@fern-api/fern-api-dev 5.87.0 → 5.88.0

package/cli.cjs

@@ -54019,6 +54019,19 @@ var init_OAuthAccessTokenResponsePropertiesSchema = __esm({
   }
 });
 
+// ../fern-definition/schema/lib/schemas/api/resources/auth/types/OAuthFlowTypeSchema.js
+var OAuthFlowTypeSchema;
+var init_OAuthFlowTypeSchema = __esm({
+  "../fern-definition/schema/lib/schemas/api/resources/auth/types/OAuthFlowTypeSchema.js"() {
+    "use strict";
+    OAuthFlowTypeSchema = {
+      ClientCredentials: "client-credentials",
+      AuthorizationCode: "authorization-code",
+      DeviceCode: "device-code"
+    };
+  }
+});
+
 // ../fern-definition/schema/lib/schemas/api/resources/auth/types/OAuthGetTokenEndpointSchema.js
 var init_OAuthGetTokenEndpointSchema = __esm({
   "../fern-definition/schema/lib/schemas/api/resources/auth/types/OAuthGetTokenEndpointSchema.js"() {
@@ -54026,6 +54039,13 @@ var init_OAuthGetTokenEndpointSchema = __esm({
   }
 });
 
+// ../fern-definition/schema/lib/schemas/api/resources/auth/types/OAuthPkceSchema.js
+var init_OAuthPkceSchema = __esm({
+  "../fern-definition/schema/lib/schemas/api/resources/auth/types/OAuthPkceSchema.js"() {
+    "use strict";
+  }
+});
+
 // ../fern-definition/schema/lib/schemas/api/resources/auth/types/OAuthRefreshTokenEndpointSchema.js
 var init_OAuthRefreshTokenEndpointSchema = __esm({
   "../fern-definition/schema/lib/schemas/api/resources/auth/types/OAuthRefreshTokenEndpointSchema.js"() {
@@ -54054,6 +54074,20 @@ var init_OAuthSchemeSchema = __esm({
   }
 });
 
+// ../fern-definition/schema/lib/schemas/api/resources/auth/types/RedirectUriSchema.js
+var init_RedirectUriSchema = __esm({
+  "../fern-definition/schema/lib/schemas/api/resources/auth/types/RedirectUriSchema.js"() {
+    "use strict";
+  }
+});
+
+// ../fern-definition/schema/lib/schemas/api/resources/auth/types/RedirectUriWithBackupPortsSchema.js
+var init_RedirectUriWithBackupPortsSchema = __esm({
+  "../fern-definition/schema/lib/schemas/api/resources/auth/types/RedirectUriWithBackupPortsSchema.js"() {
+    "use strict";
+  }
+});
+
 // ../fern-definition/schema/lib/schemas/api/resources/auth/types/TokenBearerAuthSchema.js
 var init_TokenBearerAuthSchema = __esm({
   "../fern-definition/schema/lib/schemas/api/resources/auth/types/TokenBearerAuthSchema.js"() {
@@ -54098,11 +54132,15 @@ var init_types2 = __esm({
     init_InferredGetTokenEndpointSchemaObject();
     init_OAuthAccessTokenRequestPropertiesSchema();
     init_OAuthAccessTokenResponsePropertiesSchema();
+    init_OAuthFlowTypeSchema();
     init_OAuthGetTokenEndpointSchema();
+    init_OAuthPkceSchema();
     init_OAuthRefreshTokenEndpointSchema();
     init_OAuthRefreshTokenRequestPropertiesSchema();
     init_OAuthRefreshTokenResponsePropertiesSchema();
     init_OAuthSchemeSchema();
+    init_RedirectUriSchema();
+    init_RedirectUriWithBackupPortsSchema();
     init_TokenBearerAuthSchema();
     init_WithAuthSchema();
     init_WithEnvironmentVariable();
@@ -54111,6 +54149,9 @@ var init_types2 = __esm({
 
 // ../fern-definition/schema/lib/schemas/api/resources/auth/index.js
 var auth_exports = {};
+__export(auth_exports, {
+  OAuthFlowTypeSchema: () => OAuthFlowTypeSchema
+});
 var init_auth = __esm({
   "../fern-definition/schema/lib/schemas/api/resources/auth/index.js"() {
     "use strict";
@@ -58194,6 +58235,16 @@ var init_AuthScope2 = __esm({
   }
 });
 
+// ../fern-definition/schema/lib/schemas/serialization/resources/auth/types/OAuthFlowTypeSchema.js
+var OAuthFlowTypeSchema2;
+var init_OAuthFlowTypeSchema2 = __esm({
+  "../fern-definition/schema/lib/schemas/serialization/resources/auth/types/OAuthFlowTypeSchema.js"() {
+    "use strict";
+    init_core();
+    OAuthFlowTypeSchema2 = schemas_exports.enum_(["client-credentials", "authorization-code", "device-code"]);
+  }
+});
+
 // ../fern-definition/schema/lib/schemas/serialization/resources/auth/types/OAuthAccessTokenRequestPropertiesSchema.js
 var OAuthAccessTokenRequestPropertiesSchema;
 var init_OAuthAccessTokenRequestPropertiesSchema2 = __esm({
@@ -58238,6 +58289,18 @@ var init_OAuthGetTokenEndpointSchema2 = __esm({
   }
 });
 
