Add blind fill contracts and approval capability (#364)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex f2c8724d..49a85545 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,9 @@
  # Changelog
  
++## 0.350.0 — 2026-11-09
++
++- Define credential-free blind fill request, encrypted grant, and outcome contracts, plus the `run.fill.approve` capability.
++
  ## 0.349.0 — 2026-11-08
  
  - Add `identity.emails@1` and `identity.email-add-request@1` and the `identity.emails.read` capability for a person's verified, privacy-limited email addresses.
ddiff --git a/contracts/catalog.json b/contracts/catalog.json
iindex 8c76b610..193fd8f7 100644
---- a/contracts/catalog.json
++++ b/contracts/catalog.json
@@@ -8472,6 +8472,60 @@
        "compatibility": "backward",
        "status": "active"
      },
++    {
++      "id": "run.fill-request",
++      "version": "1.0.0",
++      "owner": "run",
++      "schema": "run/fill-request.v1.json",
++      "visibility": "public",
++      "compatibility": "backward",
++      "status": "active"
++    },
++    {
++      "id": "run.fill-grant",
++      "version": "1.0.0",
++      "owner": "run",
++      "schema": "run/fill-grant.v1.json",
++      "visibility": "public",
++      "compatibility": "backward",
++      "status": "active"
++    },
++    {
++      "id": "run.fill-outcome",
++      "version": "1.0.0",
++      "owner": "run",
++      "schema": "run/fill-outcome.v1.json",
++      "visibility": "public",
++      "compatibility": "backward",
++      "status": "active"
++    },
++    {
++      "id": "run.fill-request-create",
++      "version": "1.0.0",
++      "owner": "run",
++      "schema": "run/fill-request-create.v1.json",
++      "visibility": "public",
++      "compatibility": "backward",
++      "status": "active"
++    },
++    {
++      "id": "run.fill-request-created",
++      "version": "1.0.0",
++      "owner": "run",
++      "schema": "run/fill-request-created.v1.json",
++      "visibility": "public",
++      "compatibility": "backward",
++      "status": "active"
++    },
++    {
++      "id": "run.fill-command",
++      "version": "1.0.0",
++      "owner": "run",
++      "schema": "run/fill-command.v1.json",
++      "visibility": "first-party",
++      "compatibility": "backward",
++      "status": "active"
++    },
      {
        "id": "bot.desk-lease",
        "version": "1.0.0",
ddiff --git a/contracts/run/fill-command.v1.json b/contracts/run/fill-command.v1.json
nnew file mode 100644
iindex 00000000..4b779515
---- /dev/null
++++ b/contracts/run/fill-command.v1.json
@@@ -0,0 +1,13 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/run/fill-command.v1.json",
++  "title": "RunFillCommand",
++  "description": "Machine-side blind fill command. Contains only the request id and sealed bytes.",
++  "type": "object",
++  "additionalProperties": false,
++  "required": ["request_id", "envelope"],
++  "properties": {
++    "request_id": {"type": "string", "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"},
++    "envelope": {"type": "string", "contentEncoding": "base64", "minLength": 12, "maxLength": 16384, "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"}
++  }
++}
ddiff --git a/contracts/run/fill-grant.v1.json b/contracts/run/fill-grant.v1.json
nnew file mode 100644
iindex 00000000..132a7af6
---- /dev/null
++++ b/contracts/run/fill-grant.v1.json
@@@ -0,0 +1,13 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/run/fill-grant.v1.json",
++  "title": "RunFillGrant",
++  "description": "Single-use encrypted grant posted by the Companion. Plaintext is never sent to Run.",
++  "type": "object",
++  "additionalProperties": false,
++  "required": ["request_id", "envelope"],
++  "properties": {
++    "request_id": {"type": "string", "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"},
++    "envelope": {"type": "string", "contentEncoding": "base64", "minLength": 12, "maxLength": 16384, "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"}
++  }
++}
ddiff --git a/contracts/run/fill-outcome.v1.json b/contracts/run/fill-outcome.v1.json
nnew file mode 100644
iindex 00000000..3b63f328
---- /dev/null
++++ b/contracts/run/fill-outcome.v1.json
@@@ -0,0 +1,19 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/run/fill-outcome.v1.json",
++  "title": "RunFillOutcome",
++  "description": "Credential-free result of a blind sign-in fill.",
++  "type": "object",
++  "additionalProperties": false,
++  "required": ["request_id", "outcome", "reason"],
++  "properties": {
++    "request_id": {"type": "string", "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"},
++    "outcome": {"enum": ["ok", "failed"]},
++    "reason": {"enum": ["origin_changed", "expired", "reused", "not_owned", "no_fields", "iframe", "decrypt_failed", "navigation", "refused", "timeout", null]}
++  },
++  "allOf": [{
++    "if": {"properties": {"outcome": {"const": "ok"}}, "required": ["outcome"]},
++    "then": {"properties": {"reason": {"const": null}}},
++    "else": {"properties": {"reason": {"enum": ["origin_changed", "expired", "reused", "not_owned", "no_fields", "iframe", "decrypt_failed", "navigation", "refused", "timeout"]}}}
++  }]
++}
ddiff --git a/contracts/run/fill-request-create.v1.json b/contracts/run/fill-request-create.v1.json
nnew file mode 100644
iindex 00000000..c6c58d4e
---- /dev/null
++++ b/contracts/run/fill-request-create.v1.json
@@@ -0,0 +1,12 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/run/fill-request-create.v1.json",
++  "title": "RunFillRequestCreate",
++  "description": "Agent request to ask the person for a blind sign-in fill. The response contains only request_id and status.",
++  "type": "object",
++  "additionalProperties": false,
++  "required": ["origin"],
++  "properties": {
++    "origin": {"type": "string", "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$"}
++  }
++}
ddiff --git a/contracts/run/fill-request-created.v1.json b/contracts/run/fill-request-created.v1.json
