@o3co/create-auth-provider 0.15.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -29,14 +29,22 @@ import {
 	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
+import { coreConfigForTests } from "@o3co/auth-provider-core/testing";
 import express from "express";
 import request from "supertest";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
+import type { Switches } from "../configPath.mjs";
+import type { Adapters } from "../sections.mjs";
+import {
+	capturedRenames,
+	inProcessAdapters,
+	shippedAdapters,
+} from "./library-references.fixture.mjs";
 
 const dockerfile = readFileSync(new URL("../../Dockerfile", import.meta.url), "utf8");
 
-// #282: the template's shipped default is EdDSA with a published JWKS, so the
+// The template's shipped default is EdDSA with a published JWKS, so the
 // smoke test signs the way a real deployment of this scaffold does. Generated
 // per run — no key material is committed.
 const smokeKeyPair = generateKeyPairSync("ed25519", {
@@ -44,22 +52,40 @@ const smokeKeyPair = generateKeyPairSync("ed25519", {
 	privateKeyEncoding: { type: "pkcs8", format: "pem" },
 });
 
-const config: AppConfig = {
-	http: { port: 0, trustProxy: false, readinessTimeoutMs: 1000 },
+/** The `http` module's section, as the hand-built configuration below carries it. */
+const HTTP = {
+	port: 0,
+	trustProxy: false,
+	readinessTimeoutMs: 1000,
+	cors: { allowedOrigins: [] as string[] },
+};
+
+/** The template modules' sections sit beside core's, so the configuration is wider than `AppConfig`. */
+const config: AppConfig & Record<string, unknown> = {
+	// What a resolution under an environment that sets none captures of
+	// core's renamed variables.
+	...{
+		"renamed-variables": capturedRenames({}),
+	},
+	http: HTTP,
 	logging: { level: "silent" },
+	"key-store": {
+		provider: "local",
+		local: {
+			algorithm: "EdDSA",
+			kid: "v0",
+			privateKey: smokeKeyPair.privateKey,
+			publicKey: smokeKeyPair.publicKey,
+			previousKeys: [],
+		},
+	},
+	// A composition with a consumer of session admission states what it
+	// expects (ADR 2026-09-28-session-admission): the shipped
+	// `application.conf` expects none, and so does this hand-built config.
+	...coreConfigForTests({ federations: { google: { enabled: false } } }),
 	oauth: {
 		jwt: {
 			issuer: "https://auth.test",
-			signingKey: {
-				provider: "local",
-				local: {
-					algorithm: "EdDSA",
-					kid: "v0",
-					privateKey: smokeKeyPair.privateKey,
-					publicKey: smokeKeyPair.publicKey,
-					previousKeys: [],
-				},
-			},
 		},
 		accessToken: { expiresIn: 3600 },
 		refreshToken: {
@@ -69,16 +95,10 @@ const config: AppConfig = {
 		},
 		grants: {},
 		oidcMode: "oidc-required",
-		// #330: no `authorize` section — the `allowUnmarkedClients` migration
-		// flag was removed; the first-party invariant is unconditional.
-		// OR-9: explicit memory adapter for the smoke test. The legacy
-		// `repositories.code.type` fallback would also pick memory here,
-		// but the explicit setting documents the intent and avoids
-		// console.warn deprecation noise in the test output.
-		code: { adapter: "memory" as const },
+		// No `authorize` section: the first-party invariant is unconditional.
 	},
-	session: {
-		// #282: `session.secret` carries a 256-bit entropy floor.
+	"session-store": {
+		// `session-store.secret` carries a 256-bit entropy floor.
 		secret: "test-session-secret.at-least-32-bytes.ok",
 		name: "auth.sid",
 		maxAge: 3600000,
@@ -87,53 +107,45 @@ const config: AppConfig = {
 		domain: null,
 		storage: { type: "memory", redis: { url: "redis://localhost:6379" } },
 	},
-	rateLimit: {
-		login: { windowMs: 60000, limit: 10 },
-		failMode: "open",
-	},
-	federations: {
-		google: { enabled: false },
-	},
-	repositories: {
-		client: { type: "yaml", path: "./config/clients.yaml" },
-		user: { type: "yaml", path: "./config/users.yaml", timeout: 5000 },
-		code: { type: "memory", defaultExpiresIn: 600 },
-	},
-	endpoints: {
-		login: { url: "/login" },
+	session: {
+		loginPage: { url: "/login" },
+		rateLimit: { login: { windowMs: 60000, limit: 10 } },
 	},
-	cors: { allowedOrigins: [] },
+	rateLimit: { failMode: "open" },
+	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
 };
 
