feat!: regenerate the SDK from the enhanced generator

.editorconfig

@@ -3,11 +3,9 @@ root = true
 [*]
 charset = utf-8
 indent_style = space
-indent_size = 2
 end_of_line = lf
 trim_trailing_whitespace = true
 insert_final_newline = true
-max_line_length = 120
 
 [*.java]
-indent_size = 4
+indent_size = 4

.github/workflows/integration.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java-version: [ '11', '17', '21' ]
+        java-version: [ '25' ]
       fail-fast: false
 
     steps:

.github/workflows/linting.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'corretto'
           cache: maven
 

.github/workflows/release.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'corretto'
           cache: maven
 

.github/workflows/test.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'corretto'
           cache: maven
 

.github/workflows/unused.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'corretto'
           cache: maven
 

.gitignore

@@ -1,27 +1,17 @@
+# Maven build output
+/target/
 *.class
 
-# Mobile Tools for Java (J2ME)
-.mtj.tmp/
+# IDE files
+*.iml
+.idea/
 
-# Package Files #
-*.jar
-*.war
-*.ear
+# devbox local state
+devbox.d/
 
-# exclude jar for gradle wrapper
-!gradle/wrapper/*.jar
-
-# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
-hs_err_pid*
-
-# build files
-**/target
-target
-.gradle
-build
+# Coverage output
+.out/
 
+# integration-test stack output (PAT, service-account key) — never commit
+etc/zitadel_output/
 .env
-
-devbox.json
-devbox.lock
-.devbox

.openapi-generator-ignore

@@ -0,0 +1,80 @@
+# Keep-list: files the generator must NOT overwrite, and the Makefile's
+# `prune` step must NOT delete. Everything else is generator-owned.
+
+# --- bespoke authenticators (ported onto the generated auth interfaces) ---
+#
+# NOTE: the old hand-written Authenticator.java (abstract base) is NOT kept;
+# the generator now owns Authenticator (interface), BaseAuthenticator,
+# BearerAuthenticator, HttpAwareAuthenticator and ZitadelAccessTokenAuthenticator.
+src/main/java/com/zitadel/auth/ClientCredentialsAuthenticator.java
+src/main/java/com/zitadel/auth/NoAuthAuthenticator.java
+src/main/java/com/zitadel/auth/OAuthAuthenticator.java
+src/main/java/com/zitadel/auth/OpenId.java
+src/main/java/com/zitadel/auth/PersonalAccessTokenAuthenticator.java
+src/main/java/com/zitadel/auth/WebTokenAuthenticator.java
+
+# --- bespoke tests + fixtures the generator does not emit ---
+#
+# NOTE: the six spec-independent unit tests (ValueSerializerTest,
+# HeaderSelectorTest, ConfigurationTest, TransportOptionsTest,
+# TraceContextUtilTest, DefaultApiClientUnitTest) are now generator-owned
+# and land under src/test/java/com/zitadel/...; they are NOT kept here.
+# Only the bespoke test RESOURCES (wiremock mappings, certs, squid.conf,
+# junit-platform.properties) are kept — the generator does not emit those.
+#
+# One redaction test per bespoke secret-bearing authenticator (mirroring the
+# Python, PHP and Ruby SDKs): each verifies the secret/cached token is masked
+# in toString(). The generator does not emit these for this spec, so they are
+# kept here to survive the prune step.
+etc/
+src/spec/
+src/test/resources/
+src/test/java/com/zitadel/auth/ClientCredentialsAuthenticatorTest.java
+src/test/java/com/zitadel/auth/PersonalAccessTokenAuthenticatorTest.java
+src/test/java/com/zitadel/auth/OAuthAuthenticatorTest.java
+src/test/java/com/zitadel/auth/WebTokenAuthenticatorTest.java
+
+# --- repo identity + docs (team-owned, not generated) ---
+LICENSE
+README.md
+SECURITY.md
+VERSIONING.md
+
+# --- house tooling (team-owned, not generated) ---
+.commitlintrc.json
+.dockerignore
+.editorconfig
+.github/
+.gitignore
+.mvn/
+.pre-commit-config.yaml
+.releaserc.json
+*.iml
+devbox.json
+devbox.lock
+Dockerfile
+lefthook.yml
+qodana.yaml
+settings.xml
+
+# --- build / package config (team-owned: carries repo identity + bespoke
+#     deps) ---
+#
+# pom.xml carries the repo identity, the Maven Central release/deployment
+# profile, and the bespoke-auth deps (nimbus-jose-jwt, bouncycastle
+# bcprov/bcpkix) that the kept authenticators need and the generator does
+# not emit. Its toolchain is aligned to the generator's output: checkstyle
+# google_checks.xml + default spotbugs, no custom checkstyle.xml /
+# spotbugs.xml (the generator emits class-level @SuppressWarnings /
+# @SuppressFBWarnings instead).
+pom.xml
+
+# --- generation tooling we added ---
+.openapi-generator-ignore
+Makefile
+proc.yml
+
+# --- generator bookkeeping (FILES manifest + VERSION; rewritten by the
+#     generator but keep-listed so prune does not orphan them — the FILES
+#     manifest does not list itself, so it would otherwise be deleted) ---
+.openapi-generator/