nnew file mode 100644
iindex 00000000..f3c898f1
---- /dev/null
++++ b/contracts/run/fill-request-created.v1.json
@@@ -0,0 +1,13 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/run/fill-request-created.v1.json",
++  "title": "RunFillRequestCreated",
++  "description": "Credential-free acknowledgement of an agent's blind fill request.",
++  "type": "object",
++  "additionalProperties": false,
++  "required": ["request_id", "status"],
++  "properties": {
++    "request_id": {"type": "string", "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"},
++    "status": {"const": "pending"}
++  }
++}
ddiff --git a/contracts/run/fill-request.v1.json b/contracts/run/fill-request.v1.json
nnew file mode 100644
iindex 00000000..b2035d83
---- /dev/null
++++ b/contracts/run/fill-request.v1.json
@@@ -0,0 +1,19 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/run/fill-request.v1.json",
++  "title": "RunFillRequest",
++  "description": "Metadata for a person's pending blind sign-in approval. Never contains credentials. The Companion must take the machine's public key from Network's list of the person's own machines by machine_node_id and show its thumbprint; it must never accept a key from Run.",
++  "type": "object",
++  "additionalProperties": false,
++  "required": ["id", "session_id", "machine_node_id", "origin", "created_at", "expires_at", "agent", "computer"],
++  "properties": {
++    "id": {"type": "string", "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"},
++    "session_id": {"$ref": "session.v1.json#/$defs/session_id"},
++    "machine_node_id": {"type": "string", "minLength": 1, "maxLength": 200},
++    "origin": {"type": "string", "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$"},
++    "created_at": {"type": "string", "format": "date-time"},
++    "expires_at": {"type": "string", "format": "date-time"},
++    "agent": {"type": "string", "maxLength": 200},
++    "computer": {"type": "string", "maxLength": 200}
++  }
++}
ddiff --git a/fixtures/run.fill-command/invalid/password.json b/fixtures/run.fill-command/invalid/password.json
nnew file mode 100644
iindex 00000000..8eaf3186
---- /dev/null
++++ b/fixtures/run.fill-command/invalid/password.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","envelope":"T1ZMSwAAAAAAAAA=","password":"must-not-be-here"}
ddiff --git a/fixtures/run.fill-command/valid/example.json b/fixtures/run.fill-command/valid/example.json
nnew file mode 100644
iindex 00000000..eca4a357
---- /dev/null
++++ b/fixtures/run.fill-command/valid/example.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","envelope":"T1ZMSwAAAAAAAAA="}
ddiff --git a/fixtures/run.fill-grant/invalid/object-envelope.json b/fixtures/run.fill-grant/invalid/object-envelope.json
nnew file mode 100644
iindex 00000000..00fd4715
---- /dev/null
++++ b/fixtures/run.fill-grant/invalid/object-envelope.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","envelope":{"ciphertext":"T1ZMSwAAAAAAAAA="}}
ddiff --git a/fixtures/run.fill-grant/invalid/plaintext-json.json b/fixtures/run.fill-grant/invalid/plaintext-json.json
nnew file mode 100644
iindex 00000000..d9a215de
---- /dev/null
++++ b/fixtures/run.fill-grant/invalid/plaintext-json.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","envelope":"{\"password\":\"must-not-be-here\"}"}
ddiff --git a/fixtures/run.fill-grant/invalid/plaintext.json b/fixtures/run.fill-grant/invalid/plaintext.json
nnew file mode 100644
iindex 00000000..81f4ce74
---- /dev/null
++++ b/fixtures/run.fill-grant/invalid/plaintext.json
@@@ -0,0 +1 @@
++{"request_id":"fill_01","envelope":"T1ZMSwAAAAAAAAA=","username":"alice","password":"must-not-be-here"}
ddiff --git a/fixtures/run.fill-grant/valid/example.json b/fixtures/run.fill-grant/valid/example.json
nnew file mode 100644
iindex 00000000..eca4a357
---- /dev/null
++++ b/fixtures/run.fill-grant/valid/example.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","envelope":"T1ZMSwAAAAAAAAA="}
ddiff --git a/fixtures/run.fill-outcome/invalid/credential.json b/fixtures/run.fill-outcome/invalid/credential.json
nnew file mode 100644
iindex 00000000..34d12740
---- /dev/null
++++ b/fixtures/run.fill-outcome/invalid/credential.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","outcome":"ok","username":"alice","password":"must-not-be-here"}
ddiff --git a/fixtures/run.fill-outcome/invalid/free-text-reason.json b/fixtures/run.fill-outcome/invalid/free-text-reason.json
nnew file mode 100644
iindex 00000000..aa150d2f
---- /dev/null
++++ b/fixtures/run.fill-outcome/invalid/free-text-reason.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","outcome":"failed","reason":"password entry failed because the page said: please retry"}
ddiff --git a/fixtures/run.fill-outcome/valid/example.json b/fixtures/run.fill-outcome/valid/example.json
nnew file mode 100644
iindex 00000000..3cd301e6
---- /dev/null
++++ b/fixtures/run.fill-outcome/valid/example.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","outcome":"ok","reason":null}
ddiff --git a/fixtures/run.fill-request-create/invalid/password.json b/fixtures/run.fill-request-create/invalid/password.json
nnew file mode 100644
iindex 00000000..c9f3f044
---- /dev/null
++++ b/fixtures/run.fill-request-create/invalid/password.json
@@@ -0,0 +1 @@
++{"origin":"https://example.org","password":"must-not-be-here"}
ddiff --git a/fixtures/run.fill-request-create/valid/example.json b/fixtures/run.fill-request-create/valid/example.json
nnew file mode 100644
iindex 00000000..81f0a28d
---- /dev/null
++++ b/fixtures/run.fill-request-create/valid/example.json
@@@ -0,0 +1 @@
++{"origin":"https://example.org"}
ddiff --git a/fixtures/run.fill-request-created/invalid/password.json b/fixtures/run.fill-request-created/invalid/password.json
nnew file mode 100644
iindex 00000000..ec000a9a
---- /dev/null
++++ b/fixtures/run.fill-request-created/invalid/password.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","status":"pending","password":"must-not-be-here"}
