@lunora/cli 1.0.0-alpha.21 → 1.0.0-alpha.210

package/dist/packem_shared/tui-prompts-Dd0pDuNr.mjs

@@ -0,0 +1,4 @@
+import{jsx as n,jsxs as a}from"react/jsx-runtime";import{isInteractive as m,ACCENT as w,LUNA_ART as ce,LUNA_NAME as le,LUNA_SIGNOFF as se,BADGE_COLUMN_WIDTH as z,badgeWidth as J,badgeLead as ae,padBadge as ue}from"@lunora/config";import{render as H}from"@visulima/tui";import{Box as u}from"@visulima/tui/components/box";import{Text as l}from"@visulima/tui/components/text";import{useApp as I}from"@visulima/tui/hooks/use-app";import{useInput as B}from"@visulima/tui/hooks/use-input";import{useInterval as de}from"@visulima/tui/hooks/use-interval";import{CommandPalette as fe}from"@visulima/tui-kit/command-palette";import{ConfirmInput as he}from"@visulima/tui-kit/confirm-input";import{SelectInput as me}from"@visulima/tui-kit/select-input";import{Spinner as pe}from"@visulima/tui-kit/spinner";import{TextInput as ve}from"@visulima/tui-kit/text-input";import{useState as S,useEffect as A}from"react";import{P as K}from"./prompt-cancelled-C8Sj7OqI.mjs";let j=!1;const V=()=>{j||(j=!0,process.getMaxListeners()<64&&process.setMaxListeners(64))},we=({children:e,onCancel:r})=>{const{exit:t}=I();return B((i,o)=>{o.ctrl&&i==="c"&&(r(),t())}),e},Q=e=>e instanceof Error?e:new Error(typeof e=="string"?e:"task failed"),Z=10,xe=8,ee=({spec:e})=>a(l,{children:[n(l,{children:ae(e.text)}),n(l,{backgroundColor:e.bg,bold:!0,color:e.fg,children:ue(e.text)})]}),$=({badge:e,message:r})=>e===void 0?n(l,{bold:!0,children:r}):a(u,{children:[n(ee,{spec:e}),n(l,{bold:!0,children:` ${r}`})]}),re=2,T=" ".repeat(z-1),te=e=>" ".repeat(J(e)+1),Ce=e=>e===void 0?re:J(e)+1,D=({badge:e,children:r,message:t})=>a(u,{flexDirection:"column",children:[n($,{badge:e,message:t}),n(u,{flexDirection:"column",marginLeft:Ce(e),children:r})]}),g=({answer:e,badge:r,message:t})=>a(u,{flexDirection:"column",children:[n($,{badge:r,message:t}),e===""?null:n(l,{dimColor:!0,children:`${r===void 0?" ".repeat(re):te(r)}${e}`})]}),R=e=>{const{exit:r}=I(),[t,i]=S(void 0);return A(()=>{t!==void 0&&r()},[t,r]),{answer:t,submit:(o,c)=>{e(o),i(c)}}},Se=({children:e})=>{const{exit:r}=I();return A(()=>{r()},[r]),e},N=async e=>{V(),process.stdout.write(`
+`);const r=H(n(Se,{children:e}));try{await r.waitUntilExit()}catch{}finally{r.unmount()}},Ze=async(e,r,t)=>{if(!m())return;const i=t===void 0||t===""?[]:t.split(`
+`);await N(a(u,{flexDirection:"column",children:[n($,{badge:e,message:r}),i.map(o=>n(l,{dimColor:!0,children:`${te(e)}${o}`},o))]}))},G=async e=>{V(),process.stdout.write(`
+`);const r={value:!1},t=H(n(we,{onCancel:()=>{r.value=!0},children:e}),{exitOnCtrlC:!1});try{await t.waitUntilExit()}finally{t.unmount()}if(r.value)throw new K},E=async(e,r)=>{let t=r;return await G(e(i=>{t=i})),t},ne=e=>e.description===void 0?e.label:`${e.label} — ${e.description}`,U=()=>{const{exit:e}=I();B((r,t)=>{t.escape&&e()})},Ie=({badge:e,finish:r,initialIndex:t,message:i,options:o})=>{const{answer:c,submit:d}=R(r);return U(),c!==void 0?n(g,{answer:c,badge:e,message:i}):n(D,{badge:e,message:i,children:n(me,{accentColor:w,initialIndex:t,items:o.map(s=>({key:s.value,label:ne(s),value:s.value})),limit:Z,onSelect:s=>{d(s.value,o.find(f=>f.value===s.value)?.label??s.value)}})})},be=({badge:e,finish:r,message:t,options:i})=>{const{exit:o}=I(),{answer:c,submit:d}=R(r);return c!==void 0?n(g,{answer:c,badge:e,message:t}):n(D,{badge:e,message:t,children:n(fe,{accentColor:w,autoFocus:!0,commands:i.map(s=>({description:s.description,id:s.value,label:s.label})),limit:Z,onCancel:()=>{o()},onSelect:s=>{d(s,i.find(f=>f.value===s)?.label??s)},placeholder:"Type to filter…"})})},er=async(e,r,t)=>{if(!m()||r.length===0)return t?.default;const{badge:i}=t??{};if(r.length>xe)return E(c=>n(be,{badge:i,finish:c,message:e,options:r}),t?.default);const o=t?.default===void 0?-1:r.findIndex(c=>c.value===t.default);return E(c=>n(Ie,{badge:i,finish:c,initialIndex:o>=0?o:void 0,message:e,options:r}),t?.default)},Te=({badge:e,defaultValue:r,finish:t,message:i,placeholder:o})=>{const{answer:c,submit:d}=R(t);return U(),c!==void 0?n(g,{answer:c,badge:e,message:i}):n(D,{badge:e,message:i,children:n(ve,{defaultValue:r,onSubmit:s=>{const f=s.trim()===""?r:s.trim();d(f,f)},placeholder:o})})},rr=async(e,r)=>{const t=r?.default??"";if(!m())return t;const{badge:i}=r??{};return E(o=>n(Te,{badge:i,defaultValue:t,finish:o,message:e,placeholder:r?.placeholder}),t)},Ne=({badge:e,defaults:r,finish:t,message:i,options:o})=>{const{answer:c,submit:d}=R(t),[s,f]=S(0),[p,x]=S(()=>new Set(r));return U(),B((b,v)=>{if(!(c!==void 0||o.length===0)){if(v.upArrow)f(h=>(h-1+o.length)%o.length);else if(v.downArrow)f(h=>(h+1)%o.length);else if(b===" "){const h=o[s];h!==void 0&&x(C=>{const _=new Set(C);return _.has(h.value)?_.delete(h.value):_.add(h.value),_})}else if(v.return){const h=o.filter(C=>p.has(C.value));d(h.map(C=>C.value),h.length>0?h.map(C=>C.label).join(", "):"none")}}}),c!==void 0?n(g,{answer:c,badge:e,message:i}):n(D,{badge:e,message:i,children:a(u,{flexDirection:"column",children:[n(l,{dimColor:!0,children:"space toggles · enter confirms · esc cancels"}),o.map((b,v)=>{const h=v===s;return n(l,{color:h?w:void 0,children:`${h?"