create-pracht 0.4.1 → 0.4.2

package/README.md

@@ -17,7 +17,7 @@ npm run dev
 - Detects the active package manager from the current environment.
 - Lets the user choose between the Node.js, Cloudflare, and Vercel adapters.
 - Optionally wires up Tailwind CSS (`tailwindcss` + `@tailwindcss/vite`, a global stylesheet, and the shell import).
-- Scaffolds a minimal app with a route manifest or pages router, shell, home route, sample API route, runnable project README, and agent instructions.
+- Scaffolds a minimal app with a route manifest or pages router, shell, home route, sample API route, runnable project README, TypeScript typecheck script, and agent instructions.
 - Manifest scaffolds include a commented-out `constraints` example in `src/routes.ts`, ready for `pracht verify`.
 - The generated `.gitignore` keeps `.pracht/app-graph.json` committable, and the README and agent instructions cover the `pracht verify` / `pracht plan` / `pracht report` loop.
 - Seeds the pracht Claude Code skills into `.claude/skills/` and writes a `.mcp.json` registering the `pracht mcp` server (yes-default prompt; skipped with `--no-agent-tools`).
@@ -80,6 +80,7 @@ Cloudflare scaffolds also include:
 
 - `dev` -> `pracht dev`
 - `build` -> `pracht build`
+- `typecheck` -> `tsc --noEmit`
 
 Node starters also include:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pracht",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Interactive and scriptable starter CLI for creating full-stack Preact apps with Pracht.",
   "keywords": [
     "pracht",

package/skills/audit-auth/SKILL.md

@@ -91,9 +91,11 @@ target. From `pracht inspect api --json`:
   serves ALL methods but reports `methods: []` — treat
   `hasDefaultHandler: true` as "every method exposed". On older CLIs where
   the field is missing, grep the handler file for `export default` instead.
-- For each mutation handler (named method export or default handler), check
-  whether `defineApp({ api: { middleware } })` applies a Gate, OR the handler
-  reads/validates a session itself.
+- For each mutation handler (named method export or default handler) and each
+  HTTP-exposed capability, check whether
+  `defineApp({ api: { middleware } })` applies a Gate, OR the handler/capability
+  reads and validates a session itself. App-level API middleware wraps generated
+  capability endpoints before capability-specific middleware.
 - Common bug: dashboard route is protected by middleware, but
   `POST /api/items` is not — attacker bypasses the UI entirely.
 

package/skills/audit-csrf/SKILL.md

@@ -128,7 +128,8 @@ The canonical shape is in `recipes-auth.md` (the `origin-check.ts` example).
 
 Verify the wiring: the middleware name must appear in
 `defineApp({ api: { middleware: [...] } })` — that single global list applies
-to every API route. There is no per-group API middleware, and
+to every API route and generated capability HTTP endpoint. There is no
+per-group API middleware, and
 `pracht inspect api --json` output has no middleware field, so the manifest is
 the only place to check.
 

package/skills/audit-secrets/SKILL.md

@@ -115,6 +115,12 @@ Check for accidental exposure outside loaders:
   intentionally public, so flag client-side `VITE_*` references unless they are
   explicitly allowlisted and reviewed. Warn loudly if a public env name has a
   secret-shaped name.
+- Flag any client-side read of `import.meta.env` that is not a single-key
+  access — a bare reference, destructuring, a spread, or bracket access such as
+  `const env = import.meta.env` or `import.meta.env["MODE"]`. Vite replaces
+  those with an object literal holding **every** exposed variable, so the
+  `VITE_*` values land in the bundle with no accessor text left for a
+  name-based grep to find. Use `publicEnv` to enumerate public values.
 - Confirm server-side env access uses `serverEnv` (from
   `@pracht/core/env/server`) or `context.env` rather than ad-hoc globals.
 

package/skills/pre-deploy/SKILL.md

@@ -77,8 +77,9 @@ a markdown summary (graph diff + verify + budgets) worth attaching to it.
   deployment environment. List them for the user.
 - If the app mounts `createImageHandler()` from `@pracht/image/node`, confirm
   `sharp` is installed and `localOrigin` is the same trusted public origin as
-  `nodeAdapter({ canonicalOrigin })`. A production-relative image endpoint
-  without both values is an error.
+  `nodeAdapter({ canonicalOrigin })`. A relative image endpoint without both
+  values is an error in every environment; loopback-looking request origins
+  are intentionally not trusted.
 - Reverse-proxy / TLS termination configured (out of scope for this skill —
   flag for confirmation).
 

package/src/index.js

@@ -21,6 +21,7 @@ const FALLBACK_VERSION_RANGES = {
   "@pracht/vite-plugin": "^0.3.2",
   "@tailwindcss/vite": "^4.1.0",
   tailwindcss: "^4.1.0",
+  typescript: "^6.0.0",
   vercel: "^56.5.0",
 };
 
@@ -567,6 +568,7 @@ async function buildProjectFiles({
     "@pracht/vite-plugin",
     "@pracht/core",
     adapter.packageName,
+    "typescript",
   ];
   if (adapter.id === "vercel") {
     packagesToResolve.push("vercel");
@@ -664,6 +666,7 @@ function createPackageJson({ adapter, projectName, tailwind, versions }) {
   const scripts = {
     build: "pracht build",
     dev: "pracht dev",
+    typecheck: "tsc --noEmit",
   };
 
   if (adapter.id === "node") {
@@ -676,6 +679,7 @@ function createPackageJson({ adapter, projectName, tailwind, versions }) {
     "@pracht/vite-plugin": versions["@pracht/vite-plugin"],
     preact: "^10.26.9",
     "preact-render-to-string": "^6.5.13",
+    typescript: versions["typescript"],
     vite: "^8.0.0",
   };
 
@@ -1116,6 +1120,8 @@ function createReadme({ adapter, agentTools, packageManager, projectName, router
   const previewCommand = packageManager === "npm" ? "npm run preview" : `${packageManager} preview`;
   const startCommand = packageManager === "npm" ? "npm run start" : `${packageManager} start`;
   const deployCommand = packageManager === "npm" ? "npm run deploy" : `${packageManager} deploy`;
+  const typecheckCommand =
+    packageManager === "npm" ? "npm run typecheck" : `${packageManager} typecheck`;
 
   const lines = [
     `# ${projectName}`,
@@ -1126,6 +1132,7 @@ function createReadme({ adapter, agentTools, packageManager, projectName, router
     "",
     `- \`${installCommand}\``,
     `- \`${devCommand}\``,
+    `- \`${typecheckCommand}\``,
   ];
 
   if (adapter.id === "node") {