+// ../fern-definition/schema/lib/schemas/serialization/resources/auth/types/OAuthPkceSchema.js
+var OAuthPkceSchema;
+var init_OAuthPkceSchema2 = __esm({
+  "../fern-definition/schema/lib/schemas/serialization/resources/auth/types/OAuthPkceSchema.js"() {
+    "use strict";
+    init_core();
+    OAuthPkceSchema = schemas_exports.object({
+      method: schemas_exports.string().optional()
+    });
+  }
+});
+
 // ../fern-definition/schema/lib/schemas/serialization/resources/auth/types/OAuthRefreshTokenRequestPropertiesSchema.js
 var OAuthRefreshTokenRequestPropertiesSchema;
 var init_OAuthRefreshTokenRequestPropertiesSchema2 = __esm({
@@ -58280,6 +58343,30 @@ var init_OAuthRefreshTokenEndpointSchema2 = __esm({
   }
 });
 
+// ../fern-definition/schema/lib/schemas/serialization/resources/auth/types/RedirectUriWithBackupPortsSchema.js
+var RedirectUriWithBackupPortsSchema;
+var init_RedirectUriWithBackupPortsSchema2 = __esm({
+  "../fern-definition/schema/lib/schemas/serialization/resources/auth/types/RedirectUriWithBackupPortsSchema.js"() {
+    "use strict";
+    init_core();
+    RedirectUriWithBackupPortsSchema = schemas_exports.object({
+      url: schemas_exports.string(),
+      ports: schemas_exports.list(schemas_exports.number()).optional()
+    });
+  }
+});
+
+// ../fern-definition/schema/lib/schemas/serialization/resources/auth/types/RedirectUriSchema.js
+var RedirectUriSchema;
+var init_RedirectUriSchema2 = __esm({
+  "../fern-definition/schema/lib/schemas/serialization/resources/auth/types/RedirectUriSchema.js"() {
+    "use strict";
+    init_core();
+    init_RedirectUriWithBackupPortsSchema2();
+    RedirectUriSchema = schemas_exports.undiscriminatedUnion([schemas_exports.string(), RedirectUriWithBackupPortsSchema]);
+  }
+});
+
 // ../fern-definition/schema/lib/schemas/serialization/resources/auth/types/OAuthSchemeSchema.js
 var OAuthSchemeSchema;
 var init_OAuthSchemeSchema2 = __esm({
@@ -58288,18 +58375,32 @@ var init_OAuthSchemeSchema2 = __esm({
     init_core();
     init_WithDocsSchema2();
     init_AuthScope2();
+    init_OAuthFlowTypeSchema2();
     init_OAuthGetTokenEndpointSchema2();
+    init_OAuthPkceSchema2();
     init_OAuthRefreshTokenEndpointSchema2();
+    init_RedirectUriSchema2();
     OAuthSchemeSchema = schemas_exports.object({
       scheme: schemas_exports.stringLiteral("oauth"),
-      type: schemas_exports.stringLiteral("client-credentials"),
+      type: OAuthFlowTypeSchema2,
       scopes: schemas_exports.list(AuthScope).optional(),
-      "client-id-env": schemas_exports.string().optional(),
-      "client-secret-env": schemas_exports.string().optional(),
       "token-prefix": schemas_exports.string().optional(),
       "token-header": schemas_exports.string().optional(),
-      "get-token": OAuthGetTokenEndpointSchema,
-      "refresh-token": OAuthRefreshTokenEndpointSchema.optional()
+      "client-id-env": schemas_exports.string().optional(),
+      "client-secret-env": schemas_exports.string().optional(),
+      "get-token": OAuthGetTokenEndpointSchema.optional(),
+      "refresh-token": OAuthRefreshTokenEndpointSchema.optional(),
+      "client-id": schemas_exports.string().optional(),
+      "authorization-url": schemas_exports.string().optional(),
+      "device-authorization-url": schemas_exports.string().optional(),
+      "token-url": schemas_exports.string().optional(),
+      "refresh-url": schemas_exports.string().optional(),
+      "redirect-uri": RedirectUriSchema.optional(),
+      pkce: OAuthPkceSchema.optional(),
+      "authorization-parameters": schemas_exports.record(schemas_exports.string(), schemas_exports.string()).optional(),
+      "device-authorization-parameters": schemas_exports.record(schemas_exports.string(), schemas_exports.string()).optional(),
+      "token-parameters": schemas_exports.record(schemas_exports.string(), schemas_exports.string()).optional(),
+      "refresh-parameters": schemas_exports.record(schemas_exports.string(), schemas_exports.string()).optional()
     }).extend(WithDocsSchema);
   }
 });
@@ -58372,11 +58473,15 @@ var init_types22 = __esm({
     init_InferredGetTokenEndpointSchemaObject2();
     init_OAuthAccessTokenRequestPropertiesSchema2();
     init_OAuthAccessTokenResponsePropertiesSchema2();
+    init_OAuthFlowTypeSchema2();
     init_OAuthGetTokenEndpointSchema2();
+    init_OAuthPkceSchema2();
     init_OAuthRefreshTokenEndpointSchema2();
     init_OAuthRefreshTokenRequestPropertiesSchema2();
     init_OAuthRefreshTokenResponsePropertiesSchema2();
     init_OAuthSchemeSchema2();
+    init_RedirectUriSchema2();
+    init_RedirectUriWithBackupPortsSchema2();
     init_TokenBearerAuthSchema2();
     init_WithAuthSchema2();
     init_WithEnvironmentVariable2();
@@ -58405,11 +58510,15 @@ __export(auth_exports2, {
   InferredGetTokenEndpointSchemaObject: () => InferredGetTokenEndpointSchemaObject,
   OAuthAccessTokenRequestPropertiesSchema: () => OAuthAccessTokenRequestPropertiesSchema,
   OAuthAccessTokenResponsePropertiesSchema: () => OAuthAccessTokenResponsePropertiesSchema,
+  OAuthFlowTypeSchema: () => OAuthFlowTypeSchema2,
   OAuthGetTokenEndpointSchema: () => OAuthGetTokenEndpointSchema,
+  OAuthPkceSchema: () => OAuthPkceSchema,
   OAuthRefreshTokenEndpointSchema: () => OAuthRefreshTokenEndpointSchema,
   OAuthRefreshTokenRequestPropertiesSchema: () => OAuthRefreshTokenRequestPropertiesSchema,
   OAuthRefreshTokenResponsePropertiesSchema: () => OAuthRefreshTokenResponsePropertiesSchema,
   OAuthSchemeSchema: () => OAuthSchemeSchema,
+  RedirectUriSchema: () => RedirectUriSchema,
+  RedirectUriWithBackupPortsSchema: () => RedirectUriWithBackupPortsSchema,
   TokenBearerAuthSchema: () => TokenBearerAuthSchema,
   WithAuthSchema: () => WithAuthSchema,
   WithEnvironmentVariable: () => WithEnvironmentVariable
@@ -61580,7 +61689,9 @@ __export(serialization_exports, {
   NumberValidationSchema: () => NumberValidationSchema,
   OAuthAccessTokenRequestPropertiesSchema: () => OAuthAccessTokenRequestPropertiesSchema,
   OAuthAccessTokenResponsePropertiesSchema: () => OAuthAccessTokenResponsePropertiesSchema,
+  OAuthFlowTypeSchema: () => OAuthFlowTypeSchema2,
   OAuthGetTokenEndpointSchema: () => OAuthGetTokenEndpointSchema,
+  OAuthPkceSchema: () => OAuthPkceSchema,
   OAuthRefreshTokenEndpointSchema: () => OAuthRefreshTokenEndpointSchema,
   OAuthRefreshTokenRequestPropertiesSchema: () => OAuthRefreshTokenRequestPropertiesSchema,
   OAuthRefreshTokenResponsePropertiesSchema: () => OAuthRefreshTokenResponsePropertiesSchema,
@@ -61605,6 +61716,8 @@ __export(serialization_exports, {
   ProtobufSourceSchema: () => ProtobufSourceSchema,
   ProtobufTypeSchema: () => ProtobufTypeSchema,
   QueryParameterTypeReferenceDetailed: () => QueryParameterTypeReferenceDetailed,
+  RedirectUriSchema: () => RedirectUriSchema,
+  RedirectUriWithBackupPortsSchema: () => RedirectUriWithBackupPortsSchema,
   ResponseError: () => ResponseError,
   ResponseErrorWithDocsSchema: () => ResponseErrorWithDocsSchema,
   ResponseErrorsSchema: () => ResponseErrorsSchema,
@@ -61783,6 +61896,7 @@ __export(schemas_exports2, {
   FernDefinitionTimeoutError: () => FernDefinitionTimeoutError,
   FormDataBodyEncodingStyle: () => FormDataBodyEncodingStyle,
   HttpMethodSchema: () => HttpMethodSchema,
+  OAuthFlowTypeSchema: () => OAuthFlowTypeSchema,
   ObjectPropertyAccess: () => ObjectPropertyAccess,
   StreamFormat: () => StreamFormat,
   SupportedSdkLanguageSchema: () => SupportedSdkLanguageSchema,
@@ -125582,6 +125696,19 @@ var init_OAuthAccessTokenResponsePropertiesSchema3 = __esm({
   }
 });
 