▸ ":"  "}${p.has(b.value)?"◼":"◻"} ${ne(b)}`},b.value)})]})})},tr=async(e,r,t)=>{const i=t?.defaults??[];if(!m()||r.length===0)return[...i];const{badge:o}=t??{};return E(c=>n(Ne,{badge:o,defaults:i,finish:c,message:e,options:r}),[...i])},ye=({badge:e,defaultYes:r,finish:t,message:i})=>{const{answer:o,submit:c}=R(t);return o!==void 0?n(g,{answer:o,badge:e,message:i}):a(u,{children:[e===void 0?null:n(ee,{spec:e}),n(l,{bold:!0,children:e===void 0?`${i} `:` ${i} `}),n(he,{defaultChoice:r?"confirm":"cancel",onCancel:()=>{c(!1,"No")},onConfirm:()=>{c(!0,"Yes")}})]})},Ee=async(e,r)=>{const t=r?.defaultYes===!0;if(!m())return t;const{badge:i}=r??{};return E(o=>n(ye,{badge:i,defaultYes:t,finish:o,message:e}),!1)},nr=()=>m()?e=>Ee(e,{defaultYes:!0}):()=>Promise.resolve(!1),W="#c8a8ff",L="#d9c8ff",$e="#6b5b9a",P=({moon:e,prefix:r,suffix:t})=>a(u,{children:[n(l,{color:W,dimColor:!0,children:r}),typeof e=="string"?n(l,{color:L,children:e}):e,t===void 0?null:n(l,{color:W,children:t})]}),X=({left:e,right:r})=>a(l,{color:L,children:[e,n(l,{color:$e,children:"●●"}),r]}),ge=()=>a(u,{flexDirection:"column",paddingX:1,children:[n(P,{moon:".-‐-.",prefix:"·      ✦          ·      ",suffix:"     ✦"}),n(P,{moon:n(X,{left:"/",right:"\\"}),prefix:"      ✦      ·           ",suffix:"   ·"}),n(P,{moon:n(X,{left:"\\",right:"/"}),prefix:"  .        ✦      ·      "}),a(u,{children:[n(l,{bold:!0,color:w,children:"      lunora init "}),n(l,{dimColor:!0,children:"· moonrise sequence"}),n(l,{color:L})]})]}),or=async e=>{m()&&await N(a(u,{flexDirection:"column",children:[n(ge,{}),n(u,{paddingX:1,children:n(l,{dimColor:!0,children:e})})]}))},Re=({label:e})=>a(u,{children:[n(l,{color:w,children:n(pe,{type:"dots"})}),a(l,{children:[" ",e]})]}),ir=async(e,r)=>{if(!m())return r();V();const t=H(n(Re,{label:e}));try{return await r()}finally{t.unmount()}},cr=async()=>{m()&&await N(a(u,{paddingX:1,children:[n(l,{color:L,children:ce}),a(u,{flexDirection:"column",marginLeft:2,children:[n(l,{bold:!0,color:w,children:le}),n(l,{children:se})]})]}))},_e="#06b6d4",k=" ".repeat(9),lr=async e=>{m()&&await N(n(l,{bold:!0,children:`${k}${e}`}))},sr=async e=>{m()&&await N(a(u,{children:[n(l,{color:_e,children:`${T}◼`}),n(l,{children:`  ${e}`})]}))},ar=async(e,r,t,i)=>{m()&&await N(a(u,{flexDirection:"column",children:[n($,{badge:e,message:r}),n(u,{flexDirection:"column",marginTop:1,children:t.map(o=>a(l,{children:[`${k}${o.lead} `,n(l,{color:w,children:o.code}),o.tail??""]},o.lead))}),n(u,{flexDirection:"column",marginTop:1,children:i.map(o=>a(l,{children:[`${k}${o.lead} `,n(l,{color:w,children:o.code}),o.tail??""]},o.lead))})]}))},Y="#a855f7",oe="#06b6d4",y=[Y,"#9b51f6","#8a5cf6","#6f86f6","#4aa6ef","#2bb6dd","#12bcd0",oe],O=y.length-2,F=(e,r)=>Array.from({length:Math.max(0,e)},()=>r),q=[...F(y.length-1,Y),...y,...F(y.length-1,oe),...y.toReversed()],M=q.map((e,r)=>{const t=q.slice(r,r+O);return[...t,...F(O-t.length,Y)]}),Ae=" ".repeat(Math.max(0,z-O)),ie=({label:e})=>{const[r,t]=S(0);de(()=>{t(o=>(o+1)%M.length)},90);const i=M[r%M.length]??[];return a(l,{children:[Ae,i.map((o,c)=>n(l,{color:o,children:"█"},c)),` ${e}`]})},De=({label:e,status:r})=>r==="running"?n(l,{color:w,children:`${T}▶ ${e}`}):r==="failed"?n(l,{color:"red",children:`${T}✖ ${e}`}):r==="done"?n(l,{dimColor:!0,children:`${T}■ ${e}`}):n(l,{dimColor:!0,children:`${T}□ ${e}`}),Le=async(e,r)=>{const t=[];let i;for(const[o,c]of e.entries()){r(o,"running");try{t.push(await c.run()),r(o,"done")}catch(d){r(o,"failed"),i=d;break}}return{failure:i,results:t}},Pe=(e,r,t,i)=>{let o=!0;return Le(e,(d,s)=>{o&&r(f=>f.map((p,x)=>x===d?s:p))}).then(({failure:d,results:s})=>{setTimeout(()=>{o&&(t(s,d),i())},400)}).catch(()=>{}),()=>{o=!1}},Me=({end:e,onSettle:r,start:t,tasks:i})=>{const{exit:o}=I(),[c,d]=S(()=>i.map(()=>"pending"));A(()=>Pe(i,d,r,o),[o,r,i]);const s=c.length>0&&c.every(f=>f==="done");return a(u,{flexDirection:"column",children:[s?a(u,{children:[n(l,{bold:!0,color:"green",children:`${T}✔`}),n(l,{bold:!0,color:"green",children:` ${e}`})]}):n(ie,{label:t}),i.map((f,p)=>n(De,{label:f.label,status:c[p]??"pending"},f.label))]})},ur=async(e,r)=>{if(!m()){const o=[];for(const c of e)o.push(await c.run());return o}let t=[],i;if(await G(n(Me,{end:r.end,onSettle:(o,c)=>{t=o,i=c},start:r.start,tasks:e})),i!==void 0)throw Q(i);return t},ke=async(e,r)=>{const t=[];let i;for(const[o,c]of e.entries()){r(o);try{t.push(await c.task())}catch(d){i=d;break}}return{failure:i,values:t}},Oe=({badge:e,done:r,onSettle:t,steps:i})=>{const{exit:o}=I(),[c,d]=S(0),[s,f]=S(!1);return A(()=>{let p=!0,x;return ke(i,v=>{p&&d(v)}).then(({failure:v,values:h})=>{if(p){if(v!==void 0){t({error:v,ok:!1}),o();return}f(!0),x=setTimeout(()=>{p&&(t({ok:!0,values:h}),o())},400)}}).catch(()=>{}),()=>{p=!1,x!==void 0&&clearTimeout(x)}},[o,t,i]),s?n($,{badge:e,message:r}):n(ie,{label:i[c]?.running??""})},dr=async(e,r,t)=>{if(!m()){const o=[];for(const c of r)o.push(await c.task());return o}let i;if(await G(n(Oe,{badge:e,done:t,onSettle:o=>{i=o},steps:r})),i===void 0)throw new K;if(!i.ok)throw Q(i.error);return i.values};export{rr as a,Ee as b,nr as c,cr as d,Ze as e,or as f,tr as g,lr as h,sr as i,ar as j,ur as k,dr as l,er as t,ir as w};

