@ogygie/cli 0.19.0 → 0.21.0

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@ogygie/cli",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Ogygie framework CLI: deterministic scaffolding (init), governed-file upgrades (upgrade) and lockstep verification (check) for Ogygie products.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/julienTeam/Ogygie.git",
+    "directory": "packages/ogygie-cli"
+  },
   "type": "module",
   "bin": {
     "ogygie": "dist/cli.js"
@@ -17,7 +22,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@ogygie/core": "0.19.0",
+    "@ogygie/core": "0.21.0",
     "@types/node": "^24.0.0",
     "esbuild": "^0.28.0",
     "tsx": "^4.20.0",

package/templates/project/ci/ogygie-gates.yml

@@ -4,14 +4,13 @@
 name: ogygie-gates
 on:
   push:
-    branches: [main]
+    branches: [main, "spec/**"]
   pull_request:
 
-# Least-privilege token: gitleaks-action reads the PR's commit list on
-# pull_request events; PR comments stay disabled so no write scope is needed.
+# Least-privilege token: the gates only read the checkout. The one job that
+# writes (speculate) raises its own permission, alone.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   verifier:
@@ -34,10 +33,155 @@ jobs:
       - run: pnpm lint                     # any, ts-ignore, raw-db, dangerouslySetInnerHTML
       - run: pnpm test
       # Security
-      - uses: gitleaks/gitleaks-action@v2  # committed secrets
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          GITLEAKS_ENABLE_COMMENTS: "false"
+      # Committed secrets: the gitleaks binary, pinned by version and checksum.
+      # Its GitHub action asks for a licence key as soon as the repository
+      # belongs to an organization; the binary asks for nothing. A pull request
+      # scans its own commits and a push the ones it brings, so a leak already
+      # dealt with in the past does not keep the gate red.
+      - env:
+          GITLEAKS_VERSION: "8.30.1"
+          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+          RANGE: "${{ github.event_name == 'pull_request' && format('{0}..{1}', github.event.pull_request.base.sha, github.event.pull_request.head.sha) || format('{0}..{1}', github.event.before, github.sha) }}"
+        run: |
+          curl -sSLo "$RUNNER_TEMP/gitleaks.tar.gz" "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          echo "${GITLEAKS_SHA256}  $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf "$RUNNER_TEMP/gitleaks.tar.gz" -C "$RUNNER_TEMP" gitleaks
+          # A branch born with this push has no "before": the whole history is scanned.
+          case "$RANGE" in 0000000000000000000000000000000000000000..*) RANGE="" ;; esac
+          "$RUNNER_TEMP/gitleaks" git --redact --no-banner ${RANGE:+--log-opts="$RANGE"} .
       - uses: semgrep/semgrep-action@v1    # dangerous patterns (SAST)
         with: { config: "p/typescript p/owasp-top-ten" }
       - run: pnpm audit --audit-level=high # dependency CVEs
+
+  # Hosted mode (spec ogygie-hosted-mode B5): a pull request whose branch is
+  # spec/<id> is mergeable only once its spec is SIGNED (status validated).
+  # Require this check in the branch protection of the default branch: GitHub
+  # then holds the rule, never a UI. Any other branch passes and says so.
+  spec-signed:
+    if: "${{ github.event_name == 'pull_request' }}"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec ogygie verify-spec-signed   # reads GITHUB_HEAD_REF
+
+  # Hosted mode (spec ogygie-hosted-mode B4): on a push to spec/<id>, the
+  # generator derives on the branch what the spec declares, deterministically,
+  # and commits it there — never on the default branch — with the preview pages
+  # of a screen. The first schemas.ts of a NEW feature is drawn by the model and
+  # judged by the gates, written once; refused twice, the pull request gets the
+  # needs-operator label and nothing is generated. The holes are filled — library, draw, escalation — with the client's model key
+  # (a repo secret), the test of a candidate running without it; the body of a
+  # custom view is one of them, and gets the same label when no candidate is green. A repo
+  # without the generator installed is told so, and the branch is left as is.
+  # With OGYGIE_CI_TOKEN (a token allowed to push to spec/* branches), the
+  # commit it pushes gets its own checks; with the default token, it does not.
+  speculate:
+    if: "${{ github.event_name == 'push' && startsWith(github.ref_name, 'spec/') }}"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      # The needs-operator label on the branch's pull request (labels go through the issues API).
+      pull-requests: write
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: "${{ secrets.OGYGIE_CI_TOKEN || github.token }}"
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - id: generator
+        run: |
+          if node -e "require.resolve('@ogygie/generate/cli')" 2>/dev/null; then
+            echo "installed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "installed=false" >> "$GITHUB_OUTPUT"
+            echo "ogygie-gates — @ogygie/generate n'est pas installé : la branche n'est pas spéculée."
+          fi
+      - if: "${{ steps.generator.outputs.installed == 'true' }}"
+        env:
+          OGYGIE_MODEL_API_KEY: "${{ secrets.OGYGIE_MODEL_API_KEY }}"
+          GH_TOKEN: "${{ github.token }}"
+        run: |
+          SPEC_ID="${GITHUB_REF_NAME#spec/}"
+          SPEC_FILE="specs/${SPEC_ID}.spec.md"
+          if [ ! -f "$SPEC_FILE" ]; then
+            echo "ogygie-gates — $SPEC_FILE absent de la branche : rien à spéculer."
+            exit 0
+          fi
+          if ! grep -q '^# Génération' "$SPEC_FILE"; then
+            echo "ogygie-gates — $SPEC_FILE sans section # Génération : rien à générer."
+            exit 0
+          fi
+          # A NEW feature has no schemas.ts yet: the model writes the first one, the
+          # gates judge it, two attempts (exit 2 = the operator). The pull request of
+          # the branch carries the verdict as a label, so the studio can say it.
+          pnpm exec ogygie generate schemas "$SPEC_ID" || SCHEMAS_STATUS=$?
+          PR_NUMBER="$(gh pr list --head "$GITHUB_REF_NAME" --state open --json number --jq '.[0].number' 2>/dev/null || true)"
+          if [ "${SCHEMAS_STATUS:-0}" = "2" ]; then
+            if [ -n "$PR_NUMBER" ]; then
+              gh label create needs-operator --force --color D9A35A --description "La spec attend un geste de l'opérateur : un schemas.ts refusé deux fois, ou le corps d'une vue custom sans candidat vert." >/dev/null
+              gh pr edit "$PR_NUMBER" --add-label needs-operator
+            fi
+            echo "ogygie-gates — le schemas.ts de $SPEC_ID attend l'opérateur (needs-operator) : rien n'est généré sur la branche."
+            exit 1
+          elif [ "${SCHEMAS_STATUS:-0}" != "0" ]; then
+            exit "$SCHEMAS_STATUS"
+          fi
+          if [ -n "$PR_NUMBER" ]; then
+            gh pr edit "$PR_NUMBER" --remove-label needs-operator 2>/dev/null || true
+          fi
+          pnpm exec ogygie generate check "$SPEC_ID"
+          pnpm exec ogygie generate generate "$SPEC_ID"
+          # The holes: the library first, then the client's model workspace key —
+          # a repo secret, present in THIS step alone; the test of a candidate
+          # runs in a process that holds no secret. Absent, the library alone.
+          pnpm exec ogygie generate fill "$SPEC_ID" || FILL_STATUS=$?
+          pnpm exec ogygie generate verify
+          if [ "${FILL_STATUS:-0}" = "2" ]; then
+            # The body of a custom view (hosted mode, the body as a hole): no candidate
+            # rendered its example — the operator writes it. The label says so; the
+            # view's own test stays red until then, so the pull request does too.
+            if [ -n "$PR_NUMBER" ]; then
+              gh label create needs-operator --force --color D9A35A --description "La spec attend un geste de l'opérateur : un schemas.ts refusé deux fois, ou le corps d'une vue custom sans candidat vert." >/dev/null
+              gh pr edit "$PR_NUMBER" --add-label needs-operator
+            fi
+            echo "ogygie-gates — le corps d'une vue custom de $SPEC_ID attend l'opérateur (needs-operator) : son test d'exemple reste rouge."
+          elif [ "${FILL_STATUS:-0}" != "0" ]; then
+            echo "ogygie-gates — des trous restent à l'humain, ou le plafond du modèle est atteint : voir le journal ci-dessus."
+          fi
+          # The previews of a screen (spec ogygie-hosted-mode B10): a page per
+          # state under previews/<id>/, committed with the derived code; not a
+          # screen, or a jsdom front: nothing to render, said, exit 0.
+          pnpm exec ogygie generate preview "$SPEC_ID"
+      - if: "${{ steps.generator.outputs.installed == 'true' }}"
+        run: |
+          # A commit that is no longer the head of the branch — a composition the
+          # model proposed before its preferred one — keeps its previews alone,
+          # under the composition's folder; the derived code is the head's.
+          HEAD_SHA="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)"
+          if [ -n "$HEAD_SHA" ] && [ "$HEAD_SHA" != "$GITHUB_SHA" ]; then
+            git add previews 2>/dev/null || true
+            MESSAGE="speculate: ${GITHUB_REF_NAME#spec/} — aperçus d'une composition proposée (${GITHUB_SHA:0:7})"
+          else
+            git add -A
+            MESSAGE="speculate: ${GITHUB_REF_NAME#spec/} — dérivé par ogygie generate sur la branche"
+          fi
+          if git diff --cached --quiet; then
+            echo "ogygie-gates — rien de nouveau à committer sur la branche."
+            exit 0
+          fi
+          git config user.name "ogygie-speculate"
+          git config user.email "ogygie-speculate@users.noreply.github.com"
+          git commit -m "$MESSAGE"
+          # The branch may have moved since this commit was checked out: replay on its head.
+          git reset --hard HEAD --quiet
+          git clean -fdq
+          git pull --rebase origin "$GITHUB_REF_NAME"
+          git push origin "HEAD:${GITHUB_REF_NAME}"

