@techspokes/typescript-wsdl-client 1.1.5 → 1.2.0

package/README.md

@@ -9,22 +9,37 @@ Turn legacy WSDL/SOAP services into typed TypeScript clients and optional REST A
 
 Created from production integration work at [TechSpokes](https://www.techspokes.com); built for teams modernizing real enterprise SOAP integrations.
 
+## Upgrading to 1.2.0
+
+Existing projects keep legacy generation unless they explicitly choose another profile. Regeneration can change affected DTO names, stream records and corrected scalar/simple-content results; 1.2.0 is not an unconditional drop-in regeneration upgrade. Read the [1.1.x migration guide](docs/migration.md#from-11x-to-120) before updating, including matched artifact regeneration, scaffold preservation, consumer checks and rollback.
+
+Published npm starting points include 1.1.5 and 1.1.8; 1.1.6 and 1.1.7 were unpublished candidates. Native multi-service composition and checked generation are optional capabilities with separate adoption instructions, not automatic migrations of an existing gateway.
+
 ## Pick Your Path
 
 | Goal | Command | What you get |
 |------|---------|-------------|
 | Typed SOAP client | `npx wsdl-tsc client` | TypeScript types, typed operations, mockable interface |
 | OpenAPI 3.1 spec | `npx wsdl-tsc openapi` | OpenAPI JSON/YAML generated from WSDL |
-| Full SOAP-to-REST bridge | `npx wsdl-tsc pipeline` | Client + OpenAPI + Fastify gateway + runnable app |
+| Full SOAP-to-REST bridge | `npx wsdl-tsc pipeline --init-app` | Client + OpenAPI + Fastify gateway + runnable app |
+| Several SOAP sources behind one API | `npx wsdl-tsc pipeline --services-config services.json` | Separate legacy clients, one gateway plugin and combined OpenAPI |
+| Checked document/literal or bounded RPC | `npx wsdl-tsc pipeline --model checked-components-v1` | Source-backed validation and buffered checked values |
 
 See [Start Here](docs/start-here.md) for detailed guidance on choosing a path.
 
-Unreleased checked direct artifacts can use the [versioned package-root runtime binding](docs/direct-values.md#package-root-binding-for-generated-direct-clients).
-Its restricted grammar and owned-loopback transport are separate from the existing generation commands.
+## Two generation modes
+
+Legacy generation is the default. Opt into [checked generation](docs/checked-generation.md) with `pipeline --model checked-components-v1` for native validation of supported contracts across generated clients, OpenAPI, gateways, app scaffolding and tests.
+
+Unambiguous sources select their service and operations automatically; ambiguous sources need an explicit `--checked-config`. Checked mode refuses unsupported or unresolved constructs rather than silently dropping their rules; the [checked gateway guide](docs/checked-gateway.md) explains configuration and scope.
+
+Generated source snapshots support offline runtime use, and calls use the selected WSDL address or an explicit endpoint override with optional restrictions. Existing [direct-runtime clients](docs/direct-values.md#package-root-binding-for-generated-direct-clients) remain compatible; the [product corpus](docs/corpus.md) records representative evidence without claiming universal WSDL/XSD or live-provider support.
+
+Checked generation can opt into [application groups and configured names](docs/checked-gateway.md#application-groups-and-configured-names) with `{"applicationGroups":{}}` in the existing `--checked-config` file, or `checkedComponents: {applicationGroups: {}}` in the package-root API. Reconstructible choices become named alternative objects, repeated sequences become group-item arrays, and the generated inventory supplies exact targets for naming overrides. Omit the option to preserve existing checked value shapes.
 
 ## Why Choose This
 
-Most tools in this space stop at one layer: a SOAP runtime, type generation, or spec conversion. This package generates the full stack from a single WSDL source.
+Most tools in this space stop at one layer: a SOAP runtime, type generation, or spec conversion. This package generates the full stack from a WSDL source and can compose independent legacy sources into one REST gateway.
 
