getaura 0.3.0 → 0.4.0

package/dist/index.js

@@ -978,10 +978,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path51) {
-  if (!path51)
+function getElementAtPath(obj, path52) {
+  if (!path52)
     return obj;
-  return path51.reduce((acc, key) => acc?.[key], obj);
+  return path52.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1321,11 +1321,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path51, issues) {
+function prefixIssues(path52, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path51);
+    iss.path.unshift(path52);
     return iss;
   });
 }
@@ -1775,16 +1775,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path51 = []) => {
+  const processError = (error63, path52 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path51, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else {
-        const fullpath = [...path51, ...issue2.path];
+        const fullpath = [...path52, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1823,17 +1823,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path51 = []) => {
+  const processError = (error63, path52 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path51, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else {
-        const fullpath = [...path51, ...issue2.path];
+        const fullpath = [...path52, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1872,8 +1872,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path51 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path51) {
+  const path52 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path52) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -18975,13 +18975,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path51 = ref.slice(1).split("/").filter(Boolean);
-  if (path51.length === 0) {
+  const path52 = ref.slice(1).split("/").filter(Boolean);
+  if (path52.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path51[0] === defsKey) {
-    const key = path51[1] === void 0 ? void 0 : decodeJSONPointerSegment(path51[1]);
+  if (path52[0] === defsKey) {
+    const key = path52[1] === void 0 ? void 0 : decodeJSONPointerSegment(path52[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -20931,7 +20931,7 @@ async function ghStatus(root) {
   const remote = await git(root, "remote", "get-url", "origin");
   return { installed: true, authed: auth.code === 0, hasRemote: remote.code === 0 && /github\.com/.test(remote.stdout) };
 }
-var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura(?:-(?:check|scan|next|fix|setup))?\/|\.cursor\/commands\/aura-[a-z]+\.md$|\.pi\/prompts\/aura-[a-z]+\.md$|\.claude\/settings\.json$)/;
+var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura(?:-(?:check|scan|next|fix|setup|pr))?\/|\.cursor\/commands\/aura-[a-z]+\.md$|\.pi\/prompts\/aura-[a-z]+\.md$|\.claude\/settings\.json$)/;
 async function dirtyFiles(root) {
   const r = await git(root, "status", "--porcelain", "-uall");
   return r.stdout.split("\n").filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop() ?? "").filter((f) => !AURA_OWNED.test(f) && !isLocalOnly(f));
@@ -21076,11 +21076,11 @@ var github = {
       isPrivate: Boolean(info.isPrivate),
       defaultBranch: info.defaultBranchRef?.name || "main",
       gh,
-      get: (path51) => {
-        let result = cache3.get(path51);
+      get: (path52) => {
+        let result = cache3.get(path52);
         if (!result) {
-          result = gh(["api", path51]);
-          cache3.set(path51, result);
+          result = gh(["api", path52]);
+          cache3.set(path52, result);
         }
         return result;
       }
@@ -22244,8 +22244,8 @@ function applyOverride(profile, o) {
     profile.evidence = ["set in .aura/config.json", ...profile.evidence];
   }
 }
-function setKindOverride(overrides = [], path51, kind) {
-  const at = normPath(path51);
+function setKindOverride(overrides = [], path52, kind) {
+  const at = normPath(path52);
   const rest = overrides.filter((o) => normPath(o.path) !== at);
   const existing = overrides.find((o) => normPath(o.path) === at);
   const next = { ...existing, path: at, kind };
@@ -22284,7 +22284,7 @@ function describeProject(p2) {
 // package.json
 var package_default = {
   name: "getaura",
-  version: "0.3.0",
+  version: "0.4.0",
   description: "Aura helps you and your coding agent follow best practices while you vibe code.",
   type: "module",
   bin: {
