@polishd/next 0.1.0

package/dist/ai/digest.js

@@ -0,0 +1,108 @@
+/**
+ * Polishd — analytics digest (server only).
+ *
+ * This is the token-saving heart of the AI layer. Instead of shipping raw
+ * events (thousands of rows) to a model, we pre-aggregate everything on the
+ * server — the same numbers the dashboard already computes — and render them as
+ * a terse, structured text block. A model can read the whole picture of a site
+ * in a few hundred tokens.
+ *
+ * `fingerprintDigest` hashes the digest so the orchestrator can skip the model
+ * call entirely when nothing has changed since the last summary (see summary.ts).
+ */
+import { createHash } from "node:crypto";
+/** Round to keep digests stable across tiny float jitter. */
+const r = (n) => (n === null ? "—" : String(Math.round(n)));
+/** Trim and cap a free-text label so one outlier can't bloat the prompt. */
+const clip = (s, max = 40) => !s ? "" : s.replace(/\s+/g, " ").trim().slice(0, max);
+/**
+ * Render the captured analytics as a compact, model-readable brief. Sections
+ * are omitted when empty so the prompt only ever contains real signal.
+ */
+export function buildDigest(data, context) {
+    const { overview, pages, elements, devices, topUsed, errors, monitored } = data;
+    const lines = [];
+    if (context && context.trim()) {
+        lines.push(`SITE: ${context.trim()}`);
+    }
+    lines.push(`TOTALS: ${overview.sessions} sessions, ${overview.pageViews} page views, ` +
+        `${overview.rageClicks} rage clicks, ${overview.deadClicks} dead clicks, ` +
+        `${overview.jsErrors} JS errors (${overview.totalEvents} events total).`);
+    if (devices.length) {
+        lines.push("DEVICES: " +
+            devices.map((d) => `${d.category} ${d.pct}%`).join(", ") +
+            ".");
+    }
+    if (topUsed.length) {
+        lines.push("MOST-USED ELEMENTS (by clicks):");
+        for (const t of topUsed.slice(0, 8)) {
+            const label = clip(t.label) || clip(t.sampleText) || t.selector || "(unknown)";
+            lines.push(`  - ${label}: ${t.clicks} clicks, ${t.pages} pages`);
+        }
+    }
+    // Pages ranked worst-first by issue score (rage/dead/errors/shallow scroll).
+    const worst = [...pages]
+        .map((p) => ({
+        ...p,
+        score: p.rageClicks * 3 +
+            p.deadClicks * 2 +
+            p.jsErrors * 2.5 +
+            (p.avgScrollDepth !== null && p.avgScrollDepth < 50
+                ? (50 - p.avgScrollDepth) / 25
+                : 0),
+    }))
+        .filter((p) => p.score > 0)
+        .sort((a, b) => b.score - a.score)
+        .slice(0, 6);
+    if (worst.length) {
+        lines.push("PAGES WITH FRICTION (worst first):");
+        for (const p of worst) {
+            lines.push(`  - ${p.path}: ${p.sessions} sessions, ${p.rageClicks} rage, ` +
+                `${p.deadClicks} dead, ${p.jsErrors} err, scroll ${r(p.avgScrollDepth)}%`);
+        }
+    }
+    const brokenEls = elements.filter((e) => e.rageClicks > 0 || e.deadClicks > 0).slice(0, 8);
+    if (brokenEls.length) {
+        lines.push("ELEMENTS USERS STRUGGLE WITH:");
+        for (const e of brokenEls) {
+            const label = clip(e.sampleText) || e.label;
+            lines.push(`  - ${label}: ${e.rageClicks} rage, ${e.deadClicks} dead, ${e.pages} pages`);
+        }
+    }
+    if (monitored.length) {
+        lines.push("MONITORED COMPONENTS (engagement):");
+        for (const m of monitored.slice(0, 6)) {
+            const parts = [`${m.componentViews} views`];
+            if (m.avgViewMs !== null)
+                parts.push(`avg ${Math.round(m.avgViewMs / 100) / 10}s visible`);
+            if (m.avgScrollDepth !== null)
+                parts.push(`${m.avgScrollDepth}% scrolled`);
+            if (m.rageClicks > 0)
+                parts.push(`${m.rageClicks} rage`);
+            lines.push(`  - ${m.name}: ${parts.join(", ")}`);
+        }
+    }
+    if (errors.length) {
+        // Dedupe by message so a single recurring error doesn't fill the section.
+        const seen = new Set();
+        const uniq = [];
+        for (const e of errors) {
+            if (seen.has(e.message))
+                continue;
+            seen.add(e.message);
+            uniq.push(e);
+            if (uniq.length >= 5)
+                break;
+        }
+        lines.push("RECENT ERRORS:");
+        for (const e of uniq) {
+            lines.push(`  - "${clip(e.message, 80)}" on ${e.path}`);
+        }
+    }
+    return lines.join("\n");
+}
+/** Stable fingerprint of a digest — drives the "data unchanged" short-circuit. */
+export function fingerprintDigest(digest) {
+    return createHash("sha256").update(digest).digest("hex").slice(0, 16);
+}
+//# sourceMappingURL=digest.js.map

