@postman/sdk-config 0.9.0 → 0.11.0

package/dist/{typescript-Chge0X4f.d.cts → typescript-CsAa1VSy.d.cts}

@@ -134,14 +134,94 @@ declare const packageConfigSchema: z.ZodObject<{
         defaultFeatures: z.ZodOptional<z.ZodBoolean>;
         environmentMarker: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
+    extraPeerDependenciesMeta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonObject, unknown, z.core.$ZodTypeInternals<JsonObject, unknown>>>>;
 }, z.core.$strict>;
 type Dependency = z.infer<typeof dependencySchema>;
 type PackageConfig = z.infer<typeof packageConfigSchema>;
 
+declare const githubActionsSecretNameSchema: z.ZodString;
+declare const cliDistributionGithubAppSchema: z.ZodObject<{
+    appIdSecretName: z.ZodString;
+    privateKeySecretName: z.ZodString;
+}, z.core.$strict>;
+declare const cliDistributionHomebrewSchema: z.ZodObject<{
+    tap: z.ZodString;
+    formula: z.ZodOptional<z.ZodString>;
+    tokenSecretName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const cliDistributionScoopSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    tokenSecretName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const cliDistributionConfigSchema: z.ZodObject<{
+    githubApp: z.ZodOptional<z.ZodObject<{
+        appIdSecretName: z.ZodString;
+        privateKeySecretName: z.ZodString;
+    }, z.core.$strict>>;
+    homebrew: z.ZodOptional<z.ZodObject<{
+        tap: z.ZodString;
+        formula: z.ZodOptional<z.ZodString>;
+        tokenSecretName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    scoop: z.ZodOptional<z.ZodObject<{
+        bucket: z.ZodString;
+        tokenSecretName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE";
+interface SdkConfigDiagnostic {
+    code: string;
+    severity: 'warning';
+    path: (string | number)[];
+    reason: string;
+    suggestedAction: string;
+}
+type CliDistributionGithubAppConfig = z.infer<typeof cliDistributionGithubAppSchema>;
+type CliDistributionHomebrewConfig = z.infer<typeof cliDistributionHomebrewSchema>;
+type CliDistributionScoopConfig = z.infer<typeof cliDistributionScoopSchema>;
+type CliDistributionConfig = z.infer<typeof cliDistributionConfigSchema>;
+
+declare const profilesProvisionOperationSchema: z.ZodObject<{
+    operation: z.ZodString;
+    credential: z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>;
+    revokeParameters: z.ZodOptional<z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>>;
+}, z.core.$strict>;
+declare const profilesConfigSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    commandName: z.ZodOptional<z.ZodString>;
+    revokeOperation: z.ZodOptional<z.ZodString>;
+    provisionOperation: z.ZodOptional<z.ZodObject<{
+        operation: z.ZodString;
+        credential: z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>;
+        revokeParameters: z.ZodOptional<z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/**
+ * Omitted fields are left undefined; the CLI generator applies its own defaults: a binary name
+ * derived from the API display name, custom commands on, no root group, profiles off, a single
+ * types crate, and a `user-agent-suffix` flag.
+ */
 declare const cliGenerationConfigSchema: z.ZodObject<{
     paginationParameters: z.ZodOptional<z.ZodArray<z.ZodString>>;
     skills: z.ZodOptional<z.ZodBoolean>;
+    binaryName: z.ZodOptional<z.ZodString>;
+    customCommands: z.ZodOptional<z.ZodBoolean>;
+    rootGroup: z.ZodOptional<z.ZodString>;
+    profiles: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        commandName: z.ZodOptional<z.ZodString>;
+        revokeOperation: z.ZodOptional<z.ZodString>;
+        provisionOperation: z.ZodOptional<z.ZodObject<{
+            operation: z.ZodString;
+            credential: z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>;
+            revokeParameters: z.ZodOptional<z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    splitTypeCrates: z.ZodOptional<z.ZodBoolean>;
+    userAgentSuffixFlag: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+type CliProfilesProvisionOperation = z.infer<typeof profilesProvisionOperationSchema>;
+type CliProfilesConfig = z.infer<typeof profilesConfigSchema>;
 type CliGenerationConfig = z.infer<typeof cliGenerationConfigSchema>;
 
 declare const csharpGenerationConfigSchema: z.ZodObject<{
@@ -447,4 +527,4 @@ declare const typescriptGenerationConfigSchema: z.ZodObject<{
 }, z.core.$strict>;
 type TypescriptGenerationConfig = z.infer<typeof typescriptGenerationConfigSchema>;
 