@@ -22381,11 +22381,11 @@ function briefSummary(root, pkg2) {
   const file2 = auraPath(root, "brief.md");
   if (!existsSync7(file2)) return { name: fallbackName, summary: pkg2?.description ?? "See `.aura/brief.md` once the product brief is added." };
   const text = readFileSync5(file2, "utf8");
-  const title = text.match(/^#\s+(.+)$/m)?.[1]?.replace(/[:\-–—]?\s*product brief$/i, "").trim();
+  const title2 = text.match(/^#\s+(.+)$/m)?.[1]?.replace(/[:\-–—]?\s*product brief$/i, "").trim();
   const paragraph = text.split(/\n\s*\n/).map((p2) => p2.trim()).find((p2) => p2 && !p2.startsWith("#") && !p2.startsWith(">") && !p2.startsWith("-") && !p2.startsWith("|") && p2.length > 40) ?? "";
   const sentences = paragraph.replace(/\s+/g, " ").match(/[^.!?]+[.!?]+/g) ?? [paragraph];
   return {
-    name: title || fallbackName,
+    name: title2 || fallbackName,
     summary: sentences.slice(0, 3).map((x) => x.trim()).join(" ")
   };
 }
@@ -23568,7 +23568,7 @@ function unreachableFiles(files, read2, pkgScripts) {
 // src/actions/agent-commands.ts
 import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
 import path15 from "path";
-var AURA_COMMANDS = ["check", "next", "fix", "setup"];
+var AURA_COMMANDS = ["check", "next", "fix", "setup", "pr"];
 var RETIRED_COMMANDS = ["scan"];
 function invocation(agent, command) {
   return agent === "claude" ? `/aura:${command}` : agent === "codex" ? `$aura-${command}` : `/aura-${command}`;
@@ -23581,7 +23581,7 @@ function pluginCommand(command) {
 }
 function adapt(agent, body) {
   const args = agent === "pi" ? "Fix: $@\n\n" : "Fix the action or finding the user named after the command, if any.\n\n";
-  return body.replace(/\/aura:(check|next|fix|setup)\b/g, (_, c) => invocation(agent, c)).replace("Fix: $ARGUMENTS\n\n", args).replace("--agent claude", `--agent ${agent}`);
+  return body.replace(/\/aura:(check|next|fix|setup|pr)\b/g, (_, c) => invocation(agent, c)).replace("Fix: $ARGUMENTS\n\n", args).replace("--agent claude", `--agent ${agent}`);
 }
 function commandFiles(agent, command) {
   if (agent === "cursor") return [`.cursor/commands/aura-${command}.md`];
@@ -23676,8 +23676,8 @@ function agentSafetyChanges(root, agents2) {
 }
 function leftForYou(root, tracked, unreadable) {
   const notes = dangerousSettings(root, tracked).map((d) => {
-    const { title, detail } = describeDanger(d);
-    return `- **${title}.** ${detail} If you didn\u2019t mean to allow this, remove it from \`${d.file}\`.`;
+    const { title: title2, detail } = describeDanger(d);
+    return `- **${title2}.** ${detail} If you didn\u2019t mean to allow this, remove it from \`${d.file}\`.`;
   });
   const unhides = cursorEnvUnhides(readRepoFile(root, CURSOR_IGNORE));
   if (unhides.length)
@@ -24829,7 +24829,7 @@ var AuraClient = class _AuraClient {
   get hasKey() {
     return Boolean(this.key);
   }
-  async request(method, path51, body, timeoutMs = 6e4) {
+  async request(method, path52, body, timeoutMs = 6e4) {
     if (!this.key) throw new AuraApiError("no_key", "No pilot key");
     let payload;
     if (body !== void 0) {
@@ -24839,7 +24839,7 @@ var AuraClient = class _AuraClient {
     }
     let res;
     try {
-      res = await fetch(`${this.baseUrl}/v1/${path51}`, {
+      res = await fetch(`${this.baseUrl}/v1/${path52}`, {
         method,
         headers: { authorization: `Bearer ${this.key}`, "content-type": "application/json", "user-agent": `getaura/${AURA_VERSION}` },
         body: payload,
@@ -28201,10 +28201,10 @@ var typecheck = {
   applies: (ctx) => ctx.stack.typescript,
   async observe(ctx) {
     if (ctx.options.fast) return { facts: { outcome: "skipped-fast-mode" }, items: [] };
-    const { existsSync: existsSync30 } = await import("fs");
-    const path51 = await import("path");
-    const tsc = path51.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-    if (!existsSync30(tsc)) return { facts: { outcome: "not-installed" }, items: [] };
+    const { existsSync: existsSync31 } = await import("fs");
+    const path52 = await import("path");
+    const tsc = path52.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+    if (!existsSync31(tsc)) return { facts: { outcome: "not-installed" }, items: [] };
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: ctx.root, timeoutMs: 18e4 });
     if (r.timedOut) return { facts: { outcome: "timed-out" }, items: [] };
     if (r.code === 0) return { facts: { outcome: "ran" }, items: [], engine: "tsc" };
