@postman/sdk-config 0.12.0 → 0.14.0

package/dist/sdk-config/index.d.cts

@@ -1,3 +1,3 @@
 export { FernConfigMappingDiagnostic, FernConfigMappingError, FernConfigMappingResult, FernResolvedGeneratorGroupInput, FernResolvedGeneratorInput, FernSdkConfigLanguage, SDK_CONFIG_V1_SCHEMA_VERSION, SdkConfigV1, SdkConfigV1ApiConfig, SdkConfigV1ApiConfigInput, SdkConfigV1CliOutputConfig, SdkConfigV1ClientConfig, SdkConfigV1ClientConfigInput, SdkConfigV1ClientConfigOverride, SdkConfigV1Dependency, SdkConfigV1DocsConfig, SdkConfigV1Document, SdkConfigV1GenerationConfig, SdkConfigV1GenerationConfigInput, SdkConfigV1GenerationConfigOverride, SdkConfigV1Input, SdkConfigV1OutputConfig, SdkConfigV1PackageConfig, SdkConfigV1PublishConfig, SdkConfigV1PublishRegistry, SdkConfigV1ReplayConfig, SdkConfigV1SourceConfig, SdkConfigV1SourceSpec, SdkConfigV1Target, SdkConfigV1WebhookSignature, SdkConfigV1WebhookSignatureInput, getSdkConfigV1Diagnostics, mapFernConfigToSdkConfigV1, parseSdkConfigV1, parseSdkConfigV1ForConsumption, sdkConfigV1ApiConfigSchema, sdkConfigV1AuthConfigSchema, sdkConfigV1AuthSchemeSchema, sdkConfigV1CliOutputConfigSchema, sdkConfigV1ClientConfigOverrideSchema, sdkConfigV1ClientConfigSchema, sdkConfigV1DependencySchema, sdkConfigV1DocsConfigSchema, sdkConfigV1GenerationConfigOverrideSchema, sdkConfigV1GenerationConfigSchema, sdkConfigV1OutputConfigSchema, sdkConfigV1PackageConfigSchema, sdkConfigV1PublishConfigSchema, sdkConfigV1PublishRegistrySchema, sdkConfigV1ReadmeCustomSectionSchema, sdkConfigV1ReadmeEndpointSchema, sdkConfigV1ReplayConfigSchema, sdkConfigV1Schema, sdkConfigV1SourceConfigSchema, sdkConfigV1SourceSpecSchema, sdkConfigV1TargetSchema, sdkConfigV1WebhookSignatureSchema, splitSdkConfigV1TargetGeneration, validateSdkConfigV1 } from './v1/index.cjs';
-export { C as SDK_CONFIG_V1_CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE, a as SdkConfigV1CliDistributionConfig, b as SdkConfigV1CliDistributionGithubAppConfig, c as SdkConfigV1CliDistributionHomebrewConfig, d as SdkConfigV1CliDistributionScoopConfig, S as SdkConfigV1Diagnostic, s as sdkConfigV1CliDistributionConfigSchema, t as sdkConfigV1CliDistributionGithubAppSchema, u as sdkConfigV1CliDistributionHomebrewSchema, v as sdkConfigV1CliDistributionScoopSchema, w as sdkConfigV1CliGenerationConfigSchema, x as sdkConfigV1ComposerPackageNameSchema, y as sdkConfigV1CsharpGenerationConfigSchema, A as sdkConfigV1ExactSemverSchema, B as sdkConfigV1GithubActionsSecretNameSchema, E as sdkConfigV1GoGenerationConfigSchema, F as sdkConfigV1GoModulePathSchema, H as sdkConfigV1JavaGenerationConfigSchema, N as sdkConfigV1KotlinGenerationConfigSchema, Q as sdkConfigV1McpGenerationConfigSchema, U as sdkConfigV1NonEmptyStringSchema, W as sdkConfigV1PhpGenerationConfigSchema, X as sdkConfigV1PythonGenerationConfigSchema, Y as sdkConfigV1RelativePathSchema, Z as sdkConfigV1RubyGenerationConfigSchema, _ as sdkConfigV1RustGenerationConfigSchema, $ as sdkConfigV1SwiftGenerationConfigSchema, a0 as sdkConfigV1TerraformGenerationConfigSchema, a1 as sdkConfigV1TypescriptGenerationConfigSchema } from '../typescript-Byhn4MqL.cjs';