package/dist/packem_shared/vectorize-metadata-DbziRKpX.mjs

@@ -0,0 +1 @@
+const p=/(?:key|password|secret|token)$/iu,x=e=>p.test(e),g=e=>{switch(e){case"boolean":return"boolean";case"date":case"number":case"timestamp":return"number";case"id":case"literal":case"string":return"string";default:return}},l=/already (?:exists|indexed)|duplicate/iu,i=e=>["vectorize","create-metadata-index",e.index,`--property-name=${e.property}`,`--type=${e.type}`],m=async(e,n)=>{try{return await e(n)}catch(r){return{code:1,stderr:r instanceof Error?r.message:String(r)}}},y=async e=>{const{cwd:n,entries:r,exec:o,logger:d,spawner:u}=e,s=[];for(const t of r){const a=await m(u,{args:[...o.args,...i(t)],captureStderr:!0,command:o.command,cwd:n,stdoutToStderr:!0});if(a.code===0){s.push({entry:t,status:"created"});continue}const c=`${a.stderr??""}${a.stdout??""}`;if(l.test(c)){s.push({entry:t,status:"exists"});continue}s.push({entry:t,error:c.trim()||`exit code ${String(a.code)}`,status:"failed"}),d.warn(`could not create the Vectorize metadata index for "${t.property}" on "${t.index}" — filters on that property will match nothing until it exists. Run: wrangler ${i(t).join(" ")}`)}return s};export{i as c,y as e,x as i,g as m};

package/dist/packem_shared/wrangler-name-Dsk5K1f-.mjs

@@ -0,0 +1 @@
+import{findWranglerFile as a,readWranglerJsonc as t}from"@lunora/config/cloudflare";const i=n=>{const e=a(n);if(!e)return;const{parsed:r}=t(e);return typeof r?.name=="string"&&r.name.length>0?r.name:void 0};export{i as r};