@@ -32299,14 +32299,14 @@ function observedResult(pending2, answer) {
     const part = parts[f.part];
     const item = part?.items[Number(f.ref.slice(1))];
     const vars = item?.vars ?? {};
-    const [title, detail, why] = [fill2(f.title, vars), fill2(f.detail, vars), fill2(f.why, vars)];
-    if (!part || !item || title === null || detail === null || why === null) return { ...base2, status: "unknown", score: 0, summary: UPDATE, findings: [] };
+    const [title2, detail, why] = [fill2(f.title, vars), fill2(f.detail, vars), fill2(f.why, vars)];
+    if (!part || !item || title2 === null || detail === null || why === null) return { ...base2, status: "unknown", score: 0, summary: UPDATE, findings: [] };
     const finding = {
       id: item.id,
       checkId: check2.id,
       category: check2.category,
       severity: f.severity,
-      title,
+      title: title2,
       detail,
       why,
       locations: item.locations,
@@ -33508,7 +33508,7 @@ async function inventoryCommand(flags) {
   inv.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   writeAuraFile(root, "inventory.json", `${JSON.stringify(inv, null, 2)}
 `);
-  say.ok("Saved .aura/inventory.json. Commit it so the record travels with the code.");
+  say.ok("Saved .aura/inventory.json. Run `aura pr` when you\u2019re done to put it in a pull request, so the record travels with the code.");
   const personal = Object.entries(inv.services).filter(([, v]) => /@(?:gmail|yahoo|hotmail|outlook|icloud|proton)\./i.test(v.owner ?? ""));
   if (personal.length)
     say.info(
@@ -33760,9 +33760,9 @@ async function applyAction(actionId, flags, report) {
     large = { plan: breakdown, chunk, file: file2 };
   }
   const pm = pmCommands(scan.stack.packageManager);
-  const showChanges = (title, changes) => {
+  const showChanges = (title2, changes) => {
     console.log(`
-${pc.bold(title)}`);
+${pc.bold(title2)}`);
     for (const c of changes.changes)
       console.log(`  ${c.content === null ? pc.red("delete") : existsSync25(path42.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
     if (changes.devDeps?.length) console.log(`  ${pc.cyan("install")} ${changes.devDeps.join(", ")} ${pc.dim(`(${pm.addDev})`)}`);
@@ -34975,19 +34975,19 @@ async function summaryCommand(flags) {
       say.warn(`${friendlyApiError(err)} Using the standard summary.`);
     }
   }
-  const title = `Aura weekly summary: ${since.toISOString().slice(0, 10)} to ${until.toISOString().slice(0, 10)}`;
+  const title2 = `Aura weekly summary: ${since.toISOString().slice(0, 10)} to ${until.toISOString().slice(0, 10)}`;
   const body = `${summary.trim()}
 
 ---
 <sub>Posted by [Aura](https://github.com/JohnFazio1/aura). Run \`aura next\` for what to do next.</sub>
 `;
-  if (flags.json) printJson({ title, body, request: { ...req, product: void 0 } });
+  if (flags.json) printJson({ title: title2, body, request: { ...req, product: void 0 } });
   else console.log(`
-${title}
+${title2}
 
 ${body}`);
   if (flags.post) {
-    const r = await run("gh", ["issue", "create", "--title", title, "--body-file", "-"], { cwd: root, input: body });
+    const r = await run("gh", ["issue", "create", "--title", title2, "--body-file", "-"], { cwd: root, input: body });
     if (r.code !== 0) {
       say.error(`Couldn\u2019t post the summary as an issue: ${r.stderr.trim()}`);
       return 1;
@@ -35149,9 +35149,406 @@ async function updateCommand(flags, deps2 = { fetchLatest, run, argv1: process.a
   return 0;
 }
 
+// src/commands/pr.ts
+import { existsSync as existsSync29, readFileSync as readFileSync31, statSync as statSync6 } from "fs";
+import path51 from "path";
+
+// src/actions/pr-plan.ts
+var PR_MAX_LINES = 400;
+var PR_MAX_FILES = 25;
+var MAX_FILE_BYTES = 10 * 1024 * 1024;
+var LEFT_OUT_REASONS = {
+  local: "made by a tool on your computer",
+  "aura-local": "Aura\u2019s local notes; they can describe security weaknesses",
+  env: "may hold secrets; keep it out of git",
+  "too-big": "over 10 MB; large files don\u2019t belong in git"
+};
+var AURA_LOCAL = /^\.aura\/(?:report\.md|scan\.json|history\.json|fixes\.json|cache\/|tasks\/|plans\/)/;
+var ENV_FILE = /(?:^|\/)\.env(?:\.[^/]+)?$/;
+var ENV_EXAMPLE2 = /\.(?:example|sample|template)$/;
+var LOCKFILE = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|npm-shrinkwrap\.json)$/;
+var MANIFEST = /(?:^|\/)package\.json$/;
