0.83.0: host.site.config (plan T12 J3): the capability, host.site-config@1 with its request and result contracts and fixtures, listed by the Host service manifest. Additive (compat vs v0.82.0: no breaking changes).

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 67bd25d4..a62c4df9 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,14 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
++## 0.83.0 — 2026-09-29
++
++**Host site configuration** (plan T12 J3): the capability `host.site.config` (active, first-party, `host:write`, project
++role checked by Host) with `host.site-config@1`, `host.site-config-request@1` and `host.site-config-result@1` and their
++fixtures, listed by `manifests/services/host.json`. GET, PUT and DELETE `/api/v1/sites/:id/config` read, replace and
++reset a site's response headers (the platform's security, routing, caching, scope and transport headers and every
++X-Forwarded-* are refused), its local-only redirects and its SPA fallback. Additive.
++
  ## 0.82.0 — 2026-09-29
  
  **Space and the media hub: the forum moves off Community and the three new products register** (plan T10, D1–D4).
ddiff --git a/contracts/catalog.json b/contracts/catalog.json
iindex ded6e096..b970c25e 100644
---- a/contracts/catalog.json
++++ b/contracts/catalog.json
@@@ -5089,6 +5089,33 @@
        "compatibility": "backward",
        "status": "active"
      },
++    {
++      "id": "host.site-config",
++      "version": "1.0.0",
++      "owner": "host",
++      "schema": "host/site-config.v1.json",
++      "visibility": "first-party",
++      "compatibility": "backward",
++      "status": "active"
++    },
++    {
++      "id": "host.site-config-request",
++      "version": "1.0.0",
++      "owner": "host",
++      "schema": "host/site-config-request.v1.json",
++      "visibility": "first-party",
++      "compatibility": "backward",
++      "status": "active"
++    },
++    {
++      "id": "host.site-config-result",
++      "version": "1.0.0",
++      "owner": "host",
++      "schema": "host/site-config-result.v1.json",
++      "visibility": "first-party",
++      "compatibility": "backward",
++      "status": "active"
++    },
      {
        "id": "host.deploy.activated",
        "version": "1.0.0",
ddiff --git a/contracts/host/site-config-request.v1.json b/contracts/host/site-config-request.v1.json
nnew file mode 100644
iindex 00000000..9cecc2ef
---- /dev/null
++++ b/contracts/host/site-config-request.v1.json
@@@ -0,0 +1,28 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/host/site-config-request.v1.json",
++  "title": "HostSiteConfigRequest",
++  "description": "host.site-config-request@1: the body of PUT /api/v1/sites/:id/config on OpenVibe.Host (host.site.config; the acting principal must be a maintainer or owner of the site's project). { headers?, redirects?, spa? } replaces the whole configuration: a field left out is reset to its default. A redirect's status defaults to 301. Refusals are 422 problem+json: site_config.reserved_header, site_config.header_name, site_config.header_value (longer than 1024 characters or a control character), site_config.too_many (over 50 headers or 200 redirects), site_config.redirect (not a local path, a duplicate from, or a status outside 301/302/307/308), site_config.headers and site_config.redirects (wrong type). GET and DELETE /api/v1/sites/:id/config take no body (DELETE resets to the defaults).",
++  "type": "object",
++  "additionalProperties": false,
++  "properties": {
++    "headers": {
++      "type": "object",
++      "additionalProperties": { "type": "string" }
++    },
++    "redirects": {
++      "type": "array",
++      "items": {
++        "type": "object",
++        "additionalProperties": false,
++        "required": ["from", "to"],
++        "properties": {
++          "from": { "type": "string" },
++          "to": { "type": "string" },
++          "status": { "enum": [301, 302, 307, 308] }
++        }
++      }
++    },
++    "spa": { "type": "boolean" }
++  }
++}
ddiff --git a/contracts/host/site-config-result.v1.json b/contracts/host/site-config-result.v1.json
nnew file mode 100644
iindex 00000000..f01243e2
---- /dev/null
++++ b/contracts/host/site-config-result.v1.json
@@@ -0,0 +1,12 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/host/site-config-result.v1.json",
++  "title": "HostSiteConfigResult",
++  "description": "host.site-config-result@1: every answer of host.site.config on OpenVibe.Host. GET, PUT and DELETE /api/v1/sites/:id/config → { config } (after a PUT, the configuration as stored; after a DELETE, the defaults).",
++  "type": "object",
++  "additionalProperties": false,
++  "required": ["config"],
++  "properties": {
++    "config": { "$ref": "site-config.v1.json" }
++  }
++}
ddiff --git a/contracts/host/site-config.v1.json b/contracts/host/site-config.v1.json
