@ogygie/studio 0.19.0 → 0.21.0

package/dist/server.js

@@ -1,5 +1,5 @@
 // src/server/start.ts
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { dirname as dirname2, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -38,24 +38,167 @@ function throwOgygieError(input, httpStatus = 500) {
   throw new OgygieFailure(ogygieError(input), httpStatus);
 }
 
-// src/server/storage/local-adapter.ts
-import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute as isAbsolute2, resolve as resolve2, sep as sep2 } from "node:path";
-
 // ../ogygie-core/src/repo-adapter.ts
 import { readFile as readFileFromDisk, readdir, realpath, stat } from "node:fs/promises";
 import { isAbsolute, join, resolve, sep } from "node:path";
 import { z as z2 } from "zod";
+
+// ../ogygie-core/src/repo-adapter-github.ts
+var NEVER_LISTED = /* @__PURE__ */ new Set(["node_modules"]);
+function isSkippedSegment(segment) {
+  return segment.startsWith(".") || NEVER_LISTED.has(segment);
+}
+function refusePathOutsideRepo(relativePath, cause) {
+  return throwOgygieError(
+    {
+      code: "PATH_OUTSIDE_REPO",
+      message: "The requested path resolves outside the repo root.",
+      file: relativePath,
+      cause,
+      suggestedFix: "Address a path INSIDE the repo, written relative to its root and without `..`."
+    },
+    400
+  );
+}
+function normalizeRepoPath(relativePath) {
+  if (relativePath.startsWith("/") || /^[A-Za-z]:[\\/]/.test(relativePath)) {
+    refusePathOutsideRepo(relativePath, `"${relativePath}" is an absolute path`);
+  }
+  const segments = relativePath.split(/[\\/]+/).filter((segment) => segment !== "" && segment !== ".");
+  if (segments.includes("..")) {
+    refusePathOutsideRepo(relativePath, `"${relativePath}" climbs out of the repo with ".."`);
+  }
+  return segments.join("/");
+}
+function createGithubApiRepoAdapter(options) {
+  const apiBase = options.apiBase ?? "https://api.github.com";
+  const repoUrl = `${apiBase}/repos/${options.owner}/${options.repo}`;
+  const where = `${options.owner}/${options.repo}@${options.ref}`;
+  async function request(url, allowNotFound) {
+    let response;
+    try {
+      response = await options.fetchImpl(url, {
+        method: "GET",
+        headers: {
+          accept: "application/vnd.github+json",
+          "x-github-api-version": "2022-11-28",
+          "user-agent": options.userAgent ?? "ogygie-core",
+          ...options.token === void 0 ? {} : { authorization: `Bearer ${options.token}` }
+        }
+      });
+    } catch (thrown) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub could not be reached to read ${where}.`,
+        file: null,
+        cause: thrown instanceof Error ? thrown.message : String(thrown),
+        suggestedFix: "Retry once the network is back \u2014 a read has no side effect to undo."
+      });
+    }
+    if (response.status === 404 && allowNotFound) return null;
+    if (!response.ok) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub answered ${response.status} for GET ${url.replace(apiBase, "")}.`,
+        file: null,
+        cause: `status=${response.status}`,
+        suggestedFix: response.status === 401 || response.status === 403 ? "Check the GitHub token: it must grant contents (read) on this repo." : "Retry later \u2014 a read has no side effect to undo."
+      });
+    }
+    return await response.json();
+  }
+  let commitShaPromise = null;
+  let treePromise = null;
+  function commitSha() {
+    commitShaPromise ??= (async () => {
+      const commit = await request(
+        `${repoUrl}/commits/${encodeURIComponent(options.ref)}`,
+        true
+      );
+      if (commit === null) {
+        return throwOgygieError({
+          code: "GITHUB_UNAVAILABLE",
+          message: `Ref "${options.ref}" does not exist on ${options.owner}/${options.repo}.`,
+          file: null,
+          cause: "the commits endpoint answered 404 for that ref",
+          suggestedFix: "Name an existing branch, tag or commit SHA of that repo."
+        });
+      }
+      return commit.sha;
+    })();
+    return commitShaPromise;
+  }
+  function tree() {
+    treePromise ??= (async () => {
+      const sha = await commitSha();
+      const answer = await request(
+        `${repoUrl}/git/trees/${sha}?recursive=1`,
+        false
+      );
+      if (answer === null) return [];
+      if (answer.truncated) {
+        return throwOgygieError({
+          code: "REPO_TREE_TRUNCATED",
+          message: `The tree of ${where} is too large for one GitHub answer.`,
+          file: null,
+          cause: "the trees endpoint set truncated=true",
+          suggestedFix: "Read that repo from a clone (createFilesystemRepoAdapter) rather than through the API."
+        });
+      }
+      return answer.tree.filter(
+        (entry) => entry.type === "blob" && !entry.path.split("/").slice(0, -1).some(isSkippedSegment)
+      );
+    })();
+    return treePromise;
+  }
+  return {
+    async readFile(relativePath) {
+      const path = normalizeRepoPath(relativePath);
+      const sha = await commitSha();
+      const file = await request(`${repoUrl}/contents/${path}?ref=${sha}`, true);
+      if (file === null || Array.isArray(file) || file.type !== "file") {
+        return throwOgygieError({
+          code: "REPO_FILE_NOT_FOUND",
+          message: "The requested file cannot be read from the repo.",
+          file: relativePath,
+          cause: file === null ? `no file at "${path}" in ${where}` : `"${path}" is not a file in ${where}`,
+          suggestedFix: "Check the path against what the map declares \u2014 the manifest is the only chart of a repo."
+        });
+      }
+      if (file.encoding === "base64" && file.content !== void 0) {
+        return Buffer.from(file.content, "base64").toString("utf8");
+      }
+      const blob = await request(`${repoUrl}/git/blobs/${file.sha}`, false);
+      return Buffer.from(blob?.content ?? "", "base64").toString("utf8");
+    },
+    async listDirectory(relativePath) {
+      const path = normalizeRepoPath(relativePath);
+      const prefix = path === "" ? "" : `${path}/`;
+      return (await tree()).filter((entry) => entry.path.startsWith(prefix)).map((entry) => ({ path: entry.path.slice(prefix.length), sizeBytes: entry.size ?? 0 })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    },
+    async exists(relativePath) {
+      const path = normalizeRepoPath(relativePath);
+      if (path === "") return true;
+      const prefix = `${path}/`;
+      return (await tree()).some((entry) => entry.path === path || entry.path.startsWith(prefix));
+    },
+    async currentRef() {
+      return commitSha();
+    }
+  };
+}
+
+// ../ogygie-core/src/repo-adapter.ts
 var RepoFileEntrySchema = z2.object({
   /** Path relative to the LISTED directory, "/" separated, never absolute. */
   path: z2.string(),
   sizeBytes: z2.number().int().nonnegative()
 });
-var NEVER_LISTED = /* @__PURE__ */ new Set(["node_modules"]);
+var NEVER_LISTED2 = /* @__PURE__ */ new Set(["node_modules"]);
 function isSkippedDirectory(name) {
-  return name.startsWith(".") || NEVER_LISTED.has(name);
+  return name.startsWith(".") || NEVER_LISTED2.has(name);
 }
-function refusePathOutsideRepo(relativePath, cause) {
+function refusePathOutsideRepo2(relativePath, cause) {
   return throwOgygieError(
     {
       code: "PATH_OUTSIDE_REPO",
@@ -69,12 +212,12 @@ function refusePathOutsideRepo(relativePath, cause) {
 }
 function resolveInsideRoot(rootDir, relativePath) {
   if (isAbsolute(relativePath)) {
-    refusePathOutsideRepo(relativePath, `"${relativePath}" is an absolute path`);
+    refusePathOutsideRepo2(relativePath, `"${relativePath}" is an absolute path`);
   }
   const root = resolve(rootDir);
   const absolute = resolve(root, relativePath);
   if (absolute !== root && !absolute.startsWith(root + sep)) {
-    refusePathOutsideRepo(relativePath, `"${relativePath}" resolves to "${absolute}", outside "${root}"`);
+    refusePathOutsideRepo2(relativePath, `"${relativePath}" resolves to "${absolute}", outside "${root}"`);
   }
   return absolute;
 }
@@ -88,7 +231,7 @@ async function assertRealPathInsideRoot(rootDir, absolute, relativePath) {
     return;
   }
   if (realTarget !== realRoot && !realTarget.startsWith(realRoot + sep)) {
-    refusePathOutsideRepo(
+    refusePathOutsideRepo2(
       relativePath,
       `"${relativePath}" is a symbolic link leading to "${realTarget}", outside "${realRoot}"`
     );
@@ -204,43 +347,60 @@ function createFilesystemRepoAdapter(rootDir) {
   };
 }
 
-// src/server/storage/local-adapter.ts
-function resolveInsideRoot2(rootDir, relativePath) {
-  const root = resolve2(rootDir);
-  const absolute = resolve2(root, relativePath);
-  if (isAbsolute2(relativePath) || absolute !== root && !absolute.startsWith(root + sep2)) {
-    throwOgygieError(
-      {
-        code: "PATH_OUTSIDE_REPO",
-        message: "The requested path escapes the repo root.",
-        file: relativePath,
-        cause: `relative path "${relativePath}" resolves to "${absolute}", outside "${root}"`,
-        suggestedFix: "Only address files inside the repo (specs/, ogygie.manifest.json)."
-      },
-      400
-    );
+// ../ogygie-core/src/proposal.ts
+import { z as z5 } from "zod";
+
+// ../ogygie-core/src/decision-refs.ts
+var DECISION_REFERENCE = /(?<![A-Za-z0-9])D(\d+)(?![A-Za-z0-9])/g;
+var DECISION_HEADING = /^##\s+D(\d+)\b/;
+function parseKnownDecisionIds(decisionsMarkdown) {
+  const ids = [];
+  for (const line of decisionsMarkdown.split("\n")) {
+    const heading = DECISION_HEADING.exec(line);
+    if (heading !== null) ids.push(`D${heading[1]}`);
   }
-  return absolute;
+  return ids;
 }
-function createLocalSpecStorage(rootDir) {
-  const reader = createFilesystemRepoAdapter(rootDir);
-  return {
-    ...reader,
-    async write(path, content, _message) {
-      const absolute = resolveInsideRoot2(rootDir, path);
-      await mkdir(dirname(absolute), { recursive: true });
-      await writeFile(absolute, content, "utf8");
-    }
+function extractDecisionSection(decisionsMarkdown, decisionId) {
+  const lines = decisionsMarkdown.split("\n");
+  const trimTrailingBlanks = (section) => {
+    while (section.length > 0 && (section[section.length - 1] ?? "").trim() === "") section.pop();
+    return section.join("\n");
   };
+  let start = -1;
+  for (let index = 0; index < lines.length; index += 1) {
+    const heading = DECISION_HEADING.exec(lines[index] ?? "");
+    if (heading === null) continue;
+    if (start === -1) {
+      if (`D${heading[1]}` === decisionId) start = index;
+      continue;
+    }
+    return trimTrailingBlanks(lines.slice(start, index));
+  }
+  return start === -1 ? null : trimTrailingBlanks(lines.slice(start));
+}
+function findDecisionReferences(text) {
+  const references = [];
+  const lines = text.split("\n");
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    for (const match of line.matchAll(DECISION_REFERENCE)) {
+      references.push({ decision: `D${match[1]}`, line: index + 1 });
+    }
+  }
+  return references;
+}
+function findUnknownDecisionReferences(text, knownDecisionIds) {
+  const known = new Set(knownDecisionIds);
+  const unknown = [];
+  const alreadyReported = /* @__PURE__ */ new Set();
+  for (const reference of findDecisionReferences(text)) {
+    if (known.has(reference.decision) || alreadyReported.has(reference.decision)) continue;
+    alreadyReported.add(reference.decision);
+    unknown.push(reference);
+  }
+  return unknown;
 }
-
-// src/server/app.ts
-import Fastify from "fastify";
-import {
-  hasZodFastifySchemaValidationErrors,
-  serializerCompiler,
-  validatorCompiler
-} from "fastify-type-provider-zod";
 
 // ../ogygie-core/src/spec.schema.ts
 import { z as z4 } from "zod";
@@ -631,131 +791,556 @@ function parseSpecFrontmatter(text) {
   }
   return { value, problems };
 }
-
-// src/server/service.ts
-var SPECS_DIR = "specs";
-var TEMPLATE_PATH = "specs/_TEMPLATE.spec.md";
-var MANIFEST_PATH = "ogygie.manifest.json";
 var FRONTMATTER_BLOCK = /^---\n([\s\S]*?)\n---/;
-function splitSpecFile(content) {
+function parseSpecDocument(content) {
   const match = FRONTMATTER_BLOCK.exec(content);
-  if (match === null || match[1] === void 0) return null;
-  return { frontmatterText: match[1], body: content.slice(match[0].length) };
-}
-function presentSectionsOf(body) {
-  const searchable = `
-${body}`;
-  const present = [];
-  let cursor = 0;
-  for (const section of SECTIONS_SPEC_OBLIGATOIRES) {
-    const position = searchable.indexOf(`
-${section}`, cursor);
-    if (position === -1) continue;
-    present.push(section);
-    cursor = position + section.length;
-  }
-  return present;
-}
-function missingSectionsOf(body) {
-  const present = new Set(presentSectionsOf(body));
-  return SECTIONS_SPEC_OBLIGATOIRES.filter((section) => !present.has(section));
-}
-function quoteFrontmatterElement(value, specPath) {
-  if (value.includes("\n") || value.includes('"') && value.includes("'")) {
-    throwOgygieError(
-      {
-        code: "SPEC_FRONTMATTER_UNSERIALIZABLE",
-        message: "A frontmatter array element cannot be written in the restricted spec format.",
-        file: specPath,
-        cause: `element ${JSON.stringify(value)} contains a newline or both quote kinds`,
-        suggestedFix: "Rewrite the element without newlines and with at most one kind of quote character."
-      },
-      422
-    );
-  }
-  return value.includes('"') ? `'${value}'` : `"${value}"`;
-}
-function serializeSpecFrontmatter(frontmatter, specPath) {
-  const quote = (value) => quoteFrontmatterElement(value, specPath);
-  const lines = [
-    `id: ${frontmatter.id}`,
-    `status: ${frontmatter.status}`,
-    `depends_on: [${frontmatter.depends_on.join(", ")}]`,
-    `priority: ${frontmatter.priority}`,
-    `refs: [${frontmatter.refs.map(quote).join(", ")}]`
-  ];
-  if (frontmatter.deferred.length > 0) {
-    lines.push(`deferred: [${frontmatter.deferred.map(quote).join(", ")}]`);
-  }
-  return lines.join("\n");
-}
-function specPathOf(specId) {
-  return `${SPECS_DIR}/${specId}.spec.md`;
-}
-function frontmatterInvalidError(filePath, cause) {
-  return ogygieError({
-    code: "SPEC_FRONTMATTER_INVALID",
-    message: `Spec ${filePath} has an invalid frontmatter.`,
-    file: filePath,
-    cause,
-    suggestedFix: "Fix the frontmatter in your editor to match packages/ogygie-core/src/spec.schema.ts \u2014 the studio never repairs a spec silently."
-  });
-}
-function parseSpec(filePath, fileName, content) {
-  const split = splitSpecFile(content);
-  if (split === null) {
+  if (match === null || match[1] === void 0) {
     return {
-      ok: false,
-      error: frontmatterInvalidError(
-        filePath,
-        "file does not start with a --- ... --- frontmatter block"
-      )
+      frontmatter: null,
+      problems: ["file does not start with a --- ... --- frontmatter block"],
+      body: content
     };
   }
-  const parsed = parseSpecFrontmatter(split.frontmatterText);
+  const body = content.slice(match[0].length);
+  const parsed = parseSpecFrontmatter(match[1]);
   if (parsed.problems.length > 0) {
-    return { ok: false, error: frontmatterInvalidError(filePath, parsed.problems.join(" ; ")) };
+    return { frontmatter: null, problems: parsed.problems, body };
   }
   const checked = SpecFrontmatterSchema.safeParse(parsed.value);
   if (!checked.success) {
     return {
-      ok: false,
-      error: frontmatterInvalidError(
-        filePath,
-        checked.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join(" ; ")
-      )
+      frontmatter: null,
+      problems: checked.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`),
+      body
     };
   }
-  const expectedId = fileName.replace(/\.spec\.md$/, "");
-  if (checked.data.id !== expectedId) {
-    return {
-      ok: false,
-      error: ogygieError({
-        code: "SPEC_ID_MISMATCH",
-        message: `Spec ${fileName} declares id "${checked.data.id}" \u2014 expected "${expectedId}".`,
-        file: filePath,
-        cause: `id=${checked.data.id} \u2260 filename ${expectedId}`,
-        suggestedFix: "Make the frontmatter id identical to the file name."
-      })
-    };
+  return { frontmatter: checked.data, problems: [], body };
+}
+var DESIGN_SECTION_TITLE = "Design";
+var COMPOSITION_LINE = /^\s*(?:[-*]\s*)?[Cc]omposition\s*:\s*`?([a-z][a-z0-9]*(?:-[a-z0-9]+)*)`?(?![A-Za-z0-9])/mu;
+function compositionOfSpec(content) {
+  const heading = new RegExp(`^# ${DESIGN_SECTION_TITLE}\\s*$`, "mu").exec(content);
+  if (heading === null) return null;
+  const rest = content.slice(heading.index + heading[0].length);
+  const next = /^# /mu.exec(rest);
+  const section = next === null ? rest : rest.slice(0, next.index);
+  return COMPOSITION_LINE.exec(section)?.[1] ?? null;
+}
+
+// ../ogygie-core/src/proposal.ts
+var DECISION_FILES = ["DECISIONS.md", "DECISIONS.product.md"];
+var GithubCoordinatesSchema = z5.object({
+  owner: z5.string().min(1),
+  repo: z5.string().min(1),
+  defaultBranch: z5.string().min(1).default("main")
+});
+var ProposablePathSchema = z5.union([
+  z5.string().regex(/^specs\/(?!_)[a-z][a-z0-9]*(-[a-z0-9]+)*\.spec\.md$/),
+  z5.literal("DECISIONS.md"),
+  z5.literal("DECISIONS.product.md")
+]);
+var ProposalSchema = z5.object({
+  repo: z5.string(),
+  path: ProposablePathSchema,
+  branch: z5.string(),
+  baseSha: z5.string(),
+  commitSha: z5.string(),
+  pullRequestNumber: z5.number().int().positive(),
+  pullRequestUrl: z5.url(),
+  /** false when an open pull request was updated instead of created. */
+  created: z5.boolean()
+});
+function assertProposablePath(path) {
+  const parsed = ProposablePathSchema.safeParse(path);
+  if (!parsed.success) {
+    return throwOgygieError({
+      code: "WRITE_PATH_FORBIDDEN",
+      message: `"${path}" is outside what a proposal may touch.`,
+      file: path,
+      cause: "the perimeter is specs/<id>.spec.md (not the template), DECISIONS.md, DECISIONS.product.md",
+      suggestedFix: "Propose a spec or a decisions file; code, manifest, governed files and FAILURES.md are out of reach (D17)."
