@ogygie/studio 0.30.0 → 0.32.0

package/dist/server.js

@@ -1187,7 +1187,7 @@ ${deps.originOf(path)}`
 }
 
 // src/server/storage/local-adapter.ts
-import { mkdir, writeFile } from "node:fs/promises";
+import { mkdir, stat as stat2, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute as isAbsolute2, resolve as resolve2, sep as sep2 } from "node:path";
 function resolveInsideRoot2(rootDir, relativePath) {
   const root = resolve2(rootDir);
@@ -1214,6 +1214,14 @@ function createLocalSpecStorage(rootDir) {
       const absolute = resolveInsideRoot2(rootDir, path);
       await mkdir(dirname(absolute), { recursive: true });
       await writeFile(absolute, content, "utf8");
+    },
+    async modifiedAt(path) {
+      const absolute = resolveInsideRoot2(rootDir, path);
+      try {
+        return (await stat2(absolute)).mtime.toISOString();
+      } catch {
+        return null;
+      }
     }
   };
 }
@@ -1345,7 +1353,8 @@ function intentOf(body) {
   const sentence = /^.*?[.!?](?:\s|$)/u.exec(paragraph)?.[0]?.trim() ?? paragraph;
   return sentence.length > 160 ? `${sentence.slice(0, 157).trimEnd()}\u2026` : sentence;
 }
-function toReadableSummary(filePath, spec) {
+var modifiedAtOf = (deps, filePath) => deps.storage.modifiedAt?.(filePath) ?? Promise.resolve(null);
+function toReadableSummary(filePath, spec, updatedAt) {
   return {
     id: spec.frontmatter.id,
     status: spec.frontmatter.status,
@@ -1353,7 +1362,8 @@ function toReadableSummary(filePath, spec) {
     depends_on: spec.frontmatter.depends_on,
     filePath,
     presentSections: presentSectionsOf(spec.body),
-    intent: intentOf(spec.body)
+    intent: intentOf(spec.body),
+    updatedAt
   };
 }
 async function listSpecFileNames(deps) {
@@ -1369,7 +1379,7 @@ async function listSpecSummaries(deps) {
     const parsed = parseSpec(filePath, fileName, content);
     const id = fileName.replace(/\.spec\.md$/, "");
     summaries.push(
-      parsed.ok ? toReadableSummary(filePath, parsed.spec) : { id, filePath, error: parsed.error }
+      parsed.ok ? toReadableSummary(filePath, parsed.spec, await modifiedAtOf(deps, filePath)) : { id, filePath, error: parsed.error }
     );
   }
   return summaries;
@@ -1484,7 +1494,7 @@ ${serialized}
 ---${body}`;
   const message = isValidation ? `spec: validate ${specId}` : `spec: save ${specId}`;
   await deps.storage.write(filePath, content, message);
-  return toReadableSummary(filePath, { frontmatter: input.frontmatter, body });
+  return toReadableSummary(filePath, { frontmatter: input.frontmatter, body }, await modifiedAtOf(deps, filePath));
 }
 async function createSpec(deps, specId) {
   const fileName = `${specId}.spec.md`;
@@ -1526,7 +1536,7 @@ async function createSpec(deps, specId) {
       suggestedFix: "Fix the template's frontmatter to match SpecFrontmatterSchema."
     });
   }
-  return toReadableSummary(filePath, parsed.spec);
+  return toReadableSummary(filePath, parsed.spec, await modifiedAtOf(deps, filePath));
 }
 async function getManifest(deps) {
   const content = await deps.storage.readFile(MANIFEST_PATH);
@@ -1920,7 +1930,9 @@ var ReadableSpecSummarySchema = z7.object({
   filePath: z7.string(),
   presentSections: z7.array(z7.string()),
   /** The first sentence of `# @intent`, for a list that reads (v1.20: the target-spec suggestions of the brief). */
-  intent: z7.string().default("")
+  intent: z7.string().default(""),
+  /** When the spec last changed (ISO 8601) — the board's order, newest first (v3.4); null when the storage does not know. */
+  updatedAt: z7.string().nullable().default(null)
 });
 var UnreadableSpecSummarySchema = z7.object({
   id: z7.string(),
@@ -2203,7 +2215,7 @@ async function registerStudioRoutes(app, resolver) {
 }
 
 // src/server/hosted/routes.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/server/hosted/auth.ts
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
@@ -2258,19 +2270,27 @@ function consumeMagicLink(deps, token) {
   deps.consumed.set(nonce, exp);
   return email;
 }
-function issueSession(deps, email) {
-  return seal({ kind: "session", email: email.toLowerCase(), exp: deps.now() + deps.ttlHours * 36e5 }, deps.secret);
+function issueSession(deps, user) {
+  return seal(
+    { kind: "session", email: user.email.toLowerCase(), displayName: user.displayName, role: user.role, via: user.via, exp: deps.now() + deps.ttlHours * 36e5 },
+    deps.secret
+  );
 }
+var ROLES = /* @__PURE__ */ new Set(["reader", "author", "approver", "operator"]);
+var VIAS = /* @__PURE__ */ new Set(["magic-link", "entra"]);
 function readSession(deps, cookieHeader) {
   const token = cookieValue(cookieHeader, SESSION_COOKIE);
   if (token === null) return null;
   const value = open(token, deps.secret);
   const email = value?.["email"];
+  const displayName = value?.["displayName"];
+  const role = value?.["role"];
+  const via = value?.["via"];
   const exp = value?.["exp"];
-  if (value?.["kind"] !== "session" || typeof email !== "string" || typeof exp !== "number" || exp <= deps.now()) {
+  if (value?.["kind"] !== "session" || typeof email !== "string" || typeof displayName !== "string" || typeof role !== "string" || !ROLES.has(role) || typeof via !== "string" || !VIAS.has(via) || typeof exp !== "number" || exp <= deps.now()) {
     return null;
   }
-  return email;
+  return { email, displayName, role, via };
 }
 function cookieValue(cookieHeader, name) {
   if (cookieHeader === void 0) return null;
@@ -2319,6 +2339,21 @@ function unauthenticated(cause) {
 // src/server/hosted/config.ts
 import { z as z8 } from "zod";
 var HostRoleSchema = z8.enum(["reader", "author", "approver", "operator"]);
+var HOST_ROLES = HostRoleSchema.options;
+var HostIdentitySchema = z8.object({
+  kind: z8.literal("entra"),
+  tenantId: z8.string().min(1),
+  clientId: z8.string().min(1),
+  clientSecretPath: z8.string().min(1),
+  /** Where the tenant writes the groups in the id token — a setting of the app registration. */
+  groupsClaim: z8.string().min(1).default("groups"),
+  roles: z8.object({
+    reader: z8.array(z8.string().min(1)).default([]),
+    author: z8.array(z8.string().min(1)).default([]),
+    approver: z8.array(z8.string().min(1)).default([]),
+    operator: z8.array(z8.string().min(1)).default([])
+  })
+});
 var MergePolicySchema = z8.enum(["client", "operator"]);
 var HostUserSchema = z8.object({
   email: z8.email(),
@@ -2332,7 +2367,9 @@ var HostConfigSchema = z8.object({
     installationId: z8.string().min(1),
     privateKeyPath: z8.string().min(1)
   }),
-  users: z8.array(HostUserSchema).min(1),
+  /** The addresses the magic link serves; optional once `identity` opens the door (D59). */
+  users: z8.array(HostUserSchema).default([]),
+  identity: HostIdentitySchema.optional(),
   /** "operator" at onboarding: the agency keeps the merge until it hands it over (D48). */
   mergePolicy: MergePolicySchema.default("operator"),
   writeRateLimit: z8.number().int().positive().default(20),
@@ -2365,6 +2402,9 @@ var HostConfigSchema = z8.object({
     /** USD per million tokens, by model id — overrides the built-in table of the estimate (B8). */
     costPerMillionUsd: z8.record(z8.string(), z8.object({ input: z8.number().nonnegative(), output: z8.number().nonnegative() })).optional()
   }).optional()
+}).refine((config) => config.users.length > 0 || config.identity !== void 0, {
+  path: ["users"],
