@ogygie/studio 0.27.0 → 0.29.0

package/dist/server.js

@@ -558,14 +558,14 @@ var OgygieManifestSchema = z3.object({
     }
     packageNames.add(packageEntry.name);
   });
-  const specIdOf = (specPath) => (specPath.split("/").pop() ?? specPath).replace(/\.spec\.md$/, "");
+  const specIdOf2 = (specPath) => (specPath.split("/").pop() ?? specPath).replace(/\.spec\.md$/, "");
   const ownedSpecIds = /* @__PURE__ */ new Set([
     ...manifest.features.map((feature) => feature.name),
     ...packageNames
   ]);
   (manifest.framework?.packages ?? []).forEach((packageEntry, index) => {
     if (packageEntry.spec === null) return;
-    const specId = specIdOf(packageEntry.spec);
+    const specId = specIdOf2(packageEntry.spec);
     if (ownedSpecIds.has(specId)) {
       context.addIssue({
         code: "custom",
@@ -1552,211 +1552,587 @@ async function getManifest(deps) {
 }
 
 // src/server/schemas.ts
+import { z as z7 } from "zod";
+
+// ../ogygie-core/src/impact.ts
 import { z as z6 } from "zod";
+
+// ../ogygie-core/src/manifest-owners.ts
+function specIdOf(specPath) {
+  return (specPath.split("/").pop() ?? specPath).replace(/\.spec\.md$/, "");
+}
+function declaredEntries(manifest) {
+  const entries = [];
+  for (const feature of manifest.features) {
+    const owningApp = feature.app === void 0 ? manifest.apps.find((app) => app.type === "api") : manifest.apps.find((app) => app.name === feature.app);
+    entries.push({
+      kind: "feature",
+      name: feature.name,
+      status: feature.status,
+      folder: owningApp === void 0 ? null : `${owningApp.path}/${feature.folder}`,
+      specId: feature.name,
+      appType: owningApp?.type ?? null
+    });
+  }
+  for (const productPackage of manifest.packages ?? []) {
+    entries.push({
+      kind: "package",
+      name: productPackage.name,
+      status: productPackage.status,
+      folder: productPackage.path,
+      specId: productPackage.name,
+      appType: null
+    });
+  }
+  for (const frameworkPackage of manifest.framework?.packages ?? []) {
+    entries.push({
+      kind: "framework-package",
+      name: frameworkPackage.name,
+      status: frameworkPackage.status,
+      folder: frameworkPackage.path,
+      // A published npm name is not a spec id: the link is DECLARED.
+      specId: frameworkPackage.spec === null ? null : specIdOf(frameworkPackage.spec),
+      appType: null
+    });
+  }
+  return entries;
+}
+
+// ../ogygie-core/src/module-purity.ts
+var IMPORT_STATEMENT = /\bimport\b(?![.(])([\s\S]*?)from\s*["']([^"']+)["']|\bimport\s+["']([^"']+)["']/g;
+var DYNAMIC_LOAD = /\b(?:import\s*\(|require\s*\()\s*["']([^"']+)["']/g;
+var REEXPORT_STATEMENT = /\bexport\s+(type\s+)?(\*(?:\s+as\s+[A-Za-z_$][\w$]*)?|\{[^}]*\})\s*from\s*["']([^"']+)["']/g;
+function parseModuleImports(source) {
+  const code = stripComments(source);
+  const imports = [];
+  for (const match of code.matchAll(IMPORT_STATEMENT)) {
+    const [statement, clause, fromSpecifier, bareSpecifier] = match;
+    const specifier = fromSpecifier ?? bareSpecifier;
+    if (specifier === void 0) continue;
+    imports.push({
+      specifier,
+      typeOnly: clause !== void 0 && isTypeOnlyClause(clause),
+      statement: normalizeWhitespace(statement)
+    });
+  }
+  for (const match of code.matchAll(REEXPORT_STATEMENT)) {
+    const [statement, typeKeyword, clause, specifier] = match;
+    if (specifier === void 0 || clause === void 0) continue;
+    imports.push({
+      specifier,
+      typeOnly: typeKeyword !== void 0 || isTypeOnlyClause(clause),
+      statement: normalizeWhitespace(statement)
+    });
+  }
+  for (const match of code.matchAll(DYNAMIC_LOAD)) {
+    const [statement, specifier] = match;
+    if (specifier === void 0) continue;
+    imports.push({
+      specifier,
+      typeOnly: false,
+      statement: normalizeWhitespace(statement)
+    });
+  }
+  return imports;
+}
+function isTypeOnlyClause(clause) {
+  const trimmed = clause.trim();
+  if (trimmed.startsWith("type ")) return true;
+  const named = /^\{([\s\S]*)\}$/.exec(trimmed);
+  if (named === null || named[1] === void 0) return false;
+  const bindings = named[1].split(",").map((binding) => binding.trim()).filter((binding) => binding.length > 0);
+  return bindings.length > 0 && bindings.every((binding) => binding.startsWith("type "));
+}
+function stripComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+}
+function normalizeWhitespace(statement) {
+  return statement.replace(/\s+/g, " ").trim();
+}
+
+// ../ogygie-core/src/shared-tables.ts
+function dbTableNameOf(declaration) {
+  return typeof declaration === "string" ? declaration : declaration.name;
+}
+function dbTableNamesOf(feature) {
+  return feature.dbTables.map(dbTableNameOf);
+}
+
+// ../ogygie-core/src/impact.ts
+var MapEntryKindSchema = z6.enum(["feature", "package", "framework-package"]);
+var ImpactScopeSchema = z6.object({
+  scannedFolders: z6.array(z6.string()),
+  coveredKinds: z6.array(MapEntryKindSchema),
+  outOfReach: z6.array(z6.string())
+});
+var ImpactReportSchema = z6.object({
+  target: z6.object({
+    name: z6.string(),
+    kind: MapEntryKindSchema,
+    folder: z6.string()
+  }),
+  dependents: z6.array(
+    z6.object({
+      name: z6.string(),
+      kind: MapEntryKindSchema,
+      importedSymbols: z6.array(z6.string()),
+      viaIndexOnly: z6.boolean()
+    })
+  ),
+  routes: z6.array(
+    z6.object({ method: z6.string(), path: z6.string(), description: z6.string() })
+  ),
+  ownedTables: z6.array(z6.string()),
+  tableReadersOutsideOwner: z6.array(
+    z6.object({ table: z6.string(), feature: z6.string(), file: z6.string() })
+  ),
+  findings: z6.array(OgygieErrorSchema),
+  testCommand: z6.string(),
+  scope: ImpactScopeSchema
+});
+var SOURCE_EXTENSIONS = [".ts", ".tsx"];
+function isSource(path) {
+  return SOURCE_EXTENSIONS.some((extension) => path.endsWith(extension));
+}
+function isTest(path) {
+  return /\.test\.tsx?$/.test(path);
+}
+function symbolsOfImportClause(clause) {
+  const symbols = [];
+  const braces = /\{([^}]*)\}/.exec(clause);
+  if (braces?.[1] !== void 0) {
+    for (const rawEntry of braces[1].split(",")) {
+      const name = rawEntry.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0]?.trim();
+      if (name !== void 0 && name !== "") symbols.push(name);
+    }
+  }
+  const outsideBraces = clause.replace(/\{[^}]*\}/, "").replace(/^type\s+/, "").trim();
+  if (/\*\s*as\s+/.test(outsideBraces)) symbols.push("*");
+  else if (outsideBraces.replace(/,/g, "").trim() !== "") symbols.push("default");
+  return symbols;
+}
+function specifiersMatching(target, source) {
+  const folder = target.folder;
+  if (folder === null) return false;
+  const directory = folder.split("/").pop() ?? folder;
+  if (new RegExp(`(^|/)\\.\\./${directory}/`).test(source)) return true;
+  if (source.startsWith(`../${directory}/`) || source === `../${directory}`) return true;
+  if (source === target.name || source.startsWith(`${target.name}/`)) return true;
