@postman/sdk-config 0.12.0 → 0.13.0

package/dist/{typescript-Byhn4MqL.d.cts → typescript-BFRxjAah.d.cts}

@@ -171,6 +171,7 @@ declare const cliDistributionConfigSchema: z.ZodObject<{
         bucket: z.ZodString;
         tokenSecretName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    githubAttestations: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean]>>;
 }, z.core.$strict>;
 declare const CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE";
 interface SdkConfigDiagnostic {

package/dist/{typescript-Byhn4MqL.d.ts → typescript-BFRxjAah.d.ts}

@@ -171,6 +171,7 @@ declare const cliDistributionConfigSchema: z.ZodObject<{
         bucket: z.ZodString;
         tokenSecretName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    githubAttestations: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean]>>;
 }, z.core.$strict>;
 declare const CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE";
 interface SdkConfigDiagnostic {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman/sdk-config",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Shared SDK configuration contracts and transformations for Postman SDK generation",
   "license": "UNLICENSED",
   "sideEffects": false,

package/src/sdk-config/v1/README.md

@@ -211,9 +211,10 @@ properties of the generated language artifact.
 ## CLI distribution and npm publication
 
 A `language: cli` target's own `output` block accepts `distribution`, which publishes the generated
-CLI to Homebrew and Scoop from the generated `release.yml` on each tagged release. It exists only on
-the `cli` target; root `output` and other languages reject it as an unknown key. A CLI target may
-also publish to npm, which the CLI generator uses for its npm launcher packages.
+CLI to Homebrew and Scoop from the generated `release.yml` on each tagged release and controls
+whether that workflow attests build provenance. It exists only on the `cli` target; root `output`
+and other languages reject it as an unknown key. A CLI target may also publish to npm, which the CLI
+generator uses for its npm launcher packages.
 
 ```yaml
 targets:
@@ -238,8 +239,22 @@ targets:
         scoop:
           bucket: acme/scoop-bucket
           tokenSecretName: SCOOP_BUCKET_PAT # optional; overrides githubApp for Scoop
+        githubAttestations: auto # optional; auto (generator default), true, or false
 ```
 
+### Build attestations
+
+`githubAttestations` controls the generated `actions/attest-build-provenance` step:
+
+| Value              | Release workflow                                                 |
+| ------------------ | ---------------------------------------------------------------- |
+| `auto` (or absent) | Attests only on public repositories                              |
+| `true`             | Always attests (private repositories on GitHub Enterprise Cloud) |
+| `false`            | No step or permissions; writes `github-attestations = false`     |
+
+`githubAttestations` may be the only `distribution` key, for example `{ githubAttestations: false }`
+on a private repository that publishes only to npm. It is a plain value, not a secret name.
+
 ### Secret names, not secret values
 
 Every `*SecretName` field (`tokenSecretName`, `appIdSecretName`, `privateKeySecretName`) is the
@@ -265,28 +280,34 @@ The field names differ from the Fern generator's `tokenEnvironmentVariable`, `ap
 | `distribution` with `files` or `zip` delivery                          | Error with a fix instruction             |
 | `distribution` on root `output` or a non-`cli` target                  | Unknown-key error                        |
 | `distribution: {}` or `githubApp` without `homebrew`/`scoop`           | Error                                    |
+| `githubAttestations` other than `"auto"`, `true`, or `false`           | Error                                    |
 | `githubApp` missing either secret name                                 | Error                                    |
 | `tap`/`bucket` not `<owner>/<repo>`; `formula` not `^[a-z][a-z0-9-]*$` | Error                                    |
 | npm publication on a `cli` target without `github` delivery            | Error                                    |
 | `trustedPublishing: true` with `token`                                 | Error                                    |
+| `trustedPublishing: true` with `apiKey`                                | Error                                    |
 | `distribution` with GitHub mode `pull-request`, `push`, or `commit`    | Warning from `getSdkConfigV1Diagnostics` |
 
 Non-release modes are allowed because a customer may push a version tag themselves, but nothing is
-published until they do. Zod has no non-fatal issue channel, so warnings come from
-`getSdkConfigV1Diagnostics(document)` (and `getSdkConfigIrV1Diagnostics` for IR), which returns the
-same `code`/`severity`/`path`/`reason`/`suggestedAction` shape as Fern migration diagnostics.
+published until they do. The warning also applies when `githubAttestations` is the only key, because
+the release workflow it configures runs only on a version tag. Zod has no non-fatal issue channel, so
+warnings come from `getSdkConfigV1Diagnostics(document)` (and `getSdkConfigIrV1Diagnostics` for IR),
+which returns the same `code`/`severity`/`path`/`reason`/`suggestedAction` shape as Fern migration
+diagnostics.
 
-`trustedPublishing` is shared by every npm target. It replaces Fern's `token: OIDC` marker
-(`<USE_OIDC>` in the generator) with a typed flag. For CLI npm, omitting `publish` is equivalent to
-the generator's `shouldGeneratePublishWorkflow: false`.
+`trustedPublishing` replaces Fern's `token: OIDC` marker (`<USE_OIDC>` in the generator) with a
+typed flag. npm reads it instead of `token`; NuGet and RubyGems read it instead of `apiKey`, which is
+why setting both is an error. For CLI npm, omitting `publish` is equivalent to the generator's
+`shouldGeneratePublishWorkflow: false`.
 
