@ogygie/cli 0.18.0 → 0.20.0

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@ogygie/cli",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "Ogygie framework CLI: deterministic scaffolding (init), governed-file upgrades (upgrade) and lockstep verification (check) for Ogygie products.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/julienTeam/Ogygie.git",
+    "directory": "packages/ogygie-cli"
+  },
   "type": "module",
   "bin": {
     "ogygie": "dist/cli.js"
@@ -17,7 +22,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@ogygie/core": "0.18.0",
+    "@ogygie/core": "0.20.0",
     "@types/node": "^24.0.0",
     "esbuild": "^0.28.0",
     "tsx": "^4.20.0",

package/templates/project/ci/ogygie-gates.yml

@@ -4,11 +4,12 @@
 name: ogygie-gates
 on:
   push:
-    branches: [main]
+    branches: [main, "spec/**"]
   pull_request:
 
 # Least-privilege token: gitleaks-action reads the PR's commit list on
 # pull_request events; PR comments stay disabled so no write scope is needed.
+# The one job that writes (speculate) raises its own permission, alone.
 permissions:
   contents: read
   pull-requests: read
@@ -41,3 +42,126 @@ jobs:
       - uses: semgrep/semgrep-action@v1    # dangerous patterns (SAST)
         with: { config: "p/typescript p/owasp-top-ten" }
       - run: pnpm audit --audit-level=high # dependency CVEs
+
+  # Hosted mode (spec ogygie-hosted-mode B5): a pull request whose branch is
+  # spec/<id> is mergeable only once its spec is SIGNED (status validated).
+  # Require this check in the branch protection of the default branch: GitHub
+  # then holds the rule, never a UI. Any other branch passes and says so.
+  spec-signed:
+    if: "${{ github.event_name == 'pull_request' }}"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec ogygie verify-spec-signed   # reads GITHUB_HEAD_REF
+
+  # Hosted mode (spec ogygie-hosted-mode B4): on a push to spec/<id>, the
+  # generator derives on the branch what the spec declares, deterministically,
+  # and commits it there — never on the default branch — with the preview pages
+  # of a screen. The first schemas.ts of a NEW feature is drawn by the model and
+  # judged by the gates, written once; refused twice, the pull request gets the
+  # needs-operator label and nothing is generated. The holes are filled — library, draw, escalation — with the client's model key
+  # (a repo secret), the test of a candidate running without it. A repo
+  # without the generator installed is told so, and the branch is left as is.
+  # With OGYGIE_CI_TOKEN (a token allowed to push to spec/* branches), the
+  # commit it pushes gets its own checks; with the default token, it does not.
+  speculate:
+    if: "${{ github.event_name == 'push' && startsWith(github.ref_name, 'spec/') }}"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      # The needs-operator label on the branch's pull request (labels go through the issues API).
+      pull-requests: write
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: "${{ secrets.OGYGIE_CI_TOKEN || github.token }}"
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - id: generator
+        run: |
+          if node -e "require.resolve('@ogygie/generate/cli')" 2>/dev/null; then
+            echo "installed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "installed=false" >> "$GITHUB_OUTPUT"
+            echo "ogygie-gates — @ogygie/generate n'est pas installé : la branche n'est pas spéculée."
+          fi
+      - if: "${{ steps.generator.outputs.installed == 'true' }}"
+        env:
+          OGYGIE_MODEL_API_KEY: "${{ secrets.OGYGIE_MODEL_API_KEY }}"
+          GH_TOKEN: "${{ github.token }}"
+        run: |
+          SPEC_ID="${GITHUB_REF_NAME#spec/}"
+          SPEC_FILE="specs/${SPEC_ID}.spec.md"
+          if [ ! -f "$SPEC_FILE" ]; then