+/** What phase one hands `buildModules`: the configuration, with `changes` over every store in process. */
+const switchesWith = (changes: Partial<Adapters> = {}): Switches =>
+	({
+		...config,
+		adapters: { ...inProcessAdapters(), ...changes },
+		mfaMode: "off",
+	}) as unknown as Switches;
+
+const switches = switchesWith();
+
 /**
- * Test-only repository module — bypasses the file-system-backed repositories
- * that `repositoriesModule` provides in production. Smoke tests use in-memory
- * empty repositories to verify the boot pipeline shape, not the data layer.
- *
- * Post-OR-9 (Wave 5d): `codeRepository` is no longer provided here — it is
- * wired by `inMemoryCodeRepositoryModule` (or `redisCodeRepositoryModule`)
- * via the `oauth.code.adapter` switch in `buildModules`. The smoke test
- * config sets `oauth.code.adapter = "memory"`, so `inMemoryCodeRepositoryModule`
- * is added automatically and provides the slot.
- *
- * D-6 (v0.5.1): a single confidential client is registered so the
- * `clientAuthMw` middleware in front of `/oauth/token` has a record to
- * authenticate against. Smoke tests that hit `/oauth/token` send
- * `Authorization: ${SMOKE_BASIC_AUTH}`.
+ * The one confidential client, so the `clientAuthMw` middleware in front of
+ * `/oauth/token` has a record to authenticate against. Smoke tests that hit
+ * `/oauth/token` send `Authorization: ${SMOKE_BASIC_AUTH}`.
  */
 const SMOKE_CLIENT_ID = "smoke-client";
 const SMOKE_CLIENT_SECRET = "smoke-secret";
 const SMOKE_BASIC_AUTH = `Basic ${Buffer.from(`${SMOKE_CLIENT_ID}:${SMOKE_CLIENT_SECRET}`).toString("base64")}`;
 
+/**
+ * Test-only repository module in place of the file-system-backed repositories
+ * `repositoriesModule` provides in production: the smoke tests verify the
+ * boot pipeline shape, not the data layer. `codeRepository` is not provided
+ * here; the `adapters.codeRepository` selection in `buildModules` wires it.
+ */
 const testRepositoriesModule = defineModule({
 	name: "test:repositories",
 	provides: {
-		// `InMemoryClientRepository` constructor parameter `Map<string, ClientEntry>`
-		// uses `ClientEntry = z.infer<typeof ClientEntrySchema>` (the schema's
-		// OUTPUT type) — fields with `.default(...)` are non-optional in the
-		// output even though they are optional on input. The fixture supplies
-		// every field explicitly so the literal satisfies the output shape
-		// without requiring a cast.
+		// The map takes `ClientEntry`, the schema's OUTPUT type, where fields
+		// with `.default(...)` are required; every field is supplied so the
+		// literal needs no cast.
 		clientRepository: () =>
 			new InMemoryClientRepository(
 				new Map([
@@ -165,7 +177,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
@@ -176,14 +188,11 @@ describe("standalone smoke test", () => {
 