+    });
   }
-  return { ok: true, spec: { frontmatter: checked.data, body: split.body } };
+  return parsed.data;
 }
-function toReadableSummary(filePath, spec) {
+function createGithubWriteClient(deps, github) {
+  const apiBase = deps.apiBase ?? "https://api.github.com";
+  const repoUrl = `${apiBase}/repos/${github.owner}/${github.repo}`;
+  const credential = deps.credentialHint ?? "the GitHub token";
+  async function request(method, url, body, allowNotFound) {
+    let response;
+    try {
+      response = await deps.fetchImpl(url, {
+        method,
+        headers: {
+          authorization: `Bearer ${deps.token}`,
+          accept: "application/vnd.github+json",
+          "x-github-api-version": "2022-11-28",
+          "user-agent": deps.userAgent ?? "ogygie-core",
+          ...body === void 0 ? {} : { "content-type": "application/json" }
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+    } catch (thrown) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub could not be reached for ${github.owner}/${github.repo}.`,
+        file: null,
+        cause: thrown instanceof Error ? thrown.message : String(thrown),
+        suggestedFix: "Retry once the network is back \u2014 nothing was written, nothing is queued."
+      });
+    }
+    if (response.status === 404 && allowNotFound) return null;
+    if (!response.ok) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub answered ${response.status} for ${method} ${url.replace(apiBase, "")}.`,
+        file: null,
+        cause: `status=${response.status}`,
+        suggestedFix: response.status === 401 || response.status === 403 ? `Check ${credential}: it must grant contents and pull requests on this repo.` : "Retry later \u2014 nothing was written, nothing is queued."
+      });
+    }
+    return await response.json();
+  }
   return {
-    id: spec.frontmatter.id,
-    status: spec.frontmatter.status,
-    priority: spec.frontmatter.priority,
-    depends_on: spec.frontmatter.depends_on,
-    filePath,
-    presentSections: presentSectionsOf(spec.body)
+    async getBranchHead(branch) {
+      const ref = await request(
+        "GET",
+        `${repoUrl}/git/ref/heads/${encodeURIComponent(branch)}`,
+        void 0,
+        true
+      );
+      return ref?.object.sha ?? null;
+    },
+    async readFileAtRef(path, ref) {
+      const file = await request(
+        "GET",
+        `${repoUrl}/contents/${path}?ref=${encodeURIComponent(ref)}`,
+        void 0,
+        true
+      );
+      if (file === null) return null;
+      return { content: Buffer.from(file.content, "base64").toString("utf8"), sha: file.sha };
+    },
+    async createBranch(branch, fromSha) {
+      await request("POST", `${repoUrl}/git/refs`, { ref: `refs/heads/${branch}`, sha: fromSha }, false);
+    },
+    async commitFile(input) {
+      const result = await request(
+        "PUT",
+        `${repoUrl}/contents/${input.path}`,
+        {
+          message: input.message,
+          content: Buffer.from(input.content, "utf8").toString("base64"),
+          branch: input.branch,
+          ...input.expectedSha === null ? {} : { sha: input.expectedSha },
+          ...input.author === void 0 ? {} : { author: input.author }
+        },
+        false
+      );
+      return { commitSha: result?.commit.sha ?? "" };
+    },
+    async findOpenPullRequest(branch) {
+      const pulls = await request(
+        "GET",
+        `${repoUrl}/pulls?state=open&head=${encodeURIComponent(`${github.owner}:${branch}`)}`,
+        void 0,
+        false
+      );
+      const first = pulls?.[0];
+      return first === void 0 ? null : { number: first.number, url: first.html_url };
+    },
+    async openPullRequest(input) {
+      const pull = await request(
+        "POST",
+        `${repoUrl}/pulls`,
+        { title: input.title, body: input.body, head: input.branch, base: input.base },
+        false
+      );
+      return { number: pull?.number ?? 0, url: pull?.html_url ?? "" };
+    }
   };
 }
-async function listSpecFileNames(deps) {
-  const entries = await deps.storage.listDirectory(SPECS_DIR);
-  return entries.map((entry) => entry.path).filter((path) => !path.includes("/")).filter((name) => name.endsWith(".spec.md") && !name.startsWith("_")).sort();
+var HOUR_MS = 36e5;
+var DECISION_HEADING2 = /^## D(\d+) — \d{4}-\d{2}-\d{2} — \S/;
+var DECISION_BULLETS = ["**D\xE9cision**", "**Motivation**", "**Exclut**"];
+function specIdOfPath(path) {
+  return path.replace(/^specs\//, "").replace(/\.spec\.md$/, "");
 }
-async function listSpecSummaries(deps) {
+function assertSpecProposable(path, content) {
+  const parsed = parseSpecDocument(content);
+  const problems = [...parsed.problems];
+  if (parsed.frontmatter !== null && parsed.frontmatter.id !== specIdOfPath(path)) {
+    problems.push(`id "${parsed.frontmatter.id}" differs from the file name "${specIdOfPath(path)}"`);
+  }
+  let cursor = 0;
+  for (const section of SECTIONS_SPEC_OBLIGATOIRES) {
+    const position = parsed.body.indexOf(`
+${section}
+`, cursor);
+    if (position === -1) problems.push(`section "${section}" missing or out of order`);
+    else cursor = position + section.length;
+  }
+  if (problems.length > 0) {
+    throwOgygieError({
+      code: "SPEC_INVALID",
+      message: `The proposed spec would fail verify-specs (${problems.length} problem(s)).`,
+      file: path,
+      cause: problems.join(" ; "),
+      suggestedFix: "Fix the frontmatter (id, status, depends_on, priority, refs) and keep the six canonical sections in order."
+    });
+  }
+  if (parsed.frontmatter?.status === "implemented") {
+    throwOgygieError({
+      code: "SPEC_STATUS_FORBIDDEN",
+      message: "A proposal may not declare a spec implemented.",
+      file: path,
+      cause: "status=implemented",
+      suggestedFix: "Propose the spec as draft or validated \u2014 the repo's manifest and CI say when it is implemented."
+    });
+  }
+}
+function assertDecisionsProposable(path, content, baseSame, baseOther) {
+  const problems = [];
+  for (const line of content.split("\n")) {
+    if (line.startsWith("## ") && !DECISION_HEADING2.test(line)) {
+      problems.push(`heading "${line}" is not "## D<n> \u2014 AAAA-MM-JJ \u2014 <titre>"`);
+    }
+  }
+  const proposedIds = parseKnownDecisionIds(content);
+  const otherIds = parseKnownDecisionIds(baseOther ?? "");
+  const previousIds = parseKnownDecisionIds(baseSame ?? "");
+  for (const id of previousIds) {
+    if (!proposedIds.includes(id)) problems.push(`${id} was declared and is removed or renumbered`);
+  }
+  const all = [...proposedIds, ...otherIds];
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of all) {
+    if (seen.has(id)) problems.push(`${id} is declared twice across the decision files`);
+    seen.add(id);
+  }
+  const numbers = [...seen].map((id) => Number.parseInt(id.slice(1), 10)).sort((a, b) => a - b);
+  numbers.forEach((value, index) => {
+    if (value !== index + 1) problems.push(`numbering has a gap: expected D${index + 1}, found D${value}`);
+  });
+  for (const id of proposedIds.filter((candidate) => !previousIds.includes(candidate))) {
+    const section = extractDecisionSection(content, id) ?? "";
+    for (const bullet of DECISION_BULLETS) {
+      if (!section.includes(bullet)) problems.push(`${id} lacks its ${bullet} bullet`);
+    }
+  }
+  if (problems.length > 0) {
+    throwOgygieError({
+      code: "DECISION_INVALID",
+      message: `The proposed decisions file breaks the D<n> contract (${problems.length} problem(s)).`,
+      file: path,
+      cause: problems.join(" ; "),
+      suggestedFix: "Keep every existing decision, number the new one right after the last across both files, and give it its D\xE9cision / Motivation / Exclut bullets."
+    });
+  }
+}
+function assertDecisionReferencesKnown(path, content, known) {
+  const unknown = findUnknownDecisionReferences(content, known);
+  if (unknown.length > 0) {
+    throwOgygieError({
+      code: "UNKNOWN_DECISION_REFERENCE",
+      message: `The proposal cites ${unknown.length} decision(s) the repo does not declare.`,
+      file: path,
+      cause: unknown.map((reference) => `${reference.decision} (line ${reference.line})`).join(", "),
+      suggestedFix: `Cite only declared decisions (${known.join(", ") || "<none>"}), or propose the decision first.`
+    });
+  }
+}
+function branchSlug(path) {
+  return path.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "");
+}
+function defaultBranchFor(target, path) {
+  return `mcp/${target.id}/${branchSlug(path)}`;
+}
+async function withGithub(action) {
+  try {
+    return await action();
+  } catch (thrown) {
+    if (thrown instanceof OgygieFailure) throw thrown;
+    return throwOgygieError({
+      code: "GITHUB_UNAVAILABLE",
+      message: "The GitHub client failed outside its contract.",
+      file: null,
+      cause: thrown instanceof Error ? thrown.message : String(thrown),
+      suggestedFix: "Retry \u2014 nothing was written, nothing is queued."
+    });
+  }
+}
+async function proposeChange(target, deps, input) {
+  const path = assertProposablePath(input.path);
+  const github = target.github;
+  const now = deps.now();
+  const recent = (deps.recentProposals.get(target.id) ?? []).filter((at) => now - at < HOUR_MS);
+  if (recent.length >= deps.rateLimitPerHour) {
+    const retryAfterSeconds = Math.ceil(((recent[0] ?? now) + HOUR_MS - now) / 1e3);
+    throwOgygieError({
+      code: "WRITE_RATE_LIMITED",
+      message: `Repo "${target.id}" already received ${recent.length} proposals this hour.`,
+      file: null,
+      cause: `limit=${deps.rateLimitPerHour}/hour`,
+      suggestedFix: `Retry in ${retryAfterSeconds} s, or merge or close the open proposals first.`
+    });
+  }
+  const client = deps.clientFor(github);
+  const baseSha = await withGithub(() => client.getBranchHead(github.defaultBranch));
+  if (baseSha === null) {
+    return throwOgygieError({
+      code: "GITHUB_UNAVAILABLE",
+      message: `Branch "${github.defaultBranch}" does not exist on ${github.owner}/${github.repo}.`,
+      file: null,
+      cause: "default branch head not found",
+      suggestedFix: "Fix `defaultBranch` in the GitHub coordinates of that repo."
+    });
+  }
+  const baseFiles = /* @__PURE__ */ new Map();
+  for (const decisionsPath of DECISION_FILES) {
+    const file = await withGithub(() => client.readFileAtRef(decisionsPath, baseSha));
+    baseFiles.set(decisionsPath, file?.content ?? null);
+  }
+  if (path.startsWith("specs/")) {
+    assertSpecProposable(path, input.content);
+    const known = DECISION_FILES.flatMap((file) => parseKnownDecisionIds(baseFiles.get(file) ?? ""));
+    assertDecisionReferencesKnown(path, input.content, known);
+  } else {
+    const other = DECISION_FILES.find((file) => file !== path) ?? DECISION_FILES[1];
+    assertDecisionsProposable(path, input.content, baseFiles.get(path) ?? null, baseFiles.get(other) ?? null);
+    const known = [...parseKnownDecisionIds(input.content), ...parseKnownDecisionIds(baseFiles.get(other) ?? "")];
+    assertDecisionReferencesKnown(path, input.content, known);
+  }
+  let branch = (deps.branchFor ?? defaultBranchFor)(target, path);
+  let branchHead = await withGithub(() => client.getBranchHead(branch));
+  let openPull = branchHead === null ? null : await withGithub(() => client.findOpenPullRequest(branch));
+  if (branchHead !== null && openPull === null) {
+    branch = `${branch}-${baseSha.slice(0, 7)}`;
+    branchHead = await withGithub(() => client.getBranchHead(branch));
+    openPull = branchHead === null ? null : await withGithub(() => client.findOpenPullRequest(branch));
+  }
+  const headOfBranch = branchHead;
+  const baseFile = await withGithub(() => client.readFileAtRef(path, baseSha));
+  const branchFile = headOfBranch === null ? null : await withGithub(() => client.readFileAtRef(path, headOfBranch));
+  const readsBranch = deps.readFrom === "branch" && headOfBranch !== null;
+  const compared = readsBranch ? branchFile : baseFile;
+  const comparedName = readsBranch ? branch : github.defaultBranch;
+  const local = await target.adapter.exists(path) ? await target.adapter.readFile(path) : null;
+  if ((compared?.content ?? null) !== local) {
+    throwOgygieError({
+      code: "REMOTE_CONFLICT",
+      message: `"${path}" changed on ${comparedName} since it was read.`,
+      file: path,
+      cause: `head sha=${compared?.sha ?? "<absent>"}, the read copy ${local === null ? "has no such file" : "differs"}`,
+      suggestedFix: "Re-read the file (details.headContent is the current head), reapply your change and propose again.",
+      details: { headSha: compared?.sha ?? null, headContent: compared?.content ?? null }
+    });
+  }
+  recent.push(now);
+  deps.recentProposals.set(target.id, recent);
+  const expectedSha = headOfBranch === null ? baseFile?.sha ?? null : branchFile?.sha ?? null;
+  if (headOfBranch === null) {
+    await withGithub(() => client.createBranch(branch, baseSha));
+  }
+  const author = deps.authorOf?.();
+  const commit = await withGithub(
+    () => client.commitFile({
+      branch,
+      path,
+      content: input.content,
+      message: input.message,
+      expectedSha,
+      ...author === void 0 ? {} : { author }
+    })
+  );
+  const pull = openPull ?? await withGithub(
+    () => client.openPullRequest({
+      branch,
+      base: github.defaultBranch,
+      title: (input.message.split("\n")[0] ?? input.message).slice(0, 72),
+      body: `${input.message}
+
+---
+${deps.originOf(path)}`
+    })
+  );
+  return {
+    repo: target.id,
+    path,
+    branch,
+    baseSha,
+    commitSha: commit.commitSha,
+    pullRequestNumber: pull.number,
+    pullRequestUrl: pull.url,
+    created: openPull === null
+  };
+}
+
+// src/server/storage/local-adapter.ts
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute as isAbsolute2, resolve as resolve2, sep as sep2 } from "node:path";
+function resolveInsideRoot2(rootDir, relativePath) {
+  const root = resolve2(rootDir);
+  const absolute = resolve2(root, relativePath);
+  if (isAbsolute2(relativePath) || absolute !== root && !absolute.startsWith(root + sep2)) {
+    throwOgygieError(
+      {
+        code: "PATH_OUTSIDE_REPO",
+        message: "The requested path escapes the repo root.",
+        file: relativePath,
+        cause: `relative path "${relativePath}" resolves to "${absolute}", outside "${root}"`,
+        suggestedFix: "Only address files inside the repo (specs/, ogygie.manifest.json)."
+      },
+      400
+    );
+  }
+  return absolute;
+}
+function createLocalSpecStorage(rootDir) {
+  const reader = createFilesystemRepoAdapter(rootDir);
+  return {
+    ...reader,
+    async write(path, content, _message) {
+      const absolute = resolveInsideRoot2(rootDir, path);
+      await mkdir(dirname(absolute), { recursive: true });
+      await writeFile(absolute, content, "utf8");
+    }
+  };
+}
+
+// src/server/app.ts
+import Fastify from "fastify";
+import {
+  hasZodFastifySchemaValidationErrors,
+  serializerCompiler,
+  validatorCompiler
+} from "fastify-type-provider-zod";
+
+// src/server/service.ts
+var SPECS_DIR = "specs";
+var TEMPLATE_PATH = "specs/_TEMPLATE.spec.md";
+var MANIFEST_PATH = "ogygie.manifest.json";
+var FRONTMATTER_BLOCK2 = /^---\n([\s\S]*?)\n---/;
+function splitSpecFile(content) {
+  const match = FRONTMATTER_BLOCK2.exec(content);
+  if (match === null || match[1] === void 0) return null;
+  return { frontmatterText: match[1], body: content.slice(match[0].length) };
+}
+function presentSectionsOf(body) {
+  const searchable = `
+${body}`;
+  const present = [];
+  let cursor = 0;
+  for (const section of SECTIONS_SPEC_OBLIGATOIRES) {
+    const position = searchable.indexOf(`
+${section}`, cursor);
+    if (position === -1) continue;
+    present.push(section);
+    cursor = position + section.length;
+  }
+  return present;
+}
+function missingSectionsOf(body) {
+  const present = new Set(presentSectionsOf(body));
+  return SECTIONS_SPEC_OBLIGATOIRES.filter((section) => !present.has(section));
+}
+function quoteFrontmatterElement(value, specPath) {
+  if (value.includes("\n") || value.includes('"') && value.includes("'")) {
+    throwOgygieError(
+      {
+        code: "SPEC_FRONTMATTER_UNSERIALIZABLE",
+        message: "A frontmatter array element cannot be written in the restricted spec format.",
+        file: specPath,
+        cause: `element ${JSON.stringify(value)} contains a newline or both quote kinds`,
+        suggestedFix: "Rewrite the element without newlines and with at most one kind of quote character."
+      },
+      422
+    );
+  }
+  return value.includes('"') ? `'${value}'` : `"${value}"`;
+}
+function serializeSpecFrontmatter(frontmatter, specPath) {
+  const quote = (value) => quoteFrontmatterElement(value, specPath);
+  const lines = [
+    `id: ${frontmatter.id}`,
+    `status: ${frontmatter.status}`,
+    `depends_on: [${frontmatter.depends_on.join(", ")}]`,
+    `priority: ${frontmatter.priority}`,
+    `refs: [${frontmatter.refs.map(quote).join(", ")}]`
+  ];
+  if (frontmatter.deferred.length > 0) {
+    lines.push(`deferred: [${frontmatter.deferred.map(quote).join(", ")}]`);
+  }
+  return lines.join("\n");
+}
+function specPathOf(specId) {
+  return `${SPECS_DIR}/${specId}.spec.md`;
+}
+function frontmatterInvalidError(filePath, cause) {
+  return ogygieError({
+    code: "SPEC_FRONTMATTER_INVALID",
+    message: `Spec ${filePath} has an invalid frontmatter.`,
+    file: filePath,
+    cause,
+    suggestedFix: "Fix the frontmatter in your editor to match packages/ogygie-core/src/spec.schema.ts \u2014 the studio never repairs a spec silently."
+  });
+}
+function parseSpec(filePath, fileName, content) {
+  const split = splitSpecFile(content);
+  if (split === null) {
+    return {
+      ok: false,
+      error: frontmatterInvalidError(
+        filePath,
+        "file does not start with a --- ... --- frontmatter block"
+      )
+    };
+  }
+  const parsed = parseSpecFrontmatter(split.frontmatterText);
+  if (parsed.problems.length > 0) {
+    return { ok: false, error: frontmatterInvalidError(filePath, parsed.problems.join(" ; ")) };
+  }
+  const checked = SpecFrontmatterSchema.safeParse(parsed.value);
+  if (!checked.success) {
+    return {
+      ok: false,
+      error: frontmatterInvalidError(
+        filePath,
+        checked.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join(" ; ")
+      )
+    };
+  }
+  const expectedId = fileName.replace(/\.spec\.md$/, "");
+  if (checked.data.id !== expectedId) {
+    return {
+      ok: false,
+      error: ogygieError({
+        code: "SPEC_ID_MISMATCH",
+        message: `Spec ${fileName} declares id "${checked.data.id}" \u2014 expected "${expectedId}".`,
+        file: filePath,
+        cause: `id=${checked.data.id} \u2260 filename ${expectedId}`,
+        suggestedFix: "Make the frontmatter id identical to the file name."
