@ogygie/studio 0.29.2 → 0.31.0

package/dist/server.js

@@ -1397,12 +1397,22 @@ async function readParsedSpec(deps, specId) {
   }
   return parsed.spec;
 }
+async function generatedProductOf(deps) {
+  if (!await deps.storage.exists("ogygie.manifest.json")) return false;
+  try {
+    const raw = JSON.parse(await deps.storage.readFile("ogygie.manifest.json"));
+    return typeof raw === "object" && raw !== null && "generation" in raw && raw.generation !== null;
+  } catch {
+    return false;
+  }
+}
 async function getSpec(deps, specId) {
   const spec = await readParsedSpec(deps, specId);
   return {
     frontmatter: spec.frontmatter,
     body: spec.body,
-    presentSections: presentSectionsOf(spec.body)
+    presentSections: presentSectionsOf(spec.body),
+    generatedProduct: await generatedProductOf(deps)
   };
 }
 async function saveSpec(deps, specId, input) {
@@ -1931,7 +1941,9 @@ var GetSpecOutputSchema = z7.object({
   frontmatter: SpecFrontmatterSchema,
   /** Markdown body after the frontmatter block, byte-exact. */
   body: z7.string(),
-  presentSections: z7.array(z7.string())
+  presentSections: z7.array(z7.string()),
+  /** D58: the product's map declares a `generation` block — a spec without `# Génération` is then hand-written, nothing derives from it. */
+  generatedProduct: z7.boolean().default(false)
 });
 var UpdateSpecInputSchema = z7.object({
   frontmatter: SpecFrontmatterSchema,
@@ -2191,7 +2203,7 @@ async function registerStudioRoutes(app, resolver) {
 }
 
 // src/server/hosted/routes.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/server/hosted/auth.ts
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
@@ -2246,19 +2258,27 @@ function consumeMagicLink(deps, token) {
   deps.consumed.set(nonce, exp);
   return email;
 }
-function issueSession(deps, email) {
-  return seal({ kind: "session", email: email.toLowerCase(), exp: deps.now() + deps.ttlHours * 36e5 }, deps.secret);
+function issueSession(deps, user) {
+  return seal(
+    { kind: "session", email: user.email.toLowerCase(), displayName: user.displayName, role: user.role, via: user.via, exp: deps.now() + deps.ttlHours * 36e5 },
+    deps.secret
+  );
 }
+var ROLES = /* @__PURE__ */ new Set(["reader", "author", "approver", "operator"]);
+var VIAS = /* @__PURE__ */ new Set(["magic-link", "entra"]);
 function readSession(deps, cookieHeader) {
   const token = cookieValue(cookieHeader, SESSION_COOKIE);
   if (token === null) return null;
   const value = open(token, deps.secret);
   const email = value?.["email"];
+  const displayName = value?.["displayName"];
+  const role = value?.["role"];
+  const via = value?.["via"];
   const exp = value?.["exp"];
-  if (value?.["kind"] !== "session" || typeof email !== "string" || typeof exp !== "number" || exp <= deps.now()) {
+  if (value?.["kind"] !== "session" || typeof email !== "string" || typeof displayName !== "string" || typeof role !== "string" || !ROLES.has(role) || typeof via !== "string" || !VIAS.has(via) || typeof exp !== "number" || exp <= deps.now()) {
     return null;
   }
-  return email;
+  return { email, displayName, role, via };
 }
 function cookieValue(cookieHeader, name) {
   if (cookieHeader === void 0) return null;
@@ -2307,6 +2327,21 @@ function unauthenticated(cause) {
 // src/server/hosted/config.ts
 import { z as z8 } from "zod";
 var HostRoleSchema = z8.enum(["reader", "author", "approver", "operator"]);
+var HOST_ROLES = HostRoleSchema.options;
+var HostIdentitySchema = z8.object({
+  kind: z8.literal("entra"),
+  tenantId: z8.string().min(1),
+  clientId: z8.string().min(1),
+  clientSecretPath: z8.string().min(1),
+  /** Where the tenant writes the groups in the id token — a setting of the app registration. */
+  groupsClaim: z8.string().min(1).default("groups"),
+  roles: z8.object({
+    reader: z8.array(z8.string().min(1)).default([]),
+    author: z8.array(z8.string().min(1)).default([]),
+    approver: z8.array(z8.string().min(1)).default([]),
+    operator: z8.array(z8.string().min(1)).default([])
+  })
+});
 var MergePolicySchema = z8.enum(["client", "operator"]);
 var HostUserSchema = z8.object({
   email: z8.email(),
@@ -2320,7 +2355,9 @@ var HostConfigSchema = z8.object({
