feat(csharp): remove omitted basic auth fields from SDK API, use empty string internally

generators/csharp/dynamic-snippets/src/EndpointSnippetGenerator.ts

@@ -385,16 +385,24 @@ export class EndpointSnippetGenerator extends WithGeneration {
         auth: FernIr.dynamic.BasicAuth;
         values: FernIr.dynamic.BasicAuthValues;
     }): NamedArgument[] {
-        return [
-            {
+        // usernameOmit/passwordOmit may exist in newer IR versions
+        const authRecord = auth as unknown as Record<string, unknown>;
+        const usernameOmitted = !!authRecord.usernameOmit;
+        const passwordOmitted = !!authRecord.passwordOmit;
+        const args: NamedArgument[] = [];
+        if (!usernameOmitted) {
+            args.push({
                 name: this.context.getParameterName(auth.username),
                 assignment: this.csharp.Literal.string(values.username)
-            },
-            {
+            });
+        }
+        if (!passwordOmitted) {
+            args.push({
                 name: this.context.getParameterName(auth.password),
                 assignment: this.csharp.Literal.string(values.password)
-            }
-        ];
+            });
+        }
+        return args;
     }
 
     private getConstructorBearerAuthArgs({

generators/csharp/sdk/src/root-client/RootClientGenerator.ts

@@ -454,6 +454,7 @@ export class RootClientGenerator extends FileGenerator<CSharpFile, SdkGeneratorC
                             (s): s is typeof s & { type: "basic" } => s.type === "basic"
                         );
                         const isAuthOptional = !this.context.ir.sdkConfig.isAuthMandatory;
+                        let isFirstBlock = true;
                         for (let i = 0; i < basicSchemes.length; i++) {
                             const basicScheme = basicSchemes[i];
                             if (basicScheme == null) {
@@ -467,15 +468,30 @@ export class RootClientGenerator extends FileGenerator<CSharpFile, SdkGeneratorC
                             const passwordAccess = unified
                                 ? `clientOptions.${this.toPascalCase(passwordName)}`
                                 : passwordName;
+                            const usernameOmitted = !!basicScheme.usernameOmit;
+                            const passwordOmitted = !!basicScheme.passwordOmit;
+                            // Condition: only require non-omitted fields to be present
+                            let condition: string;
+                            if (!usernameOmitted && !passwordOmitted) {
+                                condition = `${usernameAccess} != null && ${passwordAccess} != null`;
+                            } else if (usernameOmitted && !passwordOmitted) {
+                                condition = `${passwordAccess} != null`;
+                            } else if (!usernameOmitted && passwordOmitted) {
+                                condition = `${usernameAccess} != null`;
+                            } else {
+                                // Both fields omitted — skip auth header entirely when auth is non-mandatory
+                                continue;
+                            }
                             if (isAuthOptional || basicSchemes.length > 1) {
-                                const controlFlowKeyword = i === 0 ? "if" : "else if";
-                                innerWriter.controlFlow(
-                                    controlFlowKeyword,
-                                    this.csharp.codeblock(`${usernameAccess} != null && ${passwordAccess} != null`)
-                                );
+                                const controlFlowKeyword = isFirstBlock ? "if" : "else if";
+                                innerWriter.controlFlow(controlFlowKeyword, this.csharp.codeblock(condition));
                             }
+                            isFirstBlock = false;
+                            // Build credential string: omitted fields are empty, provided fields use interpolation
+                            const usernamePart = usernameOmitted ? "" : `{${usernameAccess}}`;
+                            const passwordPart = passwordOmitted ? "" : `{${passwordAccess}}`;
                             innerWriter.writeTextStatement(
-                                `clientOptionsWithAuth.Headers["Authorization"] = $"Basic {Convert.ToBase64String(global::System.Text.Encoding.UTF8.GetBytes($"{${usernameAccess}}:{${passwordAccess}}"))}"`
+                                `clientOptionsWithAuth.Headers["Authorization"] = $"Basic {Convert.ToBase64String(global::System.Text.Encoding.UTF8.GetBytes($"${usernamePart}:${passwordPart}"))}"`
                             );
                             if (isAuthOptional || basicSchemes.length > 1) {
                                 innerWriter.endControlFlow();
@@ -802,8 +818,12 @@ export class RootClientGenerator extends FileGenerator<CSharpFile, SdkGeneratorC
             {
                 const usernameName = this.case.camelSafe(scheme.username);
                 const passwordName = this.case.camelSafe(scheme.password);
-                return [
-                    {
+                const usernameOmitted = !!scheme.usernameOmit;
+                const passwordOmitted = !!scheme.passwordOmit;
+                // When omit is true, the field is completely removed from the end-user API.
+                const params: ConstructorParameter[] = [];
+                if (!usernameOmitted) {
+                    params.push({
                         name: usernameName,
                         docs: scheme.docs ?? `The ${usernameName} to use for authentication.`,
                         isOptional,
@@ -817,8 +837,10 @@ export class RootClientGenerator extends FileGenerator<CSharpFile, SdkGeneratorC
                         type: this.Primitive.string,
                         environmentVariable: scheme.usernameEnvVar,
                         exampleValue: this.case.screamingSnakeSafe(scheme.username)
-                    },
-                    {
+                    });
+                }
+                if (!passwordOmitted) {
+                    params.push({
                         name: passwordName,
                         docs: scheme.docs ?? `The ${passwordName} to use for authentication.`,
                         isOptional,
@@ -832,8 +854,9 @@ export class RootClientGenerator extends FileGenerator<CSharpFile, SdkGeneratorC
                         type: this.Primitive.string,
                         environmentVariable: scheme.passwordEnvVar,
                         exampleValue: this.case.screamingSnakeSafe(scheme.password)
-                    }
-                ];
+                    });
+                }
+                return params;
             }
         } else if (scheme.type === "oauth") {
             if (this.oauth !== null) {

generators/csharp/sdk/versions.yml

@@ -1,4 +1,16 @@
 # yaml-language-server: $schema=../../../fern-versions-yml.schema.json
+- version: 2.58.0
+  changelogEntry:
+    - summary: |
+        Support omitting username or password from basic auth when configured via
+        `usernameOmit` or `passwordOmit` in the IR. Omitted fields are removed from
+        the SDK's public API and treated as empty strings internally (e.g., omitting
+        password encodes `username:`, omitting username encodes `:password`). When
+        both are omitted, the Authorization header is skipped entirely.
+      type: feat
+  createdAt: "2026-04-03"
+  irVersion: 66
+
 - version: 2.57.0-rc.0
   changelogEntry:
     - summary: |

packages/cli/generation/ir-generator/src/dynamic-snippets/DynamicSnippetsConverter.ts

@@ -732,11 +732,22 @@ export class DynamicSnippetsConverter {
         }
         const scheme = auth.schemes[0];
         switch (scheme.type) {
-            case "basic":
-                return DynamicSnippets.Auth.basic({
+            case "basic": {
+                const basicAuth: DynamicSnippets.BasicAuth & {
+                    usernameOmit?: boolean;
+                    passwordOmit?: boolean;
+                } = {
                     username: this.inflateName(scheme.username),
                     password: this.inflateName(scheme.password)
-                });
+                };
+                if (scheme.usernameOmit) {
+                    basicAuth.usernameOmit = scheme.usernameOmit;
+                }
+                if (scheme.passwordOmit) {
+                    basicAuth.passwordOmit = scheme.passwordOmit;
+                }
+                return DynamicSnippets.Auth.basic(basicAuth);
+            }
             case "bearer":
                 return DynamicSnippets.Auth.bearer({
                     token: this.inflateName(scheme.token)