@postman/sdk-config 0.12.0 → 0.14.0

package/dist/{typescript-Byhn4MqL.d.cts → typescript-BFRxjAah.d.cts}

@@ -171,6 +171,7 @@ declare const cliDistributionConfigSchema: z.ZodObject<{
         bucket: z.ZodString;
         tokenSecretName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    githubAttestations: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean]>>;
 }, z.core.$strict>;
 declare const CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE";
 interface SdkConfigDiagnostic {

package/dist/{typescript-Byhn4MqL.d.ts → typescript-BFRxjAah.d.ts}

@@ -171,6 +171,7 @@ declare const cliDistributionConfigSchema: z.ZodObject<{
         bucket: z.ZodString;
         tokenSecretName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    githubAttestations: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodBoolean]>>;
 }, z.core.$strict>;
 declare const CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE";
 interface SdkConfigDiagnostic {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman/sdk-config",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Shared SDK configuration contracts and transformations for Postman SDK generation",
   "license": "UNLICENSED",
   "sideEffects": false,

package/src/sdk-config/v1/README.md

@@ -65,7 +65,9 @@ target-specific values are retained as sparse target overrides when the public s
 them. Optional `api` enrichment may be supplied after Fern's definition or IR has already been
 lowered into the public API shape. Supported registry credentials, signing material, and GitHub
 credentials are preserved in SDK Config when present; callers must treat these fields as sensitive
-secrets.
+secrets. A GitHub output's `workflows: false` becomes `output.github.workflows: false`, which tells
+GitHub delivery to skip generated `.github/workflows` files and leave existing ones untouched; the
+default `true` is omitted.
 
 Legacy package metadata fills `target.package` only where the mapped package has no value yet:
 the CLI generator's `packageIdentity.homepage`, `keywords`, `authors`, and `license`, the Rust
@@ -211,9 +213,10 @@ properties of the generated language artifact.
 ## CLI distribution and npm publication
 
 A `language: cli` target's own `output` block accepts `distribution`, which publishes the generated
-CLI to Homebrew and Scoop from the generated `release.yml` on each tagged release. It exists only on
-the `cli` target; root `output` and other languages reject it as an unknown key. A CLI target may
-also publish to npm, which the CLI generator uses for its npm launcher packages.
+CLI to Homebrew and Scoop from the generated `release.yml` on each tagged release and controls
+whether that workflow attests build provenance. It exists only on the `cli` target; root `output`
+and other languages reject it as an unknown key. A CLI target may also publish to npm, which the CLI
+generator uses for its npm launcher packages.
 
 ```yaml
 targets:
@@ -238,8 +241,22 @@ targets:
         scoop:
           bucket: acme/scoop-bucket
           tokenSecretName: SCOOP_BUCKET_PAT # optional; overrides githubApp for Scoop
+        githubAttestations: auto # optional; auto (generator default), true, or false
 ```
 
+### Build attestations
+
+`githubAttestations` controls the generated `actions/attest-build-provenance` step:
+
+| Value              | Release workflow                                                 |
+| ------------------ | ---------------------------------------------------------------- |
+| `auto` (or absent) | Attests only on public repositories                              |
+| `true`             | Always attests (private repositories on GitHub Enterprise Cloud) |
+| `false`            | No step or permissions; writes `github-attestations = false`     |
+
+`githubAttestations` may be the only `distribution` key, for example `{ githubAttestations: false }`
+on a private repository that publishes only to npm. It is a plain value, not a secret name.
+
 ### Secret names, not secret values
 
