@postman/sdk-config 0.3.1 → 0.3.2

package/README.md

@@ -3,9 +3,10 @@
 Build and validate SDK Config documents for SDK Generation API requests.
 
 SDK Config describes what to generate: API source provenance, SDK identity, API behavior, client
-behavior, package metadata, documentation, output, shared generation options, and one or more
-language targets. The materialized API source bytes, authentication, idempotency, and transport
-metadata belong to the SDK Generation API request rather than the SDK Config document.
+behavior, package metadata, documentation, output, shared generation options, optional publishing
+credentials/signing material, and one or more language targets. The materialized API source bytes,
+idempotency, and transport metadata belong to the SDK Generation API request rather than the SDK
+Config document.
 
 ## Install
 
@@ -70,7 +71,10 @@ if (!result.success) {
 ```
 
 SDK Config objects are strict. Unknown fields, duplicate language targets, incompatible package
-publication settings, and non-exact generator versions are rejected.
+publication settings, and non-exact generator versions are rejected. Publishing credentials and
+signing material may be provided under `output.publish.credentials`, Maven
+`output.publish.signature`, or `output.github.credentials`; these fields can contain raw secrets and
+must be handled accordingly by clients and servers.
 
 `SdkConfigV1` accepts customer-facing local source paths and HTTP(S) source URLs, but not
 server-owned signed URLs or artifact metadata. See the

package/dist/index.cjs

@@ -711,6 +711,7 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
   if (typeof value.makePr === "boolean") consume(state, [...sourcePath, "makePr"]);
   if (stringValue(value.host)) consume(state, [...sourcePath, "host"]);
   if (stringValue(value.branch)) consume(state, [...sourcePath, "branch"]);
+  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
   return {
     output: {
       delivery: "github",
@@ -719,13 +720,58 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
         ...optional("host", stringValue(value.host)),
         ...optional("branch", stringValue(value.branch)),
         mode: value.makePr === true || type === "pullRequest" ? "pull-request" : type === "push" ? "push" : "release",
-        ...optional("reviewers", reviewers)
+        ...optional("reviewers", reviewers),
+        ...optional("credentials", credentials)
       },
       ...publication ? { publish: publication.publish } : {}
     },
     ...optional("package", publication?.package)
   };
 }
+function mapCredentials(value, sourcePath, state) {
+  if (!isObject(value)) return void 0;
+  return credentialsFromObject(value, sourcePath, state);
+}
+function mapInlineCredentials(value, sourcePath, state) {
+  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
+  if (credentials) return credentials;
+  return credentialsFromObject(value, sourcePath, state);
+}
+function credentialsFromObject(value, sourcePath, state) {
+  const credentials = {};
+  const username = stringValue(value.username);
+  const password = stringValue(value.password);
+  const token = stringValue(value.token);
+  const apiKey = stringValue(value.apiKey);
+  if (username) {
+    credentials.username = username;
+    consume(state, [...sourcePath, "username"]);
+  }
+  if (password) {
+    credentials.password = password;
+    consume(state, [...sourcePath, "password"]);
+  }
+  if (token) {
+    credentials.token = token;
+    consume(state, [...sourcePath, "token"]);
+  }
+  if (apiKey) {
+    credentials.apiKey = apiKey;
+    consume(state, [...sourcePath, "apiKey"]);
+  }
+  return Object.keys(credentials).length === 0 ? void 0 : credentials;
+}
+function mapMavenSignature(value, sourcePath, state) {
+  if (!isObject(value)) return void 0;
+  const keyId = stringValue(value.keyId);
+  const password = stringValue(value.password);
+  const secretKey = stringValue(value.secretKey);
+  if (!keyId || !password || !secretKey) return void 0;
+  consume(state, [...sourcePath, "keyId"]);
+  consume(state, [...sourcePath, "password"]);
+  consume(state, [...sourcePath, "secretKey"]);
+  return { keyId, password, secretKey };
+}
 function mapReviewers(value, sourcePath, state) {
   if (Array.isArray(value)) {
     const teams2 = reviewerNames(value, "team", sourcePath, state);
@@ -769,11 +815,13 @@ function mapPublication(value, language, sourcePath, state, index) {
