GitHub collection
jovidecroock/pracht
Imported from GitHub — is this yours?
33 skills imported from this repository.
- Stars
- 99
- Forks
- 5
- License
- MIT
Skills (33)
add-auth
Wire session-based auth into a pracht app with `@pracht/session`: encrypted cookie sessions, gate middleware, login/logout/signup API routes, `<Form>` pages, and public vs. protected route groups. Use for "add auth", "set up login", "wire authentication", "add session middleware"
add-capabilities
Expose an app operation as a typed pracht capability — one contract projected into direct server calls, an HTTP endpoint, a route-scoped WebMCP page tool, and a remote MCP tool — plus `defineApp({ agents })` trust config, typed clients, `<Form capability>`, and `pracht eval` scen
add-content
Wire `@pracht/content` and `@pracht/markdown`: a collection registry owning source discovery, routes, locales, compilation, and static artifacts (`llms.txt`, raw source), plus Markdown/MDX route modules and snapshot loaders. Use for "add a blog", "set up docs", "render markdown p
add-db
Wire Drizzle ORM into a pracht app: pick the target (D1, PlanetScale, Neon, Supabase, Turso, Postgres, MySQL, SQLite), then generate driver setup, schema, migration workflow, and a typed client for loaders, middleware, and API routes. Use for "add database", "set up Drizzle", "wi
add-i18n
Wire `@pracht/i18n`: locale-detection middleware (URL prefix, cookie, `Accept-Language`), lazy typed dictionaries, and either strategy — locale-prefixed route groups with hreflang, or one URL per page with a cookie-backed switcher. Use for "add i18n", "set up translations", "make
add-images
Wire `@pracht/image`: the CLS-safe zero-runtime `<Image>`, the loader for your target (sharp endpoint, Cloudflare, Vercel, Netlify, passthrough), `?pracht` build-time imports with blur placeholders, prebuilt WebP variants, and the optimization endpoint's security settings. Use fo
add-observability
Wire Sentry or OpenTelemetry into pracht server boundaries (loaders, middleware, API routes), client-side Web Vitals reporting, and a capability audit sink that records every capability dispatch with transport, outcome, latency, and verified identity. Use for "add observability",
add-openapi
Wire `@pracht/openapi`: generate an OpenAPI 3.1 document from `defineApi()` routes, attach response contracts with `defineOpenApi()`, serve an optional Scalar or Swagger UI, handle deploy-base and CSP, and gate completeness in CI. Use for "add OpenAPI", "generate an API spec", "a
audit-a11y
Per-route axe-core audit of a pracht app in a headless browser: alt text, contrast, landmarks, focus order, and form labels, grouped by severity and route. Use for "audit a11y", "check accessibility", "axe my app", "WCAG compliance", "screen reader test".
audit-agent-surface
Inventory what agents can reach in a pracht app — capability exposure (HTTP, WebMCP, remote MCP), `agents` trust config, the destructive-confirmation gate, `llms.txt`, Markdown negotiation, OpenAPI — and report where the surface is wider than intended, or confirm an opt-out app s
audit-auth
Find pracht routes that look protected but aren't: missing auth middleware, middleware that augments context but never gates, client-only checks, and unguarded API mutations. Use for "audit auth", "check route protection", "find unauthenticated routes", "review middleware coverag
audit-bundles
Analyze a pracht production build: client bytes per route, fat vendor chunks, routes shipping large dependencies, and dynamic `import()` / prefetch recommendations. Use for "audit bundles", "why is my JS so big", "bundle size per route", "what's in my vendor chunk", "tune prefetc
audit-csrf
Check CSRF posture across every form and mutation API. Pracht enforces same-origin on mutation API requests by default (`api.requireSameOrigin`); this verifies the default is intact and that cookies, middleware, or tokens cover what it does not. Use for "audit CSRF", "check CSRF
audit-deps
Run a dependency vulnerability audit and map each advisory to the pracht routes, loaders, middleware, and API handlers that import it — so you know what to retest after upgrading. Use for "audit deps", "scan for CVEs", "npm audit", "which routes use this vulnerable package".
audit-headers
Audit security headers in a pracht app. The framework sets four defaults on every response path; this covers the exceptions — static output served outside first-party adapters, `headers()` exports that weaken defaults, and the choices only you can make (HSTS, CSP). Use for "audit
audit-islands
Audit pracht hydration: over-hydrated routes that should be `hydration: "islands"` or `"none"`, dead interactivity outside the islands directory, non-serializable island props, mis-tuned `client` strategies, and invalid render/hydration pairs. Use for "audit islands", "reduce hyd
audit-loaders
Audit pracht route loaders for serializability, leaked secrets, unsafe `loaderCache`, browser-only API use, and missing `AbortSignal` plumbing. Use for "audit loaders", "check loader data", "find serialization bugs", "loader security review".
