@postman/sdk-config 0.3.1 → 0.3.3

package/README.md

@@ -3,9 +3,10 @@
 Build and validate SDK Config documents for SDK Generation API requests.
 
 SDK Config describes what to generate: API source provenance, SDK identity, API behavior, client
-behavior, package metadata, documentation, output, shared generation options, and one or more
-language targets. The materialized API source bytes, authentication, idempotency, and transport
-metadata belong to the SDK Generation API request rather than the SDK Config document.
+behavior, package metadata, documentation, output, shared generation options, optional publishing
+credentials/signing material, and one or more language targets. The materialized API source bytes,
+idempotency, and transport metadata belong to the SDK Generation API request rather than the SDK
+Config document.
 
 ## Install
 
@@ -70,7 +71,10 @@ if (!result.success) {
 ```
 
 SDK Config objects are strict. Unknown fields, duplicate language targets, incompatible package
-publication settings, and non-exact generator versions are rejected.
+publication settings, and non-exact generator versions are rejected. Publishing credentials and
+signing material may be provided under `output.publish.credentials`, Maven
+`output.publish.signature`, or `output.github.credentials`; these fields can contain raw secrets and
+must be handled accordingly by clients and servers.
 
 `SdkConfigV1` accepts customer-facing local source paths and HTTP(S) source URLs, but not
 server-owned signed URLs or artifact metadata. See the

package/dist/index.cjs

@@ -292,7 +292,8 @@ var composerPackageNameSchema = nonEmptyStringSchema.regex(
 );
 var authorSchema = zod.z.strictObject({
   name: nonEmptyStringSchema,
-  email: zod.z.email().optional()
+  email: zod.z.email().optional(),
+  url: nonEmptyStringSchema.optional()
 });
 var developerSchema = zod.z.strictObject({
   name: nonEmptyStringSchema,
@@ -711,6 +712,7 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
   if (typeof value.makePr === "boolean") consume(state, [...sourcePath, "makePr"]);
   if (stringValue(value.host)) consume(state, [...sourcePath, "host"]);
   if (stringValue(value.branch)) consume(state, [...sourcePath, "branch"]);
+  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
   return {
     output: {
       delivery: "github",
@@ -719,13 +721,58 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
         ...optional("host", stringValue(value.host)),
         ...optional("branch", stringValue(value.branch)),
         mode: value.makePr === true || type === "pullRequest" ? "pull-request" : type === "push" ? "push" : "release",
-        ...optional("reviewers", reviewers)
+        ...optional("reviewers", reviewers),
+        ...optional("credentials", credentials)
       },
       ...publication ? { publish: publication.publish } : {}
     },
     ...optional("package", publication?.package)
   };
 }
+function mapCredentials(value, sourcePath, state) {
+  if (!isObject(value)) return void 0;
+  return credentialsFromObject(value, sourcePath, state);
+}
+function mapInlineCredentials(value, sourcePath, state) {
+  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
+  if (credentials) return credentials;
+  return credentialsFromObject(value, sourcePath, state);
+}
+function credentialsFromObject(value, sourcePath, state) {
+  const credentials = {};
+  const username = stringValue(value.username);
+  const password = stringValue(value.password);
+  const token = stringValue(value.token);
+  const apiKey = stringValue(value.apiKey);
+  if (username) {
+    credentials.username = username;
+    consume(state, [...sourcePath, "username"]);
+  }
+  if (password) {
+    credentials.password = password;
+    consume(state, [...sourcePath, "password"]);
+  }
+  if (token) {
+    credentials.token = token;
+    consume(state, [...sourcePath, "token"]);
+  }
+  if (apiKey) {
+    credentials.apiKey = apiKey;