+  message: "declare at least one user, or an identity block (D59): a host nobody can enter is a configuration error"
 });
 function parseHostConfig(raw, configPath) {
   const parsed = HostConfigSchema.safeParse(raw);
@@ -2384,20 +2424,190 @@ function findHostUser(config, email) {
   return config.users.find((user) => user.email.toLowerCase() === wanted) ?? null;
 }
 
+// src/server/hosted/entra.ts
+import { createHash, createPublicKey, randomBytes as randomBytes2, verify as verifySignature } from "node:crypto";
+import { z as z9 } from "zod";
+var OIDC_SCOPE = "openid profile email";
+var CLOCK_SKEW_SECONDS = 60;
+var FILE = "packages/ogygie-studio/src/server/hosted/entra.ts";
+var baseUrlOf = (config) => `https://login.microsoftonline.com/${config.tenantId}`;
+var issuerOf = (config) => `${baseUrlOf(config)}/v2.0`;
+var tokenEndpointOf = (config) => `${baseUrlOf(config)}/oauth2/v2.0/token`;
+var jwksEndpointOf = (config) => `${baseUrlOf(config)}/discovery/v2.0/keys`;
+function codeChallengeOf(codeVerifier) {
+  return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+function newHandshake() {
+  return { state: randomBytes2(16).toString("hex"), nonce: randomBytes2(16).toString("hex"), codeVerifier: randomBytes2(48).toString("base64url") };
+}
+function authorizationUrlOf(config, handshake) {
+  const url = new URL(`${baseUrlOf(config)}/oauth2/v2.0/authorize`);
+  url.searchParams.set("client_id", config.clientId);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("redirect_uri", config.callbackUrl);
+  url.searchParams.set("response_mode", "query");
+  url.searchParams.set("scope", OIDC_SCOPE);
+  url.searchParams.set("state", handshake.state);
+  url.searchParams.set("nonce", handshake.nonce);
+  url.searchParams.set("code_challenge", codeChallengeOf(handshake.codeVerifier));
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+function unauthenticated2(cause, suggestedFix) {
+  return throwOgygieError(
+    { code: "HOST_UNAUTHENTICATED", message: "The Microsoft sign-in did not establish an identity.", file: FILE, cause, suggestedFix },
+    401
+  );
+}
+var IdTokenClaimsSchema = z9.looseObject({
+  sub: z9.string().min(1),
+  iss: z9.string().min(1),
+  aud: z9.union([z9.string(), z9.array(z9.string())]),
+  exp: z9.number(),
+  nonce: z9.string().optional(),
+  email: z9.string().optional(),
+  preferred_username: z9.string().optional(),
+  upn: z9.string().optional(),
+  name: z9.string().optional()
+});
+var RsaSigningKeySchema = z9.object({ kid: z9.string().min(1), kty: z9.literal("RSA"), n: z9.string().min(1), e: z9.string().min(1) });
+var JwksSchema = z9.object({ keys: z9.array(z9.unknown()) });
+var TokenResponseSchema = z9.looseObject({ id_token: z9.string().min(1) });
+function decodeJwt(token) {
+  const [encodedHeader, encodedPayload, encodedSignature, ...rest] = token.split(".");
+  if (encodedHeader === void 0 || encodedPayload === void 0 || encodedSignature === void 0 || rest.length > 0) return null;
+  try {
+    const header = JSON.parse(Buffer.from(encodedHeader, "base64url").toString("utf8"));
+    if (typeof header !== "object" || header === null) return null;
+    const { alg, kid } = header;
+    return {
+      header: { ...typeof alg === "string" ? { alg } : {}, ...typeof kid === "string" ? { kid } : {} },
+      payload: JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8")),
+      signingInput: `${encodedHeader}.${encodedPayload}`,
+      signature: Buffer.from(encodedSignature, "base64url")
+    };
+  } catch {
+    return null;
+  }
+}
+function verifyIdToken(input) {
+  const decoded = decodeJwt(input.idToken);
+  if (decoded === null) return unauthenticated2("id token is not a readable JWT", "Retry the sign-in.");
+  if (decoded.header.alg !== "RS256") {
+    return unauthenticated2(`id token signed with alg=${decoded.header.alg ?? "none"}, only RS256 is accepted`, "Check the signing algorithm of the app registration (RS256).");
+  }
+  const candidates = input.keys.map((key) => RsaSigningKeySchema.safeParse(key)).flatMap((parsed) => parsed.success ? [parsed.data] : []).filter((key) => decoded.header.kid === void 0 || key.kid === decoded.header.kid);
+  if (candidates.length === 0) {
+    return unauthenticated2(`no published RSA key matches kid=${decoded.header.kid ?? "(absent)"}`, "Check that the id token comes from the configured tenant.");
+  }
+  const signed = candidates.some(
+    (key) => verifySignature("sha256", Buffer.from(decoded.signingInput, "utf8"), createPublicKey({ key: { kty: "RSA", n: key.n, e: key.e }, format: "jwk" }), decoded.signature)
+  );