     installationId: z8.string().min(1),
     privateKeyPath: z8.string().min(1)
   }),
-  users: z8.array(HostUserSchema).min(1),
+  /** The addresses the magic link serves; optional once `identity` opens the door (D59). */
+  users: z8.array(HostUserSchema).default([]),
+  identity: HostIdentitySchema.optional(),
   /** "operator" at onboarding: the agency keeps the merge until it hands it over (D48). */
   mergePolicy: MergePolicySchema.default("operator"),
   writeRateLimit: z8.number().int().positive().default(20),
@@ -2353,6 +2390,9 @@ var HostConfigSchema = z8.object({
     /** USD per million tokens, by model id — overrides the built-in table of the estimate (B8). */
     costPerMillionUsd: z8.record(z8.string(), z8.object({ input: z8.number().nonnegative(), output: z8.number().nonnegative() })).optional()
   }).optional()
+}).refine((config) => config.users.length > 0 || config.identity !== void 0, {
+  path: ["users"],
+  message: "declare at least one user, or an identity block (D59): a host nobody can enter is a configuration error"
 });
 function parseHostConfig(raw, configPath) {
   const parsed = HostConfigSchema.safeParse(raw);
@@ -2372,20 +2412,190 @@ function findHostUser(config, email) {
   return config.users.find((user) => user.email.toLowerCase() === wanted) ?? null;
 }
 
+// src/server/hosted/entra.ts
+import { createHash, createPublicKey, randomBytes as randomBytes2, verify as verifySignature } from "node:crypto";
+import { z as z9 } from "zod";
+var OIDC_SCOPE = "openid profile email";
+var CLOCK_SKEW_SECONDS = 60;
+var FILE = "packages/ogygie-studio/src/server/hosted/entra.ts";
+var baseUrlOf = (config) => `https://login.microsoftonline.com/${config.tenantId}`;
+var issuerOf = (config) => `${baseUrlOf(config)}/v2.0`;
+var tokenEndpointOf = (config) => `${baseUrlOf(config)}/oauth2/v2.0/token`;
+var jwksEndpointOf = (config) => `${baseUrlOf(config)}/discovery/v2.0/keys`;
+function codeChallengeOf(codeVerifier) {
+  return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+function newHandshake() {
+  return { state: randomBytes2(16).toString("hex"), nonce: randomBytes2(16).toString("hex"), codeVerifier: randomBytes2(48).toString("base64url") };
+}
+function authorizationUrlOf(config, handshake) {
+  const url = new URL(`${baseUrlOf(config)}/oauth2/v2.0/authorize`);
+  url.searchParams.set("client_id", config.clientId);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("redirect_uri", config.callbackUrl);
+  url.searchParams.set("response_mode", "query");
+  url.searchParams.set("scope", OIDC_SCOPE);
+  url.searchParams.set("state", handshake.state);
+  url.searchParams.set("nonce", handshake.nonce);
+  url.searchParams.set("code_challenge", codeChallengeOf(handshake.codeVerifier));
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+function unauthenticated2(cause, suggestedFix) {
+  return throwOgygieError(
+    { code: "HOST_UNAUTHENTICATED", message: "The Microsoft sign-in did not establish an identity.", file: FILE, cause, suggestedFix },
+    401
+  );
+}
+var IdTokenClaimsSchema = z9.looseObject({
+  sub: z9.string().min(1),
+  iss: z9.string().min(1),
+  aud: z9.union([z9.string(), z9.array(z9.string())]),
+  exp: z9.number(),
+  nonce: z9.string().optional(),
+  email: z9.string().optional(),
+  preferred_username: z9.string().optional(),
+  upn: z9.string().optional(),
+  name: z9.string().optional()
+});
+var RsaSigningKeySchema = z9.object({ kid: z9.string().min(1), kty: z9.literal("RSA"), n: z9.string().min(1), e: z9.string().min(1) });
+var JwksSchema = z9.object({ keys: z9.array(z9.unknown()) });
+var TokenResponseSchema = z9.looseObject({ id_token: z9.string().min(1) });
+function decodeJwt(token) {
+  const [encodedHeader, encodedPayload, encodedSignature, ...rest] = token.split(".");
+  if (encodedHeader === void 0 || encodedPayload === void 0 || encodedSignature === void 0 || rest.length > 0) return null;
+  try {
+    const header = JSON.parse(Buffer.from(encodedHeader, "base64url").toString("utf8"));
+    if (typeof header !== "object" || header === null) return null;
+    const { alg, kid } = header;
+    return {