 	async function buildApp() {
 		const handle = await createApp({
-			modules: buildModules(config, {
+			modules: buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
-				// D-2 v2: smoke tests stay in-memory for the RT family store.
-				// Production composition root pairs `refreshTokenFamilyClientModule`
-				// with `redisRefreshTokenFamilyStoreModule`; this override replaces
-				// the pair entirely with a single memory-backed store module so no
-				// real ioredis connection is opened during CI unit tests.
+				// A memory RT family store in place of the default Redis store and
+				// its client, so no real ioredis connection is opened.
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 			}),
 			bootstrapComponents: { config, pathResolver: (s) => s },
@@ -194,7 +203,7 @@ describe("standalone smoke test", () => {
 		app.use(
 			createReadinessRouter(express, {
 				probes: handle.readinessProbes,
-				timeoutMs: config.http.readinessTimeoutMs,
+				timeoutMs: HTTP.readinessTimeoutMs,
 			}),
 		);
 		app.use(handle.router);
@@ -207,16 +216,11 @@ describe("standalone smoke test", () => {
 	});
 
 	it("Dockerfile declares runtime metadata and runs install/build steps as node", () => {
-		// Default port is 3000 but the HEALTHCHECK and EXPOSE must read it
-		// from ${HTTP_PORT} so an operator overriding the env var keeps the
-		// app, EXPOSE metadata, and healthcheck in sync. Assert the ENV /
-		// EXPOSE / HEALTHCHECK structure rather than the literal port so the
-		// test is not brittle when operators or downstream forks change the
-		// default.
-		// The literal `${HTTP_PORT}` token from the Dockerfile is split across
-		// concatenations to sidestep biome's `noTemplateCurlyInString` rule
-		// (it cannot statically tell that this string is intentionally NOT
-		// a JS template placeholder — it is a Dockerfile env-substitution).
+		// HEALTHCHECK and EXPOSE must read the port from ${HTTP_PORT} so an
+		// operator overriding it keeps the app, EXPOSE and the healthcheck in
+		// sync; they are asserted by that token, not the literal port. The token
+		// is built by concatenation to sidestep biome's
+		// `noTemplateCurlyInString`: it is a Dockerfile substitution, not JS.
 		const HTTP_PORT_VAR = `$${"{"}HTTP_PORT}`;
 		expect(dockerfile).toContain("ENV HTTP_PORT=3000");
 		expect(dockerfile).toContain(`EXPOSE ${HTTP_PORT_VAR}`);
@@ -233,7 +237,7 @@ describe("standalone smoke test", () => {
 			/FROM node-base AS deps[\s\S]*USER node[\s\S]*RUN pnpm install --frozen-lockfile/,
 		);
 		expect(dockerfile).toMatch(/FROM deps AS builder[\s\S]*USER node[\s\S]*RUN pnpm run build/);
-		// #289: dependencies are resolved exactly once, in `deps`. The runtime
+		// Dependencies are resolved exactly once, in `deps`. The runtime
 		// stage must take its node_modules from a prune of that same tree — a
 		// second `pnpm install` would be a second resolution, so its absence
 		// after the runtime FROM is part of the contract.
@@ -248,12 +252,12 @@ describe("standalone smoke test", () => {
 		);
 	});
 
-	it("Dockerfile pins its mutable build inputs (#289)", () => {
+	it("Dockerfile pins its mutable build inputs", () => {
 		// Base image by digest — the tag alone is a moving pointer, and
 		// Dependabot's docker ecosystem bumps tag and digest together.
 		expect(dockerfile).toMatch(/FROM node:26-alpine@sha256:[0-9a-f]{64} AS node-base/);
 		// Global corepack by version — `npm install -g corepack` with no pin
-		// resolved whatever was latest at build time.
+		// resolves whatever is latest at build time.
 		expect(dockerfile).toMatch(/npm install -g corepack@\d+\.\d+\.\d+ --force/);
 		// The lockfile is a required build input for --frozen-lockfile.
 		expect(dockerfile).toMatch(/COPY --chown=node:node package\.json pnpm-lock\.yaml/);
@@ -290,7 +294,7 @@ describe("standalone smoke test", () => {
 						},
 					},
 				],
-				timeoutMs: config.http.readinessTimeoutMs,
+				timeoutMs: HTTP.readinessTimeoutMs,
 			}),
 		);
 		const res = await request(app).get("/readyz");
@@ -300,15 +304,11 @@ describe("standalone smoke test", () => {
 	});
 