ddiff --git a/fixtures/run.fill-request-created/valid/example.json b/fixtures/run.fill-request-created/valid/example.json
nnew file mode 100644
iindex 00000000..6ee95561
---- /dev/null
++++ b/fixtures/run.fill-request-created/valid/example.json
@@@ -0,0 +1 @@
++{"request_id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","status":"pending"}
ddiff --git a/fixtures/run.fill-request/invalid/credential.json b/fixtures/run.fill-request/invalid/credential.json
nnew file mode 100644
iindex 00000000..d637a591
---- /dev/null
++++ b/fixtures/run.fill-request/invalid/credential.json
@@@ -0,0 +1 @@
++{"id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","session_id":"ses_01JD2C3D4E5F6G7H8J9K0MNPQR","machine_node_id":"node_01","origin":"https://example.org","created_at":"2026-11-09T10:00:00Z","expires_at":"2026-11-09T10:02:00Z","agent":"My assistant","computer":"Workstation","password":"must-not-be-here"}
ddiff --git a/fixtures/run.fill-request/valid/example.json b/fixtures/run.fill-request/valid/example.json
nnew file mode 100644
iindex 00000000..aab441f5
---- /dev/null
++++ b/fixtures/run.fill-request/valid/example.json
@@@ -0,0 +1 @@
++{"id":"fr_01JD2C3D4E5F6G7H8J9K0MNPQR","session_id":"ses_01JD2C3D4E5F6G7H8J9K0MNPQR","machine_node_id":"node_01","origin":"https://example.org","created_at":"2026-11-09T10:00:00Z","expires_at":"2026-11-09T10:02:00Z","agent":"My assistant","computer":"Workstation"}
ddiff --git a/generated/json-schema/bundle.json b/generated/json-schema/bundle.json
iindex 70e6e667..0661b95a 100644
---- a/generated/json-schema/bundle.json
++++ b/generated/json-schema/bundle.json
@@@ -94645,6 +94645,255 @@
          }
        }
      },
++    "run.fill-request": {
++      "version": "1.0.0",
++      "owner": "run",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/run/fill-request.v1.json",
++        "title": "RunFillRequest",
++        "description": "Metadata for a person's pending blind sign-in approval. Never contains credentials. The Companion must take the machine's public key from Network's list of the person's own machines by machine_node_id and show its thumbprint; it must never accept a key from Run.",
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "id",
++          "session_id",
++          "machine_node_id",
++          "origin",
++          "created_at",
++          "expires_at",
++          "agent",
++          "computer"
++        ],
++        "properties": {
++          "id": {
++            "type": "string",
++            "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"
++          },
++          "session_id": {
++            "$ref": "session.v1.json#/$defs/session_id"
++          },
++          "machine_node_id": {
++            "type": "string",
++            "minLength": 1,
++            "maxLength": 200
++          },
++          "origin": {
++            "type": "string",
++            "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$"
++          },
++          "created_at": {
++            "type": "string",
++            "format": "date-time"
++          },
++          "expires_at": {
++            "type": "string",
++            "format": "date-time"
++          },
++          "agent": {
++            "type": "string",
++            "maxLength": 200
++          },
++          "computer": {
++            "type": "string",
++            "maxLength": 200
++          }
++        }
++      }
++    },
++    "run.fill-grant": {
++      "version": "1.0.0",
++      "owner": "run",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/run/fill-grant.v1.json",
++        "title": "RunFillGrant",
++        "description": "Single-use encrypted grant posted by the Companion. Plaintext is never sent to Run.",
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "request_id",
++          "envelope"
++        ],
++        "properties": {
++          "request_id": {
++            "type": "string",
++            "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"
++          },
++          "envelope": {
++            "type": "string",
++            "contentEncoding": "base64",
++            "minLength": 12,
++            "maxLength": 16384,
++            "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
++          }
++        }
++      }
++    },
++    "run.fill-outcome": {
++      "version": "1.0.0",
++      "owner": "run",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/run/fill-outcome.v1.json",
++        "title": "RunFillOutcome",
++        "description": "Credential-free result of a blind sign-in fill.",
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "request_id",
++          "outcome",
++          "reason"
++        ],
++        "properties": {
++          "request_id": {
++            "type": "string",
++            "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"
++          },
++          "outcome": {
++            "enum": [
++              "ok",
++              "failed"
++            ]
++          },
++          "reason": {
++            "enum": [
++              "origin_changed",
++              "expired",
++              "reused",
++              "not_owned",
++              "no_fields",
++              "iframe",
++              "decrypt_failed",
++              "navigation",
++              "refused",
++              "timeout",
++              null
++            ]
++          }
++        },
++        "allOf": [
++          {
++            "if": {
++              "properties": {
++                "outcome": {
++                  "const": "ok"
++                }
++              },
++              "required": [
++                "outcome"
++              ]
++            },
++            "then": {
++              "properties": {
++                "reason": {
++                  "const": null
++                }
++              }
++            },
++            "else": {
++              "properties": {
++                "reason": {
++                  "enum": [