   const registry = publicationRegistry(type, language, [...sourcePath, "type"], index);
   const registryUrl = stringValue(nested.registryUrl);
   if (registryUrl) consume(state, [...nestedPath, "registryUrl"]);
+  const credentials = mapInlineCredentials(nested, nestedPath, state);
   if (registry === "maven") {
     const coordinate = stringValue(nested.coordinate);
+    const signature = mapMavenSignature(nested.signature, [...nestedPath, "signature"], state);
     if (coordinate) consume(state, [...nestedPath, "coordinate"]);
     return {
-      publish: compact({ registry, url: registryUrl }),
+      publish: compact({ registry, url: registryUrl, credentials, signature }),
       ...coordinate ? { package: mavenPackage(coordinate, [...nestedPath, "coordinate"], index) } : {}
     };
   }
@@ -782,7 +830,7 @@ function mapPublication(value, language, sourcePath, state, index) {
   if (packageName) consume(state, [...nestedPath, packageNameField]);
   const metadata = registry === "pypi" ? mapPypiMetadata(nested.pypiMetadata, nestedPath, state) : {};
   return {
-    publish: compact({ registry, url: registryUrl }),
+    publish: compact({ registry, url: registryUrl, credentials }),
     ...packageName || Object.keys(metadata).length ? { package: { ...optional("packageName", packageName), ...metadata } } : {}
   };
 }
@@ -899,7 +947,11 @@ function finishOutputMapping(mapping, outputMode, sourcePath, state, index) {
           code: "FERN_OUTPUT_CREDENTIAL_UNSUPPORTED",
           severity: "warning",
           path: sourcePath,
-          reason: "Fern output credentials and signatures are intentionally excluded from SDK Config v1",
+          // This diagnostic only captures credential/signature fields that remained
+          // unconsumed after mapping supported registry/GitHub credentials into
+          // SDK Config v1. Supported credential shapes are carried through; this
+          // warning is about the remaining legacy-only credential fields.
+          reason: "Some Fern output credentials and signatures are intentionally excluded from SDK Config v1 when they cannot be represented in the public schema",
           suggestedAction: "Provide publishing credentials through the build request or external secret resolution."
         }
       ] : [],
@@ -1119,15 +1171,33 @@ var sdkConfigV1PublishRegistrySchema = zod.z.enum([
   "go",
   "composer"
 ]);
+var registryCredentialsSchema = zod.z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
+var mavenSignatureSchema = zod.z.strictObject({
+  keyId: nonEmptyStringSchema,
+  password: nonEmptyStringSchema,
+  secretKey: nonEmptyStringSchema
+});
 var commonPublishShape = {
   url: nonEmptyStringSchema.optional(),
+  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema.optional(),
   releaseBranch: nonEmptyStringSchema.optional(),
   tolerateRepublish: zod.z.boolean().optional()
 };
 var sdkConfigV1PublishConfigSchema = zod.z.discriminatedUnion("registry", [
   zod.z.strictObject({ registry: zod.z.literal("npm"), ...commonPublishShape }),
   zod.z.strictObject({ registry: zod.z.literal("pypi"), ...commonPublishShape }),
-  zod.z.strictObject({ registry: zod.z.literal("maven"), ...commonPublishShape }),
+  zod.z.strictObject({
+    registry: zod.z.literal("maven"),
+    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    signature: mavenSignatureSchema.optional(),
+    ...commonPublishShape
+  }),
   zod.z.strictObject({ registry: zod.z.literal("nuget"), ...commonPublishShape }),
   zod.z.strictObject({ registry: zod.z.literal("rubygems"), ...commonPublishShape }),
   zod.z.strictObject({ registry: zod.z.literal("crates"), ...commonPublishShape }),
@@ -1138,12 +1208,15 @@ var reviewersSchema = zod.z.strictObject({
   teams: zod.z.array(nonEmptyStringSchema).optional(),
   users: zod.z.array(nonEmptyStringSchema).optional()
 });
+var githubCredentialsSchema = registryCredentialsSchema;
 var githubOutputSchema = zod.z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
   branch: nonEmptyStringSchema.optional(),
-  mode: zod.z.enum(["release", "pull-request", "push"]).optional(),
+  mode: zod.z.enum(["release", "pull-request", "push", "commit", "commit-and-release"]).optional(),
   reviewers: reviewersSchema.optional(),
+  /** Raw GitHub credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: githubCredentialsSchema.optional(),
   privateRepository: zod.z.boolean().optional()