package/dist/packem_shared/wrangler-secrets-CCdt0mUl.mjs

@@ -0,0 +1 @@
+import{resolveDeployDriver as c,resolveProjectTarget as d,execArgsFor as l,detectPackageManager as i}from"@lunora/config";import{defaultSpawner as m}from"./createRecordingSpawner-DJlNacZ6.mjs";const u=async(e,t,o)=>{try{const r=await m({args:t,captureStderr:!0,captureStdoutSilently:!0,command:e,cwd:o});return{code:r.code,stderr:r.stderr??"",stdout:r.stdout??""}}catch(r){return{code:1,stderr:r instanceof Error?r.message:String(r),stdout:""}}},f=e=>{let t;try{t=JSON.parse(e)}catch{return}return Array.isArray(t)?[...t.map(r=>r!==null&&typeof r=="object"?r.name:void 0).filter(r=>typeof r=="string"&&r.length>0)].toSorted((r,n)=>r.localeCompare(n)):void 0},y=async e=>{const t=c(d(e.cwd)).toolchain?.secretList({environment:e.env,temporary:e.temporary});if(t===void 0)return{error:"deploy target has no command-line toolchain",names:[],ok:!1};const{args:o,command:r}=l(i(e.cwd),t.tool,t.args),a=await(e.runner??u)(r,o,e.cwd);if(a.code!==0)return{error:a.stderr.trim()||`wrangler secret list exited ${String(a.code)}`,names:[],ok:!1};const s=f(a.stdout);return s===void 0?{error:"could not parse `wrangler secret list --format json` output",names:[],ok:!1}:{names:s,ok:!0}};export{y as l};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lunora/cli",
-  "version": "1.0.0-alpha.21",
-  "description": "The Lunora CLI: init, dev, deploy, codegen, run, reset, and migrate commands",
+  "version": "1.0.0-alpha.210",
+  "description": "The Lunora CLI: init, dev, deploy, codegen, migrate, seed, doctor, insights, logs, registry, and the rest of the project commands",
   "keywords": [
     "agent-skills",
     "cli",
@@ -51,26 +51,48 @@
     "access": "public"
   },
   "dependencies": {
-    "@bomb.sh/tab": "0.0.16",
-    "@lunora/codegen": "1.0.0-alpha.7",
-    "@lunora/config": "1.0.0-alpha.11",
-    "@lunora/container": "1.0.0-alpha.1",
-    "@lunora/d1": "1.0.0-alpha.4",
-    "@lunora/seed": "1.0.0-alpha.2",
-    "@visulima/cerebro": "3.0.0-alpha.32",
-    "@visulima/fs": "5.0.0-alpha.32",
-    "@visulima/pail": "4.0.0-alpha.22",
-    "@visulima/path": "3.0.0-alpha.13",
-    "@visulima/spinner": "1.0.0-alpha.4",
-    "@visulima/tui": "1.0.0-alpha.26",
+    "@bomb.sh/tab": "0.0.22",
+    "@lunora/advisor": "1.0.0-alpha.100",
+    "@lunora/bindings": "1.0.0-alpha.42",
+    "@lunora/codegen": "1.0.0-alpha.143",
+    "@lunora/config": "1.0.0-alpha.177",
+    "@lunora/container": "1.0.0-alpha.37",
+    "@lunora/d1": "1.0.0-alpha.98",
+    "@lunora/errors": "1.0.0-alpha.26",
+    "@lunora/mcp": "1.0.0-alpha.100",
+    "@lunora/runtime": "1.0.0-alpha.83",
+    "@lunora/seed": "1.0.0-alpha.95",
+    "@visulima/cerebro": "3.0.6",
+    "@visulima/error": "6.1.0",
+    "@visulima/fs": "6.0.0",
+    "@visulima/pail": "4.1.1",
+    "@visulima/path": "4.0.0",
+    "@visulima/spinner": "1.0.1",
+    "@visulima/tui": "4.0.0",
+    "@visulima/tui-kit": "1.0.3",
+    "adm-zip": "0.6.0",
     "cfonts": "^3.3.1",
-    "giget": "3.3.0",
+    "csv-parse": "7.0.2",
+    "giget": "3.3.1",
     "jsonc-parser": "^3.3.1",
-    "magic-string": "^0.30.21",
-    "react": "^19.2.7",
+    "magic-string": "^1.1.0",
+    "react": "^19.2.8",
     "react-reconciler": "^0.33.0",
+    "smol-toml": "1.7.1",
     "ts-morph": "^28.0.0"
   },
+  "peerDependencies": {
+    "mysql2": "*",
+    "pg": "*"
+  },
+  "peerDependenciesMeta": {
+    "mysql2": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"
   }

package/skills/README.md

@@ -9,21 +9,39 @@ framework correctly. They ship inside `@lunora/cli` and are discovered by the
 Each skill is a `SKILL.md` with YAML frontmatter (`name`, `description`) in its
 own directory:
 
-| Skill                      | Use for                                                                     |
-| -------------------------- | --------------------------------------------------------------------------- |
-| `lunora`                   | Router — start here, then switch to the matching skill below.               |
-| `lunora-quickstart`        | `lunora init` / adding Lunora to an app + first round-trip.                 |
-| `lunora-functions`         | Core authoring rules — schema, validators, query/mutation/action, `ctx.db`. |
-| `lunora-realtime`          | Client reactivity — live hooks, optimistic updates, `@lunora/db`.           |
-| `lunora-setup-auth`        | Authentication via `lunora registry add auth` (+ providers).                |
-| `lunora-setup-mail`        | Transactional email via `lunora registry add mail` — `sendEmail` actions.   |
-| `lunora-setup-storage`     | R2 file storage via `lunora registry add storage` — signed upload/download. |
-| `lunora-setup-scheduler`   | Deferred (`ctx.scheduler`) + cron jobs (`lunora registry add crons`).       |
-| `lunora-create-package`    | Building a reusable registry item or `@lunora/*` package.                   |
-| `lunora-migration-helper`  | Schema/data migrations, `.global()` D1 flow, the drift gate.                |
-| `lunora-deploy`            | Deploying to Cloudflare — wrangler bindings, secrets, the gate.             |
-| `lunora-performance-audit` | Scans, indexes, OCC write conflicts, sharding/`.global()`.                  |
+| Skill                            | Use for                                                                      |
+| -------------------------------- | ---------------------------------------------------------------------------- |
+| `lunora`                         | Router — start here, then switch to the matching skill below.                |
+| `lunora-quickstart`              | `lunora init` / adding Lunora to an app + first round-trip.                  |
+| `lunora-functions`               | Core authoring rules — schema, validators, query/mutation/action, `ctx.db`.  |
+| `lunora-realtime`                | Client reactivity — live hooks, optimistic updates, `@lunora/db`.            |
+| `lunora-setup-auth`              | Authentication via `lunora registry add auth` (+ providers).                 |
+| `lunora-setup-mail`              | Transactional email via `lunora registry add mail` — `sendEmail` actions.    |
+| `lunora-setup-storage`           | R2 file storage via `lunora registry add storage` — signed upload/download.  |
+| `lunora-setup-scheduler`         | Deferred (`ctx.scheduler`) + cron jobs (`lunora registry add crons`).        |
+| `lunora-setup-hyperdrive`        | Existing Postgres/MySQL from an action — `ctx.sql`, non-reactive.            |
+| `lunora-setup-hyperdrive-global` | Postgres/MySQL as a reactive `.global()` backend; D1 → Hyperdrive migration. |
+| `lunora-create-package`          | Building a reusable registry item or `@lunora/*` package.                    |
+| `lunora-migration-helper`        | Schema/data migrations, `.global()` DDL flow, the drift gate.                |
+| `lunora-deploy`                  | Deploying to Cloudflare — wrangler bindings, secrets, the gate.              |
+| `lunora-performance-audit`       | `lunora insights`, scans, indexes, OCC conflicts, sharding/`.global()`.      |
 
