@postman/sdk-config 0.10.1 → 0.11.0

package/dist/sdk-config/v1/index.cjs

@@ -33,7 +33,7 @@ var jsonValueSchema = zod.z.lazy(
     zod.z.record(zod.z.string(), jsonValueSchema)
   ])
 );
-zod.z.record(zod.z.string(), jsonValueSchema);
+var jsonObjectSchema = zod.z.record(zod.z.string(), jsonValueSchema);
 var hashAlgorithmSchema = zod.z.enum(["sha1", "sha256", "sha384", "sha512"]);
 var encodingSchema = zod.z.enum(["base64", "hex"]);
 var payloadComponentSchema = zod.z.enum(["body", "timestamp", "notification-url", "message-id"]);
@@ -131,13 +131,21 @@ var oauthScopeSchema = zod.z.strictObject({
   name: nonEmptyStringSchema.describe("The OAuth scope value requested from the provider."),
   description: zod.z.string().optional().describe("A description of the OAuth scope included in generated SDK documentation.")
 });
+var publicClientIdSchema = nonEmptyStringSchema.refine((value) => value.trim() === value, {
+  message: "must not have leading or trailing whitespace"
+}).refine((value) => !value.includes("${"), {
+  message: "must be a literal public client ID, not an environment expression"
+});
 var oauthFlowSchema = zod.z.discriminatedUnion("type", [
   zod.z.strictObject({
     type: zod.z.literal("authorization-code").describe("Uses the OAuth authorization code flow."),
     authorizationUrl: nonEmptyStringSchema.describe("The URL used to authorize the client."),
     tokenUrl: nonEmptyStringSchema.describe("The URL used to exchange a code for tokens."),
     refreshUrl: nonEmptyStringSchema.optional().describe("The URL used to refresh access tokens."),
-    scopes: zod.z.array(oauthScopeSchema).optional().describe("The scopes supported by this flow.")
+    scopes: zod.z.array(oauthScopeSchema).optional().describe("The scopes supported by this flow."),
+    clientId: publicClientIdSchema.optional().describe(
+      "The public, non-secret OAuth client ID that generated interactive login flows, such as CLI browser login with PKCE, send to the authorization and token endpoints. It is embedded verbatim in generated code, so it must never be a client secret."
+    )
   }),
   zod.z.strictObject({
     type: zod.z.literal("client-credentials").describe("Uses the OAuth client credentials flow."),
@@ -453,8 +461,102 @@ var packageConfigSchema = zod.z.strictObject({
   projectUrls: zod.z.array(projectUrlSchema).optional().describe("Labeled project links for package metadata."),
   extraDependencies: zod.z.array(dependencySchema).optional().describe("Additional runtime dependencies added to the generated package."),
   extraDevDependencies: zod.z.array(dependencySchema).optional().describe("Additional development dependencies added to the generated package."),
-  extraPeerDependencies: zod.z.array(dependencySchema).optional().describe("Additional peer dependencies added to the generated package.")
+  extraPeerDependencies: zod.z.array(dependencySchema).optional().describe("Additional peer dependencies added to the generated package."),
+  extraPeerDependenciesMeta: zod.z.record(nonEmptyStringSchema, jsonObjectSchema).optional().describe(
+    "npm peerDependenciesMeta entries keyed by peer dependency name, such as { optional: true }."
+  )
+});
+var GITHUB_ACTIONS_SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+var GITHUB_REPOSITORY_SLUG_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+var HOMEBREW_FORMULA_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+var githubActionsSecretNameSchema = zod.z.string({ error: "must be the name of a GitHub Actions secret" }).regex(GITHUB_ACTIONS_SECRET_NAME_PATTERN, {
+  error: "must be the name of a GitHub Actions secret: start with an uppercase letter and contain only A-Z, 0-9, or _. Secret values and ${...} expressions are not accepted."
+}).refine((value) => value !== "GITHUB_TOKEN", {
+  error: "GITHUB_TOKEN cannot be used: it is the workflow's built-in token, scoped to the generated repository. Store the credential under a different secret name."
+});
+var githubRepositorySlugSchema = zod.z.string({ error: 'must be a GitHub repository in "<owner>/<repo>" form' }).regex(GITHUB_REPOSITORY_SLUG_PATTERN, {
+  error: 'must be a GitHub repository in "<owner>/<repo>" form, for example "acme/homebrew-tap"'
+});
+var homebrewFormulaNameSchema = zod.z.string({ error: "must be a Homebrew formula name" }).regex(HOMEBREW_FORMULA_NAME_PATTERN, {
+  error: "must be a Homebrew formula name: start with a lowercase letter and contain only a-z, 0-9, or -"
 });
+var cliDistributionGithubAppSchema = zod.z.strictObject({
+  appIdSecretName: githubActionsSecretNameSchema.describe(
+    "The name of the GitHub Actions secret holding the GitHub App ID or client ID."
+  ),
+  privateKeySecretName: githubActionsSecretNameSchema.describe(
+    "The name of the GitHub Actions secret holding the GitHub App private key in PEM form."
+  )
+});
+var channelTokenSecretNameDescription = "The name of the GitHub Actions secret holding a token with write access to the channel repository. Takes precedence over githubApp for this channel.";
+var cliDistributionHomebrewSchema = zod.z.strictObject({
+  tap: githubRepositorySlugSchema.describe(
+    'The Homebrew tap repository in "<owner>/<repo>" form that receives the formula.'
+  ),
+  formula: homebrewFormulaNameSchema.optional().describe("The Homebrew formula name; the generator defaults it to the CLI binary name."),
+  tokenSecretName: githubActionsSecretNameSchema.optional().describe(channelTokenSecretNameDescription)
+});
+var cliDistributionScoopSchema = zod.z.strictObject({
+  bucket: githubRepositorySlugSchema.describe(
+    'The Scoop bucket repository in "<owner>/<repo>" form that receives the manifest.'
+  ),
+  tokenSecretName: githubActionsSecretNameSchema.optional().describe(channelTokenSecretNameDescription)
+});
+var cliDistributionConfigSchema = zod.z.strictObject({
+  githubApp: cliDistributionGithubAppSchema.optional().describe(
+    "A GitHub App used to mint short-lived tokens for every channel without its own tokenSecretName."
