@postman/sdk-config 0.4.0 → 0.4.1

package/dist/sdk-config/index.cjs

@@ -581,7 +581,13 @@ function mapOutput(generator, language, index) {
   const raw = isObject(generator.raw) ? generator.raw : void 0;
   const rawOutput = raw && isObject(raw.output) ? raw.output : void 0;
   const outputPath = ["group", "generators", index, "outputMode"];
-  const state = { consumedPaths: /* @__PURE__ */ new Set() };
+  const state = { consumedPaths: /* @__PURE__ */ new Set(), credentialDiagnostics: [] };
+  if (generator.output) {
+    return {
+      output: sanitizeNormalizedOutput(generator.output, rawOutput, state, index),
+      unsupportedFields: state.credentialDiagnostics ?? []
+    };
+  }
   if (rawOutput?.location === "local-file-system") {
     if (isObject(generator.outputMode)) consume(state, [...outputPath, "type"]);
     return finishOutputMapping(
@@ -613,7 +619,7 @@ function mapOutput(generator, language, index) {
       return finishOutputMapping({ output: { delivery: "zip" } }, output, outputPath, state, index);
     case "github":
       return finishOutputMapping(
-        githubOutput(output, output.publishInfo, language, outputPath, state, index),
+        githubOutput(output, output.publishInfo, rawOutput, language, outputPath, state, index),
         output,
         outputPath,
         state,
@@ -633,6 +639,7 @@ function mapOutput(generator, language, index) {
         githubOutput(
           output.githubV2,
           output.githubV2.publishInfo,
+          rawOutput,
           language,
           githubPath,
           state,
@@ -647,6 +654,7 @@ function mapOutput(generator, language, index) {
     case "publishV2": {
       const publication = mapPublication(
         output.publishV2,
+        rawOutput,
         language,
         [...outputPath, "publishV2"],
         state,
@@ -666,6 +674,7 @@ function mapOutput(generator, language, index) {
     case "publish": {
       const publication = mapLegacyPublication(
         output.registryOverrides,
+        rawOutput,
         language,
         [...outputPath, "registryOverrides"],
         state,
@@ -692,7 +701,22 @@ function mapOutput(generator, language, index) {
       );
   }
 }
-function githubOutput(value, publishInfo, language, sourcePath, state, index) {
+function sanitizeNormalizedOutput(output, rawOutput, state, index) {
+  const publish = output.publish ? sanitizePublishConfig(output.publish, output.publish, rawOutput, state, index) : void 0;
+  const publishShape = publish ? { publish } : {};
+  if (output.delivery !== "github") return { ...output, ...publishShape };
+  const { credentials, ...github } = output.github;
+  if (credentials) {
+    addCredentialDiagnostic(
+      state,
+      ["group", "generators", index, "output", "github", "credentials"],
+      ["targets", index, "output", "github", "credentials"],
+      "Normalized GitHub credentials have no raw environment-expression provenance"
+    );
+  }
+  return { ...output, github, ...publishShape };
+}
+function githubOutput(value, publishInfo, rawOutput, language, sourcePath, state, index) {
   const owner = stringValue(value.owner);
   const repo = stringValue(value.repo);
   if (!owner || !repo)
@@ -705,14 +729,22 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
     );
   consume(state, [...sourcePath, "owner"]);
   consume(state, [...sourcePath, "repo"]);
-  const publication = publishInfo ? mapPublication(publishInfo, language, [...sourcePath, "publishInfo"], state, index) : void 0;
+  const publication = publishInfo ? mapPublication(publishInfo, rawOutput, language, [...sourcePath, "publishInfo"], state, index) : void 0;
   const type = stringValue(value.type);
   const reviewers = mapReviewers(value.reviewers, [...sourcePath, "reviewers"], state);
   if (type) consume(state, [...sourcePath, "type"]);
   if (typeof value.makePr === "boolean") consume(state, [...sourcePath, "makePr"]);
   if (stringValue(value.host)) consume(state, [...sourcePath, "host"]);
   if (stringValue(value.branch)) consume(state, [...sourcePath, "branch"]);
-  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
+  consumeCredentialObject(value.credentials, [...sourcePath, "credentials"], state);
+  if (isObject(value.credentials)) {
+    addCredentialDiagnostic(
+      state,
+      [...sourcePath, "credentials"],