package/dist/ai/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../src/ai/digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,6DAA6D;AAC7D,MAAM,CAAC,GAAG,CAAC,CAAgB,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnF,4EAA4E;AAC5E,MAAM,IAAI,GAAG,CAAC,CAA4B,EAAE,GAAG,GAAG,EAAE,EAAU,EAAE,CAC9D,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAExD;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAA0B,EAAE,OAAgB;IACtE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAChF,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,IAAI,CACR,WAAW,QAAQ,CAAC,QAAQ,cAAc,QAAQ,CAAC,SAAS,eAAe;QACzE,GAAG,QAAQ,CAAC,UAAU,iBAAiB,QAAQ,CAAC,UAAU,gBAAgB;QAC1E,GAAG,QAAQ,CAAC,QAAQ,eAAe,QAAQ,CAAC,WAAW,iBAAiB,CAC3E,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CACR,WAAW;YACT,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACxD,GAAG,CACN,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC;YAC/E,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,CAAC;QACJ,KAAK,EACH,CAAC,CAAC,UAAU,GAAG,CAAC;YAChB,CAAC,CAAC,UAAU,GAAG,CAAC;YAChB,CAAC,CAAC,QAAQ,GAAG,GAAG;YAChB,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,GAAG,EAAE;gBACjD,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE;gBAC9B,CAAC,CAAC,CAAC,CAAC;KACT,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;SAC1B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,UAAU,SAAS;gBAC7D,GAAG,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3F,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3F,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,YAAY,CAAC,CAAC;YAC3E,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,OAAO,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,0EAA0E;QAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,IAAI,GAAkB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/ai/github.d.ts

@@ -0,0 +1,51 @@
+import type { PolishdGithubStatus, VerifyGithubResult } from "./types";
+/** True when both a repo and a token are configured. */
+export declare function isGithubConnected(): Promise<boolean>;
+/**
+ * Check the saved token against the saved repo: does it exist, can we read it,
+ * can we push (branches/PRs), are issues enabled? Called right after the owner
+ * saves the connection so bad tokens fail at setup, not at first use.
+ */
+export declare function verifyGithubConnection(): Promise<VerifyGithubResult>;
+/** The verified connection status, or null when not connected / unreachable. */
+export declare function getGithubStatus(): Promise<PolishdGithubStatus | null>;
+/**
+ * Read one file from the connected repo (default branch unless `ref` given).
+ * Returns null when the path doesn't exist or nothing is connected — callers
+ * treat GitHub as a fallback source tree, not a hard dependency.
+ */
+export declare function readGithubFile(path: string, ref?: string): Promise<string | null>;
+/**
+ * Find files in the connected repo whose content matches the given terms
+ * (ANDed), via GitHub's code search. Returns file paths, best matches first,
+ * or [] on any failure — search is an enrichment, never a hard dependency.
+ */
+export declare function searchGithubCode(terms: string[], max?: number): Promise<string[]>;
+/**
+ * Create a branch off the repo's default branch (or `from`). Returns the new
+ * branch name. Throws on failure — callers surface GitHub's message.
+ */
+export declare function createGithubBranch(name: string, from?: string): Promise<string>;
+/**
+ * Open a pull request from `head` into `base` (default branch when omitted).
+ * Returns the PR's URL and number. Throws on failure.
+ */
+export declare function createGithubPullRequest(input: {
+    title: string;
+    body?: string;
+    head: string;
+    base?: string;
+}): Promise<{
+    url: string;
+    number: number;
+}>;
+/** File an issue in the connected repo. Throws on failure. */
+export declare function createGithubIssue(input: {
+    title: string;
+    body?: string;
+    labels?: string[];
+}): Promise<{
+    url: string;
+    number: number;
+}>;
+//# sourceMappingURL=github.d.ts.map

