feat: refactor(terraform): restructure origin_tls_client_auth to peer subresources

* fix: add backward-compatible methods for origin_tls_client_auth

Adds deprecated parent-level methods (list, get, create, delete) to maintain
backward compatibility with existing SDK users while preserving the clean
cache-style resource structure.

Changes:
- Add 4 deprecated methods at parent level pointing to zone cert endpoints
- Methods generate client.OriginTLSClientAuth.New/List/Get/Delete() paths
- Deprecation messages guide users to zone_certificates.* subresource
- Zero breaking changes - existing SDK code continues to work
- New explicit paths available at ZoneCertificates.* and HostnameCertificates.*

This follows the proven KV namespace dual-path pattern (lines 2730-2752)
where the same endpoint generates methods at both parent and child levels.

Related: SECENG-12971

* refactor(terraform): restructure origin_tls_client_auth to peer subresources

Restructure origin_tls_client_auth to have all 4 terraform resources as sibling subresources:
- zone_certificates → authenticated_origin_pulls_certificate
- hostnames → authenticated_origin_pulls
- hostname_certificates → authenticated_origin_pulls_hostname_certificate
- settings → authenticated_origin_pulls_settings

Add id_property annotations to all CRUD methods.

Closes SECENG-12971, SECENG-12970, SECENG-13210

Author: stainless-app[bot]

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 1995
 openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare%2Fcloudflare-28b84a5db03b38290dfe7ef1de2c68feb68762d7a8f207bdbea4d39a7aeef1ea.yml
 openapi_spec_hash: ba6bd61621e4be20b581f4f3bf0978d3
-config_hash: b73d16cbbb07431f2e4dff6dc0290ba5
+config_hash: ba25c643e51849c8da3f0383b84239c8

api.md

@@ -2038,7 +2038,6 @@ Types:
 
 ```python
 from cloudflare.types.origin_tls_client_auth import (
-    ZoneAuthenticatedOriginPull,
     OriginTLSClientAuthCreateResponse,
     OriginTLSClientAuthListResponse,
     OriginTLSClientAuthDeleteResponse,
@@ -2053,6 +2052,27 @@ Methods:
 - <code title="delete /zones/{zone_id}/origin_tls_client_auth/{certificate_id}">client.origin_tls_client_auth.<a href="./src/cloudflare/resources/origin_tls_client_auth/origin_tls_client_auth.py">delete</a>(certificate_id, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/origin_tls_client_auth_delete_response.py">Optional[OriginTLSClientAuthDeleteResponse]</a></code>
 - <code title="get /zones/{zone_id}/origin_tls_client_auth/{certificate_id}">client.origin_tls_client_auth.<a href="./src/cloudflare/resources/origin_tls_client_auth/origin_tls_client_auth.py">get</a>(certificate_id, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/origin_tls_client_auth_get_response.py">Optional[OriginTLSClientAuthGetResponse]</a></code>
 
+## ZoneCertificates
+
+Types:
+
+```python
+from cloudflare.types.origin_tls_client_auth import (
+    ZoneAuthenticatedOriginPull,
+    ZoneCertificateCreateResponse,
+    ZoneCertificateListResponse,
+    ZoneCertificateDeleteResponse,
+    ZoneCertificateGetResponse,
+)
+```
+
+Methods:
+
+- <code title="post /zones/{zone_id}/origin_tls_client_auth">client.origin_tls_client_auth.zone_certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/zone_certificates.py">create</a>(\*, zone_id, \*\*<a href="src/cloudflare/types/origin_tls_client_auth/zone_certificate_create_params.py">params</a>) -> <a href="./src/cloudflare/types/origin_tls_client_auth/zone_certificate_create_response.py">Optional[ZoneCertificateCreateResponse]</a></code>
+- <code title="get /zones/{zone_id}/origin_tls_client_auth">client.origin_tls_client_auth.zone_certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/zone_certificates.py">list</a>(\*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/zone_certificate_list_response.py">SyncSinglePage[ZoneCertificateListResponse]</a></code>
+- <code title="delete /zones/{zone_id}/origin_tls_client_auth/{certificate_id}">client.origin_tls_client_auth.zone_certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/zone_certificates.py">delete</a>(certificate_id, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/zone_certificate_delete_response.py">Optional[ZoneCertificateDeleteResponse]</a></code>
+- <code title="get /zones/{zone_id}/origin_tls_client_auth/{certificate_id}">client.origin_tls_client_auth.zone_certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/zone_certificates.py">get</a>(certificate_id, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/zone_certificate_get_response.py">Optional[ZoneCertificateGetResponse]</a></code>
+
 ## Hostnames
 
 Types:
@@ -2063,29 +2083,29 @@ from cloudflare.types.origin_tls_client_auth import AuthenticatedOriginPull, Hos
 
 Methods:
 
-- <code title="put /zones/{zone_id}/origin_tls_client_auth/hostnames">client.origin_tls_client_auth.hostnames.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostnames/hostnames.py">update</a>(\*, zone_id, \*\*<a href="src/cloudflare/types/origin_tls_client_auth/hostname_update_params.py">params</a>) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostname_update_response.py">SyncSinglePage[HostnameUpdateResponse]</a></code>
-- <code title="get /zones/{zone_id}/origin_tls_client_auth/hostnames/{hostname}">client.origin_tls_client_auth.hostnames.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostnames/hostnames.py">get</a>(hostname, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/authenticated_origin_pull.py">Optional[AuthenticatedOriginPull]</a></code>
+- <code title="put /zones/{zone_id}/origin_tls_client_auth/hostnames">client.origin_tls_client_auth.hostnames.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostnames.py">update</a>(\*, zone_id, \*\*<a href="src/cloudflare/types/origin_tls_client_auth/hostname_update_params.py">params</a>) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostname_update_response.py">SyncSinglePage[HostnameUpdateResponse]</a></code>
+- <code title="get /zones/{zone_id}/origin_tls_client_auth/hostnames/{hostname}">client.origin_tls_client_auth.hostnames.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostnames.py">get</a>(hostname, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/authenticated_origin_pull.py">Optional[AuthenticatedOriginPull]</a></code>
 
-### Certificates
+## HostnameCertificates
 
 Types:
 