+var AGENT_SETUP2 = /(?:^|\/)(?:CLAUDE\.md|AGENTS\.md|\.cursorrules|\.mcp\.json)$|^(?:\.claude|\.agents|\.cursor|\.pi|\.codex)\/|^\.github\/copilot-instructions\.md$/;
+var CI = /^(?:\.github|\.husky)\//;
+var DATABASE = /(?:^|\/)supabase\//;
+var DOCS = /^(?:docs\/.*|[^/]+\.mdx?)$/;
+function leftOutReason(file2) {
+  if (AURA_LOCAL.test(file2.path)) return "aura-local";
+  if (isLocalOnly(file2.path)) return "local";
+  if (ENV_FILE.test(file2.path) && !ENV_EXAMPLE2.test(file2.path)) return "env";
+  if (file2.bytes > MAX_FILE_BYTES) return "too-big";
+  return null;
+}
+function kindOf(file2) {
+  if (file2 === ".aura/brief.md") return "docs";
+  if (file2.startsWith(".aura/")) return "aura-records";
+  if (AGENT_SETUP2.test(file2)) return "agent-setup";
+  if (CI.test(file2)) return "ci";
+  if (DATABASE.test(file2)) return "database";
+  if (LOCKFILE.test(file2) || MANIFEST.test(file2)) return "dependencies";
+  if (DOCS.test(file2)) return "docs";
+  return "code";
+}
+var ORDER2 = ["database", "dependencies", "code", "docs", "agent-setup", "ci", "aura-records"];
+var WHY = {
+  database: "Database changes are reviewed on their own and merged first, so the code that needs them never runs without them.",
+  dependencies: "Package updates are kept apart from feature work, so a problem can be traced to one or the other.",
+  code: "One area of the code per pull request keeps each review focused.",
+  docs: "Documentation only; nothing about how the app runs changes.",
+  "agent-setup": "Rules and skills for coding agents change how future work is done, so they get their own review.",
+  ci: "Automated checks and GitHub settings protect every future change, so they get their own review.",
+  "aura-records": "Aura\u2019s records describe the project, not its code, so they never mix with code changes."
+};
+var projectName = (project) => project === "." ? "the repo root" : project;
+function title(kind, files, projects) {
+  if (kind === "aura-records") {
+    const parts = [
+      files.some((f) => f.endsWith("inventory.json")) && "who owns each account",
+      files.some((f) => f.endsWith("config.json")) && "Aura settings"
+    ].filter(Boolean);
+    return parts.length ? `Aura: update ${parts.join(", ")}` : "Aura: update Aura\u2019s records";
+  }
+  if (kind === "code") return projects.length === 1 && projects[0] === "." ? "Code changes" : `Code changes in ${projects.map(projectName).join(", ")}`;
+  return {
+    database: "Database changes",
+    dependencies: "Update dependencies",
+    docs: "Update documentation",
+    "agent-setup": "Update coding agent rules and skills",
+    ci: "Update automated checks"
+  }[kind];
+}
+function planPrs(changed) {
+  const leftOut = [];
+  const keep = [];
+  for (const f of changed) {
+    const reason = leftOutReason(f);
+    if (reason) leftOut.push({ path: f.path, reason });
+    else keep.push(f);
+  }
+  const drafts = /* @__PURE__ */ new Map();
+  const keyOf2 = (kind, project) => kind === "code" ? `code:${project}` : kind;
+  const add = (key, kind, f) => {
+    const d = drafts.get(key) ?? { kind, projects: [], files: [], joined: [] };
+    if (!d.projects.includes(f.project)) d.projects.push(f.project);
+    d.files.push(f);
+    drafts.set(key, d);
+  };
+  for (const f of keep) {
+    const kind = kindOf(f.path);
+    add(keyOf2(kind, f.project), kind, f);
+  }
+  const codeKeys = () => [...drafts.keys()].filter((k) => k.startsWith("code:"));
+  const merge2 = (from, into, reason) => {
+    const src = drafts.get(from);
+    const dst = drafts.get(into);
+    if (!src || !dst || from === into) return;
+    dst.files.push(...src.files);
+    if (src.kind === "code") {
+      for (const p2 of src.projects) if (!dst.projects.includes(p2)) dst.projects.push(p2);
+    }
+    dst.joined.push(reason, ...src.joined);
+    drafts.delete(from);
+  };
+  const deps2 = drafts.get("dependencies");
+  if (deps2) {
+    const targets2 = /* @__PURE__ */ new Set();
+    for (const f of deps2.files.filter((x) => MANIFEST.test(x.path))) {
+      const key = `code:${f.project}`;
+      if (!drafts.has(key)) continue;
+      deps2.files = deps2.files.filter((x) => x !== f);
+      drafts.get(key)?.files.push(f);
+      targets2.add(key);
+    }
+    const [first, ...rest] = [...targets2];
+    if (first && deps2.files.some((x) => LOCKFILE.test(x.path))) {