+// ../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/OAuthFlowTypeSchema.js
+var OAuthFlowTypeSchema3;
+var init_OAuthFlowTypeSchema3 = __esm({
+  "../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/OAuthFlowTypeSchema.js"() {
+    "use strict";
+    OAuthFlowTypeSchema3 = {
+      ClientCredentials: "client-credentials",
+      AuthorizationCode: "authorization-code",
+      DeviceCode: "device-code"
+    };
+  }
+});
+
 // ../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/OAuthGetTokenEndpointSchema.js
 var init_OAuthGetTokenEndpointSchema3 = __esm({
   "../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/OAuthGetTokenEndpointSchema.js"() {
@@ -125589,6 +125716,13 @@ var init_OAuthGetTokenEndpointSchema3 = __esm({
   }
 });
 
+// ../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/OAuthPkceSchema.js
+var init_OAuthPkceSchema3 = __esm({
+  "../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/OAuthPkceSchema.js"() {
+    "use strict";
+  }
+});
+
 // ../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/OAuthRefreshTokenEndpointSchema.js
 var init_OAuthRefreshTokenEndpointSchema3 = __esm({
   "../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/OAuthRefreshTokenEndpointSchema.js"() {
@@ -125617,6 +125751,20 @@ var init_OAuthSchemeSchema3 = __esm({
   }
 });
 
+// ../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/RedirectUriSchema.js
+var init_RedirectUriSchema3 = __esm({
+  "../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/RedirectUriSchema.js"() {
+    "use strict";
+  }
+});
+
+// ../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/RedirectUriWithBackupPortsSchema.js
+var init_RedirectUriWithBackupPortsSchema3 = __esm({
+  "../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/RedirectUriWithBackupPortsSchema.js"() {
+    "use strict";
+  }
+});
+
 // ../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/TokenBearerAuthSchema.js
 var init_TokenBearerAuthSchema3 = __esm({
   "../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/types/TokenBearerAuthSchema.js"() {
@@ -125653,11 +125801,15 @@ var init_types104 = __esm({
     init_InferredGetTokenEndpointSchemaObject3();
     init_OAuthAccessTokenRequestPropertiesSchema3();
     init_OAuthAccessTokenResponsePropertiesSchema3();
+    init_OAuthFlowTypeSchema3();
     init_OAuthGetTokenEndpointSchema3();
+    init_OAuthPkceSchema3();
     init_OAuthRefreshTokenEndpointSchema3();
     init_OAuthRefreshTokenRequestPropertiesSchema3();
     init_OAuthRefreshTokenResponsePropertiesSchema3();
     init_OAuthSchemeSchema3();
+    init_RedirectUriSchema3();
+    init_RedirectUriWithBackupPortsSchema3();
     init_TokenBearerAuthSchema3();
     init_WithEnvironmentVariable3();
   }
@@ -125665,6 +125817,9 @@ var init_types104 = __esm({
 