 ### Fern migration
 
 `mapFernConfigToSdkConfigV1` maps the CLI generator's `config.distribution` onto the target's
 `output.distribution` when the Fern output is a GitHub repository. Keys are matched by exact name:
 `appIdSecret` and `privateKeySecret` become `appIdSecretName` and `privateKeySecretName`, and each
-channel's `tokenEnvironmentVariable` becomes `tokenSecretName`. Secret names are copied verbatim and
-generator defaults are not written. Other keys are reported as `FERN_CONFIG_FIELD_UNSUPPORTED`.
+channel's `tokenEnvironmentVariable` becomes `tokenSecretName`. `githubAttestations` is copied as a
+plain value. Secret names are copied verbatim and generator defaults are not written. Other keys are
+reported as `FERN_CONFIG_FIELD_UNSUPPORTED`.
 
 - A distribution this schema rejects, including the legacy no-ops above, is left out and reported
   as `FERN_CONFIG_VALUE_INVALID` at the legacy path, without the rejected value.

package/src/sdk-config-ir/v1/README.md

@@ -47,12 +47,13 @@ messages. Valid IR requests route only to the IR bridge and never fall through t
 - Credentials may be references to externally managed secrets or raw credential/signing values when
   an integration must carry the material through the normalized config. Raw values are sensitive and
   must be handled as secrets.
-- `output.distribution` (CLI Homebrew/Scoop channels) is valid only when `target.language` is `cli`
-  and `output.delivery` is `github`. It is accepted on every delivery variant so files/zip produce an
-  actionable error. Its `*SecretName` fields hold GitHub Actions secret names that the generated
-  release workflow resolves; they are never credentials, references, or values to resolve, and
-  `credentialResolution` does not apply to them. `getSdkConfigIrV1Diagnostics` warns when
-  distribution is combined with a non-release GitHub mode. See the
+- `output.distribution` (CLI Homebrew/Scoop channels and `githubAttestations`) is valid only when
+  `target.language` is `cli` and `output.delivery` is `github`. It is accepted on every delivery
+  variant so files/zip produce an actionable error. Its `*SecretName` fields hold GitHub Actions
+  secret names that the generated release workflow resolves; they are never credentials,
+  references, or values to resolve, and `credentialResolution` does not apply to them.
+  `getSdkConfigIrV1Diagnostics` warns when distribution is combined with a non-release GitHub mode.
+  See the
   [SDK Config v1 reference](../../sdk-config/v1/README.md#cli-distribution-and-npm-publication).
 - npm publication is valid for `cli` targets with GitHub delivery only.
 
@@ -259,7 +260,7 @@ audited on 2026-07-17. Counts guide the initial contract; they are not a permane
 | npm package privacy and JSR publication                                     | `output.publish.isPackagePrivate` / `output.publish.publishToJsr`                                         |                          NPM-only booleans |
 | registry version and workflow gate                                          | `output.publish.version` / `output.publish.shouldGeneratePublishWorkflow`                                 |                      Per-registry controls |
 | registry credentials and environment variables                              | `output.publish.credentials` / `output.publish.*EnvironmentVariable`                                      |      Registry-specific secret values/names |
-| trusted publishing / OIDC markers                                           | `output.publish.trustedPublishing`                                                                        |                       npm, PyPI, and NuGet |
+| trusted publishing / OIDC markers                                           | `output.publish.trustedPublishing`                                                                        |             npm, PyPI, NuGet, and RubyGems |
 | Maven coordinate and signing material/env vars                              | `output.publish.coordinate` / `output.publish.signature` / `output.publish.signatureEnvironmentVariables` |                             Maven-specific |
 | Fern README config                                                          | `docs.readme`                                                                                             |  12 API names; 11 disabled-section configs |
 | `customReadmeSections`                                                      | `docs.readme.customSections`                                                                              |     Not in the project snapshot; see below |
@@ -348,28 +349,29 @@ normalized contract.
 These settings remain under `source.apiImportSettings` because they affect spec conversion rather
 than generated-language presentation.
 