+export { C as SDK_CONFIG_V1_CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE, a as SdkConfigV1CliDistributionConfig, b as SdkConfigV1CliDistributionGithubAppConfig, c as SdkConfigV1CliDistributionHomebrewConfig, d as SdkConfigV1CliDistributionScoopConfig, S as SdkConfigV1Diagnostic, s as sdkConfigV1CliDistributionConfigSchema, t as sdkConfigV1CliDistributionGithubAppSchema, u as sdkConfigV1CliDistributionHomebrewSchema, v as sdkConfigV1CliDistributionScoopSchema, w as sdkConfigV1CliGenerationConfigSchema, x as sdkConfigV1ComposerPackageNameSchema, y as sdkConfigV1CsharpGenerationConfigSchema, A as sdkConfigV1ExactSemverSchema, B as sdkConfigV1GithubActionsSecretNameSchema, E as sdkConfigV1GoGenerationConfigSchema, F as sdkConfigV1GoModulePathSchema, H as sdkConfigV1JavaGenerationConfigSchema, N as sdkConfigV1KotlinGenerationConfigSchema, Q as sdkConfigV1McpGenerationConfigSchema, U as sdkConfigV1NonEmptyStringSchema, W as sdkConfigV1PhpGenerationConfigSchema, X as sdkConfigV1PythonGenerationConfigSchema, Y as sdkConfigV1RelativePathSchema, Z as sdkConfigV1RubyGenerationConfigSchema, _ as sdkConfigV1RustGenerationConfigSchema, $ as sdkConfigV1SwiftGenerationConfigSchema, a0 as sdkConfigV1TerraformGenerationConfigSchema, a1 as sdkConfigV1TypescriptGenerationConfigSchema } from '../typescript-BFRxjAah.cjs';
 import 'zod';

package/dist/sdk-config/index.d.ts

@@ -1,3 +1,3 @@
 export { FernConfigMappingDiagnostic, FernConfigMappingError, FernConfigMappingResult, FernResolvedGeneratorGroupInput, FernResolvedGeneratorInput, FernSdkConfigLanguage, SDK_CONFIG_V1_SCHEMA_VERSION, SdkConfigV1, SdkConfigV1ApiConfig, SdkConfigV1ApiConfigInput, SdkConfigV1CliOutputConfig, SdkConfigV1ClientConfig, SdkConfigV1ClientConfigInput, SdkConfigV1ClientConfigOverride, SdkConfigV1Dependency, SdkConfigV1DocsConfig, SdkConfigV1Document, SdkConfigV1GenerationConfig, SdkConfigV1GenerationConfigInput, SdkConfigV1GenerationConfigOverride, SdkConfigV1Input, SdkConfigV1OutputConfig, SdkConfigV1PackageConfig, SdkConfigV1PublishConfig, SdkConfigV1PublishRegistry, SdkConfigV1ReplayConfig, SdkConfigV1SourceConfig, SdkConfigV1SourceSpec, SdkConfigV1Target, SdkConfigV1WebhookSignature, SdkConfigV1WebhookSignatureInput, getSdkConfigV1Diagnostics, mapFernConfigToSdkConfigV1, parseSdkConfigV1, parseSdkConfigV1ForConsumption, sdkConfigV1ApiConfigSchema, sdkConfigV1AuthConfigSchema, sdkConfigV1AuthSchemeSchema, sdkConfigV1CliOutputConfigSchema, sdkConfigV1ClientConfigOverrideSchema, sdkConfigV1ClientConfigSchema, sdkConfigV1DependencySchema, sdkConfigV1DocsConfigSchema, sdkConfigV1GenerationConfigOverrideSchema, sdkConfigV1GenerationConfigSchema, sdkConfigV1OutputConfigSchema, sdkConfigV1PackageConfigSchema, sdkConfigV1PublishConfigSchema, sdkConfigV1PublishRegistrySchema, sdkConfigV1ReadmeCustomSectionSchema, sdkConfigV1ReadmeEndpointSchema, sdkConfigV1ReplayConfigSchema, sdkConfigV1Schema, sdkConfigV1SourceConfigSchema, sdkConfigV1SourceSpecSchema, sdkConfigV1TargetSchema, sdkConfigV1WebhookSignatureSchema, splitSdkConfigV1TargetGeneration, validateSdkConfigV1 } from './v1/index.js';