 - Typed client, OpenAPI spec, REST gateway, and runnable app from one command
 - Deterministic output safe for CI regeneration and version control
@@ -94,6 +109,10 @@ curl -X POST http://localhost:3000/get-weather-information \
   -H "Content-Type: application/json" -d '{}'
 ```
 
+### Compose several SOAP services
+
+Use `pipeline --services-config ./services.json` to generate each source into separate client, catalog, OpenAPI and gateway paths, then emit one aggregate plugin and API document. The [multi-service guide](docs/gateway-guide.md#multi-service-setup) shows the configuration and generated `createClients` helper; each runtime client keeps its own WSDL source, endpoint and security settings. Native composition currently supports legacy generation; checked composition remains deferred.
+
 ## What Gets Generated
 
 | Output | Files | Purpose |
@@ -176,19 +195,21 @@ import type { WeatherOperations } from "./.generated/client/operations.js";
 
 const mockClient: WeatherOperations = {
   GetCityWeatherByZIP: async (args) => ({
-    response: { GetCityWeatherByZIPResult: { Success: true, City: "Test" } },
+    response: { GetCityWeatherByZIPResult: { Success: true, WeatherID: 0, City: "Test" } },
     headers: {},
   }),
+  GetCityForecastByZIP: async () => ({ response: {}, headers: {} }),
+  GetWeatherInformation: async () => ({ response: {}, headers: {} }),
 };
 
 import Fastify from "fastify";
-import { weatherGateway } from "./.generated/gateway/plugin.js";
+import weatherGateway from "./.generated/gateway/plugin.js";
 
 const app = Fastify();
 await app.register(weatherGateway, { client: mockClient, prefix: "/v1/weather" });
 ```
 
-See [Testing Guide](docs/testing.md) for integration test patterns and mock examples.
+See [consumer testing guidance](docs/testing.md#for-consumer-projects) for legacy and checked setup, generated tests and mock examples.
 
 ## Commands
 
@@ -205,79 +226,68 @@ See [CLI Reference](docs/cli-reference.md) for all flags and examples.
 
