@techspokes/typescript-wsdl-client 1.0.2 → 1.0.5

package/dist/app/generateApp.js

@@ -525,14 +525,14 @@ function generatePackageJson(appDir, force) {
             dev: "tsx watch server.ts",
         },
         dependencies: {
-            fastify: "^5.10.0",
+            fastify: "^5.12.0",
             "fastify-plugin": "^6.0.0",
             saxes: "^6.0.0",
-            soap: "^1.9.3",
+            soap: "^1.10.0",
         },
         devDependencies: {
-            "@types/node": "^26.1.1",
-            tsx: "^4.23.0",
+            "@types/node": "^26.2.0",
+            tsx: "^4.23.12",
             typescript: "^6.0.3",
         },
     };

package/docs/agent-skill.md

@@ -4,7 +4,7 @@ Standalone agent skill artifact for consumer projects using `@techspokes/typescr
 
 ## Purpose
 
-Release assets include a ZIP named `typescript-wsdl-client-agent-skill-vX.Y.Z.zip`. The ZIP contains an installable `typescript-wsdl-client/` skill folder that helps AI agents in consumer projects generate clients, OpenAPI specs, gateways, apps, tests, and catalogs from WSDL or catalog inputs.
+Release assets include `typescript-wsdl-client-agent-skill-vX.Y.Z.zip` and `SHA256SUMS`. GitHub artifact provenance attests the ZIP, which contains an installable `typescript-wsdl-client/` skill folder for consumer projects.
 
 The skill is for consumer-project agents. It tells agents how to choose `wsdl-tsc` commands, handle generated output boundaries, load reference material, and validate generated code without treating generated files as hand-maintained source.
 
@@ -12,6 +12,7 @@ The skill is for consumer-project agents. It tells agents how to choose `wsdl-ts
 
 ```text
 typescript-wsdl-client/
+  LICENSE
   SKILL.md
   install.mjs
   references/
@@ -42,10 +43,12 @@ Do not maintain `agent-skill/references/` by hand. The package scripts generate
 Download the release ZIP from the GitHub draft or published release, extract it, and run the installer from the extracted skill folder:
 
 ```bash
-node install.mjs --target ./skills
+node install.mjs --target ../skills
 ```
 
-Use `--name <folder-name>` to choose a different installed folder name. Use `--force` only when replacing an existing installed copy.
+Use `--name <folder-name>` to choose a different installed folder name. The target must be outside the extracted skill directory.
+
+An existing installation is preserved unless `--force` is present. Forced installation stages a complete candidate, swaps it into place, removes stale files from the previous copy, and restores the previous installation if the swap fails.
 
 The installer copies only the skill folder. It does not edit Codex, Claude, IDE, MCP, shell, or global configuration files.
 
@@ -63,7 +66,7 @@ Run the validation script before release packaging:
 npm run skill:validate
 ```
 
-Validation checks skill frontmatter, manifest sources, extracted headings, packaged Markdown structure, packaged links, forbidden files, deterministic staged output, and oversized evergreen duplication of fluid references.
+Validation checks skill frontmatter, manifest sources, extracted headings, packaged Markdown structure, packaged links, forbidden files, behavioral fixtures, exact `SOURCE-MAP.json` content, exact ZIP inventory, checksum output, and byte-identical complete builds.
 
