0.209.0: OpenVibe.Space's deploy, site, config and domain capabilities are public (an app added to a project as deployer can deploy from CI, as the capability intended) (#196)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 93905d80..4339fb9a 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,16 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
++## 0.209.0 — 2026-10-20
++
++- OpenVibe.Space's site capabilities are public, so a developer app can be granted them: `space.deploy.create`
++  (sensitive: upload, activate and roll back deploys — "an app principal added to a project as deployer can deploy
++  from CI", which no app could do while it was first-party), `space.site.config` (headers, local redirects, the SPA
++  fallback), `space.site.manage` (sensitive: sites and members; apps still cannot own projects) and
++  `space.domain.manage` (sensitive: custom domains, served only after DNS TXT verification). Space judges every one by
++  the acting principal's project role as well: an app is a principal of its own and can touch only the projects a
++  person added it to, as deployer, maintainer or owner. Sandbox tokens stay confined to sandbox projects.
++
  ## 0.208.0 — 2026-10-20
  
  - Coupons, Deals and Trade open what a person does for themselves to apps (all three already act for an app only as
ddiff --git a/generated/openapi/actor.json b/generated/openapi/actor.json
iindex a1ac9367..93eb46b5 100644
---- a/generated/openapi/actor.json
++++ b/generated/openapi/actor.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Actor API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/ai.json b/generated/openapi/ai.json
iindex 3d376130..bfd61bf7 100644
---- a/generated/openapi/ai.json
++++ b/generated/openapi/ai.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.AI API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/billing.json b/generated/openapi/billing.json
iindex d0b04c78..b22923cd 100644
---- a/generated/openapi/billing.json
++++ b/generated/openapi/billing.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Billing API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/blog.json b/generated/openapi/blog.json
iindex 681950a5..1846c95b 100644
---- a/generated/openapi/blog.json
++++ b/generated/openapi/blog.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Blog API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bot.json b/generated/openapi/bot.json
iindex d7008483..7b00cec9 100644
---- a/generated/openapi/bot.json
++++ b/generated/openapi/bot.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bot API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/chat.json b/generated/openapi/chat.json
iindex 28a07f31..4766d68c 100644
---- a/generated/openapi/chat.json
++++ b/generated/openapi/chat.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Chat API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/codes.json b/generated/openapi/codes.json
iindex 29feda57..04bf18c4 100644
---- a/generated/openapi/codes.json
++++ b/generated/openapi/codes.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Codes API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/community.json b/generated/openapi/community.json
iindex f5a7abf7..4f77a69c 100644
---- a/generated/openapi/community.json
++++ b/generated/openapi/community.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Community API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json
iindex a916ca6e..4a843732 100644
---- a/generated/openapi/coupons.json
++++ b/generated/openapi/coupons.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Coupons API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/deals.json b/generated/openapi/deals.json
iindex 6c18e361..1592468f 100644
---- a/generated/openapi/deals.json
++++ b/generated/openapi/deals.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Deals API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/events.json b/generated/openapi/events.json
iindex 037682ea..8250acbe 100644
---- a/generated/openapi/events.json
++++ b/generated/openapi/events.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Events API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/food.json b/generated/openapi/food.json
iindex 69805169..8605d3d8 100644
---- a/generated/openapi/food.json
++++ b/generated/openapi/food.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Food API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/games.json b/generated/openapi/games.json
iindex c3447e82..4541b896 100644
---- a/generated/openapi/games.json
++++ b/generated/openapi/games.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Games API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex ac882e0f..14ccffba 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Host API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/inventory.json b/generated/openapi/inventory.json
iindex 2ade6dad..5adce7be 100644
---- a/generated/openapi/inventory.json
++++ b/generated/openapi/inventory.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Inventory API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/live.json b/generated/openapi/live.json
iindex bec98d5c..562c8e50 100644
---- a/generated/openapi/live.json
++++ b/generated/openapi/live.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Live API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media-hub.json b/generated/openapi/media-hub.json
iindex 7c021c0e..412479c0 100644
---- a/generated/openapi/media-hub.json
++++ b/generated/openapi/media-hub.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.MediaHub API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media.json b/generated/openapi/media.json
iindex 3cc3dc25..8176ff55 100644
---- a/generated/openapi/media.json
++++ b/generated/openapi/media.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Media API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/network.json b/generated/openapi/network.json
iindex 0d199eb8..717c4cc1 100644
---- a/generated/openapi/network.json
++++ b/generated/openapi/network.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Network API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/news.json b/generated/openapi/news.json
iindex 654738a2..37b00e16 100644
---- a/generated/openapi/news.json
++++ b/generated/openapi/news.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.News API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/openre.json b/generated/openapi/openre.json
