@apifuse/provider-sdk 2.1.0-beta.17 → 2.1.0-beta.19

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @apifuse/provider-sdk Changelog
 
+## 2.1.0-beta.19
+
+- Release candidate for main commit 71d76385f722b1202880f26b14ea3916a07852eb.
+
+## 2.1.0-beta.18
+
+- Release candidate for main commit 46f93ecf8c2c8aab1afd0f23f5f62a87cbb45f6d.
+
 ## 2.1.0-beta.17
 
 - Release candidate for main commit c4466ffc8a30cb99740b50687a62b92cec9ba10e.

package/README.md

@@ -56,7 +56,7 @@ Removed legacy runtime paths are not supported:
 cd my-provider
 bun run check
 bun run test
-bun run submit-check
+bun run submit-check -- --smoke
 bun run dev
 ```
 
@@ -245,10 +245,10 @@ be replaced before recording fixtures.
 Standalone providers include a pre-submission script:
 
 ```bash
-bun run submit-check
+bun run submit-check -- --smoke
 ```
 
-This runs the public review-readiness evaluator and writes `submission-report.md`. The report contains provider metadata, a 100-point readiness score, hard blockers, warnings, checklist evidence, and remediation. Blockers override the score; fix them before posting bounty evidence. The command is offline-safe by default and does not execute arbitrary upstream calls. Add local smoke notes to your assigned workspace PR after testing `/health` and `POST /v1/{operation}`. See [`SUBMISSION.md`](./SUBMISSION.md) for the full public-only bounty submission checklist shipped in the npm package.
+This runs the public review-readiness evaluator and writes `submission-report.md`. The report contains provider metadata, a 100-point readiness score, hard blockers, warnings, checklist evidence, measured smoke details, and remediation. Blockers override the score; fix them before posting bounty evidence. `--smoke` boots the local dev server, checks `/health`, and POSTs every operation fixture. Set `APIFUSE__PROVIDER__*` env vars when live upstream credentials are available; without them, structured provider errors can still earn runtime-path smoke credit. See [`SUBMISSION.md`](./SUBMISSION.md) for the full public-only bounty submission checklist shipped in the npm package.
 
 ## Scope boundary
 

package/SUBMISSION.md

@@ -9,11 +9,11 @@ bunx @apifuse/provider-sdk@beta create my-provider --yes
 cd my-provider
 bun run check
 bun run test
-bun run submit-check
+bun run submit-check -- --smoke
 bun run dev
 ```
 
-`bun run submit-check` runs `apifuse submit-check . --markdown submission-report.md` in generated Providers.
+`bun run submit-check -- --smoke` runs the generated `apifuse submit-check . --markdown submission-report.md` script with measured smoke enabled.
 
 ## What submit-check scores
 
@@ -52,20 +52,19 @@ Fix all blockers before submitting:
 
 Warnings do not fail the command, but they should be addressed when practical. For example, the generated starter `ping` operation warns because it is not a real upstream-backed bounty Operation. SDK-native warnings also flag moderate `as Type` assertion counts and credentialed Providers that never reference `ctx.credential`.
 
-## Safe local smoke evidence
+## Measured local smoke
 
-`submit-check` does not call arbitrary live upstream APIs by default. After replacing starter logic, run the Provider locally and record a short evidence note:
+`submit-check` does not call live upstream APIs by default. For smoke scoring,
+run measured smoke so the CLI boots the Provider, checks `/health`, and POSTs
+each operation fixture:
 
 ```bash
-bun run dev
-curl -s http://localhost:3900/health
-curl -s -X POST http://localhost:3900/v1/<operation> \
-  -H 'Content-Type: application/json' \
-  -d '{"requestId":"req_local_smoke","input":{...},"headers":{}}'
-
-bun run submit-check -- --smoke-note "GET /health and POST /v1/<operation> passed locally with redacted input."
+bun run submit-check -- --smoke
 ```
 
+`APIFUSE__PROVIDER__*` env vars enable live upstream calls. Their absence can
+still produce 7/10 smoke credit when every operation routes and returns a
+structured provider error envelope, but zero schema-valid successes are observed.
 Never paste real credentials, personal data, account numbers, access tokens, cookies, or unredacted upstream responses into workspace PR comments, chat, or reports.
 
 ## Submission evidence checklist