Changelog

(feat): Add a new smart-casing-digit-word-boundary option to generators.yml. When enabled alongside smart-casing, snake_case names preserve the word boundary after a digit run (e.g., ConversationsV2Configuration → conversations_v2_configuration, Int32Value → int32_value). The option defaults to false, restoring the pre-5.70.3 behavior where the digit run stays fused to the following word (conversations_v2configuration).

(chore): Move internal docs-publish logs that expose implementation details (docs ledger deploy mode, per-locale segment counts, FDR publish, ledger deployment IDs) from INFO to DEBUG level, so they only appear when debug logging is enabled.

(fix): Fix discriminated union variants that reference a nested oneOf/anyOf being wrapped in a spurious “value” property. The OpenAPI importer now merges the nested oneOf variants into a single object with optional fields, preserving the correct wire format.

(fix): Bump @fern-api/generator-cli to 0.9.49. Self-hosted push/PR commits created with a personal access token (ghp_/github_pat_) are now attributed to fern-api[bot] as author and committer instead of the PAT owner.

(feat): Add support for webhook signature schemes that transmit a hash of the raw request body separately rather than signing the body directly (for example, Twilio’s bodySHA256 query parameter for JSON bodies). HMAC webhook signatures now accept a body-hash-binding with an algorithm, encoding, and a location (currently a query-parameter on the notification URL). The field is threaded through the Fern Definition schema, the IR, and the OpenAPI importer, and validation requires notification-url in payload-format.components when a query-parameter binding is configured.

(internal): Forward the GitHub Actions OIDC request variables (ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN) into the local-generation Docker container, so tooling running inside a generator (e.g. npm publish to an npm trusted publisher) can mint a short-lived OIDC token instead of relying on a long-lived registry token. No effect outside GitHub Actions OIDC jobs. The OIDC request token is redacted from the logged container command line.

(fix): Fix disable-sri being dropped for remote JS scripts when publishing docs via the ledger deploy path. The per-script disableSri flag from docs.yml is now forwarded through the ledger config, so flagged scripts render without an SRI integrity (or crossorigin) attribute.

(feat): Add a disable-sri option to remote js scripts in docs.yml. When set to true, the script is rendered without a Subresource Integrity (SRI) integrity attribute, which is useful for scripts whose contents change over time.

(fix): Resolve the auto-generate-idempotency-key config from a generator invocation’s resolved config when no raw generators.yml block is present. This restores idempotency-key auto-generation for synthetic invocations (e.g. the seed test harness) that populate config directly without a raw block.

(internal): Compute discriminated-union base-property dedupe facts once during IR generation and expose them on both the regular and dynamic IR: UnionTypeDeclaration.inheritedBaseProperties (base properties every samePropertiesAsObject variant redeclares with a structurally-equal type) and ObjectTypeDeclaration.deferredUnionBaseProperties (properties an object used exclusively as a union variant defers to the union envelope). Generators now read one source of truth instead of re-deriving the decision independently. The facts are computed regardless of any generator flag.

(fix): Fix smart-casing snake_case names dropping the word boundary after a number. Names like ConversationsV2Configuration now generate conversations_v2_configuration instead of conversations_v2configuration (matching the camelCase and pascalCase variants). Trailing numbers remain fused, e.g. applicationV1 still generates application_v1.

(fix): Fix multi-API environment grouping (group-multi-api-environments) selecting the wrong base URL when more than two specs are merged and several specs share identical servers. Duplicate servers no longer accumulate across merges, so environments with the same name but different URLs are now grouped into a multi-URL environment instead of collapsing to the last spec’s URL.

(fix): fern generate with an explicit --version X.Y.Z now records a version-only entry (version header with an empty description) in the SDK repo’s changelog.md, and existing changelog entries are preserved across regenerations instead of being wiped.

(feat): Add an opt-in mask-pii setting under ai-search in docs.yml. When enabled, personally identifiable information (PII) in user messages is masked before being sent to Ask Fern. Disabled by default.

(feat): Add an api.settings.auto-generate-idempotency-key option in generators.yml that applies idempotency-key auto-generation to every generator in the API, so it no longer has to be set on each generator’s config. A generator’s own config.auto-generate-idempotency-key still overrides the API-level value. Accepts the same boolean shorthand or header-name / methods object form, and is resolved into the IR (SdkConfig.idempotencyKeyGeneration) as before.

(feat): Add an auto-generate-idempotency-key generator config key. When enabled, the CLI records idempotency-key auto-generation in the IR (SdkConfig.idempotencyKeyGeneration) so every generator reads a single, canonical setting from the IR instead of each defining its own config key. Accepts true or { header-name: "Idempotency-Key" } and is stripped from the config forwarded to generators.

(fix): Fix --version AUTO leaking the literal “AUTO” string into self-hosted generated SDKs. Both the IR version field (which drives the User-Agent header and X-Fern-SDK-Version) and the IR publishing config (which drives package.json and version.ts) now use the language-mapped magic version placeholder (“0.0.0-fern-placeholder”) instead of the raw “AUTO” version, so these fields are stamped with the computed version after post-generation replacement rather than “AUTO”.

(feat): Custom MDX components (experimental.mdx-components) can now import third-party libraries. The CLI bundles component files with rolldown (via npx) at docs build time, inlining dependencies resolved from the docs project’s node_modules.

(fix): Validate that a docs instance’s url and custom-domain share the same basepath for all sites, not just basepath-aware ones. Navigation links and redirects are generated relative to the basepath, so the CLI now fails with a clear error when they differ.

(feat): Resolve x-fern-global-parameters applicability once at IR-generation time. HttpEndpoint.globalParameters now holds the fully resolved set of global parameters that apply to each endpoint (explicit opt-ins plus matching apply: auto parameters), with body-location parameters gated on the endpoint’s request-body schema actually containing the dotted target path. An explicit opt-in whose request body lacks the target is dropped with a generation-time warning.

(fix): Docs configs with a path input library no longer crash fern docs dev and fern generate --docs. parseLibrariesConfiguration now accepts both git and path library inputs instead of throwing on path, so a site whose library docs were generated locally with fern docs md generate --local can be previewed and published.