-export { pythonGenerationConfigSchema as A, relativePathSchema as B, type CliGenerationConfig as C, type Dependency as D, rubyGenerationConfigSchema as E, rustGenerationConfigSchema as F, type GoGenerationConfig as G, swiftGenerationConfigSchema as H, terraformGenerationConfigSchema as I, type JavaGenerationConfig as J, type KotlinGenerationConfig as K, typescriptGenerationConfigSchema as L, type McpAvailabilityStatus as M, type PackageConfig as P, type RubyGenerationConfig as R, type SwiftGenerationConfig as S, type TerraformGenerationConfig as T, type CsharpGenerationConfig as a, type JsonObject as b, type JsonValue as c, type McpGenerationConfig as d, type McpToolFilter as e, type PhpGenerationConfig as f, type PlanModifiers as g, type PythonGenerationConfig as h, type RustGenerationConfig as i, type TypescriptGenerationConfig as j, cliGenerationConfigSchema as k, composerPackageNameSchema as l, csharpGenerationConfigSchema as m, dependencySchema as n, exactSemverSchema as o, goGenerationConfigSchema as p, goModulePathSchema as q, javaGenerationConfigSchema as r, jsonObjectSchema as s, jsonValueSchema as t, kotlinGenerationConfigSchema as u, mcpAvailabilityStatuses as v, mcpGenerationConfigSchema as w, nonEmptyStringSchema as x, packageConfigSchema as y, phpGenerationConfigSchema as z };
+export { swiftGenerationConfigSchema as $, exactSemverSchema as A, githubActionsSecretNameSchema as B, CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE as C, type Dependency as D, goGenerationConfigSchema as E, goModulePathSchema as F, type GoGenerationConfig as G, javaGenerationConfigSchema as H, jsonObjectSchema as I, type JavaGenerationConfig as J, type KotlinGenerationConfig as K, jsonValueSchema as L, type McpAvailabilityStatus as M, kotlinGenerationConfigSchema as N, mcpAvailabilityStatuses as O, type PackageConfig as P, mcpGenerationConfigSchema as Q, type RubyGenerationConfig as R, type SdkConfigDiagnostic as S, type TerraformGenerationConfig as T, nonEmptyStringSchema as U, packageConfigSchema as V, phpGenerationConfigSchema as W, pythonGenerationConfigSchema as X, relativePathSchema as Y, rubyGenerationConfigSchema as Z, rustGenerationConfigSchema as _, type CliDistributionConfig as a, terraformGenerationConfigSchema as a0, typescriptGenerationConfigSchema as a1, type CliDistributionGithubAppConfig as b, type CliDistributionHomebrewConfig as c, type CliDistributionScoopConfig as d, type CliGenerationConfig as e, type CliProfilesConfig as f, type CliProfilesProvisionOperation as g, type CsharpGenerationConfig as h, type JsonObject as i, type JsonValue as j, type McpGenerationConfig as k, type McpToolFilter as l, type PhpGenerationConfig as m, type PlanModifiers as n, type PythonGenerationConfig as o, type RustGenerationConfig as p, type SwiftGenerationConfig as q, type TypescriptGenerationConfig as r, cliDistributionConfigSchema as s, cliDistributionGithubAppSchema as t, cliDistributionHomebrewSchema as u, cliDistributionScoopSchema as v, cliGenerationConfigSchema as w, composerPackageNameSchema as x, csharpGenerationConfigSchema as y, dependencySchema as z };

package/dist/{typescript-Chge0X4f.d.ts → typescript-CsAa1VSy.d.ts}

@@ -134,14 +134,94 @@ declare const packageConfigSchema: z.ZodObject<{
         defaultFeatures: z.ZodOptional<z.ZodBoolean>;
         environmentMarker: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
+    extraPeerDependenciesMeta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonObject, unknown, z.core.$ZodTypeInternals<JsonObject, unknown>>>>;
 }, z.core.$strict>;
 type Dependency = z.infer<typeof dependencySchema>;
 type PackageConfig = z.infer<typeof packageConfigSchema>;
 