++                    "origin_changed",
++                    "expired",
++                    "reused",
++                    "not_owned",
++                    "no_fields",
++                    "iframe",
++                    "decrypt_failed",
++                    "navigation",
++                    "refused",
++                    "timeout"
++                  ]
++                }
++              }
++            }
++          }
++        ]
++      }
++    },
++    "run.fill-request-create": {
++      "version": "1.0.0",
++      "owner": "run",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/run/fill-request-create.v1.json",
++        "title": "RunFillRequestCreate",
++        "description": "Agent request to ask the person for a blind sign-in fill. The response contains only request_id and status.",
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "origin"
++        ],
++        "properties": {
++          "origin": {
++            "type": "string",
++            "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$"
++          }
++        }
++      }
++    },
++    "run.fill-request-created": {
++      "version": "1.0.0",
++      "owner": "run",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/run/fill-request-created.v1.json",
++        "title": "RunFillRequestCreated",
++        "description": "Credential-free acknowledgement of an agent's blind fill request.",
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "request_id",
++          "status"
++        ],
++        "properties": {
++          "request_id": {
++            "type": "string",
++            "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"
++          },
++          "status": {
++            "const": "pending"
++          }
++        }
++      }
++    },
++    "run.fill-command": {
++      "version": "1.0.0",
++      "owner": "run",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/run/fill-command.v1.json",
++        "title": "RunFillCommand",
++        "description": "Machine-side blind fill command. Contains only the request id and sealed bytes.",
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "request_id",
++          "envelope"
++        ],
++        "properties": {
++          "request_id": {
++            "type": "string",
++            "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"
++          },
++          "envelope": {
++            "type": "string",
++            "contentEncoding": "base64",
++            "minLength": 12,
++            "maxLength": 16384,
++            "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
++          }
++        }
++      }
++    },
      "bot.desk-lease": {
        "version": "1.0.0",
        "owner": "bot",
ddiff --git a/generated/openapi/actor.json b/generated/openapi/actor.json
iindex c1d9c71f..b1a33d3d 100644
---- a/generated/openapi/actor.json
++++ b/generated/openapi/actor.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Actor API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/ai.json b/generated/openapi/ai.json
iindex 7723fbd8..04a1866a 100644
---- a/generated/openapi/ai.json
++++ b/generated/openapi/ai.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.AI API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bench.json b/generated/openapi/bench.json
iindex 2513b5fb..89584f82 100644
---- a/generated/openapi/bench.json
++++ b/generated/openapi/bench.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bench API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Bench as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Bench as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/billing.json b/generated/openapi/billing.json
iindex 675ea9a6..7942ba3e 100644
---- a/generated/openapi/billing.json
++++ b/generated/openapi/billing.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Billing API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/blog.json b/generated/openapi/blog.json
iindex 197ceca8..596c9aac 100644
---- a/generated/openapi/blog.json
++++ b/generated/openapi/blog.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Blog API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bot.json b/generated/openapi/bot.json
iindex 0202f875..9995e18a 100644
---- a/generated/openapi/bot.json
++++ b/generated/openapi/bot.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bot API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/chat.json b/generated/openapi/chat.json
iindex 6d6c6c12..5b2f9e15 100644
---- a/generated/openapi/chat.json
++++ b/generated/openapi/chat.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Chat API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/codes.json b/generated/openapi/codes.json
iindex 8c1629be..6b98594e 100644
---- a/generated/openapi/codes.json
++++ b/generated/openapi/codes.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Codes API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/community.json b/generated/openapi/community.json
iindex 5868583a..4ca9ba95 100644
---- a/generated/openapi/community.json
++++ b/generated/openapi/community.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Community API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/connect.json b/generated/openapi/connect.json
iindex 9de82030..dfe4646b 100644
---- a/generated/openapi/connect.json
++++ b/generated/openapi/connect.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe Connect API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe Connect as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe Connect as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json
iindex 883dfaa6..78003f3d 100644
---- a/generated/openapi/coupons.json
++++ b/generated/openapi/coupons.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Coupons API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/deals.json b/generated/openapi/deals.json
iindex dc5a49d8..df77ccca 100644
---- a/generated/openapi/deals.json