 	it("issuer-configured buildModules serves the advertised jwks_uri (discovery <-> JWKS presence contract)", async () => {
-		// Guards the cross-module contract end-to-end against the REAL composition
-		// root: core's `jwksModule` contributes `jwks_uri` to discovery AND mounts
-		// the JWKS route, while `oauthModule` contributes the provider endpoints;
-		// core's aggregator assembles the document. If `buildModules` ever drops
-		// `jwksModule`, the issuer-configured composition now fails the discovery
-		// presence contract at boot (missing `jwks_uri`) — this test fails (RED) in
-		// that case. (The oauth package's integration test hand-composes both
-		// modules, so only a scaffold-level test like this can catch the
-		// composition root forgetting to wire jwksModule.)
+		// Against the REAL composition root: core's `jwksModule` contributes
+		// `jwks_uri` to discovery AND mounts the JWKS route. Without it the
+		// issuer-configured composition fails the discovery presence contract
+		// at boot. The oauth package's integration test composes both modules by
+		// hand, so only a scaffold-level test catches `buildModules` dropping it.
 		const issuerConfig: AppConfig = {
 			...config,
 			oauth: {
@@ -317,11 +317,14 @@ describe("standalone smoke test", () => {
 			},
 		};
 		const handle = await createApp({
-			modules: buildModules(issuerConfig, {
-				keyStoreModule: testKeyStoreModule,
-				repositoriesModule: testRepositoriesModule,
-				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-			}),
+			modules: buildModules(
+				{ ...switches, oauth: issuerConfig.oauth },
+				{
+					keyStoreModule: testKeyStoreModule,
+					repositoriesModule: testRepositoriesModule,
+					refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+				},
+			),
 			bootstrapComponents: { config: issuerConfig, pathResolver: (s) => s },
 		});
 		handleRef = handle;
@@ -333,7 +336,7 @@ describe("standalone smoke test", () => {
 		const res = await request(app).get(jwksPath);
 		expect(res.status).toBe(200);
 		expect(Array.isArray(res.body.keys)).toBe(true);
-		// #282: presence is no longer enough — the advertised jwks_uri must
+		// Presence is not enough — the advertised jwks_uri must
 		// publish an actual verification key, and never the private half.
 		expect(res.body.keys).toHaveLength(1);
 		expect(res.body.keys[0].alg).toBe("EdDSA");
@@ -364,27 +367,22 @@ describe("standalone smoke test", () => {
 		expect(res.headers["cache-control"]).not.toBe("no-store");
 	});
 
-	// Regression guard: a freshly scaffolded standalone app must boot under
-	// the default `federations.google.enabled = false`. The earlier shape of
-	// app.mts unconditionally listed `googleFederationModule` and the config
-	// bridge `googleFederationConfigModule`, so the bridge's
-	// `extractFederationSection` returned undefined and threw at boot. The
-	// fix moved the manifest assembly into `buildModules`, which conditionally
-	// includes the federation pair. The first sub-assertion asserts directly
-	// on the manifest list — a regression that bypasses the gate fails the
-	// `not.toContain` even if `googleFederationConfigModule` is later made
-	// tolerant of `undefined` (which would otherwise mask the gating bug).
-	// The second sub-assertion verifies the resulting handle still boots
-	// (Codex Round 1 P1 reproducibility).
+	// A freshly scaffolded app must boot under the default
+	// `core.federations.google.enabled = false`. `buildModules` includes
+	// `googleFederationModule` and its config bridge only when enabled, since
+	// the bridge throws at boot when `extractFederationSection` returns
+	// undefined. The manifest is asserted directly, so a bypassed gate fails
+	// even if the bridge is later made tolerant of `undefined`; then the
+	// handle must still boot.
 	it("boots when google federation is disabled (default scaffold config)", async () => {
-		const modules = buildModules(config, {
+		const modules = buildModules(switches, {
 			keyStoreModule: testKeyStoreModule,
 			repositoriesModule: testRepositoriesModule,
 			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 		});
 		const moduleNames = modules.map((m) => m.name);
-		expect(moduleNames).not.toContain("federation:google");
-		expect(moduleNames).not.toContain("standalone:google-federation-config");
+		expect(moduleNames).not.toContain("federation-google");
+		expect(moduleNames).not.toContain("google-federation-config");
 
