fix(sdk): sync generator templates with hand-edited SDK output (#884)

## Summary

- Update Go SDK generator templates and OpenAPI spec so that running
`make generate-sdk` produces output identical to the current hand-edited
SDK code
- Prevents regeneration from silently dropping features

## Changes

### `generator/templates/go/http_client.go.tmpl`
- Add `crypto/tls` import
- Add `insecureSkipVerify` field to `Client` struct
- Add `WithInsecureSkipVerify()` client option (needed for
OpenShift/self-signed certs)
- Compile `bearerTokenPattern` regex at package level (was `MustCompile`
per call)

### `ambient-api-server/openapi/openapi.sessions.yaml`
- Add `DELETE /api/ambient/v1/sessions/{id}` endpoint so the generator
emits `Sessions().Delete()`

### `generator/templates/go/types.go.tmpl`
- Fix extra blank lines between builder methods by trimming whitespace
in `{{range}}` blocks

## Verification

After these changes, running the generator produces output that differs
from the committed SDK only in the timestamp and spec hash:

```
$ cd generator && go run . -spec ... -go-out ../go-sdk && cd ../go-sdk && go fmt ./...
$ git diff --stat go-sdk/
 client/client.go               |  4 ++--  # timestamp + hash only
 client/session_api.go           | 12 +++---     # Delete moved position + timestamp
 types/user.go                   |  4 ++--  # timestamp + hash only
 ...
```

## Test plan

- [x] `go run . -spec ...` succeeds, reports `Session delete=true`
- [x] Generated `client.go` retains `WithInsecureSkipVerify`,
`insecureSkipVerify`, compiled regex
- [x] Generated `session_api.go` includes `Delete()` method
- [x] Generated type files have no extra blank lines after `gofmt`
- [x] Only diff from committed code is timestamp/hash and `Delete`
method position

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: maskarb

.github/workflows/sdk-drift-check.yml

@@ -0,0 +1,89 @@
+name: SDK Drift Check
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'components/ambient-sdk/generator/**'
+      - 'components/ambient-sdk/go-sdk/**'
+      - 'components/ambient-sdk/python-sdk/**'
+      - 'components/ambient-sdk/ts-sdk/**'
+      - 'components/ambient-api-server/openapi/**'
+      - '.github/workflows/sdk-drift-check.yml'
+
+  push:
+    branches: [main]
+    paths:
+      - 'components/ambient-sdk/generator/**'
+      - 'components/ambient-sdk/go-sdk/**'
+      - 'components/ambient-sdk/python-sdk/**'
+      - 'components/ambient-sdk/ts-sdk/**'
+      - 'components/ambient-api-server/openapi/**'
+      - '.github/workflows/sdk-drift-check.yml'
+
+  workflow_dispatch:
+
+concurrency:
+  group: sdk-drift-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check-drift:
+    name: SDK Generator Drift
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: components/ambient-sdk/generator/go.mod
+          cache-dependency-path: components/ambient-sdk/generator/go.sum
+
+      - name: Regenerate SDK from OpenAPI spec
+        working-directory: components/ambient-sdk/generator
+        run: |
+          go run . \
+            -spec ../../ambient-api-server/openapi/openapi.yaml \
+            -go-out ../go-sdk \
+            -python-out ../python-sdk/ambient_platform \
+            -ts-out ../ts-sdk
+
+      - name: Run gofmt on generated Go code
+        working-directory: components/ambient-sdk/go-sdk
+        run: go fmt ./...
+
+      - name: Fix trailing newlines (match pre-commit end-of-file-fixer)
+        run: |
+          find components/ambient-sdk/go-sdk components/ambient-sdk/python-sdk components/ambient-sdk/ts-sdk \
+            -type f \( -name '*.go' -o -name '*.py' -o -name '*.ts' \) \
+            -exec sed -i -e :a -e '/^\n*$/{$d;N;ba' -e '}' {} +
+
+      - name: Check for drift
+        run: |
+          # Ignore timestamp and hash lines (they change every run)
+          # Patterns cover both // (Go/TS) and # (Python) comment styles
+          DRIFT=$(git diff \
+            --ignore-matching-lines='Spec SHA256:' \
+            --ignore-matching-lines='Generated:' \
+            -- components/ambient-sdk/go-sdk/ \
+               components/ambient-sdk/python-sdk/ \
+               components/ambient-sdk/ts-sdk/)
+
+          if [ -n "$DRIFT" ]; then
+            echo "❌ SDK drift detected — regenerated code differs from committed code."
+            echo ""
+            echo "This means either:"
+            echo "  1. A generator template was updated but the SDK was not regenerated"
+            echo "  2. The OpenAPI spec changed but the SDK was not regenerated"
+            echo "  3. Generated files were hand-edited (update the templates instead)"
+            echo ""
+            echo "Fix: cd components/ambient-sdk && make generate-sdk"
+            echo ""
+            echo "Diff:"
+            echo "$DRIFT"
+            exit 1
+          fi
+
+          echo "✅ No SDK drift detected"

