feat(sdks): Integration API OpenAPI clients (TS/Go/Python/Rust/C++/Dart)

.github/scripts/product_file_line_count_ratchet_baseline/backend-other.json

@@ -1,9 +1,11 @@
 {
   "files": {
-    "backend/scripts/validate-backend-runtime-env.py": 1843
+    "backend/scripts/validate-backend-runtime-env.py": 1843,
+    "backend/scripts/generate_integration_sdks.py": 2180
   },
   "raise_justifications": {
-    "backend/scripts/validate-backend-runtime-env.py": "Serving STT retirement, shared forbidden-env validation, and the SCA-29 admitted-runtime/workflow-control source boundary remain one authoritative deployment contract."
+    "backend/scripts/validate-backend-runtime-env.py": "STT retirement and shared forbidden-env guard keep provider/runtime validation in the authoritative deployment contract validator.",
+    "backend/scripts/generate_integration_sdks.py": "Single multi-language Integration API SDK generator; one file keeps OpenAPI\u2192TS/Go/Python/Rust/C++/Dart emission consistent."
   },
   "threshold": 1500
 }

.github/workflows/openapi-contract.yml

@@ -9,6 +9,8 @@ on:
       - 'docs/api-reference/openapi.json'
       - 'docs/api-reference/app-client-openapi.json'
       - 'docs/api-reference/integration-public-openapi.json'
+      - 'sdks/integration/**'
+      - 'backend/scripts/generate_integration_sdks.py'
       - 'app/lib/backend/http/api/**'
       - 'app/lib/backend/schema/**'
       - 'app/lib/backend/schema/gen/**'
@@ -27,6 +29,8 @@ on:
       - 'docs/api-reference/openapi.json'
       - 'docs/api-reference/app-client-openapi.json'
       - 'docs/api-reference/integration-public-openapi.json'
+      - 'sdks/integration/**'
+      - 'backend/scripts/generate_integration_sdks.py'
       - 'app/lib/backend/http/api/**'
       - 'app/lib/backend/schema/**'
       - 'app/lib/backend/schema/gen/**'
@@ -113,3 +117,6 @@ jobs:
 
       - name: Check generated desktop Swift DTOs
         run: python backend/scripts/generate_swift_openapi_types.py --check
+
+      - name: Check generated Integration API SDKs
+        run: python backend/scripts/generate_integration_sdks.py --check

README.md

@@ -134,7 +134,7 @@ cd app && bash setup.sh ios    # or: bash setup.sh android
 | Backend API | [`backend/`](backend/) | Python, FastAPI, Firebase |
 | Firmware | [`omi/`](omi/) | nRF, Zephyr, C |
 | Omi Glass | [`omiGlass/`](omiGlass/) | ESP32-S3, C |
-| SDKs | [`sdks/`](sdks/) | React Native, Swift, Python |
+| SDKs | [`sdks/`](sdks/) | React Native, Swift, Python, Integration (TS/Go/Python/Rust/C++) |
 | AI Personas | [`web/personas-open-source/`](web/personas-open-source/) | Next.js |
 
 </details>
@@ -158,7 +158,8 @@ cd app && bash setup.sh ios    # or: bash setup.sh android
 
 ### API & SDKs
 - [API Reference](https://docs.omi.me/api-reference/introduction) — REST endpoints for memories, conversations, action items
-- [Python SDK](sdks/python/)
+- [Integration API SDKs](sdks/integration/) — OpenAPI-generated TypeScript, Go, Python, Rust, C++, Dart (RN uses TypeScript)
+- [Python device SDK](sdks/python/)
 - [Swift SDK](sdks/swift/)
 - [React Native SDK](sdks/react-native/)
 - [MCP Server](mcp/) — Model Context Protocol integration

backend/scripts/export_openapi.py

@@ -788,6 +788,30 @@ def _normalize_app_client_security(schema: dict[str, Any]) -> None:
                     operation['responses'].setdefault('404', {'$ref': '#/components/responses/Error404'})
 
 
+def _strip_authorization_header_params(operation: dict[str, Any]) -> None:
+    """Drop raw Authorization header params in favor of securitySchemes.
+
+    FastAPI emits optional header parameters for Authorization. Generators treat
+    those as ordinary inputs and miss the bearer scheme. Prefer OpenAPI security.
+    """
+    params = operation.get('parameters')
+    if not params:
+        return
+    filtered = [
+        param
+        for param in params
+        if not (
+            isinstance(param, dict)
+            and param.get('in') == 'header'
+            and str(param.get('name', '')).lower() == 'authorization'
+        )
+    ]
+    if filtered:
+        operation['parameters'] = filtered
+    else:
+        operation.pop('parameters', None)
+
+
 def _normalize_integration_public_security(schema: dict[str, Any]) -> None:
     components = schema.setdefault('components', {})
     security_schemes = components.setdefault('securitySchemes', {})
@@ -804,11 +828,13 @@ def _normalize_integration_public_security(schema: dict[str, Any]) -> None:
                 }
             },
         }
-    schema.pop('security', None)
+    # Global default so generators wire bearer auth without per-op gymnastics.
+    schema['security'] = [{'integrationApiKey': []}]
 
     for path, operations in schema.get('paths', {}).items():
         for method, operation in operations.items():
             if method.upper() in HTTP_METHODS:
+                _strip_authorization_header_params(operation)
                 operation['security'] = [{'integrationApiKey': []}]
                 operation.setdefault('responses', {})['401'] = {'$ref': '#/components/responses/Error401'}
                 operation['responses'].setdefault('403', {'$ref': '#/components/responses/Error403'})