-export { C as SDK_CONFIG_V1_CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE, a as SdkConfigV1CliDistributionConfig, b as SdkConfigV1CliDistributionGithubAppConfig, c as SdkConfigV1CliDistributionHomebrewConfig, d as SdkConfigV1CliDistributionScoopConfig, S as SdkConfigV1Diagnostic, s as sdkConfigV1CliDistributionConfigSchema, t as sdkConfigV1CliDistributionGithubAppSchema, u as sdkConfigV1CliDistributionHomebrewSchema, v as sdkConfigV1CliDistributionScoopSchema, w as sdkConfigV1CliGenerationConfigSchema, x as sdkConfigV1ComposerPackageNameSchema, y as sdkConfigV1CsharpGenerationConfigSchema, A as sdkConfigV1ExactSemverSchema, B as sdkConfigV1GithubActionsSecretNameSchema, E as sdkConfigV1GoGenerationConfigSchema, F as sdkConfigV1GoModulePathSchema, H as sdkConfigV1JavaGenerationConfigSchema, N as sdkConfigV1KotlinGenerationConfigSchema, Q as sdkConfigV1McpGenerationConfigSchema, U as sdkConfigV1NonEmptyStringSchema, W as sdkConfigV1PhpGenerationConfigSchema, X as sdkConfigV1PythonGenerationConfigSchema, Y as sdkConfigV1RelativePathSchema, Z as sdkConfigV1RubyGenerationConfigSchema, _ as sdkConfigV1RustGenerationConfigSchema, $ as sdkConfigV1SwiftGenerationConfigSchema, a0 as sdkConfigV1TerraformGenerationConfigSchema, a1 as sdkConfigV1TypescriptGenerationConfigSchema } from '../typescript-Byhn4MqL.js';
+export { C as SDK_CONFIG_V1_CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE, a as SdkConfigV1CliDistributionConfig, b as SdkConfigV1CliDistributionGithubAppConfig, c as SdkConfigV1CliDistributionHomebrewConfig, d as SdkConfigV1CliDistributionScoopConfig, S as SdkConfigV1Diagnostic, s as sdkConfigV1CliDistributionConfigSchema, t as sdkConfigV1CliDistributionGithubAppSchema, u as sdkConfigV1CliDistributionHomebrewSchema, v as sdkConfigV1CliDistributionScoopSchema, w as sdkConfigV1CliGenerationConfigSchema, x as sdkConfigV1ComposerPackageNameSchema, y as sdkConfigV1CsharpGenerationConfigSchema, A as sdkConfigV1ExactSemverSchema, B as sdkConfigV1GithubActionsSecretNameSchema, E as sdkConfigV1GoGenerationConfigSchema, F as sdkConfigV1GoModulePathSchema, H as sdkConfigV1JavaGenerationConfigSchema, N as sdkConfigV1KotlinGenerationConfigSchema, Q as sdkConfigV1McpGenerationConfigSchema, U as sdkConfigV1NonEmptyStringSchema, W as sdkConfigV1PhpGenerationConfigSchema, X as sdkConfigV1PythonGenerationConfigSchema, Y as sdkConfigV1RelativePathSchema, Z as sdkConfigV1RubyGenerationConfigSchema, _ as sdkConfigV1RustGenerationConfigSchema, $ as sdkConfigV1SwiftGenerationConfigSchema, a0 as sdkConfigV1TerraformGenerationConfigSchema, a1 as sdkConfigV1TypescriptGenerationConfigSchema } from '../typescript-BFRxjAah.js';
 import 'zod';

package/dist/sdk-config/index.js

@@ -508,7 +508,10 @@ var cliDistributionConfigSchema = z.strictObject({
     "A GitHub App used to mint short-lived tokens for every channel without its own tokenSecretName."
