[kdubb]

Generated client factories need transport-independent settings while the application chooses its installed HTTP transport. This adds narrow runtime credential families and immutable resolved settings, including operation bindings and a prepared token manager. OAuth provider construction remains application-selected; construction does not acquire tokens. Existing transport constructors remain available, and applications retain lifecycle ownership.

The settings resolver preserves complete security alternatives, rejects incompatible credentials, resolves relative endpoint metadata, and isolates managers between configurations.

Adds JDK and OkHttp settings adapters. Validation: :sunday-core:check :sunday-jdk:check :sunday-okhttp:check passed, including provider-construction, endpoint/header, and isolation regressions.

This is the runtime prerequisite for generated server configuration factories. A runtime release must be published and verified before the generator updates its dependency pin.

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds security credential and transport configuration classes.

The PR appears safe to merge; both previous findings are fixed.

What we checked:

• Same-scheme choices remain selectable: alternativeSelection filters by candidate index and returns the whole candidate, including its scopes and endpoint metadata.
• Queries cannot swallow request paths: ClientSettings now rejects queries, fragments, and user-info before preparing the token manager.

Summary

Adds transport-independent ClientSettings, credential families, and adapters for JDK and OkHttp transports.

• Settings preserve selected security bindings and prepare a token manager without acquiring tokens.
• The latest changes let callers choose alternatives with the same scheme but different scopes.
• Direct construction now rejects URLs containing user-info, queries, or fragments.
• Both previous findings are fixed. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Application credentials and alternatives] --> B[ClientSettings.resolve]
  B --> C[Selected bindings and prepared token manager]
  C --> D[Application-selected JDK or OkHttp transport]
  D --> E[Request acquires credentials when needed]

Loading

_{Reviews (2) · Last reviewed commit: "Validate endpoints and allow selecting c..."}

[kdubb]

@greptile review

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud