build: bump openapi-generation to license token validation and elect commercial on the access-check token

Pins openapi-generation/v2 at 3f9d8b8234 (openapi-generation#55, target-
scoped license tokens) and generation-context v1.1.0.

The platform returns a license token on every non-blocked access check
(wildcard for paid tiers, one target for free workspaces), so the CLI
elects commercial output whenever a token is present and attaches it for
the generator to validate; the auth-context token is a fallback and a
warning is printed when no token was issued. Direct workflow runs and the
lint dry-run elect AGPL explicitly now that WithDirect no longer implies
it.

Author: ThomasRooney

cmd/lint/lint.go

@@ -592,7 +592,7 @@ func runDryRunGeneration(ctx context.Context, schemaPath, targetLanguage, workin
 	// Lint is available without authentication, so its optional diagnostic
 	// generation must explicitly use the direct AGPL mode when no caller state exists.
 	if _, ok := generationaccess.StateFromContext(ctx); !ok {
-		ctx = generationaccess.WithDirect(ctx)
+		ctx = generationaccess.WithDirect(ctx, generationaccess.ElectAGPL())
 	}
 
 	// Load the OpenAPI schema

go.mod

@@ -41,13 +41,13 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 	github.com/samber/lo v1.52.0
 	github.com/sethvargo/go-githubactions v1.3.2
-	github.com/speakeasy-api/generation-context v1.0.0
+	github.com/speakeasy-api/generation-context v1.1.0
 	github.com/speakeasy-api/git-diff-parser v0.2.0
 	github.com/speakeasy-api/gram v0.0.0-20260121234743-5a36906a8929
 	github.com/speakeasy-api/huh v1.1.2
 	github.com/speakeasy-api/jq v0.1.1-0.20251107233444-84d7e49e84a4
 	github.com/speakeasy-api/openapi v1.25.0
-	github.com/speakeasy-api/openapi-generation/v2 v2.933.1
+	github.com/speakeasy-api/openapi-generation/v2 v2.933.1-0.20260827162058-3f9d8b8234af
 	github.com/speakeasy-api/sdk-gen-config v1.58.0
 	github.com/speakeasy-api/speakeasy-agent-mode-content v0.2.12
 	github.com/speakeasy-api/speakeasy-client-sdk-go/v3 v3.28.1

go.sum

@@ -530,8 +530,8 @@ github.com/sourcegraph/jsonrpc2 v0.2.2 h1:fCyU80iidEwcF9kWaj4ylOO1h8pT8P8sFGv8EK
 github.com/sourcegraph/jsonrpc2 v0.2.2/go.mod h1:ZafdZgk/axhT1cvZAPOhw+95nz2I/Ra5qMlU4gTRwIo=
 github.com/speakeasy-api/easytemplate v0.12.4 h1:0xEm93tqPfdIWKUwgxvFgDLBmSDXlCImp+mQF3XZcOg=
 github.com/speakeasy-api/easytemplate v0.12.4/go.mod h1:UF8bFhTpyr1sHiEWacT7ULN67Bve6UIrTH7uvzdbTEY=
-github.com/speakeasy-api/generation-context v1.0.0 h1:LMHn7k1GCT1lIuwWSCn2ogaUgaIq8eGsGGPUXmvpW0s=
-github.com/speakeasy-api/generation-context v1.0.0/go.mod h1:AxqOSyH55Kp70pQynKl0nSlpke6P3/FlnFL//7sPM50=
+github.com/speakeasy-api/generation-context v1.1.0 h1:VndzBP6wdkk1yp7DGA/lgAMH+qudMLYf2I5wuXscs+8=
+github.com/speakeasy-api/generation-context v1.1.0/go.mod h1:AxqOSyH55Kp70pQynKl0nSlpke6P3/FlnFL//7sPM50=
 github.com/speakeasy-api/git-diff-parser v0.2.0 h1:fvPsWhTqTt+8j9Kx4eXF6kRRqDUC60gy0VII4PnjIHA=
 github.com/speakeasy-api/git-diff-parser v0.2.0/go.mod h1:P46HmmVVmwA9P8h2wa0fDpmRM8/grbVQ+uKhWDtpkIY=
 github.com/speakeasy-api/goja v0.0.0-20260223084236-ed0328a0a462 h1:wFAq/dFgXzPkOpI36BkHdUl4rKi7qh6iMsvlRkh2fCs=
@@ -550,8 +550,8 @@ github.com/speakeasy-api/libopenapi v0.21.10-fixhiddencomps-fixed h1:ZtuakKtG6x7
 github.com/speakeasy-api/libopenapi v0.21.10-fixhiddencomps-fixed/go.mod h1:Gc8oQkjr2InxwumK0zOBtKN9gIlv9L2VmSVIUk2YxcU=
 github.com/speakeasy-api/openapi v1.25.0 h1:xyJ5ZzW4YwStT2ICo0o7v9M890J7VpsR7AqhQSZnwl4=
 github.com/speakeasy-api/openapi v1.25.0/go.mod h1:9gGkzi9jNspEbcB08zta+IjzAi5Zy4QgSEQfF/LSrbQ=
-github.com/speakeasy-api/openapi-generation/v2 v2.933.1 h1:g0lZi8XsS2NjArwP1hyC08bJRKeOHjgD9gx9ie7KONQ=
-github.com/speakeasy-api/openapi-generation/v2 v2.933.1/go.mod h1:1Yypyh8Dl2dg/aYMY8ySCJ6kfuI9xTpUxuSs30XpZPE=
+github.com/speakeasy-api/openapi-generation/v2 v2.933.1-0.20260827162058-3f9d8b8234af h1:KuV5UGjAwP1pjJglPMzM02SBnJUsR9kkymf1y0v5jbg=
+github.com/speakeasy-api/openapi-generation/v2 v2.933.1-0.20260827162058-3f9d8b8234af/go.mod h1:OOjYkuR25Q5RvpwR5z1EeA9tIKdp3TK4jnXQsNbpmHg=
 github.com/speakeasy-api/openapi/openapi/linter/customrules v0.0.0-20260206023826-2483fb8e98b4 h1:gV+lYeVNNJG9X3Sl9Su3cRh1iF/oNqzvb5Ijq2QR8jY=
 github.com/speakeasy-api/openapi/openapi/linter/customrules v0.0.0-20260206023826-2483fb8e98b4/go.mod h1:1zQpVio7X6QJDtyNdUguCgZ+IC7CzKhhjvNgJdvGVF0=
 github.com/speakeasy-api/sdk-gen-config v1.58.0 h1:JrDgDU3XBIidv+TXFqYBvIomfeGEQ0zN+OnHyUc+kNw=