nnew file mode 100644
iindex 00000000..617eda38
---- /dev/null
++++ b/contracts/host/site-config.v1.json
@@@ -0,0 +1,32 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/host/site-config.v1.json",
++  "title": "HostSiteConfig",
++  "description": "host.site-config@1: one Host site's serving configuration (plan T12 J3). headers are applied to every response of the site before the platform's own, which always win; the platform's security, routing, caching, scope and transport headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, Cache-Control, Content-Type, Location, Service-Worker-Allowed, Alt-Svc and the rest of Host's reserved list) and every X-Forwarded-* header are refused. redirects are local paths only (no scheme, host, protocol-relative URL, backslash or control character, also after percent-decoding). spa serves /index.html for an extensionless path that has no file. A site with no configuration answers { headers: {}, redirects: [], spa: false }.",
++  "type": "object",
++  "additionalProperties": false,
++  "required": ["headers", "redirects", "spa"],
++  "properties": {
++    "headers": {
++      "type": "object",
++      "maxProperties": 50,
++      "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9-]{0,63}$" },
++      "additionalProperties": { "type": "string", "maxLength": 1024 }
++    },
++    "redirects": {
++      "type": "array",
++      "maxItems": 200,
++      "items": {
++        "type": "object",
++        "additionalProperties": false,
++        "required": ["from", "to", "status"],
++        "properties": {
++          "from": { "type": "string", "pattern": "^/(?!/)", "maxLength": 1024 },
++          "to": { "type": "string", "pattern": "^/(?!/)", "maxLength": 1024 },
++          "status": { "enum": [301, 302, 307, 308] }
++        }
++      }
++    },
++    "spa": { "type": "boolean" }
++  }
++}
ddiff --git a/fixtures/host.site-config-request/invalid/bad-status.json b/fixtures/host.site-config-request/invalid/bad-status.json
nnew file mode 100644
iindex 00000000..76dcfa9a
---- /dev/null
++++ b/fixtures/host.site-config-request/invalid/bad-status.json
@@@ -0,0 +1 @@
++{ "redirects": [{ "from": "/a", "to": "/b", "status": 303 }] }
ddiff --git a/fixtures/host.site-config-request/valid/full.json b/fixtures/host.site-config-request/valid/full.json
nnew file mode 100644
iindex 00000000..3d57f7d7
---- /dev/null
++++ b/fixtures/host.site-config-request/valid/full.json
@@@ -0,0 +1 @@
++{ "headers": { "X-Frame-Options": "SAMEORIGIN" }, "redirects": [{ "from": "/docs", "to": "/docs/" }], "spa": true }
ddiff --git a/fixtures/host.site-config-request/valid/reset.json b/fixtures/host.site-config-request/valid/reset.json
nnew file mode 100644
iindex 00000000..0967ef42
---- /dev/null
++++ b/fixtures/host.site-config-request/valid/reset.json
@@@ -0,0 +1 @@
++{}
ddiff --git a/fixtures/host.site-config-result/invalid/missing-spa.json b/fixtures/host.site-config-result/invalid/missing-spa.json
nnew file mode 100644
iindex 00000000..66003f5e
---- /dev/null
++++ b/fixtures/host.site-config-result/invalid/missing-spa.json
@@@ -0,0 +1 @@
++{ "config": { "headers": {}, "redirects": [] } }
ddiff --git a/fixtures/host.site-config-result/valid/stored.json b/fixtures/host.site-config-result/valid/stored.json
nnew file mode 100644
iindex 00000000..bc56e4ac
---- /dev/null
++++ b/fixtures/host.site-config-result/valid/stored.json
@@@ -0,0 +1 @@
++{ "config": { "headers": { "X-Frame-Options": "DENY" }, "redirects": [], "spa": false } }
ddiff --git a/fixtures/host.site-config/invalid/protocol-relative.json b/fixtures/host.site-config/invalid/protocol-relative.json
nnew file mode 100644
iindex 00000000..a91f8d2b
---- /dev/null
++++ b/fixtures/host.site-config/invalid/protocol-relative.json
@@@ -0,0 +1 @@
++{ "headers": {}, "redirects": [{ "from": "/a", "to": "//evil.example/", "status": 301 }], "spa": false }
ddiff --git a/fixtures/host.site-config/valid/configured.json b/fixtures/host.site-config/valid/configured.json
nnew file mode 100644
iindex 00000000..4f12a6ff
---- /dev/null
++++ b/fixtures/host.site-config/valid/configured.json
@@@ -0,0 +1 @@
++{ "headers": { "X-Frame-Options": "DENY", "Access-Control-Allow-Origin": "*" }, "redirects": [{ "from": "/old", "to": "/new", "status": 301 }], "spa": true }
ddiff --git a/fixtures/host.site-config/valid/defaults.json b/fixtures/host.site-config/valid/defaults.json
nnew file mode 100644
iindex 00000000..f37c9be4
---- /dev/null
++++ b/fixtures/host.site-config/valid/defaults.json
@@@ -0,0 +1 @@
++{ "headers": {}, "redirects": [], "spa": false }
ddiff --git a/generated/json-schema/bundle.json b/generated/json-schema/bundle.json
iindex ca1a86f0..57117289 100644
---- a/generated/json-schema/bundle.json
++++ b/generated/json-schema/bundle.json