+      header: { ...typeof alg === "string" ? { alg } : {}, ...typeof kid === "string" ? { kid } : {} },
+      payload: JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8")),
+      signingInput: `${encodedHeader}.${encodedPayload}`,
+      signature: Buffer.from(encodedSignature, "base64url")
+    };
+  } catch {
+    return null;
+  }
+}
+function verifyIdToken(input) {
+  const decoded = decodeJwt(input.idToken);
+  if (decoded === null) return unauthenticated2("id token is not a readable JWT", "Retry the sign-in.");
+  if (decoded.header.alg !== "RS256") {
+    return unauthenticated2(`id token signed with alg=${decoded.header.alg ?? "none"}, only RS256 is accepted`, "Check the signing algorithm of the app registration (RS256).");
+  }
+  const candidates = input.keys.map((key) => RsaSigningKeySchema.safeParse(key)).flatMap((parsed) => parsed.success ? [parsed.data] : []).filter((key) => decoded.header.kid === void 0 || key.kid === decoded.header.kid);
+  if (candidates.length === 0) {
+    return unauthenticated2(`no published RSA key matches kid=${decoded.header.kid ?? "(absent)"}`, "Check that the id token comes from the configured tenant.");
+  }
+  const signed = candidates.some(
+    (key) => verifySignature("sha256", Buffer.from(decoded.signingInput, "utf8"), createPublicKey({ key: { kty: "RSA", n: key.n, e: key.e }, format: "jwk" }), decoded.signature)
+  );
+  if (!signed) return unauthenticated2("id token signature does not match the keys published by the tenant", "Retry the sign-in; if it persists, check the tenant of this host.");
+  const claims = IdTokenClaimsSchema.safeParse(decoded.payload);
+  if (!claims.success) return unauthenticated2("id token claims do not have the expected shape", "Check the app registration (openid scope, id token).");
+  const expectedIssuer = issuerOf(input.config);
+  if (claims.data.iss !== expectedIssuer) return unauthenticated2(`id token issued by ${claims.data.iss}, expected ${expectedIssuer}`, "Point identity.tenantId at the tenant that issues the token.");
+  const audiences = Array.isArray(claims.data.aud) ? claims.data.aud : [claims.data.aud];
+  if (!audiences.includes(input.config.clientId)) return unauthenticated2("id token was issued for another application", "Check identity.clientId against the app registration the sign-in used.");
+  if (claims.data.exp + CLOCK_SKEW_SECONDS < Math.floor(input.nowMs / 1e3)) return unauthenticated2("id token has expired", "Retry the sign-in.");
+  if (claims.data.nonce !== input.nonce) return unauthenticated2("id token nonce does not match the one this handshake sent", "Retry the sign-in from the start; a token cannot be replayed.");
+  return claims.data;
+}
+function groupsOfClaim(value) {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return [];
+  return value.filter((group) => typeof group === "string" && group.length > 0);
+}
+function identityOfClaims(claims, groupsClaim) {
+  const email = claims.email ?? claims.preferred_username ?? claims.upn;
+  if (email === void 0 || email === "") {
+    return unauthenticated2("the id token carries no email, preferred_username nor upn claim", "Add the optional email claim on the app registration.");
+  }
+  return { email: email.toLowerCase(), displayName: claims.name ?? email, groups: groupsOfClaim(claims[groupsClaim]) };
+}
+function roleOfGroups(groups, roles) {
+  let found = null;
+  for (const role of HOST_ROLES) if (roles[role].some((group) => group !== "" && groups.includes(group))) found = role;
+  return found;
+}
+function hostUserOfIdentity(identity, declared, roles) {
+  if (declared !== null) return { email: declared.email, displayName: declared.displayName, role: declared.role };
+  const role = roleOfGroups(identity.groups, roles);
+  if (role === null) {
+    return throwOgygieError(
+      {
+        code: "HOST_ACCESS_DENIED",
+        message: "This account is authenticated but not invited on this host.",
+        file: null,
+        cause: `${identity.email}: none of its ${identity.groups.length} group(s) is declared under identity.roles, and the address is not in users`,
+        suggestedFix: "Add the account to one of the directory groups the host declares (identity.roles), or declare its address in users."