+      for (const other of rest) merge2(other, first, "These projects share one lockfile, so their package changes must merge together.");
+      merge2("dependencies", first, "The lockfile goes with the package.json files it records.");
+    } else if (!deps2.files.length) drafts.delete("dependencies");
+  }
+  const [onlyCode, ...moreCode] = codeKeys();
+  if (onlyCode && moreCode.length === 0) {
+    merge2("docs", onlyCode, "Documentation is updated in the same change as the behaviour it describes.");
+    merge2("database", onlyCode, "The database change and the code that uses it need each other.");
+  }
+  const groups = ORDER2.flatMap(
+    (kind) => [...drafts.entries()].filter(([, d]) => d.kind === kind).sort(([a], [b]) => a.localeCompare(b)).map(([key, d]) => {
+      const files = [...new Set(d.files.flatMap((f) => f.from ? [f.from, f.path] : [f.path]))].sort();
+      const lines = d.files.filter((f) => !LOCKFILE.test(f.path)).reduce((n, f) => n + f.lines, 0);
+      const project = key.startsWith("code:") && key !== "code:." ? `-${key.slice("code:".length)}` : "";
+      return {
+        id: `${d.kind}${project}`.replace(/[^a-z0-9-]+/gi, "-").toLowerCase(),
+        kind: d.kind,
+        title: title(d.kind, files, d.projects.sort()),
+        why: [WHY[d.kind], ...new Set(d.joined)].join(" "),
+        files,
+        lines,
+        large: lines > PR_MAX_LINES || files.length > PR_MAX_FILES
+      };
+    })
+  );
+  return { groups, leftOut: leftOut.sort((a, b) => a.path.localeCompare(b.path)) };
+}
+function prBody(group, note) {
+  const check2 = note?.check?.length ? note.check : CHECKS[group.kind];
+  return [
+    note?.summary ? `## What changed
+
+${note.summary}
+` : `## What changed
+
+${group.files.map((f) => `- \`${f}\``).join("\n")}
+`,
+    `## Why this is its own pull request
+
+${group.why}
+`,
+    `## Before merging
+
+${check2.map((c) => `- [ ] ${c}`).join("\n")}
+`,
+    ...note?.summary ? [`<details><summary>Files</summary>
+
+${group.files.map((f) => `- \`${f}\``).join("\n")}
+</details>
+`] : [],
+    group.large ? `> This pull request is large (${group.lines} lines in ${group.files.length} files). Large pull requests are harder to review; split it if you can.
+` : "",
+    "Opened by Aura (https://github.com/JohnFazio1/aura)."
+  ].filter(Boolean).join("\n");
+}
+var CHECKS = {
+  database: [
+    "Every new table turns on row level security and has policies.",
+    "No migration that was already applied has been edited.",
+    "Merge this before the pull requests that use it."
+  ],
+  dependencies: ["The automated checks pass.", "Each new package is one you meant to add."],
+  code: ["The automated checks pass.", "Try the changed pages or features in the preview deployment.", "New behaviour has tests."],
+  docs: ["The instructions match how the app works now."],
+  "agent-setup": ["The rules describe how you want your coding agent to work."],
+  ci: ["The automated checks pass on this pull request.", "No secret values are written in the workflow files."],
+  "aura-records": ["Accounts are owned by the company, not a personal or freelancer email."]
+};
+
+// src/commands/pr.ts
+var Notes = external_exports.record(
+  external_exports.string(),
+  external_exports.object({ title: external_exports.string().min(1).max(120).optional(), summary: external_exports.string().max(4e3).optional(), check: external_exports.array(external_exports.string().max(300)).max(10).optional() })
+);
+function parseStatus(out) {
+  const parts = out.split("\0");
+  const entries = [];
+  for (let i = 0; i < parts.length; i++) {
+    const entry = parts[i] ?? "";
+    if (entry.length < 4) continue;
+    const xy = entry.slice(0, 2);
+    const file2 = entry.slice(3);
+    if (/[RC]/.test(xy)) entries.push({ path: file2, from: parts[++i] });
+    else entries.push({ path: file2 });
+  }
+  return entries;
+}
+function projectOf(root, file2, exists2 = (rel) => existsSync29(path51.join(root, rel))) {
+  const parts = file2.split("/").slice(0, -1);
+  for (let n = parts.length; n > 0; n--) {
+    const dir = parts.slice(0, n).join("/");
+    if (exists2(`${dir}/package.json`)) return dir;
+  }
+  return ".";
+}
+async function changedFiles(root) {
+  const status = await git(root, "status", "--porcelain=v1", "-z", "-uall");
+  const numstat = await git(root, "diff", "--numstat", "-z", "--no-renames", "HEAD");
+  const lines = /* @__PURE__ */ new Map();