   ),
   homebrew: cliDistributionHomebrewSchema.optional().describe("Publishes a Homebrew formula to a tap repository on each tagged release."),
-  scoop: cliDistributionScoopSchema.optional().describe("Publishes a Scoop manifest to a bucket repository on each tagged release.")
+  scoop: cliDistributionScoopSchema.optional().describe("Publishes a Scoop manifest to a bucket repository on each tagged release."),
+  githubAttestations: z.union([z.literal("auto"), z.boolean()], { error: 'must be "auto", true, or false' }).optional().describe(
+    'Whether the generated release workflow attests build provenance. "auto" (the generator default) attests only on public repositories; true always attests, for private repositories on GitHub Enterprise Cloud; false omits the attestation step and its permissions.'
+  )
 }).superRefine((distribution, context) => {
   if (distribution.homebrew !== void 0 || distribution.scoop !== void 0) {
     return;
@@ -521,6 +524,9 @@ var cliDistributionConfigSchema = z.strictObject({
     });
     return;
   }
+  if (distribution.githubAttestations !== void 0) {
+    return;
+  }
   context.addIssue({
     code: "custom",
     message: "distribution must configure at least one channel: homebrew or scoop"
@@ -532,14 +538,17 @@ var CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE"
 var nonReleaseGithubModes = /* @__PURE__ */ new Set(["pull-request", "push", "commit"]);
 function cliDistributionModeDiagnostic(output, outputPath) {
   const mode = output?.github?.mode;
-  if (output?.distribution === void 0 || mode === void 0 || !nonReleaseGithubModes.has(mode)) {
+  const distribution = output?.distribution;
+  if (distribution === void 0 || mode === void 0 || !nonReleaseGithubModes.has(mode)) {
     return void 0;
   }
+  const hasChannel = distribution.homebrew !== void 0 || distribution.scoop !== void 0;
+  const consequence = hasChannel ? "Homebrew and Scoop publish only after a semantic-version tag is pushed to the repository." : "the release workflow, including its githubAttestations setting, runs only after a semantic-version tag is pushed to the repository.";
   return {
     code: CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE,
     severity: "warning",
     path: [...outputPath, "github", "mode"],
-    reason: `GitHub mode "${mode}" does not create a release tag, so Homebrew and Scoop publish only after a semantic-version tag is pushed to the repository.`,
+    reason: `GitHub mode "${mode}" does not create a release tag, so ${consequence}`,
     suggestedAction: 'Use mode "release" or "commit-and-release", or push a version tag after merging generated changes.'