package/templates/project/design/tokens.json

@@ -1,32 +1,112 @@
 {
-  "$intent": "Placeholder design tokens of the starter. A product REWRITES these values when it opens (AGENTS.product.md); the structure stays. The design tool composes ONLY from these tokens — a missing color or spacing is an amendment of this file (explicit decision), never a hardcoded value (AGENTS.md §Front).",
+  "$intent": "Design tokens of the starter: the Ogygie charter, two themes (dark first, the identity; light, a complete working theme). A product REWRITES these values when it opens (AGENTS.product.md); the structure stays. A colour or a shadow is either ONE value for every theme or one value per theme id of `themes`, the first theme being the default. The design tool composes ONLY from these tokens: a missing colour, spacing or motion value is an amendment of this file (explicit decision), never a hardcoded value (AGENTS.md §Front). The socle `@ogygie/ui` only names tokens (surface, border, text, accent, danger, focus...): every name it uses must stay declared here.",
+  "themes": [
+    "dark",
+    "light"
+  ],
   "color": {
-    "surface": "#f6f6f4",
-    "surface-raised": "#ffffff",
-    "border": "#e2e1dc",
-    "text": "#22241f",
-    "text-muted": "#5f6259",
-    "accent": "#3b5b92",
-    "accent-contrast": "#ffffff",
-    "positive": "#2f6b4f",
-    "warning": "#a96a1f",
-    "danger": "#b3423a",
-    "focus": "#7aa2ff"
+    "surface": {
+      "dark": "#0b1322",
+      "light": "#f6f3ec"
+    },
+    "surface-raised": {
+      "dark": "#131d30",
+      "light": "#ffffff"
+    },
+    "surface-sunken": {
+      "dark": "#060b15",
+      "light": "#ece8de"
+    },
+    "border": {
+      "dark": "#223049",
+      "light": "#ddd7ca"
+    },
+    "border-strong": {
+      "dark": "#5a6d93",
+      "light": "#8b8571"
+    },
+    "text": {
+      "dark": "#ebe6da",
+      "light": "#121a2a"
+    },
+    "text-muted": {
+      "dark": "#a2abba",
+      "light": "#5a6475"
+    },
+    "text-faint": {
+      "dark": "#7b8694",
+      "light": "#667080"
+    },
+    "accent": {
+      "dark": "#5cd6cc",
+      "light": "#0f7580"
+    },
+    "accent-strong": {
+      "dark": "#86e6de",
+      "light": "#0a5c66"
+    },
+    "accent-soft": {
+      "dark": "#0e2b31",
+      "light": "#dbf2f3"
+    },
+    "accent-contrast": {
+      "dark": "#0b1322",
+      "light": "#f3fbfb"
+    },
+    "accent-glow": {
+      "dark": "#5cd6cc29",
+      "light": "#0f758024"
+    },
+    "orichalcum": {
+      "dark": "#d9a35a",
+      "light": "#9e5420"
+    },
+    "positive": {
+      "dark": "#8fd67a",
+      "light": "#2e7a1f"
+    },
+    "positive-soft": {
+      "dark": "#152a16",
+      "light": "#e2f3dc"
+    },
+    "warning": {
