@polishd/next 0.1.0

package/README.md

@@ -0,0 +1,310 @@
+# @polishd/next
+
+> **What gets measured gets improved.**
+
+Drop-in **product analytics** for Next.js (App Router). Capture real user
+behavioral signals — rage clicks, dead clicks, scroll depth, JS errors, web
+vitals, component engagement — and explore them on a built-in, Vercel-style
+dashboard at `/polishd`.
+
+No third-party service. Events go to your own database: **SQLite in dev**
+(zero-config, built into Node), **Postgres in production**. Anonymous by design —
+one httpOnly UUID cookie per session, no fingerprinting, no PII.
+
+---
+
+## Documentation
+
+| | |
+|---|---|
+| **[docs/SETUP.md](./docs/SETUP.md)** | Full walkthrough — every variant, verification, troubleshooting |
+| **[AGENTS.md](./AGENTS.md)** | Install procedure written for AI coding agents |
+| **[DATABASE.md](./DATABASE.md)** | Production database setup, schema, retention |
+
+## Requirements
+
+- Next.js **15+**, App Router (no Pages Router support)
+- Node **22.5+** (the dev store uses the built-in `node:sqlite`)
+- Tailwind CSS v3 or v4, if you want the dashboard styled — see [Styling](#styling-required)
+- Postgres in production; nothing extra for local development
+
+## Quickstart
+
+```bash
+npm install @polishd/next
+npx polishd init
+npm run dev          # then visit /polishd
+```
+
+That's it locally — events write to `.polishd/analytics.db` with no
+configuration. `init` detects your layout (`src/` or root), writes the four
+files below, adds `.polishd/` to `.gitignore`, wires Tailwind, and skips
+anything that already exists (`--force` to overwrite, `--dry-run` to preview,
+`--js` for JavaScript, `--config` to also emit a `polishd.config.ts`).
+
+`pg` installs automatically as an optional dependency and is loaded only when
+you point Polishd at a Postgres URL.
+
+## What gets wired up
+
+```ts
+// src/proxy.ts        (middleware.ts on Next 15) — sets the session cookie
+import type { NextRequest } from "next/server";
+import { withPolishdSession } from "@polishd/next/proxy";
+
+export function proxy(request: NextRequest) {
+  return withPolishdSession(request);
+}
+// Must be an inline literal — Next can't import config.matcher.
+export const config = {
+  matcher: ["/((?!api|_next/static|_next/image|favicon|assets).*)"],
+};
+
+// src/instrumentation-client.ts — starts capture before hydration
+import { initPolishd } from "@polishd/next/client";
+initPolishd();
+
+// src/app/api/polishd/route.ts — the ingest endpoint
+import { createPolishdRoute } from "@polishd/next/route";
+export const runtime = "nodejs";        // must be declared here, not re-exported
+export const dynamic = "force-dynamic";
+export const POST = createPolishdRoute();
+
+// src/app/polishd/page.tsx — the dashboard (unguarded by default)
+import { createPolishdPage } from "@polishd/next/dashboard";
+export const runtime = "nodejs";       // Next requires these inline in the page
+export const dynamic = "force-dynamic";
+export default createPolishdPage();
+```
+
+> **Route segment config can't be re-exported.** Next statically parses
+> `runtime` and `dynamic`, so `export { POST, runtime, dynamic } from
+> "@polishd/next/route"` fails the build — declare them inline as above. The same
+> applies to the dashboard page.
+
+> **Get the matcher right.** Next statically parses `config.matcher`, so it must
+> be an inline literal in your proxy file — it can't be imported. `npx @polishd/next
+> init` writes the correct one for you. Excluding all of `/api` is load-bearing:
+> under Next 16 + Turbopack, a proxy matcher that touches any `/api/*` route
+> breaks resolution for the entire `/api` segment.