   };
 }
@@ -974,6 +983,7 @@ var DISTRIBUTION_KEYS = {
   homebrew: { tap: "tap", formula: "formula", tokenEnvironmentVariable: "tokenSecretName" },
   scoop: { bucket: "bucket", tokenEnvironmentVariable: "tokenSecretName" }
 };
+var DISTRIBUTION_SCALAR_KEYS = ["githubAttestations"];
 function mapCliDistribution(config, state, basePath, targetIndex) {
   if (!Object.hasOwn(config, "distribution")) return;
   const raw = config.distribution;
@@ -1020,6 +1030,11 @@ function translateDistribution(distribution, path) {
     }
     value[block] = translatedBlock;
   }
+  for (const key of DISTRIBUTION_SCALAR_KEYS) {
+    if (!Object.hasOwn(distribution, key)) continue;
+    value[key] = distribution[key];
+    consumedPaths.push([...path, key]);
+  }
   return { value, consumedPaths, legacyKeys };
 }
 function invalidDistributionDiagnostic(issue, path, legacyKeys, targetIndex) {
@@ -1159,6 +1174,7 @@ function mapOutput(generator, language, index) {
         output.publishV2,
         rawOutput,
         language,
+        "zip",
         [...outputPath, "publishV2"],
         state,
         index
@@ -1180,6 +1196,7 @@ function mapOutput(generator, language, index) {
         output.registryOverrides,
         rawOutput,
         language,
+        "zip",
         [...outputPath, "registryOverrides"],
         state,
         index
@@ -1207,7 +1224,14 @@ function mapOutput(generator, language, index) {
   }
 }
 function sanitizeNormalizedOutput(output, rawOutput, state, index) {
-  const publish = output.publish ? sanitizePublishConfig(output.publish, output.publish, rawOutput, state, index) : void 0;
+  const publish = output.publish ? sanitizePublishConfig(
+    output.publish,
+    output.publish,
+    rawOutput,
+    output.delivery,
+    state,
+    index
+  ) : void 0;
   const publishShape = publish ? { publish } : {};
   if (output.delivery !== "github") return { ...output, ...publishShape };
   const { credentials, ...github } = output.github;
@@ -1234,13 +1258,22 @@ function githubOutput(value, publishInfo, rawOutput, language, sourcePath, state
     );
   consume(state, [...sourcePath, "owner"]);
   consume(state, [...sourcePath, "repo"]);
-  const publication = publishInfo ? mapPublication(publishInfo, rawOutput, language, [...sourcePath, "publishInfo"], state, index) : void 0;
+  const publication = publishInfo ? mapPublication(
+    publishInfo,
+    rawOutput,
+    language,
+    "github",
+    [...sourcePath, "publishInfo"],
+    state,
+    index
+  ) : void 0;
   const type = stringValue(value.type);
   const licensePackage = mapGithubLicense(value.license, [...sourcePath, "license"], state);
   const reviewers = mapReviewers(value.reviewers, [...sourcePath, "reviewers"], state);
   if (type) consume(state, [...sourcePath, "type"]);
   if (typeof value.makePr === "boolean") consume(state, [...sourcePath, "makePr"]);
-  if (value.workflows === true) consume(state, [...sourcePath, "workflows"]);
+  const workflows = typeof value.workflows === "boolean" ? value.workflows : void 0;
+  if (workflows !== void 0) consume(state, [...sourcePath, "workflows"]);
   if (stringValue(value.host)) consume(state, [...sourcePath, "host"]);
   if (stringValue(value.branch)) consume(state, [...sourcePath, "branch"]);
   consumeCredentialObject(value.credentials, [...sourcePath, "credentials"], state);
@@ -1260,7 +1293,8 @@ function githubOutput(value, publishInfo, rawOutput, language, sourcePath, state
         ...optional("host", stringValue(value.host)),
         ...optional("branch", stringValue(value.branch)),
         mode: value.makePr === true || type === "pullRequest" ? "pull-request" : type === "push" ? "push" : "release",
-        ...optional("reviewers", reviewers)
+        ...optional("reviewers", reviewers),
+        ...workflows === false ? { workflows } : {}
       },
       ...publication ? { publish: publication.publish } : {}
     },
@@ -1327,7 +1361,7 @@ function reviewerNames(value, expectedType, sourcePath, state) {
   });
   return names.length ? names : void 0;
 }