+  const segments = source.split("/");
+  return segments.includes(directory) && !source.startsWith(".");
+}
+function piercesTheIndex(specifier) {
+  if (!specifier.startsWith(".")) return false;
+  return !/(^|\/)index(\.js)?$/.test(specifier);
+}
+async function analyzeImpact(deps, targetName) {
+  const entries = declaredEntries(deps.manifest);
+  const target = entries.find((entry) => entry.name === targetName);
+  if (target === void 0) {
+    return throwOgygieError({
+      code: "IMPACT_UNKNOWN_FEATURE",
+      message: `"${targetName}" is unknown to the manifest.`,
+      file: "ogygie.manifest.json",
+      cause: `no entry of the map is named "${targetName}"`,
+      suggestedFix: `Pick one of: ${entries.map((entry) => entry.name).join(", ") || "<the map declares nothing>"}.`
+    });
+  }
+  return buildReport(deps, entries, target);
+}
+async function buildReport(deps, entries, target) {
+  const findings = [];
+  const scannedFolders = [];
+  const outOfReach = [];
+  if (target.folder === null) {
+    outOfReach.push(
+      `the target "${target.name}" has no folder the map can resolve \u2014 its app is not declared`
+    );
+  }
+  const dependents = /* @__PURE__ */ new Map();
+  const tableReadersOutsideOwner = [];
+  const ownedTables = target.kind === "feature" ? tablesOf(deps.manifest, target.name) : [];
+  for (const entry of entries) {
+    if (entry.name === target.name) continue;
+    if (entry.folder === null) {
+      outOfReach.push(
+        `"${entry.name}" (${entry.kind}) \u2014 the map declares no resolvable folder for it`
+      );
+      continue;
+    }
+    const files = (await deps.adapter.listDirectory(entry.folder)).filter(
+      (file) => isSource(file.path)
+    );
+    if (files.length > 0) scannedFolders.push(entry.folder);
+    for (const file of files) {
+      const filePath = `${entry.folder}/${file.path}`;
+      const content = await deps.adapter.readFile(filePath);
+      for (const imported of parseModuleImports(content)) {
+        if (!specifiersMatching(target, imported.specifier)) continue;
+        const accumulator = dependents.get(entry.name) ?? {
+          kind: entry.kind,
+          importedSymbols: /* @__PURE__ */ new Set(),
+          viaIndexOnly: true
+        };
+        for (const symbol of symbolsOfImportClause(clauseOf(imported.statement))) {
+          accumulator.importedSymbols.add(symbol);
+        }
+        if (piercesTheIndex(imported.specifier)) {
+          accumulator.viaIndexOnly = false;
+          findings.push(
+            ogygieError({
+              code: "FEATURE_BOUNDARY_VIOLATION",
+              message: `"${entry.name}" imports an internal file of "${target.name}" instead of its index.ts.`,
+              file: filePath,
+              cause: `import from "${imported.specifier}" bypasses the public index of ${target.name}`,
+              suggestedFix: `Export the needed symbols from the index of ${target.name} and import them from there.`
+            })
+          );
+        }
+        dependents.set(entry.name, accumulator);
+      }
+      if (isTest(file.path)) continue;
+      if (entry.appType === "front" || entry.appType === "gateway") continue;
+      for (const table of ownedTables) {
+        if (!content.includes(`"${table}"`)) continue;
+        tableReadersOutsideOwner.push({ table, feature: entry.name, file: filePath });
+        findings.push(
+          ogygieError({
+            code: "TABLE_REFERENCED_OUTSIDE_OWNER",
+            message: `Table "${table}" is owned by "${target.name}" but referenced by production code of "${entry.name}".`,
+            file: filePath,
+            cause: `"${table}" found in a non-test file outside its owner`,
+            suggestedFix: `Go through the public contracts of ${target.name} instead of touching the table \u2014 one table, one owner.`
+          })
+        );
+      }
+    }
+  }
+  findings.push(...manifestDependencyFindings(deps.manifest, target, dependents));
+  const feature = deps.manifest.features.find((candidate) => candidate.name === target.name);
+  const report = {
+    target: { name: target.name, kind: target.kind, folder: target.folder ?? "" },
+    dependents: [...dependents.entries()].map(([name, accumulator]) => ({
+      name,
+      kind: accumulator.kind,
+      importedSymbols: [...accumulator.importedSymbols].sort(),
+      viaIndexOnly: accumulator.viaIndexOnly
+    })).sort((left, right) => left.name < right.name ? -1 : 1),
+    routes: (feature?.routes ?? []).map((route) => ({
+      method: route.method,
+      path: route.path,
+      description: route.description
+    })),
+    ownedTables,
+    tableReadersOutsideOwner,
+    findings,
+    testCommand: testCommandFor(target, [...dependents.keys()], entries),
+    scope: {
+      scannedFolders: scannedFolders.sort(),
+      coveredKinds: [...new Set(entries.map((entry) => entry.kind))],
+      outOfReach: [...outOfReach, ...outOfReachOf(target, entries)]
+    }
+  };
+  return ImpactReportSchema.parse(report);
+}
+function clauseOf(statement) {
+  const match = /\bimport\b([\s\S]*?)\bfrom\b/.exec(statement);
+  return match?.[1] ?? "";
+}
+function tablesOf(manifest, featureName) {
+  const feature = manifest.features.find((candidate) => candidate.name === featureName);
+  return feature === void 0 ? [] : dbTableNamesOf(feature);
+}
+function outOfReachOf(target, entries) {
+  const limits = [
+    "code that no manifest entry declares \u2014 the map is the only chart",
+    "anything outside this repo: no network, no npm registry"
+  ];
+  const spared = entries.filter(
+    (entry) => entry.appType === "front" || entry.appType === "gateway"
+  );
+  if (spared.length > 0 && target.kind === "feature") {
+    limits.push(
+      `table ownership was NOT checked in ${spared.length} front/gateway entr${spared.length === 1 ? "y" : "ies"} \u2014 that code holds no database client, so a table name there is a query key or a route`
+    );
+  }
+  if (target.kind === "framework-package" || target.kind === "package") {
+    limits.unshift(
+      `consumers of "${target.name}" OUTSIDE this repo \u2014 it is a package, and a published package is imported by projects this analysis cannot see`
+    );
+  }
+  return limits;
+}
+function manifestDependencyFindings(manifest, target, dependents) {
+  const findings = [];
+  const declared = manifest.features.filter(
+    (feature) => feature.dependsOn.includes(target.name)
+  );
+  for (const feature of declared) {
+    if (!dependents.has(feature.name)) {
+      findings.push(
+        ogygieError({
+          code: "MANIFEST_DEPENDENCY_STALE",
+          message: `Feature "${feature.name}" declares dependsOn "${target.name}" but never imports it.`,
+          file: `ogygie.manifest.json#features.${feature.name}`,
+          cause: `dependsOn contains "${target.name}", no import of it found in its code`,
+          suggestedFix: "Remove the stale dependsOn entry, or make the dependency real through the entry's index.ts."