+    consume(state, [...sourcePath, "apiKey"]);
+  }
+  return Object.keys(credentials).length === 0 ? void 0 : credentials;
+}
+function mapMavenSignature(value, sourcePath, state) {
+  if (!isObject(value)) return void 0;
+  const keyId = stringValue(value.keyId);
+  const password = stringValue(value.password);
+  const secretKey = stringValue(value.secretKey);
+  if (!keyId || !password || !secretKey) return void 0;
+  consume(state, [...sourcePath, "keyId"]);
+  consume(state, [...sourcePath, "password"]);
+  consume(state, [...sourcePath, "secretKey"]);
+  return { keyId, password, secretKey };
+}
 function mapReviewers(value, sourcePath, state) {
   if (Array.isArray(value)) {
     const teams2 = reviewerNames(value, "team", sourcePath, state);
@@ -769,11 +816,13 @@ function mapPublication(value, language, sourcePath, state, index) {
   const registry = publicationRegistry(type, language, [...sourcePath, "type"], index);
   const registryUrl = stringValue(nested.registryUrl);
   if (registryUrl) consume(state, [...nestedPath, "registryUrl"]);
+  const credentials = mapInlineCredentials(nested, nestedPath, state);
   if (registry === "maven") {
     const coordinate = stringValue(nested.coordinate);
+    const signature = mapMavenSignature(nested.signature, [...nestedPath, "signature"], state);
     if (coordinate) consume(state, [...nestedPath, "coordinate"]);
     return {
-      publish: compact({ registry, url: registryUrl }),
+      publish: compact({ registry, url: registryUrl, credentials, signature }),
       ...coordinate ? { package: mavenPackage(coordinate, [...nestedPath, "coordinate"], index) } : {}
     };
   }
@@ -782,7 +831,7 @@ function mapPublication(value, language, sourcePath, state, index) {
   if (packageName) consume(state, [...nestedPath, packageNameField]);
   const metadata = registry === "pypi" ? mapPypiMetadata(nested.pypiMetadata, nestedPath, state) : {};
   return {
-    publish: compact({ registry, url: registryUrl }),
+    publish: compact({ registry, url: registryUrl, credentials }),
     ...packageName || Object.keys(metadata).length ? { package: { ...optional("packageName", packageName), ...metadata } } : {}
   };
 }
@@ -874,7 +923,8 @@ function mapAuthors(value, sourcePath, state) {
     if (!isObject(author)) return [];
     const name = stringValue(author.name);
     const email = stringValue(author.email);
-    return name ? [{ name, ...optional("email", email) }] : [];
+    const url = stringValue(author.url);
+    return name ? [{ name, ...optional("email", email), ...optional("url", url) }] : [];
   });
   if (authors.length !== value.length) return void 0;
   value.forEach((author, index) => {
@@ -882,6 +932,9 @@ function mapAuthors(value, sourcePath, state) {
     if (isObject(author) && stringValue(author.email)) {
       consume(state, [...sourcePath, index, "email"]);
     }
+    if (isObject(author) && stringValue(author.url)) {
+      consume(state, [...sourcePath, index, "url"]);
+    }
   });
   return authors;
 }
@@ -899,7 +952,11 @@ function finishOutputMapping(mapping, outputMode, sourcePath, state, index) {
           code: "FERN_OUTPUT_CREDENTIAL_UNSUPPORTED",
           severity: "warning",
           path: sourcePath,
-          reason: "Fern output credentials and signatures are intentionally excluded from SDK Config v1",
+          // This diagnostic only captures credential/signature fields that remained
+          // unconsumed after mapping supported registry/GitHub credentials into
+          // SDK Config v1. Supported credential shapes are carried through; this
+          // warning is about the remaining legacy-only credential fields.
+          reason: "Some Fern output credentials and signatures are intentionally excluded from SDK Config v1 when they cannot be represented in the public schema",
           suggestedAction: "Provide publishing credentials through the build request or external secret resolution."
