@o3co/create-auth-provider 0.12.0 → 0.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-provider",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Scaffold a new o3co/auth.provider project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,8 +28,8 @@
     "node": ">=22.0.0"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
-    "vitest": "^4.1.11"
+    "@types/node": "^26.5.0",
+    "vitest": "^5.0.0"
   },
   "scripts": {
     "build": "tsc",

package/templates/standalone/.dockerignore

@@ -1,9 +1,10 @@
 node_modules
 dist
 .git
-.gitignore
 .env*
 !.env.example
-*.md
-docker-compose*.yml
 Makefile
+# .gitignore, the READMEs and the compose files stay in the context: the
+# `test` image copies them because the shipped suite reads them (#512). The
+# runtime image never copies them, so they cost the context a few kilobytes
+# and the image nothing.

package/templates/standalone/Dockerfile

@@ -1,9 +1,9 @@
-# The base image is pinned by digest, not just by tag: `node:24-alpine` is a
+# The base image is pinned by digest, not just by tag: `node:26-alpine` is a
 # moving pointer, so the same source produced a different image on every
 # rebuild (#289). The digest is the multi-arch index, so amd64 and arm64 both
 # resolve from it. Dependabot's `docker` ecosystem keeps the pair in step —
 # bump the tag and the digest together, never the tag alone.
-FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS node-base
+FROM node:26-alpine@sha256:ef24c5053d50fdc3e4e56eb4e7ddb7861874ab0fdc797046ba897581deb8e868 AS node-base
 
 ENV HOME=/home/node
 
@@ -105,6 +105,13 @@ FROM builder AS test
 
 COPY --chown=node:node vitest.config.mts ./
 COPY --chown=node:node tests/ ./tests/
+# #512: the suite reads these from the project root (scaffold-assets,
+# documented-env-overrides, smoke). The builder stage brings only what the
+# build needs, so inside this image they did not exist and `make test` failed
+# on files that were never a test's business. `.dockerignore` lets them into
+# the context for the same reason; nothing copies them into `runtime`.
+COPY --chown=node:node Dockerfile .dockerignore .env.example .gitignore README.md README.ja.md \
+  docker-compose.yml docker-compose.production.yml ./
 
 CMD ["pnpm", "run", "test", "--", "--passWithNoTests"]
 

package/templates/standalone/README.md

@@ -25,6 +25,12 @@ my-app:
   allowedRedirectUris: ["https://app.example/callback"]
 ```
 
+A machine client can authenticate with a key instead of a shared secret (#484):
+`tokenEndpointAuthMethod: "private_key_jwt"` plus `jwks` (inline public keys) or
+`jwksUri`, and it presents a signed assertion at `/oauth/token` — see the
+[oauth package README](../../packages/oauth/README.md#client-authentication-private_key_jwt-rfc-7523-22).
+Nothing secret lives in `clients.yaml` for such a client.
+
 **What this does not do.** It does not make `/authorize` safe against forced navigation for a client that *is* first-party — that remains the accepted model here. What it prevents is a client that should never have been trusted with a silent code being registered into that position by accident. The step that changes the former is a consent screen, tracked separately.
 
 **Migrating.** Registrations that predate the field are refused at `/authorize` until you mark them — a client with no `firstParty` field and one carrying an explicit `false` are treated alike. Mark every client you operate before pointing it at `/authorize`; there is no admit-with-warning window. The one-time `oauth.authorize.allowUnmarkedClients` migration flag was removed before it ever shipped in a release, and a config or environment still setting it (`OAUTH_AUTHORIZE_ALLOW_UNMARKED_CLIENTS`, any value) fails at boot with migration instructions rather than being silently ignored.
@@ -106,6 +112,7 @@ Other multi-replica considerations covered by the default modules:
 - The `express-session` store (`sessionStoreModule`) is its own connection: `SESSION_STORAGE_TYPE=redis` with `SESSION_STORAGE_REDIS_URL` (`session.storage.redis.url`) pointing at the shared instance.
 - The user-session stores switch on `userSessionStores.adapter = "redis"` (`USER_SESSION_STORES_ADAPTER`), which wires `redisSessionStoresModule` off the shared ioredis connection — the one `REFRESH_TOKEN_FAMILY_STORE_REDIS_URL` configures.
 - The authorization-code repository switches on `oauth.code.adapter` (`OAUTH_CODE_ADAPTER`); the template ships `"redis"`, on that same connection. The older `repositories.code.type = "redis"` (`CLIENT_CODE_TYPE`) switch is still honoured with a deprecation warning at boot. `CLIENT_CODE_ENDPOINT_URI` (`repositories.code.redis.endpointUri`) is still bound by `config/application.conf` but nothing reads it: the Redis code repository has run on the shared connection since the `{ endpointUri }` builder shape was retired, so there is one Redis URL for every adapter and that variable is legacy.
+- The replay seen-set — the `jti` single-use record behind `private_key_jwt` client authentication (#484) — switches on `replaySeenSet.adapter` (`REPLAY_SEEN_SET_ADAPTER`); the template ships `"redis"` on the shared connection, and `memory` is refused under `DEPLOYMENT_MODE=multi` because a captured client assertion would replay once per replica.
 - The federation token store defaults to memory. Set `FEDERATION_TOKEN_STORE_TYPE=redis` (`federationTokenStore.type = "redis"`) and supply `REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY` — 32 bytes, base64-encoded (`openssl rand -base64 32`); the store encrypts the upstream refresh tokens it holds. It shares the ioredis socket configured by `REFRESH_TOKEN_FAMILY_STORE_REDIS_URL`. See [Federation Token Store](#federation-token-store).
 
 ## Usage
@@ -161,6 +168,18 @@ fail fast rather than silently falling back to defaults.