 ## Documentation
 
-### Evaluate
+### Using the package
 
 | Guide | Description |
-|-------|-------------|
+|---|---|
 | [Start Here](docs/start-here.md) | What this is, who it is for, choose your path |
 | [Supported Patterns](docs/supported-patterns.md) | WSDL/XSD features handled and current limitations |
-| [Content Model Baseline](docs/content-model-baseline.md) | Reproducible S01 reference evidence and current semantic limits |
-| [Shipped Fix Reconciliation](docs/content-model-shipped-fix.md) | Contributor attribution, delivered occurrence behavior and S02 handoff |
-| [Content Model Contracts (ADR-003)](docs/decisions/003-content-model-contracts.md) | Fidelity, profile, compatibility and integration contracts for S02 |
-| [Content Model Decision Register](docs/content-model-decisions.md) | Stable S02 decisions, evidence, owners and prerequisite gates |
-| [SOAP Feasibility Evidence](docs/content-model-soap-feasibility.md) | Local ordered SOAP exchanges, raw transport seams and capability limits |
-| [Gateway Feasibility Evidence](docs/content-model-gateway-feasibility.md) | Non-mutating route validation, dialect boundaries and serialized HTTP bytes |
-| [S02 Handoff](docs/content-model-s02-handoff.md) | Delivery checkpoints, validation, provisional limits and S03 continuation |
-| [Ordered Schema Loading](docs/content-model-loading.md) | Internal ordered syntax, provenance and controlled resolution contracts |
-| [Canonical Schema Graph](docs/content-model-graph.md) | Immutable declarations, use-site particles, references and lexical context |
-| [Canonical Reference Resolution](docs/content-model-resolution.md) | Namespace visibility, complete targets, legal recursion and component-cycle diagnostics |
-| [Canonical Derivation Composition](docs/content-model-composition.md) | Distinct extension/restriction views, attributes, wildcards and legality obligations |
-| [Structural Companion Catalogs](docs/content-model-companions.md) | Required closures, actual structural equality, provenance and shared semantic dispatch |
-| [Exact Particle Analysis](docs/content-model-analysis.md) | Exact contributions, particle emptiness and bounded immutable summaries |
-| [S06 Attribute Research](docs/content-model-s06-au-01.md) | Repeated attribute-use identities, constraints and interpretation alternatives |
-| [S06 Reordered Derivation Research](docs/content-model-s06-re-01.md) | Constructive witnesses, counterexamples and decision-procedure proof obligations |
-| [S06 RE01 Support Reconstruction](docs/content-model-s06-re-01-support-reconstruction.md) | Conditional member/copy/bundle reductions, value/name palettes and open support bounds |
-| [S06 RE01 Scalar Witness Construction](docs/content-model-s06-re-01-scalar-witnesses.md) | Shared endpoint tuple construction, scalar counterexamples and open materialization gates |
-| [S06 Hypothetical Resolver Specification](docs/content-model-s06-re-01-resolver.md) | Candidate contexts, component identity, validation ownership and implementation tasks |
-| [S06 Research Resolver Implementation](docs/content-model-s06-re-01-resolver-implementation.md) | Resolver guarantees, abstract wildcard properties, verification and the future production seam |
-| [S06 Wildcard Research](docs/content-model-s06-pw-01.md) | Member and whole-group cardinality, original namespace context and authority |
-| [S06 Calendar Research](docs/content-model-s06-dt-01.md) | Exact negative-year calendar alternatives and corrected reference observations |
-| [S06 Research Handoff](docs/content-model-s06-research-handoff.md) | Joint contracts, reproducible evidence, unresolved gates and production ownership |
-| [Semantic Catalog Format 2](docs/content-model-catalog.md) | Deterministic persistence, typed validation and early compatibility routing |
 | [Output Anatomy](docs/output-anatomy.md) | What gets generated and how to use it |
-
-### Adopt
-
-| Guide | Description |
-|-------|-------------|
-| [Checked WSDL readiness](docs/content-model-readiness.md) | Measured assessment corpus and bounded P3 implementation packet |
 | [Direct Scalar Values](docs/direct-values.md) | Internal scalar mapping, fresh inverse and bounded bare-root XML codec |
-| [Direct Structural Matching](docs/content-model-matching.md) | Internal structure-only matcher, evidence and scalar handoff |
+| [Try Opt-in Checked Generation](docs/checked-generation.md) | Installed component trial, URL intake, endpoint setup, scope, direction and feedback |
+| [Checked Gateway Reference](docs/checked-gateway.md) | Component/direct configuration, project commands, compatibility and bounded HTTP/SOAP evidence |
 | [CLI Reference](docs/cli-reference.md) | All commands with flags and examples |
 | [Working With Generated Code](docs/generated-code.md) | Using clients, types, and operations |
 | [Configuration](docs/configuration.md) | Gateway security, upstream SOAP security, tags, operation overrides |
 | [Migration Playbook](docs/migration-playbook.md) | End-to-end SOAP modernization guide |
-
-### Operate
-
-| Guide | Description |
-|-------|-------------|
 | [Gateway Guide](docs/gateway-guide.md) | Fastify integration, inbound enforcement, and error handling |
-| [Testing Guide](docs/testing.md) | Testing patterns and mock client examples |
+| [Multi-Service Gateway Status](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/roadmap/multi-service-gateway.md) | Implemented legacy composition, mapping boundaries, and deferred checked composition |
+| [Testing Guide](docs/testing.md) | Consumer tests and separate maintainer verification guidance |
 | [Production Guide](docs/production.md) | CI/CD, validation, logging |
 | [Troubleshooting](docs/troubleshooting.md) | Common issues and debugging |
-| [Release Notes](docs/releases/README.md) | Per-version GitHub release notes used by the draft release workflow |
-| [v1.1.5 Release Notes](docs/releases/v1.1.5.md) | Restricted checked-direct runtime binding, safe local SOAP evidence and explicit caller controls |
-| [v1.1.4 Release Notes](docs/releases/v1.1.4.md) | Named SOAP imports and compiled-client coverage on Node 24 and 26 |
-| [v1.1.3 Release Notes](docs/releases/v1.1.3.md) | Dependency security updates and Node 24 development alignment |
-| [v1.1.2 Release Notes](docs/releases/v1.1.2.md) | Sequence occurrence bounds and singleton SOAP response normalization |
-| [v1.1.1 Release Notes](docs/releases/v1.1.1.md) | Wrapping sequence occurrence bounds and generated array contracts |