-function mapPublication(value, rawOutput, language, sourcePath, state, index) {
+function mapPublication(value, rawOutput, language, delivery, sourcePath, state, index) {
   if (!isObject(value))
     fail(
       "FERN_PUBLICATION_INVALID",
@@ -1348,6 +1382,7 @@ function mapPublication(value, rawOutput, language, sourcePath, state, index) {
     compact({ registry, url: registryUrl }),
     nested,
     rawOutput,
+    delivery,
     state,
     index
   );
@@ -1368,7 +1403,7 @@ function mapPublication(value, rawOutput, language, sourcePath, state, index) {
     ...packageName || Object.keys(metadata).length ? { package: { ...optional("packageName", packageName), ...metadata } } : {}
   };
 }
-function sanitizePublishConfig(publish, resolvedPublication, rawOutput, state, index) {
+function sanitizePublishConfig(publish, resolvedPublication, rawOutput, delivery, state, index) {
   const rawPublication = rawOutput?.location === publish.registry ? rawOutput : void 0;
   const rawPath = ["group", "generators", index, "output"];
   if (publish.registry === "npm" || publish.registry === "crates") {
@@ -1464,6 +1499,33 @@ function sanitizePublishConfig(publish, resolvedPublication, rawOutput, state, i
       signature
     });
   }
+  if (publish.registry === "nuget" || publish.registry === "rubygems") {
+    const apiKey = mapApiKeyExpression(
+      publish.registry,
+      rawPublication,
+      resolvedPublication,
+      rawPath,
+      state,
+      index,
+      fernDefaultApiKey(publish.registry, rawOutput, delivery)
+    );
+    warnForUnexpectedCredentialFields(
+      rawPublication,
+      resolvedPublication,
+      ["apiKey"],
+      rawPath,
+      state,
+      index
+    );
+    return compact({
+      registry: publish.registry,
+      url: publish.url,
+      releaseBranch: publish.releaseBranch,
+      tolerateRepublish: publish.tolerateRepublish,
+      apiKey,
+      trustedPublishing: usesTrustedPublishing(rawPublication) || void 0
+    });
+  }
   warnForUnrepresentableCredentials(rawPublication, resolvedPublication, rawPath, state, index);
   return compact({
     registry: publish.registry,
@@ -1472,11 +1534,19 @@ function sanitizePublishConfig(publish, resolvedPublication, rawOutput, state, i
     tolerateRepublish: publish.tolerateRepublish
   });
 }
-function mapLegacyPublication(value, rawOutput, language, sourcePath, state, index) {
+function mapLegacyPublication(value, rawOutput, language, delivery, sourcePath, state, index) {
   const registry = defaultRegistry(language, sourcePath, index);
   const overrides = isObject(value) ? value : {};
   const override = isObject(overrides[registry]) ? overrides[registry] : {};
-  return mapPublication(override, rawOutput, language, [...sourcePath, registry], state, index);
+  return mapPublication(
+    override,
+    rawOutput,
+    language,
+    delivery,
+    [...sourcePath, registry],
+    state,
+    index
+  );
 }
 function mapCredentialExpression(rawPublication, resolvedPublication, field, rawPath, state, index) {
   const rawValue = rawPublication?.[field];
@@ -1491,6 +1561,45 @@ function mapCredentialExpression(rawPublication, resolvedPublication, field, raw
   }
   return void 0;
 }
+var TRUSTED_PUBLISHING_VALUES = /* @__PURE__ */ new Set(["OIDC", "<USE_OIDC>"]);
+function rawApiKeyValue(raw) {
+  return raw?.apiKey ?? raw?.["api-key"];
+}
+function usesTrustedPublishing(rawPublication) {
+  const rawValue = rawApiKeyValue(rawPublication);
+  return typeof rawValue === "string" && TRUSTED_PUBLISHING_VALUES.has(rawValue);
+}
+function mapApiKeyExpression(registry, rawPublication, resolvedPublication, rawPath, state, index, defaultSecretName) {
+  const rawValue = rawApiKeyValue(rawPublication);
+  if (isEnvironmentExpression(rawValue)) return rawValue;
+  if (usesTrustedPublishing(rawPublication)) return void 0;
+  if (defaultSecretName !== void 0) return defaultSecretName;
+  if (rawValue === void 0 && !hasResolvedCredential(resolvedPublication, "apiKey")) {
+    return void 0;
+  }
+  addCredentialDiagnostic(
+    state,
+    [...rawPath, "apiKey"],
