@postman/sdk-config 0.4.0 → 0.5.0

package/dist/index.js

@@ -28,6 +28,59 @@ var jsonValueSchema = z.lazy(
   ])
 );
 var jsonObjectSchema = z.record(z.string(), jsonValueSchema);
+var hashAlgorithmSchema = z.enum(["sha1", "sha256", "sha384", "sha512"]);
+var encodingSchema = z.enum(["base64", "hex"]);
+var payloadComponentSchema = z.enum(["body", "timestamp", "notification-url", "message-id"]);
+var payloadFormatSchema = z.strictObject({
+  components: z.array(payloadComponentSchema).min(1),
+  delimiter: z.string().optional(),
+  /**
+   * Set when the body is a form-encoded parameter map that must be canonicalized before signing:
+   * keys sorted, each key's values deduped and sorted, concatenated as key-value pairs.
+   */
+  bodySort: z.literal("alphabetical").optional()
+});
+var timestampSchema = z.strictObject({
+  header: nonEmptyStringSchema,
+  format: z.enum(["unix-seconds", "unix-millis", "iso8601"]).optional(),
+  /** Replay window in seconds. */
+  tolerance: z.number().positive().optional()
+});
+var bodyHashLocationSchema = z.discriminatedUnion("type", [
+  z.strictObject({
+    type: z.literal("query-parameter"),
+    name: nonEmptyStringSchema
+  })
+]);
+var bodyHashBindingSchema = z.strictObject({
+  algorithm: hashAlgorithmSchema,
+  encoding: encodingSchema.optional(),
+  location: bodyHashLocationSchema
+});
+var urlNormalizationSchema = z.strictObject({
+  /** Try the URL with and without an explicit default port. */
+  portVariants: z.boolean().optional(),
+  /** Try the URL with the pre-RFC3986 query encoding (`+` for space, unescaped `*`). */
+  legacyQueryEncoding: z.boolean().optional()
+}).refine(
+  ({ portVariants, legacyQueryEncoding }) => portVariants === true || legacyQueryEncoding === true,
+  { message: "url normalization must enable at least one variant" }
+);
+var webhookSignatureSchema = z.discriminatedUnion("type", [
+  z.strictObject({
+    type: z.literal("hmac"),
+    /** Request header carrying the signature. */
+    header: nonEmptyStringSchema,
+    algorithm: hashAlgorithmSchema.optional(),
+    encoding: encodingSchema.optional(),
+    /** Stripped from the header value before comparison, e.g. `sha256=`. */
+    signaturePrefix: z.string().optional(),
+    payloadFormat: payloadFormatSchema.optional(),
+    timestamp: timestampSchema.optional(),
+    bodyHashBinding: bodyHashBindingSchema.optional(),
+    urlNormalization: urlNormalizationSchema.optional()
+  })
+]);
 
 // src/sdk-config-domain/v1/api.ts
 var authVariableSchema = z.strictObject({
@@ -186,13 +239,19 @@ var apiConfigSchema = z.strictObject({
    * Absent means all audiences. A present empty array selects no tagged audience: untagged nodes
    * remain included, while every audience-tagged node is excluded.
    */
-  audiences: z.array(nonEmptyStringSchema).optional()
+  audiences: z.array(nonEmptyStringSchema).optional(),
+  /**
+   * How the API signs the webhooks it sends, enabling a generated verification helper. API-wide, and
+   * independent of whether any webhook is modeled — see {@link webhookSignatureSchema}.