+declare const githubActionsSecretNameSchema: z.ZodString;
+declare const cliDistributionGithubAppSchema: z.ZodObject<{
+    appIdSecretName: z.ZodString;
+    privateKeySecretName: z.ZodString;
+}, z.core.$strict>;
+declare const cliDistributionHomebrewSchema: z.ZodObject<{
+    tap: z.ZodString;
+    formula: z.ZodOptional<z.ZodString>;
+    tokenSecretName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const cliDistributionScoopSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    tokenSecretName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const cliDistributionConfigSchema: z.ZodObject<{
+    githubApp: z.ZodOptional<z.ZodObject<{
+        appIdSecretName: z.ZodString;
+        privateKeySecretName: z.ZodString;
+    }, z.core.$strict>>;
+    homebrew: z.ZodOptional<z.ZodObject<{
+        tap: z.ZodString;
+        formula: z.ZodOptional<z.ZodString>;
+        tokenSecretName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    scoop: z.ZodOptional<z.ZodObject<{
+        bucket: z.ZodString;
+        tokenSecretName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE = "CLI_DISTRIBUTION_NON_RELEASE_MODE";
+interface SdkConfigDiagnostic {
+    code: string;
+    severity: 'warning';
+    path: (string | number)[];
+    reason: string;
+    suggestedAction: string;
+}
+type CliDistributionGithubAppConfig = z.infer<typeof cliDistributionGithubAppSchema>;
+type CliDistributionHomebrewConfig = z.infer<typeof cliDistributionHomebrewSchema>;
+type CliDistributionScoopConfig = z.infer<typeof cliDistributionScoopSchema>;
+type CliDistributionConfig = z.infer<typeof cliDistributionConfigSchema>;
+
+declare const profilesProvisionOperationSchema: z.ZodObject<{
+    operation: z.ZodString;
+    credential: z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>;
+    revokeParameters: z.ZodOptional<z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>>;
+}, z.core.$strict>;
+declare const profilesConfigSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    commandName: z.ZodOptional<z.ZodString>;
+    revokeOperation: z.ZodOptional<z.ZodString>;
+    provisionOperation: z.ZodOptional<z.ZodObject<{
+        operation: z.ZodString;
+        credential: z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>;
+        revokeParameters: z.ZodOptional<z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/**
+ * Omitted fields are left undefined; the CLI generator applies its own defaults: a binary name
+ * derived from the API display name, custom commands on, no root group, profiles off, a single
+ * types crate, and a `user-agent-suffix` flag.
+ */
 declare const cliGenerationConfigSchema: z.ZodObject<{
     paginationParameters: z.ZodOptional<z.ZodArray<z.ZodString>>;
     skills: z.ZodOptional<z.ZodBoolean>;
+    binaryName: z.ZodOptional<z.ZodString>;
+    customCommands: z.ZodOptional<z.ZodBoolean>;
+    rootGroup: z.ZodOptional<z.ZodString>;
+    profiles: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        commandName: z.ZodOptional<z.ZodString>;
+        revokeOperation: z.ZodOptional<z.ZodString>;
+        provisionOperation: z.ZodOptional<z.ZodObject<{
+            operation: z.ZodString;
+            credential: z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>;
+            revokeParameters: z.ZodOptional<z.ZodType<Record<string, string>, unknown, z.core.$ZodTypeInternals<Record<string, string>, unknown>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    splitTypeCrates: z.ZodOptional<z.ZodBoolean>;
+    userAgentSuffixFlag: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+type CliProfilesProvisionOperation = z.infer<typeof profilesProvisionOperationSchema>;
+type CliProfilesConfig = z.infer<typeof profilesConfigSchema>;
 type CliGenerationConfig = z.infer<typeof cliGenerationConfigSchema>;
 
 declare const csharpGenerationConfigSchema: z.ZodObject<{
@@ -447,4 +527,4 @@ declare const typescriptGenerationConfigSchema: z.ZodObject<{
 }, z.core.$strict>;
 type TypescriptGenerationConfig = z.infer<typeof typescriptGenerationConfigSchema>;
 