+        })
+      );
+    }
+  }
+  for (const [name, accumulator] of dependents) {
+    if (accumulator.kind !== "feature") continue;
+    if (declared.some((feature) => feature.name === name)) continue;
+    findings.push(
+      ogygieError({
+        code: "MANIFEST_DEPENDENCY_UNDECLARED",
+        message: `Feature "${name}" imports "${target.name}" but does not declare it in dependsOn.`,
+        file: `ogygie.manifest.json#features.${name}`,
+        cause: `imports of "${target.name}" found in its code, absent from its dependsOn`,
+        suggestedFix: `Add "${target.name}" to the dependsOn of "${name}" \u2014 the manifest must never lie by omission.`
+      })
+    );
+  }
+  return findings;
+}
+function testCommandFor(target, dependentNames, entries) {
+  const folders = [target, ...entries.filter((entry) => dependentNames.includes(entry.name))].map((entry) => entry.folder).filter((folder) => folder !== null);
+  return ["pnpm test --", ...[...new Set(folders)].sort()].join(" ");
+}
+
+// src/server/schemas.ts
 var SpecStatusSchema = SpecFrontmatterSchema.shape.status;
-var ReadableSpecSummarySchema = z6.object({
+var ReadableSpecSummarySchema = z7.object({
   id: FeatureNameSchema,
   status: SpecStatusSchema,
   priority: SpecFrontmatterSchema.shape.priority,
-  depends_on: z6.array(FeatureNameSchema),
-  filePath: z6.string(),
-  presentSections: z6.array(z6.string()),
+  depends_on: z7.array(FeatureNameSchema),
+  filePath: z7.string(),
+  presentSections: z7.array(z7.string()),
   /** The first sentence of `# @intent`, for a list that reads (v1.20: the target-spec suggestions of the brief). */
-  intent: z6.string().default("")
+  intent: z7.string().default("")
 });
-var UnreadableSpecSummarySchema = z6.object({
-  id: z6.string(),
-  filePath: z6.string(),
+var UnreadableSpecSummarySchema = z7.object({
+  id: z7.string(),
+  filePath: z7.string(),
   error: OgygieErrorSchema
 });
-var SpecSummarySchema = z6.union([
+var SpecSummarySchema = z7.union([
   ReadableSpecSummarySchema,
   UnreadableSpecSummarySchema
 ]);
-var ListSpecsOutputSchema = z6.object({
-  specs: z6.array(SpecSummarySchema)
+var ListSpecsOutputSchema = z7.object({
+  specs: z7.array(SpecSummarySchema)
 });
-var SpecParamsSchema = z6.object({
+var SpecParamsSchema = z7.object({
   specId: FeatureNameSchema
 });
-var GetSpecOutputSchema = z6.object({
+var GetSpecOutputSchema = z7.object({
   frontmatter: SpecFrontmatterSchema,
   /** Markdown body after the frontmatter block, byte-exact. */
-  body: z6.string(),
-  presentSections: z6.array(z6.string())
+  body: z7.string(),
+  presentSections: z7.array(z7.string())
 });
-var UpdateSpecInputSchema = z6.object({
+var UpdateSpecInputSchema = z7.object({
   frontmatter: SpecFrontmatterSchema,
   /** Omitted ⇒ the existing markdown body is preserved byte-exact. */
-  body: z6.string().max(2e5).optional()
+  body: z7.string().max(2e5).optional()
 });
-var UpdateSpecOutputSchema = z6.object({
+var UpdateSpecOutputSchema = z7.object({
   spec: ReadableSpecSummarySchema
 });
-var CreateSpecInputSchema = z6.object({
+var CreateSpecInputSchema = z7.object({
   id: FeatureNameSchema.max(80)
 });
-var CreateSpecOutputSchema = z6.object({
+var CreateSpecOutputSchema = z7.object({
   spec: ReadableSpecSummarySchema
 });
-var GetManifestOutputSchema = z6.object({
+var GetManifestOutputSchema = z7.object({
   manifest: OgygieManifestSchema
 });
-var BriefAttachmentSchema = z6.object({
-  name: z6.string().min(1).max(200),
-  contentBase64: z6.string().min(1).max(57e5)
+var BriefAttachmentSchema = z7.object({
+  name: z7.string().min(1).max(200),
+  contentBase64: z7.string().min(1).max(57e5)
 });
-var BriefAnswerSchema = z6.object({ questionId: FeatureNameSchema, answer: z6.string().min(1).max(2e3) });
-var BriefInputSchema = z6.object({
-  brief: z6.string().min(50).max(2e4),
+var BriefAnswerSchema = z7.object({ questionId: FeatureNameSchema, answer: z7.string().min(1).max(2e3) });
+var BriefInputSchema = z7.object({
+  brief: z7.string().min(50).max(2e4),
   /** Absent: the model names the new spec. Present and existing: an amendment. */
   specId: FeatureNameSchema.optional(),
   /** The client's material — a mock-up, a workbook, a document; five at most, formats md, txt, csv, json, html, xlsx, pdf. */
-  attachments: z6.array(BriefAttachmentSchema).max(5).default([]),
+  attachments: z7.array(BriefAttachmentSchema).max(5).default([]),
   /** D57: the answers of the past rounds of questions, three rounds at most. */
-  answers: z6.array(BriefAnswerSchema).max(15).default([]),
+  answers: z7.array(BriefAnswerSchema).max(15).default([]),
   /** D57: the round this send opens; at 3 the draft is asked without a question. */
-  round: z6.number().int().min(1).max(4).default(1),
+  round: z7.number().int().min(1).max(4).default(1),
   /** D57: « Passer les questions » — the draft is asked, the unknown becomes an assumption. */
-  skipQuestions: z6.boolean().default(false)
+  skipQuestions: z7.boolean().default(false)
 });
-var BriefQuestionSchema = z6.object({
+var BriefQuestionSchema = z7.object({
   /** kebab-case, stable from one read to the next. */
   id: FeatureNameSchema,
-  text: z6.string().min(1),
+  text: z7.string().min(1),
   /** The proposed answers; a free answer is always possible. */
-  options: z6.array(z6.string().min(1)).min(2).max(4)
+  options: z7.array(z7.string().min(1)).min(2).max(4)
 });
-var BriefOutputSchema = z6.object({
+var BriefOutputSchema = z7.object({
   specId: FeatureNameSchema,
   /** 1 when the first draft passed; up to 4 when the model corrected itself and a refused round of questions cost a turn (D57). */
-  attempts: z6.number().int().min(1).max(4),
-  problemsFixed: z6.array(z6.string()),
+  attempts: z7.number().int().min(1).max(4),
+  problemsFixed: z7.array(z7.string()),
   /** No feature of the manifest carries this id: its first schemas.ts awaits the operator (D52, lot C). */
-  isNewFeature: z6.boolean(),
-  isAmendment: z6.boolean(),
+  isNewFeature: z7.boolean(),
+  isAmendment: z7.boolean(),
   /** D53: the compositions the model proposed for a screen, the retained one (the head's) first; empty when the rubric is not a screen. */
-  compositions: z6.array(z6.string()).default([]),