+      "dark": "#f2d06b",
+      "light": "#8a6400"
+    },
+    "warning-soft": {
+      "dark": "#2e2410",
+      "light": "#fbeccc"
+    },
+    "danger": {
+      "dark": "#ff8a7a",
+      "light": "#b42318"
+    },
+    "danger-soft": {
+      "dark": "#3a1612",
+      "light": "#fbe3df"
+    },
+    "focus": {
+      "dark": "#5cd6cc",
+      "light": "#0f7580"
+    }
   },
   "typography": {
-    "font-sans": "system-ui, -apple-system, 'Segoe UI', sans-serif",
-    "font-mono": "ui-monospace, 'SF Mono', 'Cascadia Mono', monospace",
+    "font-display": "'Cormorant Garamond', 'Iowan Old Style', Georgia, serif",
+    "font-sans": "'Hanken Grotesk', 'Helvetica Neue', Arial, sans-serif",
+    "font-mono": "'Fragment Mono', ui-monospace, 'SF Mono', Menlo, monospace",
     "size": {
       "xs": "0.75rem",
-      "sm": "0.875rem",
-      "base": "1rem",
+      "sm": "0.8125rem",
+      "base": "0.9375rem",
       "lg": "1.125rem",
-      "xl": "1.375rem",
-      "2xl": "1.75rem"
+      "xl": "1.25rem",
+      "2xl": "1.75rem",
+      "3xl": "3rem",
+      "4xl": "4.5rem"
     },
     "leading": {
-      "tight": "1.25",
-      "normal": "1.5"
+      "tight": "1.2",
+      "normal": "1.6"
     }
   },
   "spacing": {
@@ -36,15 +116,42 @@
     "4": "1rem",
     "6": "1.5rem",
     "8": "2rem",
-    "12": "3rem"
+    "12": "3rem",
+    "16": "4rem",
+    "24": "6rem"
   },
   "radius": {
+    "xs": "0.125rem",
     "sm": "0.25rem",
     "md": "0.5rem",
     "lg": "0.75rem",
+    "xl": "1.25rem",
     "full": "9999px"
   },
   "shadow": {
-    "raised": "0 1px 2px rgb(0 0 0 / 0.06), 0 2px 8px rgb(0 0 0 / 0.04)"
+    "raised": {
+      "dark": "inset 0 1px 0 rgb(255 255 255 / 0.05), 0 8px 24px rgb(0 0 0 / 0.4)",
+      "light": "0 1px 2px rgb(18 26 42 / 0.08), 0 8px 24px rgb(18 26 42 / 0.08)"
+    },
+    "overlay": {
+      "dark": "inset 0 1px 0 rgb(255 255 255 / 0.08), 0 24px 64px rgb(0 0 0 / 0.65)",
+      "light": "0 2px 4px rgb(18 26 42 / 0.08), 0 24px 64px rgb(18 26 42 / 0.16)"
+    },
+    "glow": {
+      "dark": "0 0 0 1px rgb(92 214 204 / 0.4), 0 0 48px rgb(92 214 204 / 0.2)",
+      "light": "0 0 0 1px rgb(15 117 128 / 0.4), 0 0 48px rgb(15 117 128 / 0.14)"
+    }
+  },
+  "motion": {
+    "ease": {
+      "swell": "cubic-bezier(0.2, 0.7, 0.2, 1)",
+      "retreat": "cubic-bezier(0.4, 0, 0.2, 1)"
+    },
+    "duration": {
+      "fast": "160ms",
+      "base": "320ms",
+      "slow": "640ms",
+      "count": "800ms"
+    }
   }
 }

package/templates/project/package.json

@@ -23,6 +23,7 @@
   },
   "devDependencies": {
     "@ogygie/cli": "__OGYGIE_VERSION__",
+    "@ogygie/generate": "__OGYGIE_VERSION__",
     "@types/node": "^24.0.0",
     "tsx": "^4.20.0",
     "typescript": "^5.8.0",