-export { pythonGenerationConfigSchema as A, relativePathSchema as B, type CliGenerationConfig as C, type Dependency as D, rubyGenerationConfigSchema as E, rustGenerationConfigSchema as F, type GoGenerationConfig as G, swiftGenerationConfigSchema as H, terraformGenerationConfigSchema as I, type JavaGenerationConfig as J, type KotlinGenerationConfig as K, typescriptGenerationConfigSchema as L, type McpAvailabilityStatus as M, type PackageConfig as P, type RubyGenerationConfig as R, type SwiftGenerationConfig as S, type TerraformGenerationConfig as T, type CsharpGenerationConfig as a, type JsonObject as b, type JsonValue as c, type McpGenerationConfig as d, type McpToolFilter as e, type PhpGenerationConfig as f, type PlanModifiers as g, type PythonGenerationConfig as h, type RustGenerationConfig as i, type TypescriptGenerationConfig as j, cliGenerationConfigSchema as k, composerPackageNameSchema as l, csharpGenerationConfigSchema as m, dependencySchema as n, exactSemverSchema as o, goGenerationConfigSchema as p, goModulePathSchema as q, javaGenerationConfigSchema as r, jsonObjectSchema as s, jsonValueSchema as t, kotlinGenerationConfigSchema as u, mcpAvailabilityStatuses as v, mcpGenerationConfigSchema as w, nonEmptyStringSchema as x, packageConfigSchema as y, phpGenerationConfigSchema as z };
+export { swiftGenerationConfigSchema as $, exactSemverSchema as A, githubActionsSecretNameSchema as B, CLI_DISTRIBUTION_NON_RELEASE_MODE_CODE as C, type Dependency as D, goGenerationConfigSchema as E, goModulePathSchema as F, type GoGenerationConfig as G, javaGenerationConfigSchema as H, jsonObjectSchema as I, type JavaGenerationConfig as J, type KotlinGenerationConfig as K, jsonValueSchema as L, type McpAvailabilityStatus as M, kotlinGenerationConfigSchema as N, mcpAvailabilityStatuses as O, type PackageConfig as P, mcpGenerationConfigSchema as Q, type RubyGenerationConfig as R, type SdkConfigDiagnostic as S, type TerraformGenerationConfig as T, nonEmptyStringSchema as U, packageConfigSchema as V, phpGenerationConfigSchema as W, pythonGenerationConfigSchema as X, relativePathSchema as Y, rubyGenerationConfigSchema as Z, rustGenerationConfigSchema as _, type CliDistributionConfig as a, terraformGenerationConfigSchema as a0, typescriptGenerationConfigSchema as a1, type CliDistributionGithubAppConfig as b, type CliDistributionHomebrewConfig as c, type CliDistributionScoopConfig as d, type CliGenerationConfig as e, type CliProfilesConfig as f, type CliProfilesProvisionOperation as g, type CsharpGenerationConfig as h, type JsonObject as i, type JsonValue as j, type McpGenerationConfig as k, type McpToolFilter as l, type PhpGenerationConfig as m, type PlanModifiers as n, type PythonGenerationConfig as o, type RustGenerationConfig as p, type SwiftGenerationConfig as q, type TypescriptGenerationConfig as r, cliDistributionConfigSchema as s, cliDistributionGithubAppSchema as t, cliDistributionHomebrewSchema as u, cliDistributionScoopSchema as v, cliGenerationConfigSchema as w, composerPackageNameSchema as x, csharpGenerationConfigSchema as y, dependencySchema as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman/sdk-config",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Shared SDK configuration contracts and transformations for Postman SDK generation",
   "license": "UNLICENSED",
   "sideEffects": false,

package/src/sdk-config/v1/README.md

@@ -67,6 +67,19 @@ lowered into the public API shape. Supported registry credentials, signing mater
 credentials are preserved in SDK Config when present; callers must treat these fields as sensitive
 secrets.
 
+Legacy package metadata fills `target.package` only where the mapped package has no value yet:
+the CLI generator's `packageIdentity.homepage`, `keywords`, `authors`, and `license`, the Rust
+generator's `packageLicense`, and `metadata.license` for outputs other than GitHub (a GitHub output
+already carries it as its license). A value mapped from another source, such as the GitHub license
+or `publishMetadata` authors, is kept; a differing legacy value is reported as
+`FERN_PACKAGE_VALUE_CONFLICT`. Cargo `authors` entries are `Name` or `Name <email>`; a bracketed
+suffix that is not a valid email stays part of the name (`Acme <Team>`). If any entry has no name
+before its brackets (`<ada@acme.test>`), no authors are written and each such entry is reported as
+`FERN_CONFIG_VALUE_INVALID`. Licenses `MIT`, `Apache-2.0`, `GPL-3.0`, `GPL-3.0-only`, and
+`UNLICENSED` become `MIT`, `APACHE`, `GPL3`, `GPL3`, and `UNLICENSED`; other identifiers are kept
+verbatim. A custom `metadata.license` file is reported rather than migrated. Cargo dependency
+`rev` and `branch` map to `source.ref`, and `registry` maps to a registry source.
+
 ## Contract boundaries
 
