@fern-api/generator-cli 0.9.10 → 0.9.11

package/dist/api.d.ts

@@ -499,6 +499,7 @@ declare const consolePipelineLogger: PipelineLogger;
 interface PipelineConfig {
     outputDir: string;
     replay?: ReplayStepConfig;
+    autoVersion?: AutoVersionStepConfig;
     fernignore?: FernignoreStepConfig;
     github?: GithubStepConfig;
     cliVersion?: string;
@@ -508,6 +509,7 @@ interface PipelineConfig {
 interface PipelineContext {
     previousStepResults: {
         replay?: ReplayStepResult;
+        autoVersion?: AutoVersionStepResult;
         fernignore?: FernignoreStepResult;
     };
 }
@@ -516,6 +518,17 @@ interface ReplayStepConfig {
     stageOnly?: boolean;
     skipApplication?: boolean;
 }
+interface AutoVersionStepConfig {
+    enabled: boolean;
+    /** Generator language: typescript | python | java | go | ruby | csharp | php | swift | rust | kotlin */
+    language: string;
+    /** Existing changelog content passed to the AI for context. */
+    priorChangelog?: string;
+    /** Fallback version when no prior generation exists (first run). */
+    baseVersion?: string;
+    /** Fern token used to authorize the FAI (AnalyzeSdkDiff) call. */
+    fernToken: string;
+}
 interface FernignoreStepConfig {
     enabled: boolean;
     customContents?: string;
@@ -555,8 +568,10 @@ interface GithubStepConfig {
         previousGenerationSha: string;
         currentGenerationSha: string;
     };
-    /** When true: separate PRs per generation, no-diff skip, automerge support, run_id in body */
+    /** When true: separate PRs per generation, automerge support, run_id in body */
     automationMode?: boolean;
+    /** When true: skip opening a PR / pushing when the generated output has no diff from the base branch. */
+    skipIfNoDiff?: boolean;
     /** Enable GitHub automerge on the PR (only effective when automationMode && !hasBreakingChanges) */
     autoMerge?: boolean;
     /** Pre-computed: version bump is MAJOR (from --version AUTO AI analysis) */
@@ -570,6 +585,7 @@ interface PipelineResult {
     success: boolean;
     steps: {
         replay?: ReplayStepResult;
+        autoVersion?: AutoVersionStepResult;
         fernignore?: FernignoreStepResult;
         github?: GithubStepResult;
     };
@@ -602,6 +618,24 @@ interface ReplayStepResult extends StepResult {
 interface FernignoreStepResult extends StepResult {
     pathsPreserved?: string[];
 }
+interface AutoVersionStepResult extends StepResult {
+    /** The new version to use (e.g. "1.2.3"). Field name matches fiddle's Java AutoVersionResult DTO. */
+    version?: string;
+    /** Commit subject for the `[fern-autoversion]` commit. */
+    commitMessage?: string;
+    /** User-facing changelog entry appended to changelog.md. */
+    changelogEntry?: string;
+    /** Prior SDK version before this change (e.g. "1.2.2"). */
+    previousVersion?: string;
+    /** The version bump level determined by FAI. */
+    versionBump?: "MAJOR" | "MINOR" | "PATCH" | "NO_CHANGE";
+    /** Structured PR description with Before/After code fences for breaking changes. */
+    prDescription?: string;
+    /** One-sentence justification for WHY the version bump was chosen. */
+    versionBumpReason?: string;
+    /** SHA of the `[fern-autoversion]` commit once it's been made. TS-only; no fiddle counterpart. */
+    commitSha?: string;
+}
 interface GithubStepResult extends StepResult {
     commitSha?: string;
     branchUrl?: string;
@@ -733,4 +767,48 @@ interface ReplayStatusParams {
 }
 declare function replayStatus(params: ReplayStatusParams): StatusResult;
 
-export { type BootstrapLogEntry, type GenerateReadmeParams, type GenerateReadmeToStreamParams, type GenerateReferenceParams, type GenerateReferenceToStreamParams, type GithubPrParams, type GithubPushParams, type GithubReleaseParams, type GithubStepConfig, type GithubStepResult, type PipelineConfig, type PipelineContext, type PipelineLogger, type PipelineResult, PostGenerationPipeline, type ReplayForgetParams, type ReplayInitParams, type ReplayInitResult, type ReplayResolveParams, type ReplayRunParams, type ReplayRunResult, type ReplayStatusParams, type ReplayStepResult, consolePipelineLogger, formatBootstrapSummary, formatReplayPrBody, generateReadme, generateReadmeToStream, generateReference, generateReferenceToStream, githubPr, githubPush, githubRelease, logReplaySummary, replayForget, replayInit, replayResolve, replayRun, replayStatus };
+interface SubmitReplayInitParams {
+    /** Fiddle API origin (e.g. "https://fiddle.buildwithfern.com") */
+    fiddleOrigin: string;
+    /** Fern auth token */
+    fernToken: string;
+    /** GitHub repository (e.g. "owner/repo" or full URL) */
+    githubRepo: string;
+    /** Result from replayInit() */
+    initResult: ReplayInitResult;
+}
+interface SubmitReplayInitResult {
+    /** URL of the PR created by Fiddle */
+    prUrl: string;
+}
+/**
+ * Submits a Replay init lockfile to the Fiddle API for server-side PR creation.