+      },
+      403
+    );
+  }
+  return { email: identity.email, displayName: identity.displayName, role };
+}
+async function readJson(response, endpoint) {
+  if (!response.ok) return unauthenticated2(`${endpoint} answered ${response.status}`, "Retry the sign-in; if it persists, check the tenant, the client id and the client secret.");
+  try {
+    return await response.json();
+  } catch {
+    return unauthenticated2(`${endpoint} answered a body that is not JSON`, "Retry the sign-in.");
+  }
+}
+async function exchangeAuthorizationCode(deps, config, input) {
+  const endpoint = tokenEndpointOf(config);
+  const response = await deps.fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      code: input.code,
+      code_verifier: input.codeVerifier,
+      redirect_uri: config.callbackUrl
+    }).toString()
+  });
+  const parsed = TokenResponseSchema.safeParse(await readJson(response, endpoint));
+  if (!parsed.success) return unauthenticated2(`${endpoint} answered without an id_token`, "Check that the app registration requests the openid scope.");
+  return parsed.data.id_token;
+}
+async function fetchSigningKeys(deps, config) {
+  const endpoint = jwksEndpointOf(config);
+  const response = await deps.fetchImpl(endpoint, { method: "GET", headers: {} });
+  const parsed = JwksSchema.safeParse(await readJson(response, endpoint));
+  if (!parsed.success) return unauthenticated2(`${endpoint} answered a document that is not a JWKS`, "Check identity.tenantId \u2014 the JWKS of the tenant is what verifies the id token.");
+  return parsed.data.keys;
+}
+
 // src/server/hosted/routes.ts
+var OIDC_COOKIE = "ogygie_host_oidc";
+var OIDC_TTL_MS = 10 * 60 * 1e3;
+var oidcCookie = (value) => `${OIDC_COOKIE}=${encodeURIComponent(value)}; Path=/api/auth/entra; Max-Age=${OIDC_TTL_MS / 1e3}; HttpOnly; Secure; SameSite=Lax`;
+var clearedOidcCookie = () => `${OIDC_COOKIE}=; Path=/api/auth/entra; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
+function cookieOf(cookieHeader, name) {
+  if (cookieHeader === void 0) return null;
+  for (const part of cookieHeader.split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name) return decodeURIComponent(rest.join("="));
+  }
+  return null;
+}
 var usersByRequest = /* @__PURE__ */ new WeakMap();
 function hostedUserOf(request) {
   const user = usersByRequest.get(request);
   if (user === void 0) return unauthenticated("no session attached to this request");
   return user;
 }
-var MagicLinkInputSchema = z9.object({ email: z9.email() });
-var CallbackQuerySchema = z9.object({ token: z9.string().min(1) });
-var MeOutputSchema = z9.object({
-  email: z9.email(),
-  displayName: z9.string(),
+var MagicLinkInputSchema = z10.object({ email: z10.email() });
+var CallbackQuerySchema = z10.object({ token: z10.string().min(1) });
+var MeOutputSchema = z10.object({
+  email: z10.email(),
+  displayName: z10.string(),
   role: HostRoleSchema,
-  host: z9.object({ environments: z9.boolean(), mergePolicy: z9.enum(["client", "operator"]) })
+  host: z10.object({ environments: z10.boolean(), mergePolicy: z10.enum(["client", "operator"]) })
 });
 async function registerHostedRoutes(app, deps) {
   const sessions = {
@@ -2399,21 +2609,74 @@ async function registerHostedRoutes(app, deps) {
     consumed: deps.consumedLinks,
     ...deps.magicLinkTtlMs === void 0 ? {} : { ttlMs: deps.magicLinkTtlMs }
   };
-  const PUBLIC_ROUTES = /* @__PURE__ */ new Set(["/api/auth/magic-link", "/api/auth/callback", "/api/auth/logout"]);
+  const PUBLIC_ROUTES = /* @__PURE__ */ new Set(["/api/auth/options", "/api/auth/magic-link", "/api/auth/callback", "/api/auth/logout", "/api/auth/entra/start", "/api/auth/entra/callback"]);
   app.addHook("onRequest", async (request) => {
     const url = request.url.split("?")[0] ?? request.url;
     if (!url.startsWith("/api/") || PUBLIC_ROUTES.has(url)) return;
-    const email = readSession(sessions, request.headers.cookie);
-    if (email === null) return unauthenticated("missing or expired session cookie");
-    const user = findHostUser(deps.config, email);
-    if (user === null) return unauthenticated(`session for ${email}, no longer a declared user`);
-    usersByRequest.set(request, user);
+    const session = readSession(sessions, request.headers.cookie);
+    if (session === null) return unauthenticated("missing or expired session cookie");
+    if (session.via === "magic-link") {
+      const declared = findHostUser(deps.config, session.email);
+      if (declared === null) return unauthenticated(`session for ${session.email}, no longer a declared user`);
+      usersByRequest.set(request, declared);
+      return;
+    }
+    usersByRequest.set(request, { email: session.email, displayName: session.displayName, role: session.role });
   });
   const route = app.withTypeProvider();
+  route.route({
+    method: "GET",
+    url: "/api/auth/options",
+    schema: { response: { 200: z10.object({ magicLink: z10.boolean(), entra: z10.boolean() }) } },
+    handler: async (_request, reply) => reply.code(200).send({ magicLink: deps.config.users.length > 0, entra: deps.entra !== void 0 })
+  });
+  if (deps.entra !== void 0) {
+    const entra = deps.entra;
+    route.route({
+      method: "GET",
+      url: "/api/auth/entra/start",