+
+## Styling (required)
+
+The dashboard is built from Tailwind utility classes and ships **no stylesheet
+of its own**, so Tailwind has to scan the package's `dist` — it won't find it by
+default. `init` wires this up for you; if you're doing it by hand:
+
+```css
+/* Tailwind v4 — in the CSS file that imports tailwind */
+@import "tailwindcss";
+@source "../../node_modules/@polishd/next/dist";   /* relative to this file */
+```
+
+```ts
+/* Tailwind v3 — in tailwind.config.ts */
+content: [
+  "./src/**/*.{ts,tsx}",
+  "./node_modules/@polishd/next/dist/**/*.js",
+],
+```
+
+Skip this and `/polishd` renders as unstyled HTML. Tailwind v4's automatic content
+detection deliberately ignores `node_modules`, so the `@source` line is not
+optional.
+
+## Protecting the dashboard
+
+By default `/polishd` is **public** (a dev-only console warning reminds you).
+Gate it with an `authenticate` callback, and optionally render your own sign-in
+UI when it fails:
+
+```tsx
+import { createPolishdPage } from "@polishd/next/dashboard";
+import { isAuthenticated } from "@/lib/auth";
+import { MyLogin } from "./login";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export default createPolishdPage({
+  authenticate: isAuthenticated,        // () => boolean | Promise<boolean>
+  unauthorized: <MyLogin />,            // optional; a minimal screen otherwise
+});
+```
+
+The same callback also guards the AI **server actions** (generate summary, save
+settings, scan codebase, file GitHub issues). That matters: a server action is
+an addressable POST endpoint whose id ships in the public client bundle, so
+gating only the page would leave those actions callable by anyone. They re-run
+`authenticate` against the caller's cookies on every call, and deny when no
+dashboard page has registered a policy.
+
+If you pass no `authenticate`, the dashboard **and** its actions are public —
+anyone who finds the URL can read your analytics, change the configured model
+and API base URL, and spend your model tokens. Always gate it in production.
+
+## AI summary
+
+The dashboard's top card turns the captured signals into a plain-English story
+of how people are actually using your site, followed by a **wins** list (what's
+working) and a **losses** list (specific problems). Losses are held to a higher
+bar: each must cite the exact page, selector, or component from the data —
+citations that don't appear in the analytics are discarded as hallucinations,
+and the rest are matched to your source files so every loss shows the file it
+lives in (or an honest "not matched to source" tag for dynamic content). It's
+**bring-your-own-key**: on first visit the card walks you through a four-step
+setup — connect a model (Anthropic, OpenAI, any OpenAI-compatible endpoint, or
+Google), describe your site, scan your codebase, and pick a refresh cadence.
+After that the card is just the story: the summary, when it was generated, a
+**refresh** icon to force a regenerate, and a **gear** that opens the full
+settings when you need them. Nothing is sent to a model until you ask.
+
+It's built to spend as few tokens as possible:
+
+- The model never sees raw events — only a compact, server-side **digest** of the
+  already-aggregated numbers (a few hundred tokens for an entire site).
+- The digest is **fingerprinted** and the summary is **cached**. Re-opening the
+  dashboard costs nothing, and a regenerate with no new data returns the cached
+  text without a model call.
+- The output is capped to a single tight paragraph.
+
+**Auto-refresh.** Pick a cadence (manual / daily / weekly) during setup or in
+Settings. When you open the dashboard past the cadence and the data has
+actually changed, the summary regenerates in the background after the page is
+served — no external cron, serverless-friendly. Unchanged data never triggers
+a model call, whatever the cadence.
+
+The API key is stored server-side (in your database) and is **never** sent back
+to the browser — the UI only ever shows whether one is set. You can also preset
+everything from the environment (handy for CI / shared deploys); dashboard
+settings take precedence.
+
+**Where to get a key:**
+
+| Provider | Get a key | Notes |
+|---|---|---|
+| Anthropic (Claude) | [console.anthropic.com/settings/keys](https://console.anthropic.com/settings/keys) | default model `claude-opus-4-8` |
+| OpenAI | [platform.openai.com/api-keys](https://platform.openai.com/api-keys) | default model `gpt-4o-mini` |
+| OpenAI-compatible | e.g. [openrouter.ai/keys](https://openrouter.ai/keys), [console.groq.com/keys](https://console.groq.com/keys) | also set **Base URL** |
+| Google (Gemini) | [aistudio.google.com/app/apikey](https://aistudio.google.com/app/apikey) | default model `gemini-1.5-flash` |
+
+### Project profile — the one-time setup scan
+
+To make the summary understand your *code* — not just the numbers — run the
+one-time **Scan codebase** step from the card's Project profile strip. Polishd
+reads your app's source from disk (pages and layouts first, then component
+files, under a hard token budget), and asks the model to write a compact
+profile: what the site is for, a map of its routes, and every interactive
+component by its exact identifier. Optionally tell it your **target audience**
+and **ideology / values** in Settings so the analysis judges the site by your
+goals.
