Prepare v1.0.2 public source and release metadata

[Alexander Zaslonov (azaslonov)]

Summary

Prepare the ongoing v1.0.2 public release on upstream main at 03612c6, including the source alignment from the historical v1.0.1 backfill. The branch contains two commits: the source/backfill alignment and the v1.0.2 metadata update.

• Set package.json and both package-lock.json version fields to 1.0.2, without changing dependencies or schema version.
• Add both v1.0.1 and v1.0.2 changelog entries.
• Port structured DELETE error handling and empty environment.appliesTo validation with regression coverage, preserving all newer upstream fixes.
• Document v1.0.2 fixes already on main: WSDL XSD schema handling and gateway dry-run labels (Fix/wsdl xsd schemas and dryrun label #272), subscription owner normalization (fix: normalize subscription ownerId to relative /users path on publish #279), conservative timestamp-schema handling (fix: skip portal-created 13-digit schema IDs on spec import to prevent duplicate schemas #280), and sovereign-cloud pre-flight endpoints (Respect --cloud in publish pre-flight checks #281).
• Only public commits and eight allowlisted source/test/metadata files are included. No internal release infrastructure is imported.

Validation

• Every runtime source file matches the validated v1.0.2 release candidate after line-ending/trailing-whitespace normalization.
• Both package manifests match the release candidate exactly.
• 154 focused tests passed across three files on this public branch.
• The corresponding release candidate passed build, lint, and all 1,501 tests; the historical public source port also passed build and lint. The full suite was not rerun on this public branch.
• Constitution-focused code review found no Blocker or Required findings. Existing DELETE regression tests resolve the reviewer's coverage suggestion.
• Whitespace and public-only ancestry checks passed.
• Existing moderate Vitest development dependency advisories remain unchanged.

Related Issues

Release preparation only; the upstream fixes retain their existing issue/PR references.

Release Gate

KEEP DRAFT until v1.0.2 is approved for release. The existing Squad Release workflow is configured to create an annotated tag and publish a GitHub release after a version bump reaches main. Merging this PR can therefore announce v1.0.2; do not merge it prematurely or independently create a competing tag/release. After approval and merge, verify that v1.0.2 points to the version-matching main commit and that exactly one GitHub release exists. GitHub source release and npm/ESRP publication are separate; this PR must not trigger duplicate npm publication.

[Copilot]

🟡 Changes recommended

The tightened configuration validation conflicts with the frozen v1 schema and requires a new schema version.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Prepares the v1.0.2 release metadata and backfills validated v1.0.1 publishing fixes.

Changes:

• Bumps package metadata to v1.0.2 and adds changelog entries.
• Uses structured HTTP status/error codes for DELETE handling.
• Rejects empty environment appliesTo configurations with regression coverage.

File summaries

File	Description
package.json	Bumps package version.
package-lock.json	Aligns lockfile package versions.
CHANGELOG.md	Documents v1.0.1 and v1.0.2.
src/clients/apim-client.ts	Classifies DELETE failures structurally.
src/services/env-mapping-validator.ts	Rejects empty appliesTo.
tests/unit/clients/apim-client.test.ts	Covers structured DELETE outcomes.
tests/unit/services/publish-service.env-mapping.test.ts	Covers direct validation failure.
tests/unit/services/publish-service.test.ts	Verifies validation precedes deletion.

Review details

• Files reviewed: 7/8 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.