 ## Packaging
 
@@ -73,9 +76,24 @@ Package the release skill with the exact release tag. For the `0.21.0` release:
 npm run skill:package -- v0.21.0
 ```
 
-The script requires the tag to match `package.json` and writes `dist/assets/typescript-wsdl-client-agent-skill-v0.21.0.zip`.
+The script requires the tag to match `package.json` and writes `dist/assets/typescript-wsdl-client-agent-skill-v0.21.0.zip` plus `dist/assets/SHA256SUMS`.
+
+## Release Verification
+
+The draft workflow attests the locally built ZIP, uploads the ZIP and `SHA256SUMS`, downloads both assets into an isolated runner directory, verifies their checksum and GitHub provenance, installs the extracted skill, and runs the representative weather WSDL pipeline fixture. A draft is ready only when that workflow succeeds.
+
+Run the artifact verifier directly when diagnosing a downloaded candidate:
+
+```bash
+node scripts/verify-agent-skill-artifact.mjs --zip <zip-file> --checksums <SHA256SUMS-file> --work-dir <temporary-directory> --wsdl examples/minimal/weather.wsdl --expected-tag vX.Y.Z --previous-zip <previous-release-zip>
+```
+
+## GitHub CLI Applicability
+
+`gh skill publish dist/agent-skill-stage --dry-run` validates the complete generated skill without committing generated references. Do not run this command without `--dry-run`; product release creation remains owned by the repository release workflows.
+
+Direct `gh skill install` and `gh skill update` are not supported delivery paths for this repository. Those commands resolve skill files from the tagged Git tree, while the complete skill exists only after manifest-driven packaging, so the release ZIP remains the supported installation and replacement boundary.
 
 ## Drift Control
 
 Changing an extracted docs section changes the packaged reference on the next package run. Renaming or removing an extracted heading fails validation. Packaged links must resolve after rewrite, and `references/SOURCE-MAP.json` records the source path, output path, and extracted sections for each packaged reference.
-

package/docs/releases/v1.0.3.md

@@ -0,0 +1,37 @@
+# TypeScript WSDL Client v1.0.3
+
+## Stable Dependency Tooling
+
+Version 1.0.3 refreshes the SOAP runtime and TypeScript execution tooling while preserving the compiler compatibility required by repository validation and generated projects.
+
+## What This Improves
+
+The package and generated app scaffold now use `soap` 1.10.0 and `tsx` 4.23.1. These updates keep runtime SOAP integration and TypeScript execution current without changing generated client, OpenAPI, gateway, or app behavior.
+
+TypeScript remains on the supported 6.x line because TypeScript 7 changes the compiler package exports and JavaScript API used by validation and conformance tests. Dependabot now defers only TypeScript 7.x updates until that compiler migration is implemented and validated separately.
+
+## Highlights
+
+- Updates the `soap` runtime dependency minimum to 1.10.0.
+- Updates the `tsx` development dependency minimum to 4.23.1.
+- Aligns generated app dependency pins with the refreshed root dependencies.
+- Retains TypeScript 6.0.3 compatibility for compiler API and CLI validation.
+- Defers TypeScript 7.x Dependabot updates pending a dedicated migration.
+
+## Upgrade Notes
+
+No generated-code or public API changes are introduced. Existing consumers can update normally, and newly generated apps receive the refreshed `soap` and `tsx` dependency ranges.
+
+## Validation
+
+- CI passed.
+- The complete WSDL capability conformance suite passed.
+- NPM package contents were validated.
+- Agent skill artifact was validated and packaged.
+- Release preflight passed against the target tag.
+
+## Notes
+
+Release tag: `v1.0.3`.
+
+TypeScript 7 adoption remains a separate maintenance task because its native compiler package does not preserve the TypeScript 6 JavaScript compiler API and CLI export behavior used by this repository.

package/docs/releases/v1.0.4.md

@@ -0,0 +1,45 @@
+# TypeScript WSDL Client v1.0.4
+
+## Secure Dependency Delivery
+
+Version 1.0.4 is the next public patch after the retired v1.0.3 candidate. It refreshes SOAP and TypeScript execution tooling, remediates vulnerable direct and transitive dependencies, and updates release workflows without changing generated client, OpenAPI, gateway, or app behavior.
+
+## What This Improves
+
+The package and generated app scaffold now use `soap` 1.10.0 and `tsx` 4.23.1. The direct `fast-xml-parser` and `js-yaml` dependency floors are updated to secure versions, while the refreshed lockfile resolves the reported Axios, brace expansion, routing, URI, and YAML advisories.
+
+TypeScript remains on the supported 6.x line because TypeScript 7 changes compiler package exports and JavaScript APIs used by validation and conformance tests. Dependabot continues to defer only TypeScript 7.x updates until that compiler migration is implemented and validated separately.
+
+GitHub Actions workflows now use `actions/setup-node` v7. Security reporting guidance is aligned with Node.js 24 and GitHub private vulnerability reporting.