@@@ -56267,6 +56267,145 @@
          ]
        }
      },
++    "host.site-config": {
++      "version": "1.0.0",
++      "owner": "host",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/host/site-config.v1.json",
++        "title": "HostSiteConfig",
++        "description": "host.site-config@1: one Host site's serving configuration (plan T12 J3). headers are applied to every response of the site before the platform's own, which always win; the platform's security, routing, caching, scope and transport headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, Cache-Control, Content-Type, Location, Service-Worker-Allowed, Alt-Svc and the rest of Host's reserved list) and every X-Forwarded-* header are refused. redirects are local paths only (no scheme, host, protocol-relative URL, backslash or control character, also after percent-decoding). spa serves /index.html for an extensionless path that has no file. A site with no configuration answers { headers: {}, redirects: [], spa: false }.",
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "headers",
++          "redirects",
++          "spa"
++        ],
++        "properties": {
++          "headers": {
++            "type": "object",
++            "maxProperties": 50,
++            "propertyNames": {
++              "pattern": "^[A-Za-z0-9][A-Za-z0-9-]{0,63}$"
++            },
++            "additionalProperties": {
++              "type": "string",
++              "maxLength": 1024
++            }
++          },
++          "redirects": {
++            "type": "array",
++            "maxItems": 200,
++            "items": {
++              "type": "object",
++              "additionalProperties": false,
++              "required": [
++                "from",
++                "to",
++                "status"
++              ],
++              "properties": {
++                "from": {
++                  "type": "string",
++                  "pattern": "^/(?!/)",
++                  "maxLength": 1024
++                },
++                "to": {
++                  "type": "string",
++                  "pattern": "^/(?!/)",
++                  "maxLength": 1024
++                },
++                "status": {
++                  "enum": [
++                    301,
++                    302,
++                    307,
++                    308
++                  ]
++                }
++              }
++            }
++          },
++          "spa": {
++            "type": "boolean"
++          }
++        }
++      }
++    },
++    "host.site-config-request": {
++      "version": "1.0.0",
++      "owner": "host",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/host/site-config-request.v1.json",
++        "title": "HostSiteConfigRequest",
++        "description": "host.site-config-request@1: the body of PUT /api/v1/sites/:id/config on OpenVibe.Host (host.site.config; the acting principal must be a maintainer or owner of the site's project). { headers?, redirects?, spa? } replaces the whole configuration: a field left out is reset to its default. A redirect's status defaults to 301. Refusals are 422 problem+json: site_config.reserved_header, site_config.header_name, site_config.header_value (longer than 1024 characters or a control character), site_config.too_many (over 50 headers or 200 redirects), site_config.redirect (not a local path, a duplicate from, or a status outside 301/302/307/308), site_config.headers and site_config.redirects (wrong type). GET and DELETE /api/v1/sites/:id/config take no body (DELETE resets to the defaults).",
++        "type": "object",
++        "additionalProperties": false,
++        "properties": {
++          "headers": {
++            "type": "object",
++            "additionalProperties": {
++              "type": "string"
++            }
++          },
++          "redirects": {
++            "type": "array",
++            "items": {
++              "type": "object",
++              "additionalProperties": false,
++              "required": [
++                "from",
++                "to"
++              ],
++              "properties": {
++                "from": {
++                  "type": "string"
++                },
++                "to": {
++                  "type": "string"
++                },
++                "status": {
++                  "enum": [
++                    301,
++                    302,
++                    307,
++                    308
++                  ]
++                }
++              }
++            }
++          },
++          "spa": {
++            "type": "boolean"
++          }
++        }
++      }
++    },
++    "host.site-config-result": {
++      "version": "1.0.0",
++      "owner": "host",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/host/site-config-result.v1.json",