 | `OAUTH_JWT_SECRET` | — | Signing secret, **HMAC (`HS256`) only**. At least 32 bytes (256 bits) of random material — `openssl rand -hex 32`. Hex/base64 values are measured **decoded**, so a 32-character hex string counts as 16 bytes and is refused. |
 | `OAUTH_JWT_ISSUER` | **(required)** | Canonical issuer URL stamped as `iss` on every token. Must be absolute `https` (`http` only for a loopback host), with no query or fragment. Boot fails when unset — it is never derived from the `Host` header. |
 | `OAUTH_REQUIRE_EMAIL_VERIFIED` | `false` | Refuse to issue tokens for a user until the Store publishes `emailVerified: true`. Enforced at `/authorize` and on the `session` grant. Verification itself is the Store's job — this only reads the result. |
+| `OAUTH_CIMD_ENABLED` | `false` | Accept Client ID Metadata Documents (#529): a client whose `client_id` is the `https` URL of its own registration, the model MCP hosts use. Such a client is public, never first-party — it goes through the consent step, so wire `CONSENT_STORE_ADAPTER`. |
+| `OAUTH_CIMD_ALLOWED_SCOPES` | — | Comma-separated: what any such client may obtain (its document's `scope` is intersected with this). Empty admits none. |
+| `OAUTH_CIMD_ALLOWED_AUDIENCES` | — | Comma-separated: the resource servers it may mint for (RFC 8707 `resource`). Empty admits only its own `client_id`. |
+| `OAUTH_CIMD_ALLOWED_HOSTS` | — | Comma-separated hosts a document may live on: exact, or `.suffix` for a domain and its subdomains. Empty admits any public host. |
+| `OAUTH_CIMD_DENIED_HOSTS` | — | Comma-separated hosts refused even when allowed above. |
+| `OAUTH_CIMD_MAX_BYTES` | `5120` | Byte cap on a document (the draft recommends 5 KB). |
+| `OAUTH_CIMD_TIMEOUT_MS` | `5000` | Fetch timeout. |
+| `OAUTH_CIMD_CACHE_MAX_AGE_MS` | `600000` | Upper bound on how long a valid document is served from cache; `Cache-Control: max-age` may shorten it. |
+| `OAUTH_CIMD_MAX_CACHE_ENTRIES` | `256` | How many documents are remembered at once. The keys are chosen by an unauthenticated caller, so the map is bounded. |
+| `OAUTH_CIMD_STALE_IF_ERROR_MS` | `300000` | How long a registration already validated is still served after a revalidation that failed for a reason that is not the document's (a DNS blip, a 5xx, a timeout) — an outage should not break a working client. A document that was *rejected* is dropped immediately. `0` disables it. |
+| `OAUTH_CIMD_NEGATIVE_CACHE_MS` | `60000` | How long a refusal is remembered, so the same `client_id` is not resolved and fetched again on every request. Short, so a client that fixes its document is not locked out. |
+| `OAUTH_CIMD_MAX_CONCURRENT_FETCHES` | `8` | How many documents may be in flight at once, across every `client_id`. Bounds what an unauthenticated caller can make this server dial. |
 | `OAUTH_JWT_KID` | `v0` | Key ID included in the JWT header |
 | `OAUTH_JWT_PRIVATE_KEY` | — | PEM-encoded private key (asymmetric algorithms) |
 | `OAUTH_JWT_PRIVATE_KEY_PATH` | — | Path to PEM private key file |
@@ -311,6 +330,46 @@ all — no headers, no `Vary`, nothing changed.
 | `FEDERATIONS_GOOGLE_CLIENT_SECRET` | — | Google OAuth client secret |
 | `FEDERATIONS_GOOGLE_CALLBACK_URL` | `http://localhost:3000/session/oauth/federation/google/callback` | Google OAuth callback URL |
 
+### OIDC Federation (any OpenID Connect provider)
+
+One instance ships in `config/application.conf` under `federations.oidc`
+(`@o3co/auth-provider-federation-oidc`, #524): Okta, Entra ID, Auth0, Keycloak
+or your own tenant, selected by issuer. Discovery runs at boot and a failure
+refuses boot. The identity handed to the Store is `oidc:<sub>`; an identity
+the Store does not know is refused with 401 — nothing is provisioned.
+
+| Variable | Default | Description |
+|---|---|---|
+| `FEDERATIONS_OIDC_ENABLED` | `false` | Enable the OIDC federation |
+| `FEDERATIONS_OIDC_ISSUER` | — | Issuer identifier (https), exactly as the IdP writes `iss` |
+| `FEDERATIONS_OIDC_CLIENT_ID` | — | Client ID registered at the IdP |
+| `FEDERATIONS_OIDC_CLIENT_SECRET` | — | Client secret (`client_secret_basic`); set `privateKey` in the config file for `private_key_jwt` instead |
+| `FEDERATIONS_OIDC_CALLBACK_URL` | `http://localhost:3000/session/oauth/federation/oidc/callback` | Where the IdP sends the browser back |
+
+A second IdP is another section with `type = "oidc"` and its own callback:
+
+```hocon
+federations {
+  okta {
+    enabled = true
+    type = "oidc"
+    issuer = "https://dev-123.okta.com"
+    clientId = ${OKTA_CLIENT_ID}
+    clientSecret = ${OKTA_CLIENT_SECRET}
+    callbackURL = "https://auth.example.com/session/oauth/federation/okta/callback"
+    redirectAllowlist = ["https://app.example.com/welcome"]
+  }
+}
+```
+
+The section's `type` names the implementation. `federations.google` without a
+`type` is the built-in Google federation; with `type = "oidc"` it is a generic
+OIDC instance named `google`, and the built-in module is not composed.
+
+Every field the package accepts — `scopes`, `discovery` / `endpoints`,
+`privateKey`, `userInfo`, `idTokenSignedResponseAlg`, `clockToleranceSeconds` —
+is documented in [its README](../../packages/federation-oidc/README.md).
+
 ### Client Repository
 
 | Variable | Default | Description |
@@ -325,6 +384,7 @@ all — no headers, no `Vary`, nothing changed.
 | `CLIENT_USER_TYPE` | `http` | User repository backend: `http` |
 | `CLIENT_USER_AUTHENTICATE_URL` | — | URL for password-based user authentication. **https required** (see below) |
 | `CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL` | — | URL for token-based user authentication. **https required** (see below) |
+| `CLIENT_USER_LINK_FEDERATED_IDENTITY_URL` | — | Optional. URL the Store links a federated identity at (#482); enables `?link=1` on the federation start route. **https required** |
 | `CLIENT_USER_TIMEOUT` | `5000` | HTTP request timeout in milliseconds. Positive integer ≤ `2147483647` |
 | `CLIENT_USER_MAX_RESPONSE_BYTES` | `1048576` | Largest upstream response body accepted, in bytes |
 
@@ -357,6 +417,7 @@ needs a key.
 | Variable | Default | Description |
 |---|---|---|
 | `FEDERATION_TOKEN_STORE_TYPE` | `memory` | Federation token store backend: `memory` or `redis` |
+| `CONSENT_STORE_ADAPTER` | `none` | Consent store for clients that are not first-party (#527): `none` (such clients are refused) or `memory` (single replica) |
 | `REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY` | — | AES-256-GCM key for records at rest: 32 bytes, base64-encoded (`openssl rand -base64 32`). **Required** with `redis` unless the mode below is `allow-plaintext` |
 | `REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE` | `required` | `required` or `allow-plaintext`. Plaintext is refused when the config was selected by a production/staging environment (`CONFIG_ENV` or `NODE_ENV`) and under `DEPLOYMENT_MODE=multi` in any environment, unless `FEDERATION_TOKENS_ALLOW_INSECURE=1` is also set — development only |
 
@@ -384,6 +445,7 @@ Use values that include the deployment name, for example `tenant-a:ss:`,
 | Variable | Default | Description |
 |---|---|---|
 | `ENDPOINTS_LOGIN_URL` | `/login` | URL of the login page (for redirects) |
+| `ENDPOINTS_CONSENT_URL` | `/consent` | URL of the consent page a client that is not first-party is routed through, with `?challenge=<id>` (#527) |
 
 `ENDPOINTS_CLIENT_URL` and `ENDPOINTS_AUTH_CALLBACK_URL` were removed (IH-10) —
 no production consumer read them, and the config lines leaked values into

package/templates/standalone/config/application.conf