+ *
+ * Extracts owner/repo from the GitHub repository string, posts the lockfile
+ * and related metadata to the Fiddle remote-gen endpoint, and returns the
+ * resulting PR URL.
+ *
+ * This function is shared between CLI v1 and CLI v2 to avoid duplicating
+ * the Fiddle submission logic.
+ */
+declare function submitReplayInit(params: SubmitReplayInitParams): Promise<SubmitReplayInitResult>;
+/**
+ * Parses a GitHub repository string into owner and repo components.
+ * Accepts formats: "owner/repo", "github.com/owner/repo",
+ * "https://github.com/owner/repo", "https://github.com/owner/repo.git"
+ */
+declare function parseOwnerRepo(githubRepo: string): {
+    owner: string;
+    repo: string;
+};
+/**
+ * Error thrown when submitting a Replay init to Fiddle fails.
+ * Consumers can inspect `statusCode` to distinguish between
+ * different failure modes (e.g. 404 = GitHub App not installed).
+ */
+declare class ReplaySubmitError extends Error {
+    readonly statusCode: number | undefined;
+    constructor(message: string, statusCode?: number);
+}
+
+export { type BootstrapLogEntry, type GenerateReadmeParams, type GenerateReadmeToStreamParams, type GenerateReferenceParams, type GenerateReferenceToStreamParams, type GithubPrParams, type GithubPushParams, type GithubReleaseParams, type GithubStepConfig, type GithubStepResult, type PipelineConfig, type PipelineContext, type PipelineLogger, type PipelineResult, PostGenerationPipeline, type ReplayForgetParams, type ReplayInitParams, type ReplayInitResult, type ReplayResolveParams, type ReplayRunParams, type ReplayRunResult, type ReplayStatusParams, type ReplayStepResult, ReplaySubmitError, type SubmitReplayInitParams, type SubmitReplayInitResult, consolePipelineLogger, formatBootstrapSummary, formatReplayPrBody, generateReadme, generateReadmeToStream, generateReference, generateReferenceToStream, githubPr, githubPush, githubRelease, logReplaySummary, parseOwnerRepo, replayForget, replayInit, replayResolve, replayRun, replayStatus, submitReplayInit };

package/dist/api.js

@@ -881,6 +881,7 @@ var require_dist2 = __commonJS({
 var api_exports2 = {};
 __export(api_exports2, {
   PostGenerationPipeline: () => PostGenerationPipeline,
+  ReplaySubmitError: () => ReplaySubmitError,
   consolePipelineLogger: () => consolePipelineLogger,
   formatBootstrapSummary: () => formatBootstrapSummary,
   formatReplayPrBody: () => formatReplayPrBody,
@@ -892,11 +893,13 @@ __export(api_exports2, {
   githubPush: () => githubPush,
   githubRelease: () => githubRelease,
   logReplaySummary: () => logReplaySummary,
+  parseOwnerRepo: () => parseOwnerRepo,
   replayForget: () => replayForget,
   replayInit: () => replayInit,
   replayResolve: () => replayResolve,
   replayRun: () => replayRun,
-  replayStatus: () => replayStatus
+  replayStatus: () => replayStatus,
+  submitReplayInit: () => submitReplayInit
 });
 module.exports = __toCommonJS(api_exports2);
 
@@ -6017,6 +6020,46 @@ var ClonedRepository = class _ClonedRepository {
     const result = await this.git.raw(["rev-parse", "HEAD^{tree}"]);
     return result.trim();
   }
+  async getHeadCommitMessage() {
+    await this.git.cwd(this.clonePath);
+    const result = await this.git.raw(["log", "-1", "--format=%B", "HEAD"]);
+    return result.replace(/\n$/, "");
+  }
+  async getHeadParents() {
+    await this.git.cwd(this.clonePath);
+    const result = await this.git.raw(["rev-list", "--parents", "-n", "1", "HEAD"]);
+    const parts = result.trim().split(/\s+/);
+    return parts.slice(1);
+  }
+  /**
+   * Pushes a specific object (commit SHA) to a remote ref.
