feat!: regenerate the SDK from the enhanced generator

Regenerate the client from openapi-generator-plus with modernized
templates, authenticators ported to the new interfaces, and house
tooling aligned to the generator's output.

BREAKING CHANGE: new generated API surface, a raised minimum runtime,
and updated dependencies; not source-compatible with the prior release.

Author: mridang

.editorconfig

@@ -3,11 +3,9 @@ root = true
 [*]
 charset = utf-8
 indent_style = space
-indent_size = 2
 end_of_line = lf
 trim_trailing_whitespace = true
 insert_final_newline = true
-max_line_length = 120
 
 [*.py]
-indent_size = 4
+indent_size = 4

.github/workflows/integration.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [ '3.10', '3.11', '3.12', '3.13' ]
+        python-version: [ '3.13' ]
       fail-fast: false
 
     steps:

.github/workflows/linting.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen

.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen

.github/workflows/test.yml

@@ -30,34 +30,43 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen
 
       - name: Run Tests
-        run: uv run pytest --junitxml=build/reports/junit.xml
+        run: uv run pytest
 
       - name: Generate coverage report
         uses: mridang/action-test-reporter@v1
         if: always()
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          coverage-file: 'build/coverage/clover.xml'
+          coverage-file: '.out/coverage.xml'
 
       - name: Upload Results
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: test-results
-          path: build/reports/junit.xml
+          path: .out/reports/junit.xml
+          overwrite: true
+
+      - name: Upload Coverage
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always()
+        with:
+          name: test-coverage
+          path: .out/coverage.xml
+          overwrite: true
 
       - name: Generate Report
         if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         uses: dorny/test-reporter@6e6a65b7a0bd2c9197df7d0ae36ac5cee784230c # v2.0.0
         with:
           name: Tests
-          path: build/reports/junit.xml
+          path: .out/reports/junit.xml
           reporter: java-junit
           fail-on-error: 'false'
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/typecheck.yml

@@ -33,10 +33,10 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen
 
-      - name: Run Ty
-        run: uv run ty check
+      - name: Run Mypy
+        run: uv run mypy zitadel_client

.github/workflows/unused.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen

.gitignore

@@ -1,78 +1,28 @@
-# Byte-compiled / optimized / DLL files
+# Python cache
 __pycache__/
 *.py[cod]
 *$py.class
 
-# C extensions
-*.so
+# Tool caches
+.pytest/
+.mypy/
+.mypy_cache/
+.ruff/
+.ruff_cache/
 
-# Distribution / packaging
-.Python
-env/
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-*.egg-info/
-.installed.cfg
-*.egg
-
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.coverage
-.coverage.*
-.cache
-.uv/
-nosetests.xml
-coverage.xml
-*,cover
-.hypothesis/
+# Virtual environment
 venv/
 .venv/
-.python-version
-.pytest
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
 
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-target/
+# Build output
+dist/
+build/
+*.egg-info/
 
-#Ipython Notebook
-.ipynb_checkpoints
+# Coverage output
+.out/
+.coverage
 
+# integration-test stack output (PAT, service-account key) — never commit
+etc/zitadel_output/
 .env
-
-devbox.json
-devbox.lock
-.devbox
-
-.uv
-
-.ruff
-.ty

.openapi-generator-ignore

@@ -0,0 +1,62 @@
+# Keep-list: files the generator must NOT overwrite, and the Makefile's
+# `prune` step must NOT delete. Everything else is generator-owned.
+
+# --- bespoke token-minting authenticators (ported onto the new
+#     Authenticator / HttpAwareAuthenticator interfaces) ---
+zitadel_client/auth/oauth_authenticator.py
+zitadel_client/auth/open_id.py
+zitadel_client/auth/client_credentials_authenticator.py
+zitadel_client/auth/web_token_authenticator.py
+zitadel_client/auth/personal_access_token_authenticator.py
+zitadel_client/auth/no_auth_authenticator.py
+
+# --- bespoke facade (hand-curated entry point wiring the with* factories
+#     onto the bespoke authenticators the generator does not emit) ---
+zitadel_client/zitadel.py
+
+# --- bespoke integration specs + Zitadel server fixtures ---
+spec/
+etc/
+
+# --- bespoke test files the generator does not emit: Zitadel authenticator
+#     unit tests, the facade test, the wiremock/squid/cert fixtures, and the
+#     auth-package init. The spec-independent unit tests (serializer, transport,
+#     header-selector, configuration, client) are now generator-owned. ---
+test/test_zitadel.py
+test/auth/__init__.py
+test/auth/test_oauth_authenticator.py
+test/auth/test_client_credentials_authenticator.py
+test/auth/test_no_auth_authenticator.py
+test/auth/test_personal_access_authenticator.py
+test/auth/test_web_token_authenticator.py
+test/fixtures/
+
+# --- repo identity, docs, house tooling (team-owned, not generated) ---
+README.md
+LICENSE
+SECURITY.md
+VERSIONING.md
+.github/
+.idea/
+.releaserc.json
+.commitlintrc.json
+.pre-commit-config.yaml
+devbox.json
+devbox.lock
+lefthook.yml
+qodana.yaml
+.dockerignore
+Dockerfile
+.editorconfig
+.gitignore
+uv.lock
+pyproject.toml
+
+# --- generation tooling we added ---
+proc.yml
+Makefile
+.openapi-generator-ignore
+
+# --- generator bookkeeping: the FILES manifest + VERSION are committed but
+#     are not themselves listed in FILES, so prune must be told to spare them. ---
+.openapi-generator/