 `SdkConfigV1` is distinct from both existing configuration contracts:
@@ -103,6 +116,34 @@ their operational extensions remain separate explicit allowlists.
 Source `path`, `overlays`, and `overrides` values must be relative paths without parent-directory
 segments. Absolute paths and `..` traversal are rejected at validation time.
 
+### OAuth client identity
+
+An OAuth 2.0 scheme distinguishes two kinds of client identity:
+
+- `api.auth.schemes[].clientId` and `clientSecret` describe SDK parameters that the caller supplies
+  at runtime, optionally from an environment variable. They carry confidential-client credentials
+  and never contain literal values.
+- `api.auth.schemes[].flows[].clientId` is accepted only on `authorization-code` flows. It is the
+  literal, public (RFC 6749 §2.2) identifier of an installed application, such as a CLI that runs
+  browser login with PKCE. Generators embed it verbatim, so environment expressions are rejected and
+  it must never hold a client secret.
+
+The flow-level `clientId` is optional so existing documents keep parsing. A generator that needs it
+for an interactive login reports an error when it is absent.
+
+```yaml
+api:
+  auth:
+    schemes:
+      - id: login
+        type: oauth2
+        flows:
+          - type: authorization-code
+            authorizationUrl: https://auth.example.com/authorize
+            tokenUrl: https://auth.example.com/token
+            clientId: acme-cli
+```
+
 ## Shape
 
 ```json
@@ -167,6 +208,105 @@ target must have an effective output either from that baseline or from its own `
 migration writes output directly on each target because repositories and publication registries are
 properties of the generated language artifact.
 
+## CLI distribution and npm publication
+
+A `language: cli` target's own `output` block accepts `distribution`, which publishes the generated
+CLI to Homebrew and Scoop from the generated `release.yml` on each tagged release. It exists only on
+the `cli` target; root `output` and other languages reject it as an unknown key. A CLI target may
+also publish to npm, which the CLI generator uses for its npm launcher packages.
+
+```yaml
+targets:
+  - language: cli
+    package:
+      packageName: '@acme/cli'
+    output:
+      delivery: github
+      github:
+        repository: acme/acme-cli
+        mode: release
+      publish:
+        registry: npm
+        trustedPublishing: true # or token: ${NPM_TOKEN}
+      distribution:
+        githubApp:
+          appIdSecretName: PUBLISH_APP_ID
+          privateKeySecretName: PUBLISH_APP_PRIVATE_KEY
+        homebrew:
+          tap: acme/homebrew-tap
+          formula: acme # optional; the generator defaults it to the binary name
+        scoop:
+          bucket: acme/scoop-bucket
+          tokenSecretName: SCOOP_BUCKET_PAT # optional; overrides githubApp for Scoop
+```
+
+### Secret names, not secret values
+
+Every `*SecretName` field (`tokenSecretName`, `appIdSecretName`, `privateKeySecretName`) is the
+**name of a GitHub Actions secret in the generated CLI repository**. The generated workflow reads
+`${{ secrets.<NAME> }}` and, for `githubApp`, mints a short-lived installation token at release time.
+Secret values never pass through SDK Config, SDK Config IR, the Fern CLI, or SDK Generation API:
+
+- Names are not `${ENV}` expressions. Clients must not resolve them and must not send them through
+  the KMS-encrypted publish-credential channel; that channel is for `output.publish` credentials only.
+- Names must match `^[A-Z][A-Z0-9_]*$` and must not be `GITHUB_TOKEN`, so lowercase tokens, PEM keys,
+  and `${...}` expressions are rejected. Validation messages never include the rejected value.
+- Defaults are not written into configuration. A channel without `tokenSecretName` uses `githubApp`
+  when present and otherwise the generator's default secret (`HOMEBREW_TAP_TOKEN` or
+  `SCOOP_BUCKET_TOKEN`). Writing a default name explicitly would override `githubApp` for that channel.
+
+The field names differ from the Fern generator's `tokenEnvironmentVariable`, `appIdSecret`, and
+`privateKeySecret` so they cannot be mistaken for environment variables resolved by the client.
+
+### Validation
+
+| Rule                                                                   | Result                                   |
+| ---------------------------------------------------------------------- | ---------------------------------------- |
+| `distribution` with `files` or `zip` delivery                          | Error with a fix instruction             |
+| `distribution` on root `output` or a non-`cli` target                  | Unknown-key error                        |
+| `distribution: {}` or `githubApp` without `homebrew`/`scoop`           | Error                                    |
+| `githubApp` missing either secret name                                 | Error                                    |
+| `tap`/`bucket` not `<owner>/<repo>`; `formula` not `^[a-z][a-z0-9-]*$` | Error                                    |
+| npm publication on a `cli` target without `github` delivery            | Error                                    |
+| `trustedPublishing: true` with `token`                                 | Error                                    |