-| [v1.1.0 Release Notes](docs/releases/v1.1.0.md) | Automatic generated TypeScript preambles and consumer lint guidance |
-
-### Extend
-
-| Guide | Description |
-|-------|-------------|
 | [Programmatic API](docs/api-reference.md) | TypeScript functions for build tools |
 | [Core Concepts](docs/concepts.md) | Flattening, $value, primitives, determinism |
-| [Architecture](docs/architecture.md) | Internal pipeline for contributors |
-| [Reference Validation](docs/reference-validation.md) | Internal evidence contract and Node tooling migration inventory |
-| [File Naming And Path Organization](docs/file-naming-and-path-organization.md) | Contributor convention for taxonomy paths and fixture retrieval |
 | [Agent Skill Artifact](docs/agent-skill.md) | Release ZIP for consumer-project AI agents |
-| [Current Roadmap](ROADMAP.md) | Published baseline, active content-model backlog, and delivery milestones |
-| [Version 1.0 Roadmap Plan](docs/roadmap/README.md) | Historical completed implementation slices and qualification gates for 1.0 |
-| [Streamable Responses (ADR-002)](docs/decisions/002-streamable-responses.md) | Opt-in streaming: client `AsyncIterable`, gateway NDJSON or JSON array, `x-wsdl-tsc-stream` |
 | [Version Migration](docs/migration.md) | Upgrading between package versions |
+| [1.2.0 Release Notes](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/releases/v1.2.0.md) | Composition, consumer compatibility and bounded RPC qualification |
+| [XML/JSON Mapping Contract](docs/mapping-contract.md) | Checked keyed, namespace, nil and group representations |
+| [Product Corpus](docs/corpus.md) | Representative public inputs and their executable evidence |
+
+### Contributing
+
+| Guide | Description |
+|---|---|
+| [Content Model Baseline](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-baseline.md) | Reproducible S01 reference evidence and current semantic limits |
+| [Shipped Fix Reconciliation](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-shipped-fix.md) | Contributor attribution, delivered occurrence behavior and S02 handoff |
+| [Content Model Decision Register](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-decisions.md) | Stable S02 decisions, evidence, owners and prerequisite gates |
+| [SOAP Feasibility Evidence](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-soap-feasibility.md) | Local ordered SOAP exchanges, raw transport seams and capability limits |
+| [Gateway Feasibility Evidence](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-gateway-feasibility.md) | Non-mutating route validation, dialect boundaries and serialized HTTP bytes |
+| [Ordered Schema Loading](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-loading.md) | Internal ordered syntax, provenance and controlled resolution contracts |
+| [Canonical Schema Graph](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-graph.md) | Immutable declarations, use-site particles, references and lexical context |
+| [Canonical Reference Resolution](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-resolution.md) | Namespace visibility, complete targets, legal recursion and component-cycle diagnostics |
+| [Canonical Derivation Composition](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-composition.md) | Distinct extension/restriction views, attributes, wildcards and legality obligations |
+| [Structural Companion Catalogs](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-companions.md) | Required closures, actual structural equality, provenance and shared semantic dispatch |
+| [Exact Particle Analysis](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-analysis.md) | Exact contributions, particle emptiness and bounded immutable summaries |
+| [Semantic Catalog Format 2](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-catalog.md) | Deterministic persistence, typed validation and early compatibility routing |
+| [Checked WSDL readiness](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-readiness.md) | Measured assessment corpus and bounded P3 implementation packet |
+| [Direct Structural Matching](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-matching.md) | Internal structure-only matcher, evidence and scalar handoff |
+| [Architecture](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/architecture.md) | Internal pipeline for contributors |
+| [Reference Validation](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/reference-validation.md) | Internal evidence contract and Node tooling migration inventory |
+| [NOAA NDFD Qualification](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/noaa-ndfd-qualification.md) | All-12 owned RPC execution, ten live successes and two live GML refusals |
+| [File Naming And Path Organization](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/file-naming-and-path-organization.md) | Contributor convention for taxonomy paths and fixture retrieval |
+
+### Decisions and research
+
+| Guide | Description |
+|---|---|
+| [Content Model Contracts (ADR-003)](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/decisions/003-content-model-contracts.md) | Fidelity, profile, compatibility and integration contracts for S02 |
+| [Release Notes](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/releases/README.md) | Per-version GitHub release notes used by the draft release workflow |
+| [v1.1.8 Release Notes](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/releases/v1.1.8.md) | Checked generation preview, supported values and upgrade guidance |
+| [Current Roadmap](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/ROADMAP.md) | Published baseline, active content-model backlog, and delivery milestones |
+| [Version 1.0 Roadmap Plan](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/roadmap/README.md) | Historical completed implementation slices and qualification gates for 1.0 |
+| [Streamable Responses (ADR-002)](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/decisions/002-streamable-responses.md) | Opt-in streaming: client `AsyncIterable`, gateway NDJSON or JSON array, `x-wsdl-tsc-stream` |
+| [Product and Research Boundary](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/decisions/004-product-research-boundary.md) | Package, validation and delivery responsibilities |
+| [Research Program](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/research/README.md) | Optional experiments, commands and historical investigation records |
 