++        "title": "HostSiteConfigResult",
++        "description": "host.site-config-result@1: every answer of host.site.config on OpenVibe.Host. GET, PUT and DELETE /api/v1/sites/:id/config → { config } (after a PUT, the configuration as stored; after a DELETE, the defaults).",
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "config"
++        ],
++        "properties": {
++          "config": {
++            "$ref": "site-config.v1.json"
++          }
++        }
++      }
++    },
      "host.deploy.activated": {
        "version": "1.0.0",
        "owner": "host",
ddiff --git a/generated/openapi/ai.json b/generated/openapi/ai.json
iindex 52476d07..9e17f058 100644
---- a/generated/openapi/ai.json
++++ b/generated/openapi/ai.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.AI API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/billing.json b/generated/openapi/billing.json
iindex 1a5c957c..6b2a068c 100644
---- a/generated/openapi/billing.json
++++ b/generated/openapi/billing.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Billing API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/blog.json b/generated/openapi/blog.json
iindex 29af17e6..1b76d39e 100644
---- a/generated/openapi/blog.json
++++ b/generated/openapi/blog.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Blog API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/chat.json b/generated/openapi/chat.json
iindex 5e6edcde..a19c3d26 100644
---- a/generated/openapi/chat.json
++++ b/generated/openapi/chat.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Chat API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/codes.json b/generated/openapi/codes.json
iindex 1174de89..c525bb37 100644
---- a/generated/openapi/codes.json
++++ b/generated/openapi/codes.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Codes API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/community.json b/generated/openapi/community.json
iindex d23c207d..2ecc63fc 100644
---- a/generated/openapi/community.json
++++ b/generated/openapi/community.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Community API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json
iindex 5894178d..3667e953 100644
---- a/generated/openapi/coupons.json
++++ b/generated/openapi/coupons.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Coupons API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/deals.json b/generated/openapi/deals.json
iindex 335a2398..da210e10 100644
---- a/generated/openapi/deals.json
++++ b/generated/openapi/deals.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Deals API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/events.json b/generated/openapi/events.json
iindex 950d306b..05da06c1 100644
---- a/generated/openapi/events.json
++++ b/generated/openapi/events.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Events API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/games.json b/generated/openapi/games.json
iindex 3fe4f47b..1af167f9 100644
---- a/generated/openapi/games.json
++++ b/generated/openapi/games.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Games API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex 53c4e976..48fd5044 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Host API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
@@@ -1225,6 +1225,288 @@
      }
     }
    },
++  "/api/v1/sites/{id}/config": {
++   "delete": {
++    "operationId": "delete_api_v1_sites_id_config",
++    "summary": "Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html).",
++    "description": "**host.site.config** (first-party): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
++    "tags": [
++     "host.site"
++    ],
++    "x-openvibe-capabilities": [
++     "host.site.config"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "host-manage",
++    "security": [
++     {
++      "openvibeToken": [
++       "host.site.config"
++      ]
++     }
++    ],
++    "x-openvibe-input": {
++     "$ref": "#/components/schemas/host.site-config-request.v1"
++    },
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     },
++     {
++      "name": "headers",
++      "in": "query",
++      "required": false,
++      "schema": {
++       "type": "object",
++       "additionalProperties": {
++        "type": "string"
++       }
++      }
++     },
++     {
++      "name": "redirects",
++      "in": "query",
++      "required": false,
++      "schema": {
++       "type": "array",
++       "items": {
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++         "from",
++         "to"
++        ],
++        "properties": {
++         "from": {
++          "type": "string"
++         },
++         "to": {
++          "type": "string"
++         },
++         "status": {
++          "enum": [
++           301,