+    ["targets", index, "output", "publish", "apiKey"],
+    apiKeyOmissionReason(registry)
+  );
+  return void 0;
+}
+function apiKeyOmissionReason(registry) {
+  const label = registry === "nuget" ? "NuGet" : "RubyGems";
+  return `Fern ${label} apiKey is not an exact environment expression naming a secret`;
+}
+var FERN_DEFAULT_NUGET_API_KEY = "${NUGET_API_TOKEN}";
+function fernDefaultApiKey(registry, rawOutput, delivery) {
+  if (registry !== "nuget" || delivery !== "github" || rawOutput?.location !== "nuget") {
+    return void 0;
+  }
+  const rawApiKey = rawApiKeyValue(rawOutput);
+  if (typeof rawApiKey === "string" && TRUSTED_PUBLISHING_VALUES.has(rawApiKey)) {
+    return void 0;
+  }
+  return FERN_DEFAULT_NUGET_API_KEY;
+}
 function mapPypiCredentialExpressions(rawPublication, resolvedPublication, rawPath, state, index) {
   const rawToken = rawPublication?.token;
   if (isEnvironmentExpression(rawToken)) {
@@ -2194,6 +2303,29 @@ var mavenSignatureSchema = z.strictObject({
     "The armored secret key, or an environment expression that resolves to it."
   )
 });
+function apiKeySecretSchema(registry, example) {
+  return nonEmptyStringSchema.regex(
+    /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/,
+    `${registry} apiKey must be an environment expression naming a secret, such as ${example}`
+  );
+}
+function apiKeySecretDescription(registry, example) {
+  return `An environment expression naming the repository secret that the generated release workflow reads the ${registry} API key from, such as ${example}. This is a secret name, never the key itself.`;
+}
+function trustedPublishingSchema(registry) {
+  return z.boolean().optional().describe(
+    `Whether ${registry} publication uses trusted publishing (OIDC) instead of an API key secret.`
+  );
+}
+function refineApiKeyAgainstTrustedPublishing(publish, context) {
+  if (publish.trustedPublishing === true && publish.apiKey !== void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "apiKey must be omitted when trustedPublishing is true",
+      path: ["apiKey"]
+    });
+  }
+}
 var commonPublishShape = {
   url: nonEmptyStringSchema.optional().describe("A custom package registry URL."),
   releaseBranch: nonEmptyStringSchema.optional().describe("The branch used by generated package release workflows."),
@@ -2229,12 +2361,16 @@ var sdkConfigV1PublishConfigSchema = z.discriminatedUnion("registry", [
   }),
   z.strictObject({
     registry: z.literal("nuget").describe("Publishes the package to a NuGet-compatible registry."),
+    apiKey: apiKeySecretSchema("NuGet", "${NUGET_API_KEY}").optional().describe(apiKeySecretDescription("NuGet", "${NUGET_API_KEY}")),
+    trustedPublishing: trustedPublishingSchema("NuGet"),
     ...commonPublishShape
-  }),
+  }).superRefine(refineApiKeyAgainstTrustedPublishing),
   z.strictObject({
     registry: z.literal("rubygems").describe("Publishes the package to a RubyGems-compatible registry."),
+    apiKey: apiKeySecretSchema("RubyGems", "${RUBYGEMS_API_KEY}").optional().describe(apiKeySecretDescription("RubyGems", "${RUBYGEMS_API_KEY}")),
+    trustedPublishing: trustedPublishingSchema("RubyGems"),
     ...commonPublishShape
-  }),
+  }).superRefine(refineApiKeyAgainstTrustedPublishing),
   z.strictObject({
     registry: z.literal("crates").describe("Publishes the crate to a Cargo-compatible registry."),
     token: nonEmptyStringSchema.optional().describe("The Cargo registry token, or an environment expression that resolves to it."),
@@ -2268,7 +2404,10 @@ var githubOutputSchema = z.strictObject({
   mode: z.enum(["release", "pull-request", "push", "commit", "commit-and-release"]).optional().describe("How generated changes are delivered to the repository."),
   reviewers: reviewersSchema.optional().describe("Reviewers requested for generated pull requests."),
   credentials: githubCredentialsSchema.optional().describe("Credentials used to authenticate GitHub delivery."),
-  privateRepository: z.boolean().optional().describe("Whether the destination repository is private.")
