Changelog

(feat): Add webhook body-hash binding support to verify_signature. When a webhook’s HMAC signature declares a bodyHashBinding in the IR, the generated helper first recomputes the raw request body’s hash (using the binding’s own algorithm/encoding), extracts the configured query parameter from the notification URL, and timing-safe-compares them (failing closed on a missing or mismatched hash) before performing the existing HMAC verification over the verbatim notification URL. Adds stdlib-only compute_hash (unkeyed digest) and read-only get_webhook_query_parameter core utilities. Output is unchanged when no body-hash binding is present.

(fix): When a client is constructed with both an environment and server URL variables (e.g. region), the generated client now renders the selected environment’s URL template instead of always using the default (first) environment’s template. For example, Client(environment=Environment.STAGING, region="ie1") now resolves to the Staging template (https://api.stage.ie1.example.com) rather than the Production one. An explicitly provided base_url is no longer overridden by URL variables.

(fix): Stop passing required literal query parameters as keyword arguments in generated snippets and wire tests. Required literals (e.g. response_type="code") are hardcoded inside the generated method and omitted from its signature, so passing them raised TypeError: got an unexpected keyword argument. Optional literal query parameters remain in the signature and are still included.

(feat): Add opt-in, platform-guarded TCP keepalive for the generated default HTTP transport. Enable it via the new tcp_keepalive custom config (enabled, idle_seconds, interval_seconds, count); it is disabled by default so existing generated output is unchanged. When enabled, the default httpx transport applies SO_KEEPALIVE plus the platform’s idle/interval/count knobs (with a macOS TCP_KEEPIDLE -> TCP_KEEPALIVE fallback and guards for older/minimal platforms) so long, non-streaming requests survive idle-connection reaping by a firewall/load balancer/NAT. A user-supplied httpx_client or a custom_transport http_client always takes precedence over the keepalive default. Opting in requires httpx>=0.25.

(fix): Revert the smart-casing digit/word boundary behavior introduced in 5.18.4. snake_case names keep a digit run fused to the following word (conversations_v2configuration), restoring pre-5.18.4 output. The behavior will become opt-in via the new smart-casing-digit-word-boundary option in generators.yml once the generator consumes the IR version that carries the setting.

(fix): Fix the OAuth token provider crashing with “Access token not present in OAuth response” when the token response does not include a refresh token. Client-credentials token responses often omit refresh_token; the provider now treats it as optional instead of raising.

(fix): OAuth client credentials token requests now send grant_type: "client_credentials" when the token endpoint declares a non-literal grant_type request property. The property is synthesized in the token request and is no longer surfaced as a user-supplied option.

(feat): Add automatic idempotency-key generation, driven by the centralized idempotencyKeyGeneration config in the IR. When enabled, the generated SDK attaches a UUIDv4 idempotency-key header to requests whose HTTP method is listed in the IR. A caller-supplied key still takes precedence.

(fix): Fix smart-casing snake_case names dropping the word boundary after a number. Sub-client accessors and methods like ConversationsV2Configuration now generate conversations_v2_configuration instead of conversations_v2configuration.

(fix): Expose basic auth credentials (e.g. account_sid / auth_token) on the top-level client when the API also configures OAuth (auth: any). Previously the root client constructor only accepted OAuth client credentials or a bearer token, even though the underlying client wrapper supported basic auth. The credentials are now optional constructor parameters that are forwarded to the client wrapper, and the client can be instantiated with basic auth alone without raising an error.

(fix): Preserve leading and trailing underscores in generated namespace/module names. Previously a subpackage named _agents (via x-fern-sdk-group-name: _agents) was transformed to agents, stripping the underscore. Now it generates a private _agents/ Python module with a matching client._agents accessor, enabling the pattern of hiding autogenerated clients behind a hand-written public layer.

(fix): Normalize the architecture label in the structured User-Agent (emitted when include_platform_headers is enabled) so the 64-bit x86 aliases (x64, amd64, x86_64) all report as the canonical x86_64, keeping the value consistent across generators.

(feat): Add opt-in support for a structured User-Agent header of the form {sdkName}/{version} ({os}; {arch}) Python/{pythonVersion}, matching the Twilio helper-library shape. This is gated behind the include_platform_headers config option and is disabled by default. When enabled, the platform + runtime information is consolidated into the User-Agent header, superseding the default {package}/{version} value, and the discrete X-Fern-Runtime / X-Fern-Platform headers are no longer emitted. The platform group and runtime segment are dropped gracefully when they cannot be determined, and the header remains subject to omit_fern_headers.

(fix): Generated code snippets (README, OAuth token override examples) now use the custom bearer token parameter name from the API spec (e.g. api_key) instead of always using the default token.

(feat): 新增 timeout 配置选项，作为 timeout_in_seconds 的别名。两个键均以秒为单位，timeout_in_seconds 仍然有效，当二者同时设置时 timeout 优先。

(feat): 在生成的 SDK 的 RequestOptions 中新增 timeout 键，作为每请求 timeout_in_seconds 的别名。两者均以秒为单位；timeout_in_seconds 继续有效，当二者同时提供时 timeout 优先。

(fix): 为别名 Pydantic 模型字段（例如从 camelCase 线路名称重命名为 snake_case 的字段）生成属性文档字符串，使 IDE 在悬停时显示字段描述，与非别名字段的行为一致。

(feat): 为 resumable: true 端点实现透明的 SSE 流自动重连，使 Python SDK 与 TypeScript 和 Go 保持一致。当可恢复流提前结束时，EventSource 现在使用 Last-Event-ID header 重新发起原始请求，并从最后一个已分发的事件 id 恢复（而非解析但未分发的 id，避免静默事件丢失）。 重连受配置的流终止符控制，遵守 stream_reconnection_enabled 和 max_stream_reconnection_attempts（带进度重置），默认退避 1 秒（或服务器 retry: 值，上限 30 秒），防止空重连体，并在退避延迟期间保持可取消。支持同步和异步客户端。

(fix): 修复 pydantic-v2 生成器在运行时无法找到 .gitignore.Template 的问题， 将 asIs 目录复制到 dist 包中。

(fix): 修复 pydantic-v2 WrappedAliasGenerator 生成无效 Python 的问题： 添加缺失的 self 参数到 getter 方法，使用正确的返回类型替代硬编码的 UUID， 在构建器方法中引用前向引用返回类型，并在构建器方法体中添加缺失的 return 语句。

(feat): 支持 SSE 流式端点中的 resumable 标志。当端点设置了 x-fern-streaming.resumable: true 时，生成的 SDK 现在将 resumable=True 传递给 EventSource，将标志传递到运行时供重连逻辑使用。 添加 stream_reconnection_enabled 和 max_stream_reconnection_attempts 请求选项以在运行时控制重连行为。

(fix): Fix pyproject.toml distribution name for github-output SDKs without a PyPI publish target to prefer config.package_name over the organization name. Also use output_mode.version instead of hardcoding 0.0.0.