++++ b/generated/openapi/deals.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Deals API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/design.json b/generated/openapi/design.json
iindex 47c5e993..eb82acb8 100644
---- a/generated/openapi/design.json
++++ b/generated/openapi/design.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Design API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Design as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Design as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/domains.json b/generated/openapi/domains.json
iindex 2019a6da..cc1e746d 100644
---- a/generated/openapi/domains.json
++++ b/generated/openapi/domains.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Domains API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Domains as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Domains as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/events.json b/generated/openapi/events.json
iindex a0de8f6b..f47cf6de 100644
---- a/generated/openapi/events.json
++++ b/generated/openapi/events.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Events API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/food.json b/generated/openapi/food.json
iindex bd1ea335..579d3c17 100644
---- a/generated/openapi/food.json
++++ b/generated/openapi/food.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Food API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/games.json b/generated/openapi/games.json
iindex a5dcff60..86b43f32 100644
---- a/generated/openapi/games.json
++++ b/generated/openapi/games.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Games API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex df50968c..07e6b418 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Host API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/index.json b/generated/openapi/index.json
iindex f6e9dba5..16f69822 100644
---- a/generated/openapi/index.json
++++ b/generated/openapi/index.json
@@@ -215,8 +215,8 @@
        "service": "run",
        "name": "OpenVibe.Run",
        "origin": "https://openvibe.run",
--      "operations": 14,
--      "capabilities": 9
++      "operations": 16,
++      "capabilities": 10
      },
      {
        "service": "search",
ddiff --git a/generated/openapi/inventory.json b/generated/openapi/inventory.json
iindex 0e278fa7..27f68f1c 100644
---- a/generated/openapi/inventory.json
++++ b/generated/openapi/inventory.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Inventory API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/live.json b/generated/openapi/live.json
iindex cb432569..abc98d2b 100644
---- a/generated/openapi/live.json
++++ b/generated/openapi/live.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Live API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/mail.json b/generated/openapi/mail.json
iindex fd81bec9..346a1301 100644
---- a/generated/openapi/mail.json
++++ b/generated/openapi/mail.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Mail API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Mail as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Mail as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media-hub.json b/generated/openapi/media-hub.json
iindex 44b03299..96de9e90 100644
---- a/generated/openapi/media-hub.json
++++ b/generated/openapi/media-hub.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.MediaHub API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media.json b/generated/openapi/media.json
iindex 2e2a7143..f5c032eb 100644
---- a/generated/openapi/media.json
++++ b/generated/openapi/media.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Media API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/network.json b/generated/openapi/network.json
iindex b2dc9937..0d239d34 100644
---- a/generated/openapi/network.json
++++ b/generated/openapi/network.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Network API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/news.json b/generated/openapi/news.json
iindex 680f265c..a30bdded 100644
---- a/generated/openapi/news.json
++++ b/generated/openapi/news.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.News API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/openre.json b/generated/openapi/openre.json
iindex 2b15a2b1..3103ffcc 100644
---- a/generated/openapi/openre.json
++++ b/generated/openapi/openre.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenRestream API",
--  "version": "0.349.0",
--  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/play.json b/generated/openapi/play.json
iindex 795b7b2f..939f1f31 100644
---- a/generated/openapi/play.json
++++ b/generated/openapi/play.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Play API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/quest.json b/generated/openapi/quest.json
iindex 2c1e0c2c..742dfa2f 100644
---- a/generated/openapi/quest.json
++++ b/generated/openapi/quest.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Quest API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/report.json b/generated/openapi/report.json
iindex e42de506..fa329009 100644
---- a/generated/openapi/report.json
++++ b/generated/openapi/report.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Report API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Report as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Report as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json
iindex a9e00183..dd59691c 100644
---- a/generated/openapi/reviews.json
++++ b/generated/openapi/reviews.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Reviews API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/run.json b/generated/openapi/run.json
iindex f8b31295..81cccdf1 100644
---- a/generated/openapi/run.json
++++ b/generated/openapi/run.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Run API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
@@@ -125,6 +125,144 @@
      }
     }
    },
++  "/api/v1/fill-requests": {
++   "get": {