iindex cd163b8f..babd16b5 100644
---- a/generated/openapi/openre.json
++++ b/generated/openapi/openre.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenRestream API",
--  "version": "0.208.0",
--  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/play.json b/generated/openapi/play.json
iindex f6da5f60..f3e9eee7 100644
---- a/generated/openapi/play.json
++++ b/generated/openapi/play.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Play API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/quest.json b/generated/openapi/quest.json
iindex 971fef77..13a16de0 100644
---- a/generated/openapi/quest.json
++++ b/generated/openapi/quest.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Quest API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json
iindex ab1ab97c..aee356ae 100644
---- a/generated/openapi/reviews.json
++++ b/generated/openapi/reviews.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Reviews API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/run.json b/generated/openapi/run.json
iindex 54ec3255..6931d3d5 100644
---- a/generated/openapi/run.json
++++ b/generated/openapi/run.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Run API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/search.json b/generated/openapi/search.json
iindex b2aa81e7..ff68f720 100644
---- a/generated/openapi/search.json
++++ b/generated/openapi/search.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Search API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/services.json b/generated/openapi/services.json
iindex ae9f0f92..d6401493 100644
---- a/generated/openapi/services.json
++++ b/generated/openapi/services.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Services API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/sources.json b/generated/openapi/sources.json
iindex 061780e5..5f203a07 100644
---- a/generated/openapi/sources.json
++++ b/generated/openapi/sources.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Sources API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/space.json b/generated/openapi/space.json
iindex e54e6dda..da27d0f5 100644
---- a/generated/openapi/space.json
++++ b/generated/openapi/space.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Space API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
@@@ -20,7 +20,7 @@
     "delete": {
      "operationId": "delete_api_v1_deploys_id",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -28,7 +28,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -77,7 +77,7 @@
     "get": {
      "operationId": "get_api_v1_deploys_id",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**space.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
++    "description": "**space.deploy.create** (public): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "space.deploy"
      ],
@@@ -85,7 +85,7 @@
       "space.deploy.create"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-deploy",
      "security": [
@@@ -136,7 +136,7 @@
     "post": {
      "operationId": "post_api_v1_deploys_id_activate",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**space.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
++    "description": "**space.deploy.create** (public): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "space.deploy"
      ],
@@@ -144,7 +144,7 @@
       "space.deploy.create"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-deploy",
      "security": [
@@@ -202,7 +202,7 @@
     "get": {
      "operationId": "get_api_v1_deploys_id_log",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**space.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
++    "description": "**space.deploy.create** (public): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "space.deploy"
      ],
@@@ -210,7 +210,7 @@
       "space.deploy.create"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-deploy",
      "security": [
@@@ -261,7 +261,7 @@
     "delete": {
      "operationId": "delete_api_v1_domains_id",
      "summary": "Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it.",
--    "description": "**space.domain.manage** (first-party): Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
++    "description": "**space.domain.manage** (public): Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
      "tags": [
       "space.domain"
      ],
@@@ -269,7 +269,7 @@
       "space.domain.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -320,7 +320,7 @@
     "post": {
      "operationId": "post_api_v1_domains_id_verify",
      "summary": "Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it.",
--    "description": "**space.domain.manage** (first-party): Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
++    "description": "**space.domain.manage** (public): Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
      "tags": [
       "space.domain"
      ],
@@@ -328,7 +328,7 @@
       "space.domain.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -386,7 +386,7 @@
     "get": {
      "operationId": "get_api_v1_projects",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -394,7 +394,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -433,7 +433,7 @@
     "post": {
      "operationId": "post_api_v1_projects",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -441,7 +441,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -489,7 +489,7 @@
     "delete": {
      "operationId": "delete_api_v1_projects_id",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -497,7 +497,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -546,7 +546,7 @@
     "get": {
      "operationId": "get_api_v1_projects_id",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -554,7 +554,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -605,7 +605,7 @@
     "delete": {
      "operationId": "delete_api_v1_projects_id_members_principal",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -613,7 +613,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -670,7 +670,7 @@
     "put": {
      "operationId": "put_api_v1_projects_id_members_principal",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -678,7 +678,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -744,7 +744,7 @@
     "get": {
      "operationId": "get_api_v1_projects_id_quota",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -752,7 +752,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -801,7 +801,7 @@