+
+The profile is cached in your database and injected into every summary as
+authoritative context, so:
+
+- **Summaries never re-read source.** One scan, then pure digest + profile.
+- **The codebase is only touched again** when analytics mention a component the
+  profile doesn't cover — a tiny targeted read of just the files naming it —
+  or when you explicitly re-scan (the strip shows a hint when new components
+  appear).
+- On serverless hosts where source isn't on disk, scan in local dev; the saved
+  profile keeps serving in production.
+
+> **What the model sees.** A compact, server-side digest of the aggregated
+> analytics (page paths, element selectors, `data-component` names, sample
+> text, error messages), the cached project profile, and the description you
+> provide. Your source is read only during an explicit scan (or a targeted
+> gap-fill), and always under strict size budgets.
+
+## Component-level tracking
+
+Wrap any element to track it explicitly. Interactive controls get hover + click
+attribution; pass `content` for articles/regions to also measure viewport time,
+scroll depth, and rendered size.
+
+```tsx
+import { PolishdMonitor } from "@polishd/next/client";
+
+<PolishdMonitor name="listen-button">
+  <ListenButton />
+</PolishdMonitor>
+
+<PolishdMonitor name={slug} content className="block">
+  <Article />
+</PolishdMonitor>
+```
+
+## Configuration
+
+Defaults suit a low-traffic site. Override via `polishd.config.ts` and pass it to
+`initPolishd`:
+
+```ts
+// polishd.config.ts
+import { definePolishdConfig } from "@polishd/next";
+export default definePolishdConfig({
+  sampleRate: 1,
+  rageClick: { count: 3, windowMs: 500 },
+});
+```
+
+```ts
+// src/instrumentation-client.ts
+import { initPolishd } from "@polishd/next/client";
+import config from "../polishd.config";
+initPolishd(config);
+```
+
+## Environment variables
+
+| Var | When | Purpose |
+|---|---|---|
+| `POLISHD_DATABASE_URL` | production | Pooled Postgres connection string — enables capture |
+| `POLISHD_DB_PATH` | dev (optional) | Custom SQLite path (default `.polishd/analytics.db`) |
+| `POLISHD_AI_PROVIDER` | AI (optional) | `anthropic` \| `openai` \| `openai-compatible` \| `google` |
+| `POLISHD_AI_MODEL` | AI (optional) | Model id (defaults per provider, e.g. `claude-opus-4-8`) |
+| `POLISHD_AI_API_KEY` | AI (optional) | Model API key — preset instead of using the dashboard |
+| `POLISHD_AI_BASE_URL` | AI (optional) | Base URL for `openai-compatible` providers |
+| `POLISHD_AI_INSTRUCTIONS` / `POLISHD_AI_CONTEXT` | AI (optional) | Default instructions / site description |
+| `POLISHD_AI_AUDIENCE` / `POLISHD_AI_IDEOLOGY` | AI (optional) | Target audience / product values for the profile scan |
+| `POLISHD_AI_SOURCE_DIRS` | AI (optional) | Comma-separated folders to scan (default `src`/`app`/`components`/`pages`/`lib`) |
+| `POLISHD_AI_REFRESH_CADENCE` | AI (optional) | `manual` \| `daily` \| `weekly` — summary auto-refresh cadence |
+| `POLISHD_GITHUB_REPO` | GitHub (optional) | Repository as `owner/repo` — enables filing bugs from AI-found losses |
+| `POLISHD_GITHUB_TOKEN` | GitHub (optional) | Fine-grained PAT: Contents (read), Issues & Pull requests (write) |
+| `POLISHD_GITHUB_AUTO_ISSUES` | GitHub (optional) | `true` — file a GitHub issue automatically for each new problem a summary finds |
+
+AI settings are optional — the dashboard's Settings panel configures the same
+fields, and what you save there overrides these env defaults.
