@techspokes/typescript-wsdl-client 1.0.1 → 1.0.4

package/dist/app/generateApp.js

@@ -528,11 +528,11 @@ function generatePackageJson(appDir, force) {
             fastify: "^5.10.0",
             "fastify-plugin": "^6.0.0",
             saxes: "^6.0.0",
-            soap: "^1.9.3",
+            soap: "^1.10.0",
         },
         devDependencies: {
             "@types/node": "^26.1.1",
-            tsx: "^4.23.0",
+            tsx: "^4.23.1",
             typescript: "^6.0.3",
         },
     };

package/docs/releases/README.md

@@ -53,6 +53,8 @@ Write validation as consumer-facing outcomes, not as maintainer command transcri
 
 Write release notes for users and maintainers, not as a file-by-file change log. Use `CHANGELOG.md` for the canonical version history.
 
+When an abandoned major or minor candidate contains the complete launch narrative, carry that narrative into the next published corrective release. The corrective release notes must stand alone for users who never saw the abandoned draft.
+
 ## Candidate Publication
 
 The supported release path keeps final-form tags immutable:
@@ -71,13 +73,13 @@ The normal path uses GitHub UI publication because a workflow publishing with it
 
 Run the `Abandon Release Candidate` workflow before publishing a rejected draft. Supply the final-form tag, a permanent reason, and optional failed-validation evidence.
 
-The workflow creates annotated marker `abandoned/vX.Y.Z` on the same commit as `vX.Y.Z`, marks the draft visibly abandoned, and preserves its assets and evidence. The operation is idempotent when the marker already matches. A marker on another commit fails for maintainer review.
+The workflow creates annotated marker `abandoned/vX.Y.Z` on the same commit as `vX.Y.Z`, verifies the remote marker, and then deletes only the draft release and its candidate assets. The marker preserves the durable reason and release identity. The operation is idempotent when the marker already matches and the draft is absent. A marker on another commit fails for maintainer review.
 
 Drafting, abandonment, and package publication are serialized per release tag so abandonment cannot race package delivery.
 
 Never move, delete for reuse, or force-update either tag. The rejected version is consumed, and the correction uses the next version.
 
-The marker cannot disable GitHub's Publish button. Draft and package automation enforce it, but a maintainer must still avoid publishing an abandoned draft through the GitHub UI.
+The marker cannot disable GitHub's Publish button before draft retirement. Draft and package automation enforce the marker, and abandonment removes the rejected draft after verifying the marker. Never use release deletion with tag cleanup.
 
 ## Tag Ruleset Proposal
 

package/docs/releases/v1.0.2.md

@@ -0,0 +1,51 @@
+# TypeScript WSDL Client v1.0.2
+
+## The Complete Stable Typed SOAP Modernization Contract
+
+Version 1.0.2 is the complete supported stable release narrative for the TypeScript client, OpenAPI 3.1, Fastify gateway, runnable app, test generation, and programmatic APIs developed throughout the 0.x series.
+
+## What This Improves
+
+Teams can adopt the generator with an explicit compatibility baseline. Default generated behavior remains aligned with `0.40.1`, supported WSDL patterns have fixture-backed evidence through every generated stage, and unsupported polymorphic or attachment constructs stop with diagnostics instead of producing misleading contracts.
+
+The stable migration contract makes opt-in behavior clear. Choice unions remain optional, NDJSON remains the default streaming format, JSON arrays remain available per operation, and multiple SOAP bindings continue using deterministic first-binding selection.
+
+Release delivery is now equally explicit. npmjs is the sole package registry, publication uses the tested npm 12 toolchain with provenance, and package validation accepts both npm 11 and npm 12 manifest formats. Rejected candidates keep immutable release and marker tags, while their maintainer-only draft releases may be retired after the remote marker is verified.
+
+## Highlights
+
+- Stabilizes typed SOAP clients, OpenAPI specifications, Fastify gateways, apps, and generated tests.
+- Requires Node.js 24 or newer and keeps Node 26 compatibility coverage.
+- Preserves `all-optional` as the default `xs:choice` strategy.
+- Preserves NDJSON as the default configured streaming format.
+- Supports per-operation JSON array streaming as an opt-in alternative.
+- Carries fixture-backed conformance evidence across compile and generated consumer stages.
+- Rejects abstract types, substitution groups, and MTOM/XOP attachments with explicit diagnostics.
+- Documents deterministic multi-binding behavior and unresolved external policy references.
+- Keeps the public WSDL inspector as a post-1.0 candidate.
+- Publishes only to npmjs with OIDC provenance and a pinned npm release.
+- Accepts package manifests emitted by npm 11 and npm 12.
+- Retires abandoned drafts without deleting or reusing immutable tags.
+
+## Upgrade Notes
+
+No intentional generated-code or runtime behavior break is introduced relative to `0.40.1` or `1.0.1`. Consumers must run Node.js 24 or newer, regenerate owned output, review the generated diff, and run their TypeScript build and tests.
+
+Install `1.0.2` as the current stable package. Existing `1.0.1` consumers may update without a migration.
+
+## Validation
+
+- CI passed.
+- The complete WSDL capability conformance suite passed.
+- NPM package contents were validated with npm 11 and npm 12.
+- The npm publication lifecycle passed with npm 12 in dry-run mode.
+- Agent skill artifact was validated and packaged.
+- Release preflight passed against the target tag.
+
+## Notes
+
+Release tag: `v1.0.2`.
+
+Candidate `v1.0.0` was permanently abandoned before npmjs publication. Version `1.0.1` delivered the first supported stable package and the npmjs correction, but its concise incident-focused notes did not carry forward the complete major-release narrative. Version `1.0.2` restores that standalone release context.
+
+The abandoned-draft retirement policy is tracked in [LAWXER-SAS/general-issue-tracker issue #77](https://github.com/LAWXER-SAS/general-issue-tracker/issues/77).