 ## Why This Exists
 
@@ -289,18 +299,20 @@ If you are wrapping a vendor SOAP API in a modern service layer, this is the too
 
 ## Contributing
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, project structure, and guidelines.
+See [CONTRIBUTING.md](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/CONTRIBUTING.md) for development setup, project structure, and guidelines.
 
 ## License
 
 MIT. See [LICENSE](LICENSE) for full text. Generated artifacts are fully yours with no restrictions or attribution required.
 
+Unmodified NOAA/NWS qualification fixtures are public-domain provider material with separate [attribution and provenance](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/noaa-ndfd-qualification.md#provenance-and-permission).
+
 ## Links
 
 - [npm](https://www.npmjs.com/package/@techspokes/typescript-wsdl-client)
-- [Changelog](CHANGELOG.md)
-- [Roadmap](ROADMAP.md)
-- [Security](SECURITY.md)
+- [Changelog](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/CHANGELOG.md)
+- [Roadmap](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/ROADMAP.md)
+- [Security](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/SECURITY.md)
 - [Sponsor](https://github.com/sponsors/TechSpokes)
 
 Built and maintained by [TechSpokes](https://www.techspokes.com). Created by [Serge Liatko](https://github.com/sergeliatko).
@@ -323,4 +335,4 @@ The programmatic `assessSchemaSource(source, {loading: {policy: {fileRoots: [...
 
 The report separates native schema premises, dated-XSD correspondence, execution and per-operation runtime capabilities. Exit 0 requires established native scope and qualified correspondence; 2 means inconclusive, 3 native scope disproved, 4 resource-limit, 5 cancelled and 1 operational failure. Execution failure takes precedence over retained schema facts. An assessment never admits structured generation; legacy defaults and existing commands are unchanged.
 
-See the [checked-product assurance contract](docs/decisions/003-content-model-contracts.md#checked-product-assessment-amendment-p1-d01) for the sufficient direct correspondence route and remaining downstream obligations.
+See the [checked-product assurance contract](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/decisions/003-content-model-contracts.md#checked-product-assessment-amendment-p1-d01) for the sufficient direct correspondence route and remaining downstream obligations.

package/dist/app/generateApp.d.ts

@@ -52,4 +52,3 @@ export interface GenerateAppOptions {
  * @throws {Error} If validation fails or required files are missing
  */
 export declare function generateApp(opts: GenerateAppOptions): Promise<void>;
-//# sourceMappingURL=generateApp.d.ts.map

package/dist/app/generateApp.js

@@ -528,7 +528,7 @@ function generatePackageJson(appDir, force) {
             dev: "tsx watch server.ts",
         },
         dependencies: {
-            fastify: "^5.12.7",
+            fastify: "^5.12.8",
             "fastify-plugin": "^6.0.1",
             saxes: "^6.0.0",
             soap: "^1.14.0",

package/dist/app/generateCheckedApp.d.ts

@@ -0,0 +1,38 @@
+import type { DirectOperationSelector } from '../compiler/directOperation.js';
+export interface GenerateCheckedAppOptions {
+    readonly clientDir: string;
+    readonly gatewayDir: string;
+    readonly openapiFile: string;
+    readonly appDir: string;
+    readonly force?: boolean;
+    readonly host?: string;
+    readonly port?: number;
+    readonly component: {
+        readonly source: string;
+        readonly capsules: Readonly<Record<string, string>>;
+        readonly sourceResources: readonly {
+            readonly uri: string;
+            readonly file: string;
+            readonly canonicalUri?: string;
+        }[];
+        readonly sourceUri?: string;
+        readonly sourceOrigins: readonly string[];
+        readonly namespaceLocations?: readonly {
+            readonly namespace: string;
+            readonly location: string;
+        }[];
+        readonly standardLibraries?: readonly string[];
+        readonly recordSources?: readonly {
+            readonly selector: DirectOperationSelector;
+            readonly source: string;
+        }[];
+    };
+}
+/**
+ * Writes missing consumer-owned project files, preserving customizations unless forced.
+ * @param options - Explicit paths, all generated artifacts located below appDir.
+ * @returns Resolves after the scaffold has been written.
+ * @throws If a path escapes the project or a required artifact cannot be read.
+ * @sideEffects Creates project files without modifying generated client/gateway artifacts.
+ */
+export declare function generateCheckedApp(options: GenerateCheckedAppOptions): Promise<void>;