+      })
+    };
+  }
+  return { ok: true, spec: { frontmatter: checked.data, body: split.body } };
+}
+function toReadableSummary(filePath, spec) {
+  return {
+    id: spec.frontmatter.id,
+    status: spec.frontmatter.status,
+    priority: spec.frontmatter.priority,
+    depends_on: spec.frontmatter.depends_on,
+    filePath,
+    presentSections: presentSectionsOf(spec.body)
+  };
+}
+async function listSpecFileNames(deps) {
+  const entries = await deps.storage.listDirectory(SPECS_DIR);
+  return entries.map((entry) => entry.path).filter((path) => !path.includes("/")).filter((name) => name.endsWith(".spec.md") && !name.startsWith("_")).sort();
+}
+async function listSpecSummaries(deps) {
   const fileNames = await listSpecFileNames(deps);
   const summaries = [];
   for (const fileName of fileNames) {
@@ -947,64 +1532,180 @@ async function getManifest(deps) {
 }
 
 // src/server/schemas.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var SpecStatusSchema = SpecFrontmatterSchema.shape.status;
-var ReadableSpecSummarySchema = z5.object({
+var ReadableSpecSummarySchema = z6.object({
   id: FeatureNameSchema,
   status: SpecStatusSchema,
   priority: SpecFrontmatterSchema.shape.priority,
-  depends_on: z5.array(FeatureNameSchema),
-  filePath: z5.string(),
-  presentSections: z5.array(z5.string())
+  depends_on: z6.array(FeatureNameSchema),
+  filePath: z6.string(),
+  presentSections: z6.array(z6.string())
 });
-var UnreadableSpecSummarySchema = z5.object({
-  id: z5.string(),
-  filePath: z5.string(),
+var UnreadableSpecSummarySchema = z6.object({
+  id: z6.string(),
+  filePath: z6.string(),
   error: OgygieErrorSchema
 });
-var SpecSummarySchema = z5.union([
+var SpecSummarySchema = z6.union([
   ReadableSpecSummarySchema,
   UnreadableSpecSummarySchema
 ]);
-var ListSpecsOutputSchema = z5.object({
-  specs: z5.array(SpecSummarySchema)
+var ListSpecsOutputSchema = z6.object({
+  specs: z6.array(SpecSummarySchema)
 });
-var SpecParamsSchema = z5.object({
+var SpecParamsSchema = z6.object({
   specId: FeatureNameSchema
 });
-var GetSpecOutputSchema = z5.object({
+var GetSpecOutputSchema = z6.object({
   frontmatter: SpecFrontmatterSchema,
   /** Markdown body after the frontmatter block, byte-exact. */
-  body: z5.string(),
-  presentSections: z5.array(z5.string())
+  body: z6.string(),
+  presentSections: z6.array(z6.string())
 });
-var UpdateSpecInputSchema = z5.object({
+var UpdateSpecInputSchema = z6.object({
   frontmatter: SpecFrontmatterSchema,
   /** Omitted ⇒ the existing markdown body is preserved byte-exact. */
-  body: z5.string().max(2e5).optional()
+  body: z6.string().max(2e5).optional()
 });
-var UpdateSpecOutputSchema = z5.object({
+var UpdateSpecOutputSchema = z6.object({
   spec: ReadableSpecSummarySchema
 });
-var CreateSpecInputSchema = z5.object({
+var CreateSpecInputSchema = z6.object({
   id: FeatureNameSchema.max(80)
 });
-var CreateSpecOutputSchema = z5.object({
+var CreateSpecOutputSchema = z6.object({
   spec: ReadableSpecSummarySchema
 });
-var GetManifestOutputSchema = z5.object({
+var GetManifestOutputSchema = z6.object({
   manifest: OgygieManifestSchema
 });
+var BriefInputSchema = z6.object({
+  brief: z6.string().min(50).max(2e4),
+  /** Absent: the model names the new spec. Present and existing: an amendment. */
+  specId: FeatureNameSchema.optional()
+});
+var BriefOutputSchema = z6.object({
+  specId: FeatureNameSchema,
+  attempts: z6.number().int().min(1).max(2),
+  problemsFixed: z6.array(z6.string()),
+  /** No feature of the manifest carries this id: its first schemas.ts awaits the operator (D52, lot C). */
+  isNewFeature: z6.boolean(),
+  isAmendment: z6.boolean(),
+  /** D53: the compositions the model proposed for a screen, the retained one (the head's) first; empty when the rubric is not a screen. */
+  compositions: z6.array(z6.string()).default([]),
+  /** The generator's tally on the draft's `# Génération` block (lines bound without a model, lines carried by a hole); null without a block. */
+  generation: z6.object({ derivable: z6.number().int().nonnegative(), hole: z6.number().int().nonnegative() }).nullable().default(null),
+  usage: z6.array(
+    z6.object({ model: z6.string(), inputTokens: z6.number().int().nonnegative(), outputTokens: z6.number().int().nonnegative() })
+  )
+});
+var ChecksStateSchema = z6.enum(["green", "red", "pending", "none"]);
+var PullRequestStatusSchema = z6.object({
+  specId: FeatureNameSchema,
+  branch: z6.string(),
+  pullRequest: z6.object({ number: z6.number().int().positive(), url: z6.string(), headSha: z6.string(), title: z6.string() }).nullable(),
+  specStatus: z6.enum(["draft", "validated", "implemented", "unreadable", "absent"]),
+  checks: ChecksStateSchema,
+  checkRuns: z6.array(z6.object({ name: z6.string(), conclusion: z6.string().nullable() })),
+  mergeable: z6.boolean().nullable(),
+  requiredRole: z6.enum(["approver", "operator"]),
+  canMerge: z6.boolean(),
+  /** Each thing standing between the PR and its merge, in the user's language. */
+  blockers: z6.array(z6.string()),
+  labels: z6.array(z6.string()).default([]),
+  /** D52: the first schemas.ts of a new feature failed the gates twice — the operator has the hand (label needs-operator). */
+  needsOperator: z6.boolean().default(false)
+});
+var SpecPullRequestsSchema = z6.object({
+  pullRequests: z6.array(z6.object({ specId: FeatureNameSchema, number: z6.number().int().positive(), url: z6.string(), checks: ChecksStateSchema, needsOperator: z6.boolean().default(false) }))
+});
+var MergeOutputSchema = z6.object({
+  specId: FeatureNameSchema,
+  pullRequestNumber: z6.number().int().positive(),
+  mergeSha: z6.string(),
+  mergedBy: z6.string(),
+  mergedAt: z6.string()
+});
+var EnvironmentNameSchema = z6.enum(["development", "staging", "production"]);
+var PromotableEnvironmentSchema = z6.enum(["staging", "production"]);
+var EnvironmentParamsSchema = z6.object({ environment: PromotableEnvironmentSchema });
+var EnvironmentsStatusSchema = z6.object({
+  environments: z6.array(
+    z6.object({
+      name: EnvironmentNameSchema,
+      ref: z6.string(),
+      sha: z6.string().nullable(),
+      deployment: z6.object({ id: z6.number().int(), state: z6.string().nullable(), createdAt: z6.string() }).nullable()
+    })
+  ),
+  /** release/<date>.<n>, most recent first. */
+  releases: z6.array(z6.string())
+});
+var PromotionInputSchema = z6.object({
+  sha: z6.string().regex(/^[0-9a-f]{40}$/),
+  /** Operator only: a step back, forced, with its reason. */
+  rollback: z6.boolean().optional(),
+  reason: z6.string().min(10).max(2e3).optional()
+});
+var PromotionRecordSchema = z6.object({
+  environment: PromotableEnvironmentSchema,
+  fromSha: z6.string().nullable(),
+  toSha: z6.string(),
+  actor: z6.string(),
+  at: z6.string(),
+  deploymentId: z6.number().int(),
+  releaseTag: z6.string().nullable(),
+  includedPullRequests: z6.array(z6.object({ number: z6.number().int(), specId: z6.string().nullable(), message: z6.string(), authoredAt: z6.string() })),
+  destructiveMigration: z6.boolean(),
+  rollback: z6.boolean()
+});
+var ConsumptionQuerySchema = z6.object({ month: z6.string().regex(/^\d{4}-\d{2}$/).optional() });
+var ConsumptionReportSchema = z6.object({
+  month: z6.string(),
+  specs: z6.array(
+    z6.object({
+      specId: z6.string(),
+      pullRequestNumber: z6.number().int(),
+      runs: z6.number().int(),
+      inputTokens: z6.number().int(),
+      outputTokens: z6.number().int(),
+      estimatedUsd: z6.number(),
+      uncostedModels: z6.array(z6.string())
+    })
+  ),
+  totals: z6.object({ runs: z6.number().int(), inputTokens: z6.number().int(), outputTokens: z6.number().int(), estimatedUsd: z6.number() }),
+  budgetUsd: z6.number().nullable(),
+  budgetRatio: z6.number().nullable(),
+  warning: z6.boolean()
+});
+var PreviewEntrySchema = z6.object({ state: z6.string(), path: z6.string(), sizeBytes: z6.number().int().nonnegative() });
+var PreviewsListSchema = z6.object({
+  specId: FeatureNameSchema,
+  /** In the order of the states: empty, loading, nominal, error, then the rest — the pages of the composition the head declares, or of the root. */
+  previews: z6.array(PreviewEntrySchema),
+  /** D53: the composition the spec at the head declares under `# Design`; null when the screen has one composition. */
+  composition: z6.string().nullable().default(null),
+  /** D53: every composition the branch rendered, `selected` for the head's. */
+  compositions: z6.array(z6.object({ name: z6.string(), selected: z6.boolean(), previews: z6.array(PreviewEntrySchema) })).default([])
+});
+var SelectCompositionOutputSchema = z6.object({
+  specId: FeatureNameSchema,
+  composition: z6.string(),
+  /** The head already declared it: nothing was written. */
+  alreadySelected: z6.boolean()
+});
 
 // src/server/routes.ts
-async function registerStudioRoutes(app, deps) {
+async function registerStudioRoutes(app, resolver) {
   const route = app.withTypeProvider();
+  const depsOf = (request) => typeof resolver === "function" ? resolver(request) : resolver;
   route.route({
     method: "GET",
     url: "/api/specs",
     schema: { response: { 200: ListSpecsOutputSchema } },
-    handler: async (_request, reply) => {
-      return reply.code(200).send({ specs: await listSpecSummaries(deps) });
+    handler: async (request, reply) => {
+      return reply.code(200).send({ specs: await listSpecSummaries(depsOf(request)) });
     }
   });
   route.route({
@@ -1012,7 +1713,7 @@ async function registerStudioRoutes(app, deps) {
     url: "/api/specs/:specId",
     schema: { params: SpecParamsSchema, response: { 200: GetSpecOutputSchema } },
     handler: async (request, reply) => {
-      return reply.code(200).send(await getSpec(deps, request.params.specId));
+      return reply.code(200).send(await getSpec(depsOf(request), request.params.specId));
     }
   });
   route.route({
@@ -1024,7 +1725,7 @@ async function registerStudioRoutes(app, deps) {
       response: { 200: UpdateSpecOutputSchema }
     },
     handler: async (request, reply) => {
-      const spec = await saveSpec(deps, request.params.specId, request.body);
+      const spec = await saveSpec(depsOf(request), request.params.specId, request.body);
       return reply.code(200).send({ spec });
     }
   });
@@ -1036,7 +1737,7 @@ async function registerStudioRoutes(app, deps) {
       response: { 201: CreateSpecOutputSchema }
     },
     handler: async (request, reply) => {
-      const spec = await createSpec(deps, request.body.id);
+      const spec = await createSpec(depsOf(request), request.body.id);
       return reply.code(201).send({ spec });
     }
   });
@@ -1044,28 +1745,1410 @@ async function registerStudioRoutes(app, deps) {
     method: "GET",
     url: "/api/manifest",
     schema: { response: { 200: GetManifestOutputSchema } },
-    handler: async (_request, reply) => {
-      return reply.code(200).send({ manifest: await getManifest(deps) });
+    handler: async (request, reply) => {
+      return reply.code(200).send({ manifest: await getManifest(depsOf(request)) });
     }
   });
 }
 
-// src/server/app.ts
-async function createStudioApp(options) {
-  const app = Fastify({ logger: false });
-  app.setValidatorCompiler(validatorCompiler);
-  app.setSerializerCompiler(serializerCompiler);
-  app.setErrorHandler((error, _request, reply) => {
-    if (error instanceof OgygieFailure) {
-      return reply.status(error.httpStatus).send(error.error);
-    }
-    if (hasZodFastifySchemaValidationErrors(error)) {
-      return reply.status(400).send(
-        ogygieError({
-          code: "CONTRACT_VALIDATION_FAILED",
-          message: "The request does not satisfy the route's input contract.",
-          file: null,
-          cause: error.validation.map((issue) => `${issue.instancePath || "(root)"}: ${issue.message ?? "invalid"}`).join(" ; "),
+// src/server/hosted/routes.ts
+import { z as z8 } from "zod";
+
+// src/server/hosted/auth.ts
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+var MAGIC_LINK_TTL_MS = 15 * 60 * 1e3;
+var SESSION_COOKIE = "ogygie_host_session";
+var base64url = (input) => Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var fromBase64url = (input) => Buffer.from(input.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+function sign(payload, secret) {
+  return base64url(createHmac("sha256", secret).update(payload).digest());
+}
+function seal(value, secret) {
+  const payload = base64url(JSON.stringify(value));
+  return `${payload}.${sign(payload, secret)}`;
+}
+function open(token, secret) {
+  const [payload, signature, ...rest] = token.split(".");
+  if (payload === void 0 || signature === void 0 || rest.length > 0) return null;
+  const expected = Buffer.from(sign(payload, secret));
+  const given = Buffer.from(signature);
+  if (expected.length !== given.length || !timingSafeEqual(expected, given)) return null;
+  try {
+    const parsed = JSON.parse(fromBase64url(payload).toString("utf8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function issueMagicLink(deps, email) {
+  const exp = deps.now() + (deps.ttlMs ?? MAGIC_LINK_TTL_MS);
+  return seal({ kind: "magic-link", email: email.toLowerCase(), exp, nonce: randomBytes(16).toString("hex") }, deps.secret);
+}
+function consumeMagicLink(deps, token) {
+  const now = deps.now();
+  for (const [nonce2, exp2] of deps.consumed) if (exp2 <= now) deps.consumed.delete(nonce2);
+  const value = open(token, deps.secret);
+  const email = value?.["email"];
+  const exp = value?.["exp"];
+  const nonce = value?.["nonce"];
+  const valid = value?.["kind"] === "magic-link" && typeof email === "string" && typeof exp === "number" && typeof nonce === "string" && exp > now && !deps.consumed.has(nonce);
+  if (!valid) {
+    return throwOgygieError(
+      {
+        code: "MAGIC_LINK_EXPIRED",
+        message: "This sign-in link is invalid, expired or already used.",
+        file: null,
+        cause: value === null ? "signature or format invalid" : "expired or consumed",
+        suggestedFix: "Ask for a new link from the sign-in screen; each link works once, for fifteen minutes."
+      },
+      401
+    );
+  }
+  deps.consumed.set(nonce, exp);
+  return email;
+}
+function issueSession(deps, email) {
+  return seal({ kind: "session", email: email.toLowerCase(), exp: deps.now() + deps.ttlHours * 36e5 }, deps.secret);
+}
+function readSession(deps, cookieHeader) {
+  const token = cookieValue(cookieHeader, SESSION_COOKIE);
+  if (token === null) return null;
+  const value = open(token, deps.secret);
+  const email = value?.["email"];
+  const exp = value?.["exp"];
+  if (value?.["kind"] !== "session" || typeof email !== "string" || typeof exp !== "number" || exp <= deps.now()) {
+    return null;
+  }
+  return email;
+}
+function cookieValue(cookieHeader, name) {
+  if (cookieHeader === void 0) return null;
+  for (const part of cookieHeader.split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name) return decodeURIComponent(rest.join("="));
+  }
+  return null;
+}
+function sessionCookie(value, ttlHours) {
+  return `${SESSION_COOKIE}=${encodeURIComponent(value)}; Path=/; Max-Age=${ttlHours * 3600}; HttpOnly; Secure; SameSite=Lax`;
+}
+function clearedSessionCookie() {
+  return `${SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
+}
+var ROLE_RANK = { reader: 0, author: 1, approver: 2, operator: 3 };
+function hasRole(user, required) {
+  return ROLE_RANK[user.role] >= ROLE_RANK[required];
+}
+function requireRole(user, required, action) {
+  if (hasRole(user, required)) return;
+  throwOgygieError(
+    {
+      code: "HOST_ROLE_FORBIDDEN",
+      message: `"${action}" requires the ${required} role.`,
+      file: null,
+      cause: `${user.email} has role ${user.role}`,
+      suggestedFix: `Ask the operator to grant the ${required} role in the instance configuration.`
+    },
+    403
+  );
+}
+function unauthenticated(cause) {
+  return throwOgygieError(
+    {
+      code: "HOST_UNAUTHENTICATED",
+      message: "This hosted studio requires a signed-in user.",
+      file: null,
+      cause,
+      suggestedFix: "Sign in at /login \u2014 a magic link is sent to a declared email address."
+    },
+    401
+  );
+}
+
+// src/server/hosted/config.ts
+import { z as z7 } from "zod";
+var HostRoleSchema = z7.enum(["reader", "author", "approver", "operator"]);
+var MergePolicySchema = z7.enum(["client", "operator"]);
+var HostUserSchema = z7.object({
+  email: z7.email(),
+  displayName: z7.string().min(1).max(120),
+  role: HostRoleSchema
+});
+var HostConfigSchema = z7.object({
+  repo: GithubCoordinatesSchema,
+  githubApp: z7.object({
+    appId: z7.string().min(1),
+    installationId: z7.string().min(1),
+    privateKeyPath: z7.string().min(1)
+  }),
+  users: z7.array(HostUserSchema).min(1),
+  /** "operator" at onboarding: the agency keeps the merge until it hands it over (D48). */
+  mergePolicy: MergePolicySchema.default("operator"),
+  writeRateLimit: z7.number().int().positive().default(20),
+  session: z7.object({
+    secretPath: z7.string().min(1),
+    ttlHours: z7.number().int().positive().max(168).default(24)
+  }),
+  mail: z7.object({
+    fromAddress: z7.email(),
+    /** HTTP endpoint of the mail provider: POST JSON { from, to, subject, text }. */
+    providerUrl: z7.url(),
+    apiKeyPath: z7.string().min(1)
+  }),
+  /** Base of the magic links — what the client's browser can reach. */
+  publicUrl: z7.url(),
+  /** Lot D (D49): the two promotable refs. Optional until that lot lands. */
+  environments: z7.object({
+    staging: z7.object({ ref: z7.literal("env/staging") }),
+    production: z7.object({ ref: z7.literal("env/production") })
+  }).optional(),
+  /**
+   * The client's model workspace (D50). Present, the brief → spec route exists
+   * and the launcher requires OGYGIE_MODEL_API_KEY; absent, the instance never
+   * calls a model. `specModel` is the `spec` model of D24.