+      handler: async (_request, reply) => {
+        const handshake = newHandshake();
+        const state = seal({ kind: "oidc", ...handshake, exp: deps.now() + OIDC_TTL_MS }, deps.sessionSecret);
+        return reply.header("set-cookie", oidcCookie(state)).redirect(authorizationUrlOf(entra.config, handshake), 302);
+      }
+    });
+    route.route({
+      method: "GET",
+      url: "/api/auth/entra/callback",
+      schema: { querystring: z10.object({ code: z10.string().min(1).optional(), state: z10.string().min(1).optional(), error: z10.string().optional(), error_description: z10.string().optional() }) },
+      handler: async (request, reply) => {
+        const refused = (code, cause) => {
+          deps.log(JSON.stringify({ action: "sign-in", provider: "entra", outcome: code, cause }));
+          return reply.header("set-cookie", clearedOidcCookie()).redirect(`/login?error=${encodeURIComponent(code)}`, 302);
+        };
+        if (request.query.error !== void 0) return refused("HOST_UNAUTHENTICATED", `tenant answered ${request.query.error}: ${request.query.error_description ?? ""}`);
+        const sealed = cookieOf(request.headers.cookie, OIDC_COOKIE);
+        const handshake = sealed === null ? null : open(sealed, deps.sessionSecret);
+        const expected = { state: handshake?.["state"], nonce: handshake?.["nonce"], codeVerifier: handshake?.["codeVerifier"], exp: handshake?.["exp"] };
+        if (handshake?.["kind"] !== "oidc" || typeof expected.state !== "string" || typeof expected.nonce !== "string" || typeof expected.codeVerifier !== "string" || typeof expected.exp !== "number" || expected.exp <= deps.now()) {
+          return refused("HOST_UNAUTHENTICATED", "no live handshake cookie: the sign-in took more than ten minutes, or did not start here");
+        }
+        if (request.query.state !== expected.state || request.query.code === void 0) return refused("HOST_UNAUTHENTICATED", "state mismatch or no code");
+        try {
+          const idToken = await exchangeAuthorizationCode(entra, entra.config, { code: request.query.code, codeVerifier: expected.codeVerifier });
+          const keys = await fetchSigningKeys(entra, entra.config);
+          const claims = verifyIdToken({ idToken, keys, config: entra.config, nonce: expected.nonce, nowMs: deps.now() });
+          const identity = identityOfClaims(claims, entra.config.groupsClaim);
+          const user = hostUserOfIdentity(identity, findHostUser(deps.config, identity.email), entra.config.roles);
+          deps.log(JSON.stringify({ action: "sign-in", provider: "entra", actor: user.email, role: user.role, outcome: "ok" }));
+          return reply.header("set-cookie", [clearedOidcCookie(), sessionCookie(issueSession(sessions, { ...user, via: "entra" }), deps.config.session.ttlHours)]).redirect("/", 302);
+        } catch (thrown) {
+          if (thrown instanceof OgygieFailure) return refused(thrown.error.code, thrown.error.cause);
+          throw thrown;
+        }
+      }
+    });
+  }
   route.route({
     method: "POST",
     url: "/api/auth/magic-link",
-    schema: { body: MagicLinkInputSchema, response: { 202: z9.object({ accepted: z9.literal(true) }) } },
+    schema: { body: MagicLinkInputSchema, response: { 202: z10.object({ accepted: z10.literal(true) }) } },
     handler: async (request, reply) => {
       const user = findHostUser(deps.config, request.body.email);
       if (user === null) {
@@ -2443,8 +2706,8 @@ ${link}
       const email = consumeMagicLink(links, request.query.token);
       const user = findHostUser(deps.config, email);
       if (user === null) return unauthenticated(`link for ${email}, no longer a declared user`);
-      deps.log(JSON.stringify({ action: "sign-in", actor: user.email, outcome: "ok" }));
-      return reply.header("set-cookie", sessionCookie(issueSession(sessions, user.email), deps.config.session.ttlHours)).redirect("/", 302);
+      deps.log(JSON.stringify({ action: "sign-in", provider: "magic-link", actor: user.email, outcome: "ok" }));
+      return reply.header("set-cookie", sessionCookie(issueSession(sessions, { ...user, via: "magic-link" }), deps.config.session.ttlHours)).redirect("/", 302);
     }
   });
   route.route({
@@ -2465,10 +2728,10 @@ ${link}
 }
 
 // src/server/hosted/brief-routes.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/server/hosted/attachments.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { inflateRawSync } from "node:zlib";
 var ATTACHMENT_FORMATS = ["md", "txt", "csv", "json", "html", "xlsx", "pdf"];
 var MAX_ATTACHMENTS = 5;
@@ -2650,7 +2913,7 @@ function prepareBriefAttachments(raw) {
     if (buffer.length > MAX_ATTACHMENT_BYTES) return tooLarge(piece.name, `${buffer.length} bytes`, MAX_ATTACHMENT_BYTES, "bytes");
     totalBytes += buffer.length;
     if (totalBytes > MAX_ATTACHMENTS_BYTES) return tooLarge(piece.name, `${totalBytes} bytes in all`, MAX_ATTACHMENTS_BYTES, "bytes");
-    const identity = { name: piece.name, format, bytes: buffer.length, sha256: createHash("sha256").update(buffer).digest("hex") };
+    const identity = { name: piece.name, format, bytes: buffer.length, sha256: createHash2("sha256").update(buffer).digest("hex") };
     if (format === "pdf") {