 Every `*SecretName` field (`tokenSecretName`, `appIdSecretName`, `privateKeySecretName`) is the
@@ -265,28 +282,34 @@ The field names differ from the Fern generator's `tokenEnvironmentVariable`, `ap
 | `distribution` with `files` or `zip` delivery                          | Error with a fix instruction             |
 | `distribution` on root `output` or a non-`cli` target                  | Unknown-key error                        |
 | `distribution: {}` or `githubApp` without `homebrew`/`scoop`           | Error                                    |
+| `githubAttestations` other than `"auto"`, `true`, or `false`           | Error                                    |
 | `githubApp` missing either secret name                                 | Error                                    |
 | `tap`/`bucket` not `<owner>/<repo>`; `formula` not `^[a-z][a-z0-9-]*$` | Error                                    |
 | npm publication on a `cli` target without `github` delivery            | Error                                    |
 | `trustedPublishing: true` with `token`                                 | Error                                    |
+| `trustedPublishing: true` with `apiKey`                                | Error                                    |
 | `distribution` with GitHub mode `pull-request`, `push`, or `commit`    | Warning from `getSdkConfigV1Diagnostics` |
 
 Non-release modes are allowed because a customer may push a version tag themselves, but nothing is
-published until they do. Zod has no non-fatal issue channel, so warnings come from
-`getSdkConfigV1Diagnostics(document)` (and `getSdkConfigIrV1Diagnostics` for IR), which returns the
-same `code`/`severity`/`path`/`reason`/`suggestedAction` shape as Fern migration diagnostics.
+published until they do. The warning also applies when `githubAttestations` is the only key, because
+the release workflow it configures runs only on a version tag. Zod has no non-fatal issue channel, so
+warnings come from `getSdkConfigV1Diagnostics(document)` (and `getSdkConfigIrV1Diagnostics` for IR),
+which returns the same `code`/`severity`/`path`/`reason`/`suggestedAction` shape as Fern migration
+diagnostics.
 
-`trustedPublishing` is shared by every npm target. It replaces Fern's `token: OIDC` marker
-(`<USE_OIDC>` in the generator) with a typed flag. For CLI npm, omitting `publish` is equivalent to
-the generator's `shouldGeneratePublishWorkflow: false`.
+`trustedPublishing` replaces Fern's `token: OIDC` marker (`<USE_OIDC>` in the generator) with a
+typed flag. npm reads it instead of `token`; NuGet and RubyGems read it instead of `apiKey`, which is
+why setting both is an error. For CLI npm, omitting `publish` is equivalent to the generator's
+`shouldGeneratePublishWorkflow: false`.
 
 ### Fern migration
 
 `mapFernConfigToSdkConfigV1` maps the CLI generator's `config.distribution` onto the target's
 `output.distribution` when the Fern output is a GitHub repository. Keys are matched by exact name:
 `appIdSecret` and `privateKeySecret` become `appIdSecretName` and `privateKeySecretName`, and each
-channel's `tokenEnvironmentVariable` becomes `tokenSecretName`. Secret names are copied verbatim and
-generator defaults are not written. Other keys are reported as `FERN_CONFIG_FIELD_UNSUPPORTED`.
+channel's `tokenEnvironmentVariable` becomes `tokenSecretName`. `githubAttestations` is copied as a
+plain value. Secret names are copied verbatim and generator defaults are not written. Other keys are
+reported as `FERN_CONFIG_FIELD_UNSUPPORTED`.
 
 - A distribution this schema rejects, including the legacy no-ops above, is left out and reported
   as `FERN_CONFIG_VALUE_INVALID` at the legacy path, without the rejected value.

package/src/sdk-config-ir/v1/README.md

@@ -47,12 +47,13 @@ messages. Valid IR requests route only to the IR bridge and never fall through t
 - Credentials may be references to externally managed secrets or raw credential/signing values when
   an integration must carry the material through the normalized config. Raw values are sensitive and
   must be handled as secrets.
-- `output.distribution` (CLI Homebrew/Scoop channels) is valid only when `target.language` is `cli`
-  and `output.delivery` is `github`. It is accepted on every delivery variant so files/zip produce an
-  actionable error. Its `*SecretName` fields hold GitHub Actions secret names that the generated
-  release workflow resolves; they are never credentials, references, or values to resolve, and
-  `credentialResolution` does not apply to them. `getSdkConfigIrV1Diagnostics` warns when
-  distribution is combined with a non-release GitHub mode. See the
+- `output.distribution` (CLI Homebrew/Scoop channels and `githubAttestations`) is valid only when
+  `target.language` is `cli` and `output.delivery` is `github`. It is accepted on every delivery
+  variant so files/zip produce an actionable error. Its `*SecretName` fields hold GitHub Actions
+  secret names that the generated release workflow resolves; they are never credentials,
+  references, or values to resolve, and `credentialResolution` does not apply to them.
+  `getSdkConfigIrV1Diagnostics` warns when distribution is combined with a non-release GitHub mode.
+  See the
   [SDK Config v1 reference](../../sdk-config/v1/README.md#cli-distribution-and-npm-publication).
 - npm publication is valid for `cli` targets with GitHub delivery only.
 