 // ../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/index.js
 var auth_exports7 = {};
+__export(auth_exports7, {
+  OAuthFlowTypeSchema: () => OAuthFlowTypeSchema3
+});
 var init_auth8 = __esm({
   "../configuration/lib/generators-yml/schemas/api/resources/fernDefinition/resources/auth/index.js"() {
     "use strict";
@@ -126039,6 +126194,7 @@ var init_resources11 = __esm({
 var fernDefinition_exports = {};
 __export(fernDefinition_exports, {
   AvailabilityStatusSchema: () => AvailabilityStatusSchema3,
+  OAuthFlowTypeSchema: () => OAuthFlowTypeSchema3,
   auth: () => auth_exports7,
   availability: () => availability_exports3,
   commons: () => commons_exports7,
@@ -129310,6 +129466,16 @@ var init_AuthScope6 = __esm({
   }
 });
 
+// ../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/OAuthFlowTypeSchema.js
+var OAuthFlowTypeSchema4;
+var init_OAuthFlowTypeSchema4 = __esm({
+  "../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/OAuthFlowTypeSchema.js"() {
+    "use strict";
+    init_core6();
+    OAuthFlowTypeSchema4 = schemas_exports8.enum_(["client-credentials", "authorization-code", "device-code"]);
+  }
+});
+
 // ../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/OAuthAccessTokenRequestPropertiesSchema.js
 var OAuthAccessTokenRequestPropertiesSchema2;
 var init_OAuthAccessTokenRequestPropertiesSchema4 = __esm({
@@ -129354,6 +129520,18 @@ var init_OAuthGetTokenEndpointSchema4 = __esm({
   }
 });
 
+// ../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/OAuthPkceSchema.js
+var OAuthPkceSchema2;
+var init_OAuthPkceSchema4 = __esm({
+  "../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/OAuthPkceSchema.js"() {
+    "use strict";
+    init_core6();
+    OAuthPkceSchema2 = schemas_exports8.object({
+      method: schemas_exports8.string().optional()
+    });
+  }
+});
+
 // ../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/OAuthRefreshTokenRequestPropertiesSchema.js
 var OAuthRefreshTokenRequestPropertiesSchema2;
 var init_OAuthRefreshTokenRequestPropertiesSchema4 = __esm({
@@ -129396,6 +129574,30 @@ var init_OAuthRefreshTokenEndpointSchema4 = __esm({
   }
 });
 
