Both were referenced nowhere: Version held a stale hardcoded VERSION constant
and StringUtil reimplemented String.join.

Reorganize .openapi-generator-ignore into the shared section convention and
sort entries alphabetically within each section. No kept paths added or
dropped.

…nticator

Move getPrivateKeyFromString into WebTokenAuthenticator and buildHostname
into OpenId, NoAuthAuthenticator and PersonalAccessTokenAuthenticator as
private helpers, then delete the shared utils package. Other language SDKs
inline these too.

Drop lefthook from devbox, gitignore devbox.d, and trim the keep-list:
remove the already-gitignored .env and .idea entries and normalize
directory globs from dir/** to dir/.

Regeneration syncs the stale Client references in SKILLS.md to the
generated Zitadel facade.

… new API

The CMD points jshell at target/lib/* but mvn install never copied
dependencies there, so the REPL failed with 'target/lib/* not found'.
Add a dependency:copy-dependencies step to the build.

Override toString on token/secret-holding authenticators so secrets and
cached tokens are masked as *** instead of leaking into logs, matching
the Python, PHP and Ruby SDKs.

Regenerated against the generator that now redacts the bearer token in
BearerAuthenticator and ZitadelAccessTokenAuthenticator toString(), so the
masking is template-driven and survives regeneration instead of being
reverted. Keep-list the bespoke AuthenticatorRedactionTest so the prune step
preserves it.

Regenerated against the generator that redacts the bearer token in
BearerAuthenticator and ZitadelAccessTokenAuthenticator toString(). Replace the
aggregate AuthenticatorRedactionTest with one redaction test per bespoke
authenticator, each in its own test file (mirroring the Python, PHP, Ruby and
Node SDKs); keep-list them so the prune step preserves them.

The generated DefaultApiClient unit test referenced PhotoMetadata, a model that
exists only in the generator's own petstore spec, so the test sources did not
compile against this spec. The fixture is now declared in the test itself.

SKILLS.md leaves the keep-list. It is a generated file, but it sat in the block
reserved for team-owned tooling, so the generator never rewrote it and it froze
against an old version. It documented a petApi property and a Pet model this
package has never had, and told callers to import com.zitadel.models, which is
not the name of the package.

Model equality now compares container contents rather than references, so byte
arrays held in a list or a map compare by value. Signatures are unchanged.

Picks up the generated-documentation fixes. The examples previously described
APIs this package does not have: a RequestContext parameter no generator
emits, accessors under the wrong name, and error handling that could not run
as written.

The twelve generators had drifted into twelve dialects describing the same
SDK. Each sentence now has one wording across every language, varying only in
a token the language genuinely calls by another name.

The package manifest is maintained by hand and already declares Apache-2.0;
recording it in proc.yml keeps the generated metadata in agreement.

Adds the network and timeout errors, drops the one-off error types and
keeps the Zitadel root name through errorPrefix.

OpenID discovery and token requests now run lazily through the injected
ApiClient. Caller mistakes raise the built-in argument or state error, a
rejected token request OAuth2Server, an unusable token response OAuth2Token.
The private-key spec now uses the local stack instead of zitadel.cloud.

Every SDK error now lives in com.zitadel.errors, so the hand-written auth,
tests and specs import from there. Drop the local OAuth2 exception copies now
that the generator always emits them, and let OpenId discovery raise through
ApiException.fromResponse instead of keeping its own status table.

Add the OpenTelemetry SDK test dependencies the regenerated trace-context test
needs.

The repo carried no contributor guidance, so the keep-list, the error
contract and where a fix belongs were only discoverable by reading code.

Errors, client contract and configuration now match the other eleven
languages; the process-wide default configuration is gone.

The generator now records which dev dependencies its tests import, and
this repo keeps its own package manifest, so the two must stay in step.

…anifest

The generator now records which dev dependencies its tests import, and its
linter configs apply to the generated tree instead of being kept locally.

…tor needs

Generated code now passes the SDK toolchain: java line length is off as in
the other SDKs, python prunes unused imports, C# uses one authenticator form.

Drop testcontainers, assertj and junit-jupiter-params (no generated test
uses them) and declare opentelemetry-sdk-trace, which the trace test imports.
This is what dependency:analyze checks; the three unused deps were added in
error and broke the previously-green Lint Dependencies gate.

Add the 3129 auth proxy port, a testcontainers harness, and basic/407/authed proxy tests.