+  if (!signed) return unauthenticated2("id token signature does not match the keys published by the tenant", "Retry the sign-in; if it persists, check the tenant of this host.");
+  const claims = IdTokenClaimsSchema.safeParse(decoded.payload);
+  if (!claims.success) return unauthenticated2("id token claims do not have the expected shape", "Check the app registration (openid scope, id token).");
+  const expectedIssuer = issuerOf(input.config);
+  if (claims.data.iss !== expectedIssuer) return unauthenticated2(`id token issued by ${claims.data.iss}, expected ${expectedIssuer}`, "Point identity.tenantId at the tenant that issues the token.");
+  const audiences = Array.isArray(claims.data.aud) ? claims.data.aud : [claims.data.aud];
+  if (!audiences.includes(input.config.clientId)) return unauthenticated2("id token was issued for another application", "Check identity.clientId against the app registration the sign-in used.");
+  if (claims.data.exp + CLOCK_SKEW_SECONDS < Math.floor(input.nowMs / 1e3)) return unauthenticated2("id token has expired", "Retry the sign-in.");
+  if (claims.data.nonce !== input.nonce) return unauthenticated2("id token nonce does not match the one this handshake sent", "Retry the sign-in from the start; a token cannot be replayed.");
+  return claims.data;
+}
+function groupsOfClaim(value) {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return [];
+  return value.filter((group) => typeof group === "string" && group.length > 0);
+}
+function identityOfClaims(claims, groupsClaim) {
+  const email = claims.email ?? claims.preferred_username ?? claims.upn;
+  if (email === void 0 || email === "") {
+    return unauthenticated2("the id token carries no email, preferred_username nor upn claim", "Add the optional email claim on the app registration.");
+  }
+  return { email: email.toLowerCase(), displayName: claims.name ?? email, groups: groupsOfClaim(claims[groupsClaim]) };
+}
+function roleOfGroups(groups, roles) {
+  let found = null;
+  for (const role of HOST_ROLES) if (roles[role].some((group) => group !== "" && groups.includes(group))) found = role;
+  return found;
+}
+function hostUserOfIdentity(identity, declared, roles) {
+  if (declared !== null) return { email: declared.email, displayName: declared.displayName, role: declared.role };
+  const role = roleOfGroups(identity.groups, roles);
+  if (role === null) {
+    return throwOgygieError(
+      {
+        code: "HOST_ACCESS_DENIED",
+        message: "This account is authenticated but not invited on this host.",
+        file: null,
+        cause: `${identity.email}: none of its ${identity.groups.length} group(s) is declared under identity.roles, and the address is not in users`,
+        suggestedFix: "Add the account to one of the directory groups the host declares (identity.roles), or declare its address in users."
+      },
+      403
+    );
+  }
+  return { email: identity.email, displayName: identity.displayName, role };
+}
+async function readJson(response, endpoint) {
+  if (!response.ok) return unauthenticated2(`${endpoint} answered ${response.status}`, "Retry the sign-in; if it persists, check the tenant, the client id and the client secret.");
+  try {
+    return await response.json();
+  } catch {
+    return unauthenticated2(`${endpoint} answered a body that is not JSON`, "Retry the sign-in.");
+  }
+}
+async function exchangeAuthorizationCode(deps, config, input) {
+  const endpoint = tokenEndpointOf(config);
+  const response = await deps.fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      code: input.code,
+      code_verifier: input.codeVerifier,
+      redirect_uri: config.callbackUrl
+    }).toString()
+  });
+  const parsed = TokenResponseSchema.safeParse(await readJson(response, endpoint));
+  if (!parsed.success) return unauthenticated2(`${endpoint} answered without an id_token`, "Check that the app registration requests the openid scope.");
+  return parsed.data.id_token;
+}
+async function fetchSigningKeys(deps, config) {
+  const endpoint = jwksEndpointOf(config);
+  const response = await deps.fetchImpl(endpoint, { method: "GET", headers: {} });
+  const parsed = JwksSchema.safeParse(await readJson(response, endpoint));
+  if (!parsed.success) return unauthenticated2(`${endpoint} answered a document that is not a JWKS`, "Check identity.tenantId \u2014 the JWKS of the tenant is what verifies the id token.");
+  return parsed.data.keys;
+}
+
 // src/server/hosted/routes.ts
+var OIDC_COOKIE = "ogygie_host_oidc";
+var OIDC_TTL_MS = 10 * 60 * 1e3;
+var oidcCookie = (value) => `${OIDC_COOKIE}=${encodeURIComponent(value)}; Path=/api/auth/entra; Max-Age=${OIDC_TTL_MS / 1e3}; HttpOnly; Secure; SameSite=Lax`;