@@ -259,7 +260,7 @@ audited on 2026-07-17. Counts guide the initial contract; they are not a permane
 | npm package privacy and JSR publication                                     | `output.publish.isPackagePrivate` / `output.publish.publishToJsr`                                         |                          NPM-only booleans |
 | registry version and workflow gate                                          | `output.publish.version` / `output.publish.shouldGeneratePublishWorkflow`                                 |                      Per-registry controls |
 | registry credentials and environment variables                              | `output.publish.credentials` / `output.publish.*EnvironmentVariable`                                      |      Registry-specific secret values/names |
-| trusted publishing / OIDC markers                                           | `output.publish.trustedPublishing`                                                                        |                       npm, PyPI, and NuGet |
+| trusted publishing / OIDC markers                                           | `output.publish.trustedPublishing`                                                                        |             npm, PyPI, NuGet, and RubyGems |
 | Maven coordinate and signing material/env vars                              | `output.publish.coordinate` / `output.publish.signature` / `output.publish.signatureEnvironmentVariables` |                             Maven-specific |
 | Fern README config                                                          | `docs.readme`                                                                                             |  12 API names; 11 disabled-section configs |
 | `customReadmeSections`                                                      | `docs.readme.customSections`                                                                              |     Not in the project snapshot; see below |
@@ -348,28 +349,29 @@ normalized contract.
 These settings remain under `source.apiImportSettings` because they affect spec conversion rather
 than generated-language presentation.
 