package/dist/ai/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/ai/github.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAavE,wDAAwD;AACxD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE1D;AA0CD;;;;GAIG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CA2B1E;AAED,gFAAgF;AAChF,wBAAsB,eAAe,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAG3E;AAID;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,SAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAclF;AAID;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAa3C;AAID,8DAA8D;AAC9D,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAU3C"}

package/dist/ai/github.js

@@ -0,0 +1,175 @@
+/**
+ * Polishd — GitHub API client (server only).
+ *
+ * A thin client over GitHub's REST API for the repo the owner connected during
+ * onboarding. Capabilities, all scoped to that one repo: read and search source
+ * (Contents + code-search APIs — lets the AI layer ground its findings in real
+ * code even where the source tree isn't on disk, e.g. Vercel), create branches,
+ * open pull requests, and file issues. The "loss → verified bug" orchestration
+ * that uses this client lives in issues.ts.
+ *
+ * The token lives in the same server-side settings blob as the model API key
+ * and never reaches the browser; the client only sees a "connected" flag. A
+ * fine-grained PAT with Contents (read), Issues (write), and Pull requests
+ * (write) on the one repo is all it needs.
+ */
+import { resolveSettings } from "./settings";
+const API = "https://api.github.com";
+/** The connected repo + token, or null when either half is missing. */
+async function connection() {
+    const { settings } = await resolveSettings();
+    const repo = settings.githubRepo?.trim();
+    const token = settings.githubToken?.trim();
+    if (!repo || !token)
+        return null;
+    return { repo, token };
+}
+/** True when both a repo and a token are configured. */
+export async function isGithubConnected() {
+    return (await connection()) !== null;
+}
+/** One GitHub API call. Throws with GitHub's own message on non-2xx. */
+async function gh(token, method, path, body) {
+    const res = await fetch(`${API}${path}`, {
+        method,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+            ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+        cache: "no-store",
+    });
+    if (!res.ok) {
+        let message = `GitHub responded ${res.status}`;
+        try {
+            const err = (await res.json());
+            if (err.message)
+                message = `GitHub: ${err.message} (${res.status})`;
+        }
+        catch {
+            /* keep the status-only message */
+        }
+        throw new Error(message);
+    }
+    return (await res.json());
+}
+/**
+ * Check the saved token against the saved repo: does it exist, can we read it,
+ * can we push (branches/PRs), are issues enabled? Called right after the owner
+ * saves the connection so bad tokens fail at setup, not at first use.
+ */
+export async function verifyGithubConnection() {
+    const conn = await connection();
+    if (!conn) {
+        return {
+            ok: false,
+            error: "not-connected",
+            message: "Add a repository and access token first.",
+        };
+    }
+    try {
+        const repo = await gh(conn.token, "GET", `/repos/${conn.repo}`);
+        return {
+            ok: true,
+            status: {
+                repo: repo.full_name,
+                defaultBranch: repo.default_branch,
+                canPush: repo.permissions?.push === true,
+                issuesEnabled: repo.has_issues,
+            },
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: "github-error",