       if (!isPdf(buffer)) unsupported(piece.name, "the content does not start like a PDF");
       prepared.push({ ...identity, kind: "pdf", data: buffer.toString("base64") });
@@ -2698,7 +2961,7 @@ ${attachments.map((piece) => `- ${piece.name} (${piece.format}, ${sizeOf(piece.b
 var attachmentDocumentsOf = (attachments) => attachments.flatMap((piece) => piece.kind === "pdf" ? [{ name: piece.name, data: piece.data }] : []);
 
 // src/server/hosted/brief.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 import { checkSpec, generationGrammarCard, readManifestGeneration } from "@ogygie/generate";
 var TEMPLATE_PATH2 = "specs/_TEMPLATE.spec.md";
 var PRODUCT_RULES_PATH = "AGENTS.product.md";
@@ -2715,13 +2978,18 @@ var BRIEF_IN_MESSAGE_MAX = 2e3;
 var MAX_QUESTION_ROUNDS = 3;
 var QUESTIONS_MARKER = /^\s*QUESTIONS\s*$/mu;
 var NO_MORE_QUESTIONS = "no more questions: write the draft now, and put what you do not know under # Hypoth\xE8ses";
+var UNGENERATED_ASKED = /sans\s+g[ée]n[ée]ration/iu;
+var BLOCK_REQUIRED = "this product is generated (D58): write the `# G\xE9n\xE9ration` block in the closed grammar of the card \u2014 a spec without it would be implemented by nobody; only a brief saying \xAB sans g\xE9n\xE9ration \xBB may omit it";
+function asksUngenerated(brief) {
+  return UNGENERATED_ASKED.test(brief);
+}
 async function readIfPresent(storage, path) {
   return await storage.exists(path) ? storage.readFile(path) : null;
 }
-var ManifestRouteSchema = z10.looseObject({ method: z10.string(), path: z10.string(), schemaInput: z10.string().optional(), schemaOutput: z10.string().optional(), invalidates: z10.array(z10.string()).optional() });
-var ManifestForPromptSchema = z10.looseObject({
-  product: z10.looseObject({ name: z10.string(), description: z10.string().optional() }).optional(),
-  features: z10.array(z10.looseObject({ name: z10.string(), intent: z10.string().optional(), status: z10.string().optional(), spec: z10.string().nullable().optional(), routes: z10.array(ManifestRouteSchema).optional() })).optional()
+var ManifestRouteSchema = z11.looseObject({ method: z11.string(), path: z11.string(), schemaInput: z11.string().optional(), schemaOutput: z11.string().optional(), invalidates: z11.array(z11.string()).optional() });
+var ManifestForPromptSchema = z11.looseObject({
+  product: z11.looseObject({ name: z11.string(), description: z11.string().optional() }).optional(),
+  features: z11.array(z11.looseObject({ name: z11.string(), intent: z11.string().optional(), status: z11.string().optional(), spec: z11.string().nullable().optional(), routes: z11.array(ManifestRouteSchema).optional() })).optional()
 });
 async function manifestSummary(storage) {
   const raw = await readIfPresent(storage, MANIFEST_PATH2);
@@ -2788,8 +3056,8 @@ function extractQuestions(text) {
   } catch {
     return { problem: "QUESTIONS: the JSON after the marker does not parse" };
   }
-  const shape = z10.object({
-    questions: z10.array(z10.object({ id: FeatureNameSchema, text: z10.string().trim().min(1), options: z10.array(z10.string().trim().min(1)).min(2).max(4) })).min(3).max(5)
+  const shape = z11.object({
+    questions: z11.array(z11.object({ id: FeatureNameSchema, text: z11.string().trim().min(1), options: z11.array(z11.string().trim().min(1)).min(2).max(4) })).min(3).max(5)
   });
   const checked = shape.safeParse(parsed);
   if (!checked.success) return { problem: `QUESTIONS: ${checked.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join(" ; ")}` };
@@ -2814,7 +3082,9 @@ function buildBriefPrompt(context) {
     "- Tu ne cites une d\xE9cision `D<n>` QUE si elle figure dans la liste des d\xE9cisions connues ci-dessous ; sinon n'en cite aucune.",
     "- Tu n'inventes ni table, ni route, ni feature existante : tu t'appuies sur la carte du produit ci-dessous ; une rubrique nouvelle nomme ses propres contrats.",
     "- Tu n'\xE9cris jamais de code ni de design (couleurs, composants) : la spec dit QUOI, jamais COMMENT. Le bloc YAML de `# G\xE9n\xE9ration` n'est pas du code : c'est la d\xE9claration que le g\xE9n\xE9rateur lit.",
-    ...context.grammarCard === null || context.grammarCard === void 0 ? [] : ["- Quand la rubrique apporte des op\xE9rations ou un \xE9cran que le g\xE9n\xE9rateur sait d\xE9river, \xE9cris la section `# G\xE9n\xE9ration` apr\xE8s `# @intent` et ses `# Comportements` dans la grammaire ferm\xE9e (carte ci-dessous) : le brouillon est jug\xE9 par le v\xE9rificateur du g\xE9n\xE9rateur avant d'\xEAtre montr\xE9. Quand elle ne se g\xE9n\xE8re pas, n'\xE9cris pas la section."],
+    ...context.grammarCard === null || context.grammarCard === void 0 ? [] : [
+      context.ungenerated === true ? "- Ce produit est g\xE9n\xE9r\xE9, mais le brief demande une rubrique SANS g\xE9n\xE9ration : n'\xE9cris pas la section `# G\xE9n\xE9ration`, cette spec sera impl\xE9ment\xE9e \xE0 la main." : "- Ce produit est G\xC9N\xC9R\xC9 (D58) : \xE9cris TOUJOURS la section `# G\xE9n\xE9ration` apr\xE8s `# @intent`, et ses `# Comportements` dans la grammaire ferm\xE9e (carte ci-dessous) ; le brouillon est jug\xE9 par le v\xE9rificateur du g\xE9n\xE9rateur avant d'\xEAtre montr\xE9, et un brouillon sans cette section est refus\xE9. Routes, base, tests et \xE9crans se d\xE9rivent du bloc ; ce qui se pense devient un trou typ\xE9."