@@ -94,6 +94,18 @@ oauth {
   # restart and across replicas — multi-replica production MUST use "redis".
   # Supersedes the legacy `repositories.code.type` switch (kept below as
   # deprecated for backward compat — see CHANGELOG for the removal version).
+  # #481: the Authentication Context Class References this deployment can
+  # vouch for, each mapped to the RFC 8176 `amr` values a session must carry
+  # (`pwd` for a password login, `hwk` for a passkey, `fed` for a federated
+  # login, `mfa` when a resumed MFA login records it). `/authorize` answers
+  # `acr_values` from this table alone — anything else is
+  # `unmet_authentication_requirements` — and discovery advertises the keys.
+  #
+  #   authorize.acrValues {
+  #     "urn:example:pwd" = ["pwd"]
+  #     "urn:example:mfa" = ["pwd", "mfa"]
+  #   }
+  #
   # #267: /authorize refuses any client not marked `firstParty: true` in
   # clients.yaml — the template's example clients are marked. There is no
   # opt-out: the one-time `allowUnmarkedClients` migration flag was removed
@@ -134,6 +146,28 @@ accessTokenDenylist {
   adapter = ${?ACCESS_TOKEN_DENYLIST_ADAPTER}
 }
 
+# #484: backend for the replay seen-set — the `jti` single-use record behind
+# `private_key_jwt` client authentication (a client registered with `jwks` or
+# `jwksUri` in config/clients.yaml). Same reasoning as the denylist above:
+# "memory" forks per replica, so a captured client assertion would replay
+# once per replica, and `deployment.mode = "multi"` refuses it by name. It
+# shares the ioredis socket, so it costs no extra connection.
+#
+# Single-instance local development can set REPLAY_SEEN_SET_ADAPTER=memory.
+replaySeenSet {
+  adapter = "redis"
+  adapter = ${?REPLAY_SEEN_SET_ADAPTER}
+}
+
+# #527: where consent to a client that is not first-party is recorded.
+# "none" (the default) wires no store and such clients are refused at
+# /authorize; "memory" is single-replica only (refused under
+# DEPLOYMENT_MODE=multi by name).
+consentStore {
+  adapter = "none"
+  adapter = ${?CONSENT_STORE_ADAPTER}
+}
+
 session {
   secret = ${?SESSION_SECRET}
   # MIN-2: __Host- prefix requires Secure, Path=/, and no Domain attribute.
@@ -233,6 +267,42 @@ federations {
     # Where the browser goes after a callback carrying no `redirect_to`.
     # clientUrl = ${?FEDERATIONS_GOOGLE_CLIENT_URL}
   }
+
+  # Any OpenID Connect provider (Okta, Entra ID, Auth0, Keycloak, your own
+  # tenant) — `@o3co/auth-provider-federation-oidc` (#524). Disabled by
+  # default; the env vars below switch this one instance on. The section
+  # name is the federation name: the browser starts at
+  # /session/oauth/federation/oidc and the identity handed to the Store is
+  # "oidc:<sub>". An identity the Store does not know is refused (401);
+  # nothing is provisioned. To broker to a second IdP, copy this block under
+  # another name (`okta { type = "oidc" ... }`) with its own callbackURL.
+  oidc {
+    enabled = false
+    enabled = ${?FEDERATIONS_OIDC_ENABLED}
+    type = "oidc"
+
+    # Issuer identifier, exactly as the IdP writes it into `iss`. Discovery
+    # runs at boot from <issuer>/.well-known/openid-configuration and a
+    # failure refuses boot. https only (plain http on localhost for dev).
+    issuer = ${?FEDERATIONS_OIDC_ISSUER}
+    clientId = ${?FEDERATIONS_OIDC_CLIENT_ID}
+    # client_secret_basic. For private_key_jwt drop clientSecret and set
+    # privateKey (a PEM PKCS#8 key, or { pem, kid, alg }) instead.
+    clientSecret = ${?FEDERATIONS_OIDC_CLIENT_SECRET}
+    callbackURL = "http://localhost:3000/session/oauth/federation/oidc/callback"
+    callbackURL = ${?FEDERATIONS_OIDC_CALLBACK_URL}
+    scopes = ["openid", "profile", "email"]
+
+    # Same rules as the Google block above: exact URLs, https except on a
+    # loopback host, and an empty list refuses every `redirect_to`.
+    redirectAllowlist = []
+    # sessionDomain, authCallbackUrl and clientUrl work as for Google.
+    #
+    # Hand-typed endpoints instead of discovery (the IdP's document is wrong
+    # or unreachable from this network):
+    #   discovery = false
+    #   endpoints { authorizationEndpoint = "...", tokenEndpoint = "...", jwksUri = "..." }
+  }
 }
 
 repositories {
@@ -257,6 +327,14 @@ repositories {
       # service name still needs https. Boot fails if either is not.
       authenticateUrl = ${?CLIENT_USER_AUTHENTICATE_URL}
       authenticateByTokenUrl = ${?CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL}
+      # #482: optional. When set, a signed-in user can link a second federated
+      # identity (GET /session/oauth/federation/<name>?link=1): the Store
+      # receives { userId, provider, sub, token, claims } and decides — never on
+      # an unverified or relay e-mail. Same https rule as the two URLs above.
+      # Also declared in core's reference.conf, so a composition that does not
+      # layer this file gets the same override.
+      # Without it, link=1 is refused with link_unsupported.
+      linkFederatedIdentityUrl = ${?CLIENT_USER_LINK_FEDERATED_IDENTITY_URL}
       # Positive integer, milliseconds, <= 2147483647. Boot fails otherwise —
       # including on a blank env override, which HOCON substitutes as "".
       timeout = 5000
@@ -287,6 +365,13 @@ endpoints {
     url = "/login"
     url = ${?ENDPOINTS_LOGIN_URL}
   }
+  # #527: the consent page a client that is not first-party is routed
+  # through (`?challenge=<id>`). Deployment-owned, like the login page: it
+  # reads GET /oauth/consent and posts to POST /oauth/consent.
