getaura 0.1.10 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getaura",
-  "version": "0.1.10",
+  "version": "0.4.0",
   "description": "Aura helps you and your coding agent follow best practices while you vibe code.",
   "type": "module",
   "bin": {
@@ -11,12 +11,14 @@
     "templates",
     "README.md",
     ".claude-plugin",
-    "plugin"
+    "plugin",
+    "LICENSE",
+    "THIRD-PARTY-NOTICES.md"
   ],
   "engines": {
     "node": ">=22"
   },
-  "license": "UNLICENSED",
+  "license": "FSL-1.1-MIT AND MIT-0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/JohnFazio1/aura.git"
@@ -44,6 +46,7 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
+    "@getaura/rules": "workspace:*",
     "@getaura/shared": "workspace:*",
     "@types/node": "^26.6.5",
     "tsup": "^8.5.1",

package/plugin/skills/{scan → check}/SKILL.md

@@ -1,15 +1,15 @@
 ---
-name: scan
+name: check
 description: Check this repo's Aura score and explain what Aura found, in plain language.
 disable-model-invocation: true
 allowed-tools: Bash
 ---
 
-Run `aura scan --json` from the repository root. If `aura` isn't found, run `npx getaura scan --json` instead.
+Run `aura check --json` from the repository root. If `aura` isn't found, run `npx getaura check --json` instead.
 
 Then tell the user, in plain language for a non-technical founder:
 
-1. The Aura score (0–100) and its label, and the score for each category.
+1. The Aura score (0–100) and its label, and the score for each category, and what Aura scored the repo as (`profile.projects`). If a project's `confidence` is `low`, ask the user whether that's right; if they say no, run `aura config kind <kind> [folder]` with the kind they describe and check again.
 2. The most serious findings first: what could happen to the business or its users, not just the technical term. Group the rest instead of listing everything.
 3. One clear recommendation for what to do next, and offer to do it (`/aura:fix`).
 

package/plugin/skills/fix/SKILL.md

@@ -13,8 +13,10 @@ If the user named nothing to fix, run `aura next --json` (or `npx getaura next -
 Follow the step's `delivery`:
 
 - `pr`: run `aura apply <action> --yes`. Tell the user a pull request was opened and what to check before merging.
-- `agent-fix`: run `aura fix <action> --yes` to have Aura's agent make the change in a pull request. If that fails because there's no pilot key, run `aura fix <action> --agent` and complete the task file it writes yourself: on a new branch `aura/<id>`, keep the change small, run the tests, lint and type check, then open a pull request with `gh pr create` and a plain-language description.
+- `agent-fix`: run `aura fix <action> --yes` to have Aura's agent make the change in a pull request. If Aura's agent isn't available (for example, the key's monthly agent budget is used up), run `aura fix <action> --agent` and complete the task file it writes yourself: on a new branch `aura/<id>`, keep the change small, run the tests, lint and type check, then open a pull request with `gh pr create` and a plain-language description.
 - `guide`: run `aura guide <topic>` and walk the user through it step by step. These are things they do in a dashboard, not in the code.
 - `checklist`: run `aura inventory --json`, show the user which services and accounts Aura found, and ask them to run `aura inventory` in their own terminal to record who owns each account.
 
-Afterwards, run `aura scan --json` and tell the user the new score. Never disable, weaken or ignore a check to raise the score, and never repeat a secret value.
+Large changes need the user's approval first. If `aura fix` or `aura apply` stops with exit code 3 and says the change is large, show the user the breakdown it printed (also saved in `.aura/plans/<action>.md`) in plain words: what will change, why, what won't change, the risk and the chunks. Ask whether to go ahead. Only after they clearly say yes, run the same command again with `--approved` added; `--yes` doesn't count as their approval. Each run does one chunk in one pull request: tell the user which chunk was opened and how many are left, and run the command with `--approved` again for the next chunk when they want to continue.
+
+Afterwards, run `aura check --json` and tell the user the new score. Never disable, weaken or ignore a check to raise the score, and never repeat a secret value.

package/plugin/skills/next/SKILL.md

@@ -12,8 +12,10 @@ Show the steps as a short numbered list, most important first. For each: the tit
 Ask the user which ones they want done. For each one they choose, follow its `delivery`:
 
 - `pr`: run `aura apply <action id> --yes` and tell the user what to check in the pull request.
-- `agent-fix`: run `aura fix <action id> --yes` (without a pilot key, `aura fix <action id> --agent`, then complete the task file it writes).
+- `agent-fix`: run `aura fix <action id> --yes` (if Aura's agent isn't available, `aura fix <action id> --agent`, then complete the task file it writes).
 - `guide`: run `aura guide <topic>` and walk the user through it.
 - `checklist`: run `aura inventory --json`, show the user which services and accounts Aura found, and ask them to run `aura inventory` in their own terminal to record who owns each account.
 