components/ambient-api-server/openapi/openapi.sessions.yaml

@@ -177,6 +177,37 @@ paths:
             application/json:
               schema:
                 $ref: 'openapi.yaml#/components/schemas/Error'
+    delete:
+      summary: Delete a session by id
+      security:
+        - Bearer: []
+      responses:
+        '204':
+          description: Session deleted successfully
+        '401':
+          description: Auth token is invalid
+          content:
+            application/json:
+              schema:
+                $ref: 'openapi.yaml#/components/schemas/Error'
+        '403':
+          description: Unauthorized to perform operation
+          content:
+            application/json:
+              schema:
+                $ref: 'openapi.yaml#/components/schemas/Error'
+        '404':
+          description: No session with specified id exists
+          content:
+            application/json:
+              schema:
+                $ref: 'openapi.yaml#/components/schemas/Error'
+        '500':
+          description: Unexpected error deleting session
+          content:
+            application/json:
+              schema:
+                $ref: 'openapi.yaml#/components/schemas/Error'
     parameters:
       - $ref: '#/components/parameters/id'
   /api/ambient/v1/sessions/{id}/status:

components/ambient-sdk/generator/main.go

@@ -341,13 +341,15 @@ func loadTemplate(path string) (*template.Template, error) {
 }
 
 func executeTemplate(tmpl *template.Template, outPath string, data interface{}) error {
-	f, err := os.Create(outPath)
-	if err != nil {
+	var buf strings.Builder
+	if err := tmpl.Execute(&buf, data); err != nil {
 		return err
 	}
-	defer func() { _ = f.Close() }()
 
-	return tmpl.Execute(f, data)
+	// Ensure file ends with exactly one newline (match pre-commit end-of-file-fixer)
+	content := strings.TrimRight(buf.String(), "\n") + "\n"
+
+	return os.WriteFile(outPath, []byte(content), 0644)
 }
 
 func computeSpecHash(specPath string) (string, error) {

components/ambient-sdk/generator/templates/go/http_client.go.tmpl

@@ -8,6 +8,7 @@ package client
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -23,12 +24,13 @@ import (
 )
 
 type Client struct {
-	httpClient  *http.Client
-	baseURL     string
-	token       string
-	project     string
-	logger      *slog.Logger
-	userAgent   string
+	httpClient         *http.Client
+	baseURL            string
+	token              string
+	project            string
+	logger             *slog.Logger
+	userAgent          string
+	insecureSkipVerify bool
 }
 
 type ClientOption func(*Client)
@@ -39,6 +41,23 @@ func WithTimeout(timeout time.Duration) ClientOption {
 	}
 }
 
+func WithInsecureSkipVerify() ClientOption {
+	return func(c *Client) {
+		c.insecureSkipVerify = true
+		t, ok := c.httpClient.Transport.(*http.Transport)
+		if !ok || t == nil {
+			t = http.DefaultTransport.(*http.Transport).Clone()
+		} else {
+			t = t.Clone()
+		}
+		if t.TLSClientConfig == nil {
+			t.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12}
+		}
+		t.TLSClientConfig.InsecureSkipVerify = true //nolint:gosec
+		c.httpClient.Transport = t
+	}
+}
+
 func WithLogger(logger *slog.Logger) ClientOption {
 	return func(c *Client) {
 		c.logger = logger
@@ -226,7 +245,8 @@ func validateURL(rawURL string) error {
 	return nil
 }
 
+var bearerTokenPattern = regexp.MustCompile(`([Bb]earer\s+)[a-zA-Z0-9\-_~.+/=]+`)
+
 func sanitizeLogURL(rawURL string) string {
-	tokenPattern := regexp.MustCompile(`([Bb]earer\s+)[a-zA-Z0-9\-_~.+/=]+`)
-	return tokenPattern.ReplaceAllString(rawURL, "${1}[REDACTED]")
+	return bearerTokenPattern.ReplaceAllString(rawURL, "${1}[REDACTED]")
 }

components/ambient-sdk/generator/templates/go/types.go.tmpl

@@ -44,8 +44,7 @@ func (b *{{$.Resource.Name}}Builder) {{.GoName}}(v {{.GoType}}) *{{$.Resource.Na
 	b.resource.{{.GoName}} = v
 	return b
 }
-{{end}}{{end}}
-
+{{end}}{{- end}}
 func (b *{{.Resource.Name}}Builder) Build() (*{{.Resource.Name}}, error) {
 {{- range .Resource.Fields}}
 	{{- if .Required}}
@@ -78,7 +77,6 @@ func (b *{{$.Resource.Name}}PatchBuilder) {{.GoName}}(v {{.GoType}}) *{{$.Resour
 	return b
 }
 {{end}}
-
 func (b *{{.Resource.Name}}PatchBuilder) Build() map[string]any {
 	return b.patch
 }
@@ -97,7 +95,6 @@ func (b *{{$.Resource.Name}}StatusPatchBuilder) {{.GoName}}(v {{.GoType}}) *{{$.
 	return b
 }
 {{end}}
-
 func (b *{{.Resource.Name}}StatusPatchBuilder) Build() map[string]any {
 	return b.patch
 }