+   */
+  model: z7.object({
+    specModel: z7.string().min(1).default("claude-fable-5-1"),
+    workspaceId: z7.string().min(1).optional(),
+    monthlyBudgetUsd: z7.number().positive().optional(),
+    /** USD per million tokens, by model id — overrides the built-in table of the estimate (B8). */
+    costPerMillionUsd: z7.record(z7.string(), z7.object({ input: z7.number().nonnegative(), output: z7.number().nonnegative() })).optional()
+  }).optional()
+});
+function parseHostConfig(raw, configPath) {
+  const parsed = HostConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    return throwOgygieError({
+      code: "HOST_CONFIG_INVALID",
+      message: "The hosted studio configuration does not match HostConfigSchema.",
+      file: configPath,
+      cause: parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join(" ; "),
+      suggestedFix: "Fix the listed fields \u2014 see HostConfigSchema in @ogygie/studio (repo, githubApp, users, session, mail, publicUrl)."
+    });
+  }
+  return parsed.data;
+}
+function findHostUser(config, email) {
+  const wanted = email.trim().toLowerCase();
+  return config.users.find((user) => user.email.toLowerCase() === wanted) ?? null;
+}
+
+// src/server/hosted/routes.ts
+var usersByRequest = /* @__PURE__ */ new WeakMap();
+function hostedUserOf(request) {
+  const user = usersByRequest.get(request);
+  if (user === void 0) return unauthenticated("no session attached to this request");
+  return user;
+}
+var MagicLinkInputSchema = z8.object({ email: z8.email() });
+var CallbackQuerySchema = z8.object({ token: z8.string().min(1) });
+var MeOutputSchema = z8.object({
+  email: z8.email(),
+  displayName: z8.string(),
+  role: HostRoleSchema
+});
+async function registerHostedRoutes(app, deps) {
+  const sessions = {
+    secret: deps.sessionSecret,
+    now: deps.now,
+    ttlHours: deps.config.session.ttlHours
+  };
+  const links = {
+    secret: deps.sessionSecret,
+    now: deps.now,
+    consumed: deps.consumedLinks,
+    ...deps.magicLinkTtlMs === void 0 ? {} : { ttlMs: deps.magicLinkTtlMs }
+  };
+  const PUBLIC_ROUTES = /* @__PURE__ */ new Set(["/api/auth/magic-link", "/api/auth/callback", "/api/auth/logout"]);
+  app.addHook("onRequest", async (request) => {
+    const url = request.url.split("?")[0] ?? request.url;
+    if (!url.startsWith("/api/") || PUBLIC_ROUTES.has(url)) return;
+    const email = readSession(sessions, request.headers.cookie);
+    if (email === null) return unauthenticated("missing or expired session cookie");
+    const user = findHostUser(deps.config, email);
+    if (user === null) return unauthenticated(`session for ${email}, no longer a declared user`);
+    usersByRequest.set(request, user);
+  });
+  const route = app.withTypeProvider();
+  route.route({
+    method: "POST",
+    url: "/api/auth/magic-link",
+    schema: { body: MagicLinkInputSchema, response: { 202: z8.object({ accepted: z8.literal(true) }) } },
+    handler: async (request, reply) => {
+      const user = findHostUser(deps.config, request.body.email);
+      if (user === null) {
+        deps.log(JSON.stringify({ action: "magic-link", outcome: "HOST_USER_UNKNOWN" }));
+      } else {
+        const token = issueMagicLink(links, user.email);
+        const link = `${deps.config.publicUrl.replace(/\/$/, "")}/api/auth/callback?token=${encodeURIComponent(token)}`;
+        await deps.mail.send({
+          to: user.email,
+          subject: "Votre lien de connexion au studio",
+          text: `Bonjour ${user.displayName},
+
+Ouvrez ce lien pour vous connecter (valable quinze minutes, une seule fois) :
+${link}
+`
+        });
+        deps.log(JSON.stringify({ action: "magic-link", actor: user.email, outcome: "sent" }));
+      }
+      return reply.code(202).send({ accepted: true });
+    }
+  });
+  route.route({
+    method: "GET",
+    url: "/api/auth/callback",
+    schema: { querystring: CallbackQuerySchema },
+    handler: async (request, reply) => {
+      const email = consumeMagicLink(links, request.query.token);
+      const user = findHostUser(deps.config, email);
+      if (user === null) return unauthenticated(`link for ${email}, no longer a declared user`);
+      deps.log(JSON.stringify({ action: "sign-in", actor: user.email, outcome: "ok" }));
+      return reply.header("set-cookie", sessionCookie(issueSession(sessions, user.email), deps.config.session.ttlHours)).redirect("/", 302);
+    }
+  });
+  route.route({
+    method: "GET",
+    url: "/api/auth/me",
+    schema: { response: { 200: MeOutputSchema } },
+    handler: async (request, reply) => {
+      return reply.code(200).send(hostedUserOf(request));
+    }
+  });
+  route.route({
+    method: "POST",
+    url: "/api/auth/logout",
+    handler: async (_request, reply) => {
+      return reply.header("set-cookie", clearedSessionCookie()).code(204).send();
+    }
+  });
+}
+
+// src/server/hosted/brief.ts
+import { z as z9 } from "zod";
+import { checkSpec, generationGrammarCard, readManifestGeneration } from "@ogygie/generate";
+var TEMPLATE_PATH2 = "specs/_TEMPLATE.spec.md";
+var PRODUCT_RULES_PATH = "AGENTS.product.md";
+var MANIFEST_PATH2 = "ogygie.manifest.json";
+var DESIGN_TOKENS_PATH = "design/tokens.json";
+var PATTERNS_CATALOG_PATH = "design/patterns.md";
+var DESIGN_BRIEFS_DIR = "design/briefs";
+var MAX_ATTEMPTS = 2;
+var MAX_ATTEMPTS_GENERATED = 3;
+var MAX_COMPOSITIONS = 3;
+var COMPOSITION_SEPARATOR = "=== COMPOSITION ===";
+var DERIVED_BRIEF_MAX = 6e3;
+var BRIEF_IN_MESSAGE_MAX = 2e3;
+async function readIfPresent(storage, path) {
+  return await storage.exists(path) ? storage.readFile(path) : null;
+}
+var ManifestRouteSchema = z9.looseObject({ method: z9.string(), path: z9.string(), schemaInput: z9.string().optional(), schemaOutput: z9.string().optional(), invalidates: z9.array(z9.string()).optional() });
+var ManifestForPromptSchema = z9.looseObject({
+  product: z9.looseObject({ name: z9.string(), description: z9.string().optional() }).optional(),
+  features: z9.array(z9.looseObject({ name: z9.string(), intent: z9.string().optional(), status: z9.string().optional(), spec: z9.string().nullable().optional(), routes: z9.array(ManifestRouteSchema).optional() })).optional()
+});
+async function manifestSummary(storage) {
+  const raw = await readIfPresent(storage, MANIFEST_PATH2);
+  const featureIds = /* @__PURE__ */ new Set();
+  if (raw === null) return { text: "(manifeste absent)", featureIds, generation: null, features: [] };
+  let parsed;
+  let rawJson;
+  try {
+    rawJson = JSON.parse(raw);
+    parsed = ManifestForPromptSchema.safeParse(rawJson);
+  } catch {
+    return { text: "(manifeste illisible)", featureIds, generation: null, features: [] };
+  }
+  if (!parsed.success) return { text: "(manifeste illisible)", featureIds, generation: null, features: [] };
+  const generationRead = readManifestGeneration(rawJson);
+  const generation = generationRead.ok ? generationRead.generation : null;
+  const product = parsed.data.product;
+  const lines = [
+    product === void 0 ? "Produit : (non nomm\xE9)" : `Produit : ${product.name}${product.description === void 0 ? "" : ` \u2014 ${product.description}`}`,
+    "Features d\xE9clar\xE9es au manifeste :"
+  ];
+  for (const feature of parsed.data.features ?? []) {
+    featureIds.add(feature.name);
+    lines.push(`- ${feature.name} (${feature.status ?? "?"}) : ${feature.intent ?? ""}`);
+  }
+  return { text: lines.join("\n"), featureIds, generation, features: parsed.data.features ?? [] };
+}
+async function consumedFeaturesOf(storage, features, generation, consumedIds) {
+  const consumed = /* @__PURE__ */ new Map();
+  for (const featureId of consumedIds) {
+    const entry = features.find((feature) => feature.name === featureId);
+    if (entry === void 0) continue;
+    const specPath = entry.spec ?? null;
+    const markdown = specPath === null ? null : await readIfPresent(storage, specPath);
+    const report = markdown === null || specPath === null ? null : checkSpec({ markdown, specPath, generation });
+    consumed.set(featureId, {
+      featureId,
+      block: report?.kind === "feature" ? report.block : null,
+      schemas: null,
+      routes: (entry.routes ?? []).map((route) => ({ method: route.method, path: route.path, schemaInput: route.schemaInput ?? "", schemaOutput: route.schemaOutput ?? "", ...route.invalidates === void 0 ? {} : { invalidates: [...route.invalidates] } }))
+    });
+  }
+  return consumed;
+}
+async function judgeGeneration(input) {
+  const first = checkSpec({ markdown: input.content, specPath: input.specPath, generation: input.generation });
+  if (!first.generated) return { problems: [], tally: null };
+  if (input.generation === null) return { problems: ["# G\xE9n\xE9ration: the product's manifest declares no generation block \u2014 remove the section, this product is not generated"], tally: null };
+  const report = first.kind === "screen" && first.screen !== null ? checkSpec({ markdown: input.content, specPath: input.specPath, generation: input.generation, consumed: await consumedFeaturesOf(input.storage, input.features, input.generation, first.screen.consumes.map((consumed) => consumed.feature)) }) : first;
+  const problems = report.problems.map((problem) => `${problem.code}${problem.details?.["path"] === void 0 ? "" : ` ${String(problem.details["path"])}`}${problem.details?.["line"] === void 0 ? "" : ` (line ${String(problem.details["line"])})`}: ${problem.cause}`);
+  return { problems, tally: { derivable: report.tally.derivable, hole: report.tally.hole } };
+}
+async function existingSpecIds(storage) {
+  const entries = await storage.listDirectory("specs");
+  return entries.map((entry) => entry.path).filter((path) => !path.includes("/") && path.endsWith(".spec.md") && !path.startsWith("_")).map((path) => path.replace(/\.spec\.md$/, "")).sort();
+}
+function buildBriefPrompt(context) {
+  const system = [
+    "Tu r\xE9diges des SPECS de features pour un produit construit avec le framework Ogygie. Une spec est un contrat, relu et sign\xE9 par un humain non d\xE9veloppeur, puis impl\xE9ment\xE9 par une cha\xEEne de g\xE9n\xE9ration : tu \xE9cris pour ce lecteur, en fran\xE7ais, pr\xE9cis, sans jargon.",
+    "",
+    "FORME OBLIGATOIRE \u2014 le fichier entier, et rien d'autre (pas de cl\xF4ture ``` autour, pas de commentaire avant ou apr\xE8s) :",
+    "- un frontmatter YAML entre deux lignes `---`, au format RESTREINT : une cl\xE9 par ligne, scalaires ou tableaux de scalaires entre crochets, jamais d'objet imbriqu\xE9 ; cl\xE9s exactes : id (kebab-case, identique au nom du fichier), status (toujours `draft`), depends_on (tableau d'ids de specs existantes), priority (P0, P1 ou P2), refs (tableau de cha\xEEnes) ; `deferred` seulement si non vide, au format \"<RAISON> blockedBy:<id-kebab>\".",
+    "- puis SIX sections, dans cet ordre exact, titres au niveau `# ` : `# @intent`, `# Comportements`, `# Contrats de donn\xE9es`, `# \xC9tats UI`, `# Non-objectifs`, `# Budget`.",
+    "- Comportements : une liste de triplets `- \xC9TANT DONN\xC9 <contexte>` / `QUAND <action>` / `ALORS <r\xE9sultat observable>`, un par ligne de puce, en fran\xE7ais lisible. Les codes d'erreur, noms de sch\xE9mas et valeurs d'enum sont en ANGLAIS (ex. ORDER_REFERENCE_ALREADY_USED, CreateOrderInputSchema).",
+    "- Contrats de donn\xE9es : esquisse des sch\xE9mas (noms suffix\xE9s Schema, champs et types), jamais de code TypeScript complet.",
+    "- \xC9tats UI : vide / chargement / nominal / erreur, et ce que chacun montre.",
+    "- Non-objectifs : ce que la feature ne fait PAS.",
+    "- Budget : performance, d\xE9pendances (aucune nouvelle sans justification).",
+    "",
+    "R\xC8GLES DE FOND :",
+    "- Tu ne cites une d\xE9cision `D<n>` QUE si elle figure dans la liste des d\xE9cisions connues ci-dessous ; sinon n'en cite aucune.",
+    "- Tu n'inventes ni table, ni route, ni feature existante : tu t'appuies sur la carte du produit ci-dessous ; une rubrique nouvelle nomme ses propres contrats.",
+    "- Tu n'\xE9cris jamais de code ni de design (couleurs, composants) : la spec dit QUOI, jamais COMMENT. Le bloc YAML de `# G\xE9n\xE9ration` n'est pas du code : c'est la d\xE9claration que le g\xE9n\xE9rateur lit.",
+    ...context.grammarCard === null || context.grammarCard === void 0 ? [] : ["- Quand la rubrique apporte des op\xE9rations ou un \xE9cran que le g\xE9n\xE9rateur sait d\xE9river, \xE9cris la section `# G\xE9n\xE9ration` apr\xE8s `# @intent` et ses `# Comportements` dans la grammaire ferm\xE9e (carte ci-dessous) : le brouillon est jug\xE9 par le v\xE9rificateur du g\xE9n\xE9rateur avant d'\xEAtre montr\xE9. Quand elle ne se g\xE9n\xE8re pas, n'\xE9cris pas la section."],
+    "- Tu ne proposes jamais `status: validated` ni `implemented` : valider est le geste de l'humain.",
+    "- Quand la rubrique est un \xC9CRAN (une page du tableau de bord), ajoute apr\xE8s `# Budget` une section `# Design` qui commence par une ligne `Composition : <nom-kebab>` (le nom de la disposition, ex. `liste-d-abord`), puis l'ordre des vues, le pattern du catalogue de chacune (liste, formulaire, \xE9tat vide\u2026) et les \xE9tats mis en avant \u2014 jamais une couleur, jamais un composant invent\xE9.",
+    "",
+    "GABARIT DU REPO (\xE0 respecter \xE0 la lettre) :",
+    context.template,
+    "",
+    "R\xC8GLES PRODUIT (AGENTS.product.md) :",
+    context.productRules ?? "(aucune r\xE8gle produit d\xE9clar\xE9e)",
+    "",
+    "CARTE DU PRODUIT :",
+    context.manifestText,
+    "",
+    `SPECS EXISTANTES (ids) : ${context.specIds.join(", ") || "(aucune)"}`,
+    `D\xC9CISIONS CONNUES (seules citables) : ${context.knownDecisionIds.join(", ") || "(aucune)"}`,
+    ...context.grammarCard === null || context.grammarCard === void 0 ? [] : ["", context.grammarCard]
+  ].join("\n");
+  const user = [
+    context.existingSpec === null ? context.specId === void 0 ? "R\xE9dige une spec NOUVELLE \xE0 partir du brief ci-dessous. Choisis un id kebab-case en fran\xE7ais, court, qui ne soit pas d\xE9j\xE0 pris." : `R\xE9dige une spec NOUVELLE d'id \`${context.specId}\` \xE0 partir du brief ci-dessous.` : `AMENDE la spec existante \`${context.specId ?? ""}\` ci-dessous selon le brief : conserve ce qui n'est pas remis en cause, r\xE9\xE9cris ce qui l'est, et d\xE9cris toujours l'\xE9tat voulu complet (jamais un delta). Garde \`status: draft\`.`,
+    "",
+    ...context.existingSpec === null ? [] : ["SPEC EXISTANTE :", context.existingSpec, ""],
+    "BRIEF :",
+    context.brief.trim()
+  ].join("\n");
+  return { system, user };
+}
+function designContextOf(material) {
+  const lines = [];
+  if (material.tokensJson !== null) {
+    try {
+      const tokens2 = JSON.parse(material.tokensJson);
+      for (const [group, value] of Object.entries(tokens2)) {
+        if (group.startsWith("$") || typeof value !== "object" || value === null) continue;
+        lines.push(`- ${group} : ${Array.isArray(value) ? value.join(", ") : Object.keys(value).join(", ")}`);
+      }
+    } catch {
+      lines.push("- (design/tokens.json illisible)");
+    }
+  }
+  const tokens = lines.length === 0 ? "(aucun token d\xE9clar\xE9)" : lines.join("\n");
+  const patterns = material.patternsCatalog === null ? "(aucun catalogue de patterns)" : [...material.patternsCatalog.matchAll(/^## +(.+?) *$\n+([^\n]*)/gmu)].map((match) => `- ${match[1] ?? ""} : ${(match[2] ?? "").split(/(?<=\.)\s/u)[0] ?? ""}`.slice(0, 220)).join("\n") || "(catalogue sans fiche)";
+  const derived = material.derivedBrief === null ? "" : `
+BRIEF DE DESIGN D\xC9RIV\xC9 DE LA FEATURE :
+${material.derivedBrief.length > DERIVED_BRIEF_MAX ? `${material.derivedBrief.slice(0, DERIVED_BRIEF_MAX)} (\u2026)` : material.derivedBrief}
+`;
+  return `TOKENS DE DESIGN (seuls noms employables) :
+${tokens}
+
+CATALOGUE DES PATTERNS (seules briques d'\xE9cran) :
+${patterns}
+${derived}`;
+}
+function buildCompositionsPrompt(input) {
+  const others = MAX_COMPOSITIONS - 1;
+  return {
+    system: `${input.system}
+
+${input.designContext}`,
+    user: [
+      `La spec ci-dessous d\xE9crit un \xE9cran dont la composition retenue par d\xE9faut s'appelle \`${input.composition}\`. Propose jusqu'\xE0 ${others} AUTRES compositions de ce m\xEAme \xE9cran \u2014 un autre ordre des vues, un autre pattern par vue, d'autres \xE9tats mis en avant \u2014 sans changer les comportements, les contrats ni l'id.`,
+      `R\xE9ponds avec, pour chacune, la SPEC COMPL\xC8TE (frontmatter et les six sections, puis \`# Design\` avec sa propre ligne \`Composition : <nom-kebab>\`, un nom diff\xE9rent), les specs s\xE9par\xE9es par une ligne contenant exactement \`${COMPOSITION_SEPARATOR}\`. Rien d'autre. Si une seule disposition a du sens, r\xE9ponds \`${COMPOSITION_SEPARATOR}\` seul.`,
+      "",
+      "SPEC RETENUE :",
+      input.specText.trim()
+    ].join("\n")
+  };
+}
+function splitCompositions(answer) {
+  return answer.split(COMPOSITION_SEPARATOR).map((part) => part.trim()).filter((part) => part.includes("---")).map((part) => extractSpecText(part));
+}
+function extractSpecText(answer) {
+  const whole = answer.trim();
+  let candidate = whole;
+  if (!whole.startsWith("---")) {
+    const opening = [...answer.matchAll(/```(?:markdown|md|yaml)?[^\n]*\n/g)].find((fence) => answer.slice((fence.index ?? 0) + fence[0].length).trimStart().startsWith("---"));
+    if (opening !== void 0) {
+      const from = (opening.index ?? 0) + opening[0].length;
+      const to = answer.lastIndexOf("```");
+      candidate = (to > from ? answer.slice(from, to) : answer.slice(from)).trim();
+    }
+  }
+  const start = candidate.indexOf("---");
+  const text = start === -1 ? candidate : candidate.slice(start);
+  return text.endsWith("\n") ? text : `${text}
+`;
+}
+function judgeDraft(input) {
+  const parsed = parseSpecDocument(input.content);
+  const problems = [];
+  const specId = parsed.frontmatter?.id ?? null;
+  if (specId === null) {
+    problems.push(...parsed.problems.map((problem) => `frontmatter: ${problem}`));
+    return { specId, problems };
+  }
+  if (input.expectedId !== void 0 && specId !== input.expectedId) {
+    problems.push(`id "${specId}" was asked as "${input.expectedId}"`);
+  }
+  if (!input.isAmendment && input.takenIds.includes(specId)) {
+    problems.push(`id "${specId}" is already taken by an existing spec \u2014 choose another id`);
+  }
+  if (parsed.frontmatter?.status !== "draft") {
+    problems.push(`status must be draft (got ${parsed.frontmatter?.status ?? "none"})`);
+  }
+  try {
+    assertSpecProposable(`specs/${specId}.spec.md`, input.content);
+  } catch (thrown) {
+    if (thrown instanceof OgygieFailure) problems.push(thrown.error.cause ?? thrown.error.message);
+    else throw thrown;
+  }
+  for (const reference of findUnknownDecisionReferences(input.content, input.knownDecisionIds)) {
+    problems.push(`${reference.decision} (line ${reference.line}) is not a declared decision \u2014 cite none, or a known one`);
+  }
+  return { specId, problems: [...new Set(problems)] };
+}
+async function draftSpecFromBrief(deps, input) {
+  if (input.specId !== void 0 && !FeatureNameSchema.safeParse(input.specId).success) {
+    throwOgygieError(
+      {
+        code: "CONTRACT_VALIDATION_FAILED",
+        message: "The spec id must be kebab-case.",
+        file: null,
+        cause: `specId=${input.specId}`,
+        suggestedFix: "Use lowercase words separated by hyphens, e.g. suivi-des-commandes."