+   */
+  webhookSignature: webhookSignatureSchema.optional()
 });
 
 // src/sdk-config/v1/api.ts
 var sdkConfigV1AuthSchemeSchema = authSchemeSchema;
 var sdkConfigV1AuthConfigSchema = authConfigSchema;
 var sdkConfigV1ApiConfigSchema = apiConfigSchema;
+var sdkConfigV1WebhookSignatureSchema = webhookSignatureSchema;
 var retryOverrideShape = {
   enabled: z.boolean().optional(),
   maxAttempts: z.number().int().min(1).optional(),
@@ -575,7 +634,13 @@ function mapOutput(generator, language, index) {
   const raw = isObject(generator.raw) ? generator.raw : void 0;
   const rawOutput = raw && isObject(raw.output) ? raw.output : void 0;
   const outputPath = ["group", "generators", index, "outputMode"];
-  const state = { consumedPaths: /* @__PURE__ */ new Set() };
+  const state = { consumedPaths: /* @__PURE__ */ new Set(), credentialDiagnostics: [] };
+  if (generator.output) {
+    return {
+      output: sanitizeNormalizedOutput(generator.output, rawOutput, state, index),
+      unsupportedFields: state.credentialDiagnostics ?? []
+    };
+  }
   if (rawOutput?.location === "local-file-system") {
     if (isObject(generator.outputMode)) consume(state, [...outputPath, "type"]);
     return finishOutputMapping(
@@ -607,7 +672,7 @@ function mapOutput(generator, language, index) {
       return finishOutputMapping({ output: { delivery: "zip" } }, output, outputPath, state, index);
     case "github":
       return finishOutputMapping(
-        githubOutput(output, output.publishInfo, language, outputPath, state, index),
+        githubOutput(output, output.publishInfo, rawOutput, language, outputPath, state, index),
         output,
         outputPath,
         state,
@@ -627,6 +692,7 @@ function mapOutput(generator, language, index) {
         githubOutput(
           output.githubV2,
           output.githubV2.publishInfo,
+          rawOutput,
           language,
           githubPath,
           state,
@@ -641,6 +707,7 @@ function mapOutput(generator, language, index) {
     case "publishV2": {
       const publication = mapPublication(
         output.publishV2,
+        rawOutput,
         language,
         [...outputPath, "publishV2"],
         state,
@@ -660,6 +727,7 @@ function mapOutput(generator, language, index) {
     case "publish": {
       const publication = mapLegacyPublication(
         output.registryOverrides,
+        rawOutput,
         language,
         [...outputPath, "registryOverrides"],
         state,
@@ -686,7 +754,22 @@ function mapOutput(generator, language, index) {
       );
   }
 }
-function githubOutput(value, publishInfo, language, sourcePath, state, index) {
+function sanitizeNormalizedOutput(output, rawOutput, state, index) {
+  const publish = output.publish ? sanitizePublishConfig(output.publish, output.publish, rawOutput, state, index) : void 0;
+  const publishShape = publish ? { publish } : {};
+  if (output.delivery !== "github") return { ...output, ...publishShape };
+  const { credentials, ...github } = output.github;
+  if (credentials) {
+    addCredentialDiagnostic(
+      state,
+      ["group", "generators", index, "output", "github", "credentials"],
+      ["targets", index, "output", "github", "credentials"],
+      "Normalized GitHub credentials have no raw environment-expression provenance"
+    );
+  }
+  return { ...output, github, ...publishShape };
+}
+function githubOutput(value, publishInfo, rawOutput, language, sourcePath, state, index) {
   const owner = stringValue(value.owner);
   const repo = stringValue(value.repo);
   if (!owner || !repo)
@@ -699,14 +782,22 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
     );
   consume(state, [...sourcePath, "owner"]);
   consume(state, [...sourcePath, "repo"]);
-  const publication = publishInfo ? mapPublication(publishInfo, language, [...sourcePath, "publishInfo"], state, index) : void 0;
+  const publication = publishInfo ? mapPublication(publishInfo, rawOutput, language, [...sourcePath, "publishInfo"], state, index) : void 0;
   const type = stringValue(value.type);
   const reviewers = mapReviewers(value.reviewers, [...sourcePath, "reviewers"], state);
   if (type) consume(state, [...sourcePath, "type"]);
   if (typeof value.makePr === "boolean") consume(state, [...sourcePath, "makePr"]);
   if (stringValue(value.host)) consume(state, [...sourcePath, "host"]);
   if (stringValue(value.branch)) consume(state, [...sourcePath, "branch"]);
-  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
+  consumeCredentialObject(value.credentials, [...sourcePath, "credentials"], state);
+  if (isObject(value.credentials)) {
+    addCredentialDiagnostic(
+      state,
+      [...sourcePath, "credentials"],
+      ["targets", index, "output", "github", "credentials"],
+      "GitHub credentials cannot be traced safely to raw environment expressions"