+   * Used to upload tree and blob objects to the remote without moving a branch.
+   *
+   * Pass `force: true` when overwriting a ref that may already point to an
+   * unrelated commit (e.g. retrying a temp ref after a local rebase rewrites
+   * history so the new SHA is not a descendant of the previous one).
+   */
+  async pushObjectToRef(localSha, remoteRef, { force = false } = {}) {
+    await this.git.cwd(this.clonePath);
+    const spec = force ? `+${localSha}:${remoteRef}` : `${localSha}:${remoteRef}`;
+    await this.git.raw(["push", "origin", spec]);
+  }
+  /**
+   * Resets the current branch HEAD to the given SHA. After fetching a newly-created remote
+   * signed commit, use this to align the local branch so subsequent operations (tag push,
+   * getHeadSha(), etc.) see the signed SHA.
+   */
+  async resetHardToSha(sha) {
+    await this.git.cwd(this.clonePath);
+    await this.git.raw(["reset", "--hard", sha]);
+  }
+  /**
+   * Rebases the current branch onto the given remote branch (`git pull --rebase origin <branch>`).
+   */
+  async pullWithRebase(branch) {
+    await this.git.cwd(this.clonePath);
+    await this.git.raw(["pull", "origin", branch, "--rebase"]);
+  }
   async getCommitTreeHash(commitSha) {
     await this.git.cwd(this.clonePath);
     const result = await this.git.raw(["rev-parse", `${commitSha}^{tree}`]);
@@ -10024,6 +10067,35 @@ var FERN_BOT_NAME = "fern-api";
 var FERN_BOT_EMAIL = "115122769+fern-api[bot]@users.noreply.github.com";
 var FERN_BOT_LOGIN = "fern-api[bot]";
 
+// src/pipeline/steps/BaseStep.ts
+var BaseStep = class {
+  constructor(outputDir, logger) {
+    this.outputDir = outputDir;
+    this.logger = logger;
+  }
+  outputDir;
+  logger;
+};
+
+// src/pipeline/steps/AutoVersionStep.ts
+var AutoVersionStep = class extends BaseStep {
+  constructor(outputDir, logger, config) {
+    super(outputDir, logger);
+    this.config = config;
+  }
+  config;
+  name = "autoVersion";
+  async execute(_context) {
+    this.logger.info(
+      `AutoVersionStep: no-op scaffold for language=${this.config.language} (logic lands in FER-9980)`
+    );
+    return {
+      executed: true,
+      success: true
+    };
+  }
+};
+
 // src/pipeline/steps/GithubStep.ts
 var import_rest2 = require("@octokit/rest");
 var import_promises2 = require("fs/promises");
@@ -10157,6 +10229,128 @@ ${prBody}`;
   return { prTitle, prBody };
 }
 
+// src/pipeline/github/pushSignedCommit.ts
+var MAX_CONCURRENT_PUSH_RETRIES = 3;
+async function pushSignedCommit({
+  repository,
+  octokit,
+  owner,
+  repo,
+  branch,
+  force,
+  rebaseOnConflict = false,
+  logger
+}) {
+  const tempRef = `refs/temp/fern-${Date.now()}`;
+  let tempRefPushed = false;
+  try {
+    let [localHeadSha, treeSha, message, parents] = await Promise.all([
+      repository.getHeadSha(),
+      repository.getHeadTreeHash(),
+      repository.getHeadCommitMessage(),
+      repository.getHeadParents()
+    ]);
+    await repository.pushObjectToRef(localHeadSha, tempRef);
+    tempRefPushed = true;
+    for (let attempt = 0; attempt < MAX_CONCURRENT_PUSH_RETRIES; attempt++) {
+      const { data: signedCommit } = await octokit.git.createCommit({
+        owner,
+        repo,
+        message,
+        tree: treeSha,
+        parents
+      });
+      const signedSha = signedCommit.sha;
+      try {
+        await upsertBranchRef({ octokit, owner, repo, branch, sha: signedSha, force });
+        logger.debug(`Updated refs/heads/${branch} to signed commit ${signedSha}`);
+        await syncLocalToSignedCommit({ repository, branch, signedSha });
+        return signedSha;
+      } catch (err) {
+        if (!isNonFastForwardError(err) || force || attempt >= MAX_CONCURRENT_PUSH_RETRIES - 1) {
+          throw err;
+        }
+        if (rebaseOnConflict) {
+          logger.warn(
+            `Non-fast-forward on refs/heads/${branch} (attempt ${attempt + 1}/${MAX_CONCURRENT_PUSH_RETRIES}); rebasing locally and retrying.`
+          );
+          await repository.pullWithRebase(branch);