-These are mirrored into `.agents/skills/` and `.claude/skills/` (via symlinks)
-so agents working inside this repo pick them up directly. The source of truth
-lives here so the published `@lunora/cli` tarball carries them.
+These are mirrored (via symlinks) into `.agents/skills/` and `.claude/skills/`,
+so agents working inside this repo pick them up directly, and into
+`plugins/lunora/skills/`, the payload of the Claude Code / Codex plugin. The
+source of truth lives here so the published `@lunora/cli` tarball carries them —
+`lunora rules install` copies this directory into a consumer project.
+
+**Adding a skill?** Create it here, then mirror it through all three hops:
+
+```bash
+ln -s ../../packages/cli/skills/<name> .agents/skills/<name>
+ln -s ../../.agents/skills/<name> .claude/skills/<name>
+ln -s ../../../packages/cli/skills/<name> plugins/lunora/skills/<name>
+```
+
+`scripts/check-skill-mirrors.js` (run on every `pnpm install`) fails if a mirror
+is missing, dangling, or has become a real directory — a copied directory keeps
+resolving while it silently drifts from the source, so it is treated as an
+error rather than a warning. Forget a hop and it prints the exact `ln -s` for
+the one you missed, so `pnpm install` is the shortest path to the right command.

package/skills/lunora/SKILL.md

@@ -14,8 +14,9 @@ Lunora exposes a Convex-style functional API (`defineSchema`, `query`,
 `mutation`, `action`) on top of Cloudflare Workers and Durable Objects. State
 lives in a per-app `ShardDO` (SQLite, OCC, hibernated WebSocket subscriptions)
 by default; `.shardBy(key)` partitions it across many DOs and `.global()`
-replicates a table to D1 for low-latency cross-region reads. A Vite plugin
-drives codegen and end-to-end type sync.
+replicates a table to D1 — or to Postgres/MySQL over Hyperdrive — for
+low-latency cross-region reads. A Vite plugin drives codegen and end-to-end
+type sync.
 
 If a more specific Lunora skill clearly matches the request, use that instead.
 
@@ -47,12 +48,13 @@ After codegen is green, use the most specific Lunora skill for the task:
 - Wiring live data into a client (hooks, optimistic updates): `lunora-realtime`
 - Authentication setup (email/password, OAuth, magic link, OTP):
   `lunora-setup-auth`
-- Wiring a prebuilt capability (mail, file storage, scheduled jobs, rate
-  limiting, vectors, AI, containers, payments, MCP): install it with
-  `lunora registry add <item>` (see `lunora registry list`). Capabilities with a
-  dedicated skill: `lunora-setup-mail` (mail), `lunora-setup-storage` (R2 file
-  storage), `lunora-setup-scheduler` (deferred `ctx.scheduler` + cron jobs). For
-  the rest, read the item's README after installing.
+- Transactional email: `lunora-setup-mail`
+- R2 file storage (signed upload/download): `lunora-setup-storage`
+- Deferred work (`ctx.scheduler`) and cron jobs: `lunora-setup-scheduler`
+- Querying an **existing** Postgres/MySQL database from an action (`ctx.sql`,
+  non-reactive): `lunora-setup-hyperdrive`
+- Using Postgres/MySQL as a **reactive `.global()` backend**, or migrating a D1
+  `.global()` dataset onto it: `lunora-setup-hyperdrive-global`
 - Building a reusable capability — a registry item or an `@lunora/*` package:
   `lunora-create-package`
 - Planning or running a schema/data migration: `lunora-migration-helper`
@@ -61,9 +63,61 @@ After codegen is green, use the most specific Lunora skill for the task:
 - Investigating performance, scan, or write-conflict issues:
   `lunora-performance-audit`
 
+**Reviewing or auditing existing `lunora/` code** has no skill of its own,
+because two commands do the work mechanically — run them before reading
+anything:
+
+```bash
+lunora verify    # wrangler config + codegen dry-run + tsc --noEmit
+lunora advisor   # the static + runtime lint set, scored per procedure
+```
+
+`lunora advisor` is the security/quality review: RLS coverage, ownership and
+identity checks, fail-open guards, input validators, unindexed reads,
+non-deterministic calls in queries, SQL interpolation, and leaked secrets. It
+prints each finding's own lint id and category, so read its output rather than
+grepping for rule names. Use `--entry <file>#<export>` to inspect one procedure
+and `--min-score` / `--baseline` to gate CI. Only after it is clean is a by-hand
+pass over `lunora-functions` worth the tokens.
+
 If one of those clearly matches the user's goal, switch to it instead of staying
 in this skill.
 
