fix: stop calling four API routes that do not exist (#125)

[karlwaldman]

Closes #125.

Problem

Four methods called routes the API has never served. Every call returned 404, while the mocked tests stayed green. #125 listed three; the new contract test found a fourth (futures.continuous).

Decisions

Checked against rails routes and swagger.json from oilpriceapi-api b64093719. All live calls were made with the test key on 2026-10-03.

Method	Path called	Live	Matching route?	Change	Supported alternative (live)
drilling.trends()	/v1/drilling-intelligence/trends	404	none	deprecated; rejects, no request	summary() 200; completions() 200; ducWells() 200
drilling.basin(name)	/v1/drilling-intelligence/basin/{name}	404	none	deprecated; rejects, no request	by_basin maps on completions(), wellsDrilled(), ducWells(), fracSpreads()
futures.spreads(c1, c2)	/v1/futures/spreads	404	none: only per-family calendar spreads	deprecated; rejects, no request	futures.family(slug).spreads(): /v1/futures/brent/spreads 200, /v1/futures/wti/spreads 200
futures.continuous(c, m)	/v1/futures/{c}/continuous	404	/v1/futures/continuous/{brent|wti} (different shape)	deprecated; rejects, no request	new futures.continuousFrontMonth("brent"|"wti"): /v1/futures/continuous/brent 200, /v1/futures/continuous/wti 200

Deprecated methods reject with OilPriceAPIError, code ENDPOINT_NOT_AVAILABLE, and the message names the alternative. They will be removed in the next major. Signatures are unchanged, so existing code still compiles.

Contract test

• tests/api-path-contract.test.ts extracts every /v1/... literal from src/ (comments stripped). It fails when a path matches no customer-facing route in tests/fixtures/api-paths.json.
• That fixture is 520 routes from rails routes, each tagged with its swagger or openapi_route_policy.yml audience. Dashboard, website, internal and operations routes do not count.
• /v1/data-sources is allowlisted with a reason: policy classes it as dashboard, but it answers an API key with 403 ORG_REQUIRED, not 401.
• scripts/refresh-api-paths.mjs regenerates the fixture.
• Proved red: changing continuousFrontMonth to an unrouted path failed the test (/v1/futures/spreads/{param}), and restoring it went green.

Hygiene from the issue

• @types/node and @types/ws stay in dependencies. The published declarations reference them: dist/index.d.ts:71 (Buffer), dist/resources/streaming.d.ts:32-33 (node:events, ws). Consumers type-checking without skipLibCheck need them, so moving them would break consumer type resolution.
• Audit: npm audit fix changed the lockfile only (fast-uri 3.1.7 → 3.1.8, markdown-it → 14.3.2). npm audit --audit-level=low now reports 0 vulnerabilities. This covers Dependabot chore(deps-dev): bump markdown-it from 14.3.0 to 14.3.2 #124.

Version

2.1.0, a minor bump because continuousFrontMonth is a new public method. package.json, src/version.ts, the lockfile, CHANGELOG and release-readiness.test.ts are aligned.

Verification (local)

• npm test: 57 files, 917 passed, 1 skipped, 0 type errors.
• Pass: npx tsc --noEmit, npm run lint, snippets:check, storefront:check, check:secrets, npm run build.
• npm audit --audit-level=low: 0 vulnerabilities.
• smoke:package was not verified locally. The live demo endpoint returned 429 to this machine after repeated runs; it is an environmental rate limit, not a code failure.

Not published. Release after merge as usual.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f8d880d5-1630-41c2-a4d5-0efdcd91f920

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}