+      },
+      400
+    );
+  }
+  const template = await readIfPresent(deps.storage, TEMPLATE_PATH2);
+  if (template === null) {
+    throwOgygieError({
+      code: "SPEC_TEMPLATE_NOT_FOUND",
+      message: "specs/_TEMPLATE.spec.md is missing \u2014 the model writes from it.",
+      file: TEMPLATE_PATH2,
+      cause: "template file unreadable",
+      suggestedFix: "Restore specs/_TEMPLATE.spec.md from the framework skeleton."
+    });
+  }
+  const [productRules, manifest, specIds] = await Promise.all([
+    readIfPresent(deps.storage, PRODUCT_RULES_PATH),
+    manifestSummary(deps.storage),
+    existingSpecIds(deps.storage)
+  ]);
+  const knownDecisionIds = (await Promise.all(DECISION_FILES.map((file) => readIfPresent(deps.storage, file)))).flatMap((content) => parseKnownDecisionIds(content ?? ""));
+  const existingSpec = input.specId !== void 0 ? await readIfPresent(deps.storage, `specs/${input.specId}.spec.md`) : null;
+  const isAmendment = existingSpec !== null;
+  const prompt = buildBriefPrompt({
+    template,
+    productRules,
+    manifestText: manifest.text,
+    grammarCard: manifest.generation === null ? null : generationGrammarCard(manifest.generation),
+    specIds,
+    knownDecisionIds,
+    existingSpec,
+    specId: input.specId,
+    brief: input.brief
+  });
+  const usage = [];
+  let previous;
+  let firstProblems = [];
+  let maxAttempts = MAX_ATTEMPTS;
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    const answer = await deps.writer.write({ ...prompt, previous });
+    usage.push({ model: answer.model, ...answer.usage });
+    const content = extractSpecText(answer.text);
+    const judged = judgeDraft({
+      content,
+      expectedId: input.specId,
+      knownDecisionIds,
+      takenIds: specIds,
+      isAmendment
+    });
+    const generationJudgement = judged.problems.length === 0 && judged.specId !== null ? await judgeGeneration({ content, specPath: `specs/${judged.specId}.spec.md`, generation: manifest.generation, storage: deps.storage, features: manifest.features }) : { problems: [], tally: null };
+    judged.problems.push(...generationJudgement.problems);
+    if (generationJudgement.tally !== null) maxAttempts = MAX_ATTEMPTS_GENERATED;
+    deps.log(JSON.stringify({ action: "brief", attempt, specId: judged.specId, problems: judged.problems.length, generated: generationJudgement.tally !== null, ...answer.usage }));
+    if (judged.problems.length === 0 && judged.specId !== null) {
+      const specId = judged.specId;
+      const briefForMessage = input.brief.length > BRIEF_IN_MESSAGE_MAX ? `${input.brief.slice(0, BRIEF_IN_MESSAGE_MAX)} (\u2026)` : input.brief;
+      const composition = isAmendment ? null : compositionOfSpec(content);
+      const compositions = [];
+      if (composition !== null) {
+        const [tokensJson, patternsCatalog, derivedBrief] = await Promise.all([
+          readIfPresent(deps.storage, DESIGN_TOKENS_PATH),
+          readIfPresent(deps.storage, PATTERNS_CATALOG_PATH),
+          readIfPresent(deps.storage, `${DESIGN_BRIEFS_DIR}/${specId}.md`)
+        ]);
+        let answerText = "";
+        try {
+          const answer2 = await deps.writer.write(buildCompositionsPrompt({ system: prompt.system, specText: content, composition, designContext: designContextOf({ tokensJson, patternsCatalog, derivedBrief }) }));
+          usage.push({ model: answer2.model, ...answer2.usage });
+          answerText = answer2.text;
+        } catch (thrown) {
+          deps.log(JSON.stringify({ action: "composition", specId, outcome: thrown instanceof OgygieFailure ? thrown.error.code : "error" }));
+        }
+        const seen = /* @__PURE__ */ new Set([composition]);
+        for (const candidate of splitCompositions(answerText)) {
+          if (seen.size >= MAX_COMPOSITIONS) break;
+          const name = compositionOfSpec(candidate);
+          const verdict = judgeDraft({ content: candidate, expectedId: specId, knownDecisionIds, takenIds: specIds, isAmendment: false });
+          const problems = name === null ? ["# Design names no composition"] : seen.has(name) ? [`composition "${name}" is already proposed`] : verdict.problems;
+          deps.log(JSON.stringify({ action: "composition", specId, composition: name, problems: problems.length }));
+          if (problems.length > 0 || name === null) continue;
+          seen.add(name);
+          await deps.storage.write(`specs/${specId}.spec.md`, candidate, `spec: composition ${name} pour ${specId}, propos\xE9e par le mod\xE8le
+
+Une autre disposition du m\xEAme \xE9cran ; la composition retenue par d\xE9faut suit dans le commit suivant.
+
+Brief :
+${briefForMessage}`);
+          compositions.push(name);
+        }
+        compositions.unshift(composition);
+      }
+      await deps.storage.write(
+        `specs/${specId}.spec.md`,
+        content,
+        `spec: ${isAmendment ? "amend" : "draft"} ${specId} depuis un brief
+
+Brief :
+${briefForMessage}`
+      );
+      return {
+        specId,
+        attempts: attempt,
+        problemsFixed: firstProblems,
+        isNewFeature: !manifest.featureIds.has(specId),
+        isAmendment,
+        compositions,
+        generation: generationJudgement.tally,
+        usage
+      };
+    }
+    if (attempt === 1) firstProblems = judged.problems;
+    previous = { draft: answer.text, problems: judged.problems };
+  }
+  return throwOgygieError(
+    {
+      code: "SPEC_DRAFT_REJECTED",
+      message: `The model's draft still fails the repo's gates after ${maxAttempts} attempts; nothing was written.`,
+      file: input.specId === void 0 ? null : `specs/${input.specId}.spec.md`,
+      cause: (previous?.problems ?? []).join(" ; "),
+      suggestedFix: "Rephrase the brief (one rubric, concrete behaviours, no code), or write the spec by hand from the template.",
+      details: { problems: previous?.problems ?? [], usage }
+    },
+    422
+  );
+}
+
+// src/server/hosted/brief-routes.ts
+async function registerBriefRoutes(app, deps) {
+  const route = app.withTypeProvider();
+  route.route({
+    method: "POST",
+    url: "/api/briefs",
+    schema: { body: BriefInputSchema, response: { 201: BriefOutputSchema } },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      requireRole(user, "author", "write a brief");
+      const storage = deps.storageFor(user);
+      const result = await draftSpecFromBrief(
+        { storage, writer: deps.writer, log: deps.log },
+        { brief: request.body.brief, specId: request.body.specId }
+      );
+      const proposal = "lastProposal" in storage ? storage.lastProposal : null;
+      if (deps.usage !== void 0 && proposal !== null) {
+        const at = new Date((deps.now ?? Date.now)()).toISOString();
+        try {
+          await deps.usage.appendUsage(
+            proposal.pullRequestNumber,
+            result.usage.map((usage, index) => ({ at, action: "brief", attempt: index + 1, model: usage.model, inputTokens: usage.inputTokens, outputTokens: usage.outputTokens, actor: user.email, specId: result.specId }))
+          );
+        } catch (thrown) {
+          deps.log(JSON.stringify({ action: "usage-journal", specId: result.specId, outcome: thrown instanceof Error ? thrown.message : String(thrown) }));
+        }
+      }
+      return reply.code(201).send(result);
+    }
+  });
+}
+
+// src/server/hosted/previews.ts
+var PREVIEWS_DIR = "previews";
+var STATE_NAME = /^[a-z][a-z0-9-]*$/;
+var STATE_ORDER = ["empty", "loading", "nominal", "error"];
+function previewsDirOf(specId, composition = null) {
+  return composition === null ? `${PREVIEWS_DIR}/${specId}` : `${PREVIEWS_DIR}/${specId}/${composition}`;
+}
+function previewSpecIdOf(path) {
+  const match = /^previews\/([a-z][a-z0-9]*(?:-[a-z0-9]+)*)\//.exec(path);
+  return match?.[1] ?? null;
+}
+function orderStates(states) {
+  return [...states].sort((a, b) => {
+    const ia = STATE_ORDER.indexOf(a);
+    const ib = STATE_ORDER.indexOf(b);
+    if (ia !== -1 || ib !== -1) return (ia === -1 ? STATE_ORDER.length : ia) - (ib === -1 ? STATE_ORDER.length : ib) || a.localeCompare(b);
+    return a.localeCompare(b);
+  });
+}
+function orderedPages(pages) {
+  const byState = new Map(pages.map((entry) => [entry.state, entry]));
+  return orderStates([...byState.keys()]).map((state) => byState.get(state));
+}
+async function listPreviews(storage, specId, composition = null) {
+  const dir = previewsDirOf(specId, composition);
+  const entries = await storage.listDirectory(dir);
+  return orderedPages(
+    entries.filter((entry) => !entry.path.includes("/") && entry.path.endsWith(".html")).map((entry) => ({ state: entry.path.replace(/\.html$/, ""), path: `${dir}/${entry.path}`, sizeBytes: entry.sizeBytes })).filter((entry) => STATE_NAME.test(entry.state))
+  );
+}
+async function listPreviewCompositions(storage, specId) {
+  const dir = previewsDirOf(specId);
+  const entries = await storage.listDirectory(dir);
+  const byName = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const segments = entry.path.split("/");
+    if (segments.length !== 2) continue;
+    const [name, file] = segments;
+    if (name === void 0 || file === void 0 || !STATE_NAME.test(name) || !file.endsWith(".html")) continue;
+    const state = file.replace(/\.html$/, "");
+    if (!STATE_NAME.test(state)) continue;
+    const pages = byName.get(name) ?? [];
+    pages.push({ state, path: `${dir}/${name}/${file}`, sizeBytes: entry.sizeBytes });
+    byName.set(name, pages);
+  }
+  return [...byName.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([name, pages]) => ({ name, previews: orderedPages(pages) }));
+}
+async function readPreview(storage, specId, state, composition = null) {
+  if (composition !== null && !STATE_NAME.test(composition)) {
+    throwOgygieError(
+      { code: "PREVIEW_NOT_FOUND", message: `"${composition}" is not a composition name.`, file: null, cause: "a composition is named in kebab-case", suggestedFix: "Pick a composition from GET /api/specs/<id>/previews." },
+      404
+    );
+  }
+  if (!STATE_NAME.test(state)) {
+    throwOgygieError(
+      { code: "PREVIEW_NOT_FOUND", message: `"${state}" is not a preview state name.`, file: null, cause: "state must be lowercase letters, digits and hyphens", suggestedFix: "Pick a state from GET /api/specs/<id>/previews." },
+      404
+    );
+  }
+  const path = `${previewsDirOf(specId, composition)}/${state}.html`;
+  if (!await storage.exists(path)) {
+    throwOgygieError(
+      { code: "PREVIEW_NOT_FOUND", message: `Spec "${specId}" has no preview for state "${state}"${composition === null ? "" : ` in composition "${composition}"`}.`, file: path, cause: "no such file on the spec's working copy", suggestedFix: "The speculate job renders previews when the generator knows the screen; see GET /api/specs/<id>/previews for what exists." },
+      404
+    );
+  }
+  return storage.readFile(path);
+}
+
+// src/server/hosted/github-storage.ts
+var SPEC_PATH = /^specs\/([a-z][a-z0-9]*(?:-[a-z0-9]+)*)\.spec\.md$/;
+function specIdOfPath2(path) {
+  return SPEC_PATH.exec(path)?.[1] ?? null;
+}
+function specBranchOf(specId) {
+  return `spec/${specId}`;
+}
+function slug(path) {
+  return path.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "");
+}
+function createHostedSpecStorage(deps) {
+  const defaultReader = deps.readerFor(deps.github.defaultBranch);
+  const branchReaders = /* @__PURE__ */ new Map();
+  let branchesPromise = null;
+  const branches = () => {
+    branchesPromise ??= deps.listSpecBranches().then((names) => new Set(names));
+    return branchesPromise;
+  };
+  const readerOfBranch = (branch) => {
+    let reader = branchReaders.get(branch);
+    if (reader === void 0) {
+      reader = deps.readerFor(branch);
+      branchReaders.set(branch, reader);
+    }
+    return reader;
+  };
+  async function readerOf(path) {
+    const specId = specIdOfPath2(path) ?? previewSpecIdOf(path);
+    if (specId === null) return defaultReader;
+    const branch = specBranchOf(specId);
+    return (await branches()).has(branch) ? readerOfBranch(branch) : defaultReader;
+  }
+  const storage = {
+    lastProposal: null,
+    async readFile(path) {
+      return (await readerOf(path)).readFile(path);
+    },
+    async exists(path) {
+      return (await readerOf(path)).exists(path);
+    },
+    async currentRef() {
+      return defaultReader.currentRef();
+    },
+    async listDirectory(path) {
+      const entries = await defaultReader.listDirectory(path);
+      if (path.replace(/\/$/, "") !== "specs") return entries;
+      const known = new Set(entries.map((entry) => entry.path));
+      const extra = [];
+      for (const branch of await branches()) {
+        const specId = branch.slice("spec/".length);
+        const fileName = `${specId}.spec.md`;
+        if (known.has(fileName)) continue;
+        const reader = readerOfBranch(branch);
+        const specPath = `specs/${fileName}`;
+        if (!await reader.exists(specPath)) continue;
+        const content = await reader.readFile(specPath);
+        extra.push({ path: fileName, sizeBytes: Buffer.byteLength(content, "utf8") });
+      }
+      return [...entries, ...extra].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    },
+    async write(path, content, message) {
+      const specId = specIdOfPath2(path);
+      const startedAt = deps.now();
+      if (specId === null) {
+        requireRole(deps.user, "operator", `write ${path}`);
+      } else if (message.startsWith("spec: validate ")) {
+        requireRole(deps.user, "approver", `validate ${specId}`);
+      } else {
+        requireRole(deps.user, "author", `write ${path}`);
+      }
+      const branch = specId === null ? `host/${deps.repoId}/${slug(path)}` : specBranchOf(specId);
+      let outcome = "ok";
+      let pullRequestUrl = null;
+      try {
+        const proposal = await proposeChange(
+          { id: deps.repoId, github: deps.github, adapter: storage },
+          {
+            clientFor: () => deps.client,
+            originOf: (proposedPath) => `Propos\xE9 via le studio Ogygie h\xE9berg\xE9 par ${deps.user.displayName} <${deps.user.email}> (repo \`${deps.repoId}\`, chemin \`${proposedPath}\`).`,
+            authorOf: () => ({ name: deps.user.displayName, email: deps.user.email }),
+            branchFor: () => branch,
+            readFrom: "branch",
+            now: deps.now,
+            rateLimitPerHour: deps.rateLimitPerHour,
+            recentProposals: deps.recentProposals
+          },
+          { path, content, message }
+        );
+        pullRequestUrl = proposal.pullRequestUrl;
+        storage.lastProposal = proposal;
+        (await branches()).add(proposal.branch);
+        branchReaders.delete(proposal.branch);
+      } catch (thrown) {
+        outcome = thrown instanceof Error && "error" in thrown ? String(thrown.error.code) : "error";
+        throw thrown;
+      } finally {
+        deps.log(
+          JSON.stringify({
+            action: message.split(" ")[1] ?? "write",
+            specId,
+            actor: deps.user.email,
+            outcome,
+            pullRequestUrl,
+            durationMs: deps.now() - startedAt
+          })
+        );
+      }
+    }
+  };
+  return storage;
+}
+function createGithubSpecBranchLister(input) {
+  const apiBase = input.apiBase ?? "https://api.github.com";
+  return async () => {
+    const response = await input.fetchImpl(
+      `${apiBase}/repos/${input.github.owner}/${input.github.repo}/git/matching-refs/heads/spec/`,
+      {
+        method: "GET",
+        headers: {
+          accept: "application/vnd.github+json",
+          "x-github-api-version": "2022-11-28",
+          "user-agent": "ogygie-studio"
+        }
+      }
+    );
+    if (!response.ok) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub answered ${response.status} when listing spec/* branches.`,
+        file: null,
+        cause: `status=${response.status}`,
+        suggestedFix: "Retry later; check the app installation grants contents on this repo."