+  ),
+  homebrew: cliDistributionHomebrewSchema.optional().describe("Publishes a Homebrew formula to a tap repository on each tagged release."),
+  scoop: cliDistributionScoopSchema.optional().describe("Publishes a Scoop manifest to a bucket repository on each tagged release.")
+}).superRefine((distribution, context) => {
+  if (distribution.homebrew !== void 0 || distribution.scoop !== void 0) {
+    return;
+  }
+  if (distribution.githubApp !== void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "githubApp requires at least one distribution channel: homebrew or scoop",
+      path: ["githubApp"]
+    });
+    return;
+  }
+  context.addIssue({
+    code: "custom",
+    message: "distribution must configure at least one channel: homebrew or scoop"
+  });
+});
+var CLI_DISTRIBUTION_REQUIRES_GITHUB_DELIVERY_MESSAGE = 'distribution requires output.delivery "github": Homebrew and Scoop publish from a tagged GitHub Release produced by the generated release workflow. Set delivery to "github" or remove distribution.';
+var CLI_PUBLISH_REQUIRES_GITHUB_DELIVERY_MESSAGE = 'package publication for target language "cli" requires output.delivery "github": the CLI generator publishes npm packages only from its generated GitHub workflow.';
+var CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE";
+var nonReleaseGithubModes = /* @__PURE__ */ new Set(["pull-request", "push", "commit"]);
+function cliDistributionModeDiagnostic(output, outputPath) {
+  const mode = output?.github?.mode;
+  if (output?.distribution === void 0 || mode === void 0 || !nonReleaseGithubModes.has(mode)) {
+    return void 0;
+  }
+  return {
+    code: CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE,
+    severity: "warning",
+    path: [...outputPath, "github", "mode"],
+    reason: `GitHub mode "${mode}" does not create a release tag, so Homebrew and Scoop publish only after a semantic-version tag is pushed to the repository.`,
+    suggestedAction: 'Use mode "release" or "commit-and-release", or push a version tag after merging generated changes.'
+  };
+}
+
+// src/sdk-config/v1/diagnostics.ts
+function getSdkConfigV1Diagnostics(config) {
+  return config.targets.flatMap((target, targetIndex) => {
+    if (target.language !== "cli") {
+      return [];
+    }
+    const diagnostic = cliDistributionModeDiagnostic(target.output, [
+      "targets",
+      targetIndex,
+      "output"
+    ]);
+    return diagnostic ? [diagnostic] : [];
+  });
+}
 var httpMethodSchema = zod.z.enum([
   "GET",
   "POST",
@@ -659,6 +761,17 @@ function stringValue(value) {
 function stringArrayValue(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string" && item.length > 0) ? value : void 0;
 }
+var canonicalLicenseTypes = {
+  mit: "MIT",
+  apache: "APACHE",
+  "apache-2.0": "APACHE",
+  "gpl-3.0": "GPL3",
+  "gpl-3.0-only": "GPL3",
+  unlicensed: "UNLICENSED"
+};
+function canonicalLicenseType(value) {
+  return canonicalLicenseTypes[value.trim().toLowerCase()];
+}
 function stableJson(value) {
   return JSON.stringify(sortKeys(value));
 }
@@ -669,6 +782,280 @@ function sortKeys(value) {
     Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key, sortKeys(child)])
   );
 }
+var ALPHANUMERIC_PATTERN = /[A-Za-z0-9]/;
+var ROOT_GROUP_PATTERN = /^[a-z][a-z0-9_-]*$/;
+var KEBAB_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+var DOTTED_COMMAND_PATH_PATTERN = /^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/;
+var FIELD_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+var RESERVED_USER_AGENT_SUFFIX_FLAGS = /* @__PURE__ */ new Set([
+  "params",
+  "output",
+  "json",
+  "format",
+  "dry-run",
+  "base-url",
+  "page-all",
+  "page-limit",
+  "page-delay",
+  "no-pager",
+  "no-extract",
+  "no-retry",
+  "no-stream",
+  "quiet",
+  "query",
+  "help",
+  "debug",
+  "schema"
+]);
+var RESERVED_PROFILES_COMMAND_NAMES = /* @__PURE__ */ new Set([
+  "auth",
+  "completion",
+  "man",
+  "errors",
+  "generate-skills",
+  "help"
+]);
+var binaryNameSchema = nonEmptyStringSchema.regex(ALPHANUMERIC_PATTERN, {
+  message: "binaryName must contain at least one ASCII letter or digit"
+});
+var rootGroupSchema = zod.z.string().regex(ROOT_GROUP_PATTERN, {
+  message: "rootGroup must start with a lowercase letter and contain only lowercase letters, digits, hyphens, and underscores"
+});
+var userAgentSuffixFlagSchema = zod.z.string().superRefine((value, context) => {
+  if (value.startsWith("-")) {
+    context.addIssue({
+      code: "custom",
+      message: 'userAgentSuffixFlag must be the long flag name without the leading "--"'
+    });
+  } else if (!KEBAB_NAME_PATTERN.test(value)) {
+    context.addIssue({
+      code: "custom",
+      message: "userAgentSuffixFlag must start with a lowercase letter and contain only lowercase letters, digits, and hyphens"
+    });
+  } else if (RESERVED_USER_AGENT_SUFFIX_FLAGS.has(value)) {
+    context.addIssue({
+      code: "custom",
+      message: `userAgentSuffixFlag "${value}" collides with a built-in global flag`
+    });
+  }
+});
+var profilesCommandNameSchema = zod.z.string().superRefine((value, context) => {
+  if (!KEBAB_NAME_PATTERN.test(value)) {
+    context.addIssue({
+      code: "custom",
+      message: "profiles.commandName must start with a lowercase letter and contain only lowercase letters, digits, and hyphens"
+    });
+  } else if (RESERVED_PROFILES_COMMAND_NAMES.has(value)) {
+    context.addIssue({
+      code: "custom",
+      message: `profiles.commandName "${value}" collides with a built-in command group`
+    });
+  }
+});
+function dottedCommandPathSchema(field) {
+  return zod.z.string().regex(DOTTED_COMMAND_PATH_PATTERN, {
+    message: `${field} must be a dotted command path such as "iam.keys.create"`
+  });
+}
+function fieldNameMapSchema(field) {
+  const message = `${field} keys and values must be field names containing only [A-Za-z0-9_.-]`;
+  return zod.z.record(zod.z.string(), zod.z.string().regex(FIELD_NAME_PATTERN, { message })).superRefine((value, context) => {
+    for (const key of Object.keys(value)) {
+      if (!FIELD_NAME_PATTERN.test(key)) {
+        context.addIssue({ code: "custom", message, path: [key] });
+      }
+    }
+  });
+}
+var profilesProvisionOperationSchema = zod.z.strictObject({
+  operation: dottedCommandPathSchema("profiles.provisionOperation.operation").describe(
+    "The dotted command path of the operation that mints a profile credential."