     "put": {
      "operationId": "put_api_v1_projects_id_quota",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -809,7 +809,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -867,7 +867,7 @@
     "get": {
      "operationId": "get_api_v1_projects_id_sites",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -875,7 +875,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -924,7 +924,7 @@
     "post": {
      "operationId": "post_api_v1_projects_id_sites",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -932,7 +932,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -990,7 +990,7 @@
     "delete": {
      "operationId": "delete_api_v1_projects_id_takedown",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -998,7 +998,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1047,7 +1047,7 @@
     "post": {
      "operationId": "post_api_v1_projects_id_takedown",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -1055,7 +1055,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1271,7 +1271,7 @@
     "delete": {
      "operationId": "delete_api_v1_sites_id",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -1279,7 +1279,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1328,7 +1328,7 @@
     "get": {
      "operationId": "get_api_v1_sites_id",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -1336,7 +1336,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1387,7 +1387,7 @@
     "delete": {
      "operationId": "delete_api_v1_sites_id_config",
      "summary": "Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html).",
--    "description": "**space.site.config** (first-party): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
++    "description": "**space.site.config** (public): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
      "tags": [
       "space.site"
      ],
@@@ -1395,7 +1395,7 @@
       "space.site.config"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1495,7 +1495,7 @@
     "get": {
      "operationId": "get_api_v1_sites_id_config",
      "summary": "Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html).",
--    "description": "**space.site.config** (first-party): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
++    "description": "**space.site.config** (public): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
      "tags": [
       "space.site"
      ],
@@@ -1503,7 +1503,7 @@
       "space.site.config"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1603,7 +1603,7 @@
     "put": {
      "operationId": "put_api_v1_sites_id_config",
      "summary": "Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html).",
--    "description": "**space.site.config** (first-party): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
++    "description": "**space.site.config** (public): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
      "tags": [
       "space.site"
      ],
@@@ -1611,7 +1611,7 @@
       "space.site.config"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1669,7 +1669,7 @@
     "get": {
      "operationId": "get_api_v1_sites_id_deploys",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**space.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
++    "description": "**space.deploy.create** (public): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "space.deploy"
      ],
@@@ -1677,7 +1677,7 @@
       "space.deploy.create"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-deploy",
      "security": [
@@@ -1726,7 +1726,7 @@
     "post": {
      "operationId": "post_api_v1_sites_id_deploys",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**space.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
++    "description": "**space.deploy.create** (public): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "space.deploy"
      ],
@@@ -1734,7 +1734,7 @@
       "space.deploy.create"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-deploy",
      "security": [
@@@ -1792,7 +1792,7 @@
     "get": {
      "operationId": "get_api_v1_sites_id_domains",
      "summary": "Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it.",
--    "description": "**space.domain.manage** (first-party): Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
++    "description": "**space.domain.manage** (public): Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
      "tags": [
       "space.domain"
      ],
@@@ -1800,7 +1800,7 @@
       "space.domain.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1849,7 +1849,7 @@
     "post": {
      "operationId": "post_api_v1_sites_id_domains",
      "summary": "Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it.",
--    "description": "**space.domain.manage** (first-party): Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
++    "description": "**space.domain.manage** (public): Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
      "tags": [
       "space.domain"
      ],
@@@ -1857,7 +1857,7 @@
       "space.domain.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -1915,7 +1915,7 @@
     "post": {
      "operationId": "post_api_v1_sites_id_rollback",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**space.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
++    "description": "**space.deploy.create** (public): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "space.deploy"
      ],
@@@ -1923,7 +1923,7 @@
       "space.deploy.create"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-deploy",
      "security": [
@@@ -1981,7 +1981,7 @@
     "delete": {
      "operationId": "delete_api_v1_sites_id_source",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -1989,7 +1989,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -2038,7 +2038,7 @@
     "get": {
      "operationId": "get_api_v1_sites_id_source",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -2046,7 +2046,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -2095,7 +2095,7 @@
     "put": {
      "operationId": "put_api_v1_sites_id_source",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -2103,7 +2103,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -2161,7 +2161,7 @@
     "post": {
      "operationId": "post_api_v1_sites_id_source_deploys",
      "summary": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys ",