+            echo "ogygie-gates — $SPEC_FILE absent de la branche : rien à spéculer."
+            exit 0
+          fi
+          if ! grep -q '^# Génération' "$SPEC_FILE"; then
+            echo "ogygie-gates — $SPEC_FILE sans section # Génération : rien à générer."
+            exit 0
+          fi
+          # A NEW feature has no schemas.ts yet: the model writes the first one, the
+          # gates judge it, two attempts (exit 2 = the operator). The pull request of
+          # the branch carries the verdict as a label, so the studio can say it.
+          pnpm exec ogygie generate schemas "$SPEC_ID" || SCHEMAS_STATUS=$?
+          PR_NUMBER="$(gh pr list --head "$GITHUB_REF_NAME" --state open --json number --jq '.[0].number' 2>/dev/null || true)"
+          if [ "${SCHEMAS_STATUS:-0}" = "2" ]; then
+            if [ -n "$PR_NUMBER" ]; then
+              gh label create needs-operator --force --color D9A35A --description "Le premier schemas.ts de la feature attend l'opérateur : les gates l'ont refusé deux fois." >/dev/null
+              gh pr edit "$PR_NUMBER" --add-label needs-operator
+            fi
+            echo "ogygie-gates — le schemas.ts de $SPEC_ID attend l'opérateur (needs-operator) : rien n'est généré sur la branche."
+            exit 1
+          elif [ "${SCHEMAS_STATUS:-0}" != "0" ]; then
+            exit "$SCHEMAS_STATUS"
+          fi
+          if [ -n "$PR_NUMBER" ]; then
+            gh pr edit "$PR_NUMBER" --remove-label needs-operator 2>/dev/null || true
+          fi
+          pnpm exec ogygie generate check "$SPEC_ID"
+          pnpm exec ogygie generate generate "$SPEC_ID"
+          # The holes: the library first, then the client's model workspace key —
+          # a repo secret, present in THIS step alone; the test of a candidate
+          # runs in a process that holds no secret. Absent, the library alone.
+          pnpm exec ogygie generate fill "$SPEC_ID" || FILL_STATUS=$?
+          pnpm exec ogygie generate verify
+          if [ "${FILL_STATUS:-0}" != "0" ]; then
+            echo "ogygie-gates — des trous restent à l'humain, ou le plafond du modèle est atteint : voir le journal ci-dessus."
+          fi
+          # The previews of a screen (spec ogygie-hosted-mode B10): a page per
+          # state under previews/<id>/, committed with the derived code; not a
+          # screen, or a jsdom front: nothing to render, said, exit 0.
+          pnpm exec ogygie generate preview "$SPEC_ID"
+      - if: "${{ steps.generator.outputs.installed == 'true' }}"
+        run: |
+          # A commit that is no longer the head of the branch — a composition the
+          # model proposed before its preferred one — keeps its previews alone,
+          # under the composition's folder; the derived code is the head's.
+          HEAD_SHA="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)"
+          if [ -n "$HEAD_SHA" ] && [ "$HEAD_SHA" != "$GITHUB_SHA" ]; then
+            git add previews 2>/dev/null || true
+            MESSAGE="speculate: ${GITHUB_REF_NAME#spec/} — aperçus d'une composition proposée (${GITHUB_SHA:0:7})"
+          else
+            git add -A
+            MESSAGE="speculate: ${GITHUB_REF_NAME#spec/} — dérivé par ogygie generate sur la branche"
+          fi
+          if git diff --cached --quiet; then
+            echo "ogygie-gates — rien de nouveau à committer sur la branche."
+            exit 0
+          fi
+          git config user.name "ogygie-speculate"
+          git config user.email "ogygie-speculate@users.noreply.github.com"
+          git commit -m "$MESSAGE"
+          # The branch may have moved since this commit was checked out: replay on its head.
+          git reset --hard HEAD --quiet
+          git clean -fdq
+          git pull --rebase origin "$GITHUB_REF_NAME"
+          git push origin "HEAD:${GITHUB_REF_NAME}"