+
+Local dev needs nothing. If no writable store is available the package degrades
+to a safe no-op (a console warning, dashboard notice) — your app never breaks.
+See [DATABASE.md](./DATABASE.md) for production setup.
+
+## Entry points
+
+| Import | Contents |
+|---|---|
+| `@polishd/next` | config, `definePolishdConfig`, event types (isomorphic) |
+| `@polishd/next/client` | `initPolishd`, `PolishdMonitor` |
+| `@polishd/next/server` | store, ingest, queries, `withPolishdSession` (Node only) |
+| `@polishd/next/route` | `POST`, `createPolishdRoute` |
+| `@polishd/next/proxy` | `proxy`, `config`, `withPolishdSession`, `polishdMatcher` |
+| `@polishd/next/dashboard` | `createPolishdPage`, `PolishdDashboard`, `loadPolishdDashboardData` |
+
+## Development
+
+This repository contains the package only. To work on it:
+
+```bash
+npm install
+npm run build        # tsc -> dist (ESM + .d.ts)
+npm run typecheck
+```
+
+To test a change against a real app, `npm pack` and install the tarball into a
+scratch Next.js project — that exercises the published `exports` map and the
+"use client"/"use server" boundaries the way a consumer will.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/bin/init.mjs

@@ -0,0 +1,224 @@
+#!/usr/bin/env node
+/**
+ * `npx @polishd/next init` — scaffold the glue files a Next.js app needs to wire
+ * up Polishd. Node builtins only; zero runtime dependencies.
+ *
+ * Flags:
+ *   --force     overwrite existing files
+ *   --dry-run   print what would happen, write nothing
+ *   --js        emit .js/.jsx instead of TypeScript
+ *   --config    also write a starter polishd.config.ts
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+const args = new Set(process.argv.slice(2));
+const FORCE = args.has("--force");
+const DRY = args.has("--dry-run");
+const JS = args.has("--js");
+const WANT_CONFIG = args.has("--config");
+const cwd = process.cwd();
+
+const c = {
+  ok: (s) => `\x1b[32m${s}\x1b[0m`,
+  warn: (s) => `\x1b[33m${s}\x1b[0m`,
+  dim: (s) => `\x1b[2m${s}\x1b[0m`,
+  bold: (s) => `\x1b[1m${s}\x1b[0m`,
+};
+
+// ── Detect project layout ────────────────────────────────────────────────────
+const hasSrcApp = existsSync(join(cwd, "src", "app"));
+const hasRootApp = existsSync(join(cwd, "app"));
+if (!hasSrcApp && !hasRootApp) {
+  console.error(
+    c.warn("✗ Could not find an `app/` or `src/app/` directory.\n") +
+      "  Run this from the root of a Next.js App Router project.",
+  );
+  process.exit(1);
+}
+const base = hasSrcApp ? "src" : ""; // where proxy/instrumentation live
+const appDir = hasSrcApp ? join("src", "app") : "app";
+const ext = JS ? "tsx" : "tsx"; // page is always JSX
+const codeExt = JS ? "js" : "ts";
+const pageExt = JS ? "jsx" : "tsx";
+
+console.log(
+  c.ok(`✔ Detected Next.js App Router`) +
+    c.dim(` (${hasSrcApp ? "src/ layout" : "root layout"})`),
+);
+
+// ── File templates ───────────────────────────────────────────────────────────
+const files = [
+  {
+    path: join(base, `proxy.${codeExt}`),
+    merge: join(base, `middleware.${codeExt}`),
+    body:
+      (JS ? "" : `import type { NextRequest } from "next/server";\n`) +
+      `import { withPolishdSession } from "@polishd/next/proxy";\n\n` +
+      `export function proxy(request${JS ? "" : ": NextRequest"}) {\n` +
+      `  return withPolishdSession(request);\n` +
+      `}\n\n` +
+      `// Next statically parses config.matcher, so it must be an inline literal\n` +
+      `// here. Excluding all of /api is required — under Next 16 + Turbopack a\n` +
+      `// matcher that touches /api breaks the whole /api segment.\n` +
+      `export const config = {\n` +
+      `  matcher: ["/((?!api|_next/static|_next/image|favicon|assets).*)"],\n` +
+      `};\n`,
+  },
+  {
+    path: join(base, `instrumentation-client.${codeExt}`),
+    body: `import { initPolishd } from "@polishd/next/client";\n\ninitPolishd();\n`,
+  },
+  {
+    path: join(appDir, "api", "polishd", `route.${codeExt}`),
+    // runtime/dynamic must be declared here, not re-exported: Next statically
+    // parses route segment config and rejects `export { runtime } from ...`
+    // ("Next.js can't recognize the exported `runtime` field in route").