+  ),
+  credential: fieldNameMapSchema("profiles.provisionOperation.credential").refine((value) => Object.keys(value).length > 0, {
+    message: "profiles.provisionOperation.credential must map at least one credential field"
+  }).describe("Maps each stored credential field to the response field that supplies it."),
+  revokeParameters: fieldNameMapSchema("profiles.provisionOperation.revokeParameters").optional().describe("Maps each revoke-operation parameter to the response field that supplies it.")
+});
+var profilesConfigSchema = zod.z.strictObject({
+  enabled: zod.z.boolean().describe("Whether the CLI emits profile commands and the global --profile flag."),
+  commandName: profilesCommandNameSchema.optional().describe('The profile command group name. The generator defaults to "profiles".'),
+  revokeOperation: dottedCommandPathSchema("profiles.revokeOperation").optional().describe('The dotted command path called by "profiles remove --revoke".'),
+  provisionOperation: profilesProvisionOperationSchema.optional().describe('The operation called by "profiles create --provision" and its response mapping.')
+});
+var cliGenerationConfigSchema = zod.z.strictObject({
+  paginationParameters: zod.z.array(nonEmptyStringSchema).optional().describe("Request parameter names treated as pagination controls by the CLI."),
+  skills: zod.z.boolean().optional().describe("Whether the generated CLI includes skills that teach AI agents to invoke commands."),
+  binaryName: binaryNameSchema.optional().describe(
+    "The CLI executable name. The generator kebab-cases it and also uses it for the source directory and env-var prefix."
+  ),
+  customCommands: zod.z.boolean().optional().describe("Whether hand-written command support is generated. The generator defaults to true."),
+  rootGroup: rootGroupSchema.optional().describe("A command group that every spec-derived command is nested under."),
+  profiles: profilesConfigSchema.optional().describe("Named profile command configuration."),
+  splitTypeCrates: zod.z.boolean().optional().describe("Whether generated types are split into one crate per API behind a facade crate."),
+  userAgentSuffixFlag: userAgentSuffixFlagSchema.optional().describe('The long flag name, without "--", that appends a product token to the User-Agent.')
+});
+
+// src/sdk-config/v1/fern-config-mapper-cli.ts
+var CLI_GENERATION_FIELDS = [
+  "binaryName",
+  "customCommands",
+  "rootGroup",
+  "profiles",
+  "splitTypeCrates",
+  "userAgentSuffixFlag"
+];
+var PROFILES_FIELDS = ["enabled", "commandName", "revokeOperation"];
+var PROVISION_OPERATION_FIELDS = ["operation", "credential", "revokeParameters"];
+function mapCliGeneration(config, state, basePath, targetIndex) {
+  const generation = {};
+  for (const field of CLI_GENERATION_FIELDS) {
+    const raw = ownValue(config, field);
+    if (raw === void 0) continue;
+    const fieldPath = [...basePath, field];
+    const { value, consumedPaths } = field === "profiles" && isObject(raw) ? pickProfiles(raw, fieldPath) : { value: raw, consumedPaths: [fieldPath] };
+    const parsed = cliGenerationConfigSchema.shape[field].safeParse(value);
+    consumedPaths.forEach((path) => consume(state, path));
+    if (parsed.success) {
+      generation[field] = structuredClone(value);
+      continue;
+    }
+    const diagnostics = parsed.error.issues.map(
+      (issue) => invalidValueDiagnostic(field, fieldPath, issue.path, issue.message, targetIndex)
+    );
+    (state.valueDiagnostics ??= []).push(...diagnostics);
+  }
+  return generation;
+}
+function pickProfiles(profiles, path) {
+  const picked = pickKnown(profiles, PROFILES_FIELDS, path);
+  const provisionOperation = ownValue(profiles, "provisionOperation");
+  const provisionPath = [...path, "provisionOperation"];
+  if (isObject(provisionOperation)) {
+    const provision = pickKnown(provisionOperation, PROVISION_OPERATION_FIELDS, provisionPath);
+    picked.value.provisionOperation = provision.value;
+    picked.consumedPaths.push(...provision.consumedPaths);
+  } else if (provisionOperation !== void 0) {
+    picked.value.provisionOperation = provisionOperation;
+    picked.consumedPaths.push(provisionPath);
+  }
+  return { value: { enabled: false, ...picked.value }, consumedPaths: picked.consumedPaths };
+}
+function pickKnown(value, fields, path) {
+  const picked = {};
+  const consumedPaths = [];
+  for (const field of fields) {
+    const child = ownValue(value, field);
+    if (child === void 0) continue;
+    picked[field] = child;
+    consumedPaths.push([...path, field]);
+  }
+  return { value: picked, consumedPaths };
+}
+function ownValue(value, key) {
+  return Object.hasOwn(value, key) ? value[key] : void 0;
+}
+function invalidValueDiagnostic(field, fieldPath, issuePath, message, targetIndex) {
+  const relative = issuePath.map((part) => typeof part === "symbol" ? String(part) : part);
+  const sdkConfigField = ["targets", targetIndex, "generation", field];
+  return {
+    code: "FERN_CONFIG_VALUE_INVALID",
+    severity: "warning",
+    path: [...fieldPath, ...relative],
+    reason: `CLI setting ${field} was not migrated because SDK Config rejects it: ${message}`,
+    sdkConfigPath: [...sdkConfigField, ...relative],
