Changelog

(fix): Fix local images and links being published as build-machine filesystem paths (e.g. /home/runner/work/.../assets/image.png) when an earlier line on the page contains a literal < in prose or inline code. The markdown scanner treated any < as the start of a tag and skipped ahead to the next >, dropping every image and link substitution in between.

(fix): Fix Cannot resolve endpoint: <operationId> in file <tag>.yml when importing an OpenAPI spec whose operationId contains a dot and does not share a prefix with its tag (e.g. actions.index under the Custom Actions tag). Dotted operation ids are now collapsed into a single valid endpoint name, so x-fern-pagination resolves correctly. Note that this renames the generated method for these endpoints (actions.index is now imported as actionsIndex rather than verbatim); set x-fern-sdk-method-name to pin a specific name.

(fix): Fix OpenAPI import dropping the null branch of a anyOf/oneOf when a schema that contains such a branch is referenced via $ref. References to these schemas are now correctly treated as nullable, so generators that distinguish optional from nullable (e.g. TypeScript) emit | null instead of silently dropping it.

(fix): Fix fern docs preview list omitting previews created with a named --id. The command filtered server results with a hex-only pattern that dropped any preview whose id contained letters outside a-f. Preview deployments are already filtered server-side, so the redundant client-side filter has been removed.

(feat): Rename the --pack and --pack-mode flags on fern generate to --package and --package-mode, and add --package-only, which builds the distributable artifact into fern-dist/ and removes the generated SDK source, leaving only the package in the output directory.

(feat): Support declaring OAuth public-client login flows in auth-schemes: type: authorization-code (Authorization Code + PKCE, browser login) and type: device-code (RFC 8628). These lower to the new OAuthConfiguration.authorizationCode / deviceCode IR variants for public clients (no client secret), carrying the public client id, authorization/device/token URLs, scopes, an optional loopback redirect-uri, and PKCE. The valid-oauth rule enforces the per-flow required fields and that a set redirect-uri is a loopback address — either 127.0.0.1 (recommended) or localhost, with any path — that the generated CLI then binds and sends verbatim so it matches the redirect registered with the authorization server. Existing client-credentials OAuth configurations are unchanged.

(feat): Add the send-optional-defaults playground setting to docs.yml (settable globally or per-endpoint). When enabled, optional API Explorer parameters that declare a default (or x-fern-default) are pre-filled and sent from the playground. Defaults to off.

(feat): Add the preserve-one-of-in-all-of OpenAPI setting. When enabled, an allOf whose members include a oneOf/anyOf is distributed into a union — each variant is the union member merged with the remaining allOf members — instead of flattening every variant’s properties into a single object. This makes the variants available to SDKs and renders a variant selector in the API reference. Defaults to false.

(feat): fern generate --pack now produces a source zip artifact for Go SDKs in fern-dist/ (<output-dir>-source.zip). Go modules have no binary package format, so the zip contains the module source (excluding fern-dist/ and .git/) and can be shared internally and referenced with a replace directive in go.mod. The zip is built in-process, so it works identically in host and docker pack modes without any toolchain.

(feat): Add a --pack flag to fern generate. When generating to the local file system, the CLI now builds distributable package artifacts (npm tarball, Python wheel, JAR, NuGet package, gem, Composer zip, crate) into a fern-dist/ folder inside each output directory, so SDKs can be shared internally without publishing to a registry. Use --pack-mode docker to run the packaging toolchains inside official Docker images instead of requiring them on the host. --pack also generates full, packageable projects (pyproject.toml, README.md, etc.) for local-file-system outputs so the packaging toolchains have the metadata they need, and host-mode packaging hides any enclosing git repository so VCS-aware build backends (e.g. poetry-core) don’t silently exclude gitignored output files from the artifact.

(fix): Fix user-specified OpenRPC examples to use the method’s computed endpoint path instead of appending a hardcoded /{apiKey} path.

(internal): Add the additive OAuthAuthorizationCode.redirectUriBackupPorts IR field (fallback loopback callback ports for the authorization-code/PKCE flow). No behavior change for existing configs.

(feat): Add fern org set/get/unset cli-version to pin the Fern CLI to a version or a min/max range for your whole organization, keeping every project on a consistent CLI version.

(internal): Add the additive OAuthConfiguration.authorizationCode and OAuthConfiguration.deviceCode IR variants modeling the OAuth 2.0 authorization code grant with required PKCE (browser login) and the device authorization grant (RFC 8628) for public clients. IR consumers now narrow the OAuth configuration union before reading client-credentials-only fields. No behavior change for existing client-credentials configurations.

(fix): Fix markdown images that specify a title (e.g. ![alt](./image.png "Title")) failing to render. The title was treated as part of the image path, so the image was never swapped for its uploaded file reference.

(fix): fern generate (cloud generation) with local-file-system output now threads the package name and version into the IR the same way fern generate --local does. This fixes generated SDKs missing the User-Agent and X-Fern-SDK-Name/X-Fern-SDK-Version headers when generating to the local filesystem without the --local flag. Package names configured via generator config (e.g. package_name, packageJson.name) are now also resolved on the cloud generation path.

(fix): Bump @fern-api/generator-cli to 0.9.53. Under --version AUTO, a purely additive Go change (inserting a new field into a struct) is no longer misclassified as a breaking MAJOR bump. The generated explicitFields bit-constant reindexing that a field insertion produces is now stripped before AI diff analysis, so real additions stay MINOR and real removals stay MAJOR.

(fix): Support client-default on api.headers entries in generators.yml. The generators.yml schema previously dropped this field, so global headers with a client-default produced no client-side default in the generated SDKs. The field now flows through to the IR (clientDefault), so SDKs send the value by default when the caller and environment variable do not provide one.

(fix): Preserve the base schema description on nested fields composed with allOf. When a property merged a $ref (carrying a description) with an inline schema adding constraints (e.g. pattern), the merged validation was kept but the inherited description was dropped from the generated docs/SDKs.

(feat): Add the layout.show-nav-availability-badges docs.yml setting. When set to true, availability badges (Beta, Deprecated, etc.) render inline next to navigation items in the sidebar. Defaults to false; the page-header availability badge is unaffected.