fix(deps): replace the expired pkg.pr.new lunaria build with @lunariajs/core 0.2.0

[RedStar071]

Summary

• packages/i18n now depends on the published @lunariajs/core@^0.2.0 instead of a pkg.pr.new preview build.
• scripts/i18n-status.ts joins missing-key paths with dots, because 0.2.0 reports each missing key as a string[] path instead of a string.
• pnpm-lock.yaml has been regenerated for the new dependency.

Why

The pinned URL https://pkg.pr.new/lunariajs/lunaria/@lunariajs/core@904b935 now returns 404. Every clean aube ci fails before any task runs, so every job that installs dependencies is red on any new push, for example #69. Vercel previews fail for the same reason. main last passed on 2026-09-14, when the artifact still existed.

0.2.0 exports the createLunaria, getFullStatus and @lunariajs/core/config API that lunaria.config.ts and i18n-status.ts already use. The only incompatibility was the KeyPath type of missingKeys, which the oxlint type-aware check caught.

Verification

All commands were run in node:24.19.0-bookworm-slim with aube 1.41.0, from a clean aube ci of this branch:

• aube run check:repo
• aube run lint:ci (Oxfmt, type-aware Oxlint, Knip)
• aube run typecheck
• aube test: every package passes
• aube run build, including the dashboard
• aube run i18n:report and aube run i18n:status (the latter needs full git history)
• aube run i18n:schema leaves no diff under packages/i18n/schemas or packages/i18n/locales

Safety and compatibility

• I added or updated deterministic tests for changed behavior. (No runtime behavior changed. The status script's output format is unchanged apart from the key rendering.)
• I preserved observe mode as read-only, or explained the policy change above.
• Runtime commands and target-repository writes remain inside the runner boundary.
• I did not expose secrets, tokens, personal data, or untrusted output in logs.
• I updated documentation and Agent Skills when workflows or boundaries changed. (None changed.)

Agent context

• Agent/tools used: Claude Code (cloud session), aube 1.41.0 in a Node 24 container, and the GitHub MCP tools.
• What the agent did, and what you changed or verified yourself: The agent diagnosed the CI failure on ci: build and publish the dashboard image to GHCR #69, swapped the dependency, adapted i18n-status.ts, regenerated the lockfile and ran the full check set listed above.

Reviewer notes

Lockfile: two lines kept at their main values on purpose. aube add (and aube install --fix-lockfile) rewrite the @prisma/client and drizzle-orm peer references inside the @better-auth/drizzle-adapter@1.6.26 and @better-auth/prisma-adapter@1.6.26 snapshots. The new form is …(prisma@7.9.1), and no snapshot exists under that name. With that output, a frozen aube ci links the drizzle adapter to a drizzle-orm directory that is never created, and the dashboard build fails with ENOENT … drizzle-orm. A plain aube install happens to link it correctly, which hides the problem locally.

Those two references are therefore left as they are on main. aube install accepts the result byte-for-byte, and aube ci links correctly. The only tooling alternatives, aube dedupe and --lockfile-only, re-resolve the whole tree, a lockfile diff of about 15k lines with unrelated upgrades. This looks like an aube resolver bug worth reporting upstream.

Merging this should turn #69 green once it picks up main.

🤖 Generated with Claude Code

https://claude.ai/code/session_016Xv8HFiGBXf14HBy5yko6J

---

Generated by Claude Code

Confidence Score: 5/5

No outstanding findings block merging.

_{Reviews (2) · Last reviewed commit: "test(i18n): cover the missing-key path f..."}

[coldtea-pr-lens]

◈ PR Lens

🟢 +2 new · 🟠 ~3 changed · 🔴 -0 removed · 1 flow · 4 files · commit 1561a62

Architecture

5 components touched across 3 lanes.

Play the interactive walkthrough

Inside the changed components — 1 view

Component view — Translation status reporter

The modules and utilities executing the Lunaria translation status report

Data flow

Generating translation status report

Follow each request, response and payload

View

• Architecture lens
• Data flow lens
• Expand every detail

Tip

Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds

🪧 More tips

• Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."
• Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through
• The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs on every push
• Set github.draw: on-demand in .github/pr-lens.yml and PR Lens stops drawing every push. Comment @pr-lens draw on a pull request when you want that one drawn
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works
• Push a commit and the comment redraws for the new head. A slow older run never overwrites a newer one
• Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion

---

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Bluesky
• Mastodon
• Reddit
• LinkedIn

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agent-zero-marketing	Ready	Preview	Sep 24, 2026 8:17am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
agent-zero-docs	Skipped		Sep 24, 2026 8:17am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​lunariajs/​core@​0.2.0

View full report