+    body:
+      `import { createPolishdRoute } from "@polishd/next/route";\n\n` +
+      `// node:sqlite / pg need the Node runtime — never the Edge runtime.\n` +
+      `export const runtime = "nodejs";\n` +
+      `// This route mutates per-request; it must never be statically cached.\n` +
+      `export const dynamic = "force-dynamic";\n\n` +
+      `export const POST = createPolishdRoute();\n`,
+  },
+  {
+    path: join(appDir, "polishd", `page.${pageExt}`),
+    body:
+      `import { createPolishdPage } from "@polishd/next/dashboard";\n\n` +
+      `// Next requires these to be declared inline in the page module.\n` +
+      `export const runtime = "nodejs";\n` +
+      `export const dynamic = "force-dynamic";\n\n` +
+      `// Unguarded by default. To protect it, pass an authenticate callback:\n` +
+      `//   export default createPolishdPage({ authenticate: isAuthenticated });\n` +
+      `export default createPolishdPage();\n`,
+  },
+];
+
+if (WANT_CONFIG) {
+  files.push({
+    path: `polishd.config.${codeExt}`,
+    body:
+      `import { definePolishdConfig } from "@polishd/next";\n\n` +
+      `export default definePolishdConfig({\n` +
+      `  // sampleRate: 1,\n` +
+      `  // rageClick: { count: 3, windowMs: 500 },\n` +
+      `});\n`,
+  });
+}
+
+// ── Write ────────────────────────────────────────────────────────────────────
+function write(file) {
+  const abs = join(cwd, file.path);
+  if (existsSync(abs) && !FORCE) {
+    console.log(c.warn(`⚠ ${file.path} exists`) + c.dim(" — skipped (use --force)"));
+    return;
+  }
+  // If a middleware.ts already exists for the proxy file, print a merge snippet.
+  if (file.merge && existsSync(join(cwd, file.merge)) && !FORCE) {
+    console.log(
+      c.warn(`⚠ ${file.merge} exists`) +
+        c.dim(" — add this to it (and keep the matcher):\n") +
+        `    import { withPolishdSession, polishdMatcher } from "@polishd/next/proxy";\n` +
+        `    // call withPolishdSession(request) in your handler;\n` +
+        `    // and merge polishdMatcher into your config.matcher`,
+    );
+    return;
+  }
+  if (DRY) {
+    console.log(c.dim(`• would write ${file.path}`));
+    return;
+  }
+  mkdirSync(dirname(abs), { recursive: true });
+  writeFileSync(abs, file.body);
+  console.log(c.ok(`✔ Created ${file.path}`));
+}
+
+for (const f of files) write(f);
+
+// ── .gitignore ───────────────────────────────────────────────────────────────
+const giPath = join(cwd, ".gitignore");
+if (!DRY) {
+  const gi = existsSync(giPath) ? readFileSync(giPath, "utf8") : "";
+  if (!gi.includes(".polishd")) {
+    appendFileSync(giPath, `${gi.endsWith("\n") || gi === "" ? "" : "\n"}.polishd/\n`);
+    console.log(c.ok("✔ Added .polishd/ to .gitignore"));
+  }
+}
+
+// ── Tailwind ─────────────────────────────────────────────────────────────────
+// The dashboard is styled entirely with Tailwind utility classes and ships no
+// stylesheet of its own, so Tailwind has to be told to scan the package's dist.
+// Neither version finds it by default: v4's automatic content detection skips
+// node_modules, and v3 only scans the globs it is given. Without this the
+// dashboard renders completely unstyled.