+var clearedOidcCookie = () => `${OIDC_COOKIE}=; Path=/api/auth/entra; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
+function cookieOf(cookieHeader, name) {
+  if (cookieHeader === void 0) return null;
+  for (const part of cookieHeader.split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name) return decodeURIComponent(rest.join("="));
+  }
+  return null;
+}
 var usersByRequest = /* @__PURE__ */ new WeakMap();
 function hostedUserOf(request) {
   const user = usersByRequest.get(request);
   if (user === void 0) return unauthenticated("no session attached to this request");
   return user;
 }
-var MagicLinkInputSchema = z9.object({ email: z9.email() });
-var CallbackQuerySchema = z9.object({ token: z9.string().min(1) });
-var MeOutputSchema = z9.object({
-  email: z9.email(),
-  displayName: z9.string(),
+var MagicLinkInputSchema = z10.object({ email: z10.email() });
+var CallbackQuerySchema = z10.object({ token: z10.string().min(1) });
+var MeOutputSchema = z10.object({
+  email: z10.email(),
+  displayName: z10.string(),
   role: HostRoleSchema,
-  host: z9.object({ environments: z9.boolean(), mergePolicy: z9.enum(["client", "operator"]) })
+  host: z10.object({ environments: z10.boolean(), mergePolicy: z10.enum(["client", "operator"]) })
 });
 async function registerHostedRoutes(app, deps) {
   const sessions = {
@@ -2411,21 +2621,74 @@ async function registerHostedRoutes(app, deps) {
     consumed: deps.consumedLinks,
     ...deps.magicLinkTtlMs === void 0 ? {} : { ttlMs: deps.magicLinkTtlMs }
   };
-  const PUBLIC_ROUTES = /* @__PURE__ */ new Set(["/api/auth/magic-link", "/api/auth/callback", "/api/auth/logout"]);
+  const PUBLIC_ROUTES = /* @__PURE__ */ new Set(["/api/auth/options", "/api/auth/magic-link", "/api/auth/callback", "/api/auth/logout", "/api/auth/entra/start", "/api/auth/entra/callback"]);
   app.addHook("onRequest", async (request) => {
     const url = request.url.split("?")[0] ?? request.url;
     if (!url.startsWith("/api/") || PUBLIC_ROUTES.has(url)) return;
-    const email = readSession(sessions, request.headers.cookie);
-    if (email === null) return unauthenticated("missing or expired session cookie");
-    const user = findHostUser(deps.config, email);
-    if (user === null) return unauthenticated(`session for ${email}, no longer a declared user`);
-    usersByRequest.set(request, user);
+    const session = readSession(sessions, request.headers.cookie);
+    if (session === null) return unauthenticated("missing or expired session cookie");
+    if (session.via === "magic-link") {
+      const declared = findHostUser(deps.config, session.email);
+      if (declared === null) return unauthenticated(`session for ${session.email}, no longer a declared user`);
+      usersByRequest.set(request, declared);
+      return;
+    }
+    usersByRequest.set(request, { email: session.email, displayName: session.displayName, role: session.role });
   });
   const route = app.withTypeProvider();
+  route.route({
+    method: "GET",
+    url: "/api/auth/options",
+    schema: { response: { 200: z10.object({ magicLink: z10.boolean(), entra: z10.boolean() }) } },
+    handler: async (_request, reply) => reply.code(200).send({ magicLink: deps.config.users.length > 0, entra: deps.entra !== void 0 })
+  });
+  if (deps.entra !== void 0) {
+    const entra = deps.entra;
+    route.route({
+      method: "GET",
+      url: "/api/auth/entra/start",
+      handler: async (_request, reply) => {
+        const handshake = newHandshake();
+        const state = seal({ kind: "oidc", ...handshake, exp: deps.now() + OIDC_TTL_MS }, deps.sessionSecret);
+        return reply.header("set-cookie", oidcCookie(state)).redirect(authorizationUrlOf(entra.config, handshake), 302);
+      }
+    });
+    route.route({
+      method: "GET",
+      url: "/api/auth/entra/callback",
+      schema: { querystring: z10.object({ code: z10.string().min(1).optional(), state: z10.string().min(1).optional(), error: z10.string().optional(), error_description: z10.string().optional() }) },
+      handler: async (request, reply) => {
+        const refused = (code, cause) => {
+          deps.log(JSON.stringify({ action: "sign-in", provider: "entra", outcome: code, cause }));
+          return reply.header("set-cookie", clearedOidcCookie()).redirect(`/login?error=${encodeURIComponent(code)}`, 302);
+        };
+        if (request.query.error !== void 0) return refused("HOST_UNAUTHENTICATED", `tenant answered ${request.query.error}: ${request.query.error_description ?? ""}`);