-Afterwards, run `aura scan --json` and tell the user the new score.
+If a command stops with exit code 3 because the change is large, show the user the breakdown it printed (also in `.aura/plans/<action>.md`) in plain words and ask whether to go ahead. Only after they clearly say yes, run it again with `--approved` (`--yes` doesn't count). Each run does one chunk in one pull request; tell the user how many chunks are left.
+
+Afterwards, run `aura check --json` and tell the user the new score.

package/plugin/skills/pr/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: pr
+description: Wrap up the session: turn the uncommitted work into focused pull requests that follow good practice.
+disable-model-invocation: true
+allowed-tools: Bash
+---
+
+Run `aura pr --dry-run --json` from the repository root. If `aura` isn't found, run `npx getaura pr --dry-run --json` instead.
+
+It returns the pull requests Aura would open, in the order to merge them. Each has an `id`, `title`, `why` (why it's a pull request of its own), `files`, `lines`, `large` and `heldBack` (files that contain a secret). `leftOut` lists files that stay on the computer, and `blocker` says why nothing can be opened yet.
+
+1. If `blocker` is set, tell the user in plain words what to do first and stop.
+2. If a group has `heldBack` files, tell the user a secret was found (by file, never the value), move it into `.env.local` and read it with `process.env`, then run the dry run again.
+3. Write `.aura/tasks/pr-notes.json` with a note for each group you know about: `{ "<id>": { "title": "...", "summary": "...", "check": ["..."] } }`. The title says what changed in a few words. The summary explains, in plain language, what changed and why. `check` lists what the user should try before merging. Describe only work you did or can see in the files.
+4. Show the user the plan: one line per pull request with its title and file count, which ones are `large` (suggest splitting them by feature), and what's left out. Ask whether to open them.
+5. Only after they say yes, run `aura pr --yes --notes .aura/tasks/pr-notes.json`. To open only some, add `--only <id>,<id>`.
+
+Then tell the user which pull requests were opened, the order to merge them, and to run `git pull` after merging. Never merge a pull request yourself.

package/plugin/skills/setup/SKILL.md

@@ -9,7 +9,7 @@ Run `npx getaura@latest init --yes --agent claude` from the repository root and
 
 - **Sign-in link**: ask the user to open it and paste their pilot key in the browser. Never ask for the key in chat. If the command stops while waiting, run it again once they've finished: it carries on with the same link.
 - **Product brief questions**: suggest answers from the code and let the user confirm or correct them, save them as it describes, and run the command it gives.
-- **The `aura` command**: if it says to install it, run that command so the user can type `aura scan` from now on.
+- **The `aura` command**: if it says to install it, run that command so the user can type `aura check` from now on.
 
 If a command fails because the network or writing outside the project is blocked (sandboxed agents such as Codex), ask the user to approve running it with network access. Aura needs the network for sign-in and npm, and writes its settings to `~/.aura`.
 

package/templates/LICENSE

@@ -0,0 +1,16 @@
+MIT No Attribution
+
+Copyright 2026 John Fazio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this
+software and associated documentation files (the "Software"), to deal in the Software
+without restriction, including without limitation the rights to use, copy, modify,
+merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/templates/README.md

@@ -1,6 +1,6 @@
 # Aura templates
 
-Files the Aura CLI copies into a user's repository, usually through a pull request. Each file is plain text with `{{name}}` placeholders that the CLI fills in.
+Files the Aura CLI copies into a user's repository, usually through a pull request. Each file is plain text with `{{name}}` placeholders that the CLI fills in. They're licensed to users under MIT-0 (`LICENSE` here, which is not itself copied), so users own their copies outright.
 