 });
 var filesOutputSchema = zod.z.strictObject({
@@ -2539,13 +2612,18 @@ var credentialResolutionSchema = zod.z.enum([
   "resolved-by-orchestrator",
   "resolved-by-fiddle"
 ]);
+var registryCredentialsSchema2 = zod.z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
 var commonPublishShape2 = {
   url: nonEmptyStringSchema.optional(),
-  /**
-   * Reference to registry publishing credentials. Raw tokens/passwords are intentionally not part of
-   * SDK Config IR; the external publisher or orchestrator resolves this reference before use.
-   */
+  /** Reference to registry publishing credentials. */
   credentialsRef: nonEmptyStringSchema.optional(),
+  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema2.optional(),
   /**
    * Registry-specific package version override. If omitted, the external publisher/orchestrator may
    * fall back to target.sdkVersion.
@@ -2569,6 +2647,11 @@ var mavenSignatureEnvironmentSchema = zod.z.strictObject({
   passwordEnvironmentVariable: nonEmptyStringSchema.optional(),
   secretKeyEnvironmentVariable: nonEmptyStringSchema.optional()
 });
+var mavenSignatureSchema2 = zod.z.strictObject({
+  keyId: nonEmptyStringSchema,
+  password: nonEmptyStringSchema,
+  secretKey: nonEmptyStringSchema
+});
 var publishConfigSchema = zod.z.discriminatedUnion("registry", [
   zod.z.strictObject({
     registry: zod.z.literal("npm"),
@@ -2614,11 +2697,10 @@ var publishConfigSchema = zod.z.discriminatedUnion("registry", [
     passwordEnvironmentVariable: nonEmptyStringSchema.optional(),
     mavenUrlEnvironmentVariable: nonEmptyStringSchema.optional(),
     signatureEnvironmentVariables: mavenSignatureEnvironmentSchema.optional(),
-    /**
-     * Reference to Maven signing credentials. Raw signing keys are intentionally not part of SDK
-     * Config IR; the external publisher or orchestrator resolves this reference before use.
-     */
+    /** Reference to Maven signing credentials. */
     signingCredentialsRef: nonEmptyStringSchema.optional(),
+    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    signature: mavenSignatureSchema2.optional(),
     ...commonPublishShape2
   })
 ]);
@@ -2629,18 +2711,27 @@ var reviewersSchema2 = zod.z.strictObject({
 var replayControlSchema = zod.z.strictObject({
   enabled: zod.z.boolean()
 });
+var githubLicenseSchema = zod.z.strictObject({
+  /** SPDX identifier or license key for the repository license (for example, "MIT"). */
+  type: nonEmptyStringSchema.optional(),
+  /** Path to a custom license file to be committed into the GitHub repository. */
+  customPath: nonEmptyStringSchema.optional()
+}).refine((value) => value.type !== void 0 || value.customPath !== void 0, {
+  message: "GitHub license must set type or customPath"
+});
 var githubOutputSchema2 = zod.z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
   branch: nonEmptyStringSchema.optional(),
-  mode: zod.z.enum(["release", "pull-request", "push"]).optional(),
+  mode: zod.z.enum(["release", "pull-request", "push", "commit", "commit-and-release"]).optional(),
   reviewers: reviewersSchema2.optional(),
-  /**
-   * Reference to GitHub credentials. Raw tokens are intentionally not part of SDK Config IR; the
-   * external publisher or orchestrator resolves this reference before use.
-   */
+  /** Reference to GitHub credentials. */
   credentialsRef: nonEmptyStringSchema.optional(),
+  /** Raw GitHub credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema2.optional(),
   privateRepository: zod.z.boolean().optional(),
+  /** GitHub license block scoped to repository delivery. */
+  license: githubLicenseSchema.optional(),
   /** GitHub replay control. If omitted, the external publisher applies its default behavior. */
   replay: replayControlSchema.optional(),
   /** Run GitHub publishing verification. Defaults to false to match current Fiddle job behavior. */
@@ -2651,10 +2742,7 @@ var githubOutputSchema2 = zod.z.strictObject({
   autoMerge: zod.z.boolean().default(false)
 });
 var credentialResolutionShape = {
-  /**
-   * Where output credential references are resolved. SDK Config IR carries refs only; raw resolved
-   * credentials belong at the external publisher/orchestrator boundary, not in this config.
-   */
+  /** Where output credential references are resolved. */
   credentialResolution: credentialResolutionSchema.default("refs-only")
 };
 var filesOutputSchema2 = zod.z.strictObject({