 		const handle = await createApp({
 			modules,
@@ -394,40 +392,36 @@ describe("standalone smoke test", () => {
 		expect(handle).toBeDefined();
 	});
 
-	// D-2 v2 / OR-1 closure: the standalone composition root must default to the
-	// Redis-backed RT family store + ioredis client module pair, NOT the
-	// in-memory store. Multi-replica deployments lose RT family persistence
-	// when each replica holds families in-process; this test guards the
-	// production default. The override path is exercised by the smoke tests
-	// above (which substitute the memory store for CI).
-	describe("D-2 v2 + Wave 5d: redis-clients + adapter wiring", () => {
+	// The composition root must default to the Redis-backed RT family store
+	// and the ioredis client module, NOT the in-memory store: multi-replica
+	// deployments lose RT family persistence when each replica holds families
+	// in-process. The smoke tests above exercise the memory override.
+	describe("redis-clients + adapter wiring", () => {
 		it("buildModules includes the shared redis-clients module + redis store by default", () => {
-			const modules = buildModules(config, {
+			const modules = buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 			});
 			const names = modules.map((m) => m.name);
-			// Wave 5d: single shared ioredis client module (was per-purpose
-			// `standalone:refresh-token-family-client` in PR1).
-			expect(names).toContain("standalone:redis-clients");
+			expect(names).toContain("redis-clients");
 			expect(names).toContain("redis-refresh-token-family-store");
 			expect(names).not.toContain("core-refresh-token-family-store-memory");
 		});
 
 		it("buildModules drops the shared redis-clients module when override forces memory-only", () => {
-			const modules = buildModules(config, {
+			const modules = buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 			});
 			const names = modules.map((m) => m.name);
 			expect(names).toContain("core-refresh-token-family-store-memory");
-			expect(names).not.toContain("standalone:redis-clients");
+			expect(names).not.toContain("redis-clients");
 			expect(names).not.toContain("redis-refresh-token-family-store");
 		});
 
-		it("buildModules wires memoryRateLimiterModule by default (closes IH-14)", () => {
-			const modules = buildModules(config, {
+		it("buildModules wires memoryRateLimiterModule by default", () => {
+			const modules = buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
@@ -437,12 +431,8 @@ describe("standalone smoke test", () => {
 			expect(names).not.toContain("redis-rate-limiter");
 		});
 
-		it("buildModules switches to redisRateLimiterModule when rateLimiter.adapter = 'redis'", () => {
-			const redisRlConfig = {
-				...config,
-				rateLimiter: { adapter: "redis" as const },
-			};
-			const modules = buildModules(redisRlConfig, {
+		it("buildModules switches to redisRateLimiterModule when adapters.rateLimiter = 'redis'", () => {
+			const modules = buildModules(switchesWith({ rateLimiter: "redis" }), {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
@@ -451,44 +441,35 @@ describe("standalone smoke test", () => {
 			expect(names).toContain("redis-rate-limiter");
 			expect(names).not.toContain("core-rate-limiter-memory");
 			// Adapter = redis pulls in the shared redis-clients module too.
-			expect(names).toContain("standalone:redis-clients");
+			expect(names).toContain("redis-clients");
 		});
 