+## Capabilities Without a Dedicated Skill
+
+Most other capabilities install as a **registry item** — `lunora registry add
+<item>` scaffolds the `lunora/` glue, wrangler bindings, and env vars, then
+prints post-install steps. Browse with `lunora registry list`; preview with
+`lunora registry view <item>`. Read the installed item's README, and the
+package's `docs/` for the API.
+
+| Goal                                          | Install / package                                            |
+| --------------------------------------------- | ------------------------------------------------------------ |
+| Background jobs on Cloudflare Queues          | `registry add queue` → `@lunora/queue` (`ctx.queues`)        |
+| Durable multi-step workflows                  | `registry add workflow` → `@lunora/workflow` (`ctx.runStep`) |
+| Durable AI agents (tool loops, HITL, memory)  | `@lunora/agent` (`defineAgent`)                              |
+| Workers AI / RAG                              | `registry add ai` → `@lunora/ai` (`ctx.ai`, `defineRag`)     |
+| Feature flags (OpenFeature)                   | `registry add flags` → `@lunora/flags` (`ctx.flags`)         |
+| Payments (Stripe / Polar)                     | `registry add payment` → `@lunora/payment`                   |
+| Rate limiting                                 | `registry add ratelimit` → `@lunora/ratelimit`               |
+| Headless browser (action-only)                | `registry add browser` → `@lunora/browser` (`ctx.browser`)   |
+| Cloudflare Containers                         | `@lunora/container` (`defineContainer`, `ctx.containers`)    |
+| Presence / who's-here                         | `registry add presence`                                      |
+| Cloudflare Access (Zero Trust) identity       | `registry add cloudflare-access`                             |
+| Backup / restore                              | `registry add backup`                                        |
+| Testing (in-memory harness, agent doubles)    | `@lunora/testing` (`lunoraTest`)                             |
+| Deterministic seed data                       | `@lunora/seed` + `lunora seed`                               |
+| Local-first replica / offline mirror          | `@lunora/replica`                                            |
+| Exposing the deployment to AI agents over MCP | `@lunora/mcp`                                                |
+
+Scaffolding inside this repo uses `vis generate lunora-<kind>` — `query`,
+`mutation`, `action`, `http-route`, `table`, `cron`, `container`, `workflow`,
+`queue`, `step`, `agent`, `flags`, `collections`, `package` (`vis generate
+--list` for the full set). Most take a name: **always** pass it as
+`--name=value`, since vis parses a space-separated `--name foo` as `--name=true`
+plus a stray positional. `lunora-flags` and `lunora-collections` are singletons
+and take no name.
+
 ## Core Mental Model
 
 - **Functions** live in `lunora/*.ts` and are one of `query` (reactive read),
@@ -75,7 +129,9 @@ in this skill.
 - **Reads go through indexes.** Prefer `ctx.db.query("t").withIndex(...)` over
   `.filter(...)`; declare the index with `.index("by_x", ["x"])`.
 - **Clients** subscribe over WebSocket. `useQuery`/`useMutation` (React, Vue,
-  Solid, Svelte) re-render the moment a mutation changes the queried rows.
+  Solid, Svelte, React Native; signals in Angular) re-render the moment a
+  mutation changes the queried rows. Subscriptions run under the socket's
+  verified identity, so `rls()` / `ctx.auth` apply to live updates too.
 
 ## When Not to Use
 

package/skills/lunora-functions/SKILL.md

@@ -150,9 +150,44 @@ Declare the index and constrain with `.withIndex`.
 
 ## Other `ctx` capabilities
 
-`ctx.auth` (the resolved session: `ctx.auth.userId`), `ctx.scheduler`
-(`runAfter` / `runAt` for deferred work), `ctx.storage` (R2), `ctx.vectors`
-(Vectorize), and — when their packages are wired — `ctx.ai` and `ctx.containers`.
+Always available:
+
+- `ctx.auth` — the resolved session (`ctx.auth.userId`).
+- `ctx.scheduler` — `runAfter` / `runAt` for deferred work.
+- `ctx.secrets` — Cloudflare Secrets Store.
+- `ctx.span` / `ctx.trace` — the current span and a scoped tracing helper for
+  wide events.
+
+Added by their package when wired. **A dependency in `package.json` is not
+enough** — codegen scans the `lunora/` source set and flips a capability on only
+when a file there imports the `@lunora/*` package or reads its `ctx.*` helper.
+So write the call first, then run `lunora codegen` to surface the typed context:
+
+| `ctx.*`                                                                                   | Package                       |
+| ----------------------------------------------------------------------------------------- | ----------------------------- |
+| `ctx.storage`                                                                             | `@lunora/storage` (R2)        |
+| `ctx.ai`                                                                                  | `@lunora/ai` (Workers AI)     |
+| `ctx.flags`                                                                               | `@lunora/flags` (OpenFeature) |
+| `ctx.queues.<name>`                                                                       | `@lunora/queue`               |
+| `ctx.workflows` / `ctx.runStep`                                                           | `@lunora/workflow`            |
+| `ctx.containers`                                                                          | `@lunora/container`           |
+| `ctx.browser` (action-only)                                                               | `@lunora/browser`             |
+| `ctx.sql` (action-only)                                                                   | `@lunora/hyperdrive`          |
+| `ctx.kv` / `ctx.images` / `ctx.analytics` / `ctx.pipelines` / `ctx.vectors` / `ctx.r2sql` | `@lunora/bindings` subpaths   |
+
+Two exceptions to the usage scan, and one extra requirement:
+
+- **`ctx.flags` gates on a declaration file**, not on usage — codegen wires it
+  only when `lunora/flags.ts` exists (`vis generate lunora-flags` creates it).
+  `ctx.notify` / `ctx.push` work the same way via `lunora/notify.ts`.
+- **`ctx.sql` also needs the real resource.** Codegen types the field, but the
+  connection needs a `HYPERDRIVE` binding (`wrangler hyperdrive create`) and an
+  explicit `createHyperdrive(ctx.env.HYPERDRIVE)` + driver adapter in the
+  action — see `lunora-setup-hyperdrive`. Bindings codegen can provision on its
+  own (e.g. `BROWSER` for `ctx.browser`) need no manual wrangler step.
+
+`ctx.browser` and `ctx.sql` are **action-only** by design — they are
+non-deterministic and would break query reactivity and mutation replay.
 