+const DIST_GLOB = "node_modules/@polishd/next/dist";
+
+function wireTailwind() {
+  const v3Config = ["tailwind.config.ts", "tailwind.config.js", "tailwind.config.mjs"]
+    .map((f) => join(cwd, f))
+    .find((f) => existsSync(f));
+
+  if (v3Config) {
+    console.log(
+      c.warn(`⚠ Tailwind v3 config detected`) +
+        c.dim(" — add this to its `content` array:\n") +
+        `    "./${DIST_GLOB}/**/*.js"`,
+    );
+    return;
+  }
+
+  // Tailwind v4: find the entry stylesheet that imports tailwind.
+  const cssCandidates = [
+    join("src", "app", "globals.css"),
+    join("app", "globals.css"),
+    join("src", "styles", "globals.css"),
+    join("styles", "globals.css"),
+    join("src", "app", "global.css"),
+  ];
+  for (const rel of cssCandidates) {
+    const abs = join(cwd, rel);
+    if (!existsSync(abs)) continue;
+    const css = readFileSync(abs, "utf8");
+    if (!/@import\s+["']tailwindcss["']/.test(css)) continue;
+    if (css.includes("@polishd/next")) {
+      console.log(c.dim(`• ${rel} already sources Polishd's styles`));
+      return;
+    }
+    // `@source` is resolved relative to the stylesheet, so walk back up to root.
+    const depth = dirname(rel).split(/[\\/]/).filter(Boolean).length;
+    const source = `${"../".repeat(depth)}${DIST_GLOB}`;
+    if (DRY) {
+      console.log(c.dim(`• would add @source "${source}" to ${rel}`));
+      return;
+    }
+    writeFileSync(
+      abs,
+      css.replace(
+        /(@import\s+["']tailwindcss["'];?)/,
+        `$1\n/* Generate the Polishd dashboard's utility classes (Tailwind skips node_modules). */\n@source "${source}";`,
+      ),
+    );
+    console.log(c.ok(`✔ Added @source "${source}" to ${rel}`));
+    return;
+  }
+
+  console.log(
+    c.warn("⚠ No Tailwind entry stylesheet found") +
+      c.dim(" — the dashboard needs Tailwind to render styled.\n") +
+      c.dim("  v4: add to your CSS →  ") +
+      `@source "<path-to>/${DIST_GLOB}";\n` +
+      c.dim("  v3: add to content →  ") +
+      `"./${DIST_GLOB}/**/*.js"`,
+  );
+}
+
+wireTailwind();
+
+// ── Next steps ───────────────────────────────────────────────────────────────
+console.log(`
+${c.bold("Next steps:")}
+  1. Local dev needs nothing — events write to ${c.dim(".polishd/analytics.db")} (SQLite).
+  2. For production, set ${c.dim("POLISHD_DATABASE_URL")} (pooled Postgres). See DATABASE.md.
+  3. Visit ${c.bold("/polishd")} to see the dashboard.
+${DRY ? c.warn("\n(dry run — nothing was written)") : ""}`);

package/dist/ai/actions.d.ts

@@ -0,0 +1,23 @@
+import { type SaveAISettingsInput } from "./settings";
+import type { PolishdAISettingsPublic, PolishdLossItem, CreateIssueResult, GenerateProfileResult, GenerateSummaryResult, VerifyGithubResult } from "./types";
+/** Generate or refresh the narrative. `force` re-asks the model even if data is unchanged. */
+export declare function generateSummaryAction(force?: boolean): Promise<GenerateSummaryResult>;
+/** Persist provider/model/key/instructions/context; returns the no-secret view. */
+export declare function saveAISettingsAction(input: SaveAISettingsInput): Promise<PolishdAISettingsPublic>;
+/**
+ * Scan the codebase and (re)build the project profile — the explicit setup
+ * step. Passes current analytics so known component names steer the scan.
+ */
+export declare function generateProfileAction(): Promise<GenerateProfileResult>;
+/**
+ * Check the saved GitHub repo + token live against the API — called by the
+ * onboarding step right after saving, so a bad token fails at setup.
+ */
+export declare function verifyGithubAction(): Promise<VerifyGithubResult>;
+/**
+ * Verify one loss against the repository's source and — when it holds up —
+ * file a GitHub issue with the technical analysis and fix suggestions. A
+ * disproved report returns `not-a-bug` with the reasoning instead of filing.