+            message: err instanceof Error ? err.message : "Could not reach GitHub.",
+        };
+    }
+}
+/** The verified connection status, or null when not connected / unreachable. */
+export async function getGithubStatus() {
+    const res = await verifyGithubConnection();
+    return res.ok ? res.status : null;
+}
+// ── Read source ──────────────────────────────────────────────────────────────
+/**
+ * Read one file from the connected repo (default branch unless `ref` given).
+ * Returns null when the path doesn't exist or nothing is connected — callers
+ * treat GitHub as a fallback source tree, not a hard dependency.
+ */
+export async function readGithubFile(path, ref) {
+    const conn = await connection();
+    if (!conn)
+        return null;
+    try {
+        const file = await gh(conn.token, "GET", `/repos/${conn.repo}/contents/${encodeURI(path)}${ref ? `?ref=${encodeURIComponent(ref)}` : ""}`);
+        if (file.encoding !== "base64" || typeof file.content !== "string")
+            return null;
+        return Buffer.from(file.content, "base64").toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Find files in the connected repo whose content matches the given terms
+ * (ANDed), via GitHub's code search. Returns file paths, best matches first,
+ * or [] on any failure — search is an enrichment, never a hard dependency.
+ */
+export async function searchGithubCode(terms, max = 3) {
+    const conn = await connection();
+    if (!conn || terms.length === 0)
+        return [];
+    try {
+        const q = encodeURIComponent(`${terms.join(" ")} repo:${conn.repo}`);
+        const res = await gh(conn.token, "GET", `/search/code?q=${q}&per_page=${max}`);
+        return (res.items ?? []).map((i) => i.path).slice(0, max);
+    }
+    catch {
+        return [];
+    }
+}
+// ── Branches & pull requests ─────────────────────────────────────────────────
+/**
+ * Create a branch off the repo's default branch (or `from`). Returns the new
+ * branch name. Throws on failure — callers surface GitHub's message.
+ */
+export async function createGithubBranch(name, from) {
+    const conn = await connection();
+    if (!conn)
+        throw new Error("GitHub is not connected.");
+    const base = from ??
+        (await gh(conn.token, "GET", `/repos/${conn.repo}`)).default_branch;
+    const ref = await gh(conn.token, "GET", `/repos/${conn.repo}/git/ref/heads/${encodeURIComponent(base)}`);
+    await gh(conn.token, "POST", `/repos/${conn.repo}/git/refs`, {
+        ref: `refs/heads/${name}`,
+        sha: ref.object.sha,
+    });
+    return name;
+}
+/**
+ * Open a pull request from `head` into `base` (default branch when omitted).
+ * Returns the PR's URL and number. Throws on failure.
+ */
+export async function createGithubPullRequest(input) {
+    const conn = await connection();
+    if (!conn)
+        throw new Error("GitHub is not connected.");
+    const base = input.base ??
+        (await gh(conn.token, "GET", `/repos/${conn.repo}`)).default_branch;
+    const pr = await gh(conn.token, "POST", `/repos/${conn.repo}/pulls`, { title: input.title, body: input.body ?? "", head: input.head, base });
+    return { url: pr.html_url, number: pr.number };
+}
+// ── Issues ───────────────────────────────────────────────────────────────────
+/** File an issue in the connected repo. Throws on failure. */
+export async function createGithubIssue(input) {
+    const conn = await connection();
+    if (!conn)
+        throw new Error("GitHub is not connected.");
+    const issue = await gh(conn.token, "POST", `/repos/${conn.repo}/issues`, { title: input.title, body: input.body ?? "", labels: input.labels });
+    return { url: issue.html_url, number: issue.number };
+}
+//# sourceMappingURL=github.js.map

