@techspokes/typescript-wsdl-client 1.0.4 → 1.0.5

package/dist/app/generateApp.js

@@ -525,14 +525,14 @@ function generatePackageJson(appDir, force) {
             dev: "tsx watch server.ts",
         },
         dependencies: {
-            fastify: "^5.10.0",
+            fastify: "^5.12.0",
             "fastify-plugin": "^6.0.0",
             saxes: "^6.0.0",
             soap: "^1.10.0",
         },
         devDependencies: {
-            "@types/node": "^26.1.1",
-            tsx: "^4.23.1",
+            "@types/node": "^26.2.0",
+            tsx: "^4.23.12",
             typescript: "^6.0.3",
         },
     };

package/docs/agent-skill.md

@@ -4,7 +4,7 @@ Standalone agent skill artifact for consumer projects using `@techspokes/typescr
 
 ## Purpose
 
-Release assets include a ZIP named `typescript-wsdl-client-agent-skill-vX.Y.Z.zip`. The ZIP contains an installable `typescript-wsdl-client/` skill folder that helps AI agents in consumer projects generate clients, OpenAPI specs, gateways, apps, tests, and catalogs from WSDL or catalog inputs.
+Release assets include `typescript-wsdl-client-agent-skill-vX.Y.Z.zip` and `SHA256SUMS`. GitHub artifact provenance attests the ZIP, which contains an installable `typescript-wsdl-client/` skill folder for consumer projects.
 
 The skill is for consumer-project agents. It tells agents how to choose `wsdl-tsc` commands, handle generated output boundaries, load reference material, and validate generated code without treating generated files as hand-maintained source.
 
@@ -12,6 +12,7 @@ The skill is for consumer-project agents. It tells agents how to choose `wsdl-ts
 
 ```text
 typescript-wsdl-client/
+  LICENSE
   SKILL.md
   install.mjs
   references/
@@ -42,10 +43,12 @@ Do not maintain `agent-skill/references/` by hand. The package scripts generate
 Download the release ZIP from the GitHub draft or published release, extract it, and run the installer from the extracted skill folder:
 
 ```bash
-node install.mjs --target ./skills
+node install.mjs --target ../skills
 ```
 
-Use `--name <folder-name>` to choose a different installed folder name. Use `--force` only when replacing an existing installed copy.
+Use `--name <folder-name>` to choose a different installed folder name. The target must be outside the extracted skill directory.
+
+An existing installation is preserved unless `--force` is present. Forced installation stages a complete candidate, swaps it into place, removes stale files from the previous copy, and restores the previous installation if the swap fails.
 
 The installer copies only the skill folder. It does not edit Codex, Claude, IDE, MCP, shell, or global configuration files.
 
@@ -63,7 +66,7 @@ Run the validation script before release packaging:
 npm run skill:validate
 ```
 
-Validation checks skill frontmatter, manifest sources, extracted headings, packaged Markdown structure, packaged links, forbidden files, deterministic staged output, and oversized evergreen duplication of fluid references.
+Validation checks skill frontmatter, manifest sources, extracted headings, packaged Markdown structure, packaged links, forbidden files, behavioral fixtures, exact `SOURCE-MAP.json` content, exact ZIP inventory, checksum output, and byte-identical complete builds.
 
