@techspokes/typescript-wsdl-client 0.21.0 → 0.24.0

package/README.md

@@ -219,7 +219,7 @@ See [CLI Reference](docs/cli-reference.md) for all flags and examples.
 
 | Guide | Description |
 |-------|-------------|
-| [Gateway Guide](docs/gateway-guide.md) | Fastify integration and error handling |
+| [Gateway Guide](docs/gateway-guide.md) | Fastify integration, inbound enforcement, and error handling |
 | [Testing Guide](docs/testing.md) | Testing patterns and mock client examples |
 | [Production Guide](docs/production.md) | CI/CD, validation, logging |
 | [Troubleshooting](docs/troubleshooting.md) | Common issues and debugging |

package/dist/app/generateApp.js

@@ -512,11 +512,11 @@ function generatePackageJson(appDir, force) {
             fastify: "^5.8.5",
             "fastify-plugin": "^5.1.0",
             saxes: "^6.0.0",
-            soap: "^1.9.2",
+            soap: "^1.9.3",
         },
         devDependencies: {
-            "@types/node": "^25.9.0",
-            tsx: "^4.22.2",
+            "@types/node": "^25.9.1",
+            tsx: "^4.22.3",
             typescript: "^6.0.3",
         },
     };

package/dist/gateway/generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generators.d.ts","sourceRoot":"","sources":["../../src/gateway/generators.ts"],"names":[],"mappings":"AAcA,OAAO,EAAC,KAAK,UAAU,EAAE,KAAK,eAAe,EAAyE,MAAM,cAAc,CAAC;AAG3I;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6IAA6I;IAC7I,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC;QAChC,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,0BAA0B,EAAE,MAAM,EAAE,EACpC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,GAAG,EACvH,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,MAAM,EACnC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACnC,iBAAiB,EAAE,CAyJrB;AAyBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,IAAI,CAsBN;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,iBAAiB,EAAE,EAC/B,WAAW,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,GAChC,IAAI,CA6DN;AA4BD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,GAAG,EACb,IAAI,CAAC,EAAE;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAC,GAC5B,IAAI,CAuPN;AAsCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,GAChC,IAAI,CAwFN;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,GAChC,IAAI,CA6BN;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,iBAAiB,EAAE,EAC/B,WAAW,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,EACjC,UAAU,EAAE,UAAU,EACtB,OAAO,CAAC,EAAE,GAAG,GACZ,IAAI,CA0HN"}
+{"version":3,"file":"generators.d.ts","sourceRoot":"","sources":["../../src/gateway/generators.ts"],"names":[],"mappings":"AAcA,OAAO,EAAC,KAAK,UAAU,EAAE,KAAK,eAAe,EAAyE,MAAM,cAAc,CAAC;AAG3I;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6IAA6I;IAC7I,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC;QAChC,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,0BAA0B,EAAE,MAAM,EAAE,EACpC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,GAAG,EACvH,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,MAAM,EACnC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACnC,iBAAiB,EAAE,CAyJrB;AAyBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,IAAI,CAsBN;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,iBAAiB,EAAE,EAC/B,WAAW,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,GAChC,IAAI,CA6DN;AA4BD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,GAAG,EACb,IAAI,CAAC,EAAE;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAC,GAC5B,IAAI,CAuPN;AAsCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,GAChC,IAAI,CAuFN;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,GAChC,IAAI,CA6BN;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,iBAAiB,EAAE,EAC/B,WAAW,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,EACjC,UAAU,EAAE,UAAU,EACtB,OAAO,CAAC,EAAE,GAAG,GACZ,IAAI,CA0HN"}

package/dist/gateway/generators.js

@@ -701,7 +701,6 @@ export function emitPluginModule(outDir, versionSlug, serviceSlug, clientMeta, i
  */
 import fp from "fastify-plugin";
 import type { FastifyInstance, FastifyPluginOptions } from "fastify";
-import type { ${clientMeta.className} } from "${clientMeta.pluginImportPath}";
 import type { ${clientMeta.className}Operations } from "${clientMeta.operationsImportPath}";
 import { registerSchemas_${vSlug}_${sSlug} } from "./schemas${suffix}";
 import { registerRoutes_${vSlug}_${sSlug} } from "./routes${suffix}";

package/docs/README.md

@@ -37,6 +37,7 @@ Human-maintained reference documents for `@techspokes/typescript-wsdl-client`. T
 - Each document opens with an H1 title and a one-line description.
 - Cross-reference related documents and the root README where relevant.
 - Use fenced code blocks for CLI examples; format flags as inline code (`` `--flag-name` ``).
+- Run `npm run docs:validate` to check local links and TypeScript fenced snippets.
 - Keep language direct and task-oriented; architecture.md targets contributors, all others target users.
 