+  compositions: z7.array(z7.string()).default([]),
   /** The generator's tally on the draft's `# Génération` block (lines bound without a model, lines carried by a hole); null without a block. */
-  generation: z6.object({ derivable: z6.number().int().nonnegative(), hole: z6.number().int().nonnegative() }).nullable().default(null),
+  generation: z7.object({ derivable: z7.number().int().nonnegative(), hole: z7.number().int().nonnegative() }).nullable().default(null),
   /** D57: the points the model decided that the brief did not say — the `# Hypothèses` lines of the draft. */
-  assumptions: z6.array(z6.string()).default([]),
-  usage: z6.array(
-    z6.object({ model: z6.string(), inputTokens: z6.number().int().nonnegative(), outputTokens: z6.number().int().nonnegative() })
+  assumptions: z7.array(z7.string()).default([]),
+  usage: z7.array(
+    z7.object({ model: z7.string(), inputTokens: z7.number().int().nonnegative(), outputTokens: z7.number().int().nonnegative() })
   )
 });
-var BriefStartOutputSchema = z6.object({ jobId: z6.string() });
-var BriefStageSchema = z6.enum(["questions", "drafting", "judging", "compositions", "writing", "done", "failed"]);
-var BriefJobSchema = z6.object({
-  jobId: z6.string(),
+var BriefStartOutputSchema = z7.object({ jobId: z7.string() });
+var BriefStageSchema = z7.enum(["questions", "drafting", "judging", "compositions", "writing", "done", "failed"]);
+var BriefJobSchema = z7.object({
+  jobId: z7.string(),
   stage: BriefStageSchema,
   /** On questions: the round in progress. */
-  round: z6.number().int().min(1).max(3).optional(),
+  round: z7.number().int().min(1).max(3).optional(),
   /** On drafting / judging: the attempt. */
-  attempt: z6.number().int().min(1).max(4).optional(),
+  attempt: z7.number().int().min(1).max(4).optional(),
   /** On compositions: k of N. */
-  composition: z6.object({ done: z6.number().int().nonnegative(), total: z6.number().int().nonnegative() }).optional(),
-  elapsedMs: z6.number().int().nonnegative(),
+  composition: z7.object({ done: z7.number().int().nonnegative(), total: z7.number().int().nonnegative() }).optional(),
+  elapsedMs: z7.number().int().nonnegative(),
   /** The P95 of B3: 90 000 ms. */
-  budgetMs: z6.number().int().positive(),
-  questions: z6.array(BriefQuestionSchema).min(3).max(5).optional(),
+  budgetMs: z7.number().int().positive(),
+  questions: z7.array(BriefQuestionSchema).min(3).max(5).optional(),
   result: BriefOutputSchema.optional(),
   error: OgygieErrorSchema.optional()
 });
-var ChecksStateSchema = z6.enum(["green", "red", "pending", "none"]);
-var PullRequestStatusSchema = z6.object({
+var SpecImpactSchema = z7.object({
   specId: FeatureNameSchema,
-  branch: z6.string(),
-  pullRequest: z6.object({ number: z6.number().int().positive(), url: z6.string(), headSha: z6.string(), title: z6.string() }).nullable(),
-  specStatus: z6.enum(["draft", "validated", "implemented", "unreadable", "absent"]),
+  /** The branch read: spec/<id> while it exists, else the default branch. */
+  ref: z7.string(),
+  /** False: the rubric is not an entry of the map yet — the impact reads after the speculation. */
+  onMap: z7.boolean(),
+  report: ImpactReportSchema.nullable()
+});
+var ChecksStateSchema = z7.enum(["green", "red", "pending", "none"]);
+var PullRequestStatusSchema = z7.object({
+  specId: FeatureNameSchema,
+  branch: z7.string(),
+  pullRequest: z7.object({ number: z7.number().int().positive(), url: z7.string(), headSha: z7.string(), title: z7.string() }).nullable(),
+  specStatus: z7.enum(["draft", "validated", "implemented", "unreadable", "absent"]),
   checks: ChecksStateSchema,
-  checkRuns: z6.array(z6.object({ name: z6.string(), conclusion: z6.string().nullable() })),
-  mergeable: z6.boolean().nullable(),
-  requiredRole: z6.enum(["approver", "operator"]),
-  canMerge: z6.boolean(),
+  checkRuns: z7.array(z7.object({ name: z7.string(), conclusion: z7.string().nullable() })),
+  mergeable: z7.boolean().nullable(),
+  requiredRole: z7.enum(["approver", "operator"]),
+  canMerge: z7.boolean(),
   /** Each thing standing between the PR and its merge, in the user's language. */
-  blockers: z6.array(z6.string()),
-  labels: z6.array(z6.string()).default([]),
+  blockers: z7.array(z7.string()),
+  labels: z7.array(z7.string()).default([]),
   /** D52: the first schemas.ts of a new feature failed the gates twice — the operator has the hand (label needs-operator). */
-  needsOperator: z6.boolean().default(false)
+  needsOperator: z7.boolean().default(false)
 });
-var SpecPullRequestsSchema = z6.object({
-  pullRequests: z6.array(z6.object({ specId: FeatureNameSchema, number: z6.number().int().positive(), url: z6.string(), checks: ChecksStateSchema, needsOperator: z6.boolean().default(false) }))
+var SpecPullRequestsSchema = z7.object({
+  pullRequests: z7.array(z7.object({ specId: FeatureNameSchema, number: z7.number().int().positive(), url: z7.string(), checks: ChecksStateSchema, needsOperator: z7.boolean().default(false) }))
 });
-var MergeOutputSchema = z6.object({
+var MergeOutputSchema = z7.object({
   specId: FeatureNameSchema,
-  pullRequestNumber: z6.number().int().positive(),
-  mergeSha: z6.string(),
-  mergedBy: z6.string(),
-  mergedAt: z6.string()
+  pullRequestNumber: z7.number().int().positive(),
+  mergeSha: z7.string(),
+  mergedBy: z7.string(),
+  mergedAt: z7.string()
 });
-var EnvironmentNameSchema = z6.enum(["development", "staging", "production"]);
-var PromotableEnvironmentSchema = z6.enum(["staging", "production"]);
-var EnvironmentParamsSchema = z6.object({ environment: PromotableEnvironmentSchema });
-var EnvironmentsStatusSchema = z6.object({
-  environments: z6.array(
-    z6.object({
+var EnvironmentNameSchema = z7.enum(["development", "staging", "production"]);
+var PromotableEnvironmentSchema = z7.enum(["staging", "production"]);
+var EnvironmentParamsSchema = z7.object({ environment: PromotableEnvironmentSchema });
+var EnvironmentsStatusSchema = z7.object({
+  environments: z7.array(
+    z7.object({
       name: EnvironmentNameSchema,
-      ref: z6.string(),
-      sha: z6.string().nullable(),
-      deployment: z6.object({ id: z6.number().int(), state: z6.string().nullable(), createdAt: z6.string() }).nullable()
