feat!: regenerate the SDK from the enhanced generator

.editorconfig

@@ -3,11 +3,9 @@ root = true
 [*]
 charset = utf-8
 indent_style = space
-indent_size = 2
 end_of_line = lf
 trim_trailing_whitespace = true
 insert_final_newline = true
-max_line_length = 120
 
 [*.py]
-indent_size = 4
+indent_size = 4

.github/workflows/integration.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [ '3.10', '3.11', '3.12', '3.13' ]
+        python-version: [ '3.13' ]
       fail-fast: false
 
     steps:

.github/workflows/linting.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen

.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen

.github/workflows/test.yml

@@ -30,34 +30,43 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen
 
       - name: Run Tests
-        run: uv run pytest --junitxml=build/reports/junit.xml
+        run: uv run pytest
 
       - name: Generate coverage report
         uses: mridang/action-test-reporter@v1
         if: always()
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          coverage-file: 'build/coverage/clover.xml'
+          coverage-file: '.out/coverage.xml'
 
       - name: Upload Results
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: test-results
-          path: build/reports/junit.xml
+          path: .out/reports/junit.xml
+          overwrite: true
+
+      - name: Upload Coverage
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always()
+        with:
+          name: test-coverage
+          path: .out/coverage.xml
+          overwrite: true
 
       - name: Generate Report
         if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         uses: dorny/test-reporter@6e6a65b7a0bd2c9197df7d0ae36ac5cee784230c # v2.0.0
         with:
           name: Tests
-          path: build/reports/junit.xml
+          path: .out/reports/junit.xml
           reporter: java-junit
           fail-on-error: 'false'
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/typecheck.yml

@@ -15,7 +15,7 @@ permissions:
   contents: read
 
 jobs:
-  ty-check:
+  mypy-check:
     runs-on: ubuntu-latest
     name: Inspect Code
 
@@ -33,10 +33,10 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen
 
-      - name: Run Ty
-        run: uv run ty check
+      - name: Run Mypy
+        run: uv run mypy zitadel_client test spec

.github/workflows/unused.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v4
         with:
-          python-version: "3.10"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: uv sync --group dev --frozen

.gitignore

@@ -1,78 +1,29 @@
-# Byte-compiled / optimized / DLL files
+# Python cache
 __pycache__/
 *.py[cod]
 *$py.class
 
-# C extensions
-*.so
+# Tool caches
+devbox.d/
+.pytest/
+.mypy/
+.mypy_cache/
+.ruff/
+.ruff_cache/
 
-# Distribution / packaging
-.Python
-env/
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-*.egg-info/
-.installed.cfg
-*.egg
-
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.coverage
-.coverage.*
-.cache
-.uv/
-nosetests.xml
-coverage.xml
-*,cover
-.hypothesis/
+# Virtual environment
 venv/
 .venv/
-.python-version
-.pytest
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
 
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-target/
+# Build output
+dist/
+build/
+*.egg-info/
 
-#Ipython Notebook
-.ipynb_checkpoints
+# Coverage output
+.out/
+.coverage
 
+# integration-test stack output (PAT, service-account key) — never commit
+etc/zitadel_output/
 .env
-
-devbox.json
-devbox.lock
-.devbox
-
-.uv
-
-.ruff
-.ty

.openapi-generator-ignore

@@ -0,0 +1,71 @@
+# Keep-list: files the generator must NOT overwrite, and the Makefile's
+# `prune` step must NOT delete. Everything else is generator-owned.
+
+# --- bespoke authenticators (ported onto the generated auth interfaces) ---
+#
+# NOTE: the generator now owns authenticator.py (interface), base_authenticator.py,
+# bearer_authenticator.py, http_aware_authenticator.py and
+# zitadel_access_token_authenticator.py; only the token-minting strategies below
+# are kept.
+zitadel_client/auth/client_credentials_authenticator.py
+zitadel_client/auth/no_auth_authenticator.py
+zitadel_client/auth/oauth_authenticator.py
+zitadel_client/auth/open_id.py
+zitadel_client/auth/personal_access_token_authenticator.py
+zitadel_client/auth/web_token_authenticator.py
+
+# --- bespoke tests + fixtures the generator does not emit ---
+#
+# NOTE: the spec-independent unit tests (value_serializer, header_selector,
+# configuration, transport_options, trace_context_util, default_api_client_unit)
+# are now generator-owned and are NOT kept here. Only the Zitadel authenticator
+# unit tests, the facade test, the integration specs, the Zitadel server
+# fixtures, and the wiremock/squid/cert fixtures are kept.
+etc/
+spec/
+test/auth/__init__.py
+test/auth/test_client_credentials_authenticator.py
+test/auth/test_no_auth_authenticator.py
+test/auth/test_oauth_authenticator.py
+test/auth/test_personal_access_authenticator.py
+test/auth/test_web_token_authenticator.py
+test/fixtures/
+test/test_zitadel.py
+
+# --- repo identity + docs (team-owned, not generated) ---
+LICENSE
+README.md
+SECURITY.md
+VERSIONING.md
+
+# --- house tooling (team-owned, not generated) ---
+.commitlintrc.json
+.dockerignore
+.editorconfig
+.github/
+.gitignore
+.pre-commit-config.yaml
+.releaserc.json
+devbox.json
+devbox.lock
+Dockerfile
+lefthook.yml
+qodana.yaml
+
+# --- build / package config (team-owned: repo identity + bespoke deps) ---
+pyproject.toml
+uv.lock
+
+# --- generation tooling we added ---
+.openapi-generator-ignore
+Makefile
+proc.yml
+
+# --- generator bookkeeping (FILES manifest + VERSION; rewritten by the
+#     generator but keep-listed so prune does not orphan them — the FILES
+#     manifest does not list itself, so it would otherwise be deleted) ---
+# Only the two bookkeeping files, named individually: excluding the whole
+# directory also excluded DEV-DEPENDENCIES, which the generator must write
+# so this repo's package manifest can stay in step with what its tests import.
+.openapi-generator/FILES
+.openapi-generator/VERSION

.openapi-generator/DEV-DEPENDENCIES

@@ -0,0 +1,13 @@
+# Every dev dependency an emitted test imports, one per line as
+# `<name> <version-range>  # <which test needs it>`. This file is
+# generator-owned and rewritten on every generation. It is the contract between
+# the generator and a client that keep-lists its own pyproject.toml: a
+# dependency added to a generated test but missing from the client's manifest
+# kills the whole suite at collection, so the test bootstrap (conftest.py)
+# probes this set up front and names this file when one is missing.
+pytest >=7.0.0  # every module under test/
+pytest-asyncio >=0.21.0  # asyncio_mode = "auto"; the async transport tests
+pytest-cov >=4.0.0  # the --cov flags in [tool.pytest.ini_options] addopts
+testcontainers >=4.0.0  # conftest.py starts the mock server and the proxy
+docker >=7.0.0  # conftest.py joins both containers to a Docker network
+opentelemetry-sdk >=1.20.0  # test/test_trace_context_util.py