 ## Related

package/docs/configuration.md

@@ -46,6 +46,21 @@ The older OpenAPI-only shape with top-level `global` and `overrides` is still ac
 
 The generated app scaffold reads upstream secrets from environment variables. It does not embed secret values in generated source and does not implement production JWT, OAuth, or API-key verification for inbound gateway requests. Add that verification in app hooks or your platform gateway.
 
+### Runtime Enforcement Boundaries
+
+The `gateway` security settings describe the generated REST API and add request header schema validation. They do not authenticate callers or authorize access to operations.
+
+The `upstream` security settings configure how the generated app creates `node-soap` runtime security for calls from the gateway to the SOAP service. They do not enforce inbound REST gateway access.
+
+| Concern | Configured In | Generated Behavior | Consumer Responsibility |
+|---------|---------------|--------------------|-------------------------|
+| OpenAPI security schemes | `gateway.global` and `gateway.operations` | Emits OpenAPI security metadata | Keep API documentation aligned with runtime policy |
+| Required inbound headers | `gateway.global.headers` | Adds Fastify schema validation | Verify header values in host app hooks |
+| Inbound JWT verification | Host app or platform gateway | No generated verifier | Validate issuer, audience, signature, and claims |
+| Inbound API key verification | Host app or platform gateway | No generated key lookup | Compare keys against a trusted secret store |
+| Inbound mutual TLS | TLS terminator or host app | No generated certificate validation | Verify client certificate signals from trusted infrastructure |
+| Upstream SOAP credentials | `upstream` | Builds `node-soap` security from environment variables | Provide secrets through deployment environment variables |
+
 ## Tags Configuration
 
 Pass via `--openapi-tags-file`.

package/docs/gateway-guide.md

@@ -34,7 +34,107 @@ await app.listen({ port: 3000 });
 
 The plugin automatically decorates Fastify with the SOAP client, registers JSON schemas, installs a centralized error handler, and registers all routes.
 
-Route paths are determined by --openapi-base-path during generation. The prefix option adds an additional runtime prefix on top of generated paths.
+Route paths are determined by `--openapi-base-path` during generation. The prefix option adds an additional runtime prefix on top of generated paths.
+
+## Inbound Gateway Enforcement
+
+Install inbound authentication, authorization, logging, and request correlation in the host Fastify app before registering the generated gateway plugin. Generated route files are safe to regenerate because custom policy stays outside the generated directory.
+
+The example below accepts either a trusted API key or a bearer token. Replace `verifyJwt` and `principalCanCallWeather` with application-specific policy code.
+
+```typescript
+import { randomUUID } from "node:crypto";
+import Fastify from "fastify";
+import weatherGateway from "./gateway/plugin.js";
+import { Weather } from "./client/client.js";
+
+interface GatewayPrincipal {
+  subject: string;
+  scopes: string[];
+}
+
+declare module "fastify" {
+  interface FastifyRequest {
+    correlationId: string;
+    principal?: GatewayPrincipal;
+  }
+}
+
+declare function verifyJwt(token: string): Promise<GatewayPrincipal>;
+declare function principalCanCallWeather(principal: GatewayPrincipal): boolean;
+
+const app = Fastify({ logger: true });
+
+app.addHook("onRequest", async (request, reply) => {
+  const header = request.headers["x-correlation-id"];
+  request.correlationId = typeof header === "string" && header.length > 0 ? header : randomUUID();
+  reply.header("x-correlation-id", request.correlationId);
+  request.log.info({ correlationId: request.correlationId }, "gateway request started");
+});
+
+app.addHook("preHandler", async (request, reply) => {
+  const expectedApiKey = process.env.GATEWAY_API_KEY;
+  const apiKey = request.headers["x-api-key"];
+  if (expectedApiKey && apiKey === expectedApiKey) return;
+
+  const authorization = request.headers.authorization;
+  if (!authorization?.startsWith("Bearer ")) {
+    return reply.code(401).send({ error: "missing gateway credentials" });
+  }
+
+  const principal = await verifyJwt(authorization.slice("Bearer ".length));
+  if (!principalCanCallWeather(principal)) {
+    return reply.code(403).send({ error: "gateway access denied" });
+  }
+
+  request.principal = principal;
+});
+
+const weatherClient = new Weather({
+  source: "https://example.com/weather.wsdl",
+});
+
+await app.register(weatherGateway, {
+  client: weatherClient,
+});
+```
+
+### Mutual TLS Signals
+
+When Fastify terminates TLS directly, inspect the peer certificate before generated handlers run.
+
+```typescript
+import type { TLSSocket } from "node:tls";
+
+app.addHook("preHandler", async (request, reply) => {
+  const socket = request.raw.socket as TLSSocket;
+  const cert = socket.getPeerCertificate();
+  if (!cert || Object.keys(cert).length === 0) {
+    return reply.code(401).send({ error: "client certificate required" });
+  }
+
+  request.log.info({ subject: cert.subject }, "client certificate accepted");
+});
+```
+
+When TLS terminates at a load balancer or platform gateway, verify a trusted internal signal instead of reading the socket certificate. Strip public client-supplied certificate headers at ingress and inject trusted headers only after certificate validation succeeds.
+
+```typescript
+app.addHook("preHandler", async (request, reply) => {
+  const subject = request.headers["x-client-cert-subject"];
+  if (typeof subject !== "string" || subject.length === 0) {
+    return reply.code(401).send({ error: "client certificate signal required" });
+  }
+
+  request.log.info({ subject }, "trusted client certificate signal accepted");
+});
+```
+
+### Where To Put Custom Logic
+
+Use host app hooks for authentication, authorization, logging, request correlation, and platform headers. Register hooks before `app.register(weatherGateway, ...)` so they run before generated route handlers.
+
+Use Fastify encapsulation when different generated services need different policies. Do not edit generated route files because regeneration overwrites them.
 