 ```python
-from cloudflare.types.origin_tls_client_auth.hostnames import (
+from cloudflare.types.origin_tls_client_auth import (
     Certificate,
-    CertificateCreateResponse,
-    CertificateListResponse,
-    CertificateDeleteResponse,
-    CertificateGetResponse,
+    HostnameCertificateCreateResponse,
+    HostnameCertificateListResponse,
+    HostnameCertificateDeleteResponse,
+    HostnameCertificateGetResponse,
 )
 ```
 
 Methods:
 
-- <code title="post /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates">client.origin_tls_client_auth.hostnames.certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostnames/certificates.py">create</a>(\*, zone_id, \*\*<a href="src/cloudflare/types/origin_tls_client_auth/hostnames/certificate_create_params.py">params</a>) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostnames/certificate_create_response.py">Optional[CertificateCreateResponse]</a></code>
-- <code title="get /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates">client.origin_tls_client_auth.hostnames.certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostnames/certificates.py">list</a>(\*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostnames/certificate_list_response.py">SyncSinglePage[CertificateListResponse]</a></code>
-- <code title="delete /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates/{certificate_id}">client.origin_tls_client_auth.hostnames.certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostnames/certificates.py">delete</a>(certificate_id, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostnames/certificate_delete_response.py">Optional[CertificateDeleteResponse]</a></code>
-- <code title="get /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates/{certificate_id}">client.origin_tls_client_auth.hostnames.certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostnames/certificates.py">get</a>(certificate_id, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostnames/certificate_get_response.py">Optional[CertificateGetResponse]</a></code>
+- <code title="post /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates">client.origin_tls_client_auth.hostname_certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostname_certificates.py">create</a>(\*, zone_id, \*\*<a href="src/cloudflare/types/origin_tls_client_auth/hostname_certificate_create_params.py">params</a>) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostname_certificate_create_response.py">Optional[HostnameCertificateCreateResponse]</a></code>
+- <code title="get /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates">client.origin_tls_client_auth.hostname_certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostname_certificates.py">list</a>(\*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostname_certificate_list_response.py">SyncSinglePage[HostnameCertificateListResponse]</a></code>
+- <code title="delete /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates/{certificate_id}">client.origin_tls_client_auth.hostname_certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostname_certificates.py">delete</a>(certificate_id, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostname_certificate_delete_response.py">Optional[HostnameCertificateDeleteResponse]</a></code>
+- <code title="get /zones/{zone_id}/origin_tls_client_auth/hostnames/certificates/{certificate_id}">client.origin_tls_client_auth.hostname_certificates.<a href="./src/cloudflare/resources/origin_tls_client_auth/hostname_certificates.py">get</a>(certificate_id, \*, zone_id) -> <a href="./src/cloudflare/types/origin_tls_client_auth/hostname_certificate_get_response.py">Optional[HostnameCertificateGetResponse]</a></code>
 
 ## Settings
 

src/cloudflare/resources/origin_tls_client_auth/__init__.py

@@ -16,6 +16,22 @@
     HostnamesResourceWithStreamingResponse,
     AsyncHostnamesResourceWithStreamingResponse,
 )
+from .zone_certificates import (
+    ZoneCertificatesResource,
+    AsyncZoneCertificatesResource,
+    ZoneCertificatesResourceWithRawResponse,
+    AsyncZoneCertificatesResourceWithRawResponse,
+    ZoneCertificatesResourceWithStreamingResponse,
+    AsyncZoneCertificatesResourceWithStreamingResponse,
+)
+from .hostname_certificates import (
+    HostnameCertificatesResource,
+    AsyncHostnameCertificatesResource,
+    HostnameCertificatesResourceWithRawResponse,
+    AsyncHostnameCertificatesResourceWithRawResponse,
+    HostnameCertificatesResourceWithStreamingResponse,
+    AsyncHostnameCertificatesResourceWithStreamingResponse,
+)
 from .origin_tls_client_auth import (
     OriginTLSClientAuthResource,
     AsyncOriginTLSClientAuthResource,
@@ -26,12 +42,24 @@
 )
 
 __all__ = [
+    "ZoneCertificatesResource",
+    "AsyncZoneCertificatesResource",
+    "ZoneCertificatesResourceWithRawResponse",
+    "AsyncZoneCertificatesResourceWithRawResponse",
+    "ZoneCertificatesResourceWithStreamingResponse",
+    "AsyncZoneCertificatesResourceWithStreamingResponse",
     "HostnamesResource",
     "AsyncHostnamesResource",
     "HostnamesResourceWithRawResponse",
     "AsyncHostnamesResourceWithRawResponse",
     "HostnamesResourceWithStreamingResponse",
     "AsyncHostnamesResourceWithStreamingResponse",
+    "HostnameCertificatesResource",
+    "AsyncHostnameCertificatesResource",
+    "HostnameCertificatesResourceWithRawResponse",
+    "AsyncHostnameCertificatesResourceWithRawResponse",
+    "HostnameCertificatesResourceWithStreamingResponse",
+    "AsyncHostnameCertificatesResourceWithStreamingResponse",
     "SettingsResource",
     "AsyncSettingsResource",
     "SettingsResourceWithRawResponse",