Changelog

(fix): Honor endpoint-level retry configuration (x-fern-retries: { disabled: true }, or retries: { disabled: true } in a Fern definition). Endpoints that disable retries are now issued exactly once, regardless of the client-level and per-request retry options.

(fix): Fixed generated WireMock stubs for OAuth client credentials APIs whose token endpoint is itself marked as authenticated: the token (and refresh) endpoint stub no longer requires an Authorization header, since the token request is made to obtain the token and cannot carry one yet.

(fix): An empty string terminates cursor pagination when the cursor is a named type that resolves to an optional string (e.g. type Cursor = *string), matching an inline optional string. Optionality is now resolved through aliases, so both spellings of the same type generate the same termination check. Required string, uuid, int, and datetime cursors are unchanged.

(fix): Fixed generated wire tests for OAuth client credentials APIs: the test client is now constructed with client credentials so requests carry the Authorization header the WireMock stubs require, instead of failing with Header is not present.

(fix): Fix several issues in the generated README:

• The Request Options example now renders the auth options the SDK actually generates (e.g., option.WithSecret for header auth, option.WithBasicAuth for basic auth) instead of always assuming option.WithToken.
• The Errors example now passes a pointer to errors.As so the snippet compiles and doesn’t panic.
• The Pagination section is now emitted whenever the API has an endpoint with a generated paginated client, by selecting such an endpoint for the example, rather than relying on the default endpoint being paginated. The section is omitted entirely when no paginated client is generated (e.g. custom, URI, and path pagination), so the example no longer references an iterator that doesn’t exist.
• The Request Options section now documents the environment variables the generated client reads credentials from when they aren’t explicitly provided.

(fix): Omit global headers (declared under api.headers) from requests when they are left unset, instead of sending them with an empty value. This matches the behavior of auth scheme headers, which were already guarded. This applies to string, UUID, bytes, date, datetime, and enum headers; boolean and numeric headers are unchanged, since false and 0 are meaningful values that cannot be distinguished from an unset field. Unset UUID, date, and datetime headers are no longer sent as 00000000-0000-0000-0000-000000000000 and 0001-01-01 either.

(fix): Fix JSON deserialization of date and datetime values nested in containers. Lists, sets, and string-keyed maps of dates (including optional containers and aliases of containers) are now unmarshaled through the internal date wrappers, so date-only values such as "2002-08-28" no longer fail with parsing time "2002-08-28" as "2006-01-02T15:04:05Z07:00".

(fix): Cursor pagination now stops when a string cursor is an empty string, in addition to null. Previously an optional string cursor was only terminal when it was null, so an API that signals the last page with "next_cursor": "" caused an extra request, or looped indefinitely when it also kept returning results. This matches the TypeScript, Python, and C# generators. Non-string cursors (e.g. uuid, int) are unchanged.

(fix): Snippets for examples that omit an optional request body now pass nil for the body parameter instead of dropping the argument, which produced snippets that did not compile.

(feat): Add a respectOptionalRequestBody option. When enabled, an endpoint whose request body the API does not require sends no body and no Content-Type header once the caller leaves that body out, including when the request wrapper is passed with a nil Body. Examples that supply no body stop rendering an empty body such as Body: &acme.RefundRequest{}. The option defaults to false, so existing SDKs send exactly what they always have.

(fix): Fix the initial offset for offsetSemantics: item-index. Item-index offsets address records rather than pages, so pagination now starts at 0 instead of 1, which previously skipped the first record of every collection. This applies to both query-parameter and request-body offsets. Page-index semantics continue to start at 1.

(fix): Fix offset pagination emitting code that does not compile. With offsetSemantics: item-index and a step, the pager read results before declaring it (undefined: results), and the offset increment now matches the page type (int, int64, float64). Endpoints whose offset is a required (non-optional) query parameter also emitted an invalid assignment to a request field (request.Offset := ...) under either offset semantics, and now seed the initial offset from the request (next := request.Offset).