internal/run/run.go

@@ -179,7 +179,7 @@ func withWorkflowGenerationContext(ctx context.Context) (context.Context, error)
 	}
 
 	if _, err := core.GetWorkspaceIDFromContext(ctx); err != nil {
-		return generationaccess.WithDirect(ctx), nil //nolint:nilerr // Direct runs do not carry workspace context.
+		return generationaccess.WithDirect(ctx, generationaccess.ElectAGPL()), nil //nolint:nilerr // Direct runs do not carry workspace context.
 	}
 
 	// Target-level access checks decide whether authenticated output is commercial.

internal/sdkgen/generation_context_test.go

@@ -2,25 +2,29 @@ package sdkgen
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
 	generationaccess "github.com/speakeasy-api/generation-context/access"
+	"github.com/speakeasy-api/openapi-generation/v2/pkg/licensetoken"
 	"github.com/speakeasy-api/speakeasy-client-sdk-go/v3/pkg/models/shared"
 	"github.com/speakeasy-api/speakeasy-core/auth"
 )
 
-func TestWithGenerationContextSelectsCallerDecidedLicense(t *testing.T) {
+func TestWithGenerationContextElectsOnLicenseToken(t *testing.T) {
 	t.Parallel()
 
 	createdAt := time.Date(2024, time.January, 2, 3, 4, 5, 0, time.UTC)
 	testCases := []struct {
-		name              string
-		generationAllowed bool
-		wantLicense       generationaccess.GeneratedLicense
+		name         string
+		licenseToken []byte
+		wantLicense  generationaccess.GeneratedLicense
+		wantToken    bool
 	}{
-		{name: "allowed generation is commercial", generationAllowed: true, wantLicense: generationaccess.GeneratedLicenseCommercial},
-		{name: "unentitled generation is AGPL", generationAllowed: false, wantLicense: generationaccess.GeneratedLicenseAGPL},
+		{name: "license token elects commercial", licenseToken: []byte("license-token"), wantLicense: generationaccess.GeneratedLicenseCommercial, wantToken: true},
+		{name: "no license token elects AGPL", wantLicense: generationaccess.GeneratedLicenseAGPL},
+		{name: "empty license token elects AGPL", licenseToken: []byte{}, wantLicense: generationaccess.GeneratedLicenseAGPL},
 	}
 
 	for _, tt := range testCases {
@@ -37,7 +41,7 @@ func TestWithGenerationContextSelectsCallerDecidedLicense(t *testing.T) {
 				[]shared.BillingAddOn{shared.BillingAddOnSnippetAi},
 			)
 
-			ctx, err := withGenerationContext(legacy, tt.generationAllowed)
+			ctx, err := withGenerationContext(legacy, tt.licenseToken)
 			if err != nil {
 				t.Fatalf("with generation context: %v", err)
 			}
@@ -54,6 +58,14 @@ func TestWithGenerationContextSelectsCallerDecidedLicense(t *testing.T) {
 			if !state.HasBillingAddOn(shared.BillingAddOnSnippetAi) {
 				t.Fatal("caller bridge lost authenticated billing add-ons")
 			}
+			_, verification, err := licensetoken.ResolveGenerationAccess(ctx)
+			if tt.wantToken {
+				if !errors.Is(err, licensetoken.ErrInvalidLicenseToken) {
+					t.Fatalf("expected the attached fixture token to reach the validator and be rejected, got verification=%v err=%v", verification, err)
+				}
+			} else if err != nil || verification != nil {
+				t.Fatalf("expected no license token attached, got verification=%v err=%v", verification, err)
+			}
 		})
 	}
 }
@@ -68,7 +80,7 @@ func TestWithGenerationContextPreservesCancellableContext(t *testing.T) {
 	cancellable, cancel := context.WithCancel(legacy)
 	defer cancel()
 
