fix(sdk): sync generator templates with hand-edited SDK output

.github/workflows/sdk-drift-check.yml

@@ -0,0 +1,87 @@
+name: SDK Drift Check
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'components/ambient-sdk/generator/**'
+      - 'components/ambient-sdk/go-sdk/**'
+      - 'components/ambient-sdk/python-sdk/**'
+      - 'components/ambient-sdk/ts-sdk/**'
+      - 'components/ambient-api-server/openapi/**'
+      - '.github/workflows/sdk-drift-check.yml'
+
+  push:
+    branches: [main]
+    paths:
+      - 'components/ambient-sdk/generator/**'
+      - 'components/ambient-sdk/go-sdk/**'
+      - 'components/ambient-sdk/python-sdk/**'
+      - 'components/ambient-sdk/ts-sdk/**'
+      - 'components/ambient-api-server/openapi/**'
+      - '.github/workflows/sdk-drift-check.yml'
+
+  workflow_dispatch:
+
+concurrency:
+  group: sdk-drift-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check-drift:
+    name: SDK Generator Drift
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: components/ambient-sdk/generator/go.mod
+          cache-dependency-path: components/ambient-sdk/generator/go.sum
+
+      - name: Regenerate SDK from OpenAPI spec
+        working-directory: components/ambient-sdk/generator
+        run: |
+          go run . \
+            -spec ../../ambient-api-server/openapi/openapi.yaml \
+            -go-out ../go-sdk \
+            -python-out ../python-sdk/ambient_platform \
+            -ts-out ../ts-sdk
+
+      - name: Run gofmt on generated Go code
+        working-directory: components/ambient-sdk/go-sdk
+        run: go fmt ./...
+
+      - name: Check for drift
+        run: |
+          # Ignore timestamp and hash lines (they change every run)
+          DRIFT=$(git diff \
+            --ignore-matching-lines='// Spec SHA256:' \
+            --ignore-matching-lines='// Generated:' \
+            -- components/ambient-sdk/go-sdk/ \
+               components/ambient-sdk/python-sdk/ \
+               components/ambient-sdk/ts-sdk/)
+
+          if [ -n "$DRIFT" ]; then
+            echo "❌ SDK drift detected — regenerated code differs from committed code."
+            echo ""
+            echo "This means either:"
+            echo "  1. A generator template was updated but the SDK was not regenerated"
+            echo "  2. The OpenAPI spec changed but the SDK was not regenerated"
+            echo "  3. Generated files were hand-edited (update the templates instead)"
+            echo ""
+            echo "Fix: cd components/ambient-sdk && make generate-sdk"
+            echo ""
+            echo "Diff:"
+            git diff \
+              --ignore-matching-lines='// Spec SHA256:' \
+              --ignore-matching-lines='// Generated:' \
+              -- components/ambient-sdk/go-sdk/ \
+                 components/ambient-sdk/python-sdk/ \
+                 components/ambient-sdk/ts-sdk/
+            exit 1
+          fi
+
+          echo "✅ No SDK drift detected"

components/ambient-api-server/openapi/openapi.sessions.yaml

@@ -177,6 +177,37 @@ paths:
             application/json:
               schema:
                 $ref: 'openapi.yaml#/components/schemas/Error'
+    delete:
+      summary: Delete a session by id
+      security:
+        - Bearer: []
+      responses:
+        '204':
+          description: Session deleted successfully
+        '401':
+          description: Auth token is invalid
+          content:
+            application/json:
+              schema:
+                $ref: 'openapi.yaml#/components/schemas/Error'
+        '403':
+          description: Unauthorized to perform operation
+          content:
+            application/json:
+              schema:
+                $ref: 'openapi.yaml#/components/schemas/Error'
+        '404':
+          description: No session with specified id exists
+          content:
+            application/json:
+              schema:
+                $ref: 'openapi.yaml#/components/schemas/Error'
+        '500':
+          description: Unexpected error deleting session
+          content:
+            application/json:
+              schema:
+                $ref: 'openapi.yaml#/components/schemas/Error'
     parameters:
       - $ref: '#/components/parameters/id'
   /api/ambient/v1/sessions/{id}/status:

components/ambient-sdk/generator/templates/go/http_client.go.tmpl

@@ -8,6 +8,7 @@ package client
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -23,12 +24,13 @@ import (
 )
 
 type Client struct {
-	httpClient  *http.Client
-	baseURL     string
-	token       string
-	project     string
-	logger      *slog.Logger
-	userAgent   string
+	httpClient         *http.Client
+	baseURL            string
+	token              string
+	project            string
+	logger             *slog.Logger
+	userAgent          string
+	insecureSkipVerify bool
 }
 
 type ClientOption func(*Client)
@@ -39,6 +41,15 @@ func WithTimeout(timeout time.Duration) ClientOption {
 	}
 }
 
+func WithInsecureSkipVerify() ClientOption {
+	return func(c *Client) {
+		c.insecureSkipVerify = true
+		c.httpClient.Transport = &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
+		}
+	}
+}
+
 func WithLogger(logger *slog.Logger) ClientOption {
 	return func(c *Client) {
 		c.logger = logger
@@ -226,7 +237,8 @@ func validateURL(rawURL string) error {
 	return nil
 }
 
+var bearerTokenPattern = regexp.MustCompile(`([Bb]earer\s+)[a-zA-Z0-9\-_~.+/=]+`)
+
 func sanitizeLogURL(rawURL string) string {
-	tokenPattern := regexp.MustCompile(`([Bb]earer\s+)[a-zA-Z0-9\-_~.+/=]+`)
-	return tokenPattern.ReplaceAllString(rawURL, "${1}[REDACTED]")
+	return bearerTokenPattern.ReplaceAllString(rawURL, "${1}[REDACTED]")
 }

components/ambient-sdk/generator/templates/go/types.go.tmpl

@@ -44,8 +44,7 @@ func (b *{{$.Resource.Name}}Builder) {{.GoName}}(v {{.GoType}}) *{{$.Resource.Na
 	b.resource.{{.GoName}} = v
 	return b
 }
-{{end}}{{end}}
-
+{{end}}{{- end}}
 func (b *{{.Resource.Name}}Builder) Build() (*{{.Resource.Name}}, error) {
 {{- range .Resource.Fields}}
 	{{- if .Required}}
@@ -78,7 +77,6 @@ func (b *{{$.Resource.Name}}PatchBuilder) {{.GoName}}(v {{.GoType}}) *{{$.Resour
 	return b
 }
 {{end}}
-
 func (b *{{.Resource.Name}}PatchBuilder) Build() map[string]any {
 	return b.patch
 }
@@ -97,7 +95,6 @@ func (b *{{$.Resource.Name}}StatusPatchBuilder) {{.GoName}}(v {{.GoType}}) *{{$.
 	return b
 }
 {{end}}
-
 func (b *{{.Resource.Name}}StatusPatchBuilder) Build() map[string]any {
 	return b.patch
 }