+// ../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/RedirectUriWithBackupPortsSchema.js
+var RedirectUriWithBackupPortsSchema2;
+var init_RedirectUriWithBackupPortsSchema4 = __esm({
+  "../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/RedirectUriWithBackupPortsSchema.js"() {
+    "use strict";
+    init_core6();
+    RedirectUriWithBackupPortsSchema2 = schemas_exports8.object({
+      url: schemas_exports8.string(),
+      ports: schemas_exports8.list(schemas_exports8.number()).optional()
+    });
+  }
+});
+
+// ../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/RedirectUriSchema.js
+var RedirectUriSchema2;
+var init_RedirectUriSchema4 = __esm({
+  "../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/RedirectUriSchema.js"() {
+    "use strict";
+    init_core6();
+    init_RedirectUriWithBackupPortsSchema4();
+    RedirectUriSchema2 = schemas_exports8.undiscriminatedUnion([schemas_exports8.string(), RedirectUriWithBackupPortsSchema2]);
+  }
+});
+
 // ../configuration/lib/generators-yml/schemas/serialization/resources/fernDefinition/resources/auth/types/OAuthSchemeSchema.js
 var OAuthSchemeSchema2;
 var init_OAuthSchemeSchema4 = __esm({
@@ -129404,18 +129606,32 @@ var init_OAuthSchemeSchema4 = __esm({
     init_core6();
     init_WithDocsSchema4();
     init_AuthScope6();
+    init_OAuthFlowTypeSchema4();
     init_OAuthGetTokenEndpointSchema4();
+    init_OAuthPkceSchema4();
     init_OAuthRefreshTokenEndpointSchema4();
+    init_RedirectUriSchema4();
     OAuthSchemeSchema2 = schemas_exports8.object({
       scheme: schemas_exports8.stringLiteral("oauth"),
-      type: schemas_exports8.stringLiteral("client-credentials"),
+      type: OAuthFlowTypeSchema4,
       scopes: schemas_exports8.list(AuthScope3).optional(),
-      "client-id-env": schemas_exports8.string().optional(),
-      "client-secret-env": schemas_exports8.string().optional(),
       "token-prefix": schemas_exports8.string().optional(),
       "token-header": schemas_exports8.string().optional(),
-      "get-token": OAuthGetTokenEndpointSchema2,
-      "refresh-token": OAuthRefreshTokenEndpointSchema2.optional()
+      "client-id-env": schemas_exports8.string().optional(),
+      "client-secret-env": schemas_exports8.string().optional(),
+      "get-token": OAuthGetTokenEndpointSchema2.optional(),
+      "refresh-token": OAuthRefreshTokenEndpointSchema2.optional(),
+      "client-id": schemas_exports8.string().optional(),
+      "authorization-url": schemas_exports8.string().optional(),
+      "device-authorization-url": schemas_exports8.string().optional(),
+      "token-url": schemas_exports8.string().optional(),
+      "refresh-url": schemas_exports8.string().optional(),
+      "redirect-uri": RedirectUriSchema2.optional(),
+      pkce: OAuthPkceSchema2.optional(),
+      "authorization-parameters": schemas_exports8.record(schemas_exports8.string(), schemas_exports8.string()).optional(),
+      "device-authorization-parameters": schemas_exports8.record(schemas_exports8.string(), schemas_exports8.string()).optional(),
+      "token-parameters": schemas_exports8.record(schemas_exports8.string(), schemas_exports8.string()).optional(),
+      "refresh-parameters": schemas_exports8.record(schemas_exports8.string(), schemas_exports8.string()).optional()
     }).extend(WithDocsSchema2);
   }
 });
@@ -129461,11 +129677,15 @@ var init_types121 = __esm({
     init_InferredGetTokenEndpointSchemaObject4();
     init_OAuthAccessTokenRequestPropertiesSchema4();
     init_OAuthAccessTokenResponsePropertiesSchema4();
+    init_OAuthFlowTypeSchema4();
     init_OAuthGetTokenEndpointSchema4();
+    init_OAuthPkceSchema4();
     init_OAuthRefreshTokenEndpointSchema4();
     init_OAuthRefreshTokenRequestPropertiesSchema4();
     init_OAuthRefreshTokenResponsePropertiesSchema4();
     init_OAuthSchemeSchema4();
+    init_RedirectUriSchema4();
+    init_RedirectUriWithBackupPortsSchema4();
     init_TokenBearerAuthSchema4();
     init_WithEnvironmentVariable4();
   }
@@ -129492,11 +129712,15 @@ __export(auth_exports8, {
   InferredGetTokenEndpointSchemaObject: () => InferredGetTokenEndpointSchemaObject2,
   OAuthAccessTokenRequestPropertiesSchema: () => OAuthAccessTokenRequestPropertiesSchema2,
   OAuthAccessTokenResponsePropertiesSchema: () => OAuthAccessTokenResponsePropertiesSchema2,
+  OAuthFlowTypeSchema: () => OAuthFlowTypeSchema4,
   OAuthGetTokenEndpointSchema: () => OAuthGetTokenEndpointSchema2,
+  OAuthPkceSchema: () => OAuthPkceSchema2,
   OAuthRefreshTokenEndpointSchema: () => OAuthRefreshTokenEndpointSchema2,
   OAuthRefreshTokenRequestPropertiesSchema: () => OAuthRefreshTokenRequestPropertiesSchema2,
   OAuthRefreshTokenResponsePropertiesSchema: () => OAuthRefreshTokenResponsePropertiesSchema2,
   OAuthSchemeSchema: () => OAuthSchemeSchema2,
+  RedirectUriSchema: () => RedirectUriSchema2,
+  RedirectUriWithBackupPortsSchema: () => RedirectUriWithBackupPortsSchema2,
   TokenBearerAuthSchema: () => TokenBearerAuthSchema2,
   WithEnvironmentVariable: () => WithEnvironmentVariable2
 });
@@ -130085,12 +130309,16 @@ __export(fernDefinition_exports2, {
   NumberValidationSchema: () => NumberValidationSchema2,
   OAuthAccessTokenRequestPropertiesSchema: () => OAuthAccessTokenRequestPropertiesSchema2,
   OAuthAccessTokenResponsePropertiesSchema: () => OAuthAccessTokenResponsePropertiesSchema2,
+  OAuthFlowTypeSchema: () => OAuthFlowTypeSchema4,
   OAuthGetTokenEndpointSchema: () => OAuthGetTokenEndpointSchema2,
+  OAuthPkceSchema: () => OAuthPkceSchema2,
   OAuthRefreshTokenEndpointSchema: () => OAuthRefreshTokenEndpointSchema2,
   OAuthRefreshTokenRequestPropertiesSchema: () => OAuthRefreshTokenRequestPropertiesSchema2,
   OAuthRefreshTokenResponsePropertiesSchema: () => OAuthRefreshTokenResponsePropertiesSchema2,
   OAuthSchemeSchema: () => OAuthSchemeSchema2,
   ProtobufTypeSchema: () => ProtobufTypeSchema2,
+  RedirectUriSchema: () => RedirectUriSchema2,
+  RedirectUriWithBackupPortsSchema: () => RedirectUriWithBackupPortsSchema2,
   ServerVariableSchema: () => ServerVariableSchema2,
   SingleBaseUrlEnvironmentSchema: () => SingleBaseUrlEnvironmentSchema2,
   StringValidationSchema: () => StringValidationSchema2,
@@ -274952,13 +275180,17 @@ var init_convertOAuthClientCredentials = __esm({
 