package/dist/ai/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/ai/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,GAAG,GAAG,wBAAwB,CAAC;AAErC,uEAAuE;AACvE,KAAK,UAAU,UAAU;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,OAAO,CAAC,MAAM,UAAU,EAAE,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,EAAE,CACf,KAAa,EACb,MAAc,EACd,IAAY,EACZ,IAAc;IAEd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;QACvC,MAAM;QACN,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;YACpC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,OAAO,GAAG,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;YACvD,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,WAAW,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,0CAA0C;SACpD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI,CAAC,SAAS;gBACpB,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,IAAI;gBACxC,aAAa,EAAE,IAAI,CAAC,UAAU;aAC/B;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB;SACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,GAAG,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC3C,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,GAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CACnB,IAAI,CAAC,KAAK,EACV,KAAK,EACL,UAAU,IAAI,CAAC,IAAI,aAAa,SAAS,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAe,EAAE,GAAG,GAAG,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,EAAE,CAClB,IAAI,CAAC,KAAK,EACV,KAAK,EACL,kBAAkB,CAAC,aAAa,GAAG,EAAE,CACtC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,IAAa;IAEb,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACvD,MAAM,IAAI,GACR,IAAI;QACJ,CAAC,MAAM,EAAE,CAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,EAAE,CAClB,IAAI,CAAC,KAAK,EACV,KAAK,EACL,UAAU,IAAI,CAAC,IAAI,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAChE,CAAC;IACF,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC,IAAI,WAAW,EAAE;QAC3D,GAAG,EAAE,cAAc,IAAI,EAAE;QACzB,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG;KACpB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAK7C;IACC,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACvD,MAAM,IAAI,GACR,KAAK,CAAC,IAAI;QACV,CAAC,MAAM,EAAE,CAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACpF,MAAM,EAAE,GAAG,MAAM,EAAE,CACjB,IAAI,CAAC,KAAK,EACV,MAAM,EACN,UAAU,IAAI,CAAC,IAAI,QAAQ,EAC3B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CACvE,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAIvC;IACC,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,EAAE,CACpB,IAAI,CAAC,KAAK,EACV,MAAM,EACN,UAAU,IAAI,CAAC,IAAI,SAAS,EAC5B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACrE,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACvD,CAAC"}

package/dist/ai/guard.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Polishd — server-action authorization (server only).
+ *
+ * Next.js server actions are independently addressable POST endpoints: their
+ * ids ship inside the public client bundle, so anyone can invoke one directly
+ * with a `Next-Action` header. Gating the dashboard *page* therefore protects
+ * only what renders — it does nothing for the actions behind it. Every action
+ * this package exports must `await requirePolishdAuth()` before doing any work.
+ *
+ * `createPolishdPage()` records the host app's `authenticate` callback here when
+ * the page module is evaluated, and the actions re-run it on each request. The
+ * check is therefore made against the caller's own cookies every time; nothing
+ * about the decision is trusted from the client.
+ *
+ * Fails closed: an action reached before any dashboard page has registered a
+ * policy is denied.
+ */
+export type PolishdAuthPolicy = 
+/** `createPolishdPage()` with no `authenticate` — deliberately public. */
+{
+    mode: "open";
+}
+/** `createPolishdPage({ authenticate })` — re-checked per action call. */
+ | {
+    mode: "guarded";
+    authenticate: () => boolean | Promise<boolean>;
+};
+/** Record the dashboard's access policy. Called by `createPolishdPage()`. */
+export declare function registerPolishdAuth(next: PolishdAuthPolicy): void;
+/**
+ * Thrown when an action is invoked without authorization. Next replaces the
+ * message with an opaque digest in production, so nothing leaks to the caller.
+ */
+export declare class PolishdUnauthorizedError extends Error {
+    constructor();
+}
+/**
+ * Authorize the current server-action request, or throw. A callback that
+ * itself throws is treated as a denial — an auth helper blowing up must never
+ * open the gate.
+ */
+export declare function requirePolishdAuth(): Promise<void>;
+//# sourceMappingURL=guard.d.ts.map

package/dist/ai/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/ai/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,iBAAiB;AAC3B,0EAA0E;AACxE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,0EAA0E;GACxE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAIxE,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAEjE;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBxD"}