++    "operationId": "get_api_v1_fill_requests",
++    "summary": "Read pending blind sign-in requests for the signed-in person and submit a single-use encrypted approval envelope.",
++    "description": "**run.fill.approve** (public): Read pending blind sign-in requests for the signed-in person and submit a single-use encrypted approval envelope. Responses contain request metadata and credential-free outcomes only.",
++    "tags": [
++     "run.fill"
++    ],
++    "x-openvibe-capabilities": [
++     "run.fill.approve"
++    ],
++    "x-openvibe-visibility": [
++     "public"
++    ],
++    "x-openvibe-quota-class": "run-write",
++    "security": [
++     {
++      "openvibeToken": [
++       "run.fill.approve"
++      ]
++     }
++    ],
++    "x-openvibe-input": {
++     "$ref": "#/components/schemas/run.fill-grant.v1"
++    },
++    "parameters": [
++     {
++      "name": "request_id",
++      "in": "query",
++      "required": true,
++      "schema": {
++       "type": "string",
++       "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"
++      }
++     },
++     {
++      "name": "envelope",
++      "in": "query",
++      "required": true,
++      "schema": {
++       "type": "string",
++       "contentEncoding": "base64",
++       "minLength": 12,
++       "maxLength": 16384,
++       "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/run.fill-request.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
++  "/api/v1/fill-requests/{id}/grant": {
++   "post": {
++    "operationId": "post_api_v1_fill_requests_id_grant",
++    "summary": "Read pending blind sign-in requests for the signed-in person and submit a single-use encrypted approval envelope.",
++    "description": "**run.fill.approve** (public): Read pending blind sign-in requests for the signed-in person and submit a single-use encrypted approval envelope. Responses contain request metadata and credential-free outcomes only.",
++    "tags": [
++     "run.fill"
++    ],
++    "x-openvibe-capabilities": [
++     "run.fill.approve"
++    ],
++    "x-openvibe-visibility": [
++     "public"
++    ],
++    "x-openvibe-quota-class": "run-write",
++    "security": [
++     {
++      "openvibeToken": [
++       "run.fill.approve"
++      ]
++     }
++    ],
++    "requestBody": {
++     "required": false,
++     "content": {
++      "application/json": {
++       "schema": {
++        "$ref": "#/components/schemas/run.fill-grant.v1"
++       }
++      }
++     }
++    },
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/run.fill-request.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
    "/api/v1/jobs": {
     "get": {
      "operationId": "get_api_v1_jobs",
@@@ -1281,6 +1419,79 @@
       }
      }
     },
++   "run.fill-grant.v1": {
++    "title": "RunFillGrant",
++    "description": "Single-use encrypted grant posted by the Companion. Plaintext is never sent to Run.",
++    "type": "object",
++    "additionalProperties": false,
++    "required": [
++     "request_id",
++     "envelope"
++    ],
++    "properties": {
++     "request_id": {
++      "type": "string",
++      "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"
++     },
++     "envelope": {
++      "type": "string",
++      "contentEncoding": "base64",
++      "minLength": 12,
++      "maxLength": 16384,
++      "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
++     }
++    }
++   },
++   "run.fill-request.v1": {
++    "title": "RunFillRequest",
++    "description": "Metadata for a person's pending blind sign-in approval. Never contains credentials. The Companion must take the machine's public key from Network's list of the person's own machines by machine_node_id and show its thumbprint; it must never accept a key from Run.",
++    "type": "object",
++    "additionalProperties": false,
++    "required": [
++     "id",
++     "session_id",
++     "machine_node_id",
++     "origin",
++     "created_at",
++     "expires_at",
++     "agent",
++     "computer"
++    ],
++    "properties": {
++     "id": {
++      "type": "string",
++      "pattern": "^fr_[A-Za-z0-9_-]{16,64}$"
++     },
++     "session_id": {
++      "$ref": "#/components/schemas/run.session.v1/$defs/session_id"
++     },
++     "machine_node_id": {
++      "type": "string",
++      "minLength": 1,
++      "maxLength": 200
++     },
++     "origin": {
++      "type": "string",
++      "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$"
++     },
++     "created_at": {
++      "type": "string",
++      "format": "date-time"
++     },
++     "expires_at": {
++      "type": "string",
++      "format": "date-time"
++     },
++     "agent": {
++      "type": "string",
++      "maxLength": 200
++     },
++     "computer": {
++      "type": "string",
++      "maxLength": 200
++     }
++    }
++   },
     "run.job-create-request.v1": {
      "title": "RunJobCreateRequest",
      "description": "run.job-create-request@1 (PLANNED; plan T14 R1, ADR-034): the body of POST /api/v1/jobs on OpenVibe.Run (capability run.job.submit). The job belongs to the project the caller's token names, or, for a first-party service acting for a person (X-OV-Subject), the project it names with X-OV-Project once Network confirms the person is an admin or owner of it (ADR-003 amendment 2026-10-12); the person is then the requester and the service is recorded as via. CLASS is a platform.runtime-class@1 name; Run accepts any of them but places a job only on a node that advertises worker:<class> (platform.resource-offer@1), so a class no node runs today (browser, linux, desktop, gpu) ends expired with run.job.unplaceable. ARTIFACT is the pre-registered artifact to run (name and one exact version), required for function and code, as platform.job@1 carries it. ARGS is the artifact's declared input as JSON (at most 512 KiB serialized, else 413). INPUTS are files placed in the job directory before the process starts, each an OpenVibe.Media object pinned by its sha256: a size or digest mismatch fails the job (run.job.input_digest_mismatch) before the process ever runs; Run never fetches a caller-chosen URL. LIMITS are hard caps merged stricter with the node's own (platform.job@1 limits); a request over the project's tier cap is refused 422 run.limits.exceeded, never silently lowered. EGRESS is the network the job may reach, the values of OpenVibe Link's worker.egress, carried per job as the same-named platform.job@1 net: none (default; no network), public or openvibe-only. A job asking for public or openvibe-only is placed only on a node whose worker.egress allows it; a worker whose host policy is stricter runs the stricter one. REQUIREMENTS (platform.workload-requirements@1) narrow placement; absent means { kind: run.