create-pracht 0.6.0 → 0.6.2

package/skills/audit-loaders/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: audit-loaders
-version: 1.1.0
+version: 1.1.1
 description: |
-  Audit pracht route loaders for serializability, leaked secrets,
-  unsafe loader caching, browser-only API misuse, and missing AbortSignal plumbing.
-  Use when asked to "audit loaders", "check loader data", "find serialization
-  bugs", "are my loaders safe", or "loader security review".
+  Audit pracht route loaders for serializability, leaked secrets, unsafe
+  `loaderCache`, browser-only API use, and missing `AbortSignal` plumbing.
+  Use for "audit loaders", "check loader data", "find serialization bugs", "loader
+  security review".
 allowed-tools:
   - Bash
   - Read
@@ -21,8 +21,8 @@ ends up in the browser — including secrets you never meant to expose.
 
 ## Step 1: Enumerate routes
 
-If the pracht MCP server is registered (see docs/MCP.md), prefer its tools
-(`inspect_routes`, `inspect_api`, `inspect_build`, `doctor`, `verify`) over
+MCP: when the pracht MCP server is registered (docs/MCP.md), prefer its
+`inspect_routes`/`inspect_api`/`inspect_build`/`doctor`/`verify` tools over
 shelling out.
 
 ```bash
@@ -51,12 +51,27 @@ Flag returns that contain any of:
 | `Date`, `Map`, `Set`, `URL`  | Not preserved by `JSON.stringify`   |
 | Class instances              | Lose prototype on the client        |
 | `Function` / arrow values    | Stripped silently                   |
-| `Promise`                    | Becomes `{}`                        |
+| `Promise` (bare)             | Becomes `{}` — wrap in `defer()`    |
 | Circular refs                | Throws at serialize time            |
 | `Buffer` / typed arrays      | Becomes `{}` or numeric keys        |
 | `bigint`                     | `JSON.stringify` throws             |
 | `undefined` in arrays/object | Drops keys; arrays become `null`    |
 
+A bare promise in loader data is always a bug — it serializes to `{}`. The fix
+is `defer(promise)`, which marks the field as deferred and is read in the
+component with `use()` inside a `<Suspense>` boundary. Flag a bare promise as an
+`error` and point at `defer()`; a `defer()`ed field is correct and must not be
+flagged.
+
+Two `defer()` rules worth checking while you are in the loader:
+
+- A deferred value must not redirect, throw `PrachtHttpError`, or set response
+  status or headers — by the time it settles the response is already committed.
+  Auth belongs in middleware or the awaited part of the loader.
+- `defer(await …)` defeats the point and throws at runtime. Flag it.
+- `defer()` must be returned from an enumerable data property, not hidden
+  behind a getter. An unresolved marker throws during serialization.
+
 Recommend converting to `string` (ISO for dates), plain arrays, or plain objects
 before return.
 

package/skills/audit-redirects/SKILL.md

@@ -1,14 +1,13 @@
 ---
 name: audit-redirects
-version: 1.1.0
+version: 1.1.1
 description: |
-  Find open-redirect vulnerabilities in pracht loaders, middleware, and
-  navigation calls. The framework guards both ends — the client router drops
-  unsafe URL schemes, and the server `redirect()` helper rejects unsafe
-  schemes and CRLF injection — but a hand-rolled 3xx Response bypasses every
-  guard, and even a guarded redirect to an attacker-chosen origin can phish.
-  Use when asked to "audit redirects", "check for open redirects", "is my
-  ?redirect= param safe", or "review login redirect handling".
+  Find open redirects in pracht loaders, middleware, and navigation. The framework
+  rejects unsafe schemes and CRLF at both ends, but a hand-rolled 3xx Response
+  bypasses every guard, and even a guarded redirect to an attacker-chosen origin
+  can phish.
+  Use for "audit redirects", "check for open redirects", "is my ?redirect= param
+  safe", "review login redirect handling".
 allowed-tools:
   - Bash
   - Read
@@ -41,8 +40,8 @@ Bound the search first — do not grep the whole repo blind:
 pracht inspect routes --json
 ```
 
-If the pracht MCP server is registered (see `docs/MCP.md`), prefer its tools
-(`inspect_routes`, `inspect_api`, `inspect_build`, `doctor`, `verify`) over
+MCP: when the pracht MCP server is registered (docs/MCP.md), prefer its
+`inspect_routes`/`inspect_api`/`inspect_build`/`doctor`/`verify` tools over
 shelling out.
 