+    suggestedAction: `Correct the value, then set ${sdkConfigField.join(".")} manually.`
+  };
+}
+
+// src/sdk-config/v1/fern-config-mapper-cli-distribution.ts
+var DISTRIBUTION_KEYS = {
+  githubApp: { appIdSecret: "appIdSecretName", privateKeySecret: "privateKeySecretName" },
+  homebrew: { tap: "tap", formula: "formula", tokenEnvironmentVariable: "tokenSecretName" },
+  scoop: { bucket: "bucket", tokenEnvironmentVariable: "tokenSecretName" }
+};
+function mapCliDistribution(config, state, basePath, targetIndex) {
+  if (!Object.hasOwn(config, "distribution")) return;
+  const raw = config.distribution;
+  const path = [...basePath, "distribution"];
+  const translated = isObject(raw) ? translateDistribution(raw, path) : { value: raw, consumedPaths: [path], legacyKeys: /* @__PURE__ */ new Map() };
+  const parsed = cliDistributionConfigSchema.safeParse(translated.value);
+  translated.consumedPaths.forEach((consumedPath) => consume(state, consumedPath));
+  if (parsed.success) {
+    state.cliDistribution = { value: parsed.data, path };
+    return;
+  }
+  const diagnostics = parsed.error.issues.map(
+    (issue) => invalidDistributionDiagnostic(issue, path, translated.legacyKeys, targetIndex)
+  );
+  const reportedPaths = /* @__PURE__ */ new Set();
+  (state.valueDiagnostics ??= []).push(
+    ...diagnostics.filter(({ path: diagnosticPath }) => {
+      const key = diagnosticPath.join(".");
+      if (reportedPaths.has(key)) return false;
+      reportedPaths.add(key);
+      return true;
+    })
+  );
+}
+function translateDistribution(distribution, path) {
+  const value = {};
+  const consumedPaths = [];
+  const legacyKeys = /* @__PURE__ */ new Map();
+  for (const [block, keys] of Object.entries(DISTRIBUTION_KEYS)) {
+    if (!Object.hasOwn(distribution, block)) continue;
+    const blockValue = distribution[block];
+    const blockPath = [...path, block];
+    if (!isObject(blockValue)) {
+      value[block] = blockValue;
+      consumedPaths.push(blockPath);
+      continue;
+    }
+    const translatedBlock = {};
+    for (const [legacyKey, sdkConfigKey] of Object.entries(keys)) {
+      if (!Object.hasOwn(blockValue, legacyKey)) continue;
+      translatedBlock[sdkConfigKey] = blockValue[legacyKey];
+      consumedPaths.push([...blockPath, legacyKey]);
+      legacyKeys.set(`${block}.${sdkConfigKey}`, legacyKey);
+    }
+    value[block] = translatedBlock;
+  }
+  return { value, consumedPaths, legacyKeys };
+}
+function invalidDistributionDiagnostic(issue, path, legacyKeys, targetIndex) {
+  const relative = issue.path.map((part) => typeof part === "symbol" ? String(part) : part);
+  const [block, field] = relative;
+  const legacyField = typeof block === "string" && typeof field === "string" ? legacyKeys.get(`${block}.${field}`) : void 0;
+  const legacyRelative = typeof block === "string" && legacyField !== void 0 ? [block, legacyField] : relative;
+  const sdkConfigField = ["targets", targetIndex, "output", "distribution"];
+  return {
+    code: "FERN_CONFIG_VALUE_INVALID",
+    severity: "warning",
+    path: [...path, ...legacyRelative],
+    reason: `CLI distribution was not migrated because SDK Config rejects it: ${issue.message}`,
+    sdkConfigPath: [...sdkConfigField, ...relative],
+    suggestedAction: `Correct the value, then set ${sdkConfigField.join(".")} manually.`
+  };
+}
+function applyCliDistribution(output, pending, targetIndex) {
+  if (pending === void 0) return { output, diagnostics: [] };
+  if (output.delivery === "github") {
+    return { output: { ...output, distribution: pending.value }, diagnostics: [] };
+  }
+  const outputPath = ["targets", targetIndex, "output"];
+  return {
+    output,
+    diagnostics: [
+      {
+        code: "FERN_CLI_DISTRIBUTION_REQUIRES_GITHUB_OUTPUT",
+        severity: "warning",
+        path: pending.path,
+        reason: `The CLI generator ignores distribution for "${output.delivery}" output, and SDK Config accepts distribution only with output.delivery "github", so it was not migrated`,
+        sdkConfigPath: [...outputPath, "distribution"],
+        suggestedAction: `Set ${outputPath.join(".")}.delivery to "github" for the CLI repository and add ${outputPath.join(".")}.distribution manually, or remove distribution.`
+      }
+    ]
+  };
+}
 
 // src/sdk-config/v1/fern-config-mapper-output.ts
 function mapOutput(generator, language, index) {
@@ -879,11 +1266,10 @@ function githubOutput(value, publishInfo, rawOutput, language, sourcePath, state
     ...optionalObject("package", { ...publication?.package, ...licensePackage })
   };
 }
-var basicLicenseTypes = { mit: "MIT", apache: "APACHE" };
 function mapGithubLicense(value, sourcePath, state) {
   if (!isObject(value) || stringValue(value.type) !== "basic") return {};
   const id = stringValue(value.id);
-  const type = id ? basicLicenseTypes[id.toLowerCase()] : void 0;
+  const type = id ? canonicalLicenseType(id) : void 0;
   if (!type) return {};
   consume(state, [...sourcePath, "type"]);
   consume(state, [...sourcePath, "id"]);
@@ -1450,6 +1836,114 @@ function outputDiagnostic(path, index) {
     suggestedAction: resolvedGuidance?.suggestedAction ?? "Review this output setting and preserve it outside SDK Config when no equivalent exists."