+    );
+  }
   return {
     output: {
       delivery: "github",
@@ -715,57 +806,35 @@ function githubOutput(value, publishInfo, language, sourcePath, state, index) {
         ...optional("host", stringValue(value.host)),
         ...optional("branch", stringValue(value.branch)),
         mode: value.makePr === true || type === "pullRequest" ? "pull-request" : type === "push" ? "push" : "release",
-        ...optional("reviewers", reviewers),
-        ...optional("credentials", credentials)
+        ...optional("reviewers", reviewers)
       },
       ...publication ? { publish: publication.publish } : {}
     },
     ...optional("package", publication?.package)
   };
 }
-function mapCredentials(value, sourcePath, state) {
-  if (!isObject(value)) return void 0;
-  return credentialsFromObject(value, sourcePath, state);
-}
-function mapInlineCredentials(value, sourcePath, state) {
-  const credentials = mapCredentials(value.credentials, [...sourcePath, "credentials"], state);
-  if (credentials) return credentials;
-  return credentialsFromObject(value, sourcePath, state);
-}
-function credentialsFromObject(value, sourcePath, state) {
-  const credentials = {};
-  const username = stringValue(value.username);
-  const password = stringValue(value.password);
-  const token = stringValue(value.token);
-  const apiKey = stringValue(value.apiKey);
-  if (username) {
-    credentials.username = username;
-    consume(state, [...sourcePath, "username"]);
-  }
-  if (password) {
-    credentials.password = password;
-    consume(state, [...sourcePath, "password"]);
-  }
-  if (token) {
-    credentials.token = token;
-    consume(state, [...sourcePath, "token"]);
-  }
-  if (apiKey) {
-    credentials.apiKey = apiKey;
-    consume(state, [...sourcePath, "apiKey"]);
-  }
-  return Object.keys(credentials).length === 0 ? void 0 : credentials;
-}
-function mapMavenSignature(value, sourcePath, state) {
-  if (!isObject(value)) return void 0;
-  const keyId = stringValue(value.keyId);
-  const password = stringValue(value.password);
-  const secretKey = stringValue(value.secretKey);
-  if (!keyId || !password || !secretKey) return void 0;
-  consume(state, [...sourcePath, "keyId"]);
-  consume(state, [...sourcePath, "password"]);
-  consume(state, [...sourcePath, "secretKey"]);
-  return { keyId, password, secretKey };
+function consumeCredentialObject(value, sourcePath, state) {
+  if (!isObject(value)) return;
+  for (const field of ["username", "password", "token", "apiKey"]) {
+    if (stringValue(value[field])) consume(state, [...sourcePath, field]);
+  }
+}
+function consumeResolvedCredentials(value, sourcePath, state) {
+  for (const field of ["username", "password", "token", "apiKey"]) {
+    if (stringValue(value[field])) {
+      consume(state, [...sourcePath, field]);
+    }
+  }
+  if (isObject(value.credentials)) {
+    for (const field of ["username", "password", "token", "apiKey"]) {
+      if (stringValue(value.credentials[field])) {
+        consume(state, [...sourcePath, "credentials", field]);
+      }
+    }
+  }
+  if (isObject(value.signature)) {
+    consume(state, [...sourcePath, "signature"]);
+  }
 }
 function mapReviewers(value, sourcePath, state) {
   if (Array.isArray(value)) {
@@ -794,7 +863,7 @@ function reviewerNames(value, expectedType, sourcePath, state) {
   });
   return names.length ? names : void 0;
 }
-function mapPublication(value, language, sourcePath, state, index) {
+function mapPublication(value, rawOutput, language, sourcePath, state, index) {
   if (!isObject(value))
     fail(
       "FERN_PUBLICATION_INVALID",
@@ -810,13 +879,19 @@ function mapPublication(value, language, sourcePath, state, index) {
   const registry = publicationRegistry(type, language, [...sourcePath, "type"], index);
   const registryUrl = stringValue(nested.registryUrl);
   if (registryUrl) consume(state, [...nestedPath, "registryUrl"]);
-  const credentials = mapInlineCredentials(nested, nestedPath, state);
+  consumeResolvedCredentials(nested, nestedPath, state);
+  const publish = sanitizePublishConfig(
+    compact({ registry, url: registryUrl }),
+    nested,
+    rawOutput,
+    state,
+    index
+  );
   if (registry === "maven") {
     const coordinate = stringValue(nested.coordinate);
-    const signature = mapMavenSignature(nested.signature, [...nestedPath, "signature"], state);
     if (coordinate) consume(state, [...nestedPath, "coordinate"]);
     return {
-      publish: compact({ registry, url: registryUrl, credentials, signature }),
+      publish,
       ...coordinate ? { package: mavenPackage(coordinate, [...nestedPath, "coordinate"], index) } : {}
     };
   }
@@ -825,15 +900,244 @@ function mapPublication(value, language, sourcePath, state, index) {