+          [localHeadSha, treeSha, message, parents] = await Promise.all([
+            repository.getHeadSha(),
+            repository.getHeadTreeHash(),
+            repository.getHeadCommitMessage(),
+            repository.getHeadParents()
+          ]);
+          await repository.pushObjectToRef(localHeadSha, tempRef, { force: true });
+        } else {
+          throw err;
+        }
+      }
+    }
+    throw new Error(
+      `Failed to push signed commit to refs/heads/${branch} after ${MAX_CONCURRENT_PUSH_RETRIES} attempts`
+    );
+  } finally {
+    if (tempRefPushed) {
+      try {
+        await octokit.git.deleteRef({ owner, repo, ref: tempRef.replace(/^refs\//, "") });
+      } catch (err) {
+        logger.debug(`Failed to delete temp ref ${tempRef}: ${extractErrorMessage(err)}`);
+      }
+    }
+  }
+}
+async function upsertBranchRef({
+  octokit,
+  owner,
+  repo,
+  branch,
+  sha,
+  force
+}) {
+  try {
+    await octokit.git.updateRef({
+      owner,
+      repo,
+      ref: `heads/${branch}`,
+      sha,
+      force
+    });
+  } catch (err) {
+    if (isNotFoundError(err)) {
+      await octokit.git.createRef({
+        owner,
+        repo,
+        ref: `refs/heads/${branch}`,
+        sha
+      });
+      return;
+    }
+    throw err;
+  }
+}
+async function syncLocalToSignedCommit({
+  repository,
+  branch,
+  signedSha
+}) {
+  await repository.fetch(["origin", branch]);
+  await repository.resetHardToSha(signedSha);
+}
+function hasNumericStatus(err) {
+  return typeof err === "object" && err != null && "status" in err && typeof err.status === "number";
+}
+function isNotFoundError(err) {
+  return hasNumericStatus(err) && err.status === 404;
+}
+function isNonFastForwardError(err) {
+  if (!hasNumericStatus(err) || err.status !== 422) {
+    return false;
+  }
+  const message = extractErrorMessage(err).toLowerCase();
+  return message.includes("not a fast forward") || message.includes("not a fast-forward") || message.includes("update is not a fast forward");
+}
+
 // src/pipeline/replay-summary.ts
 function plural(n, word) {
   return `${n} ${word}${n === 1 ? "" : "s"}`;
@@ -10288,16 +10482,6 @@ function formatReplayPrBody(result, options) {
   return parts.join("\n");
 }
 
-// src/pipeline/steps/BaseStep.ts
-var BaseStep = class {
-  constructor(outputDir, logger) {
-    this.outputDir = outputDir;
-    this.logger = logger;
-  }
-  outputDir;
-  logger;
-};
-
 // src/pipeline/steps/GithubStep.ts
 var GithubStep = class extends BaseStep {
   constructor(outputDir, logger, config) {
@@ -10407,7 +10591,7 @@ var GithubStep = class extends BaseStep {
       await repository.commitAllChanges(finalCommitMessage2);
       this.logger.debug(`Committed changes to local copy of GitHub repository at ${this.outputDir}`);
     }
-    if (this.config.automationMode) {
+    if (shouldCheckNoDiff(this.config)) {
       const noDiff = await repository.treeHashEquals(`origin/${baseBranch}`);
       if (noDiff) {
         this.logger.info("No changes detected after generation \u2014 skipping PR creation");
@@ -10420,11 +10604,15 @@ var GithubStep = class extends BaseStep {
       updatedExistingPr: isUpdatingExistingPR
     };
     if (!this.config.previewMode) {
-      if (isUpdatingExistingPR) {
-        await repository.forcePush();
-      } else {
-        await repository.push();
-      }
+      await pushSignedCommit({
+        repository,
+        octokit,
+        owner,
+        repo,
+        branch: prBranch,
+        force: isUpdatingExistingPR,
+        logger: this.logger
+      });
       const pushedBranch = await repository.getCurrentBranch();
       result.branchUrl = `https://github.com/${this.config.uri}/tree/${pushedBranch}`;
       this.logger.info(`Pushed branch: ${result.branchUrl}`);
@@ -10525,7 +10713,7 @@ var GithubStep = class extends BaseStep {
     const finalCommitMessage = this.config.commitMessage ?? "SDK Generation";
     await repository.commitAllChanges(finalCommitMessage);
     this.logger.debug(`Committed changes to local copy of GitHub repository at ${this.outputDir}`);