   };
 }
+
+// src/sdk-config/v1/package.ts
+var sdkConfigV1DependencySchema = dependencySchema;
+var sdkConfigV1PackageConfigSchema = packageConfigSchema;
+
+// src/sdk-config/v1/fern-config-mapper-package.ts
+var emailSchema = zod.z.email();
+function mapCliPackageIdentity(identity, state, targetIndex) {
+  mapIdentityField(identity, "homepage", stringValue, state);
+  mapIdentityField(identity, "keywords", (value) => stringArrayValue(value)?.slice(), state);
+  mapCargoAuthors(identity, state, targetIndex);
+  mapIdentityField(identity, "license", licenseValue, state);
+}
+function mapIdentityField(identity, field, read, state) {
+  const located = locate(identity.value, [field], identity.path);
+  const value = located && read(located.value);
+  if (located && value !== void 0) addPackageFallback(state, field, value, located.path);
+}
+function mapLicenseFallback(config, aliases, state, basePath) {
+  const located = locate(config, aliases, basePath);
+  const license = located && licenseValue(located.value);
+  if (located && license) addPackageFallback(state, "license", license, located.path);
+}
+function resolveTargetPackage(targetPackage, fallbacks, generator, delivery, index) {
+  const diagnostics = [];
+  for (const fallback of fallbacks) {
+    applyFallback(targetPackage, fallback, index, diagnostics);
+  }
+  if (delivery !== "github") {
+    applyMetadataLicense(targetPackage, generator.raw, index, diagnostics);
+  }
+  return diagnostics;
+}
+function applyFallback(targetPackage, { field, value, path }, index, diagnostics) {
+  const existing = targetPackage[field];
+  if (existing === void 0) {
+    targetPackage[field] = value;
+  } else if (stableJson(existing) !== stableJson(value)) {
+    diagnostics.push({
+      code: "FERN_PACKAGE_VALUE_CONFLICT",
+      severity: "warning",
+      path,
+      reason: `Fern value conflicts with the package.${field} already migrated for this target, which is kept`,
+      sdkConfigPath: ["targets", index, "package", field],
+      suggestedAction: `Choose the intended value and set targets.${index}.package.${field} manually.`
+    });
+  }
+}
+function applyMetadataLicense(targetPackage, raw, index, diagnostics) {
+  const metadata = isObject(raw) && isObject(raw.metadata) ? raw.metadata : void 0;
+  if (metadata?.license === void 0 || metadata.license === null) return;
+  const path = ["group", "generators", index, "metadata", "license"];
+  const license = licenseValue(metadata.license);
+  if (license) {
+    applyFallback(targetPackage, { field: "license", value: license, path }, index, diagnostics);
+    return;
+  }
+  diagnostics.push({
+    code: "FERN_CONFIG_FIELD_UNSUPPORTED",
+    severity: "warning",
+    path,
+    reason: isObject(metadata.license) ? "A custom license file cannot be migrated automatically" : "metadata.license is not a license identifier",
+    sdkConfigPath: ["targets", index, "package", "license"],
+    suggestedAction: `Set targets.${index}.package.license manually.`
+  });
+}
+function mapCargoAuthors(identity, state, targetIndex) {
+  const located = locate(identity.value, ["authors"], identity.path);
+  const entries = located && stringArrayValue(located.value);
+  if (!located || !entries) return;
+  consume(state, located.path);
+  const authors = entries.map(parseCargoAuthor);
+  const parsed = sdkConfigV1PackageConfigSchema.shape.authors.safeParse(authors);
+  const invalid = parsed.success ? [] : [...new Set(parsed.error.issues.map((issue) => issue.path[0]))].filter(
+    (index) => typeof index === "number"
+  );
+  if (invalid.length === 0) {
+    addPackageFallback(state, "authors", authors, located.path);
+    return;
+  }
+  const authorsPath = ["targets", targetIndex, "package", "authors"];
+  (state.valueDiagnostics ??= []).push(
+    ...invalid.map((entry) => ({
+      code: "FERN_CONFIG_VALUE_INVALID",
+      severity: "warning",
+      path: [...located.path, entry],
+      reason: 'CLI packageIdentity.authors was not migrated because this entry is not "Name" or "Name <email>" with a valid email',
+      sdkConfigPath: authorsPath,
+      suggestedAction: `Correct the entry, then set ${authorsPath.join(".")} manually.`
+    }))
+  );
+}
+function parseCargoAuthor(entry) {
+  const trimmed = entry.trim();
+  const match = /^(.*?)\s*<([^<>]*)>$/.exec(trimmed);
+  if (!match) return { name: trimmed };
+  const [, name = "", email = ""] = match;
+  if (name !== "" && !emailSchema.safeParse(email).success) return { name: trimmed };
+  return { name, email };
+}
+function licenseValue(value) {
+  const license = stringValue(value)?.trim();
+  return license ? { type: canonicalLicenseType(license) ?? license } : void 0;
+}
+function addPackageFallback(state, field, value, path) {
+  consume(state, path);
+  (state.packageFallbacks ??= []).push({ field, value, path });
+}
 var OMIT = /* @__PURE__ */ Symbol("omit");
 function inputJsonSchema(schema) {
   return zod.z.toJSONSchema(schema, {
@@ -1707,7 +2201,16 @@ var sdkConfigV1PublishConfigSchema = zod.z.discriminatedUnion("registry", [
   zod.z.strictObject({
     registry: zod.z.literal("npm").describe("Publishes the package to an npm-compatible registry."),
     token: nonEmptyStringSchema.optional().describe("The npm registry token, or an environment expression that resolves to it."),
+    trustedPublishing: zod.z.boolean().optional().describe("Whether npm publication uses trusted publishing (OIDC) instead of a token."),
     ...commonPublishShape
+  }).superRefine((publish, context) => {
+    if (publish.trustedPublishing === true && publish.token !== void 0) {
+      context.addIssue({
+        code: "custom",
+        message: "token must be omitted when trustedPublishing is true",
+        path: ["token"]
+      });
+    }
   }),
   zod.z.strictObject({
     registry: zod.z.literal("pypi").describe("Publishes the package to a PyPI-compatible registry."),
@@ -1785,10 +2288,29 @@ var sdkConfigV1OutputConfigSchema = zod.z.discriminatedUnion(
   [filesOutputSchema, zipOutputSchema, githubDeliverySchema],
   { error: 'output.delivery must be one of "files", "zip", or "github"' }
 );
-
-// src/sdk-config/v1/package.ts
-var sdkConfigV1DependencySchema = dependencySchema;
-var sdkConfigV1PackageConfigSchema = packageConfigSchema;
+var cliDistributionShape = {
+  distribution: cliDistributionConfigSchema.optional().describe(
+    "CLI release channels published by the generated release workflow; credentials are GitHub Actions secret names."