+      ["targets", index, "output", "github", "credentials"],
+      "GitHub credentials cannot be traced safely to raw environment expressions"
+    );
+  }
   return {
     output: {
       delivery: "github",
@@ -721,57 +753,35 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
         ...optional("host", stringValue(value.host)),
         ...optional("branch", stringValue(value.branch)),
         mode: value.makePr === true || type === "pullRequest" ? "pull-request" : type === "push" ? "push" : "release",
-        ...optional("reviewers", reviewers),
-        ...optional("credentials", credentials)
+        ...optional("reviewers", reviewers)
       },
       ...publication ? { publish: publication.publish } : {}
     },
     ...optional("package", publication?.package)
   };
 }
-function mapCredentials(value, sourcePath, state) {
-  if (!isObject(value)) return void 0;
-  return credentialsFromObject(value, sourcePath, state);
-}
-function mapInlineCredentials(value, sourcePath, state) {
-  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
-  if (credentials) return credentials;
-  return credentialsFromObject(value, sourcePath, state);
-}
-function credentialsFromObject(value, sourcePath, state) {
-  const credentials = {};
-  const username = stringValue(value.username);
-  const password = stringValue(value.password);
-  const token = stringValue(value.token);
-  const apiKey = stringValue(value.apiKey);
-  if (username) {
-    credentials.username = username;
-    consume(state, [...sourcePath, "username"]);
+function consumeCredentialObject(value, sourcePath, state) {
+  if (!isObject(value)) return;
+  for (const field of ["username", "password", "token", "apiKey"]) {
+    if (stringValue(value[field])) consume(state, [...sourcePath, field]);
   }
-  if (password) {
-    credentials.password = password;
-    consume(state, [...sourcePath, "password"]);
+}
+function consumeResolvedCredentials(value, sourcePath, state) {
+  for (const field of ["username", "password", "token", "apiKey"]) {
+    if (stringValue(value[field])) {
+      consume(state, [...sourcePath, field]);
+    }
   }
-  if (token) {
-    credentials.token = token;
-    consume(state, [...sourcePath, "token"]);
+  if (isObject(value.credentials)) {
+    for (const field of ["username", "password", "token", "apiKey"]) {
+      if (stringValue(value.credentials[field])) {
+        consume(state, [...sourcePath, "credentials", field]);
+      }
+    }
   }
-  if (apiKey) {
-    credentials.apiKey = apiKey;
-    consume(state, [...sourcePath, "apiKey"]);
+  if (isObject(value.signature)) {
+    consume(state, [...sourcePath, "signature"]);
   }
-  return Object.keys(credentials).length === 0 ? void 0 : credentials;
-}
-function mapMavenSignature(value, sourcePath, state) {
-  if (!isObject(value)) return void 0;
-  const keyId = stringValue(value.keyId);
-  const password = stringValue(value.password);
-  const secretKey = stringValue(value.secretKey);
-  if (!keyId || !password || !secretKey) return void 0;
-  consume(state, [...sourcePath, "keyId"]);
-  consume(state, [...sourcePath, "password"]);
-  consume(state, [...sourcePath, "secretKey"]);
-  return { keyId, password, secretKey };
 }
 function mapReviewers(value, sourcePath, state) {
   if (Array.isArray(value)) {
@@ -800,7 +810,7 @@ function reviewerNames(value, expectedType, sourcePath, state) {
   });
   return names.length ? names : void 0;
 }
-function mapPublication(value, language, sourcePath, state, index) {
+function mapPublication(value, rawOutput, language, sourcePath, state, index) {
   if (!isObject(value))
     fail(
       "FERN_PUBLICATION_INVALID",
@@ -816,13 +826,19 @@ function mapPublication(value, language, sourcePath, state, index) {
   const registry = publicationRegistry(type, language, [...sourcePath, "type"], index);
   const registryUrl = stringValue(nested.registryUrl);
   if (registryUrl) consume(state, [...nestedPath, "registryUrl"]);
-  const credentials = mapInlineCredentials(nested, nestedPath, state);
+  consumeResolvedCredentials(nested, nestedPath, state);
+  const publish = sanitizePublishConfig(
+    compact({ registry, url: registryUrl }),
+    nested,
+    rawOutput,
+    state,
+    index
+  );
   if (registry === "maven") {
     const coordinate = stringValue(nested.coordinate);