+| `distribution` with GitHub mode `pull-request`, `push`, or `commit`    | Warning from `getSdkConfigV1Diagnostics` |
+
+Non-release modes are allowed because a customer may push a version tag themselves, but nothing is
+published until they do. Zod has no non-fatal issue channel, so warnings come from
+`getSdkConfigV1Diagnostics(document)` (and `getSdkConfigIrV1Diagnostics` for IR), which returns the
+same `code`/`severity`/`path`/`reason`/`suggestedAction` shape as Fern migration diagnostics.
+
+`trustedPublishing` is shared by every npm target. It replaces Fern's `token: OIDC` marker
+(`<USE_OIDC>` in the generator) with a typed flag. For CLI npm, omitting `publish` is equivalent to
+the generator's `shouldGeneratePublishWorkflow: false`.
+
+### Fern migration
+
+`mapFernConfigToSdkConfigV1` maps the CLI generator's `config.distribution` onto the target's
+`output.distribution` when the Fern output is a GitHub repository. Keys are matched by exact name:
+`appIdSecret` and `privateKeySecret` become `appIdSecretName` and `privateKeySecretName`, and each
+channel's `tokenEnvironmentVariable` becomes `tokenSecretName`. Secret names are copied verbatim and
+generator defaults are not written. Other keys are reported as `FERN_CONFIG_FIELD_UNSUPPORTED`.
+
+- A distribution this schema rejects, including the legacy no-ops above, is left out and reported
+  as `FERN_CONFIG_VALUE_INVALID` at the legacy path, without the rejected value.
+- Distribution on a non-GitHub Fern output, which the generator ignores, is reported as
+  `FERN_CLI_DISTRIBUTION_REQUIRES_GITHUB_OUTPUT` instead of being written.
+- CLI npm publication migrates from the GitHub output's `publishInfo` like any other registry.
+
+### Deferred and rejected scope
+
+- **Native SDK Generation API expansion.** The native SDK Config expander forces zip output and
+  drops output settings, so only the Fern adapter route can deliver distribution today.
+- **Rejected legacy behavior.** The Fern generator accepts an empty `distribution` and a `githubApp`
+  without a channel as no-ops, and ignores distribution outside GitHub output. SDK Config rejects
+  all three.
+- **Follow-ups.** Fern adapter mapping to `generators.yml`; credential-guard and leak verification,
+  including the pre-existing gap where `output.github.credentials` is not stripped from the uploaded
+  document.
+- **Not modeled.** Every legacy `config.distribution` field and CLI npm publish field has an SDK
+  Config equivalent. Hosted (Postman-operated) tap or bucket publication is out of scope.
+
 ## Supported languages
 
 SdkConfig v1 is language-agnostic across every sdk-gen-core target available when this contract was
@@ -184,13 +324,55 @@ defined. Each language has an explicitly allowlisted `generation` shape:
 | Ruby       | `ruby`           | `requirePaths`                           |
 | Rust       | `rust`           | `dateTimeType`                           |
 | Swift      | `swift`          | `moduleName`                             |
-| CLI        | `cli`            | `skills`                                 |
+| CLI        | `cli`            | `skills`, `binaryName`, `profiles`       |
 | MCP        | `mcp`            | `serverName`                             |
 | Terraform  | `terraform`      | `providerName`                           |
 
 Adding an internal language setting to `SdkConfigIrV1` does not add it here. Portable settings are
 added to the shared domain deliberately; IR-only settings remain explicit internal extensions.
 
+### CLI generation settings
+
+These settings are accepted only in the `generation` block of a `language: cli` target. Root
+`generation` and every other target language reject them. Each one maps to
+`generation.language.cli` in SDK Config IR with the same name and shape.
+
+```yaml
+targets:
+  - language: cli
+    generation:
+      binaryName: acme
+      customCommands: false
+      rootGroup: api
+      profiles:
+        enabled: true
+        commandName: accounts
+        revokeOperation: iam.keys.remove
+        provisionOperation:
+          operation: iam.keys.create
+          credential: { username: sid, password: secret }
+          revokeParameters: { Sid: sid }
+      splitTypeCrates: true
+      userAgentSuffixFlag: via
+```
+
+Omitted settings stay omitted in both SDK Config and IR. The CLI generator then applies the
+default shown below. Fern migration copies these keys verbatim from the CLI generator's `config`.
+A legacy `profiles` block without `enabled` migrates as `enabled: false`. A legacy value this schema
+rejects is left out and reported as `FERN_CONFIG_VALUE_INVALID`.
+
+| Setting                       | Behavior                                                                                                                                                                                                              | Validation                                                                                                                                                        | Generator default when omitted |
+| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