 ## HTTP endpoints
 

package/skills/lunora-migration-helper/SKILL.md

@@ -2,7 +2,8 @@
 name: lunora-migration-helper
 description: Plans Lunora schema and data migrations with widen-migrate-narrow. Use for
     breaking schema changes, backfills, table reshaping, online data migrations
-    (`defineMigration` + `lunora migrate up`), the `.global()` D1 SQL flow, and the
+    (`defineMigration` + `lunora migrate up`), the `.global()` D1 / Hyperdrive
+    structural flows, and the
     pre-deploy schema-drift gate.
 ---
 
@@ -15,7 +16,7 @@ Safely change a Lunora schema and migrate data when making breaking changes.
 - Adding required fields to existing tables.
 - Changing field types or structure.
 - Splitting/merging tables, renaming/removing fields.
-- Reshaping `.global()` (D1-backed) tables.
+- Reshaping `.global()` tables (D1- or Hyperdrive-backed).
 
 ## When Not to Use
 
@@ -23,21 +24,35 @@ Safely change a Lunora schema and migrate data when making breaking changes.
 - Adding **optional** fields that need no backfill.
 - Adding new tables or indexes with no correctness concern.
 
-## Two Storage Layers — Know Which You Are Migrating
+## Storage Layers — Know Which You Are Migrating
 
-Lunora tables live in one of two backends, and they migrate differently:
+Lunora tables live in one of three backends, and they migrate differently:
 
 - **ShardDO SQLite (default `root`, and `.shardBy(key)` tables).** State lives in
   the per-app / per-shard Durable Object. Data is reshaped with **online data
   migrations** — `defineMigration` declarations run by `lunora migrate up`,
   resumable per shard.
-- **`.global()` tables (D1).** Replicated to D1 for cross-region reads. Their
-  structural DDL gets versioned **SQL migrations** via `lunora migrate generate`,
-  applied by `@lunora/d1`'s runner at deploy time.
-
-A breaking change to a `.global()` table needs a generated SQL migration; a data
-backfill (either layer) is an online `defineMigration`. Both follow the same
-**widen → migrate → narrow** discipline.
+- **`.global()` on D1 (the default global backend).** Replicated to D1 for
+  cross-region reads. Structural DDL gets versioned **SQL migrations** via
+  `lunora migrate generate`, applied by `@lunora/d1`'s runner at deploy time.
+- **`.global({ backend: "hyperdrive" })` on Postgres/MySQL.** The same reactive
+  `.global()` contract served over Cloudflare Hyperdrive. Structural DDL works
+  differently here: tables **auto-provision on first use** — the runtime applies
+  the DDL through the dialect — so there is no `lunora migrate generate` step
+  and no versioned SQL file to commit. See `lunora-setup-hyperdrive-global`.
+
+So: a breaking structural change to a **D1-backed** `.global()` table needs a
+generated SQL migration; the Hyperdrive-backed equivalent provisions itself. A
+data backfill (any layer) is always an online `defineMigration`. All three
+follow the same **widen → migrate → narrow** discipline — check the table's
+backend before assuming which structural path applies.
+
+> **Moving an existing dataset between global backends.** To move a `.global()`
+> dataset from D1 onto Hyperdrive, use
+> `lunora migrate d1-to-hyperdrive --from-url <d1-worker> --to-url <hd-worker>`
+> (`--tables` scopes it; `--out` keeps the intermediate NDJSON dump). This is a
+> backend move, not a schema change — the widen → migrate → narrow discipline
+> below still governs any reshaping you do on either side of it.
 
 ## Key Principle: Widen, Migrate, Narrow
 
@@ -115,6 +130,40 @@ export default defineMigration({
 The transform must preserve row identity — the runner always keeps the original
 `_id` / `_creationTime`, so do not change them.
 
+### Reading another table
+
+The transform's second argument is a **shard-scoped reader** (`ctx.db` with
+`get` / `findFirst` / `findMany` / `count`), so the common backfill — read the
+parent, copy a field down onto its children — is expressible. It may be `async`.
+
+```ts
+up: async (doc, ctx) => {
+    const thread = await ctx.db.get(String(doc.threadId), "threads");
+
+    return thread ? { ...doc, userId: thread.userId } : undefined;
+},
+```
+
+It is a reader, not a writer: the runner accounts for exactly one rewrite per
+row read, and a transform writing directly would make that count describe
+something other than what happened. To touch a second table, run a second
+migration over that table.
+
+### A shard key cannot be backfilled by a migration
+
+If the field you are backfilling **is** the table's `.shardBy()` key, this is the
+wrong tool, and no amount of reader access fixes it:
+
+- a row whose shard key is unset does not belong to any shard, so a shard-scoped
+  query will never enumerate it; and
+- writing the key would have to **move the row to a different Durable Object**,
+  which a per-shard runner has no way to do.
+
+Re-keying is an export → transform → import (`lunora export`, rewrite the NDJSON,
+`lunora import` — ids are preserved, so foreign keys survive), not a migration.
+So the rule elsewhere in this skill that a data backfill is always an online
+`defineMigration` has this one exception.
+
 ### Run it
 
 ```bash
@@ -129,7 +178,10 @@ lunora migrate down backfill-display-name      # revert (if `down` defined)
 Useful flags: `--batch-size <n>`, `--steps <n>` (cap batches this run), and
 `--prod --url <worker> --yes` to target production (with `LUNORA_ADMIN_TOKEN`).
 
-## `.global()` (D1) Structural Migration Flow
+## `.global()` on D1 — Structural Migration Flow
+
+This flow is **D1-specific**. Hyperdrive-backed globals auto-provision their DDL
+at runtime and skip it entirely.
 