package/dist/app/generateCheckedApp.js

@@ -0,0 +1,108 @@
+/**
+ * Emits an editable standalone host for the opt-in checked gateways.
+ * @since 1.1.6
+ * @constraints Physical source permission remains explicit; component endpoint restrictions are optional.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { writeGeneratedSource } from '../generation/writeGeneratedSource.js';
+import { loadRuntimeTemplate } from '../util/runtimeSource.js';
+function relative(from, to) {
+    const result = path.relative(from, to).split(path.sep).join('/');
+    return result.startsWith('.') ? result : './' + result;
+}
+/**
+ * Writes missing consumer-owned project files, preserving customizations unless forced.
+ * @param options - Explicit paths, all generated artifacts located below appDir.
+ * @returns Resolves after the scaffold has been written.
+ * @throws If a path escapes the project or a required artifact cannot be read.
+ * @sideEffects Creates project files without modifying generated client/gateway artifacts.
+ */
+export async function generateCheckedApp(options) {
+    const root = path.resolve(options.appDir);
+    const component = options.component;
+    for (const file of [options.clientDir, options.gatewayDir, options.openapiFile]) {
+        const rel = path.relative(root, path.resolve(file));
+        if (rel === '..' || rel.startsWith('..' + path.sep) || path.isAbsolute(rel)) {
+            throw new Error('Checked app outputs must be contained in appDir');
+        }
+    }
+    const clientImport = relative(root, path.join(options.clientDir, 'client.js'));
+    const gatewayImport = relative(root, path.join(options.gatewayDir, 'plugin.js'));
+    const spec = relative(root, options.openapiFile);
+    const ownPackage = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+    const capsuleFiles = Object.fromEntries(Object.entries(component.capsules).map(([name, file]) => [name, relative(root, file)]));
+    const server = loadRuntimeTemplate('checkedGatewayHost.tpl.txt')
+        .replaceAll('__CLIENT_IMPORT__', JSON.stringify(clientImport))
+        .replaceAll('__GATEWAY_IMPORT__', JSON.stringify(gatewayImport))
+        .replaceAll('__CAPSULE_FILES__', JSON.stringify(capsuleFiles))
+        .replaceAll('__SOURCE_RECORD__', JSON.stringify(relative(root, path.join(options.clientDir, 'source-resources.json'))))
+        .replaceAll('__OPENAPI_FILE__', JSON.stringify(spec))
+        .replaceAll('__DEFAULT_HOST__', JSON.stringify(options.host ?? '127.0.0.1'))
+        .replaceAll('__DEFAULT_PORT__', String(options.port ?? 3000));
+    const manifest = {
+        name: 'checked-component-gateway', version: '0.0.0', private: true, type: 'module',
+        engines: { node: '>=24.0.0' },
+        scripts: { typecheck: 'tsc --noEmit', test: 'vitest run', build: 'tsc', start: 'node dist/server.js' },
+        dependencies: { '@techspokes/typescript-wsdl-client': `^${ownPackage.version}`, ajv: '^8.20.0', fastify: '^5.12.8', soap: '^1.14.0' },
+        devDependencies: { '@types/node': '^26.6.6', typescript: '^6.0.3', vitest: '^5.1.0' },
+    };
+    const files = {
+        'package.json': JSON.stringify(manifest, null, 2) + '\n',
+        'tsconfig.json': JSON.stringify({ compilerOptions: { target: 'ES2022', module: 'NodeNext', moduleResolution: 'NodeNext',
+                strict: true, esModuleInterop: true, skipLibCheck: true, rootDir: '.', outDir: 'dist', types: ['node'] },
+            include: ['**/*.ts'], exclude: ['dist', 'node_modules'] }, null, 2) + '\n',
+        'checked-gateway.example.json': JSON.stringify({ host: options.host ?? '127.0.0.1', port: options.port ?? 3000 }, null, 2) + '\n',
+        '.gitignore': 'node_modules/\ndist/\nchecked-gateway.local.json\n',
+        'README.md': '',
+    };
+    files['README.md'] = `# Checked component gateway
+
+This project uses native source qualification, structured mappings and SOAP 1.1 validation. Each operation has its own client and capsule; the service router keeps binding and operation identities separate. Scalar facets, ordered occurrences and wildcard declaration membership remain native runtime checks.