 ## Placeholder rules
 
@@ -79,6 +79,10 @@ Agent Skills format: YAML frontmatter with `name` (matches the folder) and `desc
 | `security-headers.md` | Not copied. Snippet the CLI or agent merges into `next.config` | `add-security-headers` |
 | `env-example-header.txt` | Top of `.env.example` | `add-env-example` |
 
+### Next.js pages (`nextjs/`)
+
+`error.tsx`, `global-error.tsx` and `not-found.tsx` → the app's `app/` (or `src/app/`) folder (`add-error-pages`), only when that page doesn't exist yet. No `{{placeholders}}`: the generator replaces each ` className="aura-page|title|text|button|link"` marker with Tailwind classes (theme colours such as `bg-primary` when the app defines shadcn/ui-style tokens), or with inline layout styles (never colours) when the app has no Tailwind, and drops the `Props` type for `.jsx`. `global-error.tsx` keeps inline styles because the app's stylesheet isn't loaded there.
+
 ### Guides (`guides/<topic>.md`)
 
 Printed by `aura guide <topic>`. Frontmatter: `title`, `summary` (one sentence), `services` (array). Body: numbered steps and a "Check it worked" section.
@@ -89,6 +93,6 @@ Mapping from secret service ids to guides: `github` → `rotate-github-token`; `
 
 ### PR bodies (`pr/<action>.md`)
 
-One per PR action id: `add-brief`, `add-agent-rules`, `install-skills`, `token-efficiency`, `add-ci`, `setup-testing`, `add-env-example`, `add-linting`, `add-pre-commit`, `add-readme`, `enable-dependency-updates`, `fix-vulnerable-deps`, `add-security-headers`, `remove-dead-files`, `move-misplaced-files`, `add-aura-workflow`, `foundation`.
+One per PR action id: `add-brief`, `add-agent-rules`, `install-skills`, `token-efficiency`, `add-ci`, `setup-testing`, `add-env-example`, `add-linting`, `add-pre-commit`, `add-readme`, `enable-dependency-updates`, `fix-vulnerable-deps`, `add-security-headers`, `remove-dead-files`, `move-misplaced-files`, `add-aura-workflow`, `add-error-pages`, `foundation`.
 
-Sections: "What this does", "Why it matters", "What to check before merging", then the footer `Opened by [Aura](https://github.com/JohnFazio1/aura) · {{aura_version}}`. The PR title is set by the CLI. `{{details}}` appears in `install-skills`, `token-efficiency`, `setup-testing`, `add-env-example`, `fix-vulnerable-deps`, `remove-dead-files`, `move-misplaced-files` and `foundation`.
+Sections: "What this does", "Why it matters", "What to check before merging", then the footer `Opened by [Aura](https://github.com/JohnFazio1/aura) · {{aura_version}}`. The PR title is set by the CLI. `{{details}}` appears in `install-skills`, `token-efficiency`, `setup-testing`, `add-env-example`, `fix-vulnerable-deps`, `remove-dead-files`, `move-misplaced-files`, `add-error-pages` and `foundation`.

package/templates/github/workflows/aura-weekly.yml

@@ -32,13 +32,13 @@ jobs:
 
       - name: Set up pnpm
         if: hashFiles('pnpm-lock.yaml') != ''
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: ${{ steps.pnpm.outputs.version }}
 
       - name: Set up Bun
         if: hashFiles('bun.lock', 'bun.lockb') != ''
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
       - uses: actions/setup-node@v5
         with:

package/templates/github/workflows/aura.yml

@@ -3,8 +3,9 @@
 # the allowed amount (ciMaxDrop in .aura/config.json, default 0; loosen it with
 # `aura config ciMaxDrop 3`). Aura's version is pinned so scores only change when
 # your code does; upgrade it deliberately by re-running `aura apply add-aura-workflow`.
-# Needs the AURA_PILOT_KEY repository secret for plain-language explanations
-# (run `aura guide add-aura-key-to-github`). It still scores without it.
+# Needs your Aura pilot key as the AURA_PILOT_KEY repository secret (run
+# `aura guide add-aura-key-to-github`); without it the check fails. Pull requests
+# from forks and Dependabot get no repository secrets, so Aura skips them.
 name: Aura score
 
 on:
@@ -37,13 +38,13 @@ jobs:
 