+      ref: z7.string(),
+      sha: z7.string().nullable(),
+      deployment: z7.object({ id: z7.number().int(), state: z7.string().nullable(), createdAt: z7.string() }).nullable()
     })
   ),
   /** release/<date>.<n>, most recent first. */
-  releases: z6.array(z6.string())
+  releases: z7.array(z7.string())
 });
-var PromotionInputSchema = z6.object({
-  sha: z6.string().regex(/^[0-9a-f]{40}$/),
+var EnvironmentReadParamsSchema = z7.object({ environment: EnvironmentNameSchema });
+var CommitReachSchema = z7.enum(["deployed", "forward", "backward", "unreachable"]);
+var EnvironmentCommitSchema = z7.object({
+  sha: z7.string(),
+  /** The first line of the message without its `spec: merge` prefix and its `(#n)` suffix. */
+  title: z7.string(),
+  specId: FeatureNameSchema.nullable(),
+  author: z7.string(),
+  authoredAt: z7.string(),
+  releaseTag: z7.string().nullable(),
+  reach: CommitReachSchema,
+  /** The reason, in the client's language. */
+  why: z7.string()
+});
+var EnvironmentCommitsSchema = z7.object({
+  environment: EnvironmentNameSchema,
+  ref: z7.string(),
+  deployedSha: z7.string().nullable(),
+  commits: z7.array(EnvironmentCommitSchema).max(30)
+});
+var PromotionInputSchema = z7.object({
+  sha: z7.string().regex(/^[0-9a-f]{40}$/),
   /** Operator only: a step back, forced, with its reason. */
-  rollback: z6.boolean().optional(),
-  reason: z6.string().min(10).max(2e3).optional()
+  rollback: z7.boolean().optional(),
+  reason: z7.string().min(10).max(2e3).optional()
 });
-var PromotionRecordSchema = z6.object({
+var PromotionRecordSchema = z7.object({
   environment: PromotableEnvironmentSchema,
-  fromSha: z6.string().nullable(),
-  toSha: z6.string(),
-  actor: z6.string(),
-  at: z6.string(),
-  deploymentId: z6.number().int(),
-  releaseTag: z6.string().nullable(),
-  includedPullRequests: z6.array(z6.object({ number: z6.number().int(), specId: z6.string().nullable(), message: z6.string(), authoredAt: z6.string() })),
-  destructiveMigration: z6.boolean(),
-  rollback: z6.boolean()
+  fromSha: z7.string().nullable(),
+  toSha: z7.string(),
+  actor: z7.string(),
+  at: z7.string(),
+  deploymentId: z7.number().int(),
+  releaseTag: z7.string().nullable(),
+  includedPullRequests: z7.array(z7.object({ number: z7.number().int(), specId: z7.string().nullable(), message: z7.string(), authoredAt: z7.string() })),
+  destructiveMigration: z7.boolean(),
+  rollback: z7.boolean()
 });
-var ConsumptionQuerySchema = z6.object({ month: z6.string().regex(/^\d{4}-\d{2}$/).optional() });
-var ConsumptionReportSchema = z6.object({
-  month: z6.string(),
-  specs: z6.array(
-    z6.object({
-      specId: z6.string(),
-      pullRequestNumber: z6.number().int(),
-      runs: z6.number().int(),
-      inputTokens: z6.number().int(),
-      outputTokens: z6.number().int(),
-      estimatedUsd: z6.number(),
-      uncostedModels: z6.array(z6.string())
+var ConsumptionQuerySchema = z7.object({ month: z7.string().regex(/^\d{4}-\d{2}$/).optional() });
+var ConsumptionReportSchema = z7.object({
+  month: z7.string(),
+  specs: z7.array(
+    z7.object({
+      specId: z7.string(),
+      pullRequestNumber: z7.number().int(),
+      runs: z7.number().int(),
+      inputTokens: z7.number().int(),
+      outputTokens: z7.number().int(),
+      estimatedUsd: z7.number(),
+      uncostedModels: z7.array(z7.string())
     })
   ),
-  totals: z6.object({ runs: z6.number().int(), inputTokens: z6.number().int(), outputTokens: z6.number().int(), estimatedUsd: z6.number() }),
-  budgetUsd: z6.number().nullable(),
-  budgetRatio: z6.number().nullable(),
-  warning: z6.boolean()
+  totals: z7.object({ runs: z7.number().int(), inputTokens: z7.number().int(), outputTokens: z7.number().int(), estimatedUsd: z7.number() }),
+  budgetUsd: z7.number().nullable(),
+  budgetRatio: z7.number().nullable(),
+  warning: z7.boolean()
 });
-var PreviewEntrySchema = z6.object({ state: z6.string(), path: z6.string(), sizeBytes: z6.number().int().nonnegative() });
-var PreviewsListSchema = z6.object({
+var PreviewEntrySchema = z7.object({ state: z7.string(), path: z7.string(), sizeBytes: z7.number().int().nonnegative() });
+var PreviewsListSchema = z7.object({
   specId: FeatureNameSchema,
   /** In the order of the states: empty, loading, nominal, error, then the rest — the pages of the composition the head declares, or of the root. */
-  previews: z6.array(PreviewEntrySchema),
+  previews: z7.array(PreviewEntrySchema),
   /** D53: the composition the spec at the head declares under `# Design`; null when the screen has one composition. */
-  composition: z6.string().nullable().default(null),
+  composition: z7.string().nullable().default(null),
   /** D53: every composition the branch rendered, `selected` for the head's. */
-  compositions: z6.array(z6.object({ name: z6.string(), selected: z6.boolean(), previews: z6.array(PreviewEntrySchema) })).default([])
+  compositions: z7.array(z7.object({ name: z7.string(), selected: z7.boolean(), previews: z7.array(PreviewEntrySchema) })).default([])
 });
-var SelectCompositionOutputSchema = z6.object({
+var SelectCompositionOutputSchema = z7.object({
   specId: FeatureNameSchema,
-  composition: z6.string(),
+  composition: z7.string(),
   /** The head already declared it: nothing was written. */
-  alreadySelected: z6.boolean()
+  alreadySelected: z7.boolean()
 });
 
 // src/server/routes.ts
@@ -1815,7 +2191,7 @@ async function registerStudioRoutes(app, resolver) {
 }
 
 // src/server/hosted/routes.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/server/hosted/auth.ts
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
@@ -1929,53 +2305,53 @@ function unauthenticated(cause) {
 }
 
 // src/server/hosted/config.ts
-import { z as z7 } from "zod";
-var HostRoleSchema = z7.enum(["reader", "author", "approver", "operator"]);
-var MergePolicySchema = z7.enum(["client", "operator"]);
-var HostUserSchema = z7.object({
-  email: z7.email(),
-  displayName: z7.string().min(1).max(120),
+import { z as z8 } from "zod";
+var HostRoleSchema = z8.enum(["reader", "author", "approver", "operator"]);
+var MergePolicySchema = z8.enum(["client", "operator"]);
+var HostUserSchema = z8.object({
+  email: z8.email(),