+  for (const rec of numstat.stdout.split("\0")) {
+    const [added, removed, file2] = rec.split("	");
+    if (file2) lines.set(file2, (Number(added) || 0) + (Number(removed) || 0));
+  }
+  return parseStatus(status.stdout).map(({ path: file2, from }) => {
+    const full = path51.join(root, file2);
+    const bytes = existsSync29(full) ? statSync6(full).size : 0;
+    let count3 = lines.get(file2);
+    if (count3 === void 0 && bytes && bytes < 2e6) {
+      const text = readFileSync31(full, "utf8");
+      count3 = text.includes("\0") ? 0 : text.split("\n").length;
+    }
+    return { path: file2, ...from ? { from } : {}, lines: count3 ?? 0, bytes, project: projectOf(root, file2) };
+  });
+}
+async function filesWithSecrets(root, files, ignores) {
+  const hits = [];
+  for (const file2 of files) {
+    if (ignores.some((re) => re.test(file2))) continue;
+    const full = path51.join(root, file2);
+    if (!existsSync29(full) || statSync6(full).size > 2e6) continue;
+    const tracked = (await git(root, "cat-file", "-e", `HEAD:${file2}`)).code === 0;
+    const added = tracked ? (await git(root, "diff", "-U0", "--no-color", "HEAD", "--", file2)).stdout.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).map((l) => l.slice(1)) : readFileSync31(full, "utf8").split("\n");
+    if (added.some((l) => findSecrets(l).some((m) => m.confidence === "high"))) hits.push(file2);
+  }
+  return hits;
+}
+function loadNotes(root, file2) {
+  if (!file2) return {};
+  const full = path51.resolve(root, file2);
+  if (!isInside(root, full) || !existsSync29(full)) return `Couldn\u2019t find the notes file ${file2}.`;
+  try {
+    const parsed = Notes.safeParse(JSON.parse(readFileSync31(full, "utf8")));
+    return parsed.success ? parsed.data : `The notes file ${file2} isn\u2019t in the expected shape: { "<group id>": { "title", "summary", "check": [] } }.`;
+  } catch {
+    return `The notes file ${file2} isn\u2019t valid JSON.`;
+  }
+}
+function showPlan(plan, held, base2, notes) {
+  if (!plan.groups.length) say.info("\nNothing to put in a pull request: no uncommitted changes.");
+  else console.log(pc.bold(`
+  ${plan.groups.length} pull request${plan.groups.length === 1 ? "" : "s"} into ${base2}, in the order to merge them
+`));
+  plan.groups.forEach((g, i) => {
+    const hold = held.get(g.id);
+    console.log(
+      `  ${i + 1}. ${pc.bold(notes[g.id]?.title ?? g.title)} ${pc.dim(`(${g.id}, ${g.files.length} file${g.files.length === 1 ? "" : "s"}, ${g.lines} lines)`)}`
+    );
+    console.log(pc.dim(`     ${g.why}`));
+    for (const f of g.files.slice(0, 8)) console.log(`     ${f}`);
+    if (g.files.length > 8) console.log(pc.dim(`     \u2026and ${g.files.length - 8} more`));
+    if (g.large) console.log(pc.yellow("     Large: reviewers miss more in big pull requests. Split it if you can."));
+    if (hold) console.log(pc.red(`     Held back: ${hold.join(", ")} ${hold.length === 1 ? "contains" : "contain"} a secret. Move it into .env.local first.`));
+  });
+  if (plan.leftOut.length) {
+    console.log(pc.bold("\n  Left out (they stay on your computer)\n"));
+    for (const l of plan.leftOut) console.log(`  ${l.path} ${pc.dim(`(${LEFT_OUT_REASONS[l.reason]})`)}`);
+  }
+}
+async function prCommand(flags) {
+  const root = await findRepoRoot();
+  if ((await git(root, "rev-parse", "--verify", "--quiet", "HEAD")).code !== 0) {
+    say.error("This repo has no commits yet. Make a first commit, push it to GitHub, then run aura pr.");
+    return 1;
+  }
+  const base2 = await currentBranch(root);
+  if (base2 === "HEAD") {
+    say.error("You\u2019re not on a branch. Switch to your main branch first: git switch main");
+    return 1;
+  }
+  const notes = loadNotes(root, flags.notes);
+  if (typeof notes === "string") {
+    say.error(notes);
+    return 1;
+  }
+  const plan = planPrs(await changedFiles(root));
+  const only = flags.only?.split(",").map((s) => s.trim()).filter(Boolean);
+  const unknown2 = only?.filter((id) => !plan.groups.some((g) => g.id === id)) ?? [];
+  if (unknown2.length) {
+    say.error(`No pull request called ${unknown2.join(", ")}. Run aura pr --dry-run to see their ids.`);
+    return 1;
+  }
+  if (only) plan.groups = plan.groups.filter((g) => only.includes(g.id));
+  const secrets2 = new Set(
+    await filesWithSecrets(
+      root,
+      plan.groups.flatMap((g) => g.files),
+      pathIgnores(loadConfig(root))