         }
       ] : [],
@@ -1119,15 +1176,33 @@ var sdkConfigV1PublishRegistrySchema = zod.z.enum([
   "go",
   "composer"
 ]);
+var registryCredentialsSchema = zod.z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
+var mavenSignatureSchema = zod.z.strictObject({
+  keyId: nonEmptyStringSchema,
+  password: nonEmptyStringSchema,
+  secretKey: nonEmptyStringSchema
+});
 var commonPublishShape = {
   url: nonEmptyStringSchema.optional(),
+  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema.optional(),
   releaseBranch: nonEmptyStringSchema.optional(),
   tolerateRepublish: zod.z.boolean().optional()
 };
 var sdkConfigV1PublishConfigSchema = zod.z.discriminatedUnion("registry", [
   zod.z.strictObject({ registry: zod.z.literal("npm"), ...commonPublishShape }),
   zod.z.strictObject({ registry: zod.z.literal("pypi"), ...commonPublishShape }),
-  zod.z.strictObject({ registry: zod.z.literal("maven"), ...commonPublishShape }),
+  zod.z.strictObject({
+    registry: zod.z.literal("maven"),
+    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    signature: mavenSignatureSchema.optional(),
+    ...commonPublishShape
+  }),
   zod.z.strictObject({ registry: zod.z.literal("nuget"), ...commonPublishShape }),
   zod.z.strictObject({ registry: zod.z.literal("rubygems"), ...commonPublishShape }),
   zod.z.strictObject({ registry: zod.z.literal("crates"), ...commonPublishShape }),
@@ -1138,12 +1213,15 @@ var reviewersSchema = zod.z.strictObject({
   teams: zod.z.array(nonEmptyStringSchema).optional(),
   users: zod.z.array(nonEmptyStringSchema).optional()
 });
+var githubCredentialsSchema = registryCredentialsSchema;
 var githubOutputSchema = zod.z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
   branch: nonEmptyStringSchema.optional(),
-  mode: zod.z.enum(["release", "pull-request", "push"]).optional(),
+  mode: zod.z.enum(["release", "pull-request", "push", "commit", "commit-and-release"]).optional(),
   reviewers: reviewersSchema.optional(),
+  /** Raw GitHub credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: githubCredentialsSchema.optional(),
   privateRepository: zod.z.boolean().optional()
 });
 var filesOutputSchema = zod.z.strictObject({
@@ -1340,13 +1418,18 @@ var pydanticConfigSchema = zod.z.strictObject({
   unionNaming: zod.z.enum(["v0", "v1"]).optional(),
   useFieldAliases: zod.z.boolean().optional()
 });
+var additionalInitExportSchema = zod.z.strictObject({
+  from: nonEmptyStringSchema,
+  imports: zod.z.array(nonEmptyStringSchema).min(1)
+});
 var pythonGenerationConfigSchema = zod.z.strictObject({
   pythonVersion: nonEmptyStringSchema.optional(),
   pydanticVersion: nonEmptyStringSchema.optional(),
   pydantic: pydanticConfigSchema.optional(),
   client: pythonClientSchema.optional(),
   alwaysInitializeOptionals: zod.z.boolean().optional(),
-  useTypedDictRequests: zod.z.boolean().optional()
+  useTypedDictRequests: zod.z.boolean().optional(),
+  additionalInitExports: zod.z.array(additionalInitExportSchema).optional()
 });
 var rubyGenerationConfigSchema = zod.z.strictObject({
   requirePaths: zod.z.array(nonEmptyStringSchema).optional()
@@ -1619,9 +1702,14 @@ function mapFernConfigToSdkConfigV1(input) {
       "Select a Fern generator group containing at least one SDK generator."