+
+## Install and run
+
+Run from this directory:
+
+\`\`\`bash
+npm install
+npm run typecheck
+npm test
+npm run build
+\`\`\`
+
+Run \`npm start\` with no configuration file for ordinary startup. Calls derive the selected WSDL address. To override it, create an optional \`checked-gateway.local.json\` containing \`{"endpoint":"https://your-owned-test-service/soap"}\`. Optional \`allowedEndpoints\` restricts the destination, and an explicit empty list denies all. Select the optional file in PowerShell:
+
+\`\`\`powershell
+$env:CHECKED_GATEWAY_CONFIG = 'checked-gateway.local.json'
+npm start
+\`\`\`
+
+Health is at \`GET /health\`; all generated routes are listed at \`GET /openapi.json\`.
+
+## Sources and security
+
+Generated \`client/source-resources.json\` owns snapshot, alias and capsule bookkeeping under its explicit v2 format. The host loads its own records and checks canonical ownership and snapshot digests. The optional user file contains host, endpoint, trust and restriction choices. Paths resolve relative to that file. Missing snapshots refuse instead of fetching metadata or using capsule-embedded bytes.
+
+Complete advanced source configurations remain supported: supply \`localSource\`, \`fileRoots\`, \`sourceResources\` and \`sourceOrigins\` together when selecting an explicit source, namespace mapping, companion source or capsule files. Omission preserves generated defaults; explicit empty origins, snapshots, libraries and endpoint restrictions stay restrictive. Incomplete advanced inputs refuse. Regeneration preserves consumer-owned host/config/test files unless their force option is deliberately selected.
+
+The runtime reads physical sources independently and validates native requests, responses and declared faults. The selected address supplies routing intent on invocation; startup and generated tests make no business SOAP calls. HTTPS policies require verified TLS; \`caFile\` can supply a test CA without disabling certificate or hostname checks. Unsupported security requirements and capabilities refuse before dispatch. Optional \`timeoutMs\` and XML \`limits\` are caller controls; there is no implicit execution deadline or diagnostic work quota. Programmatic hosts can supply an \`AbortSignal\`.
+
+Generated defaults retain the acquired standard-library and explicit companion-source decisions. Advanced callers may provide \`standardLibraries\` and \`recordSources\` explicitly; the latter pairs each outer selector with its independent physical companion WSDL. These contexts remain separate; the companion service is never invoked. Scoped responses retain the complete companion payload and validate required schema metadata before omitting it from JSON. OpenAPI records explicit exclusions and buffered scope. Missing schema metadata is not defaulted, and no streaming behavior is implied.
+
+## Ownership and evidence
+
+Clients, per-operation capsules, copied source bytes, gateway files and OpenAPI are generator-owned. Server, package/configuration, this README and generated tests are consumer-owned scaffolds and are preserved unless force is selected. Optional \`capsuleFiles\` explicitly overrides per-operation artifact locations. Unknown controls and mismatched artifacts refuse.
+
+Generated tests cover health, documentation and invalid-input refusal. They do not establish independent wire behavior, record interpretation or provider/business acceptance. WSDL supplies neither credentials nor business-value oracles; use separately specified owned-service fixtures for those checks.
+`;
+    fs.mkdirSync(root, { recursive: true });
+    if (options.force || !fs.existsSync(path.join(root, 'server.ts'))) {
+        writeGeneratedSource(path.join(root, 'server.ts'), server, 'app');
+    }
+    for (const [name, body] of Object.entries(files)) {
+        const file = path.join(root, name);
+        if (options.force || !fs.existsSync(file))
+            fs.writeFileSync(file, body, 'utf8');
+    }
+}