+ */
+export declare function createIssueFromLossAction(loss: Pick<PolishdLossItem, "issue" | "evidence" | "location">): Promise<CreateIssueResult>;
+//# sourceMappingURL=actions.d.ts.map

package/dist/ai/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/ai/actions.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtE,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,SAAS,CAAC;AAEjB,8FAA8F;AAC9F,wBAAsB,qBAAqB,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAGzF;AAED,mFAAmF;AACnF,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CAGlC;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAI5E;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAGtE;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC,GAC7D,OAAO,CAAC,iBAAiB,CAAC,CAG5B"}

package/dist/ai/actions.js

@@ -0,0 +1,58 @@
+"use server";
+/**
+ * Polishd — server actions for the AI summary card.
+ *
+ * These are the only AI entry points the client touches. They run on the
+ * server (Node runtime), so the API key never crosses to the browser, and they
+ * return only serializable, non-secret data.
+ *
+ * Every one of them gates on `requirePolishdAuth()` first. A server action is an
+ * addressable POST endpoint whose id ships in the public client bundle, so it
+ * is reachable directly regardless of whether the dashboard page rendered —
+ * the page's `authenticate` gate protects the render, not these. The guard
+ * re-runs that same callback against the caller's cookies on every call.
+ */
+import { requirePolishdAuth } from "./guard";
+import { verifyGithubConnection } from "./github";
+import { createIssueFromLoss } from "./issues";
+import { generateProjectProfile } from "./profile";
+import { loadPolishdDashboardData } from "../server/queries";
+import { saveAISettings } from "./settings";
+import { generateSummary } from "./summary";
+/** Generate or refresh the narrative. `force` re-asks the model even if data is unchanged. */
+export async function generateSummaryAction(force = false) {
+    await requirePolishdAuth();
+    return generateSummary({ force });
+}
+/** Persist provider/model/key/instructions/context; returns the no-secret view. */
+export async function saveAISettingsAction(input) {
+    await requirePolishdAuth();
+    return saveAISettings(input);
+}
+/**
+ * Scan the codebase and (re)build the project profile — the explicit setup
+ * step. Passes current analytics so known component names steer the scan.
+ */
+export async function generateProfileAction() {
+    await requirePolishdAuth();
+    const data = await loadPolishdDashboardData();
+    return generateProjectProfile(data);
+}
+/**
+ * Check the saved GitHub repo + token live against the API — called by the
+ * onboarding step right after saving, so a bad token fails at setup.
+ */
+export async function verifyGithubAction() {
+    await requirePolishdAuth();
+    return verifyGithubConnection();
+}
+/**
+ * Verify one loss against the repository's source and — when it holds up —
+ * file a GitHub issue with the technical analysis and fix suggestions. A
+ * disproved report returns `not-a-bug` with the reasoning instead of filing.
+ */
+export async function createIssueFromLossAction(loss) {
+    await requirePolishdAuth();
+    return createIssueFromLoss(loss);
+}
+//# sourceMappingURL=actions.js.map

package/dist/ai/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/ai/actions.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAA4B,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAU5C,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAK,GAAG,KAAK;IACvD,MAAM,kBAAkB,EAAE,CAAC;IAC3B,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA0B;IAE1B,MAAM,kBAAkB,EAAE,CAAC;IAC3B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,kBAAkB,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC9C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,kBAAkB,EAAE,CAAC;IAC3B,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA8D;IAE9D,MAAM,kBAAkB,EAAE,CAAC;IAC3B,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/ai/digest.d.ts

@@ -0,0 +1,9 @@
+import type { PolishdDashboardData } from "../server/queries";
+/**
+ * Render the captured analytics as a compact, model-readable brief. Sections
+ * are omitted when empty so the prompt only ever contains real signal.
+ */
+export declare function buildDigest(data: PolishdDashboardData, context?: string): string;
+/** Stable fingerprint of a digest — drives the "data unchanged" short-circuit. */
+export declare function fingerprintDigest(digest: string): string;
+//# sourceMappingURL=digest.d.ts.map

package/dist/ai/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/ai/digest.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAS9D;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CA4FhF;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD"}