   if (packageName) consume(state, [...nestedPath, packageNameField]);
   const metadata = registry === "pypi" ? mapPypiMetadata(nested.pypiMetadata, nestedPath, state) : {};
   return {
-    publish: compact({ registry, url: registryUrl, credentials }),
+    publish,
     ...packageName || Object.keys(metadata).length ? { package: { ...optional("packageName", packageName), ...metadata } } : {}
   };
 }
-function mapLegacyPublication(value, language, sourcePath, state, index) {
+function sanitizePublishConfig(publish, resolvedPublication, rawOutput, state, index) {
+  const rawPublication = rawOutput?.location === publish.registry ? rawOutput : void 0;
+  const rawPath = ["group", "generators", index, "output"];
+  if (publish.registry === "npm" || publish.registry === "crates") {
+    const token = mapCredentialExpression(
+      rawPublication,
+      resolvedPublication,
+      "token",
+      rawPath,
+      state,
+      index
+    );
+    warnForUnexpectedCredentialFields(
+      rawPublication,
+      resolvedPublication,
+      ["token"],
+      rawPath,
+      state,
+      index
+    );
+    return compact({
+      registry: publish.registry,
+      url: publish.url,
+      releaseBranch: publish.releaseBranch,
+      tolerateRepublish: publish.tolerateRepublish,
+      token
+    });
+  }
+  if (publish.registry === "pypi") {
+    const { username, password } = mapPypiCredentialExpressions(
+      rawPublication,
+      resolvedPublication,
+      rawPath,
+      state,
+      index
+    );
+    warnForUnexpectedCredentialFields(
+      rawPublication,
+      resolvedPublication,
+      ["username", "password", "token"],
+      rawPath,
+      state,
+      index
+    );
+    return compact({
+      registry: publish.registry,
+      url: publish.url,
+      releaseBranch: publish.releaseBranch,
+      tolerateRepublish: publish.tolerateRepublish,
+      username,
+      password
+    });
+  }
+  if (publish.registry === "maven") {
+    const username = mapCredentialExpression(
+      rawPublication,
+      resolvedPublication,
+      "username",
+      rawPath,
+      state,
+      index
+    );
+    const password = mapCredentialExpression(
+      rawPublication,
+      resolvedPublication,
+      "password",
+      rawPath,
+      state,
+      index
+    );
+    const signature = mapMavenSignatureExpressions(
+      rawPublication?.signature,
+      resolvedPublication.signature,
+      [...rawPath, "signature"],
+      state,
+      index
+    );
+    warnForUnexpectedCredentialFields(
+      rawPublication,
+      resolvedPublication,
+      ["username", "password"],
+      rawPath,
+      state,
+      index,
+      true
+    );
+    return compact({
+      registry: publish.registry,
+      url: publish.url,
+      releaseBranch: publish.releaseBranch,
+      tolerateRepublish: publish.tolerateRepublish,
+      username,
+      password,
+      signature
+    });
+  }
+  warnForUnrepresentableCredentials(rawPublication, resolvedPublication, rawPath, state, index);
+  return compact({
+    registry: publish.registry,
+    url: publish.url,
+    releaseBranch: publish.releaseBranch,
+    tolerateRepublish: publish.tolerateRepublish
+  });
+}
+function mapLegacyPublication(value, rawOutput, language, sourcePath, state, index) {
   const registry = defaultRegistry(language, sourcePath, index);
   const overrides = isObject(value) ? value : {};
   const override = isObject(overrides[registry]) ? overrides[registry] : {};
-  return mapPublication(override, language, [...sourcePath, registry], state, index);
+  return mapPublication(override, rawOutput, language, [...sourcePath, registry], state, index);
+}
+function mapCredentialExpression(rawPublication, resolvedPublication, field, rawPath, state, index) {
+  const rawValue = rawPublication?.[field];
+  if (isEnvironmentExpression(rawValue)) return rawValue;
+  if (rawValue !== void 0 || hasResolvedCredential(resolvedPublication, field)) {
+    addCredentialDiagnostic(
+      state,
+      [...rawPath, field],
+      ["targets", index, "output", "publish", field],
+      `Fern publishing ${field} is not an exact environment expression`
+    );
+  }
+  return void 0;
+}
+function mapPypiCredentialExpressions(rawPublication, resolvedPublication, rawPath, state, index) {
+  const rawToken = rawPublication?.token;
+  if (isEnvironmentExpression(rawToken)) {
+    return { username: "__token__", password: rawToken };
+  }
+  const resolvedUsesToken = resolvedCredentialValue(resolvedPublication, "username") === "__token__";
+  if (rawToken !== void 0 || resolvedUsesToken) {
+    addCredentialDiagnostic(
+      state,
+      [...rawPath, "token"],
+      ["targets", index, "output", "publish", "password"],
+      "Fern PyPI token is not an exact raw environment expression"
+    );
+    return {};