       - name: Set up pnpm
         if: hashFiles('pnpm-lock.yaml') != ''
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: ${{ steps.pnpm.outputs.version }}
 
       - name: Set up Bun
         if: hashFiles('bun.lock', 'bun.lockb') != ''
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
       - uses: actions/setup-node@v5
         with:
@@ -55,12 +56,19 @@ jobs:
 
       - name: Run Aura scan (pull request)
         id: scan
-        if: github.event_name == 'pull_request'
+        if: >-
+          github.event_name == 'pull_request'
+          && github.event.pull_request.head.repo.full_name == github.repository
+          && github.actor != 'dependabot[bot]'
         continue-on-error: true
         env:
           AURA_KEY: ${{ secrets.AURA_PILOT_KEY }}
           BASE_REF: ${{ github.base_ref }}
-        run: npx --yes getaura@{{aura_version}} scan --ci --base "origin/$BASE_REF" --comment-file aura-comment.md
+        run: npx --yes getaura@{{aura_version}} check --ci --base "origin/$BASE_REF" --comment-file aura-comment.md
+
+      - name: Skip Aura on forks and Dependabot
+        if: steps.scan.outcome == 'skipped' && github.event_name == 'pull_request'
+        run: echo "Aura skipped this pull request because it comes from a fork or Dependabot, which get no repository secrets."
 
       - name: Post Aura comment
         # Runs even when the scan failed. Skipped for forks and Dependabot,
@@ -80,11 +88,11 @@ jobs:
       - name: Fail if the score dropped
         if: github.event_name == 'pull_request' && steps.scan.outcome == 'failure'
         run: |
-          echo "The Aura score dropped more than allowed, or the scan failed. See the comment on the pull request."
+          echo "The Aura score dropped more than allowed, or the scan failed. See the comment on the pull request, or the log of the Aura scan step."
           exit 1
 
       - name: Run Aura scan (main)
         if: github.event_name == 'push'
         env:
           AURA_KEY: ${{ secrets.AURA_PILOT_KEY }}
-        run: npx --yes getaura@{{aura_version}} scan --ci
+        run: npx --yes getaura@{{aura_version}} check --ci

package/templates/github/workflows/ci.yml

@@ -32,13 +32,13 @@ jobs:
 
       - name: Set up pnpm
         if: hashFiles('pnpm-lock.yaml') != ''
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: ${{ steps.pnpm.outputs.version }}
 
       - name: Set up Bun
         if: hashFiles('bun.lock', 'bun.lockb') != ''
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
       - uses: actions/setup-node@v5
         with:

package/templates/guides/add-aura-key-to-github.md

@@ -1,12 +1,12 @@
 ---
 title: Add your Aura key to GitHub
-summary: Store your Aura pilot key as a GitHub Actions secret so pull request checks include plain-language explanations.
+summary: Store your Aura pilot key as a GitHub Actions secret so Aura can check every pull request.
 services: [github, aura]
 ---
 
 # Add your Aura key to GitHub
 
-The Aura workflow scores every pull request. With your pilot key stored as a repository secret, its comments also include plain-language explanations. The key is stored encrypted and never shown in logs.
+The Aura workflow scores every pull request, and like every Aura command it needs your pilot key. Store it as a repository secret: GitHub keeps it encrypted and never shows it in logs. Without it, the Aura check fails.
 
 ## Option 1: in the browser
 
@@ -29,6 +29,6 @@ Paste the key when asked and press Enter. Don't put the key in the command itsel
 ## Check it worked
 
 - **Settings → Secrets and variables → Actions** lists `AURA_PILOT_KEY` (the value stays hidden), or `gh secret list` shows it.
-- Open or update a pull request. The **Aura score** comment includes explanations.
+- Open or update a pull request. The **Aura score** check passes and posts its comment.
 