 ```bash
 # 1. Edit lunora/schema.ts (widen: add the optional new field to the .global() table).
@@ -146,8 +198,8 @@ lunora deploy
 ```
 
 `lunora migrate generate` only considers `.global()` tables (root/sharded tables
-are not D1-backed). Run it after each schema edit in the widen and narrow steps;
-backfill data with an online migration between them.
+live in ShardDO SQLite, not D1). Run it after each schema edit in the widen and
+narrow steps; backfill data with an online migration between them.
 
 ## The Schema-Drift Gate
 
@@ -176,9 +228,10 @@ add the migration — not to bypass it.
    transform before it touches real rows.
 5. **Deleting a field prematurely.** Deprecate with `v.optional` + a comment;
    delete only once nothing references it.
-6. **Migrating the wrong layer.** A `.global()` structural change needs `lunora
-migrate generate` (SQL); a data backfill needs a `defineMigration`. Check the
-   table's `.global()` / `.shardBy()` modifier first.
+6. **Migrating the wrong layer.** A D1-backed `.global()` structural change needs
+   `lunora migrate generate` (SQL); a Hyperdrive-backed one auto-provisions; a
+   data backfill needs a `defineMigration`. Check the table's `.global()` /
+   `.shardBy()` modifier — and, for `.global()`, its `backend` — first.
 
 ## Checklist
 

package/skills/lunora-performance-audit/SKILL.md

@@ -2,8 +2,8 @@
 name: lunora-performance-audit
 description: Diagnoses and fixes Lunora performance problems — full-table scans, missing
     indexes, OCC write conflicts, oversized subscriptions, and sharding/`.global()`
-    scaling. Use when queries are slow, mutations conflict, or `@lunora/advisor`
-    flags a table.
+    scaling. Use when queries are slow, mutations conflict, `lunora insights`
+    reports a hot-spot, or `@lunora/advisor` flags a table.
 ---
 
 # Lunora Performance Audit
@@ -34,12 +34,35 @@ apply it across sibling functions consistently.
 
 ## Signal Gathering
 
-Start with the static advisors — they need no traffic:
+### Runtime signal: `lunora insights`
+
+When the worker is running and has served traffic, start here — it reports the
+measured problem, not a suspected one:
+
+```bash
+lunora insights                      # against the local dev worker
+lunora insights --shard channel:demo # scope to one shard
+lunora insights --limit 25 --json    # machine-readable, more rows
+lunora insights --prod --url https://app.example.com --token $LUNORA_ADMIN_TOKEN
+```
+
+It ranks per-function **write-conflict hot-spots** (OCC contention — the
+sharding signal), **error rates**, and **latency outliers**. A function at the
+top of the write-conflict list is the direct input to the OCC section below; a
+latency outlier usually resolves to the read-amplification section.
+
+The Studio **Issues** panel and `lunora logs` cover the error side in more
+detail once `insights` tells you where to look.
+
+### Static signal: the advisors
+
+These need no traffic, so they also work on a cold codebase:
 
 - **Lunora Studio → Advisors tab** surfaces `@lunora/advisor` findings live in
   dev.
-- `@lunora/advisor` runs static lints over `defineSchema` + discovered query
-  reads / insert writes. Relevant performance/schema rules:
+- `@lunora/advisor` runs ~90 static lints over `defineSchema` + discovered query
+  reads / insert writes (plus a few runtime lints). The performance/schema rules
+  most relevant here:
     - `filter-without-index` — a query filters a table with no covering index.
     - `unindexed-foreign-key` — a relation/FK column has no index.
     - `duplicate-index` / `empty-index` — wasted or malformed indexes.
@@ -75,7 +98,8 @@ column. Fix every sibling query on the table the same way.
 
 ## Problem Class: Write Conflicts (OCC)
 
-**Symptom:** mutations on hot rows retry or fail under concurrency. ShardDO uses
+**Symptom:** mutations on hot rows retry or fail under concurrency, or the
+function tops the write-conflict section of `lunora insights`. ShardDO uses
 optimistic concurrency control — concurrent writes to the same DO that touch
 overlapping state conflict and retry.
 
@@ -115,6 +139,11 @@ cross-region reads (with read-your-writes via the Sessions API). Reserve it for
 read-mostly tables — `.global()` adds the D1 migration flow (see the
 `lunora-migration-helper` skill) and write-path cost.
 
+If the dataset outgrows D1, `.global({ backend: "hyperdrive" })` serves the same
+reactive `.global()` contract from Postgres/MySQL over Cloudflare Hyperdrive —
+see the `lunora-setup-hyperdrive-global` skill (and `lunora migrate
+d1-to-hyperdrive` to move an existing dataset).
+
 ### `.shardBy(key)` vs `.global()` — choose one per table
 
 - `.shardBy(key)`: partitions a table across Durable Objects by key — scales
@@ -135,6 +164,7 @@ read-mostly tables — `.global()` adds the D1 migration flow (see the
 ## Checklist
 
 - [ ] Scoped one concrete flow; traced every `ctx.db` read/write.
+- [ ] Ran `lunora insights` (if the worker has traffic) for the measured signal.
 - [ ] Checked the Studio Advisors tab / `@lunora/advisor` findings.
 - [ ] Read amplification: replaced `.filter()` with an indexed `.withIndex()`.
 - [ ] Write conflicts: narrowed writes and/or partitioned with `.shardBy(key)`.