-    if (this.config.automationMode) {
+    if (shouldCheckNoDiff(this.config)) {
       const noDiff = await repository.treeHashEquals(`origin/${baseBranch}`);
       if (noDiff) {
         this.logger.info("No changes detected after generation \u2014 skipping push");
@@ -10537,7 +10725,18 @@ var GithubStep = class extends BaseStep {
       success: true
     };
     if (!this.config.previewMode) {
-      await repository.pushWithRebasingRemote();
+      const octokit = new import_rest2.Octokit({ auth: this.config.token });
+      const { owner, repo } = parseRepository(this.config.uri);
+      await pushSignedCommit({
+        repository,
+        octokit,
+        owner,
+        repo,
+        branch: baseBranch,
+        force: false,
+        rebaseOnConflict: true,
+        logger: this.logger
+      });
       const pushedBranch = await repository.getCurrentBranch();
       result.branchUrl = `https://github.com/${this.config.uri}/tree/${pushedBranch}`;
       this.logger.info(`Pushed branch: ${result.branchUrl}`);
@@ -10596,6 +10795,9 @@ _Fern Run ID: \`${config.runId}\`_`;
 function shouldEnableAutomerge(config) {
   return config.automationMode === true && config.autoMerge === true && config.hasBreakingChanges !== true;
 }
+function shouldCheckNoDiff(config) {
+  return config.skipIfNoDiff === true;
+}
 function shouldPushGenerationBaseTag(replayResult) {
   return (replayResult?.patchesWithConflicts ?? 0) > 0;
 }
@@ -10929,6 +11131,9 @@ var PostGenerationPipeline = class {
       );
       config.replay.enabled = false;
     }
+    if (config.autoVersion?.enabled) {
+      this.steps.push(new AutoVersionStep(config.outputDir, this.logger, config.autoVersion));
+    }
     if (config.replay?.enabled) {
       this.steps.push(
         new ReplayStep(
@@ -10969,6 +11174,9 @@ var PostGenerationPipeline = class {
         if (step.name === "replay") {
           result.steps.replay = stepResult;
           pipelineContext.previousStepResults.replay = stepResult;
+        } else if (step.name === "autoVersion") {
+          result.steps.autoVersion = stepResult;
+          pipelineContext.previousStepResults.autoVersion = stepResult;
         } else if (step.name === "fernignore") {
           result.steps.fernignore = stepResult;
         } else if (step.name === "github") {
@@ -11156,9 +11364,66 @@ var import_replay5 = require("@fern-api/replay");
 function replayStatus(params) {
   return (0, import_replay5.status)(params.outputDir);
 }
+
+// src/replay/replay-submit-init.ts
+async function submitReplayInit(params) {
+  const { fiddleOrigin, fernToken, githubRepo, initResult } = params;
+  const { owner, repo } = parseOwnerRepo(githubRepo);
+  const response = await fetch(`${fiddleOrigin}/api/remote-gen/replay/init`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${fernToken}`
+    },
+    body: JSON.stringify({
+      owner,
+      repo,
+      lockfileContents: initResult.lockfileContent,
+      fernignoreEntries: initResult.fernignoreEntries,
+      prBody: initResult.prBody
+    })
+  });
+  if (!response.ok) {
+    if (response.status === 404) {
+      throw new ReplaySubmitError(
+        "The Fern GitHub App is not installed on this repository. Install it at https://github.com/apps/fern-api to enable server-side PR creation.",
+        response.status
+      );
+    }
+    const body = await response.text();
+    throw new ReplaySubmitError(`Failed to create PR via Fern: ${body}`, response.status);
+  }
+  const data = await response.json();
+  if (!isSubmitResponse(data)) {
+    throw new ReplaySubmitError("Unexpected response from Fern: missing prUrl field.");
+  }
+  return { prUrl: data.prUrl };
+}
+function parseOwnerRepo(githubRepo) {
+  const cleaned = githubRepo.replace(/^https?:\/\//, "").replace(/\.git$/, "").replace(/^github\.com\//, "");
+  const parts = cleaned.split("/");
+  const owner = parts[parts.length - 2];
+  const repo = parts[parts.length - 1];
+  if (!owner || !repo) {
+    throw new Error(`Could not parse owner/repo from: ${githubRepo}`);