+        const sealed = cookieOf(request.headers.cookie, OIDC_COOKIE);
+        const handshake = sealed === null ? null : open(sealed, deps.sessionSecret);
+        const expected = { state: handshake?.["state"], nonce: handshake?.["nonce"], codeVerifier: handshake?.["codeVerifier"], exp: handshake?.["exp"] };
+        if (handshake?.["kind"] !== "oidc" || typeof expected.state !== "string" || typeof expected.nonce !== "string" || typeof expected.codeVerifier !== "string" || typeof expected.exp !== "number" || expected.exp <= deps.now()) {
+          return refused("HOST_UNAUTHENTICATED", "no live handshake cookie: the sign-in took more than ten minutes, or did not start here");
+        }
+        if (request.query.state !== expected.state || request.query.code === void 0) return refused("HOST_UNAUTHENTICATED", "state mismatch or no code");
+        try {
+          const idToken = await exchangeAuthorizationCode(entra, entra.config, { code: request.query.code, codeVerifier: expected.codeVerifier });
+          const keys = await fetchSigningKeys(entra, entra.config);
+          const claims = verifyIdToken({ idToken, keys, config: entra.config, nonce: expected.nonce, nowMs: deps.now() });
+          const identity = identityOfClaims(claims, entra.config.groupsClaim);
+          const user = hostUserOfIdentity(identity, findHostUser(deps.config, identity.email), entra.config.roles);
+          deps.log(JSON.stringify({ action: "sign-in", provider: "entra", actor: user.email, role: user.role, outcome: "ok" }));
+          return reply.header("set-cookie", [clearedOidcCookie(), sessionCookie(issueSession(sessions, { ...user, via: "entra" }), deps.config.session.ttlHours)]).redirect("/", 302);
+        } catch (thrown) {
+          if (thrown instanceof OgygieFailure) return refused(thrown.error.code, thrown.error.cause);
+          throw thrown;
+        }
+      }
+    });
+  }
   route.route({
     method: "POST",
     url: "/api/auth/magic-link",
-    schema: { body: MagicLinkInputSchema, response: { 202: z9.object({ accepted: z9.literal(true) }) } },
+    schema: { body: MagicLinkInputSchema, response: { 202: z10.object({ accepted: z10.literal(true) }) } },
     handler: async (request, reply) => {
       const user = findHostUser(deps.config, request.body.email);
       if (user === null) {
@@ -2455,8 +2718,8 @@ ${link}
       const email = consumeMagicLink(links, request.query.token);
       const user = findHostUser(deps.config, email);
       if (user === null) return unauthenticated(`link for ${email}, no longer a declared user`);
-      deps.log(JSON.stringify({ action: "sign-in", actor: user.email, outcome: "ok" }));
-      return reply.header("set-cookie", sessionCookie(issueSession(sessions, user.email), deps.config.session.ttlHours)).redirect("/", 302);
+      deps.log(JSON.stringify({ action: "sign-in", provider: "magic-link", actor: user.email, outcome: "ok" }));
+      return reply.header("set-cookie", sessionCookie(issueSession(sessions, { ...user, via: "magic-link" }), deps.config.session.ttlHours)).redirect("/", 302);
     }
   });
   route.route({
@@ -2477,10 +2740,10 @@ ${link}
 }
 
 // src/server/hosted/brief-routes.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/server/hosted/attachments.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { inflateRawSync } from "node:zlib";
 var ATTACHMENT_FORMATS = ["md", "txt", "csv", "json", "html", "xlsx", "pdf"];
 var MAX_ATTACHMENTS = 5;
@@ -2662,7 +2925,7 @@ function prepareBriefAttachments(raw) {
     if (buffer.length > MAX_ATTACHMENT_BYTES) return tooLarge(piece.name, `${buffer.length} bytes`, MAX_ATTACHMENT_BYTES, "bytes");
     totalBytes += buffer.length;
     if (totalBytes > MAX_ATTACHMENTS_BYTES) return tooLarge(piece.name, `${totalBytes} bytes in all`, MAX_ATTACHMENTS_BYTES, "bytes");
-    const identity = { name: piece.name, format, bytes: buffer.length, sha256: createHash("sha256").update(buffer).digest("hex") };
+    const identity = { name: piece.name, format, bytes: buffer.length, sha256: createHash2("sha256").update(buffer).digest("hex") };
     if (format === "pdf") {
       if (!isPdf(buffer)) unsupported(piece.name, "the content does not start like a PDF");
       prepared.push({ ...identity, kind: "pdf", data: buffer.toString("base64") });
@@ -2710,7 +2973,7 @@ ${attachments.map((piece) => `- ${piece.name} (${piece.format}, ${sizeOf(piece.b
 var attachmentDocumentsOf = (attachments) => attachments.flatMap((piece) => piece.kind === "pdf" ? [{ name: piece.name, data: piece.data }] : []);
 