<class>, mobility: job, latency_class: background, objective: balanced }. IDEMPOTENCY_KEY: a repeat from the same project within 24 h with an identical body answers the first job (200, created false); with a different body 409 run.idempotency.conflict. NODE pins the machine: the device id (dev_…) of the job's own machine in Run's placement (platform.resource-offer@1 node_id, as GET /api/v1/machines on OpenVibe.Bot names it), answered by 409 run.job.node_offline when that machine is not connected, never moved to another one (Codes C9c).",
ddiff --git a/generated/openapi/search.json b/generated/openapi/search.json
iindex 8323ff90..8dc5260f 100644
---- a/generated/openapi/search.json
++++ b/generated/openapi/search.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Search API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/services.json b/generated/openapi/services.json
iindex db277f0a..7f836c14 100644
---- a/generated/openapi/services.json
++++ b/generated/openapi/services.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Services API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/sources.json b/generated/openapi/sources.json
iindex a59de5ac..66759819 100644
---- a/generated/openapi/sources.json
++++ b/generated/openapi/sources.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Sources API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/space.json b/generated/openapi/space.json
iindex 4df20ff4..c2912afb 100644
---- a/generated/openapi/space.json
++++ b/generated/openapi/space.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Space API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tips.json b/generated/openapi/tips.json
iindex 0642a705..b4d1f2e5 100644
---- a/generated/openapi/tips.json
++++ b/generated/openapi/tips.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tips API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/today.json b/generated/openapi/today.json
iindex 73884f58..52ac7aa3 100644
---- a/generated/openapi/today.json
++++ b/generated/openapi/today.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Today API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Today as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Today as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tools.json b/generated/openapi/tools.json
iindex edd885ea..6afdfac8 100644
---- a/generated/openapi/tools.json
++++ b/generated/openapi/tools.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tools API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/trade.json b/generated/openapi/trade.json
iindex 8ebb136f..7abe4007 100644
---- a/generated/openapi/trade.json
++++ b/generated/openapi/trade.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Trade API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vip.json b/generated/openapi/vip.json
iindex 5ad5b212..cf47bf13 100644
---- a/generated/openapi/vip.json
++++ b/generated/openapi/vip.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.VIP API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vision.json b/generated/openapi/vision.json
iindex 2d8588f7..905fd6b4 100644
---- a/generated/openapi/vision.json
++++ b/generated/openapi/vision.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Vision API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Vision as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Vision as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/watch.json b/generated/openapi/watch.json
iindex fd8d96e2..8277a6f7 100644
---- a/generated/openapi/watch.json
++++ b/generated/openapi/watch.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Watch API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json
iindex da1b7c23..b49c5f24 100644
---- a/generated/openapi/wiki.json
++++ b/generated/openapi/wiki.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Wiki API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/work.json b/generated/openapi/work.json
iindex 5b3a210b..6a6ed303 100644
---- a/generated/openapi/work.json
++++ b/generated/openapi/work.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Work API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/zone.json b/generated/openapi/zone.json
iindex d74d6410..f13b6a1e 100644
---- a/generated/openapi/zone.json
++++ b/generated/openapi/zone.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Zone API",
--  "version": "0.349.0",
--  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.349.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.350.0",
++  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.350.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/typescript/index.d.ts b/generated/typescript/index.d.ts
iindex 5efe118a..2e7d6b52 100644
---- a/generated/typescript/index.d.ts
++++ b/generated/typescript/index.d.ts
@@@ -275362,6 +275362,79 @@ export interface RunSessionEndedPayload {
    curtain?: boolean;
  }
  
++/** [email protected] (owner: run) */
++/**
++ * Metadata for a person's pending blind sign-in approval. Never contains credentials. The Companion must take the machine's public key from Network's list of the person's own machines by machine_node_id and show its thumbprint; it must never accept a key from Run.