+      });
+    }
+    const refs = await response.json();
+    return refs.map((entry) => entry.ref.replace(/^refs\/heads\//, "")).filter((name) => name.startsWith("spec/"));
+  };
+}
+
+// src/server/hosted/merge.ts
+var NEEDS_OPERATOR_LABEL = "needs-operator";
+function requiredRoleFor(mergePolicy) {
+  return mergePolicy === "client" ? "approver" : "operator";
+}
+async function specStatusOf(storage, specId) {
+  const path = `specs/${specId}.spec.md`;
+  if (!await storage.exists(path)) return "absent";
+  const parsed = parseSpecDocument(await storage.readFile(path));
+  return parsed.frontmatter?.status ?? "unreadable";
+}
+async function pullRequestStatus(deps, specId) {
+  const branch = specBranchOf(specId);
+  const requiredRole = requiredRoleFor(deps.mergePolicy);
+  const [specStatus, head] = await Promise.all([specStatusOf(deps.storage, specId), deps.pulls.findOpenPullRequest(branch)]);
+  if (head === null) {
+    return { specId, branch, pullRequest: null, specStatus, checks: "none", checkRuns: [], mergeable: null, requiredRole, canMerge: false, blockers: ["Aucune pull request ouverte pour cette spec : une sauvegarde en ouvre une."], labels: [], needsOperator: false };
+  }
+  const [pull, checks] = await Promise.all([deps.pulls.getPullRequest(head.number), deps.pulls.getChecks(head.headSha)]);
+  const needsOperator = head.labels.includes(NEEDS_OPERATOR_LABEL);
+  const blockers = [];
+  if (needsOperator) blockers.push("En attente de l'op\xE9rateur : le premier schemas.ts de cette feature nouvelle a \xE9t\xE9 refus\xE9 deux fois par les gates (\xE9tiquette needs-operator).");
+  if (specStatus !== "validated") blockers.push(specStatus === "draft" ? "La spec est encore en draft : elle doit \xEAtre valid\xE9e (sign\xE9e) d'abord." : `La spec est ${specStatus} sur la branche.`);
+  if (checks.state === "red") blockers.push("Un check de la CI est rouge sur la branche.");
+  if (checks.state === "pending") blockers.push("La CI tourne encore sur la branche.");
+  if (checks.state === "none") blockers.push("Aucun check n'a encore couru sur la branche.");
+  if (pull.mergeable === false) blockers.push("La branche est en conflit avec la branche par d\xE9faut : \xE0 r\xE9g\xE9n\xE9rer (op\xE9rateur).");
+  if (pull.mergeable === null) blockers.push("GitHub calcule encore si la branche est fusionnable.");
+  return {
+    specId,
+    branch,
+    pullRequest: { number: pull.number, url: pull.url, headSha: pull.headSha, title: head.title },
+    specStatus,
+    checks: checks.state,
+    checkRuns: checks.runs,
+    mergeable: pull.mergeable,
+    requiredRole,
+    canMerge: blockers.length === 0,
+    blockers,
+    labels: head.labels,
+    needsOperator
+  };
+}
+async function listSpecPullRequests(pulls) {
+  const heads = await pulls.listOpenSpecPullRequests();
+  return Promise.all(
+    heads.map(async (head) => {
+      const checks = await pulls.getChecks(head.headSha);
+      return { specId: head.branch.slice("spec/".length), number: head.number, url: head.url, checks: checks.state, needsOperator: head.labels.includes(NEEDS_OPERATOR_LABEL) };
+    })
+  );
+}
+async function mergeSpecPullRequest(deps, user, specId) {
+  const requiredRole = requiredRoleFor(deps.mergePolicy);
+  requireRole(user, requiredRole, `merge ${specId}`);
+  const status = await pullRequestStatus(deps, specId);
+  const startedAt = deps.now();
+  const refuse2 = (code, message, httpStatus) => throwOgygieError(
+    { code, message, file: `specs/${specId}.spec.md`, cause: status.blockers.join(" ; "), suggestedFix: "Lift the listed blockers, then merge again \u2014 the rule is the same one the spec-signed check and the branch protection hold.", details: { blockers: status.blockers } },
+    httpStatus
+  );
+  if (status.pullRequest === null) refuse2("PULL_REQUEST_NOT_FOUND", `No open pull request carries spec "${specId}".`, 404);
+  if (status.needsOperator) refuse2("SPEC_NEEDS_OPERATOR", `Spec "${specId}" awaits the operator: its first schemas module failed the gates twice (label ${NEEDS_OPERATOR_LABEL}).`, 409);
+  if (status.specStatus !== "validated") refuse2("SPEC_NOT_VALIDATED", `Spec "${specId}" is not validated: nothing merges before the signature.`, 409);
+  if (status.checks !== "green") refuse2("CHECKS_NOT_GREEN", `The checks of spec "${specId}" are ${status.checks}.`, 409);
+  if (status.mergeable !== true) refuse2("PULL_REQUEST_CONFLICTING", `The branch of spec "${specId}" is not mergeable.`, 409);
+  const pull = status.pullRequest;
+  if (pull === null) return refuse2("PULL_REQUEST_NOT_FOUND", "unreachable", 404);
+  let outcome = "ok";
+  let mergeSha = "";
+  try {
+    const merged = await deps.pulls.mergePullRequest(pull.number, {
+      title: `spec: merge ${specId} \u2014 approuv\xE9e par ${user.displayName}`,
+      message: `Spec ${specId} fusionn\xE9e depuis le studio h\xE9berg\xE9 par ${user.displayName} <${user.email}> (pull request #${pull.number}).`
+    });
+    mergeSha = merged.sha;
+    await deps.pulls.deleteBranch(status.branch);
+  } catch (thrown) {
+    outcome = thrown instanceof Error && "error" in thrown ? String(thrown.error.code) : "error";
+    throw thrown;
+  } finally {
+    deps.log(JSON.stringify({ action: "merge", specId, actor: user.email, outcome, pullRequestUrl: pull.url, durationMs: deps.now() - startedAt }));
+  }
+  return { specId, pullRequestNumber: pull.number, mergeSha, mergedBy: user.email, mergedAt: new Date(deps.now()).toISOString() };
+}
+
+// src/server/hosted/merge-routes.ts
+async function registerMergeRoutes(app, deps) {
+  const route = app.withTypeProvider();
+  const mergeDepsFor = (user) => ({
+    pulls: deps.pulls,
+    storage: deps.storageFor(user),
+    mergePolicy: deps.config.mergePolicy,
+    now: deps.now,
+    log: deps.log
+  });
+  route.route({
+    method: "GET",
+    url: "/api/specs/:specId/pull-request",
+    schema: { params: SpecParamsSchema, response: { 200: PullRequestStatusSchema } },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      return reply.code(200).send(await pullRequestStatus(mergeDepsFor(user), request.params.specId));
+    }
+  });
+  route.route({
+    method: "GET",
+    url: "/api/pull-requests",
+    schema: { response: { 200: SpecPullRequestsSchema } },
+    handler: async (request, reply) => {
+      hostedUserOf(request);
+      return reply.code(200).send({ pullRequests: await listSpecPullRequests(deps.pulls) });
+    }
+  });
+  route.route({
+    method: "POST",
+    url: "/api/specs/:specId/merge",
+    schema: { params: SpecParamsSchema, response: { 200: MergeOutputSchema } },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      return reply.code(200).send(await mergeSpecPullRequest(mergeDepsFor(user), user, request.params.specId));
+    }
+  });
+}
+
+// src/server/hosted/promotion.ts
+var ENVIRONMENT_REFS = {
+  staging: "env/staging",
+  production: "env/production"
+};
+var SHA = /^[0-9a-f]{40}$/;
+var PULL_NUMBER = /\(#(\d+)\)/;
+var MERGED_SPEC = /^spec: merge ([a-z][a-z0-9]*(?:-[a-z0-9]+)*)/;
+var DESTRUCTIVE_MIGRATION = /migration destructive/i;
+async function environmentsStatus(deps) {
+  const [mainSha, stagingSha, productionSha, stagingDeployment, productionDeployment, releases] = await Promise.all([
+    deps.deploy.getRefSha(deps.defaultBranch),
+    deps.deploy.getRefSha(ENVIRONMENT_REFS.staging),
+    deps.deploy.getRefSha(ENVIRONMENT_REFS.production),
+    deps.deploy.latestDeployment("staging"),
+    deps.deploy.latestDeployment("production"),
+    deps.deploy.listTags("release/")
+  ]);
+  const deploymentOf = (deployment) => deployment === null ? null : { id: deployment.id, state: deployment.state, createdAt: deployment.createdAt };
+  return {
+    environments: [
+      { name: "development", ref: deps.defaultBranch, sha: mainSha, deployment: null },
+      { name: "staging", ref: ENVIRONMENT_REFS.staging, sha: stagingSha, deployment: deploymentOf(stagingDeployment) },
+      { name: "production", ref: ENVIRONMENT_REFS.production, sha: productionSha, deployment: deploymentOf(productionDeployment) }
+    ],
+    releases: releases.sort().reverse()
+  };
+}
+function pullRequestsOf(commits) {
+  const included = [];
+  for (const commit of commits) {
+    const firstLine = commit.message.split("\n")[0] ?? "";
+    const number = PULL_NUMBER.exec(firstLine)?.[1];
+    if (number === void 0) continue;
+    included.push({
+      number: Number.parseInt(number, 10),
+      specId: MERGED_SPEC.exec(firstLine)?.[1] ?? null,
+      message: firstLine,
+      authoredAt: commit.authoredAt
+    });
+  }
+  return included;
+}
+function nextReleaseTag(existing, nowMs) {
+  const day = new Date(nowMs).toISOString().slice(0, 10);
+  const prefix = `release/${day}.`;
+  const taken = existing.filter((tag) => tag.startsWith(prefix)).length;
+  return `${prefix}${taken + 1}`;
+}
+function refuse(code, message, cause, suggestedFix, httpStatus = 409) {
+  return throwOgygieError({ code, message, file: null, cause, suggestedFix }, httpStatus);
+}
+async function promote(deps, user, input) {
+  const rollback = input.rollback === true;
+  requireRole(user, rollback ? "operator" : "approver", `promote ${input.environment}`);
+  if (!SHA.test(input.sha)) {
+    refuse("CONTRACT_VALIDATION_FAILED", "A promotion names a full commit sha.", `sha=${input.sha}`, "Give the 40-character sha shown on the environments screen.", 400);
+  }
+  if (rollback && (input.reason === void 0 || input.reason.trim().length < 10)) {
+    refuse("CONTRACT_VALIDATION_FAILED", "A rollback carries its reason.", "rollback without reason", "Say why the environment goes back (ten characters at least).", 400);
+  }
+  const ref = ENVIRONMENT_REFS[input.environment];
+  const [currentSha, targetSha, mainSha] = await Promise.all([
+    deps.deploy.getRefSha(ref),
+    deps.deploy.getCommitSha(input.sha),
+    deps.deploy.getRefSha(deps.defaultBranch)
+  ]);
+  if (currentSha === null) {
+    refuse("HOST_ENVIRONMENT_REF_MISSING", `The ref ${ref} does not exist on the repo.`, `ref=${ref}`, "Create and protect env/staging and env/production (docs/HOSTED-STUDIO.md), then retry.", 500);
+  }
+  if (targetSha === null) {
+    refuse("CONTRACT_VALIDATION_FAILED", `Commit ${input.sha} does not exist on the repo.`, `sha=${input.sha}`, "Promote a sha the environments screen shows.", 400);
+  }
+  if (input.environment === "staging") {
+    const inMain = mainSha === null ? "diverged" : (await deps.deploy.compare(targetSha, mainSha)).status;
+    if (inMain !== "ahead" && inMain !== "identical") {
+      refuse("PROMOTION_ORDER_VIOLATED", `Commit ${targetSha.slice(0, 7)} is not in the history of ${deps.defaultBranch}.`, `compare(${targetSha.slice(0, 7)}...${deps.defaultBranch})=${inMain}`, "Staging only receives what the default branch has merged.");
+    }
+  } else {
+    const stagingSha = await deps.deploy.getRefSha(ENVIRONMENT_REFS.staging);
+    if (stagingSha !== targetSha) {
+      refuse("PROMOTION_ORDER_VIOLATED", `Production only receives the sha staging holds (${stagingSha?.slice(0, 7) ?? "none"}), not ${targetSha.slice(0, 7)}.`, `staging=${stagingSha ?? "<absent>"} asked=${targetSha}`, "Promote that sha to staging first, see it there, then to production \u2014 the order is the rule, to the sha.");
+    }
+  }
+  const forward = await deps.deploy.compare(currentSha, targetSha);
+  if (forward.status === "identical") {
+    refuse("PROMOTION_ORDER_VIOLATED", `${input.environment} already holds ${targetSha.slice(0, 7)}.`, "nothing to move", "Pick a newer sha, or nothing.");
+  }
+  if (forward.status !== "ahead" && !rollback) {
+    refuse("PROMOTION_NOT_FAST_FORWARD", `Moving ${input.environment} to ${targetSha.slice(0, 7)} is not a fast-forward (${forward.status}).`, `compare(${currentSha.slice(0, 7)}...${targetSha.slice(0, 7)})=${forward.status}`, "A step back is an explicit rollback, reserved to the operator, with its reason.");
+  }
+  const includedPullRequests = rollback ? [] : pullRequestsOf(forward.commits);
+  let destructiveMigration = false;
+  for (const pull of includedPullRequests) {
+    if (DESTRUCTIVE_MIGRATION.test(await deps.deploy.getPullRequestBody(pull.number))) destructiveMigration = true;
+  }
+  if (destructiveMigration && input.environment === "production") {
+    requireRole(user, "operator", `promote to production a release with a destructive migration`);
+  }
+  const startedAt = deps.now();
+  let outcome = "ok";
+  let deploymentId = 0;
+  let releaseTag = null;
+  try {
+    await deps.deploy.updateRef(ref, targetSha, rollback);
+    const description = rollback ? `Retour arri\xE8re de ${input.environment} par ${user.displayName} : ${input.reason ?? ""}` : `Promotion de ${input.environment} par ${user.displayName} (${includedPullRequests.length} PR)`;
+    deploymentId = (await deps.deploy.createDeployment({
+      sha: targetSha,
+      environment: input.environment,
+      description: description.slice(0, 140),
+      payload: { actor: user.email, fromSha: currentSha, rollback, reason: input.reason ?? null, includedPullRequests, destructiveMigration }
+    })).id;
+    if (input.environment === "production" && !rollback) {
+      releaseTag = nextReleaseTag(await deps.deploy.listTags("release/"), deps.now());
+      const lines = includedPullRequests.map((pull) => `- #${pull.number} ${pull.specId ?? ""} ${pull.authoredAt.slice(0, 10)} \u2014 ${pull.message}`.replace(/\s+/g, " "));
+      await deps.deploy.createTag({
+        name: releaseTag,
+        sha: targetSha,
+        message: `Release ${releaseTag} \u2014 mise en production par ${user.displayName}
+
+${lines.join("\n") || "(aucune pull request list\xE9e)"}
+`,
+        tagger: { name: user.displayName, email: user.email }
+      });
+    }
+  } catch (thrown) {
+    outcome = thrown instanceof Error && "error" in thrown ? String(thrown.error.code) : "error";
+    throw thrown;
+  } finally {
+    deps.log(JSON.stringify({ action: rollback ? "rollback" : "promote", environment: input.environment, actor: user.email, outcome, fromSha: currentSha, toSha: targetSha, releaseTag, durationMs: deps.now() - startedAt }));
+  }
+  return {
+    environment: input.environment,
+    fromSha: currentSha,
+    toSha: targetSha,
+    actor: user.email,
+    at: new Date(deps.now()).toISOString(),
+    deploymentId,
+    releaseTag,
+    includedPullRequests,
+    destructiveMigration,
+    rollback
+  };
+}
+
+// src/server/hosted/promotion-routes.ts
+async function registerPromotionRoutes(app, deps) {
+  const route = app.withTypeProvider();
+  const promotionDeps = { deploy: deps.deploy, defaultBranch: deps.defaultBranch, now: deps.now, log: deps.log };
+  route.route({
+    method: "GET",
+    url: "/api/environments",
+    schema: { response: { 200: EnvironmentsStatusSchema } },
+    handler: async (request, reply) => {
+      hostedUserOf(request);
+      return reply.code(200).send(await environmentsStatus(promotionDeps));
+    }
+  });
+  route.route({
+    method: "POST",
+    url: "/api/environments/:environment/promotions",
+    schema: { params: EnvironmentParamsSchema, body: PromotionInputSchema, response: { 201: PromotionRecordSchema } },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      const record = await promote(promotionDeps, user, { environment: request.params.environment, ...request.body });
+      return reply.code(201).send(record);
+    }
+  });
+}
+
+// src/server/hosted/usage.ts
+import { z as z10 } from "zod";
+var UsageEntrySchema = z10.object({
+  at: z10.string(),
+  /** brief → spec from the instance; `speculate` entries arrive with the generator's lot. */
+  action: z10.enum(["brief", "speculate"]),
+  attempt: z10.number().int().positive().optional(),
+  model: z10.string(),
+  inputTokens: z10.number().int().nonnegative(),
+  outputTokens: z10.number().int().nonnegative(),
+  actor: z10.string().optional(),
+  specId: z10.string().optional()
+});
+var USAGE_MARKER = "<!-- ogygie-usage -->";
+var DEFAULT_MODEL_COSTS = {
+  "claude-fable-5-1": { input: 10, output: 50 },
+  "claude-opus-5-5": { input: 4, output: 20 },
+  "claude-sonnet-5-5": { input: 2, output: 10 },
+  "claude-haiku-5-5": { input: 0.1, output: 0.5 }
+};
+function estimateUsd(entry, costs = DEFAULT_MODEL_COSTS) {
+  const cost = costs[entry.model];
+  if (cost === void 0) return null;
+  return (entry.inputTokens * cost.input + entry.outputTokens * cost.output) / 1e6;
+}
+function formatUsageComment(entries) {
+  const rows = entries.map((entry) => `| ${entry.at.slice(0, 16).replace("T", " ")} | ${entry.action}${entry.attempt === void 0 ? "" : ` ${entry.attempt}`} | ${entry.model} | ${entry.inputTokens} | ${entry.outputTokens} |`);
+  return [
+    USAGE_MARKER,
+    "**Consommation de mod\xE8les (journal du studio h\xE9berg\xE9)** \u2014 estimation, la facture vient de l'espace de travail.",
+    "",
+    "| quand (UTC) | action | mod\xE8le | entr\xE9e | sortie |",
+    "|---|---|---|---|---|",
+    ...rows,
+    "",
+    "```json",
+    JSON.stringify(entries),
+    "```",
+    ""
+  ].join("\n");
+}
+function parseUsageComment(body) {
+  if (!body.includes(USAGE_MARKER)) return [];
+  const block = /```json\n([\s\S]*?)\n```/.exec(body)?.[1];
+  if (block === void 0) return [];
+  try {
+    const parsed = z10.array(UsageEntrySchema).safeParse(JSON.parse(block));
+    return parsed.success ? parsed.data : [];
+  } catch {
+    return [];
+  }
+}
+function monthBounds(month) {
+  const [year, monthIndex] = month.split("-").map((part) => Number.parseInt(part, 10));
+  const start = new Date(Date.UTC(year ?? 1970, (monthIndex ?? 1) - 1, 1));
+  const end = new Date(Date.UTC(year ?? 1970, monthIndex ?? 1, 1));
+  return { start: start.toISOString(), end: end.toISOString() };
+}
+async function consumptionReport(input) {
+  const { start, end } = monthBounds(input.month);
+  const costs = input.costs ?? DEFAULT_MODEL_COSTS;
+  const journals = await input.source.journalsSince(start);
+  const specs = [];
+  for (const journal of journals) {
+    const inMonth = journal.entries.filter((entry) => entry.at >= start && entry.at < end);
+    if (inMonth.length === 0) continue;
+    const uncosted = /* @__PURE__ */ new Set();
+    let estimatedUsd = 0;
+    for (const entry of inMonth) {
+      const usd = estimateUsd(entry, costs);