+  displayName: z8.string().min(1).max(120),
   role: HostRoleSchema
 });
-var HostConfigSchema = z7.object({
+var HostConfigSchema = z8.object({
   repo: GithubCoordinatesSchema,
-  githubApp: z7.object({
-    appId: z7.string().min(1),
-    installationId: z7.string().min(1),
-    privateKeyPath: z7.string().min(1)
+  githubApp: z8.object({
+    appId: z8.string().min(1),
+    installationId: z8.string().min(1),
+    privateKeyPath: z8.string().min(1)
   }),
-  users: z7.array(HostUserSchema).min(1),
+  users: z8.array(HostUserSchema).min(1),
   /** "operator" at onboarding: the agency keeps the merge until it hands it over (D48). */
   mergePolicy: MergePolicySchema.default("operator"),
-  writeRateLimit: z7.number().int().positive().default(20),
-  session: z7.object({
-    secretPath: z7.string().min(1),
-    ttlHours: z7.number().int().positive().max(168).default(24)
+  writeRateLimit: z8.number().int().positive().default(20),
+  session: z8.object({
+    secretPath: z8.string().min(1),
+    ttlHours: z8.number().int().positive().max(168).default(24)
   }),
-  mail: z7.object({
-    fromAddress: z7.email(),
+  mail: z8.object({
+    fromAddress: z8.email(),
     /** HTTP endpoint of the mail provider: POST JSON { from, to, subject, text }. */
-    providerUrl: z7.url(),
-    apiKeyPath: z7.string().min(1)
+    providerUrl: z8.url(),
+    apiKeyPath: z8.string().min(1)
   }),
   /** Base of the magic links — what the client's browser can reach. */
-  publicUrl: z7.url(),
+  publicUrl: z8.url(),
   /** Lot D (D49): the two promotable refs. Optional until that lot lands. */
-  environments: z7.object({
-    staging: z7.object({ ref: z7.literal("env/staging") }),
-    production: z7.object({ ref: z7.literal("env/production") })
+  environments: z8.object({
+    staging: z8.object({ ref: z8.literal("env/staging") }),
+    production: z8.object({ ref: z8.literal("env/production") })
   }).optional(),
   /**
    * The client's model workspace (D50). Present, the brief → spec route exists
    * and the launcher requires OGYGIE_MODEL_API_KEY; absent, the instance never
    * calls a model. `specModel` is the `spec` model of D24.
    */
-  model: z7.object({
-    specModel: z7.string().min(1).default("claude-fable-5-1"),
-    workspaceId: z7.string().min(1).optional(),
-    monthlyBudgetUsd: z7.number().positive().optional(),
+  model: z8.object({
+    specModel: z8.string().min(1).default("claude-fable-5-1"),
+    workspaceId: z8.string().min(1).optional(),
+    monthlyBudgetUsd: z8.number().positive().optional(),
     /** USD per million tokens, by model id — overrides the built-in table of the estimate (B8). */
-    costPerMillionUsd: z7.record(z7.string(), z7.object({ input: z7.number().nonnegative(), output: z7.number().nonnegative() })).optional()
+    costPerMillionUsd: z8.record(z8.string(), z8.object({ input: z8.number().nonnegative(), output: z8.number().nonnegative() })).optional()
   }).optional()
 });
 function parseHostConfig(raw, configPath) {
@@ -2003,13 +2379,13 @@ function hostedUserOf(request) {
   if (user === void 0) return unauthenticated("no session attached to this request");
   return user;
 }
-var MagicLinkInputSchema = z8.object({ email: z8.email() });
-var CallbackQuerySchema = z8.object({ token: z8.string().min(1) });
-var MeOutputSchema = z8.object({
-  email: z8.email(),
-  displayName: z8.string(),
+var MagicLinkInputSchema = z9.object({ email: z9.email() });
+var CallbackQuerySchema = z9.object({ token: z9.string().min(1) });
+var MeOutputSchema = z9.object({
+  email: z9.email(),
+  displayName: z9.string(),
   role: HostRoleSchema,
-  host: z8.object({ environments: z8.boolean(), mergePolicy: z8.enum(["client", "operator"]) })
+  host: z9.object({ environments: z9.boolean(), mergePolicy: z9.enum(["client", "operator"]) })
 });
 async function registerHostedRoutes(app, deps) {
   const sessions = {
@@ -2037,7 +2413,7 @@ async function registerHostedRoutes(app, deps) {
   route.route({
     method: "POST",
     url: "/api/auth/magic-link",
-    schema: { body: MagicLinkInputSchema, response: { 202: z8.object({ accepted: z8.literal(true) }) } },
+    schema: { body: MagicLinkInputSchema, response: { 202: z9.object({ accepted: z9.literal(true) }) } },
     handler: async (request, reply) => {
       const user = findHostUser(deps.config, request.body.email);
       if (user === null) {
@@ -2089,7 +2465,7 @@ ${link}
 }
 
 // src/server/hosted/brief-routes.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 
 // src/server/hosted/attachments.ts
 import { createHash } from "node:crypto";
@@ -2322,7 +2698,7 @@ ${attachments.map((piece) => `- ${piece.name} (${piece.format}, ${sizeOf(piece.b
 var attachmentDocumentsOf = (attachments) => attachments.flatMap((piece) => piece.kind === "pdf" ? [{ name: piece.name, data: piece.data }] : []);
 
 // src/server/hosted/brief.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 import { checkSpec, generationGrammarCard, readManifestGeneration } from "@ogygie/generate";
 var TEMPLATE_PATH2 = "specs/_TEMPLATE.spec.md";
 var PRODUCT_RULES_PATH = "AGENTS.product.md";
@@ -2342,10 +2718,10 @@ var NO_MORE_QUESTIONS = "no more questions: write the draft now, and put what yo
 async function readIfPresent(storage, path) {
   return await storage.exists(path) ? storage.readFile(path) : null;
 }
-var ManifestRouteSchema = z9.looseObject({ method: z9.string(), path: z9.string(), schemaInput: z9.string().optional(), schemaOutput: z9.string().optional(), invalidates: z9.array(z9.string()).optional() });
-var ManifestForPromptSchema = z9.looseObject({
-  product: z9.looseObject({ name: z9.string(), description: z9.string().optional() }).optional(),
-  features: z9.array(z9.looseObject({ name: z9.string(), intent: z9.string().optional(), status: z9.string().optional(), spec: z9.string().nullable().optional(), routes: z9.array(ManifestRouteSchema).optional() })).optional()
+var ManifestRouteSchema = z10.looseObject({ method: z10.string(), path: z10.string(), schemaInput: z10.string().optional(), schemaOutput: z10.string().optional(), invalidates: z10.array(z10.string()).optional() });
+var ManifestForPromptSchema = z10.looseObject({
+  product: z10.looseObject({ name: z10.string(), description: z10.string().optional() }).optional(),
