name: pracht-test-api\nversion: 1.2.1\ndescription: |\nGenerate Vitest request/response tests for every handler in src/api/: build a\nRequest, call the exported method handler directly, assert on the returned\nResponse — no server boot.\nUse for \"test my API routes\", \"scaffold API tests\", \"generate tests for\nsrc/api\", \"add tests for this endpoint\".\nallowed-tools:
Pracht API handlers are plain functions: (args: ApiRouteArgs) => Response | Promise<Response> (ApiRouteArgs is BaseRouteArgs with route narrowed\nto ResolvedApiRoute). They test cleanly in Vitest without booting the\nframework.
If the project has no vitest dependency, run scaffold-tests first (or\nprompt the user to). This skill does not handle Vitest setup.
MCP: when the pracht MCP server is registered (pracht dev-mcp), prefer its\ninspect_routes/inspect_api/inspect_build/doctor/verify/generate_*\ntools over shelling out. pracht inspect needs the pracht plugin in the vite\nconfig.
pracht inspect api --json\nFor each entry, capture: path (URL), file (source path), and the exported\nmethods (e.g., [\"GET\", \"POST\"]). Note: methods only lists named HTTP\nmethod exports — a default-export dispatcher yields methods: [], never\n[\"default\"]. Current @pracht/cli versions also report a\nhasDefaultHandler boolean; use it when present. If the field is absent\n(older CLI) and methods is empty, fall back to the grep in Step 7 to detect\na default dispatcher.
Ask the user which subset to scaffold or accept paths via $ARGUMENTS.
Place tests next to the handler with .test.ts suffix\n(src/api/users/[id].test.ts). Use createApiArgs() from @pracht/test\n(add it as a dev dependency if missing) to construct ApiRouteArgs:
import { describe, it, expect } from \"vitest\";\nimport { createApiArgs, readJson } from \"@pracht/test\";\nimport { GET, POST /* import only what the handler exports */ } from \"./<file>\";\n\ndescribe(\"<METHOD> <api-path>\", () => {\n it(\"returns 200 on a valid request\", async () => {\n const res = await GET(createApiArgs({ url: \"<api-path>\" }));\n expect(res).toBeInstanceOf(Response);\n expect(res.status).toBe(200);\n });\n});\nPass params for dynamic segments, body for JSON payloads (plain objects\nare JSON-encoded with the right Content-Type), and use submitForm() for\nform-encoded/multipart POSTs — it drives the same FormData parsing path\ndefineApi() uses.
For each exported method, emit the smallest realistic case:
\n| Method | \nDefault case | \n
|---|---|
GET | \nPlain GET → expect(res.status).toBeLessThan(400) | \n
POST | \nPOST with empty FormData → assert validation behavior | \n
PUT | \nPUT with JSON body → assert 200 or auth-required (401/403) | \n
PATCH | \nPATCH with partial body → assert 200 or 422 | \n
DELETE | \nDELETE on a real-shaped path → assert 200/204 or 401 | \n
For dynamic segments ([id].ts → /api/users/:id), pick a placeholder param\n(e.g., id: \"test-1\") and pass it via params. Surface in the report that\nthe user may need to provide a real fixture.
API routes do NOT appear in pracht inspect routes --json (that report\ncovers page routes only) and pracht inspect api --json has no middleware\nfield. API middleware is the single global list configured as\ndefineApp({ api: { middleware: [...] } }) — read the manifest source\n(src/routes.ts or wherever defineApp lives) to see whether an auth\nmiddleware is in that list. If it is, scaffold an extra test:
it(\"rejects unauthenticated requests\", async () => {\n const res = await POST(createApiArgs({ url: \"<api-path>\", method: \"POST\" }));\n expect([401, 403, 302]).toContain(res.status);\n});\nNote: middleware does NOT run when calling the handler directly — this test\nverifies the handler's own defense if it has one. If the only defense is\nmiddleware, mention that in the report and recommend an integration test that\ngoes through the framework's request pipeline (out of scope for this skill).\nThe same applies to the framework's built-in CSRF check: requireSameOrigin\n(on by default) rejects cross-origin state-changing API requests in the real\npipeline but never runs in direct-invocation tests.
For handlers that return Response.json(...), generate:
it(\"returns JSON with the expected keys\", async () => {\n const res = await GET(createApiArgs({ url: \"<api-path>\" }));\n expect(res.headers.get(\"content-type\")).toMatch(/application\\/json/);\n const body = await readJson(res);\n expect(body).toEqual(expect.objectContaining({ /* fill in */ }));\n});\nIf the handler exports default (one function dispatching on\nrequest.method), generate a test per HTTP method the handler appears to\nsupport (grep for request.method === patterns inside the file).
pnpm test\npracht verify --json\nReport passes/failures. Mark generated assertions as TODO so the user knows\nto tighten them.
\npracht inspect api --json as the inventory — do not glob.requireSameOrigin CSRF check. Be explicit in the report..test.ts suffix unless the\nproject already uses a __tests__/ convention (detect and match)..next.test.ts and tell the\nuser to merge.$ARGUMENTS
\n","files":[{"path":"SKILL.md","sizeBytes":6044,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-10-19T21:18:12.829539Z","sha256":"8BFE1828E6A165581E87E968AB6712CC6BDF0FC1FA5FA75C3AC204216D376977","sizeBytes":2874},"review":null,"source":{"repositoryUrl":"https://github.com/JoviDeCroock/pracht","path":"skills/pracht-test-api","license":"MIT","commit":"8bcdd52989de3e97708e7f16221839d6313cfdac","subtreeSha":"ECBB66E93E96D5968ED21252C3FE51A29917BCBD8C88B8458683C943262235EC","lastSyncedAt":"2026-10-19T21:17:21.911347Z"},"reviewedAt":"2026-10-19T21:20:00.158708Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/JoviDeCroock/pracht/tree/main/skills/pracht-test-api"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install jovidecroock-pracht@llmmart"},{"target":"git","command":"git clone https://github.com/JoviDeCroock/pracht.git"}]}