+    )
+  );
+  const held = new Map(plan.groups.map((g) => [g.id, g.files.filter((f) => secrets2.has(f))]).filter(([, f]) => f.length));
+  const ready = plan.groups.filter((g) => !held.has(g.id));
+  const ahead = await git(root, "rev-list", "--count", "@{u}..HEAD");
+  const unpushed = ahead.code === 0 ? Number(ahead.stdout.trim()) : 0;
+  const onRemote = ahead.code === 0 || (await git(root, "ls-remote", "--exit-code", "--heads", "origin", base2)).code === 0;
+  const openPr = flags.pr !== false;
+  const blocker = unpushed > 0 ? `${base2} has ${unpushed === 1 ? "1 commit that isn\u2019t" : `${unpushed} commits that aren\u2019t`} on GitHub yet, so ${unpushed === 1 ? "it" : "they"}\u2019d end up in every pull request. Push ${unpushed === 1 ? "it" : "them"} or open a pull request for ${unpushed === 1 ? "it" : "them"} first.` : openPr && !onRemote ? `${base2} isn\u2019t on GitHub yet, so there\u2019s nothing to open a pull request into. Push it first: git push -u origin ${base2}` : null;
+  if (flags.json && (flags.dryRun || !flags.yes && !interactive())) {
+    printJson({
+      base: base2,
+      groups: plan.groups.map((g) => ({ ...g, title: notes[g.id]?.title ?? g.title, heldBack: held.get(g.id) ?? [] })),
+      leftOut: plan.leftOut,
+      blocker
+    });
+    return blocker ? 1 : 0;
+  }
+  if (!flags.json) showPlan(plan, held, base2, notes);
+  if (!ready.length) return held.size ? 1 : 0;
+  if (blocker) {
+    say.error(blocker);
+    return 1;
+  }
+  if (flags.dryRun) {
+    say.dim("\nDry run: nothing was changed.");
+    return 0;
+  }
+  if (openPr) {
+    const gh = await ghStatus(root);
+    if (!gh.installed || !gh.authed || !gh.hasRemote) {
+      say.error(
+        !gh.installed ? `The GitHub CLI isn\u2019t installed. ${ghInstallHint()}` : !gh.authed ? "Run `gh auth login` first." : "This repo has no GitHub remote. Push it to GitHub first."
+      );
+      say.dim("Or run with --no-pr to commit each group on a local branch.");
+      return 1;
+    }
+  }
+  if (!flags.yes) {
+    if (!interactive()) {
+      say.info("\nShow this plan to the user. When they agree, run the same command with --yes.");
+      return 0;
+    }
+    say.dim(`
+Each group moves onto its own branch, so your computer goes back to ${base2} without them until they\u2019re merged.`);
+    const n = ready.length;
+    if (!unwrap(
+      await p.confirm({
+        message: openPr ? `Open ${n === 1 ? "this pull request" : `these ${n} pull requests`}?` : `Commit ${n === 1 ? "it" : `these ${n}`} on local branches?`
+      })
+    ))
+      return 0;
+  }
+  await git(root, "reset", "-q");
+  const opened = [];
+  let failed = null;
+  for (const g of ready) {
+    failed = await openOne(root, base2, g, notes, openPr, opened);
+    if (failed) break;
+  }
+  if (await currentBranch(root) !== base2) await git(root, "switch", base2);
+  if (flags.json) printJson({ base: base2, opened, heldBack: [...held.entries()].map(([id, files]) => ({ id, files })), error: failed });
+  else {
+    for (const o of opened) say.ok(o.url ? `Opened ${o.url}` : `Committed on branch ${o.branch}.`);
+    if (failed) say.error(failed);
+    if (opened.length > 1) say.info(`
+Merge them in the order above${ready[0]?.kind === "database" ? ", database changes first" : ""}.`);
+    if (opened.length) say.dim(`When they\u2019re merged, run \`git pull\` to have the changes on your computer again, then \`aura check\`.`);
+  }
+  return failed ? 1 : 0;
+}
+async function openOne(root, base2, g, notes, openPr, opened) {
+  const branch = await freeBranchName(root, `aura/${g.id}`);
+  const sw = await git(root, "switch", "-c", branch);
+  if (sw.code !== 0) return `Couldn\u2019t create branch ${branch}: ${sw.stderr.trim()}`;
+  const add = await git(root, "add", "-A", "--", ...g.files);
+  if (add.code !== 0) {
+    await git(root, "reset", "-q");
+    await git(root, "switch", base2);
+    await git(root, "branch", "-D", branch);
+    return `Couldn\u2019t add the files for \u201C${g.title}\u201D: ${add.stderr.trim()}`;
+  }
+  const note = notes[g.id];
+  const result = await commitPushPr(root, { branch, base: base2, title: note?.title ?? g.title, body: prBody(g, note), openPr });
+  await git(root, "switch", base2);
+  if (!result.committed) {
+    await git(root, "branch", "-D", branch);
+    return `Couldn\u2019t commit \u201C${g.title}\u201D: ${result.error?.trim() ?? "unknown error"}`;