 // ../generation/ir-generator/lib/converters/convertOAuthUtils.js
 function get0AuthTokenEndpoint(oauthSchema) {
+  const getToken3 = oauthSchema["get-token"];
+  if (getToken3 == null) {
+    throw new Error("OAuth client-credentials flow is missing the required `get-token` endpoint");
+  }
   return {
-    endpoint: oauthSchema["get-token"].endpoint,
+    endpoint: getToken3.endpoint,
     requestProperties: getTokenEndpointRequestProperties({
-      requestProperties: oauthSchema["get-token"]?.["request-properties"]
+      requestProperties: getToken3["request-properties"]
     }),
     responseProperties: getTokenEndpointResponseProperties({
-      responseProperties: oauthSchema["get-token"]?.["response-properties"]
+      responseProperties: getToken3["response-properties"]
     })
   };
 }
@@ -275231,6 +275463,43 @@ function generateOAuth({ key: key2, file: file4, docs: docs2, rawScheme, propert
           refreshTokenEndpoint: getRefreshTokenEndpoint(rawScheme)
         }))
       });
+    case "authorization-code":
+      return AuthScheme.oauth({
+        key: key2,
+        docs: docs2,
+        configuration: OAuthConfiguration.authorizationCode({
+          clientId: getPublicClientId(rawScheme),
+          authorizationUrl: requireOAuthField(rawScheme, "authorization-url"),
+          tokenUrl: requireOAuthField(rawScheme, "token-url"),
+          refreshUrl: rawScheme["refresh-url"],
+          redirectUri: getRedirectUri(rawScheme["redirect-uri"]),
+          redirectUriBackupPorts: getRedirectUriBackupPorts(rawScheme["redirect-uri"]),
+          scopes: rawScheme.scopes,
+          pkce: { method: OAuthPkceMethod.S256 },
+          authorizationParameters: rawScheme["authorization-parameters"],
+          tokenParameters: rawScheme["token-parameters"],
+          refreshParameters: rawScheme["refresh-parameters"],
+          tokenHeader: rawScheme["token-header"],
+          tokenPrefix: rawScheme["token-prefix"]
+        })
+      });
+    case "device-code":
+      return AuthScheme.oauth({
+        key: key2,
+        docs: docs2,
+        configuration: OAuthConfiguration.deviceCode({
+          clientId: getPublicClientId(rawScheme),
+          deviceAuthorizationUrl: requireOAuthField(rawScheme, "device-authorization-url"),
+          tokenUrl: requireOAuthField(rawScheme, "token-url"),
+          refreshUrl: rawScheme["refresh-url"],
+          scopes: rawScheme.scopes,
+          deviceAuthorizationParameters: rawScheme["device-authorization-parameters"],
+          tokenParameters: rawScheme["token-parameters"],
+          refreshParameters: rawScheme["refresh-parameters"],
+          tokenHeader: rawScheme["token-header"],
+          tokenPrefix: rawScheme["token-prefix"]
+        })
+      });
     default:
       throw new CliError({
         message: `Unknown OAuth type: '${rawScheme?.type}'`,
@@ -275238,6 +275507,35 @@ function generateOAuth({ key: key2, file: file4, docs: docs2, rawScheme, propert
       });
   }
 }
+function getPublicClientId(rawScheme) {
+  const clientIdEnvVar = rawScheme["client-id-env"];
+  if (rawScheme["client-id"] == null && clientIdEnvVar != null) {
+    return OAuthPublicClientId.environmentVariable(clientIdEnvVar);
+  }
+  return OAuthPublicClientId.literal(rawScheme["client-id"] ?? "");
+}
+function getRedirectUri(redirectUri) {
+  if (redirectUri == null) {
+    return void 0;
+  }
+  return typeof redirectUri === "string" ? redirectUri : redirectUri.url;
+}
+function getRedirectUriBackupPorts(redirectUri) {
+  if (redirectUri == null || typeof redirectUri === "string") {
+    return void 0;
+  }
+  return redirectUri.ports;
+}
+function requireOAuthField(rawScheme, field5) {
+  const value2 = rawScheme[field5];
+  if (typeof value2 !== "string") {
+    throw new CliError({
+      message: `OAuth ${rawScheme.type} flow is missing required field '${field5}'`,
+      code: CliError.Code.ValidationError
+    });
+  }
+  return value2;
+}
 function generateInferredAuth({ key: key2, file: file4, docs: docs2, rawScheme, propertyResolver, endpointResolver }) {
   return AuthScheme.inferred({
     key: key2,
@@ -321601,6 +321899,14 @@ var init_api_yml_schema = __esm({
           }
         ]
       },
+      "auth.OAuthFlowTypeSchema": {
+        type: "string",
+        enum: [
+          "client-credentials",
+          "authorization-code",
+          "device-code"
+        ]
+      },
       "auth.AuthScope": {
         type: "string"
       },
@@ -321800,6 +322106,62 @@ var init_api_yml_schema = __esm({
         ],
         additionalProperties: false
       },
+      "auth.RedirectUriWithBackupPortsSchema": {
+        type: "object",
+        properties: {
+          url: {
+            type: "string",
+            description: "The primary loopback callback URI, e.g. `http://127.0.0.1:8484/callback`."
+          },
+          ports: {
+            oneOf: [
+              {
+                type: "array",
+                items: {
+                  type: "integer"
+                }
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Backup loopback ports, tried in order when the port in `url` is busy. Each reuses the host and path of `url` (only the port differs) and must be pre-registered with the authorization server."
+          }
+        },
+        required: [
+          "url"
+        ],
+        additionalProperties: false,
+        description: "A loopback callback URI with additional backup ports for the authorization-code flow."
+      },
+      "auth.RedirectUriSchema": {
+        anyOf: [
+          {
+            type: "string"
+          },
+          {
+            $ref: "#/definitions/auth.RedirectUriWithBackupPortsSchema"
+          }
+        ]
+      },
+      "auth.OAuthPkceSchema": {
+        type: "object",
+        properties: {
+          method: {
+            oneOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "The PKCE code challenge method. Only 'S256' is supported. Defaults to 'S256'."
+          }
+        },
+        additionalProperties: false,
+        description: "PKCE (RFC 7636) configuration for the authorization-code flow."
+      },
       "auth.OAuthSchemeSchema": {
         type: "object",
         properties: {
@@ -321817,7 +322179,8 @@ var init_api_yml_schema = __esm({
             const: "oauth"
           },
           type: {
-            const: "client-credentials"
+            $ref: "#/definitions/auth.OAuthFlowTypeSchema",
+            description: "The OAuth flow. Defaults to 'client-credentials'."
           },
           scopes: {
             oneOf: [
@@ -321832,7 +322195,7 @@ var init_api_yml_schema = __esm({
               }
             ]
           },
-          "client-id-env": {
+          "token-prefix": {
             oneOf: [
               {
                 type: "string"
@@ -321840,9 +322203,10 @@ var init_api_yml_schema = __esm({
               {
                 type: "null"
               }
-            ]
+            ],
+            description: "Sets the token header value prefix. Defaults to 'Bearer'"
           },
-          "client-secret-env": {
+          "token-header": {
             oneOf: [
               {
                 type: "string"
@@ -321850,9 +322214,10 @@ var init_api_yml_schema = __esm({
               {
                 type: "null"
               }
-            ]
+            ],
+            description: "Sets the token header key name. Defaults to 'Authorization'"
           },
-          "token-prefix": {
+          "client-id-env": {
             oneOf: [
               {
                 type: "string"
@@ -321861,9 +322226,9 @@ var init_api_yml_schema = __esm({
                 type: "null"
               }
             ],
-            description: "Sets the token header value prefix. Defaults to 'Bearer'"
+            description: "The environment variable holding the client ID. Used by the client-credentials flow and, for the public-client flows, as an alternative to a literal `client-id`."
           },
-          "token-header": {
+          "client-secret-env": {
             oneOf: [
               {
                 type: "string"
@@ -321871,11 +322236,18 @@ var init_api_yml_schema = __esm({
               {
                 type: "null"
               }
-            ],
-            description: "Sets the token header key name. Defaults to 'Authorization'"
+            ]
           },
           "get-token": {
-            $ref: "#/definitions/auth.OAuthGetTokenEndpointSchema"
+            oneOf: [
+              {
+                $ref: "#/definitions/auth.OAuthGetTokenEndpointSchema"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "The token endpoint for the client-credentials flow. Required for that flow."