-| Fern setting                                                | Normalized field                     |                       Observed projects |
-| ----------------------------------------------------------- | ------------------------------------ | --------------------------------------: |
-| `respect-nullable-schemas`                                  | `respectNullableSchemas`             |                                      10 |
-| `title-as-schema-name`                                      | `titleAsSchemaName`                  |                                      16 |
-| `ignore-tags`                                               | `ignoreTags`                         | Not in the project snapshot; see below. |
-| `disambiguate-request-names`                                | `disambiguateRequestNames`           | Not in the project snapshot; see below. |
-| `respect-readonly-schemas`                                  | `respectReadonlySchemas`             | Not in the project snapshot; see below. |
-| `unions: v1`, `prefer-undiscriminated-unions-with-literals` | `discriminatedUnionV2`               | Not in the project snapshot; see below. |
-| `prefer-undiscriminated-unions-with-literals`               | `undiscriminatedUnionsWithLiterals`  | Not in the project snapshot; see below. |
-| `inline-all-of-schemas`                                     | `inlineAllOfSchemas`                 | Not in the project snapshot; see below. |
-| `resolve-schema-collisions`                                 | `resolveSchemaCollisions`            | Not in the project snapshot; see below. |
-| `message-naming`                                            | `asyncApiMessageNaming`              | Not in the project snapshot; see below. |
-| `coerce-enums-to-literals`                                  | `coerceEnumsToLiterals`              |                                      14 |
-| `idiomatic-request-names`                                   | `idiomaticRequestNames`              |                                      12 |
-| `wrap-references-to-nullable-in-optional`                   | `wrapReferencesToNullableInOptional` |                                       9 |
-| `coerce-optional-schemas-to-nullable`                       | `coerceOptionalSchemasToNullable`    |                                       9 |
-| `object-query-parameters`                                   | `objectQueryParameters`              |                                       9 |
-| `only-include-referenced-schemas`                           | `onlyIncludeReferencedSchemas`       |                                       4 |
-| `group-multi-api-environments`                              | `groupMultiApiEnvironments`          |                                       2 |
-| `path-parameter-order`                                      | `pathParameterOrder`                 |                                       2 |
-| `type-dates-as-strings`                                     | `typeDatesAsStrings`                 |                                      12 |
-| `default-integer-format`                                    | `defaultIntegerFormat`               |           Importer defaults to `int32`. |
+| Fern setting                                                | Normalized field                        |                       Observed projects |
+| ----------------------------------------------------------- | --------------------------------------- | --------------------------------------: |
+| `respect-nullable-schemas`                                  | `respectNullableSchemas`                |                                      10 |
+| `title-as-schema-name`                                      | `titleAsSchemaName`                     |                                      16 |
+| `ignore-tags`                                               | `ignoreTags`                            | Not in the project snapshot; see below. |
+| `disambiguate-request-names`                                | `disambiguateRequestNames`              | Not in the project snapshot; see below. |
+| `respect-readonly-schemas`                                  | `respectReadonlySchemas`                | Not in the project snapshot; see below. |
+| `unions: v1`, `prefer-undiscriminated-unions-with-literals` | `discriminatedUnionV2`                  | Not in the project snapshot; see below. |
+| `prefer-undiscriminated-unions-with-literals`               | `undiscriminatedUnionsWithLiterals`     | Not in the project snapshot; see below. |
+| `inline-all-of-schemas`                                     | `inlineAllOfSchemas`                    | Not in the project snapshot; see below. |
+| `infer-discriminated-union-base-properties`                 | `inferDiscriminatedUnionBaseProperties` | Not in the project snapshot; see below. |
+| `resolve-schema-collisions`                                 | `resolveSchemaCollisions`               | Not in the project snapshot; see below. |
+| `message-naming`                                            | `asyncApiMessageNaming`                 | Not in the project snapshot; see below. |
+| `coerce-enums-to-literals`                                  | `coerceEnumsToLiterals`                 |                                      14 |
+| `idiomatic-request-names`                                   | `idiomaticRequestNames`                 |                                      12 |
+| `wrap-references-to-nullable-in-optional`                   | `wrapReferencesToNullableInOptional`    |                                       9 |
+| `coerce-optional-schemas-to-nullable`                       | `coerceOptionalSchemasToNullable`       |                                       9 |
+| `object-query-parameters`                                   | `objectQueryParameters`                 |                                       9 |
+| `only-include-referenced-schemas`                           | `onlyIncludeReferencedSchemas`          |                                       4 |
+| `group-multi-api-environments`                              | `groupMultiApiEnvironments`             |                                       2 |
+| `path-parameter-order`                                      | `pathParameterOrder`                    |                                       2 |
+| `type-dates-as-strings`                                     | `typeDatesAsStrings`                    |                                      12 |
+| `default-integer-format`                                    | `defaultIntegerFormat`                  |           Importer defaults to `int32`. |
 
 `ignoreTags` and `disambiguateRequestNames` postdate the project snapshot. Twilio declares both
 across its namespaced API specs. They stay undefaulted so omission remains distinguishable from an
@@ -392,6 +394,11 @@ fields above: `respectReadonlySchemas` changes which properties an imported sche
 `discriminatedUnionV2` changes how union variants are converted, so an absent value must leave an
 existing SDK's shapes alone rather than assert one.
 
+`inferDiscriminatedUnionBaseProperties` postdates the snapshot too. Auth0's Management API sets it,
+and Fern then lifts every property all of a discriminated `oneOf`'s mapped variants declare with an
+equal schema onto the union itself — `ConnectionResponseContent::ad(string $id, string $displayName,
+...)` in its PHP SDK. It stays undefaulted: absent must leave a union's shape alone.
+
 `inlineAllOfSchemas`, `resolveSchemaCollisions`, and `asyncApiMessageNaming` complete the retained
 import settings with observed customer use. Each is refused today whenever it differs from the
 importer default, which blocks the declaring customer from a post-cutover generator version.