+  consent {
+    url = "/consent"
+    url = ${?ENDPOINTS_CONSENT_URL}
+  }
   # IH-10: `client { url }` and `authCallback { url }` removed — no
   # production consumer reads them.
 }

package/templates/standalone/config/clients.yaml.example

@@ -4,6 +4,9 @@
 # `tokenEndpointAuthMethod` is REQUIRED (RFC 6749 §2.3 / RFC 7591 §2):
 #   - "client_secret_basic": HTTP Basic Authorization header — recommended for confidential clients
 #   - "client_secret_post":  form-encoded body parameters
+#   - "private_key_jwt":     the client signs a JWT with its own private key
+#                            (RFC 7523 §2.2, #484) — register its public keys as
+#                            `jwks` (inline) or `jwksUri`, exactly one; no clientSecret
 #   - "none":                public client — no clientSecret; PKCE/S256 mandatory at /authorize
 #
 # Secret format (only for confidential clients — basic / post):
@@ -44,6 +47,25 @@
 #   can read the authorization request. Set it only for a legacy client that
 #   genuinely cannot compute SHA-256, and treat it as a migration deadline.
 
+# A machine client that authenticates with a key pair (#484). Nothing here is
+# secret: the private half stays with the client, which signs an assertion
+# (iss = sub = client id, aud = the issuer or the token endpoint, exp within
+# an hour, a fresh jti) per token request. Rotating the key is a JWKS
+# publish when `jwksUri` is used. Needs the replay seen-set wired
+# (REPLAY_SEEN_SET_ADAPTER, on by default).
+#
+# orders-service:
+#   tokenEndpointAuthMethod: "private_key_jwt"
+#   jwksUri: "https://orders.example.com/.well-known/jwks.json"
+#   # or inline:
+#   # jwks:
+#   #   keys:
+#   #     - { kty: "EC", crv: "P-256", kid: "2026-09", x: "...", y: "..." }
+#   allowedGrantTypes: ["client_credentials"]
+#   allowedScopes: ["orders:read"]
+#   defaultScopes: ["orders:read"]
+#   allowedAudiences: ["https://api.example.com/orders"]
+
 my-app:
   tokenEndpointAuthMethod: "client_secret_basic"
   firstParty: true

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-provider-standalone",
-	"version": "0.12.0",
+	"version": "0.13.0",
 	"private": true,
 	"license": "Apache-2.0",
 	"engines": {
@@ -23,6 +23,7 @@
 	"dependencies": {
 		"@o3co/auth-provider-core": "workspace:*",
 		"@o3co/auth-provider-federation-google": "workspace:*",
+		"@o3co/auth-provider-federation-oidc": "workspace:*",
 		"@o3co/auth-provider-foundation": "workspace:*",
 		"@o3co/auth-provider-oauth": "workspace:*",
 		"@o3co/auth-provider-redis": "workspace:*",
@@ -40,11 +41,11 @@
 	"devDependencies": {
 		"@types/express": "^5.0.6",
 		"@types/express-session": "^1",
-		"@types/node": "^26.2.0",
+		"@types/node": "^26.5.0",
 		"@types/supertest": "^7.2.1",
 		"supertest": "^7.1.0",
-		"tsx": "^4.23.10",
+		"tsx": "^4.23.13",
 		"typescript": "^6.0.3",
-		"vitest": "^4.1.11"
+		"vitest": "^5.0.0"
 	}
 }

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -14,7 +14,8 @@
  * limitations under the License.
  */
 
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { type AppConfig, AppConfigSchema } from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
@@ -95,6 +96,18 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	OAUTH_NONCE_MAX_LENGTH: "256",
 	OAUTH_TOKEN_EXCHANGE_MAX_ACTOR_CHAIN_DEPTH: "3",
 	OAUTH_RESOURCE_INDICATOR_ENABLED: "true",
+	OAUTH_CIMD_ENABLED: "true",
+	OAUTH_CIMD_ALLOWED_SCOPES: "read, write",
+	OAUTH_CIMD_ALLOWED_AUDIENCES: "https://mcp.example",
+	OAUTH_CIMD_ALLOWED_HOSTS: "client.example, .trusted.example",
+	OAUTH_CIMD_DENIED_HOSTS: "evil.example",
+	OAUTH_CIMD_MAX_BYTES: "8192",
+	OAUTH_CIMD_TIMEOUT_MS: "3000",
+	OAUTH_CIMD_CACHE_MAX_AGE_MS: "60000",
+	OAUTH_CIMD_MAX_CACHE_ENTRIES: "128",
+	OAUTH_CIMD_STALE_IF_ERROR_MS: "120000",
+	OAUTH_CIMD_NEGATIVE_CACHE_MS: "30000",
+	OAUTH_CIMD_MAX_CONCURRENT_FETCHES: "4",
 	OAUTH_TOKEN_BINDING_DISPATCH_POLICY: "intent-explicit",
 	OAUTH_TOKEN_BINDING_BIND_CONFIDENTIAL_CLIENT_REFRESH_TOKENS: "true",
 
@@ -136,6 +149,9 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	DEPLOYMENT_MODE: "multi",
 	USER_SESSION_STORES_ADAPTER: "redis",
 	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
+	// #484: the replay seen-set behind private_key_jwt client authentication.
+	REPLAY_SEEN_SET_ADAPTER: "redis",
+	CONSENT_STORE_ADAPTER: "none",
 	REDIS_ACCESS_TOKEN_DENYLIST_KEY_PREFIX: "atdeny:",
 	REDIS_SESSION_STORES_KEY_PREFIX: "ss:",
 	REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX: "rtfam:",
@@ -154,6 +170,12 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	FEDERATIONS_GOOGLE_CLIENT_ID: "google-client-id",
 	FEDERATIONS_GOOGLE_CLIENT_SECRET: "google-client-secret",
 	FEDERATIONS_GOOGLE_CALLBACK_URL: "https://auth.test/session/oauth/federation/google/callback",
+	// #524: the generic OIDC federation the template ships disabled.
+	FEDERATIONS_OIDC_ENABLED: "true",
+	FEDERATIONS_OIDC_ISSUER: "https://idp.test",
+	FEDERATIONS_OIDC_CLIENT_ID: "oidc-client-id",
+	FEDERATIONS_OIDC_CLIENT_SECRET: "oidc-client-secret",
+	FEDERATIONS_OIDC_CALLBACK_URL: "https://auth.test/session/oauth/federation/oidc/callback",
 
 	// --- repositories -------------------------------------------------
 	CLIENT_TYPE: "yaml",
@@ -162,6 +184,7 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	CLIENT_USER_PATH: "./config/users.yaml",
 	CLIENT_USER_AUTHENTICATE_URL: "https://users.example.com/authenticate",
 	CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL: "https://users.example.com/authenticate-by-token",
+	CLIENT_USER_LINK_FEDERATED_IDENTITY_URL: "https://users.example.com/link-federated-identity",
 	CLIENT_USER_TIMEOUT: "5000",
 	CLIENT_USER_MAX_RESPONSE_BYTES: "1048576",
 	CLIENT_CODE_TYPE: "redis",
@@ -172,6 +195,7 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 
 	// --- endpoints ----------------------------------------------------
 	ENDPOINTS_LOGIN_URL: "/login",
+	ENDPOINTS_CONSENT_URL: "/consent",
 
 	// --- cors ---------------------------------------------------------
 	// #500: a list, in the only shape an environment variable can carry one.