+  }
+  return {
+    ...optional(
+      "username",
+      mapCredentialExpression(
+        rawPublication,
+        resolvedPublication,
+        "username",
+        rawPath,
+        state,
+        index
+      )
+    ),
+    ...optional(
+      "password",
+      mapCredentialExpression(
+        rawPublication,
+        resolvedPublication,
+        "password",
+        rawPath,
+        state,
+        index
+      )
+    )
+  };
+}
+function mapMavenSignatureExpressions(rawValue, resolvedValue, rawPath, state, index) {
+  if (isObject(rawValue)) {
+    const yamlValues = [rawValue["key-id"], rawValue.password, rawValue["secret-key"]];
+    const projectedValues = [rawValue.keyId, rawValue.password, rawValue.secretKey];
+    const values = yamlValues.every(isEnvironmentExpression) ? yamlValues : projectedValues.every(isEnvironmentExpression) ? projectedValues : void 0;
+    if (values) {
+      const [keyId, password, secretKey] = values;
+      return { keyId, password, secretKey };
+    }
+  }
+  if (rawValue !== void 0 || isObject(resolvedValue)) {
+    addCredentialDiagnostic(
+      state,
+      rawPath,
+      ["targets", index, "output", "publish", "signature"],
+      "Maven signing credentials are incomplete or not exact environment expressions"
+    );
+  }
+  return void 0;
+}
+function warnForUnrepresentableCredentials(rawPublication, resolvedPublication, rawPath, state, index) {
+  const rawHasCredential = ["username", "password", "token", "apiKey"].some(
+    (field) => rawPublication?.[field] !== void 0
+  ) || rawPublication?.signature !== void 0;
+  if (rawHasCredential || hasAnyResolvedCredential(resolvedPublication)) {
+    addCredentialDiagnostic(
+      state,
+      rawPath,
+      ["targets", index, "output", "publish"],
+      "This registry does not support credentials in public SDK Config v1"
+    );
+  }
+}
+function warnForUnexpectedCredentialFields(rawPublication, resolvedPublication, allowedFields, rawPath, state, index, allowSignature = false) {
+  const credentialFields = ["username", "password", "token", "apiKey"];
+  const unexpectedFields = credentialFields.filter(
+    (field) => !allowedFields.includes(field) && (rawPublication?.[field] !== void 0 || hasResolvedCredential(resolvedPublication, field))
+  );
+  const hasUnexpectedSignature = !allowSignature && (rawPublication?.signature !== void 0 || resolvedPublication.signature !== void 0);
+  if (unexpectedFields.length > 0 || hasUnexpectedSignature) {
+    addCredentialDiagnostic(
+      state,
+      rawPath,
+      ["targets", index, "output", "publish"],
+      "Fern publishing credentials or signing material include fields unsupported by this registry"
+    );
+  }
+}
+function hasResolvedCredential(value, field) {
+  return resolvedCredentialValue(value, field) !== void 0;
+}
+function resolvedCredentialValue(value, field) {
+  return stringValue(value[field]) ?? (isObject(value.credentials) ? stringValue(value.credentials[field]) : void 0);
+}
+function hasAnyResolvedCredential(value) {
+  return ["username", "password", "token", "apiKey"].some(
+    (field) => hasResolvedCredential(value, field)
+  ) || value.signature !== void 0;
+}
+function isEnvironmentExpression(value) {
+  return typeof value === "string" && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(value);
+}
+function addCredentialDiagnostic(state, path, sdkConfigPath, reason) {
+  state.credentialDiagnostics?.push({
+    code: "FERN_OUTPUT_CREDENTIAL_OMITTED",
+    severity: "warning",
+    path,
+    reason,
+    sdkConfigPath,
+    suggestedAction: `Configure ${sdkConfigPath.join(".")} with an environment expression such as \${CREDENTIAL_ENV_VAR}.`
+  });
 }
 function publicationRegistry(type, language, sourcePath, index) {
   if (type === "postman") {
@@ -941,6 +1245,7 @@ function finishOutputMapping(mapping, outputMode, sourcePath, state, index) {
   return {
     ...mapping,
     unsupportedFields: [
+      ...state.credentialDiagnostics ?? [],
       ...hasCredentials ? [
         {
           code: "FERN_OUTPUT_CREDENTIAL_UNSUPPORTED",
@@ -1170,12 +1475,6 @@ var sdkConfigV1PublishRegistrySchema = z.enum([
   "go",
   "composer"
 ]);
-var registryCredentialsSchema = z.strictObject({
-  username: nonEmptyStringSchema.optional(),
-  password: nonEmptyStringSchema.optional(),
-  token: nonEmptyStringSchema.optional(),
-  apiKey: nonEmptyStringSchema.optional()
-});
 var mavenSignatureSchema = z.strictObject({
   keyId: nonEmptyStringSchema,
   password: nonEmptyStringSchema,
@@ -1183,23 +1482,35 @@ var mavenSignatureSchema = z.strictObject({
 });
 var commonPublishShape = {
   url: nonEmptyStringSchema.optional(),
-  /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
-  credentials: registryCredentialsSchema.optional(),
