Teach the SDKs the proof surface

A server-side signature change without SDK support ships clients that
lie to their users, so the proof header and endpoint land in SPECS.md,
the shared commons and both vendored trees in one step.

Author: Un3x

clients/SPECS.md

@@ -25,7 +25,7 @@
 - Token-based bearer authentication with an extensibility seam for future auth
   strategies (OAuth2, mTLS, rotating providers).
 - Public (unauthenticated) monitoring endpoints: `ping`, `pings`,
-  `ping_provider` (see §9.5).
+  `ping_provider` (see §9.6).
 
 **Out of scope**
 
@@ -445,7 +445,16 @@ brackets:
 client.dss.allocation_adulte_handicape_identite(prenoms: ['Jean', 'Paul'], …)
 ```
 
-### 9.5 Public (unauthenticated) endpoints — Ping
+### 9.5 Request-header parameters
+
+Operations may declare `in: header` parameters (e.g. `X-Generate-Proof` on the
+EAJE identity endpoint). Generated methods MUST expose each one as an optional
+kwarg named after the header — lowercased, dashes to underscores, leading `x_`
+stripped (`X-Generate-Proof` → `generate_proof`) — and send the value verbatim
+as a request header when provided. `Cache-Control` is transport-level and MUST
+NOT be scaffolded.
+
+### 9.6 Public (unauthenticated) endpoints — Ping
 
 Both APIs expose monitoring endpoints marked `security: []` in the OpenAPI
 spec. These endpoints require **no token**, **no audit parameters**
@@ -748,7 +757,7 @@ A reviewer certifying a new client ticks each item.
       `User-Agent` set.
 - [ ] Immutable `Configuration` with `with()` / `copy()`; ENV vars honoured.
 - [ ] Public ping endpoints (`ping`, `pings`, `ping_provider`) exposed on
-      the client; no auth header or audit params sent (§9.5).
+      the client; no auth header or audit params sent (§9.6).
 - [ ] Unit tests cover every surface listed in §12.1; integration tests
       cover 200 / 422 / 429 / 502 on both APIs; staging conformance run
       from TESTING.md passes; README has a stub example.

clients/node/api-entreprise/package-lock.json

@@ -1,4 +1,4 @@
-// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: c39093e4bc410efcbe528a7b462142c8c4d7f0a6).
+// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: 2ff43e12b36dac153c791f7bdb78eb7fe55c4e34).
 // Regenerate via clients/node/bin/sync-commons.ts
 
 import type { AuthStrategy } from './strategy.js';

clients/node/api-entreprise/src/commons/auth/bearer-token.ts

@@ -1,4 +1,4 @@
-// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: c39093e4bc410efcbe528a7b462142c8c4d7f0a6).
+// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: 2ff43e12b36dac153c791f7bdb78eb7fe55c4e34).
 // Regenerate via clients/node/bin/sync-commons.ts
 
 export interface AuthStrategy {

clients/node/api-entreprise/src/commons/auth/strategy.ts

@@ -1,4 +1,4 @@
-// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: c39093e4bc410efcbe528a7b462142c8c4d7f0a6).
+// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: 2ff43e12b36dac153c791f7bdb78eb7fe55c4e34).
 // Regenerate via clients/node/bin/sync-commons.ts
 
 import { Configuration, type Logger } from './configuration.js';
@@ -175,23 +175,7 @@ export abstract class ClientBase {
     const responseHeaders = headersToRecord(fetchResponse.headers);
     const rateLimit = RateLimit.fromHeaders(fetchResponse.headers);
 
-    let body: unknown;
-    const text = await fetchResponse.text();
-    if (text) {
-      try {
-        body = JSON.parse(text);
-      } catch {
-        if (fetchResponse.ok) {
-          throw new TransportError(
-            `invalid JSON body: ${text.slice(0, 200)}`,
-            { method, url },
-          );
-        }
-        body = {};
-      }
-    } else {
-      body = {};
-    }
+    const body: unknown = await this.parseBody(fetchResponse, method, url);
 
     this.logRequest(method, url, fetchResponse.status, durationMs, rateLimit);
 
@@ -256,23 +240,7 @@ export abstract class ClientBase {
     const durationMs = Date.now() - started;
     const responseHeaders = headersToRecord(fetchResponse.headers);
 
-    let body: unknown;
-    const text = await fetchResponse.text();
-    if (text) {
-      try {
-        body = JSON.parse(text);
-      } catch {
-        if (fetchResponse.ok) {
-          throw new TransportError(
-            `invalid JSON body: ${text.slice(0, 200)}`,
-            { method, url },
-          );
-        }
-        body = {};
-      }
-    } else {
-      body = {};
-    }
+    const body: unknown = await this.parseBody(fetchResponse, method, url);
 
     this.logRequest(method, url, fetchResponse.status, durationMs, null);
 
@@ -351,6 +319,26 @@ export abstract class ClientBase {
     return result;
   }
 
+  private async parseBody(
+    fetchResponse: globalThis.Response,
+    method: string,
+    url: string,
+  ): Promise<unknown> {
+    const text = await fetchResponse.text();
+    if (!text) return {};
+    try {
+      return JSON.parse(text);
+    } catch {
+      if (fetchResponse.ok) {
+        throw new TransportError(
+          `invalid JSON body: ${text.slice(0, 200)}`,
+          { method, url },
+        );
+      }
+      return {};
+    }
+  }
+
   private throwMappedError(
     status: number,
     body: unknown,

clients/node/api-entreprise/src/commons/client-base.ts

@@ -1,4 +1,4 @@
-// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: c39093e4bc410efcbe528a7b462142c8c4d7f0a6).
+// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: 2ff43e12b36dac153c791f7bdb78eb7fe55c4e34).
 // Regenerate via clients/node/bin/sync-commons.ts
 
 import type { AuthStrategy } from './auth/strategy.js';

clients/node/api-entreprise/src/commons/configuration.ts

@@ -1,4 +1,4 @@
-// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: c39093e4bc410efcbe528a7b462142c8c4d7f0a6).
+// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: 2ff43e12b36dac153c791f7bdb78eb7fe55c4e34).
 // Regenerate via clients/node/bin/sync-commons.ts
 
 export interface JsonApiError {

clients/node/api-entreprise/src/commons/errors.ts

@@ -1,4 +1,4 @@
-// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: c39093e4bc410efcbe528a7b462142c8c4d7f0a6).
+// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: 2ff43e12b36dac153c791f7bdb78eb7fe55c4e34).
 // Regenerate via clients/node/bin/sync-commons.ts
 
 export { type AuthStrategy } from './auth/strategy.js';

clients/node/api-entreprise/src/commons/index.ts

@@ -1,4 +1,4 @@
-// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: c39093e4bc410efcbe528a7b462142c8c4d7f0a6).
+// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: 2ff43e12b36dac153c791f7bdb78eb7fe55c4e34).
 // Regenerate via clients/node/bin/sync-commons.ts
 
 /** Parsed RateLimit-* response headers. */

clients/node/api-entreprise/src/commons/rate-limit.ts

@@ -1,4 +1,4 @@
-// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: c39093e4bc410efcbe528a7b462142c8c4d7f0a6).
+// DO NOT EDIT — generated from clients/node/commons/src/ (source digest: 2ff43e12b36dac153c791f7bdb78eb7fe55c4e34).
 // Regenerate via clients/node/bin/sync-commons.ts
 
 import { RateLimit } from './rate-limit.js';