Changelog

(fix): Bump @fern-api/generator-cli to 0.9.49. Self-hosted push/PR commits created with a personal access token (ghp_/github_pat_) are now attributed to fern-api[bot] as author and committer instead of the PAT owner.

(feat): Add support for webhook signature schemes that transmit a hash of the raw request body separately rather than signing the body directly (for example, Twilio’s bodySHA256 query parameter for JSON bodies). HMAC webhook signatures now accept a body-hash-binding with an algorithm, encoding, and a location (currently a query-parameter on the notification URL). The field is threaded through the Fern Definition schema, the IR, and the OpenAPI importer, and validation requires notification-url in payload-format.components when a query-parameter binding is configured.

(internal): Forward the GitHub Actions OIDC request variables (ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN) into the local-generation Docker container, so tooling running inside a generator (e.g. npm publish to an npm trusted publisher) can mint a short-lived OIDC token instead of relying on a long-lived registry token. No effect outside GitHub Actions OIDC jobs. The OIDC request token is redacted from the logged container command line.

(fix): Fix disable-sri being dropped for remote JS scripts when publishing docs via the ledger deploy path. The per-script disableSri flag from docs.yml is now forwarded through the ledger config, so flagged scripts render without an SRI integrity (or crossorigin) attribute.

(feat): Add a disable-sri option to remote js scripts in docs.yml. When set to true, the script is rendered without a Subresource Integrity (SRI) integrity attribute, which is useful for scripts whose contents change over time.

(fix): Resolve the auto-generate-idempotency-key config from a generator invocation’s resolved config when no raw generators.yml block is present. This restores idempotency-key auto-generation for synthetic invocations (e.g. the seed test harness) that populate config directly without a raw block.

(internal): Compute discriminated-union base-property dedupe facts once during IR generation and expose them on both the regular and dynamic IR: UnionTypeDeclaration.inheritedBaseProperties (base properties every samePropertiesAsObject variant redeclares with a structurally-equal type) and ObjectTypeDeclaration.deferredUnionBaseProperties (properties an object used exclusively as a union variant defers to the union envelope). Generators now read one source of truth instead of re-deriving the decision independently. The facts are computed regardless of any generator flag.

(fix): Fix smart-casing snake_case names dropping the word boundary after a number. Names like ConversationsV2Configuration now generate conversations_v2_configuration instead of conversations_v2configuration (matching the camelCase and pascalCase variants). Trailing numbers remain fused, e.g. applicationV1 still generates application_v1.

(fix): Fix multi-API environment grouping (group-multi-api-environments) selecting the wrong base URL when more than two specs are merged and several specs share identical servers. Duplicate servers no longer accumulate across merges, so environments with the same name but different URLs are now grouped into a multi-URL environment instead of collapsing to the last spec’s URL.

(fix): fern generate with an explicit --version X.Y.Z now records a version-only entry (version header with an empty description) in the SDK repo’s changelog.md, and existing changelog entries are preserved across regenerations instead of being wiped.

(feat): Add an opt-in mask-pii setting under ai-search in docs.yml. When enabled, personally identifiable information (PII) in user messages is masked before being sent to Ask Fern. Disabled by default.

(feat): Add an api.settings.auto-generate-idempotency-key option in generators.yml that applies idempotency-key auto-generation to every generator in the API, so it no longer has to be set on each generator’s config. A generator’s own config.auto-generate-idempotency-key still overrides the API-level value. Accepts the same boolean shorthand or header-name / methods object form, and is resolved into the IR (SdkConfig.idempotencyKeyGeneration) as before.

(feat): Add an auto-generate-idempotency-key generator config key. When enabled, the CLI records idempotency-key auto-generation in the IR (SdkConfig.idempotencyKeyGeneration) so every generator reads a single, canonical setting from the IR instead of each defining its own config key. Accepts true or { header-name: "Idempotency-Key" } and is stripped from the config forwarded to generators.

(fix): Fix --version AUTO leaking the literal “AUTO” string into self-hosted generated SDKs. Both the IR version field (which drives the User-Agent header and X-Fern-SDK-Version) and the IR publishing config (which drives package.json and version.ts) now use the language-mapped magic version placeholder (“0.0.0-fern-placeholder”) instead of the raw “AUTO” version, so these fields are stamped with the computed version after post-generation replacement rather than “AUTO”.

(feat): Custom MDX components (experimental.mdx-components) can now import third-party libraries. The CLI bundles component files with rolldown (via npx) at docs build time, inlining dependencies resolved from the docs project’s node_modules.

(fix): Validate that a docs instance’s url and custom-domain share the same basepath for all sites, not just basepath-aware ones. Navigation links and redirects are generated relative to the basepath, so the CLI now fails with a clear error when they differ.

(feat): 在 IR 生成时一次性解析 x-fern-global-parameters 的适用性。HttpEndpoint.globalParameters 现在保存适用于每个端点的完整解析后的全局参数集合（显式启用的参数以及匹配 apply: auto 的参数），其中位于请求体位置的参数取决于端点的请求体 schema 是否实际包含点分隔的目标路径。若显式启用的参数在其请求体中缺少目标路径，则会被丢弃并在生成时发出警告。

(fix): 使用 path 输入库的文档配置不再导致 fern docs dev 和 fern generate --docs 崩溃。parseLibrariesConfiguration 现在同时接受 git 和 path 库输入，而不再在遇到 path 时抛出异常，因此使用 fern docs md generate --local 在本地生成库文档的站点可以被预览和发布。

(fix): 当 docs.yml 同时包含 navigation 和 products 时，fern check 现在会报错。二者互斥（正如 navigation 和 versions 已经互斥一样）：在多产品站点中，导航位于每个产品所引用的文件里，因此顶层的 navigation 块会静默地覆盖 products 并渲染出空导航。

(chore): 将 @fern-api/generator-cli 升级到 0.9.44，以便在推送到 GitHub 时对每个仅存在于本地的提交都进行签名，而不仅仅是 HEAD。

(fix): 通过并行（而非顺序）预取外部 <Code src="https://..."/> URL，并借助提前退出检查和流式扫描优化图片处理，改进了 fern docs dev 的初始构建时间。对于包含大量外部代码片段的大型文档站点，这将初始构建时间从约 57 秒缩短到约 14 秒（快 75%）。