(feat): Add the enableRequestBodyPagination configuration option, which generates auto-pagination for endpoints whose cursor or offset is a top-level request body property (e.g. cursor: $request.cursor). These endpoints previously generated a regular method that returned the response body, so the option defaults to false to preserve the existing return types.

(fix): Fixed WireMock stubs for wire tests of APIs with auth: any combining Basic and OAuth/Bearer schemes: stubs now accept either Authorization form instead of requiring the exact Basic header the client may not send.

(fix): Fixed generated OAuth wire tests failing to compile when the OAuth token endpoint lives in a subpackage: the pointer helper (String) is now referenced from the root package instead of the request type’s package.

(feat): Add opt-in allowUserAgentAppInfo config. When enabled, generated clients expose an option.WithUserAgentAppInfo(name, version, comment string) client option whose sanitized product token is appended to whatever User-Agent the SDK would otherwise send ({sdk}/{version} ... {product}/{product-version} ({comment})), following RFC 9110. Disabled by default, so existing generated output is byte-identical, and it composes with includePlatformHeaders, the configured user-agent template value, and the default {package}/{version} value. Caller-supplied values are trimmed before the blank check and before encoding (blank name/version/comment are dropped rather than encoded into whitespace tokens), then name/version are percent-encoded to RFC 7230 tchar and comment delimiters (, ), \ and control characters (incl. CR/LF) are escaped, so untrusted values cannot inject header content. Still overridable by an explicit User-Agent header and suppressed by omitFernHeaders. The AppInfo type, the AppInfoOption, and the emitted appendAppInfoToUserAgent helper are only generated when the flag is on, so the shared core-utilities are never modified. No IR change.

(feat): Add the applyQueryDefaultsOnNilRequest option, which applies query parameter defaults when a request is nil. internal.QueryValuesWithDefaults returns early for a nil request, so defaults declared via x-fern-default are silently dropped and the request is sent without them. When the option is enabled, a nil request behaves like a zero-value request struct, which matters most for paginated endpoints whose response shape depends on a defaulted query parameter. The option defaults to false to preserve today’s behavior.

(fix): Client-level global header options (e.g. option.WithVersion(...) passed to the root client constructor) are no longer clobbered by env-var or client-default resolution on every request. Env and client-default fallbacks are now resolved once at client construction, and per-request options only override the header when explicitly set. Precedence is: request-level option > client-level option > env var > client default.

(feat): Add support for per-endpoint auth routing. When the API-level auth requirement is ENDPOINT_SECURITY, each endpoint now applies only the auth scheme(s) it declares in its IR security field (OR across the list of requirements, AND within a requirement, and no auth when security is empty), instead of applying every configured credential to every request. Behavior for the ALL and ANY auth requirements (the common cases) is unchanged.

(feat): Add a serverUrlVariables generator config option (default true) that lets consumers opt out of generated server URL variable options and templated base-URL interpolation. When disabled, the generator no longer emits the per-variable client options nor the construction-time base-URL template interpolation, falling back to the pre-feature base-URL behavior.

(feat): Add body-hash binding verification for HMAC webhooks that transmit a hash of the raw request body in the notification URL.

(feat): Add webhook signature verification support. When a webhook declares HMAC signature verification in the IR, the generated Go SDK now emits a WebhooksHelper with a VerifySignature method that validates the signature (and optional timestamp) using a new stdlib-only core utility (crypto/hmac/crypto/sha*/encoding with constant-time comparison).

(fix): When a client is constructed with both a selected environment and server URL variables (e.g. option.WithRegion), the generated client now renders the selected environment’s URL template(s) instead of always using the first environment’s template. Custom base URLs and environment values are left untouched, and the first (default) templated environment is still used when no environment is selected.

(feat): Client endpoint methods now include a usage example in their godoc comment, so IDEs surface a code snippet on hover.