scripts/smoke.mjs drives a deployment the way a client does — PRM, AS metadata, DCR,
consent + CSRF, password sign-in, PKCE exchange, initialize, tools/list, every read-only
tool, revoke, revoked-token 401 — printing step outcomes only. Wired as `pnpm smoke`, as a
post-deploy step in mcp.yml, and as a weekly/dispatchable mcp-smoke.yml; both skip with a
notice until the SMOKE_USERNAME / SMOKE_PASSWORD repo secrets exist. Verified end to end
against wrangler dev + the fake, including the failure path (exit 1, no credential echoed).
Claude-Session: https://claude.ai/code/session_01H3gfN2NCx3hBXSrZXYHUQ3
scripts/gen-api.mjs fetches https://storyteller-docs.netlify.app/api.json
(the source of truth for API shape), trims it to src/upstream/allowlist.json
plus transitively referenced schemas (19 paths / 103 schemas instead of
253 / 859), and emits test/fixtures/api.json and src/upstream/schema.d.ts
via openapi-typescript. Both outputs are committed; `pnpm gen:api`
regenerates them deliberately.
Two discrepancies in the published document are corrected during
generation and recorded in docs/backend-handoff.md:
- path parameters are declared as one object-typed parameter (flattened
when its properties match the path template);
- POST /v1/login and /v1/accounts/google_sso declare their JSON body a
second time as a path parameter (dropped as a duplicate of requestBody).
The generator refuses to write anything if it meets a shape it does not
recognise.
Also: .gitattributes normalising to LF, eslint/prettier ignores for the
generated files, Node-script lint block, nested .wrangler ignores.
pnpm check: typecheck, eslint, prettier, 37 tests passing.
Claude-Session: https://claude.ai/code/session_01H3gfN2NCx3hBXSrZXYHUQ3
Tanish Manku