 ## Using Individual Components (Advanced)
 
@@ -115,7 +215,7 @@ export async function registerRoute_v1_weather_getweatherinformation(fastify: Fa
 The client method returns `StreamOperationResponse<RecordType>` with a
 `records: AsyncIterable<RecordType>`. Errors raised before the first record
 use the normal error envelope; errors raised mid-stream trip the chunked
-response's truncation — consumers detect these via the absence of a clean
+response's truncation. Consumers detect these via the absence of a clean
 terminating zero-chunk.
 
 ## Error Handling

package/docs/releases/v0.22.0.md

@@ -0,0 +1,30 @@
+# TypeScript WSDL Client v0.22.0
+
+## Release Workflow And Dependency Refresh
+
+This release refreshes dependency pins from the recent bot merges and carries forward release documentation improvements for the packaged agent skill workflow.
+
+## What This Improves
+
+Maintainers get a release flow whose generated draft bodies use validated release-note subtitles and consumer-facing validation language. Consumer projects generated by the app scaffold also receive newer SOAP runtime and TypeScript execution pins without manual dependency editing.
+
+## Highlights
+
+- Updates root pins to `@types/node` 25.9.1, `soap` 1.9.3, `tsx` 4.22.3, and `vitest` 4.1.7.
+- Updates app scaffold pins to `@types/node` 25.9.1, `soap` 1.9.3, and `tsx` 4.22.3.
+- Renders draft release bodies from validated release-note subtitles.
+- Describes release validation as consumer-facing outcomes and surfaces the standalone agent skill artifact in docs.
+
+## Upgrade Notes
+
+No special upgrade steps.
+
+## Validation
+
+- CI passed.
+- NPM package contents were validated.
+- Agent skill artifact was validated and packaged.
+
+## Notes
+
+Release tag: `v0.22.0`.

package/docs/releases/v0.23.0.md

@@ -0,0 +1,31 @@
+# TypeScript WSDL Client v0.23.0
+
+## Documentation Validation And Gateway Boundaries
+
+This release adds portable documentation validation and clarifies where generated gateways expect applications or platform gateways to enforce inbound security controls.
+
+## What This Improves
+
+Maintainers now have a repeatable check for local Markdown links and TypeScript fenced snippets before release. Gateway adopters get clearer guidance for adding authentication, authorization, logging, and request correlation around generated route files without editing generated output.
+
+## Highlights
+
+- Adds `npm run docs:validate` for repository-maintained Markdown links and TypeScript fenced snippets.
+- Includes documentation validation in `npm run ci`.
+- Documents inbound gateway enforcement extension points for generated Fastify apps.
+- Updates the roadmap to reflect the shipped documentation validator and current release-health priorities.
+
+## Upgrade Notes
+
+No special upgrade steps.
+
+## Validation
+
+- CI passed.
+- NPM package contents were validated.
+- Documentation links and TypeScript fenced snippets were validated.
+- Agent skill artifact was validated and packaged.
+
+## Notes
+
+Release tag: `v0.23.0`.