audit-redirects
Find open redirects in pracht loaders, middleware, and navigation. The framework rejects unsafe schemes and CRLF at both ends, but a hand-rolled 3xx Response bypasses every guard, and even a guarded redirect to an attacker-chosen origin can phish. Use for "audit redirects", "chec
audit-secrets
Detect environment variables and secrets reaching the client bundle via loader return values, hydration state, or server-only modules imported from client code paths. Use for "audit secrets", "find leaked env vars", "is my API key exposed", "scan for credential leaks".
audit-seo
Per-route SEO audit: `head()` coverage, title and description presence, Open Graph and Twitter cards, canonicals, robots rules, plus a `sitemap.xml` generated from the route manifest. Use for "audit SEO", "check meta tags", "generate a sitemap", "are my OG cards set", "review rob
audit-shells
Audit pracht shells: missing `Loading()` on SPA routes, `<html>`/`<head>`/ `<body>` rendered inside a shell, shells that never render `children`, unused shells, and `ErrorBoundary` exports shadowed by every route under them. Use for "audit shells", "check shell composition", "fin
configure-isg
Wire ISG revalidation for the project's adapter: route-level `timeRevalidate`/`webhookRevalidate`, the authenticated `/__pracht/revalidate` webhook, Cloudflare Workers Cache, Vercel ISR, and cache-key pitfalls — then verify locally. Use for "set up ISG", "configure revalidation",
migrate-nextjs
Migrate a Next.js app to pracht: App or Pages Router pages, layouts, middleware, API routes, data fetching, and metadata — plus React→Preact, `className`→`class`, server components→loaders, and manifest wiring. Use for "migrate from next", "convert next.js app", "port from next t
pracht-debug
Framework-aware debugging for pracht: route matching, loader and API errors, rendering and hydration, middleware, HMR, and build failures — root cause first. Use for "debug this", "fix this bug", "why is this broken", "blank page", "hydration mismatch", "404 on my route"; suggest
pracht-deploy
Configure a pracht adapter and deploy to Node, Cloudflare Workers, Netlify, Vercel, or a pure static host: platform config, build, Docker, production checklist. Use for "deploy", "set up deployment", "configure adapter", "deploy to cloudflare/netlify/vercel", "static export", "pr
pracht-scaffold
Scaffold pracht code with the native generators (`pracht generate route|shell|middleware|api`), falling back to manual edits only when the CLI flags cannot express the requested shape. Use for "scaffold", "generate a route", "create a new page", "add middleware", "add an API rout
pracht-test-api
Generate Vitest request/response tests for every handler in `src/api/`: build a `Request`, call the exported method handler directly, assert on the returned `Response` — no server boot. Use for "test my API routes", "scaffold API tests", "generate tests for src/api", "add tests f
pre-deploy
Adapter-aware pre-deployment checklist (Node, Cloudflare Workers, Vercel, static) for the failures that only surface in production: missing env vars, Node-only APIs in edge bundles, absent ISG manifest, oversized bundles, missing wrangler/vercel config, and static hosts without c
scaffold-e2e
Set up Playwright for a pracht app: install it, generate a `playwright.config.ts` that boots `pracht dev` (or the build via `pracht preview`), and emit a smoke test per manifest route asserting 200, head/title, no console errors, and navigation. Use for "scaffold E2E", "set up Pl
scaffold-tests
Set up Vitest for pracht routes, loaders, and middleware — browser mode with `vitest-browser-preact` or JSDOM with `@testing-library/preact` — wiring `vitest.config.ts`, `LoaderArgs` via `@pracht/test`, and runnable test files. Use for "scaffold tests", "set up Vitest", "add unit
tune-render-mode
Recommend the right render mode (ssg, isg, ssr, spa) per route from what each loader actually does, then apply the change after confirmation. Use for "tune render modes", "should this route be SSG", "audit render modes", "review SSG/ISG/SSR choices", "make my site faster".
typed-routes
Add or maintain pracht typed routes: run typegen, adopt route-id based links and navigation, and replace hard-coded hrefs with generated helpers. Use for "add typed routes", "fix typed links", "replace hard-coded hrefs", "run typegen".
upgrade-pracht
Upgrade the `@pracht/*` packages safely: inventory installed versions, read the changelogs between installed and target, map breaking changes to real usage, apply, then walk the verification ladder (doctor, typegen, verify, build, tests). Use for "upgrade pracht", "update @pracht