package/dist/checkedPipeline.d.ts

@@ -0,0 +1,155 @@
+import type { PipelineOptions } from './pipeline.js';
+import type { DirectOperationSelector } from './compiler/directOperation.js';
+import type { ReconstructedComponentSource } from './compiler/directSourceCapsule.js';
+import type { GeneratedComponentClient } from './client/generateDirectClient.js';
+import type { SchemaInput } from './loader/schemaInput.js';
+import type { ComponentRecordProjectionSpec, ComponentRecordProjectionAssociation, ComponentRecordProjection } from './compiler/componentRecordProjection.js';
+import type { ApplicationGroupsOptions, ApplicationGroupTarget, ApplicationGroupRecord } from './compiler/applicationGroups.js';
+/** Explicit service operations and independently authorized snapshots for component generation. */
+export interface CheckedComponentOptions {
+    readonly applicationGroups?: ApplicationGroupsOptions;
+    readonly service: {
+        readonly namespace: string;
+        readonly local: string;
+    };
+    readonly port: string;
+    readonly fileRoots: readonly string[];
+    readonly signal?: AbortSignal;
+    readonly selectors: readonly DirectOperationSelector[];
+    readonly sourceResources: readonly {
+        readonly uri: string;
+        readonly file: string;
+        readonly canonicalUri?: string;
+    }[];
+    readonly sourceUri?: string;
+    readonly sourceOrigins: readonly string[];
+    readonly namespaceLocations?: readonly {
+        readonly namespace: string;
+        readonly location: string;
+    }[];
+    readonly basePath?: string;
+    readonly standardLibraries?: readonly string[];
+    readonly recordProjections?: readonly CheckedComponentRecordProjection[];
+}
+type CheckedComponentRecordProjection = Readonly<{
+    selector: DirectOperationSelector;
+    source: string;
+    recordSelector: DirectOperationSelector;
+    standardLibraries?: readonly string[];
+}> & (Readonly<{
+    spec: ComponentRecordProjectionSpec;
+    scope?: never;
+    recordPath?: never;
+}> | (ComponentRecordProjectionAssociation & Readonly<{
+    spec?: never;
+}>));
+/**
+ * Diagnostic coverage data; it confers no generation or execution authority.
+ * @since Unreleased
+ */
+export interface CheckedInventory {
+    readonly applicationGroups?: {
+        readonly targets: readonly ApplicationGroupTarget[];
+        readonly records: readonly ApplicationGroupRecord[];
+    };
+    readonly model: string;
+    readonly assurance: string;
+    readonly admitted: false;
+    readonly selection: {
+        readonly selector: DirectOperationSelector;
+        readonly selectors?: readonly DirectOperationSelector[];
+        readonly service: CheckedComponentOptions['service'];
+        readonly port: string;
+    };
+    readonly operations: readonly {
+        readonly portType: {
+            readonly namespace: string;
+            readonly local: string;
+        };
+        readonly operation: string;
+        readonly requested: boolean;
+        readonly selected: boolean;
+        readonly generated: boolean;
+        readonly executed: boolean;
+        readonly status: string;
+    }[];
+}
+/** Read explicit component configuration without invoking getters or accepting unknown controls.
+ * @returns A copied configuration; all schema, mapping and operation decisions remain native duties.
+ * @throws TypeError For missing, malformed, duplicate or unsupported configuration.
+ */
+export declare function parseCheckedComponentOptions(value: unknown): CheckedComponentOptions;
+/** Validate caller choices before discovery without fabricating resolved identities.
+ * @param value Data-only optional choices.
+ * @returns Copied choices; absent selections remain absent.
+ * @throws TypeError For malformed or unsupported controls.
+ */
+export declare function parseCheckedComponentChoices(value: unknown): Partial<CheckedComponentOptions>;
+/**
+ * Generate the bounded preview without creating a flattened catalog authority.
+ * @param opts Public pipeline options with the checked model explicitly selected.
+ * @returns Documentation and an operation inventory; no native authority is serialized as a report.
+ * @throws Error Before emission for unsupported controls or failed native qualification.
+ * @sideEffects Writes generator-owned artifacts and preserves existing scaffolds unless forced.
+ */
+export declare function runCheckedPipeline(opts: PipelineOptions): Promise<{
+    compiled: undefined;
+    openapiDoc: unknown;
+    checked: CheckedInventory;
+    planning: import("./checkedPlanning.js").CheckedComponentPlan;
+}>;
+/** Prepare through native owners only; internal handles remain within this invocation. */
+export declare function prepareComponentStages(wsdl: string, config: CheckedComponentOptions, acquired?: SchemaInput, outputs?: {
+    clientDir: string;
+    gatewayDir: string;
+    openapiFile: string;
+    basePath: string;
+}): Promise<{
+    expected: ReconstructedComponentSource[];
+    projections: Map<string, ComponentRecordProjection>;
+    namespaces: Map<string, string>;
+    refusals: {
+        selector: DirectOperationSelector;
+        kind: string;
+        rule: string;
+        dimension: "qualification-and-correspondence" | "mapping-and-artifact";
+    }[];
+    layout: {
+        inspection: import("./compiler/directOperation.js").DirectOperationInspection;
+        input: Readonly<{
+            root: import("./loader/orderedSyntax.js").SyntaxDocument;
+            documents: readonly import("./loader/orderedSyntax.js").SyntaxDocument[];
+            schemas: readonly import("./loader/schemaInput.js").SchemaInterpretation[];
+            resources: readonly import("./loader/schemaResources.js").ResourceMetadata[];
+            resourceAliases: ReadonlyMap<string, string>;
+            edges: readonly import("./loader/schemaInput.js").ResolutionEdge[];
+            limits: import("./loader/schemaResources.js").LoadingLimits;
+            metrics: Readonly<{
+                resources: number;
+                totalBytes: number;
+                ioMs: number;
+            }>;
+        }>;
+        resources: Map<string, {
+            input: SchemaInput;
+            resource: SchemaInput["resources"][number];
+        }>;
+        allResources: Readonly<{
+            uri: string;
+            digest: string;
+            byteLength: number;
+        }>[];
+        common: string;
+    } | undefined;
+    generatedClients: GeneratedComponentClient[];
+    gateway: {
+        doc: unknown;
+        routes: Readonly<Record<string, string>>;
+        emit: () => Promise<void>;
+    } | undefined;
+    applicationGroups: {
+        targets: ApplicationGroupTarget[];
+        records: ApplicationGroupRecord[];
+    } | undefined;
+}>;
+export {};