@postman/sdk-config 0.3.1 → 0.3.2

package/dist/sdk-config/index.js

@@ -705,6 +705,7 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
   if (typeof value.makePr === "boolean") consume(state, [...sourcePath, "makePr"]);
   if (stringValue(value.host)) consume(state, [...sourcePath, "host"]);
   if (stringValue(value.branch)) consume(state, [...sourcePath, "branch"]);
+  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
   return {
     output: {
       delivery: "github",
@@ -713,13 +714,58 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
         ...optional("host", stringValue(value.host)),
         ...optional("branch", stringValue(value.branch)),
         mode: value.makePr === true || type === "pullRequest" ? "pull-request" : type === "push" ? "push" : "release",
-        ...optional("reviewers", reviewers)
+        ...optional("reviewers", reviewers),
+        ...optional("credentials", credentials)
       },
       ...publication ? { publish: publication.publish } : {}
     },
     ...optional("package", publication?.package)
   };
 }
+function mapCredentials(value, sourcePath, state) {
+  if (!isObject(value)) return void 0;
+  return credentialsFromObject(value, sourcePath, state);
+}
+function mapInlineCredentials(value, sourcePath, state) {
+  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
+  if (credentials) return credentials;
+  return credentialsFromObject(value, sourcePath, state);
+}
+function credentialsFromObject(value, sourcePath, state) {
+  const credentials = {};
+  const username = stringValue(value.username);
+  const password = stringValue(value.password);
+  const token = stringValue(value.token);
+  const apiKey = stringValue(value.apiKey);
+  if (username) {
+    credentials.username = username;
+    consume(state, [...sourcePath, "username"]);
+  }
+  if (password) {
+    credentials.password = password;
+    consume(state, [...sourcePath, "password"]);
+  }
+  if (token) {
+    credentials.token = token;
+    consume(state, [...sourcePath, "token"]);
+  }
+  if (apiKey) {
+    credentials.apiKey = apiKey;
+    consume(state, [...sourcePath, "apiKey"]);
+  }
+  return Object.keys(credentials).length === 0 ? void 0 : credentials;
+}
+function mapMavenSignature(value, sourcePath, state) {
+  if (!isObject(value)) return void 0;
+  const keyId = stringValue(value.keyId);
+  const password = stringValue(value.password);
+  const secretKey = stringValue(value.secretKey);
+  if (!keyId || !password || !secretKey) return void 0;
+  consume(state, [...sourcePath, "keyId"]);
+  consume(state, [...sourcePath, "password"]);
+  consume(state, [...sourcePath, "secretKey"]);
+  return { keyId, password, secretKey };
+}
 function mapReviewers(value, sourcePath, state) {
   if (Array.isArray(value)) {
     const teams2 = reviewerNames(value, "team", sourcePath, state);
@@ -763,11 +809,13 @@ function mapPublication(value, language, sourcePath, state, index) {
   const registry = publicationRegistry(type, language, [...sourcePath, "type"], index);
   const registryUrl = stringValue(nested.registryUrl);
   if (registryUrl) consume(state, [...nestedPath, "registryUrl"]);
+  const credentials = mapInlineCredentials(nested, nestedPath, state);
   if (registry === "maven") {
     const coordinate = stringValue(nested.coordinate);
+    const signature = mapMavenSignature(nested.signature, [...nestedPath, "signature"], state);
     if (coordinate) consume(state, [...nestedPath, "coordinate"]);
     return {
-      publish: compact({ registry, url: registryUrl }),
+      publish: compact({ registry, url: registryUrl, credentials, signature }),
       ...coordinate ? { package: mavenPackage(coordinate, [...nestedPath, "coordinate"], index) } : {}
     };
   }
@@ -776,7 +824,7 @@ function mapPublication(value, language, sourcePath, state, index) {
   if (packageName) consume(state, [...nestedPath, packageNameField]);
   const metadata = registry === "pypi" ? mapPypiMetadata(nested.pypiMetadata, nestedPath, state) : {};
   return {
-    publish: compact({ registry, url: registryUrl }),
+    publish: compact({ registry, url: registryUrl, credentials }),
     ...packageName || Object.keys(metadata).length ? { package: { ...optional("packageName", packageName), ...metadata } } : {}
   };
 }
@@ -893,7 +941,11 @@ function finishOutputMapping(mapping, outputMode, sourcePath, state, index) {
           code: "FERN_OUTPUT_CREDENTIAL_UNSUPPORTED",
           severity: "warning",
           path: sourcePath,
-          reason: "Fern output credentials and signatures are intentionally excluded from SDK Config v1",
+          // This diagnostic only captures credential/signature fields that remained
+          // unconsumed after mapping supported registry/GitHub credentials into
+          // SDK Config v1. Supported credential shapes are carried through; this
+          // warning is about the remaining legacy-only credential fields.
+          reason: "Some Fern output credentials and signatures are intentionally excluded from SDK Config v1 when they cannot be represented in the public schema",
           suggestedAction: "Provide publishing credentials through the build request or external secret resolution."
         }
       ] : [],
@@ -1113,15 +1165,33 @@ var sdkConfigV1PublishRegistrySchema = z.enum([
   "go",
   "composer"
 ]);
+var registryCredentialsSchema = z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
+var mavenSignatureSchema = z.strictObject({
+  keyId: nonEmptyStringSchema,
+  password: nonEmptyStringSchema,
+  secretKey: nonEmptyStringSchema
+});
 var commonPublishShape = {
   url: nonEmptyStringSchema.optional(),
+  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema.optional(),
   releaseBranch: nonEmptyStringSchema.optional(),
   tolerateRepublish: z.boolean().optional()
 };
 var sdkConfigV1PublishConfigSchema = z.discriminatedUnion("registry", [
   z.strictObject({ registry: z.literal("npm"), ...commonPublishShape }),
   z.strictObject({ registry: z.literal("pypi"), ...commonPublishShape }),
-  z.strictObject({ registry: z.literal("maven"), ...commonPublishShape }),
+  z.strictObject({
+    registry: z.literal("maven"),
+    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    signature: mavenSignatureSchema.optional(),
+    ...commonPublishShape
+  }),
   z.strictObject({ registry: z.literal("nuget"), ...commonPublishShape }),
   z.strictObject({ registry: z.literal("rubygems"), ...commonPublishShape }),
   z.strictObject({ registry: z.literal("crates"), ...commonPublishShape }),
@@ -1132,12 +1202,15 @@ var reviewersSchema = z.strictObject({
   teams: z.array(nonEmptyStringSchema).optional(),
   users: z.array(nonEmptyStringSchema).optional()
 });
+var githubCredentialsSchema = registryCredentialsSchema;
 var githubOutputSchema = z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
   branch: nonEmptyStringSchema.optional(),
-  mode: z.enum(["release", "pull-request", "push"]).optional(),
+  mode: z.enum(["release", "pull-request", "push", "commit", "commit-and-release"]).optional(),
   reviewers: reviewersSchema.optional(),
+  /** Raw GitHub credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: githubCredentialsSchema.optional(),
   privateRepository: z.boolean().optional()
 });
 var filesOutputSchema = z.strictObject({