+  privateRepository: z.boolean().optional().describe("Whether the destination repository is private."),
+  workflows: z.boolean().optional().describe(
+    "Whether generated .github/workflows files are delivered. Defaults to true. When false, newly generated workflow files are skipped and existing ones in the repository are left untouched."
+  )
 });
 var filesOutputSchema = z.strictObject({
   delivery: z.literal("files").describe("Writes the generated SDK to a directory."),
@@ -2292,7 +2431,7 @@ var sdkConfigV1OutputConfigSchema = z.discriminatedUnion(
 );
 var cliDistributionShape = {
   distribution: cliDistributionConfigSchema.optional().describe(
-    "CLI release channels published by the generated release workflow; credentials are GitHub Actions secret names."
+    "CLI release channels and build attestation settings for the generated release workflow; credentials are GitHub Actions secret names."
   )
 };
 function rejectDistributionWithoutGithub(output, context) {
@@ -2338,6 +2477,9 @@ var apiImportSettingsSchema = z.strictObject({
   discriminatedUnionV2: z.boolean().optional().describe("Whether oneOf and anyOf schemas use the newer discriminator inference rules."),
   undiscriminatedUnionsWithLiterals: z.boolean().optional().describe("Whether literal-bearing unions remain undiscriminated during import."),
   inlineAllOfSchemas: z.boolean().optional().describe("Whether schemas composed with allOf are inlined when possible."),
+  inferDiscriminatedUnionBaseProperties: z.boolean().optional().describe(
+    "Whether properties every discriminated-union variant shares are lifted onto the union."
+  ),
   resolveSchemaCollisions: z.boolean().optional().describe("Whether colliding imported schema names are resolved automatically."),
   asyncApiMessageNaming: z.enum(["v1", "v2"]).optional().describe("The naming strategy used for messages imported from AsyncAPI."),
   defaultIntegerFormat: z.enum(["int32", "int64", "uint32", "uint64"]).optional().describe("The integer format used when a schema does not declare one.")
@@ -2556,7 +2698,7 @@ var pythonGenerationConfigSchema = z.strictObject({
   additionalInitExports: z.array(additionalInitExportSchema).optional().describe("Additional names re-exported from the package initializer.")
 });
 var rubyGenerationConfigSchema = z.strictObject({
-  requirePaths: z.array(nonEmptyStringSchema).optional().describe("Ruby load paths included in the generated gem specification.")
+  requirePaths: z.array(nonEmptyStringSchema).optional().describe("Files the generated entry file loads with `require`.")
 });
 var rustGenerationConfigSchema = z.strictObject({
   /**
@@ -3287,7 +3429,12 @@ function mapCommonConfig(language, config, state, client, generation, packageCon
   }
   const pythonClient = language === "python" ? takeObject(config, ["client"], state, basePath) : void 0;
   const typescriptNaming = language === "typescript" || language === "mcp" ? takeObject(config, ["naming"], state, basePath) : void 0;
-  const directClientName = takeString(config, ["clientName", "clientClassName"], state, basePath);
+  const directClientName = takeString(
+    config,
+    language === "ruby" ? ["clientName"] : ["clientName", "clientClassName"],
+    state,
+    basePath
+  );
   const nestedClientName = pythonClient ? takeString(pythonClient.value, ["className"], state, pythonClient.path) : typescriptNaming ? takeString(typescriptNaming.value, ["client"], state, typescriptNaming.path) : language === "ruby" ? (
     // Fern's Ruby generator renames the root client class (`Auth0::Management`) with it.
     takeString(config, ["clientModuleName"], state, basePath)