@@ -288,6 +312,7 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.oauth.requireEmailVerified).toBe(true);
 		expect(config.oauth.resourceIndicator?.enabled).toBe(true);
 		expect(config.federations.google?.enabled).toBe(true);
+		expect(config.federations.oidc?.enabled).toBe(true);
 	});
 
 	it("turns every non-boolean override into its declared type", () => {
@@ -300,6 +325,21 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.session.maxAge).toBe(3600000);
 		expect(config.session.csrf?.ttlSeconds).toBe(7200);
 		expect(config.oauth.nonce?.maxLength).toBe(256);
+		// #529: the comma-separated lists become lists, trimmed; the numbers, numbers.
+		expect(config.oauth.clientIdMetadataDocuments).toEqual({
+			enabled: true,
+			allowedScopes: ["read", "write"],
+			allowedAudiences: ["https://mcp.example"],
+			allowedHosts: ["client.example", ".trusted.example"],
+			deniedHosts: ["evil.example"],
+			maxBytes: 8192,
+			timeoutMs: 3000,
+			maxCacheEntries: 128,
+			staleIfErrorMs: 120000,
+			negativeCacheMs: 30000,
+			maxConcurrentFetches: 4,
+			cacheMaxAgeMs: 60000,
+		});
 		// #500: a comma-separated string becomes a list of origins, trimmed.
 		expect(config.cors?.allowedOrigins).toEqual([
 			"https://app.example.com",
@@ -477,10 +517,15 @@ describe("#288: the shipped config boots with every documented override supplied
 		});
 	});
 
-	it("resolves against the shipped standalone template, not a fixture", () => {
+	it("resolves against the shipped standalone artifact, not a fixture", () => {
 		// Guards the guard: if the paths above ever stop pointing at the real
-		// artifact these tests would pass while testing nothing.
-		expect(standaloneDir).toMatch(/templates[/\\]standalone[/\\]?$/);
+		// artifact these tests would pass while testing nothing. Checked by
+		// what the directory holds, not by what it is called: this file ships
+		// in every scaffolded project, and none of those lives at
+		// `templates/standalone` (#512).
+		for (const file of ["config/application.conf", "config/production.conf", "src/app.mts"]) {
+			expect(existsSync(join(standaloneDir, file)), file).toBe(true);
+		}
 		expect(liveSubstitutions().size).toBeGreaterThan(40);
 	});
 });

package/templates/standalone/src/__tests__/oidc-federation-config-module.test.mts

@@ -0,0 +1,138 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { AppConfig } from "@o3co/auth-provider-core";
+import { makeValidAppConfig } from "@o3co/auth-provider-core/testing";
+import { describe, expect, it } from "vitest";
+import { buildModules } from "../buildModules.mjs";
+import { oidcFederationConfigModule } from "../modules.mjs";
+
+/**
+ * #524: the scaffold turns every enabled `federations.<name>` of type
+ * `oidc` into one instance of the generic OIDC federation module, fed by a
+ * single config bridge. A deployment adds an IdP with configuration only.
+ */
+type Factory = (deps: { config: unknown }) => Record<string, unknown>;
+
+const bridge = (
+	oidcFederationConfigModule as unknown as {
+		provides: { oidcFederationConfigs: Factory };
+	}
+).provides.oidcFederationConfigs;
+
+const okta = {
+	issuer: "https://dev-1.okta.test",
+	clientId: "okta-client",
+	clientSecret: "okta-secret",
+	callbackURL: "https://auth.test/session/oauth/federation/okta/callback",
+};
+
+/** Core's valid fixture, with the federations under test and every adapter on memory. */
+const configWith = (federations: Record<string, unknown>): AppConfig => {
+	const base = makeValidAppConfig();
+	return {
+		...base,
+		federations,
+		oauth: { ...base.oauth, code: { adapter: "memory" } },
+	} as unknown as AppConfig;
+};
+
+describe("oidcFederationConfigModule (#524)", () => {
+	it("has the scaffold's module name and reads config", () => {
+		expect(oidcFederationConfigModule.name).toBe("standalone:oidc-federation-config");
+		expect(oidcFederationConfigModule.requires).toEqual(["config"]);
+	});
+
+	it("reads every enabled oidc section into the slot, keyed by federation name", () => {
+		const out = bridge({
+			config: {
+				federations: {
+					okta: { enabled: true, type: "oidc", ...okta },
+					keycloak: {
+						enabled: true,
+						type: "oidc",
+						clientUrl: "https://app.test/",
+						oidc: {
+							issuer: "https://kc.test/realms/dev",
+							clientId: "kc-client",
+							clientSecret: "kc-secret",
+							callbackURL: "https://auth.test/session/oauth/federation/keycloak/callback",
+						},
+					},
+					google: {
+						enabled: true,
+						clientId: "g",
+						clientSecret: "s",
+						callbackURL: "https://auth.test/g",
+					},
+					paused: { enabled: false, type: "oidc", ...okta },
+				},
+			},
+		});
+		expect(Object.keys(out).sort()).toEqual(["keycloak", "okta"]);
+		expect(out.okta).toEqual(okta);
+		expect(out.keycloak).toMatchObject({
+			issuer: "https://kc.test/realms/dev",
+			clientUrl: "https://app.test/",
+		});
+	});
+
+	it("refuses a malformed section at boot, naming the field", () => {
+		const { issuer: _dropped, ...noIssuer } = okta;
+		expect(() =>
+			bridge({ config: { federations: { okta: { enabled: true, type: "oidc", ...noIssuer } } } }),
+		).toThrow(/federations\.okta\.issuer/);
+	});
+
+	it("is an empty slot when no section is of type oidc", () => {
+		expect(bridge({ config: { federations: { google: { enabled: false } } } })).toEqual({});
+	});
+});
+
+describe("buildModules gating for OIDC federations (#524)", () => {
+	it("lists one federation:oidc:<name> per enabled section, plus the bridge once", () => {
+		const names = buildModules(
+			configWith({
+				okta: { enabled: true, type: "oidc", ...okta },
+				keycloak: { enabled: true, type: "oidc", ...okta },
+				google: { enabled: false },
+			}),
+		).map((m) => m.name);
+		expect(names).toContain("federation:oidc:okta");
+		expect(names).toContain("federation:oidc:keycloak");
+		expect(names.filter((n) => n === "standalone:oidc-federation-config")).toHaveLength(1);
+		expect(names).not.toContain("federation:google");
+	});
+
+	it("a google section of type oidc is the generic provider, not the built-in Google pair", () => {
+		// The section's `type` names the implementation. Composing both would
+		// contribute the same federation and redirect-policy keys twice.
