@postman/sdk-config 0.4.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman/sdk-config",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Shared SDK configuration contracts and transformations for Postman SDK generation",
   "license": "UNLICENSED",
   "sideEffects": false,

package/src/sdk-config/v1/README.md

@@ -86,9 +86,14 @@ bytes for the build; the server replaces the customer locator with an internal s
 SDK Config IR. Customer URLs never become generator fetch URLs. Signed URLs, S3 locations, and
 server-generated artifact metadata are not valid public locators. The public schema deliberately has
 no `compatibility`, source-origin, artifact ID, credential-resolution, or server-generated
-publishing control fields. Publishing credentials and signing material may appear in output blocks
-and must be stored, logged, and transported as secrets. Unknown fields are rejected at every object
-boundary. Portable API, client, documentation, package, source settings, and language field schemas
+publishing control fields. Supported registry credentials are flat fields selected by the `registry`
+discriminator: npm and crates accept `token`, PyPI and Maven accept `username` and `password`, and
+Maven accepts a complete `signature` containing `keyId`, `password`, and `secretKey`. Use environment
+expressions such as `${NPM_TOKEN}` for every credential rather than literal values. Unknown fields
+are rejected at every object boundary. Fern migration copies credential fields only when their raw
+`generators.yml` values are exact environment expressions. It never treats normalized or resolved
+output as credential provenance; literals and untraceable values are omitted with credential-safe
+warnings. Portable API, client, documentation, package, source settings, and language field schemas
 come from a neutral shared domain layer to prevent drift; the public and internal envelopes and
 their operational extensions remain separate explicit allowlists.
 
@@ -123,7 +128,7 @@ segments. Absolute paths and `..` traversal are rejected at validation time.
         "delivery": "zip",
         "publish": {
           "registry": "npm",
-          "credentials": { "token": "npm-token" }
+          "token": "${NPM_TOKEN}"
         }
       },
       "generation": {