scripts/smoke.mjs drives a deployment the way a client does — PRM, AS metadata, DCR,
consent + CSRF, password sign-in, PKCE exchange, initialize, tools/list, every read-only
tool, revoke, revoked-token 401 — printing step outcomes only. Wired as `pnpm smoke`, as a
post-deploy step in mcp.yml, and as a weekly/dispatchable mcp-smoke.yml; both skip with a
notice until the SMOKE_USERNAME / SMOKE_PASSWORD repo secrets exist. Verified end to end
against wrangler dev + the fake, including the failure path (exit 1, no credential echoed).
Claude-Session: https://claude.ai/code/session_01H3gfN2NCx3hBXSrZXYHUQ3
Cloudflare Worker scaffold for the MCP server (Hono, TypeScript strict,
pnpm 11 via corepack, wrangler 4, vitest 4 in workerd).
- wrangler.toml declares local/preview/production; production alone pins
https://api.storyteller.ai. Binding types are generated by `wrangler types`.
- src/config.ts parses the bindings and asserts the upstream-host
invariant per environment; src/index.ts fails every request with a 500
naming the mismatch if the invariant is violated.
- Guardrail tests: config invariant, wrangler.toml environment mapping,
MCP_ENVIRONMENT referenced only in config.ts and never branched on,
/healthz through the Worker entry.
- fake-upstream/: separate Worker (artcraft-api-fake) that will hold the
ported fake API routes; eslint forbids imports across the boundary in
both directions.
- .github/workflows/mcp.yml: typecheck, lint, format, test on mcp/**;
production deploy skips with a notice until Cloudflare secrets exist.
pnpm check: typecheck, eslint, prettier, 28 tests passing.
Claude-Session: https://claude.ai/code/session_01H3gfN2NCx3hBXSrZXYHUQ3
The frontend migrated to pnpm workspaces in #1606, which introduced
"workspace:*" dependencies. npm cannot resolve that protocol, so the
macOS and Windows publish workflows fail at "npm ci" with
EUNSUPPORTEDPROTOCOL, breaking production release builds on main.
Add a pinned pnpm setup step and replace the npm install block with
"pnpm install --frozen-lockfile". Verified the frozen install resolves
cleanly against the committed pnpm-lock.yaml.
---------
Co-authored-by: bflatastic <bombayapirat@gmail.com>
Tanish Manku
BFlat
Tanish Mankuandbflatastic
Brandon Thomas
Kasisnu