-Pull requests from Dependabot and from forks can't read repository secrets or post comments. The Aura check still runs on them, without a comment. That's expected.
+Pull requests from Dependabot and from forks can't read repository secrets, so Aura skips them. That's expected.

package/templates/guides/ai-spend-limits.md

@@ -0,0 +1,50 @@
+---
+title: Set spending caps for your AI providers
+summary: Set a monthly budget and usage alerts with OpenAI, Anthropic and Vercel AI Gateway, and revoke AI keys you don't use.
+services: [openai, anthropic, vercel]
+---
+
+# Set spending caps for your AI providers
+
+Every AI call costs money. A bug that calls the model in a loop, a public page someone abuses, or a leaked key can run up a large bill overnight. A monthly budget and an email alert with each provider limit the damage, even if something in the app goes wrong. This takes about fifteen minutes and needs the login that owns billing for each account.
+
+Only do the sections for the providers your app uses. If you're not sure, look at the environment variables in your hosting settings: names like `OPENAI_API_KEY`, `ANTHROPIC_API_KEY` or `AI_GATEWAY_API_KEY` tell you which ones.
+
+## Before you start
+
+1. Look at what you spent last month on each provider's usage or billing page, so you can pick a budget with some room above it.
+2. Decide who should get the alert emails. A shared company inbox is better than one person's email.
+
+## OpenAI
+
+1. Sign in at https://platform.openai.com and open **Settings**.
+2. Open **Limits** (it may be under Billing). Set a monthly budget, and set an email alert at a lower amount, for example half the budget.
+3. Read the wording next to the budget. Some budgets only send an email and don't stop requests; if so, the alert is your warning to act.
+4. If you use projects, each project can have its own budget in its settings. Give the project your app uses its own limit.
+
+## Anthropic
+
+1. Sign in to the Anthropic Console (https://console.anthropic.com) and open **Settings**.
+2. Open **Limits**. Set a monthly spend limit, and turn on email notifications at a lower amount.
+3. If your organization has several workspaces, check whether the workspace your app uses has its own limit and set one.
+
+## Vercel AI Gateway
+
+1. In the Vercel dashboard, open your team and then the **AI Gateway** page.
+2. Check how the gateway is paid for. If it tops up credits automatically, decide whether to turn that off or lower the top-up amount, so spending stops at an amount you chose.
+3. Look at the usage page to see which models and projects are spending, and check that it matches what you expect.
+
+## Check which keys exist
+
+Keys you don't use are risk with no benefit. Do this for each provider:
+
+1. Open the API keys page (OpenAI: https://platform.openai.com/api-keys; Anthropic: **Settings → API keys** in the Console; Vercel AI Gateway: the keys section of the AI Gateway page).
+2. Compare the list with the keys your app uses in its hosting settings and in GitHub Actions secrets.
+3. Revoke any key nobody can explain, any key for an old project, and any key that was ever pasted in a chat, email or code. If the page shows when a key was last used, a key unused for months is a good candidate.
+4. If you revoke a key the app still needs, the AI features stop working until you create a new key and put it in your hosting settings, so check twice before revoking.
+
+## Check it worked
+
+- Each provider you use shows a monthly budget or spend limit and an alert amount.
+- The API keys pages only list keys your app or your team actually uses.
+- Run `aura check` to check that AI routes need a sign-in, are rate-limited and limit the length of each answer.