     );
   }
+  const languages = input.group.generators.map(
+    (generator, index) => resolveLanguage(generator, index)
+  );
+  requireUniqueLanguages(languages);
+  const activeLanguages = new Set(languages);
   const mapped = input.group.generators.map((generator, index) => {
-    const language = resolveLanguage(generator, index);
-    const invocation = mapInvocation(generator, language, index);
+    const language = languages[index];
+    const invocation = mapInvocation(generator, language, activeLanguages, index);
     const outputMapping = generator.output ? { output: generator.output, unsupportedFields: [] } : mapOutput(generator, language, index);
     return {
       generator,
@@ -1630,7 +1718,6 @@ function mapFernConfigToSdkConfigV1(input) {
       ...outputMapping
     };
   });
-  requireUniqueLanguages(mapped.map(({ language }) => language));
   const clients = partitionSharedBlock(mapped.map(({ invocation }) => invocation.client));
   const docs = partitionSharedBlock(mapped.map(({ invocation }) => invocation.docs));
   const generations = partitionSharedBlock(mapped.map(({ invocation }) => invocation.generation));
@@ -1801,14 +1888,17 @@ function partitionObjectValues(values) {
   }
   return { shared, overrides };
 }
-function mapInvocation(generator, language, index) {
+function mapInvocation(generator, language, activeLanguages, index) {
   const prefix = ["group", "generators", index];
   const state = { consumedPaths: /* @__PURE__ */ new Set() };
   const config = isObject(generator.config) ? generator.config : {};
   const client = {};
   const generation = {};
   const packageConfig = {};
-  mapCommonConfig(config, state, client, generation, packageConfig, [...prefix, "config"]);
+  mapCommonConfig(language, config, state, client, generation, packageConfig, [
+    ...prefix,
+    "config"
+  ]);
   const rawGenerator = isObject(generator.raw) ? generator.raw : void 0;
   const smartCasing = typeof rawGenerator?.["smart-casing"] === "boolean" ? rawGenerator["smart-casing"] : generator.smartCasing === false ? false : void 0;
   const smartCasingDigitWordBoundary = typeof rawGenerator?.["smart-casing-digit-word-boundary"] === "boolean" ? rawGenerator["smart-casing-digit-word-boundary"] : generator.smartCasingDigitWordBoundary === true ? true : void 0;
@@ -1837,7 +1927,7 @@ function mapInvocation(generator, language, index) {
       client.pathParameterStyle = inlinePathParameters ? "inline" : "wrapped";
     }
   }
-  const docs = mapReadme(generator.readme, state, [...prefix, "readme"]);
+  const docs = mapReadme(generator.readme, language, activeLanguages, state, [...prefix, "readme"]);
   const unsupportedFields = [
     ...collectUnsupported(config, [...prefix, "config"], state),
     ...settings ? collectUnsupported(settings, [...prefix, "settings"], state) : [],
@@ -1893,7 +1983,7 @@ function resolvedFieldGuidance(field) {
 function isDefaultAutomation(value) {
   return isObject(value) && value.generate === true && value.upgrade === true && value.preview === true && value.verify === true;
 }
-function mapCommonConfig(config, state, client, generation, packageConfig, basePath) {
+function mapCommonConfig(language, config, state, client, generation, packageConfig, basePath) {
   const inlinePath = takeBoolean(config, ["inlinePathParameters"], state, basePath);
   const inlineFile = takeBoolean(config, ["inlineFileProperties"], state, basePath);
   const inlineRequest = takeBoolean(config, ["inlineRequestParams"], state, basePath);
@@ -1903,12 +1993,15 @@ function mapCommonConfig(config, state, client, generation, packageConfig, baseP
     client.requestParameterStyle = inlineRequest ? "inline" : "wrapped";
   const timeoutMs = takeTimeoutMs(config, state, basePath);
   if (timeoutMs !== void 0) client.timeoutMs = timeoutMs;
-  const skipValidation = takeBoolean(
+  const directSkipValidation = takeBoolean(
     config,
     ["skipResponseValidation", "skipValidation"],
     state,
     basePath
   );