           },
           "refresh-token": {
             oneOf: [
@@ -321886,12 +322258,144 @@ var init_api_yml_schema = __esm({
                 type: "null"
               }
             ]
+          },
+          "client-id": {
+            oneOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "The public client ID (literal). Public clients do not use a client secret. Required for the authorization-code and device-code flows (an environment-variable client ID via `client-id-env` is not yet supported for these flows)."
+          },
+          "authorization-url": {
+            oneOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "The authorization (consent) endpoint URL. Required for the authorization-code flow."
+          },
+          "device-authorization-url": {
+            oneOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "The device authorization endpoint URL. Required for the device-code flow."
+          },
+          "token-url": {
+            oneOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "The token endpoint URL. Required for the authorization-code and device-code flows."
+          },
+          "refresh-url": {
+            oneOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "The token refresh endpoint URL. Defaults to `token-url` when omitted."
+          },
+          "redirect-uri": {
+            oneOf: [
+              {
+                $ref: "#/definitions/auth.RedirectUriSchema"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "The loopback redirect (callback) URI for the authorization-code flow. Must be a loopback host over http \u2014 `127.0.0.1` (recommended, RFC 8252 \xA77.3) or `localhost` \u2014 with any path; the generated CLI binds and sends this URI exactly, so it must match the redirect registered with the authorization server (e.g. `http://127.0.0.1:8484/callback` or `http://localhost:8484/callback`). Provide a bare string to pin a single port, or an object with `url` plus `ports` to add backup ports tried when the primary is busy. Omit it entirely to use an ephemeral (OS-assigned) port."
+          },
+          pkce: {
+            oneOf: [
+              {
+                $ref: "#/definitions/auth.OAuthPkceSchema"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "PKCE configuration for the authorization-code flow. PKCE is always applied for that flow."
+          },
+          "authorization-parameters": {
+            oneOf: [
+              {
+                type: "object",
+                additionalProperties: {
+                  type: "string"
+                }
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Additional literal parameters appended to the authorization request (e.g. `audience`)."
+          },
+          "device-authorization-parameters": {
+            oneOf: [
+              {
+                type: "object",
+                additionalProperties: {
+                  type: "string"
+                }
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Additional literal parameters included in the device authorization request."
+          },
+          "token-parameters": {
+            oneOf: [
+              {
+                type: "object",
+                additionalProperties: {
+                  type: "string"
+                }
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Additional literal parameters included in the token exchange request."
+          },
+          "refresh-parameters": {
+            oneOf: [
+              {
+                type: "object",
+                additionalProperties: {
+                  type: "string"
+                }
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Additional literal parameters included in the refresh request."
           }
         },
         required: [
           "scheme",
-          "type",
-          "get-token"
+          "type"
         ],
         additionalProperties: false
       },
@@ -356455,6 +356959,9 @@ function resolveOAuthScheme({ ir: ir3, key: key2, oauthScheme }) {
     return void 0;
   }
   const tokenEndpointConfig = oauthScheme["get-token"];
+  if (tokenEndpointConfig == null) {
+    return void 0;
+  }
   const resolved = resolveEndpointFromReference({ ir: ir3, endpointRef: tokenEndpointConfig.endpoint });
   if (resolved == null) {
     return void 0;
@@ -682660,6 +683167,17 @@ var ValidOauthRule = {
       rootApiFile: {
         oauth: ({ name: name2, oauth }, { relativeFilepath }) => {
           const violations = [];
+          if (oauth.type === "authorization-code" || oauth.type === "device-code") {
+            return validatePublicClientFlow(oauth);
+          }
+          if (oauth["get-token"] == null) {
+            return [
+              {
+                severity: "fatal",
+                message: "OAuth client-credentials flow requires a `get-token` endpoint."
+              }
+            ];
+          }
           const tokenEndpointReference = oauth["get-token"].endpoint;
           const resolvedTokenEndpoint = endpointResolver.resolveEndpoint({
             endpoint: tokenEndpointReference,
@@ -682706,6 +683224,92 @@ var ValidOauthRule = {
     };
   }
 };
+function validatePublicClientFlow(oauth) {
+  const violations = [];
+  const hasLiteralClientId = oauth["client-id"] != null;
+  const hasEnvClientId = oauth["client-id-env"] != null;
+  if (!hasLiteralClientId && !hasEnvClientId) {
+    violations.push({
+      severity: "fatal",
+      message: `OAuth ${oauth.type} flow requires a public client ID: set \`client-id\`.`
+    });
+  } else if (!hasLiteralClientId && hasEnvClientId) {
+    violations.push({
+      severity: "fatal",
+      message: `OAuth ${oauth.type} flow does not support an environment-variable client ID (\`client-id-env\`) yet; set a literal \`client-id\` instead (public client IDs are not secret).`
+    });
+  }
+  const requireUrl = (field5) => {
+    if (oauth[field5] == null) {
+      violations.push({
+        severity: "fatal",
+        message: `OAuth ${oauth.type} flow requires \`${field5}\`.`
+      });
+    }
+  };
+  requireUrl("token-url");
+  if (oauth.type === "authorization-code") {
+    requireUrl("authorization-url");
+  } else {
+    requireUrl("device-authorization-url");
+  }
+  if (oauth.type === "authorization-code") {
+    const pkceMethod = oauth.pkce?.method;
+    if (pkceMethod != null && pkceMethod !== "S256") {
+      violations.push({
+        severity: "fatal",
+        message: `OAuth PKCE method '${pkceMethod}' is not supported; only 'S256' is allowed.`
+      });
+    }
+    const redirectUri = oauth["redirect-uri"];
+    if (redirectUri != null) {
+      const url3 = typeof redirectUri === "string" ? redirectUri : redirectUri.url;
+      const urlError = validateRedirectUri(url3);
+      if (urlError != null) {
+        violations.push({ severity: "fatal", message: urlError });
+      }
+      if (typeof redirectUri !== "string") {
+        for (const port of redirectUri.ports ?? []) {
+          if (!Number.isInteger(port) || port < 1 || port > 65535) {
+            violations.push({
+              severity: "fatal",
+              message: `OAuth redirect-uri backup port '${port}' is invalid; ports must be integers in 1\u201365535.`
+            });
+          }
+        }
+      }
+    }
+  } else {
+    if (oauth["redirect-uri"] != null) {
+      violations.push({
+        severity: "fatal",
+        message: "OAuth device-code flow has no browser callback; remove `redirect-uri` (it applies only to the authorization-code flow)."
+      });
+    }
+    if (oauth.pkce != null) {
+      violations.push({
+        severity: "fatal",
+        message: "OAuth device-code flow does not use PKCE; remove `pkce` (it applies only to the authorization-code flow)."
+      });
+    }
+  }
+  return violations;
+}
+function validateRedirectUri(redirectUri) {
+  let parsed;
+  try {
+    parsed = new URL(redirectUri);
+  } catch {
+    return `OAuth redirect-uri '${redirectUri}' is not a valid URL. Use http://127.0.0.1:<port>/callback (or http://localhost:<port>/...), or omit it for an ephemeral port.`;
+  }
+  if (parsed.protocol !== "http:" || parsed.hostname !== "127.0.0.1" && parsed.hostname !== "localhost") {
+    return `OAuth redirect-uri '${redirectUri}' must use a loopback host over http (127.0.0.1 or localhost) \u2014 it must match the redirect URI registered with the authorization server. Use e.g. http://127.0.0.1:8484/callback.`;
+  }
+  if (parsed.port === "") {
+    return `OAuth redirect-uri '${redirectUri}' must include a port to pin (e.g. http://127.0.0.1:8484/callback), or omit redirect-uri entirely to use an ephemeral port.`;
+  }
+  return void 0;
+}
 