++           302,
++           307,
++           308
++          ]
++         }
++        }
++       }
++      }
++     },
++     {
++      "name": "spa",
++      "in": "query",
++      "required": false,
++      "schema": {
++       "type": "boolean"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/host.site-config-result.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   },
++   "get": {
++    "operationId": "get_api_v1_sites_id_config",
++    "summary": "Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html).",
++    "description": "**host.site.config** (first-party): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
++    "tags": [
++     "host.site"
++    ],
++    "x-openvibe-capabilities": [
++     "host.site.config"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "host-manage",
++    "security": [
++     {
++      "openvibeToken": [
++       "host.site.config"
++      ]
++     }
++    ],
++    "x-openvibe-input": {
++     "$ref": "#/components/schemas/host.site-config-request.v1"
++    },
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     },
++     {
++      "name": "headers",
++      "in": "query",
++      "required": false,
++      "schema": {
++       "type": "object",
++       "additionalProperties": {
++        "type": "string"
++       }
++      }
++     },
++     {
++      "name": "redirects",
++      "in": "query",
++      "required": false,
++      "schema": {
++       "type": "array",
++       "items": {
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++         "from",
++         "to"
++        ],
++        "properties": {
++         "from": {
++          "type": "string"
++         },
++         "to": {
++          "type": "string"
++         },
++         "status": {
++          "enum": [
++           301,
++           302,
++           307,
++           308
++          ]
++         }
++        }
++       }
++      }
++     },
++     {
++      "name": "spa",
++      "in": "query",
++      "required": false,
++      "schema": {
++       "type": "boolean"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/host.site-config-result.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   },
++   "put": {
++    "operationId": "put_api_v1_sites_id_config",
++    "summary": "Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html).",
++    "description": "**host.site.config** (first-party): Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
++    "tags": [
++     "host.site"
++    ],
++    "x-openvibe-capabilities": [
++     "host.site.config"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "host-manage",
++    "security": [
++     {
++      "openvibeToken": [
++       "host.site.config"
++      ]
++     }
++    ],
++    "requestBody": {
++     "required": false,
++     "content": {
++      "application/json": {
++       "schema": {
++        "$ref": "#/components/schemas/host.site-config-request.v1"
++       }
++      }
++     }
++    },
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/host.site-config-result.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
    "/api/v1/sites/{id}/deploys": {
     "get": {
      "operationId": "get_api_v1_sites_id_deploys",
@@@ -2435,6 +2717,124 @@
       }
      }
     },
++   "host.site-config-request.v1": {
++    "title": "HostSiteConfigRequest",
++    "description": "host.site-config-request@1: the body of PUT /api/v1/sites/:id/config on OpenVibe.Host (host.site.config; the acting principal must be a maintainer or owner of the site's project). { headers?, redirects?, spa? } replaces the whole configuration: a field left out is reset to its default. A redirect's status defaults to 301. Refusals are 422 problem+json: site_config.reserved_header, site_config.header_name, site_config.header_value (longer than 1024 characters or a control character), site_config.too_many (over 50 headers or 200 redirects), site_config.redirect (not a local path, a duplicate from, or a status outside 301/302/307/308), site_config.headers and site_config.redirects (wrong type). GET and DELETE /api/v1/sites/:id/config take no body (DELETE resets to the defaults).",
++    "type": "object",
++    "additionalProperties": false,
++    "properties": {
++     "headers": {
++      "type": "object",
++      "additionalProperties": {
++       "type": "string"
++      }
++     },
++     "redirects": {
++      "type": "array",
++      "items": {
++       "type": "object",
++       "additionalProperties": false,
++       "required": [
++        "from",
++        "to"
++       ],
++       "properties": {
++        "from": {
++         "type": "string"
++        },
++        "to": {
++         "type": "string"
++        },
++        "status": {
++         "enum": [
++          301,
++          302,
++          307,
++          308
++         ]
++        }