package/templates/guides/database-backups.md

@@ -0,0 +1,61 @@
+---
+title: Check your database backups
+summary: Where Supabase keeps your database backups, how to download one before a risky change, and what point-in-time recovery is.
+services: [supabase]
+---
+
+# Check your database backups
+
+A backup is a copy of your database you can go back to if a migration goes wrong, a bug deletes data, or someone makes a mistake. Without one, lost data is gone for good. This takes about ten minutes.
+
+Aura only reads your backup status. It never creates, restores or deletes backups, and never changes your plan.
+
+## Where your backups are
+
+1. Sign in at https://supabase.com/dashboard and open your project.
+2. Open **Database**, then **Backups**.
+3. You'll see the list of daily backups and when each was taken, or the point-in-time recovery settings if that's on.
+
+Paid Supabase plans take a backup every day and keep them for a number of days that depends on the plan. The Free plan has no automatic backups, so on Free the only backups are the ones you download yourself (see below).
+
+If you're on a paid plan and the list is empty, or the newest backup is more than a few days old, contact Supabase support from the dashboard (**Help** or **Support**): daily backups should run on their own.
+
+## Download a backup before a risky change
+
+Before a big migration, a data clean-up or anything that deletes data, keep your own copy.
+
+On a paid plan, the **Backups** page lets you download a daily backup.
+
+You can also save a copy with the Supabase CLI on any plan. It needs Docker Desktop running. Run these from your project folder, one line at a time (they work in PowerShell, Command Prompt, Git Bash and macOS or Linux terminals):
+
+```
+npx supabase db dump --linked -f "../db-backup-roles.sql" --role-only
+```
+
+```
+npx supabase db dump --linked -f "../db-backup-schema.sql"
+```
+
+```
+npx supabase db dump --linked -f "../db-backup-data.sql" --data-only --use-copy
+```
+
+This saves three files in the folder above your project, so they can't be committed by mistake. The data file holds your users' data: keep it somewhere private, never commit it to git, and never paste it into a chat. Delete it once you no longer need it.
+
+## Point-in-time recovery
+
+Point-in-time recovery (PITR) backs up the database continuously, so you can restore it to any second instead of to last night's backup. That matters when losing a day of orders or sign-ups would hurt.
+
+- It's a paid add-on on paid plans, and it costs extra every month, so whether it's worth it is your decision. Aura only mentions it; it never counts against your score.
+- While it's on, Supabase stops taking daily backups, because PITR covers them.
+- You turn it on in the dashboard under **Database → Backups** (or the project's add-ons).
+
+## Check it worked
+
+- **Database → Backups** shows a backup from the last day or two, or point-in-time recovery is on.
+- Before your next risky change, you have a downloaded copy in a private place.
+- Aura reads backups at most once a day. To read them again now (this only reads, nothing is changed), run:
+
+  ```
+  aura apply supabase-security --dry-run
+  ```

package/templates/guides/github-security.md

@@ -8,7 +8,7 @@ services: [github]
 
 These settings stop broken or unsafe code from reaching `main`, catch secrets before they're pushed, and warn you about vulnerable packages. They take about ten minutes. You need admin access to the repository.
 
-**Aura can do steps 1 to 4 for you**: run `aura apply github-security` (or pick "Turn on GitHub security features" after `aura scan`). It turns on everything your plan allows and tells you what's left. Use the steps below to do it by hand.
+**Aura can do steps 1 to 4 for you**: run `aura apply github-security` (or pick "Turn on GitHub security features" after `aura check`). It turns on everything your plan allows and tells you what's left. Use the steps below to do it by hand.
 
 Some features on private repositories need a paid GitHub plan. Where that applies, it's noted below.
 
@@ -62,4 +62,4 @@ Available on public repositories.
 
 - Try pushing directly to `main` (`git push origin main` with a small change). GitHub rejects it.
 - **Settings → Advanced Security** shows secret scanning, push protection, Dependabot alerts and security updates as enabled (where your plan allows).
-- Run `aura scan`; the GitHub settings findings are gone.
+- Run `aura check`; the GitHub settings findings are gone.

