@postman/sdk-config 0.3.1 → 0.3.2

package/dist/index.js

@@ -705,6 +705,7 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
   if (typeof value.makePr === "boolean") consume(state, [...sourcePath, "makePr"]);
   if (stringValue(value.host)) consume(state, [...sourcePath, "host"]);
   if (stringValue(value.branch)) consume(state, [...sourcePath, "branch"]);
+  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
   return {
     output: {
       delivery: "github",
@@ -713,13 +714,58 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
         ...optional("host", stringValue(value.host)),
         ...optional("branch", stringValue(value.branch)),
         mode: value.makePr === true || type === "pullRequest" ? "pull-request" : type === "push" ? "push" : "release",
-        ...optional("reviewers", reviewers)
+        ...optional("reviewers", reviewers),
+        ...optional("credentials", credentials)
       },
       ...publication ? { publish: publication.publish } : {}
     },
     ...optional("package", publication?.package)
   };
 }
+function mapCredentials(value, sourcePath, state) {
+  if (!isObject(value)) return void 0;
+  return credentialsFromObject(value, sourcePath, state);
+}
+function mapInlineCredentials(value, sourcePath, state) {
+  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
+  if (credentials) return credentials;
+  return credentialsFromObject(value, sourcePath, state);
+}
+function credentialsFromObject(value, sourcePath, state) {
+  const credentials = {};
+  const username = stringValue(value.username);
+  const password = stringValue(value.password);
+  const token = stringValue(value.token);
+  const apiKey = stringValue(value.apiKey);
+  if (username) {
+    credentials.username = username;
+    consume(state, [...sourcePath, "username"]);
+  }
+  if (password) {
+    credentials.password = password;
+    consume(state, [...sourcePath, "password"]);
+  }
+  if (token) {
+    credentials.token = token;
+    consume(state, [...sourcePath, "token"]);
+  }
+  if (apiKey) {
+    credentials.apiKey = apiKey;
+    consume(state, [...sourcePath, "apiKey"]);
+  }
+  return Object.keys(credentials).length === 0 ? void 0 : credentials;
+}
+function mapMavenSignature(value, sourcePath, state) {
+  if (!isObject(value)) return void 0;
+  const keyId = stringValue(value.keyId);
+  const password = stringValue(value.password);
+  const secretKey = stringValue(value.secretKey);
+  if (!keyId || !password || !secretKey) return void 0;
+  consume(state, [...sourcePath, "keyId"]);
+  consume(state, [...sourcePath, "password"]);
+  consume(state, [...sourcePath, "secretKey"]);
+  return { keyId, password, secretKey };
+}
 function mapReviewers(value, sourcePath, state) {
   if (Array.isArray(value)) {
     const teams2 = reviewerNames(value, "team", sourcePath, state);
@@ -763,11 +809,13 @@ function mapPublication(value, language, sourcePath, state, index) {
   const registry = publicationRegistry(type, language, [...sourcePath, "type"], index);
   const registryUrl = stringValue(nested.registryUrl);
   if (registryUrl) consume(state, [...nestedPath, "registryUrl"]);
+  const credentials = mapInlineCredentials(nested, nestedPath, state);
   if (registry === "maven") {
     const coordinate = stringValue(nested.coordinate);
+    const signature = mapMavenSignature(nested.signature, [...nestedPath, "signature"], state);
     if (coordinate) consume(state, [...nestedPath, "coordinate"]);
     return {
-      publish: compact({ registry, url: registryUrl }),
+      publish: compact({ registry, url: registryUrl, credentials, signature }),
       ...coordinate ? { package: mavenPackage(coordinate, [...nestedPath, "coordinate"], index) } : {}
     };
   }
@@ -776,7 +824,7 @@ function mapPublication(value, language, sourcePath, state, index) {
   if (packageName) consume(state, [...nestedPath, packageNameField]);
   const metadata = registry === "pypi" ? mapPypiMetadata(nested.pypiMetadata, nestedPath, state) : {};
   return {
-    publish: compact({ registry, url: registryUrl }),
+    publish: compact({ registry, url: registryUrl, credentials }),
     ...packageName || Object.keys(metadata).length ? { package: { ...optional("packageName", packageName), ...metadata } } : {}
   };
 }
@@ -893,7 +941,11 @@ function finishOutputMapping(mapping, outputMode, sourcePath, state, index) {
           code: "FERN_OUTPUT_CREDENTIAL_UNSUPPORTED",
           severity: "warning",
           path: sourcePath,
-          reason: "Fern output credentials and signatures are intentionally excluded from SDK Config v1",
+          // This diagnostic only captures credential/signature fields that remained
+          // unconsumed after mapping supported registry/GitHub credentials into
+          // SDK Config v1. Supported credential shapes are carried through; this
+          // warning is about the remaining legacy-only credential fields.
+          reason: "Some Fern output credentials and signatures are intentionally excluded from SDK Config v1 when they cannot be represented in the public schema",
           suggestedAction: "Provide publishing credentials through the build request or external secret resolution."