 // src/server/hosted/brief.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 import { checkSpec, generationGrammarCard, readManifestGeneration } from "@ogygie/generate";
 var TEMPLATE_PATH2 = "specs/_TEMPLATE.spec.md";
 var PRODUCT_RULES_PATH = "AGENTS.product.md";
@@ -2735,10 +2998,10 @@ function asksUngenerated(brief) {
 async function readIfPresent(storage, path) {
   return await storage.exists(path) ? storage.readFile(path) : null;
 }
-var ManifestRouteSchema = z10.looseObject({ method: z10.string(), path: z10.string(), schemaInput: z10.string().optional(), schemaOutput: z10.string().optional(), invalidates: z10.array(z10.string()).optional() });
-var ManifestForPromptSchema = z10.looseObject({
-  product: z10.looseObject({ name: z10.string(), description: z10.string().optional() }).optional(),
-  features: z10.array(z10.looseObject({ name: z10.string(), intent: z10.string().optional(), status: z10.string().optional(), spec: z10.string().nullable().optional(), routes: z10.array(ManifestRouteSchema).optional() })).optional()
+var ManifestRouteSchema = z11.looseObject({ method: z11.string(), path: z11.string(), schemaInput: z11.string().optional(), schemaOutput: z11.string().optional(), invalidates: z11.array(z11.string()).optional() });
+var ManifestForPromptSchema = z11.looseObject({
+  product: z11.looseObject({ name: z11.string(), description: z11.string().optional() }).optional(),
+  features: z11.array(z11.looseObject({ name: z11.string(), intent: z11.string().optional(), status: z11.string().optional(), spec: z11.string().nullable().optional(), routes: z11.array(ManifestRouteSchema).optional() })).optional()
 });
 async function manifestSummary(storage) {
   const raw = await readIfPresent(storage, MANIFEST_PATH2);
@@ -2805,8 +3068,8 @@ function extractQuestions(text) {
   } catch {
     return { problem: "QUESTIONS: the JSON after the marker does not parse" };
   }
-  const shape = z10.object({
-    questions: z10.array(z10.object({ id: FeatureNameSchema, text: z10.string().trim().min(1), options: z10.array(z10.string().trim().min(1)).min(2).max(4) })).min(3).max(5)
+  const shape = z11.object({
+    questions: z11.array(z11.object({ id: FeatureNameSchema, text: z11.string().trim().min(1), options: z11.array(z11.string().trim().min(1)).min(2).max(4) })).min(3).max(5)
   });
   const checked = shape.safeParse(parsed);
   if (!checked.success) return { problem: `QUESTIONS: ${checked.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join(" ; ")}` };
@@ -3265,7 +3528,7 @@ async function registerBriefRoutes(app, deps) {
   route.route({
     method: "GET",
     url: "/api/briefs/:jobId",
-    schema: { params: z11.object({ jobId: z11.string().min(1) }), response: { 200: BriefJobSchema } },
+    schema: { params: z12.object({ jobId: z12.string().min(1) }), response: { 200: BriefJobSchema } },
     handler: async (request, reply) => {
       hostedUserOf(request);
       return reply.code(200).send(jobs.read(request.params.jobId));
@@ -3436,6 +3699,12 @@ function createHostedSpecStorage(deps) {
     async readFile(path) {
       return (await readerOf(path)).readFile(path);
     },
+    async modifiedAt(path) {
+      if (deps.lastCommitDateOf === void 0) return null;
+      const specId = specIdOfPath2(path);
+      const ref = specId !== null && (await branches()).has(specBranchOf(specId)) ? specBranchOf(specId) : deps.github.defaultBranch;
+      return deps.lastCommitDateOf(ref, path);
+    },
     async exists(path) {
       return (await readerOf(path)).exists(path);
     },
@@ -3885,17 +4154,17 @@ async function registerPromotionRoutes(app, deps) {
 }
 
 // src/server/hosted/usage.ts
-import { z as z12 } from "zod";
-var UsageEntrySchema = z12.object({
-  at: z12.string(),
+import { z as z13 } from "zod";
+var UsageEntrySchema = z13.object({
+  at: z13.string(),
   /** brief → spec from the instance; `speculate` entries arrive with the generator's lot. */
-  action: z12.enum(["brief", "speculate"]),
-  attempt: z12.number().int().positive().optional(),
-  model: z12.string(),
-  inputTokens: z12.number().int().nonnegative(),
-  outputTokens: z12.number().int().nonnegative(),
-  actor: z12.string().optional(),
-  specId: z12.string().optional()
+  action: z13.enum(["brief", "speculate"]),
+  attempt: z13.number().int().positive().optional(),
+  model: z13.string(),
+  inputTokens: z13.number().int().nonnegative(),
+  outputTokens: z13.number().int().nonnegative(),
+  actor: z13.string().optional(),
+  specId: z13.string().optional()
 });
 var USAGE_MARKER = "<!-- ogygie-usage -->";
 var DEFAULT_MODEL_COSTS = {
@@ -3930,7 +4199,7 @@ function parseUsageComment(body) {
