@emseepea/create-soap-backed-server 0.0.8 → 0.0.10

package/README.md

@@ -75,6 +75,23 @@ Keep service credentials outside the URL and source code. Add authentication
 headers inside the server for your provider. Never accept an endpoint, schema
 location, SOAP action, or arbitrary XML from an MCP caller.
 
+## Build a production container
+
+Run `npm install` first so the project has a lockfile. Then run:
+
+```sh
+npm run container:build
+```
+
+The image includes the local WSDL and XSD contracts required at runtime. It is
+for a production deployment behind a trusted proxy, starts with the fail-closed
+production profile, and needs a runtime-mounted deployment configuration file.
+Keep secrets in your platform's runtime secret store, not in the Dockerfile,
+build arguments, or deployment configuration file.
+
+For the production proxy, runtime configuration, and hardening requirements, see
+the [container guide](https://emseepea.github.io/emseepea/examples/#build-a-production-container).
+
 ## Change the Contract
 
 Edit the local files under `contracts/`, then regenerate and review the diff:

package/initializer-dist/template/.dockerignore

@@ -0,0 +1,17 @@
+.env
+.env.*
+.git
+.github
+.npmrc
+artifacts
+coverage
+dist
+docs
+eval
+initializer-dist
+node_modules
+release-artifacts
+test
+test-support
+*.log
+*.tsbuildinfo

package/initializer-dist/template/Dockerfile

@@ -0,0 +1,20 @@
+FROM docker.io/library/node:24.21.0-trixie-slim@sha256:db3ae80f5d8df06e04dabdf7b44cbf008d32de168205fa0294444aabbc08c590 AS build
+WORKDIR /app
+COPY . .
+RUN test "$(node --version)" = "v24.21.0" \
+  && test -f package-lock.json \
+  && npm ci --ignore-scripts \
+  && npm run build \
+  && npm prune --omit=dev --ignore-scripts
+
+FROM gcr.io/distroless/nodejs24-debian13:nonroot@sha256:7781e8b4fccf59240bd539af6738cccf8dad4be303165c3a1fa065c48699b937
+WORKDIR /app
+ENV EMSEEPEA_DEPLOYMENT_MODE=production-behind-proxy
+COPY --from=build --chown=65532:65532 /app/package.json ./package.json
+COPY --from=build --chown=65532:65532 /app/node_modules ./node_modules
+COPY --from=build --chown=65532:65532 /app/dist ./dist
+COPY --from=build --chown=65532:65532 /app/contracts ./contracts
+USER 65532:65532
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 CMD ["/nodejs/bin/node", "-e", "const port=process.env.PORT||'3000';fetch(`http://127.0.0.1:${port}/healthz`).then((r)=>process.exit(r.ok?0:1),()=>process.exit(1));"]
+CMD ["dist/server.js"]

package/initializer-dist/template/README.md

@@ -47,6 +47,23 @@ Keep service credentials outside the URL and source code. Add authentication
 headers inside the server for your provider. Never accept an endpoint, schema
 location, SOAP action, or arbitrary XML from an MCP caller.
 
+## Build a production container
+
+Run `npm install` first so the project has a lockfile. Then run:
+
+```sh
+npm run container:build
+```
+
+The image includes the local WSDL and XSD contracts required at runtime. It is
+for a production deployment behind a trusted proxy, starts with the fail-closed
+production profile, and needs a runtime-mounted deployment configuration file.
+Keep secrets in your platform's runtime secret store, not in the Dockerfile,
+build arguments, or deployment configuration file.
+
+For the production proxy, runtime configuration, and hardening requirements, see
+the [container guide](https://emseepea.github.io/emseepea/examples/#build-a-production-container).
+
 ## Change the Contract
 
 Edit the local files under `contracts/`, then regenerate and review the diff:

package/initializer-dist/template/package.json

@@ -13,11 +13,12 @@
     "test:built": "node --test test/*.test.mjs",
     "test:llm": "npm run build && npm run test:llm:built",
     "test:llm:built": "emseepea-test eval",
-    "lint": "oxlint src test test-types eval scripts test-support"
+    "lint": "oxlint src test test-types eval scripts test-support",
+    "container:build": "docker build --tag emseepea-server:local ."
   },
   "devDependencies": {
-    "@emseepea/feedback": "0.2.4",
-    "@emseepea/testing": "0.9.7",
+    "@emseepea/feedback": "0.2.6",
+    "@emseepea/testing": "0.9.9",
     "@types/node": "24.13.3",
     "typescript": "6.0.3",
     "oxlint": "1.80.0"
@@ -27,7 +28,7 @@
   },
   "private": true,
   "dependencies": {
-    "@emseepea/server": "0.9.0",
+    "@emseepea/server": "0.10.0",
     "@types/sax": "1.2.7",
     "soap": "1.11.0",
     "xml-xsd-engine": "1.7.3",

package/initializer-dist/template/src/server.ts

@@ -1,8 +1,8 @@
-import { serveEmseepea } from "@emseepea/server";
+import { loadDeploymentProfile, serveEmseepea } from "@emseepea/server";
 import { createSoapExample } from "./app.js";
 
 const endpoint = process.env.PEA_SOAP_URL ?? "http://127.0.0.1:3999/soap";
-const { app } = await createSoapExample(endpoint);
+const { app } = await createSoapExample(endpoint, { deployment: loadDeploymentProfile() });
 const running = await serveEmseepea(app, {
   port: Number.parseInt(process.env.PORT ?? "3000", 10),
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emseepea/create-soap-backed-server",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Create an Em See Pea server that validates a SOAP service from its XSD contract.",
   "license": "MIT",
   "type": "module",
@@ -20,12 +20,12 @@
     "prepack": "npm run build:initializer"
   },
   "devDependencies": {
-    "@emseepea/feedback": "0.2.4",
-    "@emseepea/server": "0.9.0",
+    "@emseepea/feedback": "0.2.6",
+    "@emseepea/server": "0.10.0",
     "soap": "1.11.0",
     "xml-xsd-engine": "1.7.3",
     "zod": "4.4.3",
-    "@emseepea/testing": "0.9.7",
+    "@emseepea/testing": "0.9.9",
     "@types/node": "24.13.3",
     "@types/sax": "1.2.7",
     "typescript": "6.0.3",