++ */
++export interface RunFillRequest {
++  id: string;
++  session_id: string;
++  machine_node_id: string;
++  origin: string;
++  created_at: string;
++  expires_at: string;
++  agent: string;
++  computer: string;
++}
++
++/** [email protected] (owner: run) */
++/**
++ * Single-use encrypted grant posted by the Companion. Plaintext is never sent to Run.
++ */
++export interface RunFillGrant {
++  request_id: string;
++  envelope: string;
++}
++
++/** [email protected] (owner: run) */
++/**
++ * Credential-free result of a blind sign-in fill.
++ */
++export type RunFillOutcome = {
++  [k: string]: unknown | undefined;
++} & {
++  request_id: string;
++  outcome: "ok" | "failed";
++  reason:
++    | "origin_changed"
++    | "expired"
++    | "reused"
++    | "not_owned"
++    | "no_fields"
++    | "iframe"
++    | "decrypt_failed"
++    | "navigation"
++    | "refused"
++    | "timeout"
++    | null;
++};
++
++/** [email protected] (owner: run) */
++/**
++ * Agent request to ask the person for a blind sign-in fill. The response contains only request_id and status.
++ */
++export interface RunFillRequestCreate {
++  origin: string;
++}
++
++/** [email protected] (owner: run) */
++/**
++ * Credential-free acknowledgement of an agent's blind fill request.
++ */
++export interface RunFillRequestCreated {
++  request_id: string;
++  status: "pending";
++}
++
++/** [email protected] (owner: run) */
++/**
++ * Machine-side blind fill command. Contains only the request id and sealed bytes.
++ */
++export interface RunFillCommand {
++  request_id: string;
++  envelope: string;
++}
++
  /** [email protected] (owner: bot) */
  /**
   * bot.desk-lease@1 (the Desks plan's D6): one desk OpenVibe.Bot holds for one OpenVibe.Run session, as POST /api/v1/machines/{id}/desk-leases answers it (201, capability bot.desk.session, a Run service token acting for the session's person in X-OV-Subject) and GET /api/v1/machines/{id}/desk-leases/{desk} reads it. The request is bot.desk-lease-create-request@1. Bot leases a desk only on the person's own machine where they turned on 'Let my agent use this computer' (shared false), or on a desk host whose owner offers its desks to other people and whose OpenVibe Link runs each desk in its own sandbox (describe desk.isolation sandbox; shared true). The lease starts the desk (bot.command@1 kind desk, start, kind browser, the lease's size) and from then on only the lease's person, through Run, may act on that desk, with screen, input and browser at POST /api/v1/machines/{id}/desk-leases/{desk}/commands (bot.command@1 without desk, answered by bot.command-result@1): never another desk, never the machine's own screen, files, programs or network, and on a shared host not even its owner's own commands reach a leased desk. DELETE /api/v1/machines/{id}/desk-leases/{desk} stops the desk and ends the lease; so does the machine going away (Run sees the lease gone, 404, and ends the session host_lost).
ddiff --git a/manifests/capabilities/run.fill.approve.json b/manifests/capabilities/run.fill.approve.json
nnew file mode 100644
iindex 00000000..0d119467
---- /dev/null
++++ b/manifests/capabilities/run.fill.approve.json
@@@ -0,0 +1,15 @@
++{
++  "id": "run.fill.approve",
++  "version": "1.0",
++  "owner": "run",
++  "status": "active",
++  "visibility": "public",
++  "description": "Read pending blind sign-in requests for the signed-in person and submit a single-use encrypted approval envelope. Responses contain request metadata and credential-free outcomes only.",
++  "inputSchema": "run.fill-grant@1",
++  "outputSchema": "run.fill-request@1",
++  "permissions": ["run:fill:approve"],
++  "resourceConstraints": ["owner"],
++  "quotaClass": "run-write",
++  "events": [],
++  "implementedBy": ["GET /api/v1/fill-requests", "POST /api/v1/fill-requests/:id/grant"]
++}
ddiff --git a/manifests/services/run.json b/manifests/services/run.json
iindex 99997f04..9c99a20d 100644
---- a/manifests/services/run.json
++++ b/manifests/services/run.json
@@@ -28,7 +28,8 @@
      "run.job.admin",
      "run.session.create",
      "run.session.read",
--    "run.session.control"
++    "run.session.control",
++    "run.fill.approve"
    ],
    "eventsProduced": [
      "run.job.queued",
ddiff --git a/package.json b/package.json
iindex c31d9aa6..b2ce4dc7 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.349.0",
++  "version": "0.350.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",