+      if (usd === null) uncosted.add(entry.model);
+      else estimatedUsd += usd;
+    }
+    specs.push({
+      specId: journal.specId,
+      pullRequestNumber: journal.pullRequestNumber,
+      runs: inMonth.length,
+      inputTokens: inMonth.reduce((sum, entry) => sum + entry.inputTokens, 0),
+      outputTokens: inMonth.reduce((sum, entry) => sum + entry.outputTokens, 0),
+      estimatedUsd: Math.round(estimatedUsd * 1e4) / 1e4,
+      uncostedModels: [...uncosted].sort()
+    });
+  }
+  specs.sort((a, b) => b.estimatedUsd - a.estimatedUsd || a.specId.localeCompare(b.specId));
+  const totals = {
+    runs: specs.reduce((sum, spec) => sum + spec.runs, 0),
+    inputTokens: specs.reduce((sum, spec) => sum + spec.inputTokens, 0),
+    outputTokens: specs.reduce((sum, spec) => sum + spec.outputTokens, 0),
+    estimatedUsd: Math.round(specs.reduce((sum, spec) => sum + spec.estimatedUsd, 0) * 1e4) / 1e4
+  };
+  const budgetRatio = input.budgetUsd === null ? null : totals.estimatedUsd / input.budgetUsd;
+  return { month: input.month, specs, totals, budgetUsd: input.budgetUsd, budgetRatio, warning: budgetRatio !== null && budgetRatio >= 0.8 };
+}
+
+// src/server/hosted/consumption-routes.ts
+async function registerConsumptionRoutes(app, deps) {
+  const route = app.withTypeProvider();
+  const cache = /* @__PURE__ */ new Map();
+  const cacheMs = deps.cacheMs ?? 5 * 60 * 1e3;
+  route.route({
+    method: "GET",
+    url: "/api/consumption",
+    schema: { querystring: ConsumptionQuerySchema, response: { 200: ConsumptionReportSchema } },
+    handler: async (request, reply) => {
+      hostedUserOf(request);
+      const month = request.query.month ?? new Date(deps.now()).toISOString().slice(0, 7);
+      const cached = cache.get(month);
+      if (cached !== void 0 && deps.now() - cached.at < cacheMs) return reply.code(200).send(cached.report);
+      const report = await consumptionReport({
+        source: deps.usage,
+        month,
+        budgetUsd: deps.config.model?.monthlyBudgetUsd ?? null,
+        ...deps.config.model?.costPerMillionUsd === void 0 ? {} : { costs: deps.config.model.costPerMillionUsd }
+      });
+      cache.set(month, { at: deps.now(), report });
+      return reply.code(200).send(report);
+    }
+  });
+}
+
+// src/server/hosted/preview-routes.ts
+import { z as z11 } from "zod";
+var PreviewParamsSchema = SpecParamsSchema.extend({ state: z11.string().min(1).max(80) });
+var CompositionPreviewParamsSchema = PreviewParamsSchema.extend({ composition: z11.string().min(1).max(80) });
+var PREVIEW_CSP = "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:";
+async function registerPreviewRoutes(app, deps) {
+  const route = app.withTypeProvider();
+  route.route({
+    method: "GET",
+    url: "/api/specs/:specId/previews",
+    schema: { params: SpecParamsSchema, response: { 200: PreviewsListSchema } },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      const storage = deps.storageFor(user);
+      const { specId } = request.params;
+      const specPath = `specs/${specId}.spec.md`;
+      const composition = await storage.exists(specPath) ? compositionOfSpec(await storage.readFile(specPath)) : null;
+      const compositions = (await listPreviewCompositions(storage, specId)).map((entry) => ({ ...entry, selected: entry.name === composition }));
+      const previews = composition !== null && compositions.some((entry) => entry.name === composition) ? await listPreviews(storage, specId, composition) : await listPreviews(storage, specId);
+      return reply.code(200).send({ specId, previews, composition, compositions });
+    }
+  });
+  route.route({
+    method: "GET",
+    url: "/api/specs/:specId/previews/:composition/:state",
+    schema: { params: CompositionPreviewParamsSchema },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      const html = await readPreview(deps.storageFor(user), request.params.specId, request.params.state, request.params.composition);
+      return reply.code(200).header("content-type", "text/html; charset=utf-8").header("content-security-policy", PREVIEW_CSP).header("x-frame-options", "SAMEORIGIN").header("cache-control", "no-store").send(html);
+    }
+  });
+  route.route({
+    method: "GET",
+    url: "/api/specs/:specId/previews/:state",
+    schema: { params: PreviewParamsSchema },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      const html = await readPreview(deps.storageFor(user), request.params.specId, request.params.state);
+      return reply.code(200).header("content-type", "text/html; charset=utf-8").header("content-security-policy", PREVIEW_CSP).header("x-frame-options", "SAMEORIGIN").header("cache-control", "no-store").send(html);
+    }
+  });
+}
+
+// src/server/hosted/composition-routes.ts
+import { z as z12 } from "zod";
+
+// src/server/hosted/compositions.ts
+var COMPOSITION_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+async function selectComposition(deps, specId, composition) {
+  if (!COMPOSITION_NAME.test(composition)) {
+    throwOgygieError(
+      { code: "COMPOSITION_NOT_FOUND", message: `"${composition}" is not a composition name.`, file: null, cause: "a composition is named in kebab-case, as its `# Design` line declares it", suggestedFix: "Pick a composition from GET /api/specs/<id>/previews." },
+      404
+    );
+  }
+  const path = `specs/${specId}.spec.md`;
+  const head = await deps.storage.exists(path) ? await deps.storage.readFile(path) : null;
+  if (head !== null && compositionOfSpec(head) === composition) {
+    return { specId, composition, alreadySelected: true };
+  }
+  const commits = await deps.pulls.listFileCommits(specBranchOf(specId), path);
+  for (const commit of commits) {
+    let content;
+    try {
+      content = await deps.readerFor(commit.sha).readFile(path);
+    } catch {
+      continue;
+    }
+    if (compositionOfSpec(content) !== composition) continue;
+    await deps.storage.write(path, content, `spec: select composition ${composition} for ${specId}
+
+La composition \xAB ${composition} \xBB est retenue parmi celles propos\xE9es ; les autres restent dans l'historique de la branche, jamais r\xE9\xE9crit.`);
+    deps.log(JSON.stringify({ action: "select-composition", specId, composition, fromSha: commit.sha }));
+    return { specId, composition, alreadySelected: false };
+  }
+  return throwOgygieError(
+    {
+      code: "COMPOSITION_NOT_FOUND",
+      message: `No version of spec "${specId}" on its branch declares the composition "${composition}".`,
+      file: path,
+      cause: `${commits.length} commit(s) of ${path} read on ${specBranchOf(specId)}, none with \`Composition : ${composition}\` under # Design`,
+      suggestedFix: "Choose one of the compositions the previews list names; a composition the model never proposed has no spec to select."
+    },
+    404
+  );
+}
+
+// src/server/hosted/composition-routes.ts
+var CompositionParamsSchema = SpecParamsSchema.extend({ composition: z12.string().min(1).max(80) });
+async function registerCompositionRoutes(app, deps) {
+  const route = app.withTypeProvider();
+  route.route({
+    method: "POST",
+    url: "/api/specs/:specId/compositions/:composition/select",
+    schema: { params: CompositionParamsSchema, response: { 200: SelectCompositionOutputSchema } },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      requireRole(user, "author", `select a composition of ${request.params.specId}`);
+      const result = await selectComposition(
+        { storage: deps.storageFor(user), pulls: deps.pulls, readerFor: deps.readerFor, log: deps.log },
+        request.params.specId,
+        request.params.composition
+      );
+      return reply.code(200).send(result);
+    }
+  });
+}
+
+// src/server/app.ts
+async function createStudioApp(options) {
+  const app = Fastify({ logger: false });
+  app.setValidatorCompiler(validatorCompiler);
+  app.setSerializerCompiler(serializerCompiler);
+  app.setErrorHandler((error, _request, reply) => {
+    if (error instanceof OgygieFailure) {
+      return reply.status(error.httpStatus).send(error.error);
+    }
+    if (hasZodFastifySchemaValidationErrors(error)) {
+      return reply.status(400).send(
+        ogygieError({
+          code: "CONTRACT_VALIDATION_FAILED",
+          message: "The request does not satisfy the route's input contract.",
+          file: null,
+          cause: error.validation.map((issue) => `${issue.instancePath || "(root)"}: ${issue.message ?? "invalid"}`).join(" ; "),
           suggestedFix: "Fix the listed fields to match the route's Zod input schema."
         })
       );
@@ -1081,7 +3164,31 @@ async function createStudioApp(options) {
       })
     );
   });
-  await registerStudioRoutes(app, options);
+  if (options.hosted !== void 0) {
+    const hosted = options.hosted;
+    await registerHostedRoutes(app, hosted);
+    await registerStudioRoutes(app, (request) => ({ storage: hosted.storageFor(hostedUserOf(request)) }));
+    await registerPreviewRoutes(app, { storageFor: hosted.storageFor });
+    if (hosted.writer !== void 0) {
+      await registerBriefRoutes(app, { writer: hosted.writer, storageFor: hosted.storageFor, log: hosted.log, usage: hosted.usage, now: hosted.now });
+    }
+    if (hosted.pulls !== void 0) {
+      await registerMergeRoutes(app, { pulls: hosted.pulls, storageFor: hosted.storageFor, config: hosted.config, now: hosted.now, log: hosted.log });
+      if (hosted.readerFor !== void 0) {
+        await registerCompositionRoutes(app, { pulls: hosted.pulls, readerFor: hosted.readerFor, storageFor: hosted.storageFor, log: hosted.log });
+      }
+    }
+    if (hosted.usage !== void 0) {
+      await registerConsumptionRoutes(app, { usage: hosted.usage, config: hosted.config, now: hosted.now });
+    }
+    if (hosted.deploy !== void 0) {
+      await registerPromotionRoutes(app, { deploy: hosted.deploy, defaultBranch: hosted.config.repo.defaultBranch, now: hosted.now, log: hosted.log });
+    }
+  } else if (options.storage !== void 0) {
+    await registerStudioRoutes(app, { storage: options.storage });
+  } else {
+    throw new Error("createStudioApp: either `storage` (local) or `hosted` must be given.");
+  }
   if (options.uiDistDir !== void 0) {
     const fastifyStatic = (await import("@fastify/static")).default;
     await app.register(fastifyStatic, { root: options.uiDistDir });
@@ -1104,6 +3211,518 @@ async function createStudioApp(options) {
   return app;
 }
 
+// src/server/hosted/github-app.ts
+import { createSign } from "node:crypto";
+var base64url2 = (input) => Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function signGithubAppJwt(input) {
+  const nowSeconds = Math.floor(input.nowMs / 1e3);
+  const header = base64url2(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = base64url2(
+    JSON.stringify({ iat: nowSeconds - 60, exp: nowSeconds + 600, iss: input.appId })
+  );
+  const signer = createSign("RSA-SHA256");
+  signer.update(`${header}.${payload}`);
+  const signature = base64url2(signer.sign(input.privateKeyPem));
+  return `${header}.${payload}.${signature}`;
+}
+var RENEW_BEFORE_MS = 5 * 60 * 1e3;
+function createGithubAppAuth(deps) {
+  const apiBase = deps.apiBase ?? "https://api.github.com";
+  let cached = null;
+  async function mint() {
+    const jwt = signGithubAppJwt({ appId: deps.appId, privateKeyPem: deps.privateKeyPem, nowMs: deps.now() });
+    let response;
+    try {
+      response = await deps.fetchImpl(`${apiBase}/app/installations/${deps.installationId}/access_tokens`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${jwt}`,
+          accept: "application/vnd.github+json",
+          "x-github-api-version": "2022-11-28",
+          "user-agent": "ogygie-studio"
+        }
+      });
+    } catch (thrown) {
+      return throwOgygieError({
+        code: "GITHUB_APP_AUTH_FAILED",
+        message: "GitHub could not be reached to mint an installation token.",
+        file: null,
+        cause: thrown instanceof Error ? thrown.message : String(thrown),
+        suggestedFix: "Retry once the network is back; nothing was written."
+      });
+    }
+    if (!response.ok) {
+      return throwOgygieError({
+        code: "GITHUB_APP_AUTH_FAILED",
+        message: `GitHub answered ${response.status} when minting the installation token.`,
+        file: null,
+        cause: `status=${response.status} for installation ${deps.installationId}`,
+        suggestedFix: "Check githubApp.appId, githubApp.installationId and the private key: the app must be installed on this repo with contents and pull requests permissions."
+      });
+    }
+    const body = await response.json();
+    return { token: body.token, expiresAtMs: Date.parse(body.expires_at) };
+  }
+  async function installationToken() {
+    if (cached === null || cached.expiresAtMs - deps.now() < RENEW_BEFORE_MS) {
+      cached = await mint();
+    }
+    return cached.token;
+  }
+  const installationFetch = async (input, init) => {
+    const token = await installationToken();
+    const headers = new Headers(init?.headers);
+    headers.set("authorization", `Bearer ${token}`);
+    return deps.fetchImpl(input, { ...init, headers });
+  };
+  return { installationToken, installationFetch };
+}
+
+// src/server/hosted/mail.ts
+function createHttpMailSender(deps) {
+  return {
+    async send(input) {
+      let response;
+      try {
+        response = await deps.fetchImpl(deps.providerUrl, {
+          method: "POST",
+          headers: { authorization: `Bearer ${deps.apiKey}`, "content-type": "application/json" },
+          body: JSON.stringify({ from: deps.fromAddress, to: input.to, subject: input.subject, text: input.text })
+        });
+      } catch (thrown) {
+        return throwOgygieError({
+          code: "MAIL_PROVIDER_UNAVAILABLE",
+          message: "The mail provider could not be reached.",
+          file: null,
+          cause: thrown instanceof Error ? thrown.message : String(thrown),
+          suggestedFix: "Check mail.providerUrl and the network; the sign-in link was not sent."
+        });
+      }
+      if (!response.ok) {
+        return throwOgygieError({
+          code: "MAIL_PROVIDER_UNAVAILABLE",
+          message: `The mail provider answered ${response.status}.`,
+          file: null,
+          cause: `status=${response.status}`,
+          suggestedFix: "Check the provider key (mail.apiKeyPath) and the sender address (mail.fromAddress)."
+        });
+      }
+    }
+  };
+}
+
+// ../ogygie-core/src/model.ts
+function createMessagesClient(deps) {
+  const apiBase = deps.apiBase ?? "https://api.anthropic.com";
+  const credential = deps.credentialHint ?? "the model API key";
+  return {
+    async complete(input) {
+      let response;
+      try {
+        response = await deps.fetchImpl(`${apiBase}/v1/messages`, {
+          method: "POST",
+          headers: {
+            "x-api-key": deps.apiKey,
+            "anthropic-version": "2023-06-01",
+            "content-type": "application/json"
+          },
+          body: JSON.stringify({
+            model: input.model,
+            max_tokens: input.maxTokens ?? 16e3,
+            system: [{ type: "text", text: input.system, cache_control: { type: "ephemeral" } }],
+            messages: input.messages,
+            output_config: { effort: input.effort ?? "high" }
+          })
+        });
+      } catch (thrown) {
+        return throwOgygieError(
+          {
+            code: "MODEL_UNAVAILABLE",
+            message: "The model API could not be reached.",
+            file: null,
+            cause: thrown instanceof Error ? thrown.message : String(thrown),
+            suggestedFix: "Retry once the network is back; nothing was written."
+          },
+          502
+        );
+      }
+      if (!response.ok) {
+        const body = await response.text();
+        const budget = response.status === 400 && /credit|billing|spend|budget/i.test(body);
+        return throwOgygieError(
+          {
+            code: budget ? "MODEL_BUDGET_EXCEEDED" : "MODEL_UNAVAILABLE",
+            message: budget ? "The model workspace refused the call: its spending limit is reached." : `The model API answered ${response.status}.`,
+            file: null,
+            cause: `status=${response.status} ${body.slice(0, 300)}`,
+            suggestedFix: budget ? "The monthly budget of this workspace is spent; it resets with the month, or the operator raises it." : `Check ${credential} and retry; nothing was written.`
+          },
+          budget ? 429 : 502
+        );
+      }
+      const answer = await response.json();
+      return {
+        text: answer.content.filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text ?? "").join(""),
+        model: answer.model,
+        stopReason: answer.stop_reason,
+        usage: { inputTokens: answer.usage.input_tokens, outputTokens: answer.usage.output_tokens }
+      };
+    }
+  };
+}
+
+// src/server/hosted/model.ts
+function createAnthropicSpecWriter(deps) {
+  const client = createMessagesClient({
+    apiKey: deps.apiKey,
+    fetchImpl: deps.fetchImpl,
+    ...deps.apiBase === void 0 ? {} : { apiBase: deps.apiBase },
+    credentialHint: "OGYGIE_MODEL_API_KEY"
+  });
+  return {
+    async write(input) {
+      const messages = [{ role: "user", content: input.user }];
+      if (input.previous !== void 0) {
+        messages.push({ role: "assistant", content: input.previous.draft });
+        messages.push({
+          role: "user",
+          content: `Ce brouillon est refus\xE9 par les gates du repo pour les raisons suivantes :
+- ${input.previous.problems.join("\n- ")}
+
+R\xE9\xE9cris la spec COMPL\xC8TE, corrig\xE9e, sans autre commentaire.`
+        });
+      }
+      const answer = await client.complete({ model: deps.model, system: input.system, messages, maxTokens: deps.maxTokens ?? 16e3, effort: "high" });
+      if (answer.stopReason === "refusal") {
+        return throwOgygieError(
+          {
+            code: "MODEL_REFUSED",
+            message: "The model declined to write this brief.",
+            file: null,
+            cause: "stop_reason=refusal",
+            suggestedFix: "Rephrase the brief as a product need; the studio writes specs, nothing else."