   releaseBranch: nonEmptyStringSchema.optional(),
   tolerateRepublish: z.boolean().optional()
 };
 var sdkConfigV1PublishConfigSchema = z.discriminatedUnion("registry", [
-  z.strictObject({ registry: z.literal("npm"), ...commonPublishShape }),
-  z.strictObject({ registry: z.literal("pypi"), ...commonPublishShape }),
+  z.strictObject({
+    registry: z.literal("npm"),
+    token: nonEmptyStringSchema.optional(),
+    ...commonPublishShape
+  }),
+  z.strictObject({
+    registry: z.literal("pypi"),
+    username: nonEmptyStringSchema.optional(),
+    password: nonEmptyStringSchema.optional(),
+    ...commonPublishShape
+  }),
   z.strictObject({
     registry: z.literal("maven"),
-    /** Raw Maven signing material. These values can be sensitive and must be handled as secrets. */
+    username: nonEmptyStringSchema.optional(),
+    password: nonEmptyStringSchema.optional(),
     signature: mavenSignatureSchema.optional(),
     ...commonPublishShape
   }),
   z.strictObject({ registry: z.literal("nuget"), ...commonPublishShape }),
   z.strictObject({ registry: z.literal("rubygems"), ...commonPublishShape }),
-  z.strictObject({ registry: z.literal("crates"), ...commonPublishShape }),
+  z.strictObject({
+    registry: z.literal("crates"),
+    token: nonEmptyStringSchema.optional(),
+    ...commonPublishShape
+  }),
   z.strictObject({ registry: z.literal("go"), ...commonPublishShape }),
   z.strictObject({ registry: z.literal("composer"), ...commonPublishShape })
 ]);
@@ -1207,7 +1518,12 @@ var reviewersSchema = z.strictObject({
   teams: z.array(nonEmptyStringSchema).optional(),
   users: z.array(nonEmptyStringSchema).optional()
 });
-var githubCredentialsSchema = registryCredentialsSchema;
+var githubCredentialsSchema = z.strictObject({
+  username: nonEmptyStringSchema.optional(),
+  password: nonEmptyStringSchema.optional(),
+  token: nonEmptyStringSchema.optional(),
+  apiKey: nonEmptyStringSchema.optional()
+});
 var githubOutputSchema = z.strictObject({
   repository: nonEmptyStringSchema,
   host: nonEmptyStringSchema.optional(),
@@ -1724,7 +2040,7 @@ function mapFernConfigToSdkConfigV1(input) {
   const mapped = input.group.generators.map((generator, index) => {
     const language = languages[index];
     const invocation = mapInvocation(generator, language, activeLanguages, index);
-    const outputMapping = generator.output ? { output: generator.output, unsupportedFields: [] } : mapOutput(generator, language, index);
+    const outputMapping = mapOutput(generator, language, index);
     return {
       generator,
       language,
@@ -1783,6 +2099,7 @@ function mapFernConfigToSdkConfigV1(input) {
     source: input.source,
     ...optional("sdkVersion", input.sdkVersion),
     ...optional("apiVersion", input.apiVersion),
+    ...optional("replay", input.replay),
     ...optionalObject("api", api),
     ...optionalObject("client", clients.shared),
     ...optionalObject("docs", docs.shared),
@@ -2113,7 +2430,7 @@ function mapLanguageConfig(language, config, state, packageConfig, basePath) {
     case "rust":
       return mapRust(config, state, packageConfig, basePath);
     case "swift":
-      return compact({ moduleName: takeString(config, ["moduleName"], state, basePath) });
+      return mapSwift(config, state, basePath);
     case "cli":
       return mapCli(config, state, packageConfig, basePath);
     case "terraform":
@@ -2280,6 +2597,12 @@ function mapRust(config, state, packageConfig, basePath) {
     defaultFeatures: takeStringArray(config, ["defaultFeatures"], state, basePath)
   });
 }
+function mapSwift(config, state, basePath) {
+  return compact({
+    moduleName: takeString(config, ["moduleName"], state, basePath),
+    nullableAsOptional: takeBoolean(config, ["nullableAsOptional"], state, basePath)
+  });
+}
 function mapCli(config, state, packageConfig, basePath) {
   const identity = takeObject(config, ["packageIdentity"], state, basePath);
   if (identity) {
@@ -2715,7 +3038,7 @@ var credentialResolutionSchema = z.enum([
   "resolved-by-orchestrator",
   "resolved-by-fiddle"
 ]);
-var registryCredentialsSchema2 = z.strictObject({
+var registryCredentialsSchema = z.strictObject({
   username: nonEmptyStringSchema.optional(),
   password: nonEmptyStringSchema.optional(),
   token: nonEmptyStringSchema.optional(),
@@ -2726,7 +3049,7 @@ var commonPublishShape2 = {
   /** Reference to registry publishing credentials. */
   credentialsRef: nonEmptyStringSchema.optional(),
   /** Raw registry credentials. These values can be sensitive and must be handled as secrets. */
-  credentials: registryCredentialsSchema2.optional(),
+  credentials: registryCredentialsSchema.optional(),
   /**
    * Registry-specific package version override. If omitted, the external publisher/orchestrator may
    * fall back to target.sdkVersion.
