feat!: regenerate the SDK from the enhanced generator

Regenerate the client from openapi-generator-plus with modernized
templates, authenticators ported to the new interfaces, and house
tooling aligned to the generator's output.

BREAKING CHANGE: new generated API surface, a raised minimum runtime,
and updated dependencies; not source-compatible with the prior release.

Author: mridang

.editorconfig

@@ -3,11 +3,9 @@ root = true
 [*]
 charset = utf-8
 indent_style = space
-indent_size = 2
 end_of_line = lf
 trim_trailing_whitespace = true
 insert_final_newline = true
-max_line_length = 120
 
 [*.java]
-indent_size = 4
+indent_size = 4

.github/workflows/integration.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java-version: [ '11', '17', '21' ]
+        java-version: [ '25' ]
       fail-fast: false
 
     steps:

.github/workflows/linting.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'corretto'
           cache: maven
 

.github/workflows/release.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'corretto'
           cache: maven
 

.github/workflows/test.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'corretto'
           cache: maven
 

.github/workflows/unused.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'corretto'
           cache: maven
 

.gitignore

@@ -1,27 +1,14 @@
+# Maven build output
+/target/
 *.class
 
-# Mobile Tools for Java (J2ME)
-.mtj.tmp/
+# IDE files
+*.iml
+.idea/
 
-# Package Files #
-*.jar
-*.war
-*.ear
-
-# exclude jar for gradle wrapper
-!gradle/wrapper/*.jar
-
-# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
-hs_err_pid*
-
-# build files
-**/target
-target
-.gradle
-build
+# Coverage output
+.out/
 
+# integration-test stack output (PAT, service-account key) — never commit
+etc/zitadel_output/
 .env
-
-devbox.json
-devbox.lock
-.devbox

.openapi-generator-ignore

@@ -0,0 +1,84 @@
+# Keep-list: files the generator must NOT overwrite, and the Makefile's
+# `prune` step must NOT delete. Everything else is generator-owned.
+
+# --- bespoke token-minting authenticators (ported onto the new
+#     Authenticator / BaseAuthenticator / HttpAwareAuthenticator interfaces) ---
+#
+# NOTE: the old hand-written Authenticator.java (abstract base) is NOT kept;
+# the generator now owns Authenticator (interface), BaseAuthenticator,
+# BearerAuthenticator, HttpAwareAuthenticator and ZitadelAccessTokenAuthenticator.
+src/main/java/com/zitadel/auth/ClientCredentialsAuthenticator.java
+src/main/java/com/zitadel/auth/NoAuthAuthenticator.java
+src/main/java/com/zitadel/auth/OAuthAuthenticator.java
+src/main/java/com/zitadel/auth/OpenId.java
+src/main/java/com/zitadel/auth/PersonalAccessTokenAuthenticator.java
+src/main/java/com/zitadel/auth/WebTokenAuthenticator.java
+
+# --- bespoke support classes the ported authenticators depend on and the
+#     new generator no longer emits (the old generator used to) ---
+src/main/java/com/zitadel/ZitadelException.java
+src/main/java/com/zitadel/utils/KeyUtil.java
+src/main/java/com/zitadel/utils/URLUtil.java
+
+# --- bespoke integration specs + Zitadel server fixtures ---
+#
+# NOTE: the six spec-independent unit tests (ValueSerializerTest,
+# HeaderSelectorTest, ConfigurationTest, TransportOptionsTest,
+# TraceContextUtilTest, DefaultApiClientUnitTest) are now generator-owned
+# and land under src/test/java/com/zitadel/...; they are NOT kept here.
+# Only the bespoke test RESOURCES (wiremock mappings, certs, squid.conf,
+# junit-platform.properties) are kept — the generator does not emit those.
+src/test/resources/**
+src/spec/**
+etc/**
+
+# --- repo identity, docs (team-owned, not generated) ---
+README.md
+LICENSE
+SECURITY.md
+VERSIONING.md
+
+# --- house tooling (team-owned, not generated) ---
+.github/**
+.mvn/**
+devbox.json
+devbox.lock
+lefthook.yml
+qodana.yaml
+settings.xml
+.editorconfig
+.gitignore
+.dockerignore
+Dockerfile
+.releaserc.json
+.commitlintrc.json
+.pre-commit-config.yaml
+.idea/**
+*.iml
+SKILLS.md
+.env
+
+# --- build config (team-owned): pom.xml carries the repo identity, the
+#     Maven Central release/deployment profile, and the bespoke-auth deps
+#     (nimbus-jose-jwt, bouncycastle bcprov/bcpkix) that the kept
+#     authenticators need and the generator does not emit. Its toolchain is
+#     aligned to the generator's output: checkstyle google_checks.xml +
+#     default spotbugs, no custom checkstyle.xml / spotbugs.xml (those are
+#     gone; the generator emits class-level @SuppressWarnings / @SuppressFBWarnings
+#     instead). ---
+pom.xml
+
+# --- generation tooling we added ---
+proc.yml
+Makefile
+.openapi-generator-ignore
+
+# generator-owned metadata (FILES manifest + VERSION) — always rewritten by
+# the generator, but keep-listed so prune does not treat them as orphans
+# (the FILES manifest does not list itself, so it would otherwise be deleted)
+.openapi-generator/
+src/main/java/com/zitadel/Zitadel.java
+src/main/java/com/zitadel/Version.java
+src/main/java/com/zitadel/utils/StringUtil.java
+
+# bespoke facade + helpers (hand-written glue over generated code)