-		it("buildModules switches to redisSessionStoresModule when userSessionStores.adapter = 'redis'", () => {
-			const redisSessConfig = {
-				...config,
-				userSessionStores: { adapter: "redis" as const },
-			};
-			const modules = buildModules(redisSessConfig, {
+		it("buildModules switches to redisSessionStoresModule when adapters.userSessionStores = 'redis'", () => {
+			const modules = buildModules(switchesWith({ userSessionStores: "redis" }), {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 			});
 			const names = modules.map((m) => m.name);
-			expect(names).toContain("redisSessionStores");
-			expect(names).not.toContain("standalone:stores");
-			expect(names).toContain("standalone:redis-clients");
+			expect(names).toContain("redis-session-stores");
+			expect(names).not.toContain("stores");
+			expect(names).toContain("redis-clients");
 		});
 
-		// #321's `redisSessionStoresModule` requires the two subject-level client
-		// slots (`subjectSessionIndexClient`, `subjectRevocationClient`) its
-		// adapters consume, and the scaffold's shared ioredis module did not
-		// provide them — so `userSessionStores.adapter = "redis"`, the
-		// template's own multi-replica path, failed stage-1 boot with
-		// `missing-required-component`. Nothing here booted that branch: the
-		// tests above check which modules are selected, not whether the
-		// selection is satisfiable. This pins the invariant the shared clients
-		// module exists for: every `*Client` slot any selected module requires
-		// is one it provides.
-		it("standalone:redis-clients provides every *Client slot the Redis branches require", () => {
-			const allRedisConfig = {
-				...config,
-				userSessionStores: { adapter: "redis" as const },
-				rateLimiter: { adapter: "redis" as const },
-				accessTokenDenylist: { adapter: "redis" as const },
-				consentStore: { adapter: "redis" as const },
-				oauth: { ...config.oauth, code: { adapter: "redis" as const } },
-			};
+		// The tests above check which modules are selected, not whether the
+		// selection is satisfiable: a `*Client` slot with no provider (such as
+		// `redisSessionStoresModule`'s `subjectSessionIndexClient`) fails
+		// stage-1 boot with `missing-required-component`. The invariant the
+		// shared clients module exists for: every `*Client` slot any selected
+		// module requires is one it provides.
+		it("redis-clients provides every *Client slot the Redis branches require", () => {
+			const allRedisConfig = switchesWith({
+				userSessionStores: "redis",
+				rateLimiter: "redis",
+				accessTokenDenylist: "redis",
+				consentStore: "redis",
+				codeRepository: "redis",
+			});
 			// No `refreshTokenFamilyModules` override: the default is the Redis
 			// RT-family store, so `refreshTokenFamilyClient` is part of what the
 			// invariant covers. Still hermetic — buildModules opens no socket.
@@ -496,7 +477,7 @@ describe("standalone smoke test", () => {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 			});
-			const clients = modules.find((m) => m.name === "standalone:redis-clients");
+			const clients = modules.find((m) => m.name === "redis-clients");
 			expect(clients).toBeDefined();
 			const provided = new Set(Object.keys(clients?.provides ?? {}));
 			const requiredClientSlots = new Set(
@@ -508,14 +489,14 @@ describe("standalone smoke test", () => {
 		});
 	});
 
-	// #277: the scaffold used to wire NO access-token denylist, so the
-	// `/oauth/revoke` it shipped answered 200 for an access token and left the
-	// JWT working until expiry. The template now always wires one, and its own
-	// application.conf selects the Redis-backed adapter — the memory one forks
-	// per replica and `deployment.mode = "multi"` refuses it.
-	describe("#277: access-token denylist wiring", () => {
+	// Without an access-token denylist, `/oauth/revoke` would answer 200 for
+	// an access token and leave the JWT working until expiry. The template
+	// always wires one, and its own application.conf selects the Redis-backed
+	// adapter — the memory one forks per replica and `core.deployment.mode =
+	// "multi"` refuses it.
+	describe("access-token denylist wiring", () => {
 		it("always wires a denylist, so /oauth/revoke can keep its promise", () => {
-			const modules = buildModules(config, {
+			const modules = buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
@@ -527,7 +508,7 @@ describe("standalone smoke test", () => {
 		});
 