+  }
+  return { owner, repo };
+}
+var ReplaySubmitError = class extends Error {
+  statusCode;
+  constructor(message, statusCode) {
+    super(message);
+    this.name = "ReplaySubmitError";
+    this.statusCode = statusCode;
+  }
+};
+function isSubmitResponse(data) {
+  return typeof data === "object" && data != null && "prUrl" in data && typeof data.prUrl === "string";
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   PostGenerationPipeline,
+  ReplaySubmitError,
   consolePipelineLogger,
   formatBootstrapSummary,
   formatReplayPrBody,
@@ -11170,9 +11435,11 @@ function replayStatus(params) {
   githubPush,
   githubRelease,
   logReplaySummary,
+  parseOwnerRepo,
   replayForget,
   replayInit,
   replayResolve,
   replayRun,
-  replayStatus
+  replayStatus,
+  submitReplayInit
 });

package/dist/cli.js

@@ -25629,6 +25629,46 @@ var ClonedRepository = class _ClonedRepository {
     const result = await this.git.raw(["rev-parse", "HEAD^{tree}"]);
     return result.trim();
   }
+  async getHeadCommitMessage() {
+    await this.git.cwd(this.clonePath);
+    const result = await this.git.raw(["log", "-1", "--format=%B", "HEAD"]);
+    return result.replace(/\n$/, "");
+  }
+  async getHeadParents() {
+    await this.git.cwd(this.clonePath);
+    const result = await this.git.raw(["rev-list", "--parents", "-n", "1", "HEAD"]);
+    const parts = result.trim().split(/\s+/);
+    return parts.slice(1);
+  }
+  /**
+   * Pushes a specific object (commit SHA) to a remote ref.
+   * Used to upload tree and blob objects to the remote without moving a branch.
+   *
+   * Pass `force: true` when overwriting a ref that may already point to an
+   * unrelated commit (e.g. retrying a temp ref after a local rebase rewrites
+   * history so the new SHA is not a descendant of the previous one).
+   */
+  async pushObjectToRef(localSha, remoteRef, { force = false } = {}) {
+    await this.git.cwd(this.clonePath);
+    const spec = force ? `+${localSha}:${remoteRef}` : `${localSha}:${remoteRef}`;
+    await this.git.raw(["push", "origin", spec]);
+  }
+  /**
+   * Resets the current branch HEAD to the given SHA. After fetching a newly-created remote
+   * signed commit, use this to align the local branch so subsequent operations (tag push,
+   * getHeadSha(), etc.) see the signed SHA.
+   */
+  async resetHardToSha(sha) {
+    await this.git.cwd(this.clonePath);
+    await this.git.raw(["reset", "--hard", sha]);
+  }
+  /**
+   * Rebases the current branch onto the given remote branch (`git pull --rebase origin <branch>`).
+   */
+  async pullWithRebase(branch) {
+    await this.git.cwd(this.clonePath);
+    await this.git.raw(["pull", "origin", branch, "--rebase"]);
+  }
   async getCommitTreeHash(commitSha) {
     await this.git.cwd(this.clonePath);
     const result = await this.git.raw(["rev-parse", `${commitSha}^{tree}`]);
@@ -33456,6 +33496,35 @@ var FERN_BOT_NAME = "fern-api";
 var FERN_BOT_EMAIL = "115122769+fern-api[bot]@users.noreply.github.com";
 var FERN_BOT_LOGIN = "fern-api[bot]";
 
+// src/pipeline/steps/BaseStep.ts
+var BaseStep = class {
+  constructor(outputDir, logger) {
+    this.outputDir = outputDir;
+    this.logger = logger;
+  }
+  outputDir;
+  logger;
+};
+
+// src/pipeline/steps/AutoVersionStep.ts
+var AutoVersionStep = class extends BaseStep {
+  constructor(outputDir, logger, config) {
+    super(outputDir, logger);
+    this.config = config;
+  }
+  config;
+  name = "autoVersion";
+  async execute(_context) {
+    this.logger.info(
+      `AutoVersionStep: no-op scaffold for language=${this.config.language} (logic lands in FER-9980)`
+    );
+    return {
+      executed: true,
+      success: true
+    };
+  }
+};
+
 // src/pipeline/steps/GithubStep.ts
 var import_promises3 = require("fs/promises");
 var import_path7 = require("path");
@@ -33588,6 +33657,128 @@ ${prBody}`;
   return { prTitle, prBody };
 }
 
+// src/pipeline/github/pushSignedCommit.ts
+var MAX_CONCURRENT_PUSH_RETRIES = 3;
+async function pushSignedCommit({
+  repository,