-| Fern setting                                                | Normalized field                     |                       Observed projects |
-| ----------------------------------------------------------- | ------------------------------------ | --------------------------------------: |
-| `respect-nullable-schemas`                                  | `respectNullableSchemas`             |                                      10 |
-| `title-as-schema-name`                                      | `titleAsSchemaName`                  |                                      16 |
-| `ignore-tags`                                               | `ignoreTags`                         | Not in the project snapshot; see below. |
-| `disambiguate-request-names`                                | `disambiguateRequestNames`           | Not in the project snapshot; see below. |
-| `respect-readonly-schemas`                                  | `respectReadonlySchemas`             | Not in the project snapshot; see below. |
-| `unions: v1`, `prefer-undiscriminated-unions-with-literals` | `discriminatedUnionV2`               | Not in the project snapshot; see below. |
-| `prefer-undiscriminated-unions-with-literals`               | `undiscriminatedUnionsWithLiterals`  | Not in the project snapshot; see below. |
-| `inline-all-of-schemas`                                     | `inlineAllOfSchemas`                 | Not in the project snapshot; see below. |
-| `resolve-schema-collisions`                                 | `resolveSchemaCollisions`            | Not in the project snapshot; see below. |
-| `message-naming`                                            | `asyncApiMessageNaming`              | Not in the project snapshot; see below. |
-| `coerce-enums-to-literals`                                  | `coerceEnumsToLiterals`              |                                      14 |
-| `idiomatic-request-names`                                   | `idiomaticRequestNames`              |                                      12 |
-| `wrap-references-to-nullable-in-optional`                   | `wrapReferencesToNullableInOptional` |                                       9 |
-| `coerce-optional-schemas-to-nullable`                       | `coerceOptionalSchemasToNullable`    |                                       9 |
-| `object-query-parameters`                                   | `objectQueryParameters`              |                                       9 |
-| `only-include-referenced-schemas`                           | `onlyIncludeReferencedSchemas`       |                                       4 |
-| `group-multi-api-environments`                              | `groupMultiApiEnvironments`          |                                       2 |
-| `path-parameter-order`                                      | `pathParameterOrder`                 |                                       2 |
-| `type-dates-as-strings`                                     | `typeDatesAsStrings`                 |                                      12 |
-| `default-integer-format`                                    | `defaultIntegerFormat`               |           Importer defaults to `int32`. |
+| Fern setting                                                | Normalized field                        |                       Observed projects |
+| ----------------------------------------------------------- | --------------------------------------- | --------------------------------------: |
+| `respect-nullable-schemas`                                  | `respectNullableSchemas`                |                                      10 |
+| `title-as-schema-name`                                      | `titleAsSchemaName`                     |                                      16 |
+| `ignore-tags`                                               | `ignoreTags`                            | Not in the project snapshot; see below. |
+| `disambiguate-request-names`                                | `disambiguateRequestNames`              | Not in the project snapshot; see below. |
+| `respect-readonly-schemas`                                  | `respectReadonlySchemas`                | Not in the project snapshot; see below. |
+| `unions: v1`, `prefer-undiscriminated-unions-with-literals` | `discriminatedUnionV2`                  | Not in the project snapshot; see below. |
+| `prefer-undiscriminated-unions-with-literals`               | `undiscriminatedUnionsWithLiterals`     | Not in the project snapshot; see below. |
+| `inline-all-of-schemas`                                     | `inlineAllOfSchemas`                    | Not in the project snapshot; see below. |
+| `infer-discriminated-union-base-properties`                 | `inferDiscriminatedUnionBaseProperties` | Not in the project snapshot; see below. |
+| `resolve-schema-collisions`                                 | `resolveSchemaCollisions`               | Not in the project snapshot; see below. |
+| `message-naming`                                            | `asyncApiMessageNaming`                 | Not in the project snapshot; see below. |
+| `coerce-enums-to-literals`                                  | `coerceEnumsToLiterals`                 |                                      14 |
+| `idiomatic-request-names`                                   | `idiomaticRequestNames`                 |                                      12 |
+| `wrap-references-to-nullable-in-optional`                   | `wrapReferencesToNullableInOptional`    |                                       9 |
+| `coerce-optional-schemas-to-nullable`                       | `coerceOptionalSchemasToNullable`       |                                       9 |
+| `object-query-parameters`                                   | `objectQueryParameters`                 |                                       9 |
+| `only-include-referenced-schemas`                           | `onlyIncludeReferencedSchemas`          |                                       4 |
+| `group-multi-api-environments`                              | `groupMultiApiEnvironments`             |                                       2 |
+| `path-parameter-order`                                      | `pathParameterOrder`                    |                                       2 |
+| `type-dates-as-strings`                                     | `typeDatesAsStrings`                    |                                      12 |
+| `default-integer-format`                                    | `defaultIntegerFormat`                  |           Importer defaults to `int32`. |
 
 `ignoreTags` and `disambiguateRequestNames` postdate the project snapshot. Twilio declares both
 across its namespaced API specs. They stay undefaulted so omission remains distinguishable from an
@@ -392,6 +394,11 @@ fields above: `respectReadonlySchemas` changes which properties an imported sche
 `discriminatedUnionV2` changes how union variants are converted, so an absent value must leave an
 existing SDK's shapes alone rather than assert one.
 
+`inferDiscriminatedUnionBaseProperties` postdates the snapshot too. Auth0's Management API sets it,
+and Fern then lifts every property all of a discriminated `oneOf`'s mapped variants declare with an
+equal schema onto the union itself — `ConnectionResponseContent::ad(string $id, string $displayName,
+...)` in its PHP SDK. It stays undefaulted: absent must leave a union's shape alone.
+
 `inlineAllOfSchemas`, `resolveSchemaCollisions`, and `asyncApiMessageNaming` complete the retained
 import settings with observed customer use. Each is refused today whenever it differs from the
 importer default, which blocks the declaring customer from a post-cutover generator version.