+		const names = buildModules(
+			configWith({ google: { enabled: true, type: "oidc", ...okta } }),
+		).map((m) => m.name);
+		expect(names).toContain("federation:oidc:google");
+		expect(names).not.toContain("federation:google");
+		expect(names).not.toContain("standalone:google-federation-config");
+	});
+
+	it("lists nothing OIDC when no section is enabled (the shipped default)", () => {
+		const names = buildModules(
+			configWith({ google: { enabled: false }, oidc: { enabled: false, type: "oidc" } }),
+		).map((m) => m.name);
+		expect(names.some((n) => n.startsWith("federation:oidc:"))).toBe(false);
+		expect(names).not.toContain("standalone:oidc-federation-config");
+	});
+});

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -159,6 +159,7 @@ const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
 	RATE_LIMITER_ADAPTER: "redis",
 	OAUTH_CODE_ADAPTER: "redis",
 	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
+	REPLAY_SEEN_SET_ADAPTER: "redis",
 	FEDERATION_TOKEN_STORE_TYPE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
 };
@@ -240,10 +241,14 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 		// #474: express-session's own store. Not a module of this template but
 		// built here from its config, which is what lets the manifest declare.
 		["SESSION_STORAGE_TYPE", "sessionStoreModule"],
+		// #527: the consent store, wired only when the switch says so.
+		["CONSENT_STORE_ADAPTER", "core-consent-store-memory"],
 		// Core's, selected by the same kind of switch. The guard knew these by
 		// name; pinned so the name table's departure (#455) did not lose them.
 		["RATE_LIMITER_ADAPTER", "core-rate-limiter-memory"],
 		["ACCESS_TOKEN_DENYLIST_ADAPTER", "core-access-token-denylist-memory"],
+		// #484: the jti single-use record behind private_key_jwt client auth.
+		["REPLAY_SEEN_SET_ADAPTER", "core-replay-seen-set-memory"],
 	];
 
 	for (const [variable, module] of cases) {
@@ -266,6 +271,8 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 			SESSION_STORAGE_TYPE: "memory",
 			RATE_LIMITER_ADAPTER: "memory",
 			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+			REPLAY_SEEN_SET_ADAPTER: "memory",
+			CONSENT_STORE_ADAPTER: "memory",
 		});
 		await expect(boot(config)).rejects.toMatchObject({
 			reason: "replica-unsafe-adapter",

package/templates/standalone/src/__tests__/scaffold-assets.test.mts

@@ -244,3 +244,148 @@ describe("#407 — the two READMEs agree on security advice", () => {
 		expect(read("/README.ja.md")).not.toMatch(/HTTP_TRUST_PROXY=true/);
 	});
 });
+
+/**
+ * Issue #512 — the suite that ships with a scaffolded project has to be green
+ * in that project, not only in this workspace.
+ *
+ * A scaffold installs `@o3co/auth-provider-*` from npm, where the packages sit
+ * under `node_modules` and vitest externalizes them: Node loads them natively
+ * and their own `import "ioredis"` / `import "redis"` never meet the
+ * `vi.mock` registry. In this workspace the same packages are symlinks to
+ * source outside `node_modules`, vitest inlines them, and the mocks apply —
+ * which is how replica-safety.test.mts stayed green here while dialling
+ * `redis.test` for real in every scaffold. The second half is `make test`:
+ * it runs this suite inside the `test` image, where a file the Dockerfile
+ * never copied simply does not exist.
+ */
+describe("#512 — the shipped suite is green outside this repository", () => {
+	it("runs the published packages through vitest, so module mocks reach them", async () => {
+		// The config is loaded, not grepped: what matters is the value vitest
+		// resolves, and a `server.deps.inline` naming the wrong package would
+		// satisfy a substring check just as well.
+		const configPath = fileURLToPath(new URL("../../vitest.config.mts", import.meta.url));
+		const { default: config } = (await import(configPath)) as {
+			default: {
+				test?: { server?: { deps?: { inline?: ReadonlyArray<string | RegExp> | true } } };
+			};
+		};
+		const inline = config.test?.server?.deps?.inline;
+		expect(inline).toBeDefined();
+		if (inline === true) return;
+		for (const name of [
+			"@o3co/auth-provider-core",
+			"@o3co/auth-provider-redis",
+			"@o3co/auth-provider-session",
+		]) {
+			expect(
+				(inline ?? []).some((m) => (m instanceof RegExp ? m.test(name) : m === name)),
+				`${name} is not inlined`,
+			).toBe(true);
+		}
+	});
+
+	/**
+	 * Every file this suite reads from the project root. `config/` and `src/`
+	 * reach the image through the builder stage; these do not, so the `test`
+	 * stage has to bring them — and `.dockerignore` has to let them into the
+	 * build context first.
+	 */
+	const READ_FROM_THE_PROJECT_ROOT = [
+		"Dockerfile",
+		".dockerignore",
+		".env.example",
+		".gitignore",
+		"README.md",
+		"README.ja.md",
+		"docker-compose.yml",
+		"docker-compose.production.yml",
+	] as const;
+
+	it("reads only files the template actually ships", () => {
+		for (const file of READ_FROM_THE_PROJECT_ROOT) {
+			expect(existsSync(`${standaloneDir}${file}`), file).toBe(true);
+		}
+	});
+
+	it("copies each of them into the image the `test` target runs", () => {
+		const copied = copiedIntoStage(read("/Dockerfile"), "test");
+		for (const file of READ_FROM_THE_PROJECT_ROOT) {
+			expect(copied.has(file), `${file} is not copied into the test image`).toBe(true);
+		}
+	});
+
+	it("lets each of them through .dockerignore", () => {
+		const dockerignore = read("/.dockerignore");
+		for (const file of READ_FROM_THE_PROJECT_ROOT) {
+			expect(
+				dockerignoreExcludes(dockerignore, file),
+				`${file} is excluded from the build context`,
+			).toBe(false);
+		}
+	});
+});
+
+/**
+ * The build-context sources every `COPY` in `stage` and its ancestors brings
+ * into the image. `COPY --from=` is skipped — it reads another stage, not
+ * the context — and `--chown` / other flags are dropped. Sources are
+ * normalised to the bare entry name (`./config/` → `config`).
+ */
+function copiedIntoStage(dockerfile: string, stage: string): Set<string> {
+	const stages = new Map<string, { parent: string; sources: string[] }>();
+	let current: { parent: string; sources: string[] } | undefined;
+	// Continuation lines are joined first, so a multi-line instruction reads
+	// as one.