-    const signature = mapMavenSignature(nested.signature, [...nestedPath, "signature"], state);
     if (coordinate) consume(state, [...nestedPath, "coordinate"]);
     return {
-      publish: compact({ registry, url: registryUrl, credentials, signature }),
+      publish,
       ...coordinate ? { package: mavenPackage(coordinate, [...nestedPath, "coordinate"], index) } : {}
     };
   }
@@ -831,15 +847,244 @@ function mapPublication(value, language, sourcePath, state, index) {
   if (packageName) consume(state, [...nestedPath, packageNameField]);
   const metadata = registry === "pypi" ? mapPypiMetadata(nested.pypiMetadata, nestedPath, state) : {};
   return {
-    publish: compact({ registry, url: registryUrl, credentials }),
+    publish,
     ...packageName || Object.keys(metadata).length ? { package: { ...optional("packageName", packageName), ...metadata } } : {}
   };
 }
-function mapLegacyPublication(value, language, sourcePath, state, index) {
+function sanitizePublishConfig(publish, resolvedPublication, rawOutput, state, index) {
+  const rawPublication = rawOutput?.location === publish.registry ? rawOutput : void 0;
+  const rawPath = ["group", "generators", index, "output"];
+  if (publish.registry === "npm" || publish.registry === "crates") {
+    const token = mapCredentialExpression(
+      rawPublication,
+      resolvedPublication,
+      "token",
+      rawPath,
+      state,
+      index
+    );
+    warnForUnexpectedCredentialFields(
+      rawPublication,
+      resolvedPublication,
+      ["token"],
+      rawPath,
+      state,
+      index
+    );
+    return compact({
+      registry: publish.registry,
+      url: publish.url,
+      releaseBranch: publish.releaseBranch,
+      tolerateRepublish: publish.tolerateRepublish,
+      token
+    });
+  }
+  if (publish.registry === "pypi") {
+    const { username, password } = mapPypiCredentialExpressions(
+      rawPublication,
+      resolvedPublication,
+      rawPath,
+      state,
+      index
+    );
+    warnForUnexpectedCredentialFields(
+      rawPublication,
+      resolvedPublication,
+      ["username", "password", "token"],
+      rawPath,
+      state,
+      index
+    );
+    return compact({
+      registry: publish.registry,
+      url: publish.url,
+      releaseBranch: publish.releaseBranch,
+      tolerateRepublish: publish.tolerateRepublish,
+      username,
+      password
+    });
+  }
+  if (publish.registry === "maven") {
+    const username = mapCredentialExpression(
+      rawPublication,
+      resolvedPublication,
+      "username",
+      rawPath,
+      state,
+      index
+    );
+    const password = mapCredentialExpression(
+      rawPublication,
+      resolvedPublication,
+      "password",
+      rawPath,
+      state,
+      index
+    );
+    const signature = mapMavenSignatureExpressions(
+      rawPublication?.signature,
+      resolvedPublication.signature,
+      [...rawPath, "signature"],
+      state,
+      index
+    );
+    warnForUnexpectedCredentialFields(
+      rawPublication,
+      resolvedPublication,
+      ["username", "password"],
+      rawPath,
+      state,
+      index,
+      true
+    );
+    return compact({
+      registry: publish.registry,
+      url: publish.url,
+      releaseBranch: publish.releaseBranch,
+      tolerateRepublish: publish.tolerateRepublish,
+      username,
+      password,
+      signature
+    });
+  }
+  warnForUnrepresentableCredentials(rawPublication, resolvedPublication, rawPath, state, index);
+  return compact({
+    registry: publish.registry,
+    url: publish.url,
+    releaseBranch: publish.releaseBranch,
+    tolerateRepublish: publish.tolerateRepublish
+  });
+}
+function mapLegacyPublication(value, rawOutput, language, sourcePath, state, index) {
   const registry = defaultRegistry(language, sourcePath, index);
   const overrides = isObject(value) ? value : {};
   const override = isObject(overrides[registry]) ? overrides[registry] : {};
-  return mapPublication(override, language, [...sourcePath, registry], state, index);
+  return mapPublication(override, rawOutput, language, [...sourcePath, registry], state, index);
+}
+function mapCredentialExpression(rawPublication, resolvedPublication, field, rawPath, state, index) {
+  const rawValue = rawPublication?.[field];