+  octokit,
+  owner,
+  repo,
+  branch,
+  force,
+  rebaseOnConflict = false,
+  logger
+}) {
+  const tempRef = `refs/temp/fern-${Date.now()}`;
+  let tempRefPushed = false;
+  try {
+    let [localHeadSha, treeSha, message, parents] = await Promise.all([
+      repository.getHeadSha(),
+      repository.getHeadTreeHash(),
+      repository.getHeadCommitMessage(),
+      repository.getHeadParents()
+    ]);
+    await repository.pushObjectToRef(localHeadSha, tempRef);
+    tempRefPushed = true;
+    for (let attempt2 = 0; attempt2 < MAX_CONCURRENT_PUSH_RETRIES; attempt2++) {
+      const { data: signedCommit } = await octokit.git.createCommit({
+        owner,
+        repo,
+        message,
+        tree: treeSha,
+        parents
+      });
+      const signedSha = signedCommit.sha;
+      try {
+        await upsertBranchRef({ octokit, owner, repo, branch, sha: signedSha, force });
+        logger.debug(`Updated refs/heads/${branch} to signed commit ${signedSha}`);
+        await syncLocalToSignedCommit({ repository, branch, signedSha });
+        return signedSha;
+      } catch (err) {
+        if (!isNonFastForwardError(err) || force || attempt2 >= MAX_CONCURRENT_PUSH_RETRIES - 1) {
+          throw err;
+        }
+        if (rebaseOnConflict) {
+          logger.warn(
+            `Non-fast-forward on refs/heads/${branch} (attempt ${attempt2 + 1}/${MAX_CONCURRENT_PUSH_RETRIES}); rebasing locally and retrying.`
+          );
+          await repository.pullWithRebase(branch);
+          [localHeadSha, treeSha, message, parents] = await Promise.all([
+            repository.getHeadSha(),
+            repository.getHeadTreeHash(),
+            repository.getHeadCommitMessage(),
+            repository.getHeadParents()
+          ]);
+          await repository.pushObjectToRef(localHeadSha, tempRef, { force: true });
+        } else {
+          throw err;
+        }
+      }
+    }
+    throw new Error(
+      `Failed to push signed commit to refs/heads/${branch} after ${MAX_CONCURRENT_PUSH_RETRIES} attempts`
+    );
+  } finally {
+    if (tempRefPushed) {
+      try {
+        await octokit.git.deleteRef({ owner, repo, ref: tempRef.replace(/^refs\//, "") });
+      } catch (err) {
+        logger.debug(`Failed to delete temp ref ${tempRef}: ${extractErrorMessage(err)}`);
+      }
+    }
+  }
+}
+async function upsertBranchRef({
+  octokit,
+  owner,
+  repo,
+  branch,
+  sha,
+  force
+}) {
+  try {
+    await octokit.git.updateRef({
+      owner,
+      repo,
+      ref: `heads/${branch}`,
+      sha,
+      force
+    });
+  } catch (err) {
+    if (isNotFoundError(err)) {
+      await octokit.git.createRef({
+        owner,
+        repo,
+        ref: `refs/heads/${branch}`,
+        sha
+      });
+      return;
+    }
+    throw err;
+  }
+}
+async function syncLocalToSignedCommit({
+  repository,
+  branch,
+  signedSha
+}) {
+  await repository.fetch(["origin", branch]);
+  await repository.resetHardToSha(signedSha);
+}
+function hasNumericStatus(err) {
+  return typeof err === "object" && err != null && "status" in err && typeof err.status === "number";
+}
+function isNotFoundError(err) {
+  return hasNumericStatus(err) && err.status === 404;
+}
+function isNonFastForwardError(err) {
+  if (!hasNumericStatus(err) || err.status !== 422) {
+    return false;
+  }
+  const message = extractErrorMessage(err).toLowerCase();
+  return message.includes("not a fast forward") || message.includes("not a fast-forward") || message.includes("update is not a fast forward");
+}
+
 // src/pipeline/replay-summary.ts
 function plural(n, word) {
   return `${n} ${word}${n === 1 ? "" : "s"}`;
@@ -33683,16 +33874,6 @@ function formatReplayPrBody(result, options) {
   return parts.join("\n");
 }
 
-// src/pipeline/steps/BaseStep.ts
-var BaseStep = class {
-  constructor(outputDir, logger) {
-    this.outputDir = outputDir;
-    this.logger = logger;
-  }
-  outputDir;
-  logger;
-};
-
 // src/pipeline/steps/GithubStep.ts
 var GithubStep = class extends BaseStep {
   constructor(outputDir, logger, config) {