+    ],
     "- Tu ne proposes jamais `status: validated` ni `implemented` : valider est le geste de l'humain.",
     "- HYPOTH\xC8SES : quand tu tranches un point que le brief ne dit pas (un nombre, un ordre, un p\xE9rim\xE8tre, un mot), ajoute apr\xE8s `# Budget` (et avant `# Design` si elle existe) une section `# Hypoth\xE8ses`, une puce par choix, en fran\xE7ais, courte ; sans hypoth\xE8se, pas de section.",
     '- QUESTIONS : quand la demande ci-dessous t\'y autorise et qu\'une r\xE9ponse du client CHANGERAIT la spec, tu peux, AU LIEU du fichier, r\xE9pondre par une ligne `QUESTIONS` seule puis un objet JSON `{"questions":[{"id":"kebab-case","text":"la question, en fran\xE7ais","options":["r\xE9ponse","r\xE9ponse"]}]}` \u2014 trois \xE0 cinq questions ferm\xE9es, deux \xE0 quatre options chacune, rien d\'autre avant ni apr\xE8s. Une question dont la r\xE9ponse ne changerait pas la spec ne se pose pas : elle devient une hypoth\xE8se.',
@@ -2966,6 +3236,8 @@ async function runBrief(deps, input) {
   const existingSpec = input.specId !== void 0 ? await readIfPresent(deps.storage, `specs/${input.specId}.spec.md`) : null;
   const isAmendment = existingSpec !== null;
   const round = Math.min(Math.max(input.round ?? 1, 1), MAX_QUESTION_ROUNDS + 1);
+  const ungeneratedAsked = asksUngenerated(input.brief);
+  const blockRequired = manifest.generation !== null && !ungeneratedAsked;
   const questionsAllowed = input.skipQuestions !== true && round <= MAX_QUESTION_ROUNDS;
   const prompt = buildBriefPrompt({
     template,
@@ -2979,7 +3251,8 @@ async function runBrief(deps, input) {
     brief: input.brief,
     attachments: input.attachments,
     answers: input.answers,
-    questions: { allowed: questionsAllowed, round }
+    questions: { allowed: questionsAllowed, round },
+    ungenerated: ungeneratedAsked
   });
   const usage = [];
   let refusedQuestions = false;
@@ -3021,7 +3294,8 @@ async function runBrief(deps, input) {
     });
     const generationJudgement = judged.problems.length === 0 && judged.specId !== null ? await judgeGeneration({ content, specPath: `specs/${judged.specId}.spec.md`, generation: manifest.generation, storage: deps.storage, features: manifest.features }) : { problems: [], tally: null };
     judged.problems.push(...generationJudgement.problems);
-    if (generationJudgement.tally !== null) maxAttempts = MAX_ATTEMPTS_GENERATED;
+    if (blockRequired && judged.problems.length === 0 && generationJudgement.tally === null) judged.problems.push(BLOCK_REQUIRED);
+    if (generationJudgement.tally !== null || blockRequired) maxAttempts = MAX_ATTEMPTS_GENERATED;
     deps.log(JSON.stringify({ action: "brief", attempt, specId: judged.specId, problems: judged.problems.length, generated: generationJudgement.tally !== null, ...answer.usage }));
     if (judged.problems.length === 0 && judged.specId !== null) {
       const specId = judged.specId;
@@ -3242,7 +3516,7 @@ async function registerBriefRoutes(app, deps) {
   route.route({
     method: "GET",
     url: "/api/briefs/:jobId",
-    schema: { params: z11.object({ jobId: z11.string().min(1) }), response: { 200: BriefJobSchema } },
+    schema: { params: z12.object({ jobId: z12.string().min(1) }), response: { 200: BriefJobSchema } },
     handler: async (request, reply) => {
       hostedUserOf(request);
       return reply.code(200).send(jobs.read(request.params.jobId));
@@ -3862,17 +4136,17 @@ async function registerPromotionRoutes(app, deps) {
 }
 
 // src/server/hosted/usage.ts
-import { z as z12 } from "zod";
-var UsageEntrySchema = z12.object({
-  at: z12.string(),
+import { z as z13 } from "zod";
+var UsageEntrySchema = z13.object({
+  at: z13.string(),
   /** brief → spec from the instance; `speculate` entries arrive with the generator's lot. */
-  action: z12.enum(["brief", "speculate"]),
-  attempt: z12.number().int().positive().optional(),
-  model: z12.string(),
-  inputTokens: z12.number().int().nonnegative(),