+  )
+};
+function rejectDistributionWithoutGithub(output, context) {
+  if (output.distribution !== void 0) {
+    context.addIssue({
+      code: "custom",
+      message: CLI_DISTRIBUTION_REQUIRES_GITHUB_DELIVERY_MESSAGE,
+      path: ["distribution"]
+    });
+  }
+}
+var sdkConfigV1CliOutputConfigSchema = zod.z.discriminatedUnion(
+  "delivery",
+  [
+    filesOutputSchema.extend(cliDistributionShape).superRefine(rejectDistributionWithoutGithub),
+    zipOutputSchema.extend(cliDistributionShape).superRefine(rejectDistributionWithoutGithub),
+    githubDeliverySchema.extend(cliDistributionShape)
+  ],
+  { error: 'output.delivery must be one of "files", "zip", or "github"' }
+);
 var sdkConfigV1ReplayConfigSchema = zod.z.strictObject({
   enabled: zod.z.boolean().describe("Whether regeneration reapplies customer-authored repository changes.")
 });
@@ -1865,10 +2387,6 @@ var sdkConfigV1SourceConfigSchema = zod.z.strictObject({
     seenIds.add(id);
   });
 });
-var cliGenerationConfigSchema = zod.z.strictObject({
-  paginationParameters: zod.z.array(nonEmptyStringSchema).optional().describe("Request parameter names treated as pagination controls by the CLI."),
-  skills: zod.z.boolean().optional().describe("Whether the generated CLI includes skills that teach AI agents to invoke commands.")
-});
 var csharpGenerationConfigSchema = zod.z.strictObject({
   useOptionalWrapper: zod.z.boolean().optional().describe("Whether optional values use an explicit Optional wrapper."),
   simplifyObjectDictionaries: zod.z.boolean().optional().describe("Whether object schemas with arbitrary values use simplified dictionary types."),
@@ -2121,7 +2639,10 @@ var sdkConfigV1TargetSchema = zod.z.discriminatedUnion("language", [
   zod.z.strictObject({
     language: zod.z.literal("cli").describe("Generates a command-line interface."),
     generation: sdkConfigV1GenerationConfigOverrideSchema.extend(cliGenerationConfigSchema.shape).optional().describe("Common and CLI-specific generation settings for this target."),
-    ...targetOverrideShape
+    ...targetOverrideShape,
+    output: sdkConfigV1CliOutputConfigSchema.optional().describe(
+      "Output configuration, including optional CLI distribution channels, that replaces the root output for this target."
+    )
   }),
   zod.z.strictObject({
     language: zod.z.literal("mcp").describe("Generates an MCP server."),
@@ -2138,7 +2659,7 @@ var sdkConfigV1TargetSchema = zod.z.discriminatedUnion("language", [
 // src/sdk-config/v1/sdk-config-v1.ts
 var SDK_CONFIG_V1_SCHEMA_VERSION = "sdk-config/v1";
 var publishRegistryLanguages = {
-  npm: ["typescript", "mcp"],
+  npm: ["typescript", "mcp", "cli"],
   pypi: ["python"],
   maven: ["java", "kotlin"],
   nuget: ["csharp"],
@@ -2215,6 +2736,13 @@ function validateTargetPublishing(target, targetIndex, globalPackage, globalOutp
     });
     return;
   }
+  if (target.language === "cli" && output.delivery !== "github") {
+    context.addIssue({
+      code: "custom",
+      message: CLI_PUBLISH_REQUIRES_GITHUB_DELIVERY_MESSAGE,
+      path: target.output ? ["targets", targetIndex, "output", "delivery"] : ["output", "delivery"]
+    });
+  }
   validatePublishingIdentity(
     { ...globalPackage, ...target.package },
     registry,
@@ -2327,16 +2855,28 @@ function mapFernConfigToSdkConfigV1(input) {
       package: outputPackage,
       generation: outputGeneration
     }, index) => {
+      const distribution = applyCliDistribution(output, invocation.cliDistribution, index);
+      invocation.unsupportedFields.push(...distribution.diagnostics);
       const target = {
         language,
-        output,
+        output: distribution.output,
         ...optional("sdkName", generator.sdkName),
         ...optional("sdkVersion", generator.sdkVersion),
         ...optional("client", clients.targetOverrides[index]),
         ...optional("docs", docs.targetOverrides[index])
       };
-      if (Object.keys(invocation.package).length > 0 || outputPackage || generator.package) {
-        target.package = { ...invocation.package, ...outputPackage, ...generator.package };
+      const targetPackage = { ...invocation.package, ...outputPackage, ...generator.package };
+      invocation.unsupportedFields.push(
+        ...resolveTargetPackage(
+          targetPackage,
+          invocation.packageFallbacks,
+          generator,
+          output.delivery,
+          index
+        )
+      );
+      if (Object.keys(targetPackage).length > 0 || outputPackage || generator.package) {
+        target.package = targetPackage;
       }
       const targetGeneration = {
         ...generations.targetOverrides[index],
@@ -2518,10 +3058,14 @@ function mapInvocation(generator, language, activeLanguages, index) {
       ...optional("smartCasingDigitWordBoundary", smartCasingDigitWordBoundary)
     };
   }
-  const targetGeneration = mapLanguageConfig(language, config, state, packageConfig, [
-    ...prefix,
-    "config"
-  ]);
+  const targetGeneration = mapLanguageConfig(
+    language,
+    config,
+    state,
+    packageConfig,
+    [...prefix, "config"],
+    index
+  );
   mapPublishMetadata(generator.publishMetadata, packageConfig);
   if (generator.keywords?.length) {
     generation.reservedKeywords = [...generator.keywords];
@@ -2538,12 +3082,22 @@ function mapInvocation(generator, language, activeLanguages, index) {