+	for (const line of dockerfile.replace(/\\\n/g, " ").split("\n")) {
+		const text = line.trim();
+		if (text === "" || text.startsWith("#")) continue;
+		const from = /^FROM\s+(\S+)(?:\s+AS\s+(\S+))?/i.exec(text);
+		if (from) {
+			const parent = from[1] as string;
+			current = { parent, sources: [] };
+			stages.set(from[2] ?? parent, current);
+			continue;
+		}
+		if (!current || !/^COPY\b/i.test(text)) continue;
+		const args = text.split(/\s+/).slice(1);
+		if (args.some((a) => a.startsWith("--from="))) continue;
+		const operands = args.filter((a) => !a.startsWith("--"));
+		for (const source of operands.slice(0, -1)) {
+			current.sources.push(source.replace(/^\.\//, "").replace(/\/$/, ""));
+		}
+	}
+	const copied = new Set<string>();
+	for (let name: string | undefined = stage; name !== undefined; ) {
+		const s = stages.get(name);
+		if (!s) break;
+		for (const source of s.sources) copied.add(source);
+		name = s.parent;
+	}
+	return copied;
+}
+
+/**
+ * Whether `.dockerignore` keeps a root-level entry out of the build context.
+ * The last matching pattern wins and a leading `!` re-includes; `*` and `?`
+ * stop at a `/` while `**` does not — the subset of Docker's matching that
+ * root-level file names exercise.
+ */
+function dockerignoreExcludes(dockerignore: string, file: string): boolean {
+	let excluded = false;
+	for (const raw of dockerignore.split("\n")) {
+		const line = raw.trim();
+		if (line === "" || line.startsWith("#")) continue;
+		const negated = line.startsWith("!");
+		const pattern = negated ? line.slice(1) : line;
+		// `**` is split out first so the single-`*` rewrite cannot see it.
+		const segment = (s: string): string =>
+			s
+				.replace(/[.+^${}()|[\]\\]/g, "\\$&")
+				.replace(/\*/g, "[^/]*")
+				.replace(/\?/g, "[^/]");
+		const regex = new RegExp(`^${pattern.split("**").map(segment).join(".*")}$`);
+		if (regex.test(file)) excluded = !negated;
+	}
+	return excluded;
+}

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -251,7 +251,7 @@ describe("standalone smoke test", () => {
 	it("Dockerfile pins its mutable build inputs (#289)", () => {
 		// Base image by digest — the tag alone is a moving pointer, and
 		// Dependabot's docker ecosystem bumps tag and digest together.
-		expect(dockerfile).toMatch(/FROM node:24-alpine@sha256:[0-9a-f]{64} AS node-base/);
+		expect(dockerfile).toMatch(/FROM node:26-alpine@sha256:[0-9a-f]{64} AS node-base/);
 		// Global corepack by version — `npm install -g corepack` with no pin
 		// resolved whatever was latest at build time.
 		expect(dockerfile).toMatch(/npm install -g corepack@\d+\.\d+\.\d+ --force/);

package/templates/standalone/src/buildModules.mts

@@ -20,9 +20,12 @@ import {
 	jwksModule,
 	type Module,
 	memoryAccessTokenDenylistModule,
+	memoryConsentStoreModule,
 	memoryRateLimiterModule,
+	memoryReplaySeenSetModule,
 } from "@o3co/auth-provider-core";
 import { googleFederationModule } from "@o3co/auth-provider-federation-google";
+import { oidcFederationModule, oidcFederationNames } from "@o3co/auth-provider-federation-oidc";
 import {
 	oauthAuthorizationModule,
 	oauthModule,
@@ -34,9 +37,14 @@ import {
 	redisFederationTokenStoreModuleFor,
 	redisRateLimiterModule,
 	redisRefreshTokenFamilyStoreModule,
+	redisReplaySeenSetModule,
 	redisSessionStoresModule,
 } from "@o3co/auth-provider-redis";
-import { sessionModule, sessionStoreModuleFor } from "@o3co/auth-provider-session";
+import {
+	extractFederationSection,
+	sessionModule,
+	sessionStoreModuleFor,
+} from "@o3co/auth-provider-session";
 import {
 	auditSinkModule,
 	googleFederationConfigModule,
@@ -44,6 +52,7 @@ import {
 	inMemoryFederationTokenStoreModule,
 	inMemorySessionStoresModule,
 	keyStoreModule,
+	oidcFederationConfigModule,
 	repositoriesModule,
 	standaloneRedisClientsModule,
 } from "./modules.mjs";
@@ -105,10 +114,23 @@ export interface BuildModulesOverrides {
  * absent), the config-bridge module's provider throws — so the entire pair
  * MUST be conditionally included at composition time, not gated inside the
  * provider.
+ *
+ * #524: the generic OIDC federation follows the same rule, once per enabled
+ * `federations.<name>` of type "oidc": `oidcFederationModule(name)` per
+ * instance plus the one `oidcFederationConfigModule` that reads every
+ * instance's config into the slot they share. A section's `type` decides
+ * which implementation owns the name, so the two gates never both select
+ * the same section.
  */
 export function buildModules(config: AppConfig, overrides: BuildModulesOverrides = {}): Module[] {
+	// A section's `type` names the implementation: `federations.google` is the
+	// built-in Google federation only when its type is `google` (the default
+	// for that name). With `type = "oidc"` it is a generic OIDC instance named
+	// "google" (#524), and composing both would contribute the same
+	// federation and redirect-policy keys twice.
 	const googleEnabled =
-		(config.federations?.google as { enabled?: boolean } | undefined)?.enabled === true;
+		extractFederationSection(config.federations ?? {}, "google")?.type === "google";
+	const oidcFederations = oidcFederationNames(config.federations ?? {});
 
 	// Wave 5d (IH-14 + OR-M1 + OR-4) + OR-9: adapter-driven branching for
 	// the OAuth-endpoint rate limiter, the user-session-store family, AND
@@ -128,6 +150,13 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 	// endpoint would answer 200 while the token kept working. The switch here is
 	// only over WHICH denylist.
 	const accessTokenDenylistAdapter = config.accessTokenDenylist?.adapter ?? "memory";
+	// #484: the jti single-use record behind private_key_jwt client auth.
+	const replaySeenSetAdapter = config.replaySeenSet?.adapter ?? "memory";
+	// #527: the consent store behind /authorize for clients that are not
+	// first-party. `"none"` (the default) wires nothing — such clients are
+	// refused, as before — so a first-party-only deployment pays nothing and
+	// a multi-replica one is not handed a memory store it cannot run.
+	const consentStoreAdapter = config.consentStore?.adapter ?? "none";
 	// #456: adapter switch for the federation token store. `"memory"` by
 	// default, the template's local-dev shape; `"redis"` mounts
 	// `redisFederationTokenStoreModule` off the shared socket — what the README
@@ -172,6 +201,7 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		userSessionStoresAdapter === "redis" ||
 		codeRepositoryAdapter === "redis" ||
 		accessTokenDenylistAdapter === "redis" ||
+		replaySeenSetAdapter === "redis" ||
 		federationTokenStoreAdapter === "redis";
 
 	// The four user-session stores switch on `userSessionStores.adapter`; the
@@ -207,6 +237,11 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 			? [redisAccessTokenDenylistModule]
 			: [memoryAccessTokenDenylistModule];
 
+	// #527: opt-in, memory only for now. The module declares itself
+	// replica-unsafe, so `deployment.mode = "multi"` refuses it by name.