 ## Packaging
 
@@ -73,9 +76,24 @@ Package the release skill with the exact release tag. For the `0.21.0` release:
 npm run skill:package -- v0.21.0
 ```
 
-The script requires the tag to match `package.json` and writes `dist/assets/typescript-wsdl-client-agent-skill-v0.21.0.zip`.
+The script requires the tag to match `package.json` and writes `dist/assets/typescript-wsdl-client-agent-skill-v0.21.0.zip` plus `dist/assets/SHA256SUMS`.
+
+## Release Verification
+
+The draft workflow attests the locally built ZIP, uploads the ZIP and `SHA256SUMS`, downloads both assets into an isolated runner directory, verifies their checksum and GitHub provenance, installs the extracted skill, and runs the representative weather WSDL pipeline fixture. A draft is ready only when that workflow succeeds.
+
+Run the artifact verifier directly when diagnosing a downloaded candidate:
+
+```bash
+node scripts/verify-agent-skill-artifact.mjs --zip <zip-file> --checksums <SHA256SUMS-file> --work-dir <temporary-directory> --wsdl examples/minimal/weather.wsdl --expected-tag vX.Y.Z --previous-zip <previous-release-zip>
+```
+
+## GitHub CLI Applicability
+
+`gh skill publish dist/agent-skill-stage --dry-run` validates the complete generated skill without committing generated references. Do not run this command without `--dry-run`; product release creation remains owned by the repository release workflows.
+
+Direct `gh skill install` and `gh skill update` are not supported delivery paths for this repository. Those commands resolve skill files from the tagged Git tree, while the complete skill exists only after manifest-driven packaging, so the release ZIP remains the supported installation and replacement boundary.
 
 ## Drift Control
 
 Changing an extracted docs section changes the packaged reference on the next package run. Renaming or removing an extracted heading fails validation. Packaged links must resolve after rewrite, and `references/SOURCE-MAP.json` records the source path, output path, and extracted sections for each packaged reference.
-

package/docs/releases/v1.0.5.md

@@ -0,0 +1,41 @@
+# TypeScript WSDL Client v1.0.5
+
+## Verifiable Agent Skill Delivery
+
+This patch release makes the agent skill release artifact reproducible, checksummed, attested, and independently installable while refreshing maintained dependencies and remediating all current audit findings.
+
+## What This Improves
+
+Agent skill releases now include a deterministic ZIP, a conventional `SHA256SUMS` file, and GitHub build provenance. The draft workflow downloads its own uploaded assets into a clean directory, verifies their checksum and attestation, installs the skill in isolation, and exercises a representative weather WSDL pipeline.
+
+Forced skill installation is now an exact, rollback-safe replacement. Existing installations remain untouched without `--force`; with `--force`, stale and locally modified files are removed as the complete candidate replaces the prior copy.
+
+Behavior fixtures now cover command selection, generated-output refusal, environment guidance, and incomplete WSDL or catalog input. Incomplete-input guidance directs agents to inspect the consumer project before asking only for the missing source location and intended generation surface.
+
+## Highlights
+
+- Add deterministic agent skill archives, checksums, inventory validation, source-map validation, and MIT license metadata.
+- Add release provenance and clean-runner verification of downloaded draft assets.
+- Verify previous-release-to-candidate replacement without altering host or global configuration.
+- Retain the release ZIP as the supported installation and update boundary while recording GitHub CLI dry-run compatibility.
+- Refresh maintained direct dependency floors and remediate current transitive vulnerability alerts.
+
+## Upgrade Notes
+
+This release does not change the TypeScript API, generated-client contract, or `wsdl-tsc` CLI behavior. Package consumers can update normally.
+
+Agent skill users should continue installing from the release ZIP. Install to an explicit target outside the extracted archive, and use `--force` only when a complete replacement of an existing installation is intended.
+
+## Validation
+
+- CI passed.
+- The complete WSDL capability conformance suite passed.
+- npm package contents were validated.
+- `npm audit` reported zero vulnerabilities.
+- Agent skill artifact checksums and provenance were validated.
+- The uploaded agent skill was installed and smoke-tested.
+- Release preflight passed against the target tag.
+
+## Notes
+
+Release tag: `v1.0.5`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techspokes/typescript-wsdl-client",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Turn legacy WSDL/SOAP services into typed TypeScript clients, OpenAPI 3.1 specs, and production-ready Fastify REST gateways. Built for enterprise SOAP modernization.",
   "keywords": [
     "wsdl",
@@ -104,22 +104,22 @@
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.2.0",
     "@types/yargs": "^17.0.35",
-    "fastify": "^5.10.0",
+    "fastify": "^5.12.0",
     "fastify-plugin": "^6.0.0",
     "rimraf": "^6.1.3",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "^12.1.0",
-    "fast-xml-parser": "^5.10.1",
-    "js-yaml": "^5.2.2",
+    "fast-xml-parser": "^5.11.0",
+    "js-yaml": "^5.3.0",
     "saxes": "^6.0.0",
     "soap": "^1.10.0",
-    "yargs": "^18.0.0"
+    "yargs": "^18.1.0"
   },
   "funding": {
     "type": "github",