@@ -2831,7 +3154,7 @@ var githubOutputSchema2 = z.strictObject({
   /** Reference to GitHub credentials. */
   credentialsRef: nonEmptyStringSchema.optional(),
   /** Raw GitHub credentials. These values can be sensitive and must be handled as secrets. */
-  credentials: registryCredentialsSchema2.optional(),
+  credentials: registryCredentialsSchema.optional(),
   privateRepository: z.boolean().optional(),
   /** GitHub license block scoped to repository delivery. */
   license: githubLicenseSchema.optional(),
@@ -3071,6 +3394,6 @@ function parseSdkConfigIrV1(value) {
   return sdkConfigIrV1Schema.parse(value);
 }
 
-export { FernConfigMappingError, SDK_CONFIG_IR_V1_SCHEMA_VERSION, SDK_CONFIG_V1_SCHEMA_VERSION, apiConfigSchema, apiImportSettingsSchema, authConfigSchema, authSchemeSchema, cliGenerationConfigSchema, clientConfigOverrideSchema, clientConfigSchema, clientRetryOverrideSchema, compatibilityConfigSchema, composerPackageNameSchema, csharpGenerationConfigSchema, dependencySchema, docsConfigSchema, exactSemverSchema, generationConfigSchema, goGenerationConfigSchema, goModulePathSchema, javaGenerationConfigSchema, jsonObjectSchema, jsonValueSchema, kotlinGenerationConfigSchema, languageGenerationConfigSchema, legacyInputSchema, mapFernConfigToSdkConfigV1, mcpAvailabilityStatuses, mcpGenerationConfigSchema, nonEmptyStringSchema, outputConfigSchema, packageConfigSchema, parseSdkConfigIrV1, parseSdkConfigV1, phpGenerationConfigSchema, publishConfigSchema, publishRegistrySchema, pythonGenerationConfigSchema, readmeCustomSectionSchema, readmeEndpointSchema, relativePathSchema, replayConfigSchema, rubyGenerationConfigSchema, rustGenerationConfigSchema, sdkConfigIrV1Schema, sdkConfigV1ApiConfigSchema, sdkConfigV1AuthConfigSchema, sdkConfigV1AuthSchemeSchema, cliGenerationConfigSchema as sdkConfigV1CliGenerationConfigSchema, sdkConfigV1ClientConfigOverrideSchema, sdkConfigV1ClientConfigSchema, composerPackageNameSchema as sdkConfigV1ComposerPackageNameSchema, csharpGenerationConfigSchema as sdkConfigV1CsharpGenerationConfigSchema, sdkConfigV1DependencySchema, sdkConfigV1DocsConfigSchema, exactSemverSchema as sdkConfigV1ExactSemverSchema, sdkConfigV1GenerationConfigOverrideSchema, sdkConfigV1GenerationConfigSchema, goGenerationConfigSchema as sdkConfigV1GoGenerationConfigSchema, goModulePathSchema as sdkConfigV1GoModulePathSchema, javaGenerationConfigSchema as sdkConfigV1JavaGenerationConfigSchema, kotlinGenerationConfigSchema as sdkConfigV1KotlinGenerationConfigSchema, mcpGenerationConfigSchema as sdkConfigV1McpGenerationConfigSchema, nonEmptyStringSchema as sdkConfigV1NonEmptyStringSchema, sdkConfigV1OutputConfigSchema, sdkConfigV1PackageConfigSchema, phpGenerationConfigSchema as sdkConfigV1PhpGenerationConfigSchema, sdkConfigV1PublishConfigSchema, sdkConfigV1PublishRegistrySchema, pythonGenerationConfigSchema as sdkConfigV1PythonGenerationConfigSchema, sdkConfigV1ReadmeCustomSectionSchema, sdkConfigV1ReadmeEndpointSchema, relativePathSchema as sdkConfigV1RelativePathSchema, sdkConfigV1ReplayConfigSchema, rubyGenerationConfigSchema as sdkConfigV1RubyGenerationConfigSchema, rustGenerationConfigSchema as sdkConfigV1RustGenerationConfigSchema, sdkConfigV1Schema, sdkConfigV1SourceConfigSchema, sdkConfigV1SourceSpecSchema, swiftGenerationConfigSchema as sdkConfigV1SwiftGenerationConfigSchema, sdkConfigV1TargetSchema, terraformGenerationConfigSchema as sdkConfigV1TerraformGenerationConfigSchema, typescriptGenerationConfigSchema as sdkConfigV1TypescriptGenerationConfigSchema, sourceConfigSchema, sourceSpecConfigSchema, sourceSpecTypeSchema, splitSdkConfigV1TargetGeneration, swiftGenerationConfigSchema, targetConfigSchema, targetLanguageSchema, terraformGenerationConfigSchema, typescriptGenerationConfigSchema, unsupportedFieldSchema, validateSdkConfigV1 };