-  outputTokens: z12.number().int().nonnegative(),
-  actor: z12.string().optional(),
-  specId: z12.string().optional()
+  action: z13.enum(["brief", "speculate"]),
+  attempt: z13.number().int().positive().optional(),
+  model: z13.string(),
+  inputTokens: z13.number().int().nonnegative(),
+  outputTokens: z13.number().int().nonnegative(),
+  actor: z13.string().optional(),
+  specId: z13.string().optional()
 });
 var USAGE_MARKER = "<!-- ogygie-usage -->";
 var DEFAULT_MODEL_COSTS = {
@@ -3907,7 +4181,7 @@ function parseUsageComment(body) {
   const block = /```json\n([\s\S]*?)\n```/.exec(body)?.[1];
   if (block === void 0) return [];
   try {
-    const parsed = z12.array(UsageEntrySchema).safeParse(JSON.parse(block));
+    const parsed = z13.array(UsageEntrySchema).safeParse(JSON.parse(block));
     return parsed.success ? parsed.data : [];
   } catch {
     return [];
@@ -3982,9 +4256,9 @@ async function registerConsumptionRoutes(app, deps) {
 }
 
 // src/server/hosted/preview-routes.ts
-import { z as z13 } from "zod";
-var PreviewParamsSchema = SpecParamsSchema.extend({ state: z13.string().min(1).max(80) });
-var CompositionPreviewParamsSchema = PreviewParamsSchema.extend({ composition: z13.string().min(1).max(80) });
+import { z as z14 } from "zod";
+var PreviewParamsSchema = SpecParamsSchema.extend({ state: z14.string().min(1).max(80) });
+var CompositionPreviewParamsSchema = PreviewParamsSchema.extend({ composition: z14.string().min(1).max(80) });
 var PREVIEW_CSP = "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:";
 async function registerPreviewRoutes(app, deps) {
   const route = app.withTypeProvider();
@@ -4026,7 +4300,7 @@ async function registerPreviewRoutes(app, deps) {
 }
 
 // src/server/hosted/composition-routes.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // src/server/hosted/compositions.ts
 var COMPOSITION_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
@@ -4070,7 +4344,7 @@ La composition \xAB ${composition} \xBB est retenue parmi celles propos\xE9es ;
 }
 
 // src/server/hosted/composition-routes.ts
-var CompositionParamsSchema = SpecParamsSchema.extend({ composition: z14.string().min(1).max(80) });
+var CompositionParamsSchema = SpecParamsSchema.extend({ composition: z15.string().min(1).max(80) });
 async function registerCompositionRoutes(app, deps) {
   const route = app.withTypeProvider();
   route.route({
@@ -4803,6 +5077,7 @@ async function startHostedStudio(options) {
   const privateKeyPem = readSecret(config.githubApp.privateKeyPath, "the GitHub App private key");
   const sessionSecret = readSecret(config.session.secretPath, "the session secret", MIN_SESSION_SECRET_LENGTH);
   const mailApiKey = readSecret(config.mail.apiKeyPath, "the mail provider key");
+  const entraClientSecret = config.identity === void 0 ? void 0 : readSecret(config.identity.clientSecretPath, "the Entra client secret");
   const modelApiKey = config.model === void 0 ? void 0 : process.env["OGYGIE_MODEL_API_KEY"] ?? "";
   if (modelApiKey !== void 0 && modelApiKey.length === 0) {
     throwOgygieError({
@@ -4869,6 +5144,19 @@ async function startHostedStudio(options) {
       now,
       log,
       consumedLinks: /* @__PURE__ */ new Map(),
+      ...config.identity === void 0 || entraClientSecret === void 0 ? {} : {
+        entra: {
+          fetchImpl: fetch,
+          config: {
+            tenantId: config.identity.tenantId,
+            clientId: config.identity.clientId,
+            clientSecret: entraClientSecret,
+            callbackUrl: `${config.publicUrl.replace(/\/$/, "")}/api/auth/entra/callback`,
+            groupsClaim: config.identity.groupsClaim,
+            roles: config.identity.roles
+          }
+        }
+      },
       pulls: createGithubPullsClient({ github: config.repo, fetchImpl: githubApp.installationFetch }),
       readerFor,
       usage: createGithubUsageClient({ github: config.repo, fetchImpl: githubApp.installationFetch }),