package/docs/releases/v1.0.3.md

@@ -0,0 +1,37 @@
+# TypeScript WSDL Client v1.0.3
+
+## Stable Dependency Tooling
+
+Version 1.0.3 refreshes the SOAP runtime and TypeScript execution tooling while preserving the compiler compatibility required by repository validation and generated projects.
+
+## What This Improves
+
+The package and generated app scaffold now use `soap` 1.10.0 and `tsx` 4.23.1. These updates keep runtime SOAP integration and TypeScript execution current without changing generated client, OpenAPI, gateway, or app behavior.
+
+TypeScript remains on the supported 6.x line because TypeScript 7 changes the compiler package exports and JavaScript API used by validation and conformance tests. Dependabot now defers only TypeScript 7.x updates until that compiler migration is implemented and validated separately.
+
+## Highlights
+
+- Updates the `soap` runtime dependency minimum to 1.10.0.
+- Updates the `tsx` development dependency minimum to 4.23.1.
+- Aligns generated app dependency pins with the refreshed root dependencies.
+- Retains TypeScript 6.0.3 compatibility for compiler API and CLI validation.
+- Defers TypeScript 7.x Dependabot updates pending a dedicated migration.
+
+## Upgrade Notes
+
+No generated-code or public API changes are introduced. Existing consumers can update normally, and newly generated apps receive the refreshed `soap` and `tsx` dependency ranges.
+
+## Validation
+
+- CI passed.
+- The complete WSDL capability conformance suite passed.
+- NPM package contents were validated.
+- Agent skill artifact was validated and packaged.
+- Release preflight passed against the target tag.
+
+## Notes
+
+Release tag: `v1.0.3`.
+
+TypeScript 7 adoption remains a separate maintenance task because its native compiler package does not preserve the TypeScript 6 JavaScript compiler API and CLI export behavior used by this repository.

package/docs/releases/v1.0.4.md

@@ -0,0 +1,45 @@
+# TypeScript WSDL Client v1.0.4
+
+## Secure Dependency Delivery
+
+Version 1.0.4 is the next public patch after the retired v1.0.3 candidate. It refreshes SOAP and TypeScript execution tooling, remediates vulnerable direct and transitive dependencies, and updates release workflows without changing generated client, OpenAPI, gateway, or app behavior.
+
+## What This Improves
+
+The package and generated app scaffold now use `soap` 1.10.0 and `tsx` 4.23.1. The direct `fast-xml-parser` and `js-yaml` dependency floors are updated to secure versions, while the refreshed lockfile resolves the reported Axios, brace expansion, routing, URI, and YAML advisories.
+
+TypeScript remains on the supported 6.x line because TypeScript 7 changes compiler package exports and JavaScript APIs used by validation and conformance tests. Dependabot continues to defer only TypeScript 7.x updates until that compiler migration is implemented and validated separately.
+
+GitHub Actions workflows now use `actions/setup-node` v7. Security reporting guidance is aligned with Node.js 24 and GitHub private vulnerability reporting.
+
+## Highlights
+
+- Updates the `soap` runtime dependency minimum to 1.10.0.
+- Updates the `tsx` development dependency minimum to 4.23.1.
+- Updates `fast-xml-parser` to 5.10.1 and `js-yaml` to 5.2.2 or newer compatible releases.
+- Refreshes transitive HTTP, brace expansion, routing, URI, and YAML dependencies.
+- Aligns generated app dependency pins with the refreshed root dependencies.
+- Retains TypeScript 6.0.3 compatibility for compiler API and CLI validation.
+- Defers TypeScript 7.x Dependabot updates pending a dedicated migration.
+- Upgrades GitHub workflows to `actions/setup-node` v7.
+
+## Upgrade Notes
+
+No generated-code or public API changes are introduced. Existing consumers can update normally, and newly generated apps receive the refreshed `soap` and `tsx` dependency ranges.
+
+Users upgrading from v1.0.2 receive the dependency tooling changes originally planned for v1.0.3 together with the security remediation in this release. Version 1.0.3 was retired before publication and never shipped to npm.
+
+## Validation
+
+- CI passed.
+- The complete WSDL capability conformance suite passed.
+- npm package contents were validated.
+- `npm audit` reported zero vulnerabilities.
+- The agent skill artifact was validated and packaged.
+- Release preflight passed against the target tag.
+
+## Notes
+
+Release tag: `v1.0.4`.
+
+Version 1.0.3 remains permanently marked as an abandoned release candidate and was never published to npm.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techspokes/typescript-wsdl-client",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "Turn legacy WSDL/SOAP services into typed TypeScript clients, OpenAPI 3.1 specs, and production-ready Fastify REST gateways. Built for enterprise SOAP modernization.",
   "keywords": [
     "wsdl",
@@ -109,16 +109,16 @@
     "fastify": "^5.10.0",
     "fastify-plugin": "^6.0.0",
     "rimraf": "^6.1.3",
-    "tsx": "^4.23.0",
+    "tsx": "^4.23.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "^12.1.0",
-    "fast-xml-parser": "^5.10.0",
-    "js-yaml": "^5.2.1",
+    "fast-xml-parser": "^5.10.1",
+    "js-yaml": "^5.2.2",
     "saxes": "^6.0.0",
-    "soap": "^1.9.3",
+    "soap": "^1.10.0",
     "yargs": "^18.0.0"
   },
   "funding": {