 		it("defaults to the memory denylist when no adapter is configured", () => {
-			const modules = buildModules(config, {
+			const modules = buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
@@ -537,12 +518,8 @@ describe("standalone smoke test", () => {
 			expect(names).not.toContain("redis-access-token-denylist");
 		});
 
-		it("switches to the Redis denylist when accessTokenDenylist.adapter = 'redis'", () => {
-			const redisDenylistConfig = {
-				...config,
-				accessTokenDenylist: { adapter: "redis" as const },
-			};
-			const modules = buildModules(redisDenylistConfig, {
+		it("switches to the Redis denylist when adapters.accessTokenDenylist = 'redis'", () => {
+			const modules = buildModules(switchesWith({ accessTokenDenylist: "redis" }), {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
@@ -553,25 +530,24 @@ describe("standalone smoke test", () => {
 			// The Redis branch must also pull in the shared ioredis socket, or the
 			// `accessTokenDenylistClient` slot has no provider and boot fails on a
 			// missing component instead of on the thing the operator changed.
-			expect(names).toContain("standalone:redis-clients");
+			expect(names).toContain("redis-clients");
 		});
 
-		it("the shipped application.conf selects the replica-safe adapter", () => {
+		it("the template's reference.conf selects the replica-safe adapter", () => {
 			// The template's own config is the artifact operators deploy. It runs
-			// with `deployment.mode = multi` in the umbrella E2E, which refuses
+			// with `core.deployment.mode = multi` in the umbrella E2E, which refuses
 			// every in-memory shared store — so shipping the memory denylist here
 			// would be a boot failure in the very stack that proves the scaffold
 			// works.
-			const conf = readFileSync(new URL("../../config/application.conf", import.meta.url), "utf8");
-			expect(conf).toMatch(/accessTokenDenylist\s*\{[\s\S]*?adapter\s*=\s*"redis"/);
+			expect(shippedAdapters().accessTokenDenylist).toBe("redis");
 		});
 
 		it("keeps the composition boot-valid end to end", async () => {
-			// The core boot guard (#277 step 13.9) refuses a composition that reads
+			// The core boot guard refuses a composition that reads
 			// the denylist slot without one. A scaffold that trips its own library's
 			// guard is not a scaffold.
 			const handle = await createApp({
-				modules: buildModules(config, {
+				modules: buildModules(switches, {
 					keyStoreModule: testKeyStoreModule,
 					repositoriesModule: testRepositoriesModule,
 					refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
@@ -583,81 +559,51 @@ describe("standalone smoke test", () => {
 		});
 	});
 
-	// OR-9 (Wave 5d): adapter switch for the OAuth code repository. Closes
-	// the deferred Phase 10 module-pattern wrapper for `codeRepository`. The
-	// memory branch wires `inMemoryCodeRepositoryModule`; the redis branch
-	// wires `redisCodeRepositoryModule` against the shared ioredis socket
-	// (same `standaloneRedisClientsModule` as the RT family / rate limiter).
-	describe("OR-9: code-repository adapter wiring", () => {
-		it("buildModules wires inMemoryCodeRepositoryModule by default (oauth.code.adapter = 'memory')", () => {
-			const modules = buildModules(config, {
+	// The OAuth code repository's selection: the memory branch wires
+	// `inMemoryCodeRepositoryModule`; the redis branch wires
+	// `redisCodeRepositoryModule` against the shared ioredis socket.
+	describe("code-repository adapter wiring", () => {
+		it("buildModules wires inMemoryCodeRepositoryModule when adapters.codeRepository = 'memory'", () => {
+			const modules = buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 			});
 			const names = modules.map((m) => m.name);
-			expect(names).toContain("standalone:in-memory-code-repository");
+			expect(names).toContain("standalone-in-memory-code-repository");
 			expect(names).not.toContain("redis-code-repository");
 		});
 