-	ctx, err := withGenerationContext(cancellable, true)
+	ctx, err := withGenerationContext(cancellable, []byte("license-token"))
 	if err != nil {
 		t.Fatalf("with generation context: %v", err)
 	}
@@ -86,7 +98,7 @@ func TestWithGenerationContextRejectsIncompleteAuthentication(t *testing.T) {
 	t.Parallel()
 
 	original := auth.SetAccountTypeInContext(context.Background(), string(shared.AccountTypeBusiness))
-	ctx, err := withGenerationContext(original, true)
+	ctx, err := withGenerationContext(original, []byte("license-token"))
 	if err == nil {
 		t.Fatal("expected incomplete authentication error")
 	}

internal/sdkgen/sdkgen.go

@@ -27,6 +27,7 @@ import (
 
 	changelog "github.com/speakeasy-api/openapi-generation/v2"
 	"github.com/speakeasy-api/openapi-generation/v2/pkg/generate"
+	"github.com/speakeasy-api/openapi-generation/v2/pkg/licensetoken"
 	"github.com/speakeasy-api/openapi-generation/v2/pkg/merge"
 	"github.com/speakeasy-api/speakeasy/internal/log"
 	"github.com/speakeasy-api/speakeasy/internal/utils"
@@ -102,13 +103,14 @@ func Generate(ctx context.Context, opts GenerateOptions) (*GenerationAccess, err
 
 	logger := log.From(ctx).WithAssociatedFile(opts.SchemaPath)
 
-	generationAccess, level, message, accessErr := access.HasGenerationAccess(ctx, &access.GenerationAccessArgs{
+	accessResult, accessErr := access.CheckGenerationAccess(ctx, &access.GenerationAccessArgs{
 		GenLockID:  GetGenLockID(opts.OutDir),
 		TargetType: &opts.Language,
 	})
 	if accessErr != nil {
 		return &GenerationAccess{}, fmt.Errorf("failed to evaluate generation access: %w", accessErr)
 	}
+	generationAccess, level, message := accessResult.Allowed, accessResult.Level, accessResult.Message
 
 	if !generationAccess && level != nil && *level == shared.LevelBlocked {
 		msg := styles.RenderErrorMessage(
@@ -124,14 +126,21 @@ func Generate(ctx context.Context, opts GenerateOptions) (*GenerationAccess, err
 		}, stderrors.New("generation access blocked")
 	}
 
-	ctx, err := withGenerationContext(ctx, generationAccess)
+	licenseToken := accessResult.LicenseToken
+	if licenseToken == nil {
+		licenseToken, _ = auth.GetLicenseTokenFromContext(ctx)
+	}
+	ctx, err := withGenerationContext(ctx, licenseToken)
 	if err != nil {
 		return &GenerationAccess{
 			AccessAllowed: generationAccess,
 			Message:       message,
 			Level:         level,
 		}, fmt.Errorf("failed to prepare generation context: %w", err)
 	}
+	if licenseToken == nil {
+		logger.Warnf("No license token was issued for this generation; generated output is licensed under AGPL-3.0-only.")
+	}
 
 	logger.Infof("Generating SDK for %s...\n", opts.Language)
 
@@ -276,7 +285,7 @@ func Generate(ctx context.Context, opts GenerateOptions) (*GenerationAccess, err
 
 		var errs []error
 		if opts.CancellableGeneration != nil && opts.CancellableGeneration.CancellableContext != nil {
-			cancelCtx, err := withGenerationContext(opts.CancellableGeneration.CancellableContext, generationAccess)
+			cancelCtx, err := withGenerationContext(opts.CancellableGeneration.CancellableContext, licenseToken)
 			if err != nil {
 				return fmt.Errorf("failed to prepare cancellable generation context: %w", err)
 			}
@@ -348,12 +357,16 @@ func Generate(ctx context.Context, opts GenerateOptions) (*GenerationAccess, err
 	}, nil
 }
 
-func withGenerationContext(ctx context.Context, generationAllowed bool) (context.Context, error) {
-	generatedLicense := generationaccess.GeneratedLicenseAGPL
-	if generationAllowed {
-		generatedLicense = generationaccess.GeneratedLicenseCommercial
+func withGenerationContext(ctx context.Context, licenseToken []byte) (context.Context, error) {
+	if len(licenseToken) == 0 {
+		return auth.WithGenerationContext(ctx, generationaccess.GeneratedLicenseAGPL)
+	}
+
+	ctx, err := auth.WithGenerationContext(ctx, generationaccess.GeneratedLicenseCommercial)
+	if err != nil {
+		return ctx, err
 	}
-	return auth.WithGenerationContext(ctx, generatedLicense)
+	return licensetoken.WithToken(ctx, licenseToken), nil
 }
 
 func ValidateConfig(ctx context.Context, outDir string) error {