package/templates/guides/install-github-cli.md

@@ -47,4 +47,4 @@ Run:
 gh auth status
 ```
 
-It shows "Logged in to github.com" with your username. Then run `aura scan` again.
+It shows "Logged in to github.com" with your username. Then run `aura check` again.

package/templates/guides/rotate-generic-key.md

@@ -30,7 +30,7 @@ For a private key (`-----BEGIN PRIVATE KEY-----`), generate a new key pair where
 
 - The old key no longer appears in the service's dashboard, or shows as revoked.
 - The feature that uses it works in your live app.
-- Run `aura scan` to confirm Aura no longer finds the secret in your code.
+- Run `aura check` to confirm Aura no longer finds the secret in your code.
 
 ## About git history
 

package/templates/guides/sync-migrations.md

@@ -0,0 +1,88 @@
+---
+title: Bring the live database and the migrations back in step
+summary: Review how the live Supabase database differs from supabase/migrations, apply pending migrations yourself, and pull changes made by hand into a new migration.
+services: [supabase]
+---
+
+# Bring the live database and the migrations back in step
+
+The files in `supabase/migrations/` are meant to describe your live database exactly: every table, column and row-level security policy. Aura found a difference. Either the repo has migrations the live database hasn't run yet (so the app may expect tables or security rules that don't exist), or the live database has changes that aren't in the repo (so nobody can rebuild it, and other environments drift apart). The versions are listed in the findings: run `aura check` to see them.
+
+Aura only reads your database. It never applies, changes or repairs migrations for you: you run each command below yourself, once you're sure. Run the commands from your project folder, one line at a time. They work the same in PowerShell, Command Prompt, Git Bash and macOS or Linux terminals.
+
+## Before you start
+
+1. Take a backup first. Follow `aura guide database-backups` (it shows how to download one), so you can go back if something goes wrong.
+2. Sign in to the Supabase CLI and check this folder is linked to the right project (the live one, not a test project):
+
+   ```
+   npx supabase login
+   ```
+
+   ```
+   npx supabase projects list
+   ```
+
+   The linked project has a dot or tick next to it. If it's the wrong one, run `npx supabase link` and pick the right project.
+
+## 1. Review the difference
+
+```
+npx supabase migration list --linked
+```
+
+This prints two columns. **Local** is the files in `supabase/migrations/`; **Remote** is what the live database has run. A version in Local with an empty Remote is waiting to be applied. A version in Remote with an empty Local was applied to the database but has no file in the repo.
+
+Open each waiting file (`supabase/migrations/<version>_<name>.sql`) and read what it does. Ask your coding agent to explain it in plain words if it helps. Look out for anything that deletes tables, columns or rows.
+
+## 2. Apply migrations that are waiting
+
+Once you're sure the waiting migrations are right, first see exactly what would run, without changing anything:
+
+```
+npx supabase db push --dry-run
+```
+
+Then apply them to the live database:
+
+```
+npx supabase db push
+```
+
+This changes your live database, which is why Aura never runs it for you. If it says some migrations are older than the last one applied, check those files carefully, then run `npx supabase db push --include-all`.
+
+## 3. Bring changes made by hand into the repo
+
+If the live database has migrations that aren't in the repo, first ask whoever made them. If they came from another branch, the simplest fix is to merge that branch, or copy its migration files into `supabase/migrations/` unchanged.
+
+If the changes were made by hand (in the Supabase dashboard's table editor or SQL editor), capture them in a new migration file. This needs Docker Desktop running:
+
+```
+npx supabase db pull
+```
+
+It creates a new file in `supabase/migrations/` describing the live database's changes, and can record it as applied. If it says the migration history doesn't match, it prints `npx supabase migration repair …` commands. Those only change the list of applied migrations, not your tables or data, but only run them if you understand what they mark, then run `npx supabase db pull` again. Review the new file and commit it.
+
+## Never edit an applied migration
+
+A migration the live database has already run is history: changing its file doesn't change the database, and it makes the repo describe something that never happened. To change a table or a policy, always write a new migration. Your coding agent's `database-migrations` skill explains how.
+
+## Check it worked
+
+1. Both columns match:
+
+   ```
+   npx supabase migration list --linked
+   ```
+
+2. Aura reads the live database at most once a day. To read it again now (this only reads, nothing is changed):
+
+   ```
+   aura apply supabase-security --dry-run
+   ```
+
+3. Then check your score:
+
+   ```
+   aura check
+   ```

package/templates/guides/sync-vercel-env.md

@@ -0,0 +1,56 @@
+---
+title: Add the missing environment variables in Vercel
+summary: Set the environment variables your code uses in Vercel, for Production and Preview, without pasting secrets anywhere unsafe.
+services: [vercel]
+---
+
+# Add the missing environment variables in Vercel
+