-		it("buildModules switches to redisCodeRepositoryModule when oauth.code.adapter = 'redis'", () => {
-			const redisCodeConfig = {
-				...config,
-				oauth: { ...config.oauth, code: { adapter: "redis" as const } },
-			};
-			const modules = buildModules(redisCodeConfig, {
+		it("buildModules switches to redisCodeRepositoryModule when adapters.codeRepository = 'redis'", () => {
+			const modules = buildModules(switchesWith({ codeRepository: "redis" }), {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 			});
 			const names = modules.map((m) => m.name);
 			expect(names).toContain("redis-code-repository");
-			expect(names).not.toContain("standalone:in-memory-code-repository");
+			expect(names).not.toContain("standalone-in-memory-code-repository");
 			// adapter = "redis" pulls in the shared ioredis socket so the
 			// `codeRepositoryClient` slot is satisfied.
-			expect(names).toContain("standalone:redis-clients");
-		});
-
-		it("buildModules honors legacy repositories.code.type='redis' with deprecation warn when oauth.code.adapter is absent", () => {
-			const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
-			try {
-				const legacyConfig = {
-					...config,
-					oauth: { ...config.oauth, code: undefined },
-					repositories: {
-						...config.repositories,
-						code: { type: "redis" as const, defaultExpiresIn: 600 },
-					},
-				};
-				const modules = buildModules(legacyConfig, {
-					keyStoreModule: testKeyStoreModule,
-					repositoriesModule: testRepositoriesModule,
-					refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-				});
-				const names = modules.map((m) => m.name);
-				expect(names).toContain("redis-code-repository");
-				expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("repositories.code.type"));
-			} finally {
-				warnSpy.mockRestore();
-			}
+			expect(names).toContain("redis-clients");
 		});
 
 		it("buildModules has only ONE codeRepository provider in the manifest (no slot collision)", () => {
-			// Regression guard: `repositoriesModule` must NOT provide
-			// `codeRepository` post-OR-9 — the slot is owned by
-			// `inMemoryCodeRepositoryModule` or `redisCodeRepositoryModule`
-			// exclusively, selected via `oauth.code.adapter`.
-			const modules = buildModules(config, {
+			// The `repositories` module must NOT provide `codeRepository` — the
+			// slot is owned by `inMemoryCodeRepositoryModule` or
+			// `redisCodeRepositoryModule` exclusively, selected via
+			// `adapters.codeRepository`.
+			const modules = buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
-				// Use the production repositoriesModule (not the test override)
-				// so we exercise its post-OR-9 provides-shape.
+				// The production `repositories` module (not the test override), so
+				// its own provides are exercised.
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 			});
 			const codeRepoProviders = modules.filter((m) =>
 				Object.keys(m.provides ?? {}).includes("codeRepository"),
 			);
 			expect(codeRepoProviders).toHaveLength(1);
-			expect(codeRepoProviders[0]?.name).toBe("standalone:in-memory-code-repository");
+			expect(codeRepoProviders[0]?.name).toBe("standalone-in-memory-code-repository");
 		});
 	});
 
@@ -669,10 +615,10 @@ describe("standalone smoke test", () => {
 		registerBuiltinKeyStores(ksf);
 		const keyStore = await ksf.create({
 			type: "local",
-			...(config.oauth.jwt.signingKey.local ?? {}),
+			...(config["key-store"] as { local: object }).local,
 		});
 		// The token must carry the deployment's configured `iss`: introspection
-		// pins it (RFC 9068 §4), and since #266 every deployment has one.
+		// pins it (RFC 9068 §4), and every deployment has one.
 		const { token } = await generateToken(
 			{},
 			{