+  if (isEnvironmentExpression(rawValue)) return rawValue;
+  if (rawValue !== void 0 || hasResolvedCredential(resolvedPublication, field)) {
+    addCredentialDiagnostic(
+      state,
+      [...rawPath, field],
+      ["targets", index, "output", "publish", field],
+      `Fern publishing ${field} is not an exact environment expression`
+    );
+  }
+  return void 0;
+}
+function mapPypiCredentialExpressions(rawPublication, resolvedPublication, rawPath, state, index) {
+  const rawToken = rawPublication?.token;
+  if (isEnvironmentExpression(rawToken)) {
+    return { username: "__token__", password: rawToken };
+  }
+  const resolvedUsesToken = resolvedCredentialValue(resolvedPublication, "username") === "__token__";
+  if (rawToken !== void 0 || resolvedUsesToken) {
+    addCredentialDiagnostic(
+      state,
+      [...rawPath, "token"],
+      ["targets", index, "output", "publish", "password"],
+      "Fern PyPI token is not an exact raw environment expression"
+    );
+    return {};
+  }
+  return {
+    ...optional(
+      "username",
+      mapCredentialExpression(
+        rawPublication,
+        resolvedPublication,
+        "username",
+        rawPath,
+        state,
+        index
+      )
+    ),
+    ...optional(
+      "password",
+      mapCredentialExpression(
+        rawPublication,
+        resolvedPublication,
+        "password",
+        rawPath,
+        state,
+        index
+      )
+    )
+  };
+}
+function mapMavenSignatureExpressions(rawValue, resolvedValue, rawPath, state, index) {
+  if (isObject(rawValue)) {
+    const yamlValues = [rawValue["key-id"], rawValue.password, rawValue["secret-key"]];
+    const projectedValues = [rawValue.keyId, rawValue.password, rawValue.secretKey];
+    const values = yamlValues.every(isEnvironmentExpression) ? yamlValues : projectedValues.every(isEnvironmentExpression) ? projectedValues : void 0;
+    if (values) {
+      const [keyId, password, secretKey] = values;
+      return { keyId, password, secretKey };
+    }
+  }
+  if (rawValue !== void 0 || isObject(resolvedValue)) {
+    addCredentialDiagnostic(
+      state,
+      rawPath,
+      ["targets", index, "output", "publish", "signature"],
+      "Maven signing credentials are incomplete or not exact environment expressions"
+    );
+  }
+  return void 0;
+}
+function warnForUnrepresentableCredentials(rawPublication, resolvedPublication, rawPath, state, index) {
+  const rawHasCredential = ["username", "password", "token", "apiKey"].some(
+    (field) => rawPublication?.[field] !== void 0
+  ) || rawPublication?.signature !== void 0;
+  if (rawHasCredential || hasAnyResolvedCredential(resolvedPublication)) {
+    addCredentialDiagnostic(
+      state,
+      rawPath,
+      ["targets", index, "output", "publish"],
+      "This registry does not support credentials in public SDK Config v1"
+    );
+  }
+}
+function warnForUnexpectedCredentialFields(rawPublication, resolvedPublication, allowedFields, rawPath, state, index, allowSignature = false) {
+  const credentialFields = ["username", "password", "token", "apiKey"];
+  const unexpectedFields = credentialFields.filter(
+    (field) => !allowedFields.includes(field) && (rawPublication?.[field] !== void 0 || hasResolvedCredential(resolvedPublication, field))
+  );
+  const hasUnexpectedSignature = !allowSignature && (rawPublication?.signature !== void 0 || resolvedPublication.signature !== void 0);
+  if (unexpectedFields.length > 0 || hasUnexpectedSignature) {
+    addCredentialDiagnostic(
+      state,
+      rawPath,
+      ["targets", index, "output", "publish"],
+      "Fern publishing credentials or signing material include fields unsupported by this registry"
+    );
+  }
+}
+function hasResolvedCredential(value, field) {
+  return resolvedCredentialValue(value, field) !== void 0;
+}
+function resolvedCredentialValue(value, field) {
+  return stringValue(value[field]) ?? (isObject(value.credentials) ? stringValue(value.credentials[field]) : void 0);
+}
+function hasAnyResolvedCredential(value) {
+  return ["username", "password", "token", "apiKey"].some(
+    (field) => hasResolvedCredential(value, field)
+  ) || value.signature !== void 0;
+}
+function isEnvironmentExpression(value) {
+  return typeof value === "string" && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(value);