package/docs/releases/v0.24.0.md

@@ -0,0 +1,38 @@
+# TypeScript WSDL Client v0.24.0
+
+## Local Release Preflight Verification
+
+This release adds a local preflight script that mirrors the release-draft workflow's gates and adds checks the workflow cannot see, so maintainers catch release issues before tagging instead of after.
+
+## What This Improves
+
+Maintainers now have a single command that verifies tag, version, changelog, release notes, dependency pin freshness, lockfile sync, committed-examples drift, the full CI pipeline, and the agent skill artifact before pushing a tag. Failures surface locally with the same messages the draft-release workflow would print, so a fix that satisfies the local check also satisfies the workflow.
+
+Generated gateway plugins also avoid importing concrete client classes when only the operations interface is needed, keeping IDE inspections clean for release candidates.
+
+The preflight example comparison now ignores committed explanatory files and normalizes catalog paths that vary by temporary regeneration directory, so it reports real generated drift instead of environment-specific metadata.
+
+## Highlights
+
+- Adds `npm run release:preflight -- vX.Y.Z` with 13 ordered checks across release metadata, dependency state, generated examples, full CI, and skill packaging.
+- Adds `--skip-ci`, `--skip-examples`, and `--skip-deps` flags for fast iteration on metadata-only changes.
+- Extracts shared dependency helpers into `scripts/lib/deps.mjs` so `release:preflight` and `maint:deps` share one source of truth for pin verification.
+- Extracts release-notes structural verification into `scripts/lib/release-notes.mjs` as a pure, CLI-runnable verifier mirroring the draft-release workflow rules.
+- Stops generated `plugin.ts` files from importing unused concrete client classes.
+- Normalizes generated example freshness checks to avoid false drift on `README.md` and `catalog.json` paths.
+
+## Upgrade Notes
+
+No runtime upgrade steps. Maintainers can adopt the preflight by running `npm run release:preflight -- v<version>` before tagging; the existing release workflow continues to work unchanged.
+
+## Validation
+
+- CI passed.
+- NPM package contents were validated.
+- Documentation links and TypeScript fenced snippets were validated.
+- Agent skill artifact was validated and packaged.
+- Release preflight passed against the target tag.
+
+## Notes
+
+Release tag: `v0.24.0`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techspokes/typescript-wsdl-client",
-  "version": "0.21.0",
+  "version": "0.24.0",
   "description": "Turn legacy WSDL/SOAP services into typed TypeScript clients, OpenAPI 3.1 specs, and production-ready Fastify REST gateways. Built for enterprise SOAP modernization.",
   "keywords": [
     "wsdl",
@@ -80,29 +80,31 @@
     "smoke:pipeline": "npm run smoke:reset && tsx src/cli.ts pipeline --wsdl-source examples/minimal/weather.wsdl --client-dir tmp/client --openapi-file tmp/openapi.json --gateway-dir tmp/gateway --gateway-service-name weather --gateway-version-prefix v1 --openapi-format json --init-app && tsc -p tsconfig.smoke.json",
     "smoke:app": "npm run smoke:reset && tsx src/cli.ts pipeline --wsdl-source examples/minimal/weather.wsdl --client-dir tmp/client --openapi-file tmp/openapi.json --gateway-dir tmp/gateway --gateway-service-name weather --gateway-version-prefix v1 --openapi-format json --openapi-servers https://example.com/api && tsx src/cli.ts app --client-dir tmp/client --gateway-dir tmp/gateway --openapi-file tmp/openapi.json --app-dir tmp/app --port 8080 && tsc -p tsconfig.smoke.json",
     "maint:deps": "node scripts/maint-deps.mjs",
+    "docs:validate": "node scripts/validate-docs.mjs",
     "skill:validate": "node scripts/validate-agent-skill.mjs",
     "skill:package": "node scripts/build-agent-skill.mjs",
     "package:validate": "node scripts/validate-npm-package.mjs",
-    "ci": "npm run clean && npm run build && npm run typecheck && npm run skill:validate && npm run package:validate && vitest run && npm run smoke:pipeline",
+    "release:preflight": "node scripts/release-preflight.mjs",
+    "ci": "npm run clean && npm run build && npm run typecheck && npm run skill:validate && npm run package:validate && npm run docs:validate && vitest run && npm run smoke:pipeline",
     "examples:regenerate": "tsx src/cli.ts pipeline --wsdl-source examples/minimal/weather.wsdl --client-dir examples/generated-output/client --openapi-file examples/generated-output/openapi.json --gateway-dir examples/generated-output/gateway --gateway-service-name weather --gateway-version-prefix v1 --openapi-format json"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "@types/yargs": "^17.0.35",
     "fastify": "^5.8.5",
     "fastify-plugin": "^5.1.0",
     "rimraf": "^6.1.3",
-    "tsx": "^4.22.2",
+    "tsx": "^4.22.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.7"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "^12.1.0",
     "fast-xml-parser": "^5.8.0",
     "js-yaml": "^4.1.1",
     "saxes": "^6.0.0",
-    "soap": "^1.9.2",
+    "soap": "^1.9.3",
     "yargs": "^18.0.0"
   },
   "funding": {