         }
       ] : [],
@@ -1113,15 +1165,33 @@ var sdkConfigV1PublishRegistrySchema = z.enum([
   "go",
   "composer"
 ]);
+var registryCredentialsSchema = z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
+var mavenSignatureSchema = z.strictObject({
+  keyId: nonEmptyStringSchema,
+  password: nonEmptyStringSchema,
+  secretKey: nonEmptyStringSchema
+});
 var commonPublishShape = {
   url: nonEmptyStringSchema.optional(),
+  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema.optional(),
   releaseBranch: nonEmptyStringSchema.optional(),
   tolerateRepublish: z.boolean().optional()
 };
 var sdkConfigV1PublishConfigSchema = z.discriminatedUnion("registry", [
   z.strictObject({ registry: z.literal("npm"), ...commonPublishShape }),
   z.strictObject({ registry: z.literal("pypi"), ...commonPublishShape }),
-  z.strictObject({ registry: z.literal("maven"), ...commonPublishShape }),
+  z.strictObject({
+    registry: z.literal("maven"),
+    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    signature: mavenSignatureSchema.optional(),
+    ...commonPublishShape
+  }),
   z.strictObject({ registry: z.literal("nuget"), ...commonPublishShape }),
   z.strictObject({ registry: z.literal("rubygems"), ...commonPublishShape }),
   z.strictObject({ registry: z.literal("crates"), ...commonPublishShape }),
@@ -1132,12 +1202,15 @@ var reviewersSchema = z.strictObject({
   teams: z.array(nonEmptyStringSchema).optional(),
   users: z.array(nonEmptyStringSchema).optional()
 });
+var githubCredentialsSchema = registryCredentialsSchema;
 var githubOutputSchema = z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
   branch: nonEmptyStringSchema.optional(),
-  mode: z.enum(["release", "pull-request", "push"]).optional(),
+  mode: z.enum(["release", "pull-request", "push", "commit", "commit-and-release"]).optional(),
   reviewers: reviewersSchema.optional(),
+  /** Raw GitHub credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: githubCredentialsSchema.optional(),
   privateRepository: z.boolean().optional()
 });
 var filesOutputSchema = z.strictObject({
@@ -2533,13 +2606,18 @@ var credentialResolutionSchema = z.enum([
   "resolved-by-orchestrator",
   "resolved-by-fiddle"
 ]);
+var registryCredentialsSchema2 = z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
 var commonPublishShape2 = {
   url: nonEmptyStringSchema.optional(),
-  /**
-   * Reference to registry publishing credentials. Raw tokens/passwords are intentionally not part of
-   * SDK Config IR; the external publisher or orchestrator resolves this reference before use.
-   */
+  /** Reference to registry publishing credentials. */
   credentialsRef: nonEmptyStringSchema.optional(),
+  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema2.optional(),
   /**
    * Registry-specific package version override. If omitted, the external publisher/orchestrator may
    * fall back to target.sdkVersion.
@@ -2563,6 +2641,11 @@ var mavenSignatureEnvironmentSchema = z.strictObject({
   passwordEnvironmentVariable: nonEmptyStringSchema.optional(),
   secretKeyEnvironmentVariable: nonEmptyStringSchema.optional()
 });
+var mavenSignatureSchema2 = z.strictObject({
+  keyId: nonEmptyStringSchema,
+  password: nonEmptyStringSchema,
+  secretKey: nonEmptyStringSchema
+});
 var publishConfigSchema = z.discriminatedUnion("registry", [
   z.strictObject({
     registry: z.literal("npm"),
@@ -2608,11 +2691,10 @@ var publishConfigSchema = z.discriminatedUnion("registry", [
     passwordEnvironmentVariable: nonEmptyStringSchema.optional(),
     mavenUrlEnvironmentVariable: nonEmptyStringSchema.optional(),
     signatureEnvironmentVariables: mavenSignatureEnvironmentSchema.optional(),
-    /**
-     * Reference to Maven signing credentials. Raw signing keys are intentionally not part of SDK
-     * Config IR; the external publisher or orchestrator resolves this reference before use.
-     */
+    /** Reference to Maven signing credentials. */
     signingCredentialsRef: nonEmptyStringSchema.optional(),
+    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    signature: mavenSignatureSchema2.optional(),
     ...commonPublishShape2
   })
 ]);
@@ -2623,18 +2705,27 @@ var reviewersSchema2 = z.strictObject({
 var replayControlSchema = z.strictObject({
   enabled: z.boolean()
 });
+var githubLicenseSchema = z.strictObject({
+  /** SPDX identifier or license key for the repository license (for example, "MIT"). */
+  type: nonEmptyStringSchema.optional(),
+  /** Path to a custom license file to be committed into the GitHub repository. */
+  customPath: nonEmptyStringSchema.optional()
+}).refine((value) => value.type !== void 0 || value.customPath !== void 0, {
+  message: "GitHub license must set type or customPath"
+});
 var githubOutputSchema2 = z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
   branch: nonEmptyStringSchema.optional(),
-  mode: z.enum(["release", "pull-request", "push"]).optional(),
+  mode: z.enum(["release", "pull-request", "push", "commit", "commit-and-release"]).optional(),
   reviewers: reviewersSchema2.optional(),
-  /**
-   * Reference to GitHub credentials. Raw tokens are intentionally not part of SDK Config IR; the
-   * external publisher or orchestrator resolves this reference before use.
-   */
+  /** Reference to GitHub credentials. */
   credentialsRef: nonEmptyStringSchema.optional(),
+  /** Raw GitHub credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema2.optional(),
   privateRepository: z.boolean().optional(),
+  /** GitHub license block scoped to repository delivery. */
+  license: githubLicenseSchema.optional(),
   /** GitHub replay control. If omitted, the external publisher applies its default behavior. */
   replay: replayControlSchema.optional(),
   /** Run GitHub publishing verification. Defaults to false to match current Fiddle job behavior. */
@@ -2645,10 +2736,7 @@ var githubOutputSchema2 = z.strictObject({
   autoMerge: z.boolean().default(false)
 });
 var credentialResolutionShape = {
-  /**
-   * Where output credential references are resolved. SDK Config IR carries refs only; raw resolved
-   * credentials belong at the external publisher/orchestrator boundary, not in this config.
-   */
+  /** Where output credential references are resolved. */
   credentialResolution: credentialResolutionSchema.default("refs-only")
 };
 var filesOutputSchema2 = z.strictObject({