++       }
++      }
++     },
++     "spa": {
++      "type": "boolean"
++     }
++    }
++   },
++   "host.site-config-result.v1": {
++    "title": "HostSiteConfigResult",
++    "description": "host.site-config-result@1: every answer of host.site.config on OpenVibe.Host. GET, PUT and DELETE /api/v1/sites/:id/config → { config } (after a PUT, the configuration as stored; after a DELETE, the defaults).",
++    "type": "object",
++    "additionalProperties": false,
++    "required": [
++     "config"
++    ],
++    "properties": {
++     "config": {
++      "$ref": "#/components/schemas/host.site-config.v1"
++     }
++    }
++   },
++   "host.site-config.v1": {
++    "title": "HostSiteConfig",
++    "description": "host.site-config@1: one Host site's serving configuration (plan T12 J3). headers are applied to every response of the site before the platform's own, which always win; the platform's security, routing, caching, scope and transport headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, Cache-Control, Content-Type, Location, Service-Worker-Allowed, Alt-Svc and the rest of Host's reserved list) and every X-Forwarded-* header are refused. redirects are local paths only (no scheme, host, protocol-relative URL, backslash or control character, also after percent-decoding). spa serves /index.html for an extensionless path that has no file. A site with no configuration answers { headers: {}, redirects: [], spa: false }.",
++    "type": "object",
++    "additionalProperties": false,
++    "required": [
++     "headers",
++     "redirects",
++     "spa"
++    ],
++    "properties": {
++     "headers": {
++      "type": "object",
++      "maxProperties": 50,
++      "propertyNames": {
++       "pattern": "^[A-Za-z0-9][A-Za-z0-9-]{0,63}$"
++      },
++      "additionalProperties": {
++       "type": "string",
++       "maxLength": 1024
++      }
++     },
++     "redirects": {
++      "type": "array",
++      "maxItems": 200,
++      "items": {
++       "type": "object",
++       "additionalProperties": false,
++       "required": [
++        "from",
++        "to",
++        "status"
++       ],
++       "properties": {
++        "from": {
++         "type": "string",
++         "pattern": "^/(?!/)",
++         "maxLength": 1024
++        },
++        "to": {
++         "type": "string",
++         "pattern": "^/(?!/)",
++         "maxLength": 1024
++        },
++        "status": {
++         "enum": [
++          301,
++          302,
++          307,
++          308
++         ]
++        }
++       }
++      }
++     },
++     "spa": {
++      "type": "boolean"
++     }
++    }
++   },
     "host.site-manage-request.v1": {
      "title": "HostSiteManageRequest",
      "description": "host.site-manage-request@1: bodies of host.site.manage on OpenVibe.Host (judged by the acting principal's project role too; a sandbox token is refused on production projects). POST /api/v1/projects { name, environment?, network_project_id? } creates a project owned by the person named with X-OV-Subject (403 project.owner_must_be_user; 422 project.invalid_name over 80 characters, project.invalid_environment; 429 quota.projects; 409 project.network_project_taken). PUT /api/v1/projects/:id/quota { storage_bytes?, deploys_per_day?, max_files?, max_file_bytes?, sites?, custom_domains? } (a Network staff user: 403 auth.staff_only; fields left out keep their value). PUT /api/v1/projects/:id/members/:principal { role } (the owner: 422 member.invalid_role, 409 member.owner_fixed). POST /api/v1/projects/:id/sites { name } (a maintainer; lowercased and trimmed, one DNS label of 3–40 characters: 422 site.invalid_name, site.name_reserved; 409 site.name_taken, site.name_held; 429 quota.sites). POST /api/v1/projects/:id/takedown and /sites/:id/takedown { reason } (staff: stop serving, keep the content; 409 takedown.exists); DELETE on those { note? } lifts it. GET /api/v1/projects, /projects/:id, /projects/:id/quota, /projects/:id/sites and /sites/:id, and DELETE /api/v1/projects/:id, /projects/:id/members/:principal, /sites/:id and /deploys/:id take no body (deleting refuses taken-down content for non-staff: 409 site.taken_down; an active deploy: 409 deploy.active).",
ddiff --git a/generated/openapi/index.json b/generated/openapi/index.json
iindex 0fac9a2e..246b10d3 100644
---- a/generated/openapi/index.json
++++ b/generated/openapi/index.json
@@@ -75,8 +75,8 @@
        "service": "host",
        "name": "OpenVibe.Host",
        "origin": "https://openvibe.host",
--      "operations": 27,
--      "capabilities": 3
++      "operations": 30,
++      "capabilities": 4
      },
      {
        "service": "live",
ddiff --git a/generated/openapi/live.json b/generated/openapi/live.json
iindex 67d46226..d1be75e8 100644
---- a/generated/openapi/live.json