+
+## Highlights
+
+- Updates the `soap` runtime dependency minimum to 1.10.0.
+- Updates the `tsx` development dependency minimum to 4.23.1.
+- Updates `fast-xml-parser` to 5.10.1 and `js-yaml` to 5.2.2 or newer compatible releases.
+- Refreshes transitive HTTP, brace expansion, routing, URI, and YAML dependencies.
+- Aligns generated app dependency pins with the refreshed root dependencies.
+- Retains TypeScript 6.0.3 compatibility for compiler API and CLI validation.
+- Defers TypeScript 7.x Dependabot updates pending a dedicated migration.
+- Upgrades GitHub workflows to `actions/setup-node` v7.
+
+## Upgrade Notes
+
+No generated-code or public API changes are introduced. Existing consumers can update normally, and newly generated apps receive the refreshed `soap` and `tsx` dependency ranges.
+
+Users upgrading from v1.0.2 receive the dependency tooling changes originally planned for v1.0.3 together with the security remediation in this release. Version 1.0.3 was retired before publication and never shipped to npm.
+
+## Validation
+
+- CI passed.
+- The complete WSDL capability conformance suite passed.
+- npm package contents were validated.
+- `npm audit` reported zero vulnerabilities.
+- The agent skill artifact was validated and packaged.
+- Release preflight passed against the target tag.
+
+## Notes
+
+Release tag: `v1.0.4`.
+
+Version 1.0.3 remains permanently marked as an abandoned release candidate and was never published to npm.

package/docs/releases/v1.0.5.md

@@ -0,0 +1,41 @@
+# TypeScript WSDL Client v1.0.5
+
+## Verifiable Agent Skill Delivery
+
+This patch release makes the agent skill release artifact reproducible, checksummed, attested, and independently installable while refreshing maintained dependencies and remediating all current audit findings.
+
+## What This Improves
+
+Agent skill releases now include a deterministic ZIP, a conventional `SHA256SUMS` file, and GitHub build provenance. The draft workflow downloads its own uploaded assets into a clean directory, verifies their checksum and attestation, installs the skill in isolation, and exercises a representative weather WSDL pipeline.
+
+Forced skill installation is now an exact, rollback-safe replacement. Existing installations remain untouched without `--force`; with `--force`, stale and locally modified files are removed as the complete candidate replaces the prior copy.
+
+Behavior fixtures now cover command selection, generated-output refusal, environment guidance, and incomplete WSDL or catalog input. Incomplete-input guidance directs agents to inspect the consumer project before asking only for the missing source location and intended generation surface.
+
+## Highlights
+
+- Add deterministic agent skill archives, checksums, inventory validation, source-map validation, and MIT license metadata.
+- Add release provenance and clean-runner verification of downloaded draft assets.
+- Verify previous-release-to-candidate replacement without altering host or global configuration.
+- Retain the release ZIP as the supported installation and update boundary while recording GitHub CLI dry-run compatibility.
+- Refresh maintained direct dependency floors and remediate current transitive vulnerability alerts.
+
+## Upgrade Notes
+
+This release does not change the TypeScript API, generated-client contract, or `wsdl-tsc` CLI behavior. Package consumers can update normally.
+
+Agent skill users should continue installing from the release ZIP. Install to an explicit target outside the extracted archive, and use `--force` only when a complete replacement of an existing installation is intended.
+
+## Validation
+
+- CI passed.
+- The complete WSDL capability conformance suite passed.
+- npm package contents were validated.
+- `npm audit` reported zero vulnerabilities.
+- Agent skill artifact checksums and provenance were validated.
+- The uploaded agent skill was installed and smoke-tested.
+- Release preflight passed against the target tag.
+
+## Notes
+
+Release tag: `v1.0.5`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techspokes/typescript-wsdl-client",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "description": "Turn legacy WSDL/SOAP services into typed TypeScript clients, OpenAPI 3.1 specs, and production-ready Fastify REST gateways. Built for enterprise SOAP modernization.",
   "keywords": [
     "wsdl",
@@ -104,22 +104,22 @@
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.2.0",
     "@types/yargs": "^17.0.35",
-    "fastify": "^5.10.0",
+    "fastify": "^5.12.0",
     "fastify-plugin": "^6.0.0",
     "rimraf": "^6.1.3",
-    "tsx": "^4.23.0",
+    "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "^12.1.0",
-    "fast-xml-parser": "^5.10.0",
-    "js-yaml": "^5.2.1",
+    "fast-xml-parser": "^5.11.0",
+    "js-yaml": "^5.3.0",
     "saxes": "^6.0.0",
-    "soap": "^1.9.3",
-    "yargs": "^18.0.0"
+    "soap": "^1.10.0",
+    "yargs": "^18.1.0"
   },
   "funding": {
     "type": "github",