   }
   const docs = mapReadme(generator.readme, language, activeLanguages, state, [...prefix, "readme"]);
   const unsupportedFields = [
+    ...state.valueDiagnostics ?? [],
     ...collectUnsupported(config, [...prefix, "config"], state),
     ...settings ? collectUnsupported(settings, [...prefix, "settings"], state) : [],
     ...isObject(generator.readme) ? collectUnsupported(generator.readme, [...prefix, "readme"], state) : [],
     ...unsupportedResolvedFields(generator, index, apiWideIdempotency !== void 0)
   ];
-  return { client, docs, generation, package: packageConfig, targetGeneration, unsupportedFields };
+  return {
+    client,
+    docs,
+    generation,
+    package: packageConfig,
+    packageFallbacks: state.packageFallbacks ?? [],
+    ...optional("cliDistribution", state.cliDistribution),
+    targetGeneration,
+    unsupportedFields
+  };
 }
 function unsupportedResolvedFields(generator, index, idempotencyMapped) {
   const values = [
@@ -2733,6 +3287,7 @@ function mapCommonConfig(language, config, state, client, generation, packageCon
   const packagePath = takeString(config, ["packagePath"], state, basePath);
   if (packagePath !== void 0) generation.layout = { packagePath };
   mapDependencies(config, state, packageConfig, basePath);
+  mapPeerDependenciesMeta(config, state, packageConfig, basePath);
 }
 function mapTypescriptStreams(config, state, basePath) {
   const responseType = takeEnum(config, ["streamType"], ["wrapper", "web"], state, basePath);
@@ -2746,7 +3301,7 @@ function mapTypescriptStreams(config, state, basePath) {
   if (responseType === void 0 && fileResponseType === void 0) return void 0;
   return { enabled: true, ...compact({ responseType, fileResponseType }) };
 }
-function mapLanguageConfig(language, config, state, packageConfig, basePath) {
+function mapLanguageConfig(language, config, state, packageConfig, basePath, targetIndex) {
   switch (language) {
     case "typescript":
       return mapTypescript(config, state, packageConfig, basePath);
@@ -2773,7 +3328,7 @@ function mapLanguageConfig(language, config, state, packageConfig, basePath) {
     case "swift":
       return mapSwift(config, state, basePath);
     case "cli":
-      return mapCli(config, state, packageConfig, basePath);
+      return mapCli(config, state, packageConfig, basePath, targetIndex);
     case "terraform":
       return mapTerraform(config, state, packageConfig, basePath);
   }
@@ -2790,6 +3345,7 @@ function mapTypescript(config, state, packageConfig, basePath) {
   const packageManagerAtIndex = packageJsonPackageManager ? packageJsonPackageManager.indexOf("@", packageJsonPackageManager.startsWith("@") ? 1 : 0) : -1;
   const packageManagerVersionPart = packageManagerAtIndex >= 0 ? packageJsonPackageManager?.slice(packageManagerAtIndex + 1).split("+")[0] : void 0;
   const packageManagerVersion = packageManagerVersionPart || void 0;
+  if (packageJsonManifest) liftPackageJsonDependencies(packageJsonManifest, state, packageConfig);
   const serdeLayer = takeBoolean(config, ["serdeLayer"], state, basePath);
   const noSerdeLayer = takeBoolean(config, ["noSerdeLayer"], state, basePath);
   const fetchSupport = takeEnum(config, ["fetchSupport"], ["native"], state, basePath);
@@ -2959,6 +3515,7 @@ function mapRust(config, state, packageConfig, basePath) {
   const description = takeString(config, ["packageDescription"], state, basePath);
   const documentationUrl = takeString(config, ["packageDocumentation"], state, basePath);
   Object.assign(packageConfig, compact({ packageName, repository, description, documentationUrl }));
+  mapLicenseFallback(config, ["packageLicense"], state, basePath);
   return compact({
     dateTimeType: takeEnum(config, ["dateTimeType"], ["offset", "utc"], state, basePath),
     capitalizeInitialisms: takeBoolean(config, ["capitalizeInitialisms"], state, basePath),
@@ -2972,7 +3529,7 @@ function mapSwift(config, state, basePath) {
     nullableAsOptional: takeBoolean(config, ["nullableAsOptional"], state, basePath)
   });
 }
-function mapCli(config, state, packageConfig, basePath) {
+function mapCli(config, state, packageConfig, basePath, targetIndex) {
   const identity = takeObject(config, ["packageIdentity"], state, basePath);
   if (identity) {
     Object.assign(
@@ -2983,10 +3540,13 @@ function mapCli(config, state, packageConfig, basePath) {
         description: takeString(identity.value, ["description"], state, identity.path)
       })
     );
+    mapCliPackageIdentity(identity, state, targetIndex);
   }
+  mapCliDistribution(config, state, basePath, targetIndex);
   return compact({
     paginationParameters: takeStringArray(config, ["paginationParameters"], state, basePath),
-    skills: takeBoolean(config, ["skills"], state, basePath)
+    skills: takeBoolean(config, ["skills"], state, basePath),
+    ...mapCliGeneration(config, state, basePath, targetIndex)
   });
 }
 function mapTerraform(config, state, packageConfig, basePath) {
@@ -3070,6 +3630,48 @@ function mapDependencies(config, state, packageConfig, basePath) {
     if (dependencies.length) packageConfig[field] = dependencies;
   }
 }
+function liftPackageJsonDependencies(manifest, state, packageConfig) {
+  for (const [field, target] of [
+    ["dependencies", "extraDependencies"],
+    ["devDependencies", "extraDevDependencies"],
