@postman/sdk-config 0.12.0 → 0.13.0

package/dist/sdk-config-ir/index.cjs

@@ -446,7 +446,10 @@ var cliDistributionConfigSchema = zod.z.strictObject({
     "A GitHub App used to mint short-lived tokens for every channel without its own tokenSecretName."
   ),
   homebrew: cliDistributionHomebrewSchema.optional().describe("Publishes a Homebrew formula to a tap repository on each tagged release."),
-  scoop: cliDistributionScoopSchema.optional().describe("Publishes a Scoop manifest to a bucket repository on each tagged release.")
+  scoop: cliDistributionScoopSchema.optional().describe("Publishes a Scoop manifest to a bucket repository on each tagged release."),
+  githubAttestations: zod.z.union([zod.z.literal("auto"), zod.z.boolean()], { error: 'must be "auto", true, or false' }).optional().describe(
+    'Whether the generated release workflow attests build provenance. "auto" (the generator default) attests only on public repositories; true always attests, for private repositories on GitHub Enterprise Cloud; false omits the attestation step and its permissions.'
+  )
 }).superRefine((distribution, context) => {
   if (distribution.homebrew !== void 0 || distribution.scoop !== void 0) {
     return;
@@ -459,6 +462,9 @@ var cliDistributionConfigSchema = zod.z.strictObject({
     });
     return;
   }
+  if (distribution.githubAttestations !== void 0) {
+    return;
+  }
   context.addIssue({
     code: "custom",
     message: "distribution must configure at least one channel: homebrew or scoop"
@@ -470,14 +476,17 @@ var CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE"
 var nonReleaseGithubModes = /* @__PURE__ */ new Set(["pull-request", "push", "commit"]);
 function cliDistributionModeDiagnostic(output, outputPath) {
   const mode = output?.github?.mode;
-  if (output?.distribution === void 0 || mode === void 0 || !nonReleaseGithubModes.has(mode)) {
+  const distribution = output?.distribution;
+  if (distribution === void 0 || mode === void 0 || !nonReleaseGithubModes.has(mode)) {
     return void 0;
   }
+  const hasChannel = distribution.homebrew !== void 0 || distribution.scoop !== void 0;
+  const consequence = hasChannel ? "Homebrew and Scoop publish only after a semantic-version tag is pushed to the repository." : "the release workflow, including its githubAttestations setting, runs only after a semantic-version tag is pushed to the repository.";
   return {
     code: CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE,
     severity: "warning",
     path: [...outputPath, "github", "mode"],
-    reason: `GitHub mode "${mode}" does not create a release tag, so Homebrew and Scoop publish only after a semantic-version tag is pushed to the repository.`,
+    reason: `GitHub mode "${mode}" does not create a release tag, so ${consequence}`,
     suggestedAction: 'Use mode "release" or "commit-and-release", or push a version tag after merging generated changes.'
   };
 }
@@ -822,7 +831,7 @@ var pythonGenerationConfigSchema = zod.z.strictObject({
   additionalInitExports: zod.z.array(additionalInitExportSchema).optional().describe("Additional names re-exported from the package initializer.")
 });
 var rubyGenerationConfigSchema = zod.z.strictObject({
-  requirePaths: zod.z.array(nonEmptyStringSchema).optional().describe("Ruby load paths included in the generated gem specification.")
+  requirePaths: zod.z.array(nonEmptyStringSchema).optional().describe("Files the generated entry file loads with `require`.")
 });
 var rustGenerationConfigSchema = zod.z.strictObject({
   /**
@@ -1201,6 +1210,7 @@ var publishConfigSchema = zod.z.discriminatedUnion("registry", [
   zod.z.strictObject({
     registry: zod.z.literal("rubygems").describe("Publishes the package to a RubyGems-compatible registry."),
     apiKeyEnvironmentVariable: nonEmptyStringSchema.optional().describe("The environment variable containing the RubyGems API key."),
+    ...trustedPublishingShape,
     ...commonPublishShape
   }),
   zod.z.strictObject({
@@ -1271,7 +1281,7 @@ var githubOutputSchema = zod.z.strictObject({
 var distributionShape = {
   /** Valid only for `cli` targets with GitHub delivery; secret names only, never values. */
   distribution: cliDistributionConfigSchema.optional().describe(
-    "CLI release channels published by the generated release workflow; credentials are GitHub Actions secret names."
+    "CLI release channels and build attestation settings for the generated release workflow; credentials are GitHub Actions secret names."
   )
 };
 var credentialResolutionShape = {
@@ -1331,6 +1341,9 @@ var apiImportSettingsSchema = zod.z.strictObject({
   discriminatedUnionV2: zod.z.boolean().optional().describe("Whether oneOf and anyOf schemas use the newer discriminator inference rules."),
   undiscriminatedUnionsWithLiterals: zod.z.boolean().optional().describe("Whether literal-bearing unions remain undiscriminated during import."),
   inlineAllOfSchemas: zod.z.boolean().optional().describe("Whether schemas composed with allOf are inlined when possible."),
+  inferDiscriminatedUnionBaseProperties: zod.z.boolean().optional().describe(
+    "Whether properties every discriminated-union variant shares are lifted onto the union."
+  ),
   resolveSchemaCollisions: zod.z.boolean().optional().describe("Whether colliding imported schema names are resolved automatically."),
   asyncApiMessageNaming: zod.z.enum(["v1", "v2"]).optional().describe("The naming strategy used for messages imported from AsyncAPI."),
   defaultIntegerFormat: zod.z.enum(["int32", "int64", "uint32", "uint64"]).optional().describe("The integer format used when a schema does not declare one.")