mcp: demo-account smoke script, weekly smoke workflow, post-deploy smoke

scripts/smoke.mjs drives a deployment the way a client does — PRM, AS metadata, DCR,
consent + CSRF, password sign-in, PKCE exchange, initialize, tools/list, every read-only
tool, revoke, revoked-token 401 — printing step outcomes only. Wired as `pnpm smoke`, as a
post-deploy step in mcp.yml, and as a weekly/dispatchable mcp-smoke.yml; both skip with a
notice until the SMOKE_USERNAME / SMOKE_PASSWORD repo secrets exist. Verified end to end
against wrangler dev + the fake, including the failure path (exit 1, no credential echoed).

Claude-Session: https://claude.ai/code/session_01H3gfN2NCx3hBXSrZXYHUQ3

.github/workflows/mcp-smoke.yml

@@ -0,0 +1,43 @@
+name: mcp smoke
+
+# The only place this project touches the real Artcraft backend: a read-only pass with the
+# demo account against production (docs/infra-request.md §2 and §4). Weekly, so a change on
+# the Claude/ChatGPT side or upstream shows up as a red badge rather than a support ticket.
+on:
+  schedule:
+    - cron: "0 9 * * 1" # Mondays 09:00 UTC
+  workflow_dispatch:
+    inputs:
+      base_url:
+        description: "MCP server origin to smoke (defaults to production)"
+        required: false
+        default: "https://mcp.getartcraft.com"
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: mcp
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - id: creds
+        run: |
+          if [ -n "$SMOKE_USERNAME" ] && [ -n "$SMOKE_PASSWORD" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::SMOKE_USERNAME / SMOKE_PASSWORD not configured; skipping."
+            echo "present=false" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          SMOKE_USERNAME: ${{ secrets.SMOKE_USERNAME }}
+          SMOKE_PASSWORD: ${{ secrets.SMOKE_PASSWORD }}
+      - if: steps.creds.outputs.present == 'true'
+        run: node scripts/smoke.mjs
+        env:
+          SMOKE_BASE_URL: ${{ inputs.base_url || 'https://mcp.getartcraft.com' }}
+          SMOKE_USERNAME: ${{ secrets.SMOKE_USERNAME }}
+          SMOKE_PASSWORD: ${{ secrets.SMOKE_PASSWORD }}

.github/workflows/mcp.yml

@@ -69,3 +69,11 @@ jobs:
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      # Read-only smoke with the demo account, right after the deploy (skipped until the
+      # demo-account secrets exist; docs/infra-request.md §2 and §4).
+      - if: steps.creds.outputs.present == 'true' && env.SMOKE_USERNAME != ''
+        run: node scripts/smoke.mjs
+        env:
+          SMOKE_BASE_URL: https://mcp.getartcraft.com
+          SMOKE_USERNAME: ${{ secrets.SMOKE_USERNAME }}
+          SMOKE_PASSWORD: ${{ secrets.SMOKE_PASSWORD }}