+| `binaryName`                  | Executable name. The generator kebab-cases it (`Acme CLI` becomes `acme-cli`) and uses the result for the Cargo binary, the CLI source directory, the runtime app name, and the fallback environment-variable prefix. | Non-empty string with at least one ASCII letter or digit, since the generator rejects names that kebab-case to empty.                                             | Kebab-cased API display name   |
+| `customCommands`              | Generates hand-written command support: the model and SDK crates, `sdk.rs`, and `custom.rs`.                                                                                                                          | Boolean                                                                                                                                                           | `true`                         |
+| `rootGroup`                   | Nests every spec-derived command under one group, so `acme users list` becomes `acme api users list`.                                                                                                                 | `^[a-z][a-z0-9_-]*$`                                                                                                                                              | No group                       |
+| `profiles.enabled`            | Emits the profile command group and the global `--profile` / `-p` flag. Profiles store per-profile credentials and request defaults.                                                                                  | Required boolean when `profiles` is present, following the SDK Config convention for feature objects. The generator itself treats a missing `enabled` as `false`. | Profiles off                   |
+| `profiles.commandName`        | Name of the profile command group.                                                                                                                                                                                    | `^[a-z][a-z0-9-]*$`, excluding `auth`, `completion`, `man`, `errors`, `generate-skills`, and `help`                                                               | `profiles`                     |
+| `profiles.revokeOperation`    | Operation that `profiles remove --revoke` calls.                                                                                                                                                                      | Dotted command path, such as `iam.keys.remove`                                                                                                                    | No `--revoke` flag             |
+| `profiles.provisionOperation` | Operation that `profiles create --provision` calls, and how its response fills the stored credential.                                                                                                                 | `operation` is a required dotted path. `credential` maps at least one field. Map keys and values match `^[A-Za-z0-9_.-]+$`.                                       | No `--provision` flag          |
+| `splitTypeCrates`             | Splits generated types into one crate per API behind a facade crate.                                                                                                                                                  | Boolean                                                                                                                                                           | `false`                        |
+| `userAgentSuffixFlag`         | Long flag that appends a product token to the User-Agent. The environment variable is `<BINARY>_<FLAG>`, with hyphens changed to underscores.                                                                         | `^[a-z][a-z0-9-]*$` without the leading `--`. Built-in global flag names such as `help` and `base-url` are rejected.                                              | `user-agent-suffix`            |
+
 ## Precedence
 
 When a server expands the public config into single-target IR documents, it applies these rules:

package/src/sdk-config-ir/v1/README.md

@@ -47,6 +47,14 @@ messages. Valid IR requests route only to the IR bridge and never fall through t
 - Credentials may be references to externally managed secrets or raw credential/signing values when
   an integration must carry the material through the normalized config. Raw values are sensitive and
   must be handled as secrets.
+- `output.distribution` (CLI Homebrew/Scoop channels) is valid only when `target.language` is `cli`
+  and `output.delivery` is `github`. It is accepted on every delivery variant so files/zip produce an
+  actionable error. Its `*SecretName` fields hold GitHub Actions secret names that the generated
+  release workflow resolves; they are never credentials, references, or values to resolve, and
+  `credentialResolution` does not apply to them. `getSdkConfigIrV1Diagnostics` warns when
+  distribution is combined with a non-release GitHub mode. See the
+  [SDK Config v1 reference](../../sdk-config/v1/README.md#cli-distribution-and-npm-publication).
+- npm publication is valid for `cli` targets with GitHub delivery only.
 
 ## Configuration design rules
 
@@ -92,6 +100,7 @@ Legacy aliases below intentionally converge on one normalized behavior.