package/dist/ai/guard.js

@@ -0,0 +1,57 @@
+/**
+ * Polishd — server-action authorization (server only).
+ *
+ * Next.js server actions are independently addressable POST endpoints: their
+ * ids ship inside the public client bundle, so anyone can invoke one directly
+ * with a `Next-Action` header. Gating the dashboard *page* therefore protects
+ * only what renders — it does nothing for the actions behind it. Every action
+ * this package exports must `await requirePolishdAuth()` before doing any work.
+ *
+ * `createPolishdPage()` records the host app's `authenticate` callback here when
+ * the page module is evaluated, and the actions re-run it on each request. The
+ * check is therefore made against the caller's own cookies every time; nothing
+ * about the decision is trusted from the client.
+ *
+ * Fails closed: an action reached before any dashboard page has registered a
+ * policy is denied.
+ */
+let policy = null;
+/** Record the dashboard's access policy. Called by `createPolishdPage()`. */
+export function registerPolishdAuth(next) {
+    policy = next;
+}
+/**
+ * Thrown when an action is invoked without authorization. Next replaces the
+ * message with an opaque digest in production, so nothing leaks to the caller.
+ */
+export class PolishdUnauthorizedError extends Error {
+    constructor() {
+        super("[polishd] unauthorized");
+        this.name = "PolishdUnauthorizedError";
+    }
+}
+/**
+ * Authorize the current server-action request, or throw. A callback that
+ * itself throws is treated as a denial — an auth helper blowing up must never
+ * open the gate.
+ */
+export async function requirePolishdAuth() {
+    // No dashboard page registered a policy in this runtime: deny rather than
+    // guess. Reaching an action without the page module loaded is not a flow the
+    // dashboard produces.
+    if (!policy)
+        throw new PolishdUnauthorizedError();
+    if (policy.mode === "open")
+        return;
+    let ok = false;
+    try {
+        ok = await policy.authenticate();
+    }
+    catch (err) {
+        console.warn("[polishd] authenticate() threw during an action call, denying:", err instanceof Error ? err.message : err);
+        ok = false;
+    }
+    if (!ok)
+        throw new PolishdUnauthorizedError();
+}
+//# sourceMappingURL=guard.js.map

package/dist/ai/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/ai/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,IAAI,MAAM,GAA6B,IAAI,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,0EAA0E;IAC1E,6EAA6E;IAC7E,sBAAsB;IACtB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IAEnC,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,gEAAgE,EAChE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;QACF,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;AAChD,CAAC"}

package/dist/ai/issues.d.ts

@@ -0,0 +1,21 @@
+import type { PolishdLossItem, CreateIssueResult } from "./types";
+/** The slice of a loss the pipeline needs. */
+type Loss = Pick<PolishdLossItem, "issue" | "evidence" | "location">;
+/**
+ * File a bug from one loss — after verifying it against the source (see the
+ * module doc for the pipeline). Returns the issue on success, the stored issue
+ * when this evidence was already filed, or `not-a-bug` with the verdict's
+ * reasoning when the code disproves the report.
+ */
+export declare function createIssueFromLoss(loss: Loss): Promise<CreateIssueResult>;
+/**
+ * Decorate a fresh summary's losses with their GitHub issues: attach the link
+ * for anything already filed and — when the owner enabled auto-filing — run
+ * the verify-and-file pipeline on the new ones. Losses whose report the code
+ * disproved are skipped (and remembered, so they aren't re-investigated).
+ * Never throws; a hiccup just leaves a loss undecorated, with the manual
+ * "file bug" button as the fallback.
+ */
+export declare function attachGithubIssues(losses: PolishdLossItem[]): Promise<PolishdLossItem[]>;
+export {};
+//# sourceMappingURL=issues.d.ts.map

package/dist/ai/issues.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues.d.ts","sourceRoot":"","sources":["../../src/ai/issues.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAElE,8CAA8C;AAC9C,KAAK,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC;AAyPrE;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4ChF;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAoB9F"}