package/templates/project/design/tokens.json

@@ -1,32 +1,112 @@
 {
-  "$intent": "Placeholder design tokens of the starter. A product REWRITES these values when it opens (AGENTS.product.md); the structure stays. The design tool composes ONLY from these tokens — a missing color or spacing is an amendment of this file (explicit decision), never a hardcoded value (AGENTS.md §Front).",
+  "$intent": "Design tokens of the starter: the Ogygie charter, two themes (dark first, the identity; light, a complete working theme). A product REWRITES these values when it opens (AGENTS.product.md); the structure stays. A colour or a shadow is either ONE value for every theme or one value per theme id of `themes`, the first theme being the default. The design tool composes ONLY from these tokens: a missing colour, spacing or motion value is an amendment of this file (explicit decision), never a hardcoded value (AGENTS.md §Front). The socle `@ogygie/ui` only names tokens (surface, border, text, accent, danger, focus...): every name it uses must stay declared here.",
+  "themes": [
+    "dark",
+    "light"
+  ],
   "color": {
-    "surface": "#f6f6f4",
-    "surface-raised": "#ffffff",
-    "border": "#e2e1dc",
-    "text": "#22241f",
-    "text-muted": "#5f6259",
-    "accent": "#3b5b92",
-    "accent-contrast": "#ffffff",
-    "positive": "#2f6b4f",
-    "warning": "#a96a1f",
-    "danger": "#b3423a",
-    "focus": "#7aa2ff"
+    "surface": {
+      "dark": "#0b1322",
+      "light": "#f6f3ec"
+    },
+    "surface-raised": {
+      "dark": "#131d30",
+      "light": "#ffffff"
+    },
+    "surface-sunken": {
+      "dark": "#060b15",
+      "light": "#ece8de"
+    },
+    "border": {
+      "dark": "#223049",
+      "light": "#ddd7ca"
+    },
+    "border-strong": {
+      "dark": "#5a6d93",
+      "light": "#8b8571"
+    },
+    "text": {
+      "dark": "#ebe6da",
+      "light": "#121a2a"
+    },
+    "text-muted": {
+      "dark": "#a2abba",
+      "light": "#5a6475"
+    },
+    "text-faint": {
+      "dark": "#7b8694",
+      "light": "#667080"
+    },
+    "accent": {
+      "dark": "#5cd6cc",
+      "light": "#0f7580"
+    },
+    "accent-strong": {
+      "dark": "#86e6de",
+      "light": "#0a5c66"
+    },
+    "accent-soft": {
+      "dark": "#0e2b31",
+      "light": "#dbf2f3"
+    },
+    "accent-contrast": {
+      "dark": "#0b1322",
+      "light": "#f3fbfb"
+    },
+    "accent-glow": {
+      "dark": "#5cd6cc29",
+      "light": "#0f758024"
+    },
+    "orichalcum": {
+      "dark": "#d9a35a",
+      "light": "#9e5420"
+    },
+    "positive": {
+      "dark": "#8fd67a",
+      "light": "#2e7a1f"
+    },
+    "positive-soft": {
+      "dark": "#152a16",
+      "light": "#e2f3dc"
+    },
+    "warning": {
+      "dark": "#f2d06b",
+      "light": "#8a6400"
+    },
+    "warning-soft": {
+      "dark": "#2e2410",
+      "light": "#fbeccc"
+    },
+    "danger": {
+      "dark": "#ff8a7a",
+      "light": "#b42318"
+    },
+    "danger-soft": {
+      "dark": "#3a1612",
+      "light": "#fbe3df"
+    },
+    "focus": {
+      "dark": "#5cd6cc",
+      "light": "#0f7580"
+    }
   },
   "typography": {
-    "font-sans": "system-ui, -apple-system, 'Segoe UI', sans-serif",
-    "font-mono": "ui-monospace, 'SF Mono', 'Cascadia Mono', monospace",
+    "font-display": "'Cormorant Garamond', 'Iowan Old Style', Georgia, serif",
+    "font-sans": "'Hanken Grotesk', 'Helvetica Neue', Arial, sans-serif",
+    "font-mono": "'Fragment Mono', ui-monospace, 'SF Mono', Menlo, monospace",
     "size": {
       "xs": "0.75rem",
-      "sm": "0.875rem",
-      "base": "1rem",
+      "sm": "0.8125rem",
+      "base": "0.9375rem",
       "lg": "1.125rem",
-      "xl": "1.375rem",
-      "2xl": "1.75rem"
+      "xl": "1.25rem",
+      "2xl": "1.75rem",
+      "3xl": "3rem",
+      "4xl": "4.5rem"
     },
     "leading": {
-      "tight": "1.25",
-      "normal": "1.5"
+      "tight": "1.2",
+      "normal": "1.6"
     }
   },
   "spacing": {
@@ -36,15 +116,42 @@
     "4": "1rem",
     "6": "1.5rem",
     "8": "2rem",
-    "12": "3rem"
+    "12": "3rem",
+    "16": "4rem",
+    "24": "6rem"
   },
   "radius": {
+    "xs": "0.125rem",
     "sm": "0.25rem",
     "md": "0.5rem",
     "lg": "0.75rem",
+    "xl": "1.25rem",
     "full": "9999px"
   },
   "shadow": {
-    "raised": "0 1px 2px rgb(0 0 0 / 0.06), 0 2px 8px rgb(0 0 0 / 0.04)"
+    "raised": {
+      "dark": "inset 0 1px 0 rgb(255 255 255 / 0.05), 0 8px 24px rgb(0 0 0 / 0.4)",
+      "light": "0 1px 2px rgb(18 26 42 / 0.08), 0 8px 24px rgb(18 26 42 / 0.08)"
+    },
+    "overlay": {
+      "dark": "inset 0 1px 0 rgb(255 255 255 / 0.08), 0 24px 64px rgb(0 0 0 / 0.65)",
+      "light": "0 2px 4px rgb(18 26 42 / 0.08), 0 24px 64px rgb(18 26 42 / 0.16)"
+    },
+    "glow": {
+      "dark": "0 0 0 1px rgb(92 214 204 / 0.4), 0 0 48px rgb(92 214 204 / 0.2)",
+      "light": "0 0 0 1px rgb(15 117 128 / 0.4), 0 0 48px rgb(15 117 128 / 0.14)"
+    }
+  },
+  "motion": {
+    "ease": {
+      "swell": "cubic-bezier(0.2, 0.7, 0.2, 1)",
+      "retreat": "cubic-bezier(0.4, 0, 0.2, 1)"
+    },
+    "duration": {
+      "fast": "160ms",
+      "base": "320ms",
+      "slow": "640ms",
+      "count": "800ms"
+    }
   }
 }

package/templates/project/package.json

@@ -23,6 +23,7 @@
   },
   "devDependencies": {
     "@ogygie/cli": "__OGYGIE_VERSION__",
+    "@ogygie/generate": "__OGYGIE_VERSION__",
     "@types/node": "^24.0.0",
     "tsx": "^4.20.0",
     "typescript": "^5.8.0",