+	const consentStoreModules: Module[] =
+		consentStoreAdapter === "memory" ? [memoryConsentStoreModule] : [];
+
 	// #455 / #456: mutually-exclusive federation-token-store pair, the same
 	// shape as the session stores. One module per adapter, so the memory one
 	// can declare `replicaSafety` on its manifest and the Redis one can
@@ -217,6 +252,9 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 	// #473: the Redis module is built for this composition root so its
 	// plaintext guard knows which environment selected the config; it reads
 	// `deployment.mode` off the config itself.
+	const replaySeenSetModules: Module[] =
+		replaySeenSetAdapter === "redis" ? [redisReplaySeenSetModule] : [memoryReplaySeenSetModule];
+
 	const federationTokenStoreModules: Module[] =
 		federationTokenStoreAdapter === "redis"
 			? [redisFederationTokenStoreModuleFor({ environment: overrides.environment })]
@@ -245,6 +283,9 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		jwksModule,
 		sessionModule,
 		...(googleEnabled ? [googleFederationModule, googleFederationConfigModule] : []),
+		...(oidcFederations.length > 0
+			? [oidcFederationConfigModule, ...oidcFederations.map((name) => oidcFederationModule(name))]
+			: []),
 		overrides.keyStoreModule ?? keyStoreModule,
 		overrides.repositoriesModule ?? repositoriesModule,
 		// #287: the audit sink, always wired. Unlike every switch above there is
@@ -272,6 +313,10 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		// RFC 7009 access-token denylist: redis (shared revocations) or memory
 		// (single-instance dev). Always wired — see the switch above.
 		...accessTokenDenylistModules,
+		...replaySeenSetModules,
+		// Consent records for clients that are not first-party: memory, or
+		// nothing (#527).
+		...consentStoreModules,
 		// RT family store: redis by default (closes OR-1); override path
 		// swaps to `[memoryRefreshTokenFamilyStoreModule]` for unit tests.
 		...refreshTokenFamilyModules,

package/templates/standalone/src/modules.mts

@@ -37,6 +37,7 @@ import {
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
 import type { GoogleProviderConfig } from "@o3co/auth-provider-federation-google";
+import { readOidcFederationConfigs } from "@o3co/auth-provider-federation-oidc";
 import { registerBuiltinAdapters } from "@o3co/auth-provider-foundation";
 import { makeIoredisClients } from "@o3co/auth-provider-redis/ioredis";
 import { extractFederationSection } from "@o3co/auth-provider-session";
@@ -436,6 +437,11 @@ export const standaloneRedisClientsModule: Module = defineModule({
 			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
 				.sessionFederationIndexClient;
 		},
+		// #484: the replay seen-set behind private_key_jwt client assertions.
+		replaySeenSetClient: async ({ config, lifecycleRegistrar, readinessRegistrar, logger }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
+				.replaySeenSetClient;
+		},
 		rateLimiterClient: async ({ config, lifecycleRegistrar, readinessRegistrar, logger }) => {
 			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
 				.rateLimiterClient;
@@ -749,3 +755,21 @@ export const googleFederationConfigModule: Module = defineModule({
 		},
 	},
 });
+
+/**
+ * OIDC federation config bridge (#524) — supplies the `oidcFederationConfigs`
+ * slot every `oidcFederationModule(<name>)` in the manifest reads its entry
+ * from. One bridge for all instances: `readOidcFederationConfigs` walks
+ * `config.federations` and reads every enabled section of type `oidc`,
+ * refusing a malformed field by `federations.<name>.<field>` at boot.
+ * `buildModules` lists this module only when at least one such section
+ * exists.
+ */
+export const oidcFederationConfigModule: Module = defineModule({
+	name: "standalone:oidc-federation-config",
+	requires: ["config"] as const,
+	provides: {
+		oidcFederationConfigs: ({ config }) =>
+			readOidcFederationConfigs((config as AppConfig).federations),
+	},
+});

package/templates/standalone/vitest.config.mts

@@ -11,5 +11,14 @@ export default defineConfig({
 		// 20s.
 		testTimeout: 20_000,
 		hookTimeout: 20_000,
+		// #512: run the @o3co/auth-provider-* packages through vitest instead of
+		// letting Node load them natively. In a scaffolded project they are
+		// installed from npm under node_modules, which vitest externalizes by
+		// default — and an externalized package's own `import "ioredis"` /
+		// `import "redis"` never sees a `vi.mock` from a test file, so
+		// replica-safety.test.mts dialled a Redis that is not there. Inside the
+		// monorepo the same packages are symlinks to source and are inlined
+		// anyway; this makes the two layouts behave the same.
+		server: { deps: { inline: [/@o3co\/auth-provider-/] } },
 	},
 });

package/templates/versions.json

@@ -1,15 +1,16 @@
 {
-	"@o3co/auth-provider-core": "0.12.0",
-	"@o3co/auth-provider-device-grant": "0.12.0",
-	"@o3co/auth-provider-dpop": "0.12.0",
-	"@o3co/auth-provider-mtls": "0.12.0",
-	"@o3co/auth-provider-federation-apple": "0.12.0",
-	"@o3co/auth-provider-federation-google": "0.12.0",
-	"@o3co/auth-provider-federation-github": "0.12.0",
-	"@o3co/auth-provider-oauth": "0.12.0",
-	"@o3co/auth-provider-oauth-token-exchange": "0.12.0",
-	"@o3co/auth-provider-session": "0.12.0",
-	"@o3co/auth-provider-foundation": "0.12.0",
-	"@o3co/auth-provider-redis": "0.12.0",
-	"@o3co/auth-provider-webauthn": "0.12.0"
+	"@o3co/auth-provider-core": "0.13.0",
+	"@o3co/auth-provider-device-grant": "0.13.0",
+	"@o3co/auth-provider-dpop": "0.13.0",
+	"@o3co/auth-provider-mtls": "0.13.0",
+	"@o3co/auth-provider-federation-apple": "0.13.0",
+	"@o3co/auth-provider-federation-google": "0.13.0",
+	"@o3co/auth-provider-federation-github": "0.13.0",
+	"@o3co/auth-provider-federation-oidc": "0.13.0",
+	"@o3co/auth-provider-oauth": "0.13.0",
+	"@o3co/auth-provider-oauth-token-exchange": "0.13.0",
+	"@o3co/auth-provider-session": "0.13.0",
+	"@o3co/auth-provider-foundation": "0.13.0",
+	"@o3co/auth-provider-redis": "0.13.0",
+	"@o3co/auth-provider-webauthn": "0.13.0"
 }