+          },
+          422
+        );
+      }
+      if (answer.stopReason === "max_tokens") {
+        return throwOgygieError(
+          {
+            code: "MODEL_OUTPUT_TRUNCATED",
+            message: "The draft was cut before its end.",
+            file: null,
+            cause: `stop_reason=max_tokens at ${deps.maxTokens ?? 16e3} tokens`,
+            suggestedFix: "Split the brief: one rubric per brief, one spec per rubric."
+          },
+          422
+        );
+      }
+      return { text: answer.text, model: answer.model, usage: answer.usage };
+    }
+  };
+}
+
+// src/server/hosted/github-pulls.ts
+var RED_CONCLUSIONS = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out", "action_required", "startup_failure"]);
+function checksStateOf(runs, statuses) {
+  if (runs.length === 0 && statuses.length === 0) return "none";
+  const red = runs.some((run) => run.conclusion !== null && RED_CONCLUSIONS.has(run.conclusion)) || statuses.some((status) => status.state === "failure" || status.state === "error");
+  if (red) return "red";
+  const pending = runs.some((run) => run.status !== "completed") || statuses.some((status) => status.state === "pending");
+  return pending ? "pending" : "green";
+}
+function createGithubPullsClient(deps) {
+  const apiBase = deps.apiBase ?? "https://api.github.com";
+  const repoUrl = `${apiBase}/repos/${deps.github.owner}/${deps.github.repo}`;
+  async function request(method, url, body, allow = []) {
+    let response;
+    try {
+      response = await deps.fetchImpl(url, {
+        method,
+        headers: {
+          accept: "application/vnd.github+json",
+          "x-github-api-version": "2022-11-28",
+          "user-agent": "ogygie-studio",
+          ...body === void 0 ? {} : { "content-type": "application/json" }
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+    } catch (thrown) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub could not be reached for ${deps.github.owner}/${deps.github.repo}.`,
+        file: null,
+        cause: thrown instanceof Error ? thrown.message : String(thrown),
+        suggestedFix: "Retry once the network is back; nothing was merged."
+      });
+    }
+    if (allow.includes(response.status)) return { status: response.status, json: null };
+    if (!response.ok) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub answered ${response.status} for ${method} ${url.replace(apiBase, "")}.`,
+        file: null,
+        cause: `status=${response.status}`,
+        suggestedFix: "Retry later; check the app installation grants contents and pull requests on this repo."
+      });
+    }
+    const text = await response.text();
+    return { status: response.status, json: text === "" ? null : JSON.parse(text) };
+  }
+  return {
+    async findOpenPullRequest(branch) {
+      const { json } = await request(
+        "GET",
+        `${repoUrl}/pulls?state=open&head=${encodeURIComponent(`${deps.github.owner}:${branch}`)}`,
+        void 0
+      );
+      const first = json?.[0];
+      return first === void 0 ? null : { number: first.number, url: first.html_url, headSha: first.head.sha, title: first.title, labels: (first.labels ?? []).map((label) => label.name) };
+    },
+    async listOpenSpecPullRequests() {
+      const { json } = await request(
+        "GET",
+        `${repoUrl}/pulls?state=open&sort=updated&direction=desc&per_page=100`,
+        void 0
+      );
+      return (json ?? []).filter((pull) => pull.head.ref.startsWith("spec/")).map((pull) => ({ number: pull.number, url: pull.html_url, headSha: pull.head.sha, title: pull.title, branch: pull.head.ref, labels: (pull.labels ?? []).map((label) => label.name) }));
+    },
+    async listFileCommits(branch, path) {
+      const { json } = await request(
+        "GET",
+        `${repoUrl}/commits?sha=${encodeURIComponent(branch)}&path=${encodeURIComponent(path)}&per_page=50`,
+        void 0
+      );
+      return (json ?? []).map((entry) => ({ sha: entry.sha, message: entry.commit.message }));
+    },
+    async getPullRequest(number) {
+      const { json } = await request(
+        "GET",
+        `${repoUrl}/pulls/${number}`,
+        void 0
+      );
+      if (json === null) throw new Error("empty pull request answer");
+      return { number: json.number, url: json.html_url, headSha: json.head.sha, mergeable: json.mergeable, merged: json.merged };
+    },
+    async getChecks(sha) {
+      const [runsAnswer, statusAnswer] = await Promise.all([
+        request("GET", `${repoUrl}/commits/${sha}/check-runs?per_page=100`, void 0),
+        request("GET", `${repoUrl}/commits/${sha}/status`, void 0)
+      ]);
+      const runs = runsAnswer.json?.check_runs ?? [];
+      const statuses = statusAnswer.json?.statuses ?? [];
+      return {
+        state: checksStateOf(runs, statuses),
+        runs: [
+          ...runs.map((run) => ({ name: run.name, conclusion: run.status === "completed" ? run.conclusion : "pending" })),
+          ...statuses.map((status) => ({ name: status.context, conclusion: status.state }))
+        ]
+      };
+    },
+    async mergePullRequest(number, input) {
+      const { status, json } = await request(
+        "PUT",
+        `${repoUrl}/pulls/${number}/merge`,
+        { merge_method: "squash", commit_title: input.title, commit_message: input.message },
+        [405, 409]
+      );
+      if (status === 405 || status === 409) {
+        return throwOgygieError(
+          {
+            code: "PULL_REQUEST_CONFLICTING",
+            message: `GitHub refused to merge pull request #${number} (${status}).`,
+            file: null,
+            cause: status === 409 ? "the head moved since it was read" : "not mergeable: conflict, or a required check missing",
+            suggestedFix: "Regenerate the branch on the current default branch (operator), then merge again."
+          },
+          409
+        );
+      }
+      return { sha: json?.sha ?? "" };
+    },
+    async deleteBranch(branch) {
+      await request("DELETE", `${repoUrl}/git/refs/heads/${encodeURIComponent(branch)}`, void 0, [404, 422]);
+    }
+  };
+}
+
+// src/server/hosted/github-deploy.ts
+function createGithubDeployClient(deps) {
+  const apiBase = deps.apiBase ?? "https://api.github.com";
+  const repoUrl = `${apiBase}/repos/${deps.github.owner}/${deps.github.repo}`;
+  async function request(method, url, body, allowNotFound = false) {
+    let response;
+    try {
+      response = await deps.fetchImpl(url, {
+        method,
+        headers: {
+          accept: "application/vnd.github+json",
+          "x-github-api-version": "2022-11-28",
+          "user-agent": "ogygie-studio",
+          ...body === void 0 ? {} : { "content-type": "application/json" }
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+    } catch (thrown) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub could not be reached for ${deps.github.owner}/${deps.github.repo}.`,
+        file: null,
+        cause: thrown instanceof Error ? thrown.message : String(thrown),
+        suggestedFix: "Retry once the network is back; no ref was moved."
+      });
+    }
+    if (response.status === 404 && allowNotFound) return null;
+    if (!response.ok) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub answered ${response.status} for ${method} ${url.replace(apiBase, "")}.`,
+        file: null,
+        cause: `status=${response.status}`,
+        suggestedFix: response.status === 422 ? "Check the ref and the sha: a protected ref only moves by the installation, in fast-forward unless forced." : "Retry later; check the app installation grants contents and deployments on this repo."
+      });
+    }
+    const text = await response.text();
+    return text === "" ? null : JSON.parse(text);
+  }
+  return {
+    async getRefSha(ref) {
+      const answer = await request("GET", `${repoUrl}/git/ref/heads/${encodeURIComponent(ref)}`, void 0, true);
+      return answer?.object.sha ?? null;
+    },
+    async getCommitSha(shaOrRef) {
+      const answer = await request("GET", `${repoUrl}/commits/${encodeURIComponent(shaOrRef)}`, void 0, true);
+      return answer?.sha ?? null;
+    },
+    async compare(base, head) {
+      const answer = await request(
+        "GET",
+        `${repoUrl}/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}?per_page=250`,
+        void 0
+      );
+      return {
+        status: answer?.status ?? "diverged",
+        commits: (answer?.commits ?? []).map((entry) => ({ sha: entry.sha, message: entry.commit.message, authoredAt: entry.commit.author.date }))
+      };
+    },
+    async updateRef(ref, sha, force) {
+      await request("PATCH", `${repoUrl}/git/refs/heads/${encodeURIComponent(ref)}`, { sha, force });
+    },
+    async createDeployment(input) {
+      const answer = await request("POST", `${repoUrl}/deployments`, {
+        ref: input.sha,
+        environment: input.environment,
+        description: input.description,
+        payload: input.payload,
+        auto_merge: false,
+        required_contexts: [],
+        production_environment: input.environment === "production"
+      });
+      return { id: answer?.id ?? 0 };
+    },
+    async latestDeployment(environment) {
+      const deployments = await request(
+        "GET",
+        `${repoUrl}/deployments?environment=${encodeURIComponent(environment)}&per_page=1`,
+        void 0
+      );
+      const latest = deployments?.[0];
+      if (latest === void 0) return null;
+      const statuses = await request("GET", `${repoUrl}/deployments/${latest.id}/statuses?per_page=1`, void 0);
+      return { id: latest.id, sha: latest.sha, createdAt: latest.created_at, state: statuses?.[0]?.state ?? null };
+    },
+    async listTags(prefix) {
+      const refs = await request("GET", `${repoUrl}/git/matching-refs/tags/${prefix}`, void 0);
+      return (refs ?? []).map((entry) => entry.ref.replace(/^refs\/tags\//, ""));
+    },
+    async createTag(input) {
+      const tag = await request("POST", `${repoUrl}/git/tags`, {
+        tag: input.name,
+        message: input.message,
+        object: input.sha,
+        type: "commit",
+        tagger: { ...input.tagger, date: (/* @__PURE__ */ new Date()).toISOString() }
+      });
+      await request("POST", `${repoUrl}/git/refs`, { ref: `refs/tags/${input.name}`, sha: tag?.sha ?? input.sha });
+    },
+    async getPullRequestBody(number) {
+      const pull = await request("GET", `${repoUrl}/pulls/${number}`, void 0, true);
+      return pull?.body ?? "";
+    }
+  };
+}
+
+// src/server/hosted/github-usage.ts
+function createGithubUsageClient(deps) {
+  const apiBase = deps.apiBase ?? "https://api.github.com";
+  const repoUrl = `${apiBase}/repos/${deps.github.owner}/${deps.github.repo}`;
+  async function request(method, url, body) {
+    let response;
+    try {
+      response = await deps.fetchImpl(url, {
+        method,
+        headers: {
+          accept: "application/vnd.github+json",
+          "x-github-api-version": "2022-11-28",
+          "user-agent": "ogygie-studio",
+          ...body === void 0 ? {} : { "content-type": "application/json" }
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+    } catch (thrown) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub could not be reached for ${deps.github.owner}/${deps.github.repo}.`,
+        file: null,
+        cause: thrown instanceof Error ? thrown.message : String(thrown),
+        suggestedFix: "Retry once the network is back."
+      });
+    }
+    if (!response.ok) {
+      return throwOgygieError({
+        code: "GITHUB_UNAVAILABLE",
+        message: `GitHub answered ${response.status} for ${method} ${url.replace(apiBase, "")}.`,
+        file: null,
+        cause: `status=${response.status}`,
+        suggestedFix: "Retry later; check the app installation grants pull requests (write) on this repo."
+      });
+    }
+    const text = await response.text();
+    return text === "" ? null : JSON.parse(text);
+  }
+  async function journalComment(pullRequestNumber) {
+    const comments = await request("GET", `${repoUrl}/issues/${pullRequestNumber}/comments?per_page=100`) ?? [];
+    const found = comments.find((comment) => comment.body.includes(USAGE_MARKER));
+    return found === void 0 ? null : { id: found.id, entries: parseUsageComment(found.body) };
+  }
+  return {
+    async appendUsage(pullRequestNumber, entries) {
+      const existing = await journalComment(pullRequestNumber);
+      const body = formatUsageComment([...existing?.entries ?? [], ...entries]);
+      if (existing === null) {
+        await request("POST", `${repoUrl}/issues/${pullRequestNumber}/comments`, { body });
+      } else {
+        await request("PATCH", `${repoUrl}/issues/comments/${existing.id}`, { body });
+      }
+    },
+    async journalsSince(sinceIso) {
+      const pulls = await request(
+        "GET",
+        `${repoUrl}/pulls?state=all&sort=updated&direction=desc&per_page=100`
+      ) ?? [];
+      const journals = [];
+      for (const pull of pulls) {
+        if (pull.updated_at < sinceIso) break;
+        if (!pull.head.ref.startsWith("spec/")) continue;
+        const comment = await journalComment(pull.number);
+        if (comment === null || comment.entries.length === 0) continue;
+        journals.push({ specId: pull.head.ref.slice("spec/".length).replace(/-[0-9a-f]{7}$/, ""), pullRequestNumber: pull.number, entries: comment.entries });
+      }
+      return journals;
+    }
+  };
+}
+
 // src/server/start.ts
 function studioPackageRoot() {
   let directory = dirname2(fileURLToPath(import.meta.url));
@@ -1159,7 +3778,142 @@ async function startStudio(options) {
   if (options.openBrowser !== false) openInBrowser(url);
   return app;
 }
+var MIN_SESSION_SECRET_LENGTH = 32;
+function readSecret(path, what, minLength = 1) {
+  let value = "";
+  try {
+    value = readFileSync(resolvePath(path), "utf8").trim();
+  } catch {
+    value = "";
+  }
+  if (value.length < minLength) {
+    throwOgygieError({
+      code: "HOST_SECRET_MISSING",
+      message: `The hosted studio cannot start: ${what} is missing or too short.`,
+      file: path,
+      cause: value.length === 0 ? "file absent or empty" : `${value.length} characters, minimum ${minLength}`,
+      suggestedFix: `Write ${what} to that path (chmod 600) \u2014 a half-configured hosted mode is an error, not a degraded mode.`
+    });
+  }
+  return value;
+}
+function resolvePath(path) {
+  return path.startsWith("~/") ? join2(process.env["HOME"] ?? "", path.slice(2)) : path;
+}
+function loadHostConfig(configPath) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch (thrown) {
+    return throwOgygieError({
+      code: "HOST_CONFIG_INVALID",
+      message: "The hosted studio configuration cannot be read as JSON.",
+      file: configPath,
+      cause: thrown instanceof Error ? thrown.message : String(thrown),
+      suggestedFix: "Point --config at a readable ogygie-host.config.json."
+    });
+  }
+  return parseHostConfig(raw, configPath);
+}
+async function startHostedStudio(options) {
+  const config = loadHostConfig(options.configPath);
+  const privateKeyPem = readSecret(config.githubApp.privateKeyPath, "the GitHub App private key");
+  const sessionSecret = readSecret(config.session.secretPath, "the session secret", MIN_SESSION_SECRET_LENGTH);
+  const mailApiKey = readSecret(config.mail.apiKeyPath, "the mail provider key");
+  const modelApiKey = config.model === void 0 ? void 0 : process.env["OGYGIE_MODEL_API_KEY"] ?? "";
+  if (modelApiKey !== void 0 && modelApiKey.length === 0) {
+    throwOgygieError({
+      code: "HOST_SECRET_MISSING",
+      message: "The hosted studio cannot start: the configuration declares a model block but OGYGIE_MODEL_API_KEY is absent.",
+      file: options.configPath,
+      cause: "model block present, environment variable empty",
+      suggestedFix: "Export OGYGIE_MODEL_API_KEY (the client's model workspace key, D50) in the instance environment, or remove the model block to run without briefs."
+    });
+  }
+  const uiDistDir = studioUiDir();
+  await buildUiIfMissing(uiDistDir);
+  const now = () => Date.now();
+  const log = (line) => {
+    process.stderr.write(`${line}
+`);
+  };
+  const githubApp = createGithubAppAuth({
+    appId: config.githubApp.appId,
+    installationId: config.githubApp.installationId,
+    privateKeyPem,
+    fetchImpl: fetch,
+    now
+  });
+  const repoId = config.repo.repo;
+  const recentProposals = /* @__PURE__ */ new Map();
+  const listSpecBranches = createGithubSpecBranchLister({ github: config.repo, fetchImpl: githubApp.installationFetch });
+  const readerFor = (ref) => createGithubApiRepoAdapter({
+    owner: config.repo.owner,
+    repo: config.repo.repo,
+    ref,
+    fetchImpl: githubApp.installationFetch,
+    userAgent: "ogygie-studio"
+  });
+  const client = createGithubWriteClient(
+    { token: "installation", fetchImpl: githubApp.installationFetch, userAgent: "ogygie-studio", credentialHint: "the GitHub App installation" },
+    config.repo
+  );
+  const deploy = config.environments === void 0 ? void 0 : createGithubDeployClient({ github: config.repo, fetchImpl: githubApp.installationFetch });
+  if (deploy !== void 0) {
+    for (const ref of Object.values(ENVIRONMENT_REFS)) {
+      if (await deploy.getRefSha(ref) === null) {
+        throwOgygieError({
+          code: "HOST_ENVIRONMENT_REF_MISSING",
+          message: `The hosted studio cannot start: the environment ref ${ref} does not exist on ${config.repo.owner}/${config.repo.repo}.`,
+          file: options.configPath,
+          cause: `environments declared, ${ref} absent`,
+          suggestedFix: "Create env/staging and env/production from the default branch and protect them (docs/HOSTED-STUDIO.md \xA77), or remove the environments block."
+        });
+      }
+    }
+  }
+  const app = await createStudioApp({
+    uiDistDir,
+    hosted: {
+      config,
+      sessionSecret,
+      mail: createHttpMailSender({
+        providerUrl: config.mail.providerUrl,
+        apiKey: mailApiKey,
+        fromAddress: config.mail.fromAddress,
+        fetchImpl: fetch
+      }),
+      now,
+      log,
+      consumedLinks: /* @__PURE__ */ new Map(),
+      pulls: createGithubPullsClient({ github: config.repo, fetchImpl: githubApp.installationFetch }),
+      readerFor,
+      usage: createGithubUsageClient({ github: config.repo, fetchImpl: githubApp.installationFetch }),
+      ...deploy === void 0 ? {} : { deploy },
+      ...modelApiKey === void 0 || config.model === void 0 ? {} : { writer: createAnthropicSpecWriter({ apiKey: modelApiKey, model: config.model.specModel, fetchImpl: fetch }) },
+      storageFor: (user) => createHostedSpecStorage({
+        repoId,
+        github: config.repo,
+        readerFor,
+        listSpecBranches,
+        client,
+        user,
+        now,
+        rateLimitPerHour: config.writeRateLimit,
+        recentProposals,
+        log
+      })
+    }
+  });
+  const host = options.host ?? "127.0.0.1";
+  const port = options.port ?? 4001;
+  await app.listen({ port, host });
+  console.log(`ogygie studio \u2014 mode h\xE9berg\xE9 sur ${host}:${port}, repo ${config.repo.owner}/${config.repo.repo}, ${config.users.length} utilisateur(s) d\xE9clar\xE9(s), briefs ${modelApiKey === void 0 ? "d\xE9sactiv\xE9s (pas de bloc model)" : `par ${config.model?.specModel ?? ""}`}`);
+  return app;
+}
 export {
+  loadHostConfig,
+  startHostedStudio,
   startStudio,
   studioUiDir
 };