 // ../fern-definition/validator/lib/rules/valid-pagination/valid-pagination.js
 init_lib22();
@@ -693707,7 +694311,7 @@ var AccessTokenPosthogManager = class {
         properties: {
           ...event,
           ...event.properties,
-          version: "5.87.0",
+          version: "5.88.0",
           usingAccessToken: true,
           ...getRunIdProperties()
         }
@@ -693773,7 +694377,7 @@ var UserPosthogManager = class {
       distinctId: this.userId ?? await this.getPersistedDistinctId(),
       event: "CLI",
       properties: {
-        version: "5.87.0",
+        version: "5.88.0",
         ...event,
         ...event.properties,
         usingAccessToken: false,
@@ -874903,7 +875507,7 @@ var LOCAL_STORAGE_FOLDER4 = ".fern-dev";
 var LOGS_FOLDER_NAME = "logs";
 var MAX_LOGS_DIR_SIZE_BYTES = 100 * 1024 * 1024;
 function getCliSource() {
-  const version7 = "5.87.0";
+  const version7 = "5.88.0";
   return `cli@${version7}`;
 }
 var DebugLogger = class {
@@ -907613,7 +908217,7 @@ var LegacyDocsPublisher = class {
         previewId,
         disableTemplates: void 0,
         skipUpload,
-        cliVersion: "5.87.0",
+        cliVersion: "5.88.0",
         loginCommand: "fern auth login"
       });
       if (taskContext.getResult() === TaskResult.Failure) {
@@ -974488,7 +975092,7 @@ function getAutomationContextFromEnv() {
     config_branch: process.env.FERN_CONFIG_BRANCH,
     config_pr_number: process.env.FERN_CONFIG_PR_NUMBER,
     trigger: process.env.GITHUB_EVENT_NAME,
-    cli_version: "5.87.0"
+    cli_version: "5.88.0"
   };
 }
 function isAutomationMode() {
@@ -975320,7 +975924,7 @@ var CliContext = class _CliContext {
     if (false) {
       this.logger.error("CLI_VERSION is not defined");
     }
-    return "5.87.0";
+    return "5.88.0";
   }
   getCliName() {
     if (false) {

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.87.0",
+  "version": "5.88.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fern-api/fern.git",