+  const pydanticConfig = language === "python" ? takeObject(config, ["pydanticConfig"], state, basePath) : void 0;
+  const nestedSkipValidation = pydanticConfig ? takeBoolean(pydanticConfig.value, ["skipValidation"], state, pydanticConfig.path) : void 0;
+  const skipValidation = directSkipValidation ?? nestedSkipValidation;
   if (skipValidation !== void 0) client.responseValidation = !skipValidation;
   const useDefaults = takeBoolean(config, ["useDefaultRequestParameterValues"], state, basePath);
   if (useDefaults !== void 0) client.useDefaultRequestParameterValues = useDefaults;
@@ -2009,16 +2102,16 @@ function mapLanguageConfig(language, config, state, packageConfig, basePath) {
   }
 }
 function mapTypescript(config, state, packageConfig, basePath) {
-  const packageJson = takeObject(config, ["packageJson"], state, basePath);
-  const packageName = packageJson ? takeString(packageJson.value, ["name"], state, packageJson.path) : void 0;
-  if (packageName !== void 0) packageConfig.packageName = packageName;
+  mapPackageManifest(config, ["packageJson"], state, packageConfig, basePath);
   const serdeLayer = takeBoolean(config, ["serdeLayer"], state, basePath);
   const noSerdeLayer = takeBoolean(config, ["noSerdeLayer"], state, basePath);
+  const fetchSupport = takeEnum(config, ["fetchSupport"], ["native"], state, basePath);
   return compact({
     typescriptVersion: takeString(config, ["typescriptVersion"], state, basePath),
     zodVersion: takeString(config, ["zodVersion"], state, basePath),
     packageManager: takeEnum(config, ["packageManager"], ["pnpm", "yarn"], state, basePath),
     testFramework: takeEnum(config, ["testFramework"], ["jest", "vitest"], state, basePath),
+    httpClient: fetchSupport === "native" ? { name: "fetch" } : void 0,
     bundle: takeBoolean(config, ["bundle"], state, basePath),
     exportClassDefault: takeBoolean(config, ["exportClassDefault"], state, basePath),
     namespaceExportName: takeString(
@@ -2043,7 +2136,8 @@ function mapPython(config, state, packageConfig, basePath) {
     pythonVersion: takeString(config, ["pythonVersion", "pyprojectPythonVersion"], state, basePath),
     pydanticVersion: takeString(config, ["pydanticVersion"], state, basePath),
     alwaysInitializeOptionals: takeBoolean(config, ["alwaysInitializeOptionals"], state, basePath),
-    useTypedDictRequests: takeBoolean(config, ["useTypedDictRequests"], state, basePath)
+    useTypedDictRequests: takeBoolean(config, ["useTypedDictRequests"], state, basePath),
+    additionalInitExports: takePythonAdditionalInitExports(config, state, basePath)
   });
 }
 function mapJvm(language, config, state, packageConfig, basePath) {
@@ -2123,6 +2217,7 @@ function mapCsharp(config, state, packageConfig, basePath) {
   });
 }
 function mapPhp(config, state, packageConfig, basePath) {
+  mapPackageManifest(config, ["composerJson"], state, packageConfig, basePath);
   const packageName = takeString(config, ["packageName"], state, basePath);
   if (packageName !== void 0) packageConfig.packageName = packageName;
   return compact({
@@ -2205,7 +2300,7 @@ function mapMcp(config, state, basePath) {
     toolsets: takeToolsets(config, ["toolsets"], state, basePath)
   });
 }
-function mapReadme(value, state, basePath) {
+function mapReadme(value, language, activeLanguages, state, basePath) {
   if (!isObject(value)) return {};
   const readme = compact({
     apiName: takeString(value, ["apiName"], state, basePath),
@@ -2213,7 +2308,7 @@ function mapReadme(value, state, basePath) {
     apiReferenceLink: takeString(value, ["apiReferenceLink"], state, basePath),
     bannerLink: takeString(value, ["bannerLink"], state, basePath),
     disabledSections: takeStringArray(value, ["disabledSections"], state, basePath),
-    customSections: takeCustomSections(value, state, basePath),
+    customSections: takeCustomSections(value, language, activeLanguages, state, basePath),
     defaultEndpoint: takeReadmeEndpoint(value, ["defaultEndpoint"], state, basePath),