++++ b/generated/openapi/live.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Live API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media.json b/generated/openapi/media.json
iindex fbc0f7f4..af77b1d2 100644
---- a/generated/openapi/media.json
++++ b/generated/openapi/media.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Media API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/network.json b/generated/openapi/network.json
iindex 34e2d5a3..74459c01 100644
---- a/generated/openapi/network.json
++++ b/generated/openapi/network.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Network API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/news.json b/generated/openapi/news.json
iindex 6a3e9d77..d49eca7e 100644
---- a/generated/openapi/news.json
++++ b/generated/openapi/news.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.News API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/openre.json b/generated/openapi/openre.json
iindex c4af2a25..2645d3b2 100644
---- a/generated/openapi/openre.json
++++ b/generated/openapi/openre.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenRe.Stream API",
--  "version": "0.82.0",
--  "description": "Routes of OpenRe.Stream as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenRe.Stream as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json
iindex a5e09b52..e8e6b191 100644
---- a/generated/openapi/reviews.json
++++ b/generated/openapi/reviews.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Reviews API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/search.json b/generated/openapi/search.json
iindex c7f03474..9d1e663b 100644
---- a/generated/openapi/search.json
++++ b/generated/openapi/search.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Search API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/sources.json b/generated/openapi/sources.json
iindex 56becb80..d84cd495 100644
---- a/generated/openapi/sources.json
++++ b/generated/openapi/sources.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Sources API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/space.json b/generated/openapi/space.json
iindex a07e6701..69cf8f34 100644
---- a/generated/openapi/space.json
++++ b/generated/openapi/space.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Space API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tips.json b/generated/openapi/tips.json
iindex 54381901..f1210991 100644
---- a/generated/openapi/tips.json
++++ b/generated/openapi/tips.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tips API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tools.json b/generated/openapi/tools.json
iindex 480da12b..052b31f1 100644
---- a/generated/openapi/tools.json
++++ b/generated/openapi/tools.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tools API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/trade.json b/generated/openapi/trade.json
iindex a6e8d654..6270386d 100644
---- a/generated/openapi/trade.json
++++ b/generated/openapi/trade.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Trade API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vip.json b/generated/openapi/vip.json
iindex 9db5d9f1..f397149f 100644
---- a/generated/openapi/vip.json
++++ b/generated/openapi/vip.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.VIP API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json
iindex f4d0578d..8d15962b 100644
---- a/generated/openapi/wiki.json
++++ b/generated/openapi/wiki.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Wiki API",
--  "version": "0.82.0",
--  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.82.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.83.0",
++  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.83.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/typescript/index.d.ts b/generated/typescript/index.d.ts
iindex 73345c1d..e974e26f 100644
---- a/generated/typescript/index.d.ts
++++ b/generated/typescript/index.d.ts
@@@ -46659,6 +46659,49 @@ export type HostSiteManageRequest =
      }
    | NoBody;
  
++/** [email protected] (owner: host) */
++/**
++ * host.site-config@1: one Host site's serving configuration (plan T12 J3). headers are applied to every response of the site before the platform's own, which always win; the platform's security, routing, caching, scope and transport headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, Cache-Control, Content-Type, Location, Service-Worker-Allowed, Alt-Svc and the rest of Host's reserved list) and every X-Forwarded-* header are refused. redirects are local paths only (no scheme, host, protocol-relative URL, backslash or control character, also after percent-decoding). spa serves /index.html for an extensionless path that has no file. A site with no configuration answers { headers: {}, redirects: [], spa: false }.