+    ["peerDependencies", "extraPeerDependencies"]
+  ]) {
+    const located = takeObject(manifest.value, [field], state, manifest.path);
+    if (!located) continue;
+    const lifted = Object.entries(located.value).flatMap(
+      ([name, dependency]) => mapDependency(name, dependency, state, [...located.path, name])
+    );
+    if (lifted.length) packageConfig[target] = overrideByName(packageConfig[target] ?? [], lifted);
+  }
+  const meta = takeObject(manifest.value, ["peerDependenciesMeta"], state, manifest.path);
+  if (!meta) return;
+  const entries = peerDependenciesMetaEntries(meta, state);
+  if (entries.length) {
+    packageConfig.extraPeerDependenciesMeta = {
+      ...packageConfig.extraPeerDependenciesMeta,
+      ...Object.fromEntries(entries)
+    };
+  }
+}
+function overrideByName(existing, overrides) {
+  const byName = new Map(existing.map((dependency) => [dependency.name, dependency]));
+  overrides.forEach((dependency) => byName.set(dependency.name, dependency));
+  return [...byName.values()];
+}
+function mapPeerDependenciesMeta(config, state, packageConfig, basePath) {
+  const located = takeObject(config, ["extraPeerDependenciesMeta"], state, basePath);
+  if (!located) return;
+  const entries = peerDependenciesMetaEntries(located, state);
+  if (entries.length) packageConfig.extraPeerDependenciesMeta = Object.fromEntries(entries);
+}
+function peerDependenciesMetaEntries(located, state) {
+  return Object.entries(located.value).flatMap(([name, value]) => {
+    const parsed = jsonObjectSchema.safeParse(value);
+    if (!parsed.success) return [];
+    consume(state, [...located.path, name]);
+    return [[name, parsed.data]];
+  });
+}
 function mapDependency(name, value, state, path) {
   if (typeof value === "string" && value) {
     consume(state, path);
@@ -3077,13 +3679,7 @@ function mapDependency(name, value, state, path) {
   }
   if (!isObject(value)) return [];
   const version = takeString(value, ["version"], state, path);
-  const gitUrl = takeString(value, ["git"], state, path);
-  const localPath = takeString(value, ["path"], state, path);
-  const source = gitUrl ? {
-    type: "git",
-    url: gitUrl,
-    ...optional("ref", takeString(value, ["ref"], state, path))
-  } : localPath ? { type: "path", path: localPath } : void 0;
+  const source = takeDependencySource(value, state, path);
   if (!version && !source) return [];
   return [
     {
@@ -3099,6 +3695,17 @@ function mapDependency(name, value, state, path) {
     }
   ];
 }
+function takeDependencySource(value, state, path) {
+  const gitUrl = takeString(value, ["git"], state, path);
+  if (gitUrl) {
+    const ref = takeString(value, ["ref", "rev", "branch"], state, path);
+    return { type: "git", url: gitUrl, ...optional("ref", ref) };
+  }
+  const localPath = takeString(value, ["path"], state, path);
+  if (localPath) return { type: "path", path: localPath };
+  const registry = takeString(value, ["registry"], state, path);
+  return registry ? { type: "registry", registry } : void 0;
+}
 function takeCustomSections(value, language, activeLanguages, state, basePath) {
   const located = locate(value, ["customSections"], basePath);
   if (!located || !Array.isArray(located.value)) return void 0;
@@ -3258,14 +3865,21 @@ function takeToolsets(value, aliases, state, basePath) {
 }
 
 exports.FernConfigMappingError = FernConfigMappingError;
+exports.SDK_CONFIG_V1_CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE;
 exports.SDK_CONFIG_V1_SCHEMA_VERSION = SDK_CONFIG_V1_SCHEMA_VERSION;
+exports.getSdkConfigV1Diagnostics = getSdkConfigV1Diagnostics;
 exports.mapFernConfigToSdkConfigV1 = mapFernConfigToSdkConfigV1;
 exports.parseSdkConfigV1 = parseSdkConfigV1;
 exports.parseSdkConfigV1ForConsumption = parseSdkConfigV1ForConsumption;
 exports.sdkConfigV1ApiConfigSchema = sdkConfigV1ApiConfigSchema;
 exports.sdkConfigV1AuthConfigSchema = sdkConfigV1AuthConfigSchema;
 exports.sdkConfigV1AuthSchemeSchema = sdkConfigV1AuthSchemeSchema;
+exports.sdkConfigV1CliDistributionConfigSchema = cliDistributionConfigSchema;
+exports.sdkConfigV1CliDistributionGithubAppSchema = cliDistributionGithubAppSchema;
+exports.sdkConfigV1CliDistributionHomebrewSchema = cliDistributionHomebrewSchema;
+exports.sdkConfigV1CliDistributionScoopSchema = cliDistributionScoopSchema;
 exports.sdkConfigV1CliGenerationConfigSchema = cliGenerationConfigSchema;
+exports.sdkConfigV1CliOutputConfigSchema = sdkConfigV1CliOutputConfigSchema;
 exports.sdkConfigV1ClientConfigOverrideSchema = sdkConfigV1ClientConfigOverrideSchema;
 exports.sdkConfigV1ClientConfigSchema = sdkConfigV1ClientConfigSchema;
 exports.sdkConfigV1ComposerPackageNameSchema = composerPackageNameSchema;
@@ -3275,6 +3889,7 @@ exports.sdkConfigV1DocsConfigSchema = sdkConfigV1DocsConfigSchema;
 exports.sdkConfigV1ExactSemverSchema = exactSemverSchema;
 exports.sdkConfigV1GenerationConfigOverrideSchema = sdkConfigV1GenerationConfigOverrideSchema;
 exports.sdkConfigV1GenerationConfigSchema = sdkConfigV1GenerationConfigSchema;
+exports.sdkConfigV1GithubActionsSecretNameSchema = githubActionsSecretNameSchema;
 exports.sdkConfigV1GoGenerationConfigSchema = goGenerationConfigSchema;
 exports.sdkConfigV1GoModulePathSchema = goModulePathSchema;
 exports.sdkConfigV1JavaGenerationConfigSchema = javaGenerationConfigSchema;