+export { FernConfigMappingError, SDK_CONFIG_IR_V1_SCHEMA_VERSION, SDK_CONFIG_V1_SCHEMA_VERSION, apiConfigSchema, apiImportSettingsSchema, authConfigSchema, authSchemeSchema, cliGenerationConfigSchema, clientConfigOverrideSchema, clientConfigSchema, clientRetryOverrideSchema, compatibilityConfigSchema, composerPackageNameSchema, csharpGenerationConfigSchema, dependencySchema, docsConfigSchema, exactSemverSchema, generationConfigSchema, goGenerationConfigSchema, goModulePathSchema, javaGenerationConfigSchema, jsonObjectSchema, jsonValueSchema, kotlinGenerationConfigSchema, languageGenerationConfigSchema, legacyInputSchema, mapFernConfigToSdkConfigV1, mcpAvailabilityStatuses, mcpGenerationConfigSchema, nonEmptyStringSchema, outputConfigSchema, packageConfigSchema, parseSdkConfigIrV1, parseSdkConfigV1, phpGenerationConfigSchema, publishConfigSchema, publishRegistrySchema, pythonGenerationConfigSchema, readmeCustomSectionSchema, readmeEndpointSchema, relativePathSchema, replayConfigSchema, rubyGenerationConfigSchema, rustGenerationConfigSchema, sdkConfigIrV1Schema, sdkConfigV1ApiConfigSchema, sdkConfigV1AuthConfigSchema, sdkConfigV1AuthSchemeSchema, cliGenerationConfigSchema as sdkConfigV1CliGenerationConfigSchema, sdkConfigV1ClientConfigOverrideSchema, sdkConfigV1ClientConfigSchema, composerPackageNameSchema as sdkConfigV1ComposerPackageNameSchema, csharpGenerationConfigSchema as sdkConfigV1CsharpGenerationConfigSchema, sdkConfigV1DependencySchema, sdkConfigV1DocsConfigSchema, exactSemverSchema as sdkConfigV1ExactSemverSchema, sdkConfigV1GenerationConfigOverrideSchema, sdkConfigV1GenerationConfigSchema, goGenerationConfigSchema as sdkConfigV1GoGenerationConfigSchema, goModulePathSchema as sdkConfigV1GoModulePathSchema, javaGenerationConfigSchema as sdkConfigV1JavaGenerationConfigSchema, kotlinGenerationConfigSchema as sdkConfigV1KotlinGenerationConfigSchema, mcpGenerationConfigSchema as sdkConfigV1McpGenerationConfigSchema, nonEmptyStringSchema as sdkConfigV1NonEmptyStringSchema, sdkConfigV1OutputConfigSchema, sdkConfigV1PackageConfigSchema, phpGenerationConfigSchema as sdkConfigV1PhpGenerationConfigSchema, sdkConfigV1PublishConfigSchema, sdkConfigV1PublishRegistrySchema, pythonGenerationConfigSchema as sdkConfigV1PythonGenerationConfigSchema, sdkConfigV1ReadmeCustomSectionSchema, sdkConfigV1ReadmeEndpointSchema, relativePathSchema as sdkConfigV1RelativePathSchema, sdkConfigV1ReplayConfigSchema, rubyGenerationConfigSchema as sdkConfigV1RubyGenerationConfigSchema, rustGenerationConfigSchema as sdkConfigV1RustGenerationConfigSchema, sdkConfigV1Schema, sdkConfigV1SourceConfigSchema, sdkConfigV1SourceSpecSchema, swiftGenerationConfigSchema as sdkConfigV1SwiftGenerationConfigSchema, sdkConfigV1TargetSchema, terraformGenerationConfigSchema as sdkConfigV1TerraformGenerationConfigSchema, typescriptGenerationConfigSchema as sdkConfigV1TypescriptGenerationConfigSchema, sdkConfigV1WebhookSignatureSchema, sourceConfigSchema, sourceSpecConfigSchema, sourceSpecTypeSchema, splitSdkConfigV1TargetGeneration, swiftGenerationConfigSchema, targetConfigSchema, targetLanguageSchema, terraformGenerationConfigSchema, typescriptGenerationConfigSchema, unsupportedFieldSchema, validateSdkConfigV1, webhookSignatureSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map