+Your code reads settings such as API keys and addresses from environment variables. On your computer they come from your `.env.local` file, but Vercel never sees that file: every variable the live site needs has to be added in Vercel too. A missing one can make a page crash or a feature quietly stop working, often only after you deploy.
+
+`aura next` and `aura check` list the names that are missing. Aura only reads the names of your Vercel variables, never their values, and it never changes anything in Vercel, so you add them yourself. It takes a few minutes.
+
+**Never paste a secret value into a chat with your coding agent, an issue, a pull request or a commit.** Type or paste values only into the Vercel dashboard or the Vercel CLI prompt.
+
+## Find each value
+
+1. Open `.env.example` in your repo. Each line names a variable, and the comment above it usually says what it's for and where to get it (for example "Stripe dashboard → Developers → API keys").
+2. If you already run the app on your computer, the value is in your `.env.local` file. Use the live (production) key for Production and a test key for Preview where the service has one, such as Stripe's test keys.
+3. If you can't tell what a variable is for or where its value comes from, ask your coding agent to explain it from the code. Ask it to describe the variable, not to fill in the value.
+4. If the app works fine without a variable (it has a default, or it's only for local development or tests), you don't need to add it. Write "optional" in its comment in `.env.example`, for example `# Optional: requests per minute (default 60)`, and Aura stops listing it.
+
+## Add them in the Vercel dashboard
+
+1. Open your project at https://vercel.com, then **Settings → Environment Variables**.
+2. For each missing name, enter the name exactly as listed (capital letters and underscores matter) and its value.
+3. Tick the environments it's for: **Production** for the live site, **Preview** for pull request previews, and **Development** if you use `vercel env pull` or `vercel dev`. Most variables need all three.
+4. For keys and passwords, turn on **Sensitive** so nobody can read the value back later.
+5. Click **Save**.
+
+## Or add them with the Vercel CLI
+
+Run these from the folder you linked with `vercel link`. Each command asks for the value, so it never ends up in your terminal history. Run one command per line, replacing `NAME` with the variable's name:
+
+```
+vercel env add NAME production
+vercel env add NAME preview
+```
+
+When the preview command asks for a git branch, leave it empty so every preview gets the variable. To see the names you've set (values stay hidden), run:
+
+```
+vercel env ls
+```
+
+## Make the live site use them
+
+Vercel only applies new variables to new deployments. Push a commit, or open the latest deployment in the Vercel dashboard and choose **Redeploy**. Aura never deploys for you.
+
+## Clean up old variables
+
+If Aura says some variables are set in Vercel but never used in the code, they may be left over from a feature you removed. Check with your team, then delete the ones nobody needs in **Settings → Environment Variables**. If one was a key, revoke it in the service's dashboard too.
+
+## Check it worked
+
+1. Run `aura apply vercel-security --dry-run` to read the names from Vercel again straight away. It only reads; it changes nothing.
+2. Run `aura check`. The environment variable check passes once every variable your code needs is set for Production and Preview.

package/templates/nextjs/error.tsx

@@ -0,0 +1,23 @@
+"use client";
+
+// Shown when something on a page breaks. Visitors never see the technical details:
+// in production Next.js only sends the browser a short reference code (error.digest),
+// which matches the full error in your server logs.
+
+type Props = {
+  error: Error & { digest?: string };
+  reset: () => void;
+};
+
+export default function ErrorPage({ error, reset }: Props) {
+  return (
+    <main className="aura-page">
+      <h1 className="aura-title">Something went wrong</h1>
+      <p className="aura-text">Sorry, this page didn’t load. Please try again. If it keeps happening, come back in a few minutes.</p>
+      <button type="button" onClick={() => reset()} className="aura-button">
+        Try again
+      </button>
+      {error.digest ? <p className="aura-text">Reference: {error.digest}</p> : null}
+    </main>
+  );
+}

package/templates/nextjs/global-error.tsx

@@ -0,0 +1,27 @@
+"use client";
+
+// Shown when the root layout itself breaks. It replaces the whole page, including <html>
+// and <body>, so the app's stylesheet isn't loaded here: keep the styles inline and simple.
+// Visitors never see the technical details, only a short reference code (error.digest).
+
+type Props = {
+  error: Error & { digest?: string };
+  reset: () => void;
+};
+
+export default function GlobalError({ error, reset }: Props) {
+  return (
+    <html lang="en">
+      <body style={{ fontFamily: "system-ui, sans-serif", margin: 0 }}>
+        <main style={{ maxWidth: "32rem", margin: "0 auto", padding: "4rem 1rem", textAlign: "center", lineHeight: 1.5 }}>
+          <h1>Something went wrong</h1>
+          <p>Sorry, the app didn’t load. Please try again. If it keeps happening, come back in a few minutes.</p>
+          <button type="button" onClick={() => reset()} style={{ font: "inherit", padding: "0.5rem 1rem", cursor: "pointer" }}>
+            Try again
+          </button>
+          {error.digest ? <p>Reference: {error.digest}</p> : null}
+        </main>
+      </body>
+    </html>
+  );
+}