+  }
+  opened.push({ id: g.id, branch, url: result.url });
+  if (result.error)
+    return `Committed \u201C${g.title}\u201D on branch ${branch}, but couldn\u2019t ${result.pushed ? "open the pull request" : "push it"}: ${result.error.trim()}
+Finish by hand with these two commands:
+  git push -u origin ${branch}
+  gh pr create --head ${branch}`;
+  return null;
+}
+
 // src/commands/simple.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync29 } from "fs";
+import { existsSync as existsSync30 } from "fs";
 async function nextCommand(flags) {
   const root = await findRepoRoot();
   const scan = await latestScan(root);
@@ -35210,7 +35607,7 @@ async function kindSetting(root, config2, value, project) {
   const paths = profile.projects.map((p2) => p2.path);
   const at = project ?? (paths.length === 1 ? paths[0] : void 0);
   if (!at) return `This repo has ${paths.length} projects, so say which one, for example: aura config kind ${value} ${paths.find((p2) => p2 !== ".")}`;
-  if (!existsSync29(packageFolder(root, normDir(at)))) return `There is no folder "${at}" in this repo.`;
+  if (!existsSync30(packageFolder(root, normDir(at)))) return `There is no folder "${at}" in this repo.`;
   config2.projects = setKindOverride(config2.projects, at, kind);
   return "saved";
 }
@@ -35334,6 +35731,7 @@ program.command("check").alias("scan").description("Run every check, show the Au
 program.command("next").description("Recommended next steps in priority order").option("--json", "print as JSON").option("--limit <n>", "how many to show").action(action((flags) => nextCommand(flags)));
 program.command("apply").argument("<action>", "action id, e.g. foundation, add-ci, install-skills").description("Make a template change on a new branch and open a pull request").option("--dry-run", "show what would change without changing anything").option("--no-pr", "commit on a local branch without pushing or opening a PR").option("-y, --yes", "don\u2019t ask for confirmation (large changes still need a person\u2019s approval)").option("--approved", "a person read and approved the breakdown of this large change: do its next chunk").option("--skills <names>", "for install-skills: comma-separated skill names").action(action((id, flags) => applyCommand(id, flags)));
 program.command("fix").argument("<target>", "finding id or action id, e.g. protect-api-routes").description("Aura\u2019s agent fixes it on a new branch and opens a PR for your approval").option("--agent", "hand the task to your own coding agent instead (writes .aura/tasks/<id>.md)").option("--dry-run", "show what would be fixed without starting the agent").option("--no-pr", "commit on a local branch without pushing or opening a PR").option("-y, --yes", "don\u2019t ask for confirmation (large changes still need a person\u2019s approval)").option("--approved", "a person read and approved the breakdown of this large change: do its next chunk").action(action((target, flags) => fixCommand(target, flags)));
+program.command("pr").description("End of a session: turn your uncommitted work into focused pull requests, one concern each").option("--dry-run", "show the pull requests Aura would open without changing anything").option("--json", "print the plan (and what was opened) as JSON").option("--only <ids>", "open only these pull requests (comma-separated ids from --dry-run)").option("--notes <file>", "JSON with a title, summary and checks per pull request id").option("--no-pr", "commit each group on a local branch without pushing or opening a PR").option("-y, --yes", "don\u2019t ask for confirmation (an agent passes it only after the user agreed to the plan)").action(action((flags) => prCommand(flags)));
 program.command("inventory").description("Services and environment variables the app uses, and who owns each account").option("--json", "print as JSON").option("-y, --yes", "don\u2019t ask questions").action(action((flags) => inventoryCommand(flags)));
 program.command("guide").argument("[topic]", "guide to show, e.g. rotate-stripe-key").description("Step-by-step guides for things outside the code").option("--list", "list all guides").action(action((topic, flags) => guideCommand(topic, flags), { key: false }));
 program.command("history").description("Aura score trend from past scans").option("--json", "print as JSON").action(action((flags) => historyCommand(flags)));