   const block = /```json\n([\s\S]*?)\n```/.exec(body)?.[1];
   if (block === void 0) return [];
   try {
-    const parsed = z12.array(UsageEntrySchema).safeParse(JSON.parse(block));
+    const parsed = z13.array(UsageEntrySchema).safeParse(JSON.parse(block));
     return parsed.success ? parsed.data : [];
   } catch {
     return [];
@@ -4005,9 +4274,9 @@ async function registerConsumptionRoutes(app, deps) {
 }
 
 // src/server/hosted/preview-routes.ts
-import { z as z13 } from "zod";
-var PreviewParamsSchema = SpecParamsSchema.extend({ state: z13.string().min(1).max(80) });
-var CompositionPreviewParamsSchema = PreviewParamsSchema.extend({ composition: z13.string().min(1).max(80) });
+import { z as z14 } from "zod";
+var PreviewParamsSchema = SpecParamsSchema.extend({ state: z14.string().min(1).max(80) });
+var CompositionPreviewParamsSchema = PreviewParamsSchema.extend({ composition: z14.string().min(1).max(80) });
 var PREVIEW_CSP = "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:";
 async function registerPreviewRoutes(app, deps) {
   const route = app.withTypeProvider();
@@ -4049,7 +4318,7 @@ async function registerPreviewRoutes(app, deps) {
 }
 
 // src/server/hosted/composition-routes.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // src/server/hosted/compositions.ts
 var COMPOSITION_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
@@ -4093,7 +4362,7 @@ La composition \xAB ${composition} \xBB est retenue parmi celles propos\xE9es ;
 }
 
 // src/server/hosted/composition-routes.ts
-var CompositionParamsSchema = SpecParamsSchema.extend({ composition: z14.string().min(1).max(80) });
+var CompositionParamsSchema = SpecParamsSchema.extend({ composition: z15.string().min(1).max(80) });
 async function registerCompositionRoutes(app, deps) {
   const route = app.withTypeProvider();
   route.route({
@@ -4478,6 +4747,15 @@ function createGithubPullsClient(deps) {
       );
       return (json ?? []).map((entry) => ({ sha: entry.sha, message: entry.commit.message }));
     },
+    async lastCommitDateOf(branch, path) {
+      const { json } = await request(
+        "GET",
+        `${repoUrl}/commits?sha=${encodeURIComponent(branch)}&path=${encodeURIComponent(path)}&per_page=1`,
+        void 0
+      );
+      const last = json?.[0];
+      return last?.commit.committer?.date ?? last?.commit.author?.date ?? null;
+    },
     async getPullRequest(number) {
       const { json } = await request(
         "GET",
@@ -4826,6 +5104,7 @@ async function startHostedStudio(options) {
   const privateKeyPem = readSecret(config.githubApp.privateKeyPath, "the GitHub App private key");
   const sessionSecret = readSecret(config.session.secretPath, "the session secret", MIN_SESSION_SECRET_LENGTH);
   const mailApiKey = readSecret(config.mail.apiKeyPath, "the mail provider key");
+  const entraClientSecret = config.identity === void 0 ? void 0 : readSecret(config.identity.clientSecretPath, "the Entra client secret");
   const modelApiKey = config.model === void 0 ? void 0 : process.env["OGYGIE_MODEL_API_KEY"] ?? "";
   if (modelApiKey !== void 0 && modelApiKey.length === 0) {
     throwOgygieError({
@@ -4878,6 +5157,7 @@ async function startHostedStudio(options) {
       }
     }
   }
+  const pulls = createGithubPullsClient({ github: config.repo, fetchImpl: githubApp.installationFetch });
   const app = await createStudioApp({
     uiDistDir,
     hosted: {
@@ -4892,7 +5172,20 @@ async function startHostedStudio(options) {
       now,
       log,
       consumedLinks: /* @__PURE__ */ new Map(),
-      pulls: createGithubPullsClient({ github: config.repo, fetchImpl: githubApp.installationFetch }),
+      ...config.identity === void 0 || entraClientSecret === void 0 ? {} : {
+        entra: {
+          fetchImpl: fetch,
+          config: {
+            tenantId: config.identity.tenantId,
+            clientId: config.identity.clientId,
+            clientSecret: entraClientSecret,
+            callbackUrl: `${config.publicUrl.replace(/\/$/, "")}/api/auth/entra/callback`,
+            groupsClaim: config.identity.groupsClaim,
+            roles: config.identity.roles
+          }
+        }
+      },
+      pulls,
       readerFor,
       usage: createGithubUsageClient({ github: config.repo, fetchImpl: githubApp.installationFetch }),
       ...deploy === void 0 ? {} : { deploy },
@@ -4902,6 +5195,7 @@ async function startHostedStudio(options) {
         github: config.repo,
         readerFor,
         listSpecBranches,
+        lastCommitDateOf: pulls.lastCommitDateOf,
         client,
         user,
         now,