+  features: z10.array(z10.looseObject({ name: z10.string(), intent: z10.string().optional(), status: z10.string().optional(), spec: z10.string().nullable().optional(), routes: z10.array(ManifestRouteSchema).optional() })).optional()
 });
 async function manifestSummary(storage) {
   const raw = await readIfPresent(storage, MANIFEST_PATH2);
@@ -2412,8 +2788,8 @@ function extractQuestions(text) {
   } catch {
     return { problem: "QUESTIONS: the JSON after the marker does not parse" };
   }
-  const shape = z9.object({
-    questions: z9.array(z9.object({ id: FeatureNameSchema, text: z9.string().trim().min(1), options: z9.array(z9.string().trim().min(1)).min(2).max(4) })).min(3).max(5)
+  const shape = z10.object({
+    questions: z10.array(z10.object({ id: FeatureNameSchema, text: z10.string().trim().min(1), options: z10.array(z10.string().trim().min(1)).min(2).max(4) })).min(3).max(5)
   });
   const checked = shape.safeParse(parsed);
   if (!checked.success) return { problem: `QUESTIONS: ${checked.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join(" ; ")}` };
@@ -2866,7 +3242,7 @@ async function registerBriefRoutes(app, deps) {
   route.route({
     method: "GET",
     url: "/api/briefs/:jobId",
-    schema: { params: z10.object({ jobId: z10.string().min(1) }), response: { 200: BriefJobSchema } },
+    schema: { params: z11.object({ jobId: z11.string().min(1) }), response: { 200: BriefJobSchema } },
     handler: async (request, reply) => {
       hostedUserOf(request);
       return reply.code(200).send(jobs.read(request.params.jobId));
@@ -2874,6 +3250,57 @@ async function registerBriefRoutes(app, deps) {
   });
 }
 
+// src/server/hosted/impact.ts
+var MANIFEST_PATH3 = "ogygie.manifest.json";
+async function specImpact(reader, ref, specId) {
+  if (!await reader.exists(MANIFEST_PATH3)) {
+    throwOgygieError({
+      code: "MANIFEST_INVALID",
+      message: `No ${MANIFEST_PATH3} on ${ref}: the impact cannot be read.`,
+      file: MANIFEST_PATH3,
+      cause: `missing on ${ref}`,
+      suggestedFix: "Restore the manifest on the branch; the impact reads the map first."
+    });
+  }
+  const parsed = OgygieManifestSchema.safeParse(JSON.parse(await reader.readFile(MANIFEST_PATH3)));
+  if (!parsed.success) {
+    return throwOgygieError(
+      {
+        code: "MANIFEST_INVALID",
+        message: `The manifest on ${ref} does not validate.`,
+        file: MANIFEST_PATH3,
+        cause: parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join(" ; "),
+        suggestedFix: "Fix the manifest on the branch (ogygie check names the field)."
+      },
+      422
+    );
+  }
+  const onMap = parsed.data.features.some((feature) => feature.name === specId);
+  if (!onMap) return { specId, ref, onMap: false, report: null };
+  const report = await analyzeImpact({ manifest: parsed.data, adapter: reader }, specId);
+  return { specId, ref, onMap: true, report };
+}
+
+// src/server/hosted/impact-routes.ts
+function knowsBranches(storage) {
+  return typeof storage.readerForSpec === "function";
+}
+async function registerImpactRoutes(app, deps) {
+  const route = app.withTypeProvider();
+  route.route({
+    method: "GET",
+    url: "/api/specs/:specId/impact",
+    schema: { params: SpecParamsSchema, response: { 200: SpecImpactSchema } },
+    handler: async (request, reply) => {
+      const user = hostedUserOf(request);
+      const storage = deps.storageFor(user);
+      const { specId } = request.params;
+      const located = knowsBranches(storage) ? await storage.readerForSpec(specId) : { reader: storage, ref: deps.defaultBranch };
+      return reply.code(200).send(await specImpact(located.reader, located.ref, specId));
+    }
+  });
+}
+
 // src/server/hosted/previews.ts
 var PREVIEWS_DIR = "previews";
 var STATE_NAME = /^[a-z][a-z0-9-]*$/;
@@ -2979,6 +3406,10 @@ function createHostedSpecStorage(deps) {
   }
   const storage = {
     lastProposal: null,
+    async readerForSpec(specId) {
+      const branch = specBranchOf(specId);
+      return (await branches()).has(branch) ? { reader: readerOfBranch(branch), ref: branch } : { reader: defaultReader, ref: deps.github.defaultBranch };
+    },
     async readFile(path) {
       return (await readerOf(path)).readFile(path);
     },
@@ -3237,6 +3668,48 @@ async function environmentsStatus(deps) {
     releases: releases.sort().reverse()
   };
 }
+var LINE_LENGTH = 30;
+function commitTitleOf(message) {
+  const firstLine = message.split("\n")[0] ?? "";
+  return firstLine.replace(/^spec: merge /u, "").replace(/\s*\(#\d+\)\s*$/u, "").trim();
+}
+function reachOf(environment, index, deployedIndex, stagingIndex) {
+  if (index === deployedIndex) return { reach: "deployed", why: "d\xE9ploy\xE9" };
+  if (environment === "development") return { reach: "unreachable", why: "le d\xE9veloppement suit la branche par d\xE9faut, il ne se promeut pas" };
+  const newer = deployedIndex === -1 || index < deployedIndex;
+  if (environment === "staging") {
+    return newer ? { reach: "forward", why: "avance rapide depuis le d\xE9veloppement" } : { reach: "backward", why: "retour arri\xE8re : op\xE9rateur, avec un motif" };
+  }
+  if (index === stagingIndex && newer) return { reach: "forward", why: "le commit de la pr\xE9production" };
+  if (newer) return { reach: "unreachable", why: stagingIndex !== -1 && index < stagingIndex ? "la pr\xE9production ne l'a pas re\xE7u (PROMOTION_ORDER_VIOLATED)" : "seul le commit de la pr\xE9production est promouvable" };
+  return { reach: "backward", why: "retour arri\xE8re : op\xE9rateur, avec un motif" };
+}
+async function environmentCommits(deps, environment) {
+  const ref = environment === "development" ? deps.defaultBranch : ENVIRONMENT_REFS[environment];
+  const [deployedSha, stagingSha, commits, tags] = await Promise.all([
+    deps.deploy.getRefSha(ref),
+    environment === "production" ? deps.deploy.getRefSha(ENVIRONMENT_REFS.staging) : Promise.resolve(null),
+    deps.deploy.listCommits(deps.defaultBranch, LINE_LENGTH),
+    deps.deploy.listReleaseTags("release/")
+  ]);
+  const tagOf = new Map(tags.map((tag) => [tag.sha, tag.name]));
+  const deployedIndex = commits.findIndex((commit) => commit.sha === deployedSha);