+}
+function addCredentialDiagnostic(state, path, sdkConfigPath, reason) {
+  state.credentialDiagnostics?.push({
+    code: "FERN_OUTPUT_CREDENTIAL_OMITTED",
+    severity: "warning",
+    path,
+    reason,
+    sdkConfigPath,
+    suggestedAction: `Configure ${sdkConfigPath.join(".")} with an environment expression such as \${CREDENTIAL_ENV_VAR}.`
+  });
 }
 function publicationRegistry(type, language, sourcePath, index) {
   if (type === "postman") {
@@ -947,6 +1192,7 @@ function finishOutputMapping(mapping, outputMode, sourcePath, state, index) {
   return {
     ...mapping,
     unsupportedFields: [
+      ...state.credentialDiagnostics ?? [],
       ...hasCredentials ? [
         {
           code: "FERN_OUTPUT_CREDENTIAL_UNSUPPORTED",
@@ -1176,12 +1422,6 @@ var sdkConfigV1PublishRegistrySchema = zod.z.enum([
   "go",
   "composer"
 ]);
-var registryCredentialsSchema = zod.z.strictObject({
-  username: nonEmptyStringSchema.optional(),
-  password: nonEmptyStringSchema.optional(),
-  token: nonEmptyStringSchema.optional(),
-  apiKey: nonEmptyStringSchema.optional()
-});
 var mavenSignatureSchema = zod.z.strictObject({
   keyId: nonEmptyStringSchema,
   password: nonEmptyStringSchema,
@@ -1189,23 +1429,35 @@ var mavenSignatureSchema = zod.z.strictObject({
 });
 var commonPublishShape = {
   url: nonEmptyStringSchema.optional(),
-  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
-  credentials: registryCredentialsSchema.optional(),
   releaseBranch: nonEmptyStringSchema.optional(),
   tolerateRepublish: zod.z.boolean().optional()
 };
 var sdkConfigV1PublishConfigSchema = zod.z.discriminatedUnion("registry", [
-  zod.z.strictObject({ registry: zod.z.literal("npm"), ...commonPublishShape }),
-  zod.z.strictObject({ registry: zod.z.literal("pypi"), ...commonPublishShape }),
+  zod.z.strictObject({
+    registry: zod.z.literal("npm"),
+    token: nonEmptyStringSchema.optional(),
+    ...commonPublishShape
+  }),
+  zod.z.strictObject({
+    registry: zod.z.literal("pypi"),
+    username: nonEmptyStringSchema.optional(),
+    password: nonEmptyStringSchema.optional(),
+    ...commonPublishShape
+  }),
   zod.z.strictObject({
     registry: zod.z.literal("maven"),
-    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    username: nonEmptyStringSchema.optional(),
+    password: nonEmptyStringSchema.optional(),
     signature: mavenSignatureSchema.optional(),
     ...commonPublishShape
   }),
   zod.z.strictObject({ registry: zod.z.literal("nuget"), ...commonPublishShape }),
   zod.z.strictObject({ registry: zod.z.literal("rubygems"), ...commonPublishShape }),
-  zod.z.strictObject({ registry: zod.z.literal("crates"), ...commonPublishShape }),
+  zod.z.strictObject({
+    registry: zod.z.literal("crates"),
+    token: nonEmptyStringSchema.optional(),
+    ...commonPublishShape
+  }),
   zod.z.strictObject({ registry: zod.z.literal("go"), ...commonPublishShape }),
   zod.z.strictObject({ registry: zod.z.literal("composer"), ...commonPublishShape })
 ]);
@@ -1213,7 +1465,12 @@ var reviewersSchema = zod.z.strictObject({
   teams: zod.z.array(nonEmptyStringSchema).optional(),
   users: zod.z.array(nonEmptyStringSchema).optional()
 });
-var githubCredentialsSchema = registryCredentialsSchema;
+var githubCredentialsSchema = zod.z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
 var githubOutputSchema = zod.z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
@@ -1730,7 +1987,7 @@ function mapFernConfigToSdkConfigV1(input) {
   const mapped = input.group.generators.map((generator, index) => {
     const language = languages[index];
     const invocation = mapInvocation(generator, language, activeLanguages, index);
-    const outputMapping = generator.output ? { output: generator.output, unsupportedFields: [] } : mapOutput(generator, language, index);
+    const outputMapping = mapOutput(generator, language, index);
     return {
       generator,
       language,
@@ -1789,6 +2046,7 @@ function mapFernConfigToSdkConfigV1(input) {
     source: input.source,
     ...optional("sdkVersion", input.sdkVersion),
     ...optional("apiVersion", input.apiVersion),
+    ...optional("replay", input.replay),
     ...optionalObject("api", api),
     ...optionalObject("client", clients.shared),
     ...optionalObject("docs", docs.shared),