chore(api): stop injecting SessionId into merged spec

[hotdata-automation]

Auto-generated from the updated HotData OpenAPI spec.
Source: https://github.com/hotdata-dev/www.hotdata.dev/pull/283

[claude]

Removing the SessionId scheme here silently breaks the hand-written session_id surface that this SDK's custom templates add on top of the generated code.

After this change:

• Configuration.__init__ still accepts session_id= and still does self.api_keys["SessionId"] = session_id (line 240-241)
• the session_id property/setter still exist (lines 543-557) and still document "sent as X-Session-Id"
• the class docstring still advertises it (line 145-147) as a workspace/sandbox scoping example

…but nothing consumes it anymore. auth_settings() no longer emits a SessionId entry, and _auth_settings in query_api.py / results_api.py no longer lists it, so update_params_for_auth (api_client.py:649-651) never finds a setting to apply. X-Session-Id is never sent.

That is a silent failure mode, not a loud one: existing callers doing

conf = hotdata.Configuration(api_key=..., workspace_id="ws_abc", session_id="sb_xyz")

get no error, no warning, and conf.session_id still reads back "sb_xyz" — but their queries and result reads now run unscoped against the workspace instead of isolated in the sandbox. Sandbox isolation quietly disappears.

This needs to be resolved one of two ways:

1. If dropping SessionId is intended — remove the session_id kwarg, property, setter, and docstring references from .openapi-generator-templates/configuration.mustache (lines 166-170, 212, 284, 331-337, 663-676) so the regenerated configuration.py no longer exposes a dead parameter, and note the removal as a breaking change in the CHANGELOG rather than under ### Changed.
2. If SessionId is still a real header — restore it in the upstream spec so the generator re-emits both the auth_settings() entry and the per-operation _auth_settings membership.

Separately worth confirming while you're here: the session_id docstring points users at SandboxesApi.create_sandbox, but there is no sandboxes_api.py in hotdata/api/. That predates this PR, but it suggests option 1 is the intent — in which case the template cleanup belongs in this change so the public API and the wire behavior stay in sync.

[claude]

Review

Blocking Issues

hotdata/configuration.py:601 — session_id becomes a silent no-op

This PR removes the SessionId security scheme from the generated code (auth_settings() in configuration.py, the AuthSettings TypedDict, and _auth_settings in query_api.py / results_api.py), but the session_id public surface added by this repo's custom templates is left in place:

• hotdata/configuration.py:191 — session_id: Optional[str]=None kwarg
• hotdata/configuration.py:240-241 — still writes self.api_keys["SessionId"]
• hotdata/configuration.py:543-557 — session_id property + setter, documented as "sent as X-Session-Id"
• hotdata/configuration.py:145-147 — class docstring advertises sandbox scoping via session_id

Nothing consumes that value now. update_params_for_auth (hotdata/api_client.py:649-651) looks each requested auth name up in configuration.auth_settings(); SessionId is absent from both the operation lists and the returned dict, so X-Session-Id is never sent.

Callers passing session_id="sb_xyz" get no error and can still read the value back off the config, but their /query and results requests silently run unscoped against the workspace instead of isolated in the sandbox. Silent loss of scoping is the problem here, not the removal itself.

Action Required

Pick one and make the code consistent:

1. Removal is intended — strip the session_id kwarg, property, setter, and docstring references from .openapi-generator-templates/configuration.mustache (lines 166-170, 212, 284, 331-337, 663-676) so regeneration stops exposing a dead parameter, and record this as a breaking change in CHANGELOG.md rather than a plain ### Changed entry.
2. X-Session-Id is still live — restore the scheme in the upstream spec so the generator re-emits the auth_settings() entry and the per-operation _auth_settings membership.

Option 1 looks likelier given the session_id docstring points at SandboxesApi.create_sandbox and no sandboxes_api.py exists in hotdata/api/. Either way, the template change belongs in this PR so the public API and the wire behavior do not diverge.