 | Package namespace        | npm organization and generator conventions                         | namespace, package-prefix, and root-namespace aliases | `package.namespace`                                                             |
 | Package identity         | per-language package IDs                                           | registry output and package-name aliases              | `package.packageName`, `moduleName`, `modulePath`, `groupId`, or `artifactId`   |
 | Extra dependencies       | language `hookDependencies` and package metadata                   | dependency and dev-dependency aliases                 | `package.extraDependencies`, `extraDevDependencies`, or `extraPeerDependencies` |
+| Peer dependency metadata | npm `peerDependenciesMeta`                                         | `extraPeerDependenciesMeta`                           | `package.extraPeerDependenciesMeta`                                             |
 | Constructor parameters   | language `additionalConstructorParameters` / `additionalVariables` | generator-specific constructor options                | `client.additionalConstructorParameters`                                        |
 | Repository delivery      | `deliveryMethods`, `githubRepoName`, `githubRef`, `privateRepo`    | GitHub output owner/repository settings               | `output.delivery` and `output.github`                                           |
 | Registry publication     | per-language package identity plus publishing settings             | registry output settings                              | `package` identity plus `output.publish` mechanics                              |
@@ -361,9 +370,28 @@ Only options that remain language-specific stay in `generation.language`.
 | Ruby        | Require paths (2)                                                                                                                                                                                    | Gem identity, client name, dependencies, pager, wire tests                                                                                |
 | Rust        | Datetime representation, initialism casing, and Cargo features/default-features                                                                                                                      | Crate identity, client name, and package metadata use shared fields.                                                                      |
 | Swift       | Module name and the nullable-as-optional collapse                                                                                                                                                    | Client, environment and error naming use shared fields.                                                                                   |
-| CLI         | Pagination parameter names and the `skills` boolean                                                                                                                                                  | Go module and package identity use `package`.                                                                                             |
+| CLI         | Pagination parameter names, the `skills` boolean, and the typed CLI settings below                                                                                                                   | Go module and package identity use `package`.                                                                                             |
 | MCP         | Server identity, availability exclusions, tool filters and named toolsets, plus the TypeScript options                                                                                               | npm package identity, client and serialization behavior                                                                                   |
 
+`generation.language.cli` also accepts the typed CLI settings `binaryName`, `customCommands`,
+`rootGroup`, `profiles`, `splitTypeCrates`, and `userAgentSuffixFlag`. Their shapes, validation,
+and generator defaults are listed in the
+[SDK Config v1 reference](../../sdk-config/v1/README.md#cli-generation-settings). IR leaves omitted
+settings undefined so the CLI generator applies its own defaults.
+
+The Fern mapper copies these six keys from a CLI generator's `config` into the target's
+`generation` unchanged. It matches only the exact key names the CLI generator reads, so spellings
+such as `binary-name` are still reported as unsupported. Two rules need care:
+
+- A legacy `profiles` block without `enabled` migrates as `enabled: false`. The generator turns
+  profiles on only when `profiles.enabled === true`, so this keeps the same behavior. Profile keys
+  the generator does not read are reported as unsupported, and the known keys are still copied.
+- A value SDK Config rejects is left out of the output and reported as
+  `FERN_CONFIG_VALUE_INVALID`. The diagnostic points at the exact legacy path and the matching
+  `targets[].generation` path. The mapper does not rewrite the value, for example by
+  kebab-casing it or dropping an invalid `profiles` entry. A rejected `profiles` block is left out
+  as a whole.
+
 ## Removed and deferred legacy configuration
 
 Removed fields are not copied into another open-ended normalized bag. Translators report them in