     features: takeReadmeFeatures(value, state, basePath)
   });
@@ -2275,15 +2370,59 @@ function mapDependency(name, value, state, path) {
     }
   ];
 }
-function takeCustomSections(value, state, basePath) {
+function takeCustomSections(value, language, activeLanguages, state, basePath) {
   const located = locate(value, ["customSections"], basePath);
   if (!located || !Array.isArray(located.value)) return void 0;
-  const sections = located.value.flatMap(
-    (section) => isObject(section) && section.language === void 0 && typeof section.title === "string" && typeof section.content === "string" ? [{ title: section.title, content: section.content }] : []
+  const sections = located.value.flatMap((section, index) => {
+    if (!isObject(section) || typeof section.title !== "string" || section.title.length === 0 || typeof section.content !== "string") {
+      return [];
+    }
+    const sectionLanguage = section.language;
+    if (sectionLanguage !== void 0 && (typeof sectionLanguage !== "string" || !isFernLanguage(sectionLanguage) || !activeLanguages.has(sectionLanguage))) {
+      return [];
+    }
+    consume(state, [...located.path, index]);
+    return sectionLanguage === void 0 || sectionLanguage === language ? [{ title: section.title, content: section.content }] : [];
+  });
+  return sections.length > 0 ? sections : void 0;
+}
+function mapPackageManifest(config, aliases, state, packageConfig, basePath) {
+  const manifest = takeObject(config, aliases, state, basePath);
+  if (!manifest) return;
+  const packageName = takeString(manifest.value, ["name"], state, manifest.path);
+  const description = takeString(manifest.value, ["description"], state, manifest.path);
+  const license = takeString(manifest.value, ["license"], state, manifest.path);
+  const author = takeObject(manifest.value, ["author"], state, manifest.path);
+  const authorName = author ? takeString(author.value, ["name"], state, author.path) : void 0;
+  const authors = authorName && author ? [
+    compact({
+      name: authorName,
+      email: takeString(author.value, ["email"], state, author.path),
+      url: takeString(author.value, ["url"], state, author.path)
+    })
+  ] : void 0;
+  Object.assign(
+    packageConfig,
+    compact({
+      packageName,
+      description,
+      authors,
+      license: license ? { type: license } : void 0
+    })
   );
-  if (sections.length !== located.value.length) return void 0;
+}
+function takePythonAdditionalInitExports(config, state, basePath) {
+  const located = locate(config, ["additionalInitExports"], basePath);
+  if (!located || !Array.isArray(located.value)) return void 0;
+  const exports = located.value.flatMap((entry) => {
+    if (!isObject(entry)) return [];
+    const from = stringValue(entry.from);
+    const imports = stringArrayValue(entry.imports);
+    return from && imports?.length ? [{ from, imports }] : [];
+  });
+  if (exports.length !== located.value.length) return void 0;
   consume(state, located.path);
-  return sections;
+  return exports;
 }
 function takeReadmeEndpoint(value, aliases, state, basePath) {
   const located = locate(value, aliases, basePath);
@@ -2539,13 +2678,18 @@ var credentialResolutionSchema = zod.z.enum([
   "resolved-by-orchestrator",
   "resolved-by-fiddle"
 ]);
+var registryCredentialsSchema2 = zod.z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
 var commonPublishShape2 = {
   url: nonEmptyStringSchema.optional(),
-  /**
-   * Reference to registry publishing credentials. Raw tokens/passwords are intentionally not part of
-   * SDK Config IR; the external publisher or orchestrator resolves this reference before use.
-   */
+  /** Reference to registry publishing credentials. */
   credentialsRef: nonEmptyStringSchema.optional(),
+  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema2.optional(),
   /**
    * Registry-specific package version override. If omitted, the external publisher/orchestrator may
    * fall back to target.sdkVersion.