--    "description": "**space.deploy.create** (first-party): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
++    "description": "**space.deploy.create** (public): Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
      "tags": [
       "space.deploy"
      ],
@@@ -2169,7 +2169,7 @@
       "space.deploy.create"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-deploy",
      "security": [
@@@ -2227,7 +2227,7 @@
     "delete": {
      "operationId": "delete_api_v1_sites_id_takedown",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -2235,7 +2235,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
@@@ -2284,7 +2284,7 @@
     "post": {
      "operationId": "post_api_v1_sites_id_takedown",
      "summary": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner",
--    "description": "**space.site.manage** (first-party): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
++    "description": "**space.site.manage** (public): Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
      "tags": [
       "space.site"
      ],
@@@ -2292,7 +2292,7 @@
       "space.site.manage"
      ],
      "x-openvibe-visibility": [
--     "first-party"
++     "public"
      ],
      "x-openvibe-quota-class": "space-manage",
      "security": [
ddiff --git a/generated/openapi/tips.json b/generated/openapi/tips.json
iindex b5a5784e..e0ebe057 100644
---- a/generated/openapi/tips.json
++++ b/generated/openapi/tips.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tips API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tools.json b/generated/openapi/tools.json
iindex ee25336b..b47d74ff 100644
---- a/generated/openapi/tools.json
++++ b/generated/openapi/tools.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tools API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/trade.json b/generated/openapi/trade.json
iindex 5c740bda..75e0a631 100644
---- a/generated/openapi/trade.json
++++ b/generated/openapi/trade.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Trade API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vip.json b/generated/openapi/vip.json
iindex ebdb7b4c..a2b37b61 100644
---- a/generated/openapi/vip.json
++++ b/generated/openapi/vip.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.VIP API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/watch.json b/generated/openapi/watch.json
iindex c36f402e..28f2246e 100644
---- a/generated/openapi/watch.json
++++ b/generated/openapi/watch.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Watch API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json
iindex efca6284..4bfc4065 100644
---- a/generated/openapi/wiki.json
++++ b/generated/openapi/wiki.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Wiki API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/work.json b/generated/openapi/work.json
iindex 3d7ce216..7b046910 100644
---- a/generated/openapi/work.json
++++ b/generated/openapi/work.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Work API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/zone.json b/generated/openapi/zone.json
iindex 1e9702a4..145a1c3e 100644
---- a/generated/openapi/zone.json
++++ b/generated/openapi/zone.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Zone API",
--  "version": "0.208.0",
--  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.208.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.209.0",
++  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.209.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/manifests/capabilities/space.deploy.create.json b/manifests/capabilities/space.deploy.create.json
iindex 33dc516b..8e9cdf34 100644
---- a/manifests/capabilities/space.deploy.create.json
++++ b/manifests/capabilities/space.deploy.create.json
@@@ -3,7 +3,8 @@
    "version": "1.0",
    "owner": "space",
    "status": "active",
--  "visibility": "first-party",
++  "visibility": "public",
++  "sensitive": true,
    "description": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. A site with a Git source also accepts a CI-built deploy at /sites/:id/source/deploys naming the ref and full commit_sha; it is always a preview and records that commit as immutable provenance.",
    "permissions": [
      "host:deploy"
ddiff --git a/manifests/capabilities/space.domain.manage.json b/manifests/capabilities/space.domain.manage.json
iindex f4608cd9..55d9a552 100644
---- a/manifests/capabilities/space.domain.manage.json
++++ b/manifests/capabilities/space.domain.manage.json
@@@ -3,7 +3,8 @@
    "version": "1.0",
    "owner": "space",
    "status": "active",
--  "visibility": "first-party",
++  "visibility": "public",
++  "sensitive": true,
    "description": "Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
    "permissions": [
      "space:write"
ddiff --git a/manifests/capabilities/space.site.config.json b/manifests/capabilities/space.site.config.json
iindex 9258db17..cc826c19 100644
---- a/manifests/capabilities/space.site.config.json
++++ b/manifests/capabilities/space.site.config.json
@@@ -3,7 +3,7 @@
    "version": "1.0",
    "owner": "space",
    "status": "active",
--  "visibility": "first-party",
++  "visibility": "public",
    "description": "Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
    "permissions": [
      "space:write"
ddiff --git a/manifests/capabilities/space.site.manage.json b/manifests/capabilities/space.site.manage.json
iindex 3b54ba4b..b5aa5b78 100644
---- a/manifests/capabilities/space.site.manage.json
++++ b/manifests/capabilities/space.site.manage.json
@@@ -3,7 +3,8 @@
    "version": "1.0",
    "owner": "space",
    "status": "active",
--  "visibility": "first-party",
++  "visibility": "public",
++  "sensitive": true,
    "description": "Manage OpenVibe.Space tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. Read, set or remove a site's Git source (provider, public repository URL and branch; never a credential).",
    "permissions": [
      "space:write"
ddiff --git a/package-lock.json b/package-lock.json
iindex 6c2fb505..849d7845 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.208.0",
++  "version": "0.209.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-contracts",
--      "version": "0.208.0",
++      "version": "0.209.0",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex fe950e50..d52031f0 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.208.0",
++  "version": "0.209.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",