++ */
++export interface HostSiteConfig {
++  headers: {
++    [k: string]: string | undefined;
++  };
++  /**
++   * @maxItems 200
++   */
++  redirects: {
++    from: string;
++    to: string;
++    status: 301 | 302 | 307 | 308;
++  }[];
++  spa: boolean;
++}
++
++/** [email protected] (owner: host) */
++/**
++ * host.site-config-request@1: the body of PUT /api/v1/sites/:id/config on OpenVibe.Host (host.site.config; the acting principal must be a maintainer or owner of the site's project). { headers?, redirects?, spa? } replaces the whole configuration: a field left out is reset to its default. A redirect's status defaults to 301. Refusals are 422 problem+json: site_config.reserved_header, site_config.header_name, site_config.header_value (longer than 1024 characters or a control character), site_config.too_many (over 50 headers or 200 redirects), site_config.redirect (not a local path, a duplicate from, or a status outside 301/302/307/308), site_config.headers and site_config.redirects (wrong type). GET and DELETE /api/v1/sites/:id/config take no body (DELETE resets to the defaults).
++ */
++export interface HostSiteConfigRequest {
++  headers?: {
++    [k: string]: string | undefined;
++  };
++  redirects?: {
++    from: string;
++    to: string;
++    status?: 301 | 302 | 307 | 308;
++  }[];
++  spa?: boolean;
++}
++
++/** [email protected] (owner: host) */
++/**
++ * host.site-config-result@1: every answer of host.site.config on OpenVibe.Host. GET, PUT and DELETE /api/v1/sites/:id/config → { config } (after a PUT, the configuration as stored; after a DELETE, the defaults).
++ */
++export interface HostSiteConfigResult {
++  config: HostSiteConfig;
++}
++
  /** [email protected] (owner: host) */
  /**
   * host.deploy.activated v1 (OpenVibe.Host server/domain/deploys.js switchPointer, Stage B tenant hosting). A tenant site's active deploy changed, written into Host's event outbox in the transaction that moves the pointer (activate or rollback). Envelope: subject { type: deploy, id: <deploy id> }, visibility internal, priority low, actor the person or app that switched it. A network service's release going live is host.release.published, not this.
ddiff --git a/manifests/capabilities/host.site.config.json b/manifests/capabilities/host.site.config.json
nnew file mode 100644
iindex 00000000..d56b5f06
---- /dev/null
++++ b/manifests/capabilities/host.site.config.json
@@@ -0,0 +1,23 @@
++{
++  "id": "host.site.config",
++  "version": "1.0",
++  "owner": "host",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Read, set and reset a Host site's serving configuration: response headers, local-only redirects and the SPA fallback (extensionless paths serve index.html). A capability holder must also hold the acting principal's project role (maintainer or owner to change, any role to read). Reserved headers (Content-Security-Policy, Strict-Transport-Security, Set-Cookie, X-Forwarded-*, caching, scope, transport and the platform's own) are refused, and a redirect target must be a local path, so a site can never become an open redirect.",
++  "permissions": [
++    "host:write"
++  ],
++  "resourceConstraints": [
++    "project"
++  ],
++  "quotaClass": "host-manage",
++  "events": [],
++  "implementedBy": [
++    "GET /api/v1/sites/:id/config",
++    "PUT /api/v1/sites/:id/config",
++    "DELETE /api/v1/sites/:id/config"
++  ],
++  "inputSchema": "host.site-config-request@1",
++  "outputSchema": "host.site-config-result@1"
++}
ddiff --git a/manifests/services/host.json b/manifests/services/host.json
iindex 11aae91a..37145246 100644
---- a/manifests/services/host.json
++++ b/manifests/services/host.json
@@@ -30,7 +30,8 @@
    "capabilities": [
      "host.site.manage",
      "host.deploy.create",
--    "host.domain.manage"
++    "host.domain.manage",
++    "host.site.config"
    ],
    "eventsProduced": [
      "host.deploy.created",
ddiff --git a/package.json b/package.json
iindex 68d3d504..cdc46686 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.82.0",
++  "version": "0.83.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",