@@ -2569,6 +2713,11 @@ var mavenSignatureEnvironmentSchema = zod.z.strictObject({
   passwordEnvironmentVariable: nonEmptyStringSchema.optional(),
   secretKeyEnvironmentVariable: nonEmptyStringSchema.optional()
 });
+var mavenSignatureSchema2 = zod.z.strictObject({
+  keyId: nonEmptyStringSchema,
+  password: nonEmptyStringSchema,
+  secretKey: nonEmptyStringSchema
+});
 var publishConfigSchema = zod.z.discriminatedUnion("registry", [
   zod.z.strictObject({
     registry: zod.z.literal("npm"),
@@ -2614,11 +2763,10 @@ var publishConfigSchema = zod.z.discriminatedUnion("registry", [
     passwordEnvironmentVariable: nonEmptyStringSchema.optional(),
     mavenUrlEnvironmentVariable: nonEmptyStringSchema.optional(),
     signatureEnvironmentVariables: mavenSignatureEnvironmentSchema.optional(),
-    /**
-     * Reference to Maven signing credentials. Raw signing keys are intentionally not part of SDK
-     * Config IR; the external publisher or orchestrator resolves this reference before use.
-     */
+    /** Reference to Maven signing credentials. */
     signingCredentialsRef: nonEmptyStringSchema.optional(),
+    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    signature: mavenSignatureSchema2.optional(),
     ...commonPublishShape2
   })
 ]);
@@ -2629,18 +2777,27 @@ var reviewersSchema2 = zod.z.strictObject({
 var replayControlSchema = zod.z.strictObject({
   enabled: zod.z.boolean()
 });
+var githubLicenseSchema = zod.z.strictObject({
+  /** SPDX identifier or license key for the repository license (for example, "MIT"). */
+  type: nonEmptyStringSchema.optional(),
+  /** Path to a custom license file to be committed into the GitHub repository. */
+  customPath: nonEmptyStringSchema.optional()
+}).refine((value) => value.type !== void 0 || value.customPath !== void 0, {
+  message: "GitHub license must set type or customPath"
+});
 var githubOutputSchema2 = zod.z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
   branch: nonEmptyStringSchema.optional(),
-  mode: zod.z.enum(["release", "pull-request", "push"]).optional(),
+  mode: zod.z.enum(["release", "pull-request", "push", "commit", "commit-and-release"]).optional(),
   reviewers: reviewersSchema2.optional(),
-  /**
-   * Reference to GitHub credentials. Raw tokens are intentionally not part of SDK Config IR; the
-   * external publisher or orchestrator resolves this reference before use.
-   */
+  /** Reference to GitHub credentials. */
   credentialsRef: nonEmptyStringSchema.optional(),
+  /** Raw GitHub credentials. These values can be sensitive and must be handled as secrets. */
+  credentials: registryCredentialsSchema2.optional(),
   privateRepository: zod.z.boolean().optional(),
+  /** GitHub license block scoped to repository delivery. */
+  license: githubLicenseSchema.optional(),
   /** GitHub replay control. If omitted, the external publisher applies its default behavior. */
   replay: replayControlSchema.optional(),
   /** Run GitHub publishing verification. Defaults to false to match current Fiddle job behavior. */
@@ -2651,10 +2808,7 @@ var githubOutputSchema2 = zod.z.strictObject({
   autoMerge: zod.z.boolean().default(false)
 });
 var credentialResolutionShape = {
-  /**
-   * Where output credential references are resolved. SDK Config IR carries refs only; raw resolved
-   * credentials belong at the external publisher/orchestrator boundary, not in this config.
-   */
+  /** Where output credential references are resolved. */
   credentialResolution: credentialResolutionSchema.default("refs-only")
 };
 var filesOutputSchema2 = zod.z.strictObject({