@@ -33802,7 +33983,7 @@ var GithubStep = class extends BaseStep {
       await repository.commitAllChanges(finalCommitMessage2);
       this.logger.debug(`Committed changes to local copy of GitHub repository at ${this.outputDir}`);
     }
-    if (this.config.automationMode) {
+    if (shouldCheckNoDiff(this.config)) {
       const noDiff = await repository.treeHashEquals(`origin/${baseBranch}`);
       if (noDiff) {
         this.logger.info("No changes detected after generation \u2014 skipping PR creation");
@@ -33815,11 +33996,15 @@ var GithubStep = class extends BaseStep {
       updatedExistingPr: isUpdatingExistingPR
     };
     if (!this.config.previewMode) {
-      if (isUpdatingExistingPR) {
-        await repository.forcePush();
-      } else {
-        await repository.push();
-      }
+      await pushSignedCommit({
+        repository,
+        octokit,
+        owner,
+        repo,
+        branch: prBranch,
+        force: isUpdatingExistingPR,
+        logger: this.logger
+      });
       const pushedBranch = await repository.getCurrentBranch();
       result.branchUrl = `https://github.com/${this.config.uri}/tree/${pushedBranch}`;
       this.logger.info(`Pushed branch: ${result.branchUrl}`);
@@ -33920,7 +34105,7 @@ var GithubStep = class extends BaseStep {
     const finalCommitMessage = this.config.commitMessage ?? "SDK Generation";
     await repository.commitAllChanges(finalCommitMessage);
     this.logger.debug(`Committed changes to local copy of GitHub repository at ${this.outputDir}`);
-    if (this.config.automationMode) {
+    if (shouldCheckNoDiff(this.config)) {
       const noDiff = await repository.treeHashEquals(`origin/${baseBranch}`);
       if (noDiff) {
         this.logger.info("No changes detected after generation \u2014 skipping push");
@@ -33932,7 +34117,18 @@ var GithubStep = class extends BaseStep {
       success: true
     };
     if (!this.config.previewMode) {
-      await repository.pushWithRebasingRemote();
+      const octokit = new Octokit2({ auth: this.config.token });
+      const { owner, repo } = parseRepository(this.config.uri);
+      await pushSignedCommit({
+        repository,
+        octokit,
+        owner,
+        repo,
+        branch: baseBranch,
+        force: false,
+        rebaseOnConflict: true,
+        logger: this.logger
+      });
       const pushedBranch = await repository.getCurrentBranch();
       result.branchUrl = `https://github.com/${this.config.uri}/tree/${pushedBranch}`;
       this.logger.info(`Pushed branch: ${result.branchUrl}`);
@@ -33991,6 +34187,9 @@ _Fern Run ID: \`${config.runId}\`_`;
 function shouldEnableAutomerge(config) {
   return config.automationMode === true && config.autoMerge === true && config.hasBreakingChanges !== true;
 }
+function shouldCheckNoDiff(config) {
+  return config.skipIfNoDiff === true;
+}
 function shouldPushGenerationBaseTag(replayResult) {
   return (replayResult?.patchesWithConflicts ?? 0) > 0;
 }
@@ -34324,6 +34523,9 @@ var PostGenerationPipeline = class {
       );
       config.replay.enabled = false;
     }
+    if (config.autoVersion?.enabled) {
+      this.steps.push(new AutoVersionStep(config.outputDir, this.logger, config.autoVersion));
+    }
     if (config.replay?.enabled) {
       this.steps.push(
         new ReplayStep(
@@ -34364,6 +34566,9 @@ var PostGenerationPipeline = class {
         if (step.name === "replay") {
           result.steps.replay = stepResult;
           pipelineContext.previousStepResults.replay = stepResult;
+        } else if (step.name === "autoVersion") {
+          result.steps.autoVersion = stepResult;
+          pipelineContext.previousStepResults.autoVersion = stepResult;
         } else if (step.name === "fernignore") {
           result.steps.fernignore = stepResult;
         } else if (step.name === "github") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fern-api/generator-cli",
-  "version": "0.9.10",
+  "version": "0.9.11",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fern-api/fern.git",