+  const stagingIndex = stagingSha === null ? -1 : commits.findIndex((commit) => commit.sha === stagingSha);
+  return {
+    environment,
+    ref,
+    deployedSha,
+    commits: commits.map((commit, index) => ({
+      sha: commit.sha,
+      title: commitTitleOf(commit.message),
+      specId: MERGED_SPEC.exec(commit.message.split("\n")[0] ?? "")?.[1] ?? null,
+      author: commit.author,
+      authoredAt: commit.authoredAt,
+      releaseTag: tagOf.get(commit.sha) ?? null,
+      ...reachOf(environment, index, deployedIndex, stagingIndex)
+    }))
+  };
+}
 function pullRequestsOf(commits) {
   const included = [];
   for (const commit of commits) {
@@ -3367,6 +3840,15 @@ async function registerPromotionRoutes(app, deps) {
       return reply.code(200).send(await environmentsStatus(promotionDeps));
     }
   });
+  route.route({
+    method: "GET",
+    url: "/api/environments/:environment/commits",
+    schema: { params: EnvironmentReadParamsSchema, response: { 200: EnvironmentCommitsSchema } },
+    handler: async (request, reply) => {
+      hostedUserOf(request);
+      return reply.code(200).send(await environmentCommits(promotionDeps, request.params.environment));
+    }
+  });
   route.route({
     method: "POST",
     url: "/api/environments/:environment/promotions",
@@ -3380,17 +3862,17 @@ async function registerPromotionRoutes(app, deps) {
 }
 
 // src/server/hosted/usage.ts
-import { z as z11 } from "zod";
-var UsageEntrySchema = z11.object({
-  at: z11.string(),
+import { z as z12 } from "zod";
+var UsageEntrySchema = z12.object({
+  at: z12.string(),
   /** brief → spec from the instance; `speculate` entries arrive with the generator's lot. */
-  action: z11.enum(["brief", "speculate"]),
-  attempt: z11.number().int().positive().optional(),
-  model: z11.string(),
-  inputTokens: z11.number().int().nonnegative(),
-  outputTokens: z11.number().int().nonnegative(),
-  actor: z11.string().optional(),
-  specId: z11.string().optional()
+  action: z12.enum(["brief", "speculate"]),
+  attempt: z12.number().int().positive().optional(),
+  model: z12.string(),
+  inputTokens: z12.number().int().nonnegative(),
+  outputTokens: z12.number().int().nonnegative(),
+  actor: z12.string().optional(),
+  specId: z12.string().optional()
 });
 var USAGE_MARKER = "<!-- ogygie-usage -->";
 var DEFAULT_MODEL_COSTS = {
@@ -3425,7 +3907,7 @@ function parseUsageComment(body) {
   const block = /```json\n([\s\S]*?)\n```/.exec(body)?.[1];
   if (block === void 0) return [];
   try {
-    const parsed = z11.array(UsageEntrySchema).safeParse(JSON.parse(block));
+    const parsed = z12.array(UsageEntrySchema).safeParse(JSON.parse(block));
     return parsed.success ? parsed.data : [];
   } catch {
     return [];
@@ -3500,9 +3982,9 @@ async function registerConsumptionRoutes(app, deps) {
 }
 
 // src/server/hosted/preview-routes.ts
-import { z as z12 } from "zod";
-var PreviewParamsSchema = SpecParamsSchema.extend({ state: z12.string().min(1).max(80) });
-var CompositionPreviewParamsSchema = PreviewParamsSchema.extend({ composition: z12.string().min(1).max(80) });
+import { z as z13 } from "zod";
+var PreviewParamsSchema = SpecParamsSchema.extend({ state: z13.string().min(1).max(80) });
+var CompositionPreviewParamsSchema = PreviewParamsSchema.extend({ composition: z13.string().min(1).max(80) });
 var PREVIEW_CSP = "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:";
 async function registerPreviewRoutes(app, deps) {
   const route = app.withTypeProvider();
@@ -3544,7 +4026,7 @@ async function registerPreviewRoutes(app, deps) {
 }
 
 // src/server/hosted/composition-routes.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // src/server/hosted/compositions.ts
 var COMPOSITION_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
@@ -3588,7 +4070,7 @@ La composition \xAB ${composition} \xBB est retenue parmi celles propos\xE9es ;
 }
 
 // src/server/hosted/composition-routes.ts
-var CompositionParamsSchema = SpecParamsSchema.extend({ composition: z13.string().min(1).max(80) });
+var CompositionParamsSchema = SpecParamsSchema.extend({ composition: z14.string().min(1).max(80) });
 async function registerCompositionRoutes(app, deps) {
   const route = app.withTypeProvider();
   route.route({
@@ -3644,6 +4126,7 @@ async function createStudioApp(options) {
     await registerHostedRoutes(app, hosted);
     await registerStudioRoutes(app, (request) => ({ storage: hosted.storageFor(hostedUserOf(request)) }));
     await registerPreviewRoutes(app, { storageFor: hosted.storageFor });
+    await registerImpactRoutes(app, { storageFor: hosted.storageFor, defaultBranch: hosted.config.repo.defaultBranch });
     if (hosted.writer !== void 0) {
       await registerBriefRoutes(app, { writer: hosted.writer, storageFor: hosted.storageFor, log: hosted.log, usage: hosted.usage, now: hosted.now });
     }
@@ -4082,6 +4565,29 @@ function createGithubDeployClient(deps) {
         commits: (answer?.commits ?? []).map((entry) => ({ sha: entry.sha, message: entry.commit.message, authoredAt: entry.commit.author.date }))
       };
     },
+    async listReleaseTags(prefix) {
+      const refs = await request("GET", `${repoUrl}/git/matching-refs/tags/${prefix}`, void 0) ?? [];
+      const tags = [];
+      for (const entry of refs) {
+        const name = entry.ref.replace(/^refs\/tags\//u, "");
+        if (entry.object.type !== "tag") {
+          tags.push({ name, sha: entry.object.sha });
+          continue;
+        }
+        const tag = await request("GET", `${repoUrl}/git/tags/${entry.object.sha}`, void 0, true);
+        if (tag !== null) tags.push({ name, sha: tag.object.sha });
+      }
+      return tags;
+    },
+    async listCommits(ref, perPage) {
+      const answer = await request(
+        "GET",
+        `${repoUrl}/commits?sha=${encodeURIComponent(ref)}&per_page=${Math.min(Math.max(perPage, 1), 100)}`,
+        void 0,
+        true
+      );
+      return (answer ?? []).map((entry) => ({ sha: entry.sha, message: entry.commit.message, authoredAt: entry.commit.author.date, author: entry.commit.author.name }));
+    },
     async updateRef(ref, sha, force) {
       await request("PATCH", `${repoUrl}/git/refs/heads/${encodeURIComponent(ref)}`, { sha, force });
     },