 The resolved graph gives you each route's `file`, `loaderFile`, and

package/skills/audit-secrets/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: audit-secrets
-version: 1.1.0
+version: 1.1.1
 description: |
-  Detect environment variables and secrets that leak from the server into
-  the client bundle via loader return values, hydration state, or accidental
-  imports of server-only modules from client code paths.
-  Use when asked to "audit secrets", "find leaked env vars", "is my API key
-  exposed", "check client bundle for secrets", or "scan for credential leaks".
+  Detect environment variables and secrets reaching the client bundle via loader
+  return values, hydration state, or server-only modules imported from client code
+  paths.
+  Use for "audit secrets", "find leaked env vars", "is my API key exposed", "scan
+  for credential leaks".
 allowed-tools:
   - Bash
   - Read

package/skills/audit-seo/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: audit-seo
-version: 1.1.0
+version: 1.1.1
 description: |
-  Per-route SEO audit for a pracht app: `head()` coverage, title/description
-  presence, Open Graph and Twitter card completeness, canonical URLs, robots
-  rules, and a generated `sitemap.xml` derived from the route manifest.
-  Use when asked to "audit SEO", "check meta tags", "generate a sitemap",
-  "are my OG cards set", or "review robots.txt".
+  Per-route SEO audit: `head()` coverage, title and description presence, Open
+  Graph and Twitter cards, canonicals, robots rules, plus a `sitemap.xml`
+  generated from the route manifest.
+  Use for "audit SEO", "check meta tags", "generate a sitemap", "are my OG cards
+  set", "review robots.txt".
 allowed-tools:
   - Bash
   - Read
@@ -23,8 +23,8 @@ coverage and generates the static SEO artifacts.
 
 ## Step 1: Inventory
 
-If the pracht MCP server is registered (see docs/MCP.md), prefer its tools
-(`inspect_routes`, `inspect_api`, `inspect_build`, `doctor`, `verify`) over
+MCP: when the pracht MCP server is registered (docs/MCP.md), prefer its
+`inspect_routes`/`inspect_api`/`inspect_build`/`doctor`/`verify` tools over
 shelling out.
 
 ```bash

package/skills/audit-shells/SKILL.md

@@ -1,13 +1,12 @@
 ---
 name: audit-shells
-version: 1.1.0
+version: 1.1.1
 description: |
-  Audit pracht shells for composition bugs: missing `Loading()` on SPA-using
-  shells, accidental `<html>`/`<head>`/`<body>` rendering, shells that swallow
-  children, unused shells, and redundant `ErrorBoundary` exports (shell-level
-  boundaries are valid fallbacks; routes win when both declare one).
-  Use when asked to "audit shells", "check shell composition", "find unused
-  shells", or "is my layout structured correctly".
+  Audit pracht shells: missing `Loading()` on SPA routes, `<html>`/`<head>`/
+  `<body>` rendered inside a shell, shells that never render `children`, unused
+  shells, and `ErrorBoundary` exports shadowed by every route under them.
+  Use for "audit shells", "check shell composition", "find unused shells", "is my
+  layout structured correctly".
 allowed-tools:
   - Bash
   - Read
@@ -24,8 +23,8 @@ component.
 
 ## Step 1: Enumerate
 
-If the pracht MCP server is registered (see docs/MCP.md), prefer its tools
-(`inspect_routes`, `inspect_api`, `inspect_build`, `doctor`, `verify`) over
+MCP: when the pracht MCP server is registered (docs/MCP.md), prefer its
+`inspect_routes`/`inspect_api`/`inspect_build`/`doctor`/`verify` tools over
 shelling out.
 
 ```bash

package/skills/configure-isg/SKILL.md

@@ -1,14 +1,13 @@
 ---
 name: configure-isg
-version: 1.0.0
+version: 1.0.1
 description: |
-  Wire ISG (incremental static generation) revalidation correctly for the
-  project's adapter: route-level timeRevalidate/webhookRevalidate policies,
-  the authenticated /__pracht/revalidate webhook, Cloudflare Workers Caching,
-  Vercel native ISR, and cache-key pitfalls — then verify it locally.
-  Use when asked to "set up ISG", "configure revalidation", "add a
-  revalidation webhook", "my ISG page never updates", or "cache this page at
-  the edge".
+  Wire ISG revalidation for the project's adapter: route-level
+  `timeRevalidate`/`webhookRevalidate`, the authenticated `/__pracht/revalidate`
+  webhook, Cloudflare Workers Cache, Vercel ISR, and cache-key pitfalls — then
+  verify locally.
+  Use for "set up ISG", "configure revalidation", "add a revalidation webhook", "my
+  ISG page never updates", "cache this page at the edge".
 allowed-tools:
   - Bash
   - Read
@@ -30,8 +29,8 @@ webhook, and the adapter-specific cache correctly.
 
 ## Step 1: Identify adapter and candidate routes
 
-If the pracht MCP server is registered (see docs/MCP.md), prefer its tools
-(`inspect_routes`, `inspect_api`, `inspect_build`, `doctor`, `verify`) over
+MCP: when the pracht MCP server is registered (docs/MCP.md), prefer its
+`inspect_routes`/`inspect_api`/`inspect_build`/`doctor`/`verify` tools over
 shelling out.
 
 ```bash