@o3co/create-auth-provider 0.17.0-rc.1 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/upstream-amr.acceptance.test.mts

@@ -30,8 +30,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import {
-	type AppConfig,
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
@@ -43,19 +41,20 @@ import {
 	registerBuiltinKeyStores,
 	type UserSessionStore,
 } from "@o3co/auth-provider-core";
+import { federationTypeForTests } from "@o3co/auth-provider-core/testing";
+import type { OAuthSection } from "@o3co/auth-provider-oauth";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
-import { resolveConfigPaths, type Switches } from "#/configPath.mjs";
+import { resolveConfigPaths } from "#/configPath.mjs";
 import { templateReference } from "../modules.mjs";
 import {
+	type BothPhases,
+	bothPhasesOf,
 	capturedRenames,
 	libraryLayers,
-	rootSectionsOf,
-	sectionsCoreDoesNotDeclare,
 } from "./library-references.fixture.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
@@ -94,14 +93,14 @@ const ENV: Readonly<Record<string, string>> = {
 };
 
 /** The shipped configuration, with the partner federation and an acr table beside it. */
-function resolveConfig(trustUpstreamAmr: boolean | undefined): Switches {
+function resolveConfig(trustUpstreamAmr: boolean | undefined): BothPhases {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
 	const layers = parseFile(envConfPath, { env: ENV })
 		.withFallback(parseFile(applicationConfPath, { env: ENV }))
 		.withFallback(parseFile(fileURLToPath(templateReference()), { env: ENV }))
 		.withFallback(libraryLayers(ENV));
-	const shipped = validate(layers, AppConfigSchema) as AppConfig;
-	const parsed = AppConfigSchema.parse({
+	const shipped = bothPhasesOf(layers, ENV);
+	return {
 		...shipped,
 		core: {
 			...shipped.core,
@@ -116,21 +115,15 @@ function resolveConfig(trustUpstreamAmr: boolean | undefined): Switches {
 			},
 		},
 		oauth: {
-			...shipped.oauth,
+			...(shipped.oauth as OAuthSection),
 			authorize: {
-				...shipped.oauth.authorize,
+				...(shipped.oauth as OAuthSection).authorize,
 				acrValues: { [MFA_ACR]: ["mfa"], [FED_ACR]: ["fed"] },
 			},
 		},
-	});
-	return {
-		...sectionsCoreDoesNotDeclare(layers),
-		...rootSectionsOf(layers, ENV),
-		...parsed,
-		// What the resolution captured of core's renamed variables, which the
-		// schema's parse drops.
+		// What the resolution captured of the renamed variables.
 		"renamed-variables": capturedRenames(ENV),
-	} as Switches;
+	} as BothPhases;
 }
 
 /** An IdP that authenticates `ext-1` and says it did so with `mfa` and `hwk`. */
@@ -151,18 +144,11 @@ const partner: FederationProvider = {
 	}),
 };
 
-const partnerFederationModule = defineModule({
-	name: "test:partner-federation",
-	contributes: {
-		federations: { [FEDERATION]: () => partner },
-		federationRedirectPolicies: {
-			[FEDERATION]: () => ({
-				validateRedirect: () => ({ ok: true as const, value: undefined }),
-				resolveCallbackRedirect: () => ({ ok: true as const, value: "/" }),
-			}),
-		},
-	} as never,
-});
+/**
+ * The partner federation's type: the `partner` entry is the IdP above, with a
+ * redirect policy that accepts every redirect and resolves the callback to `/`.
+ */
+const partnerFederationModule = federationTypeForTests(FEDERATION, { provider: () => partner });
 
 const testRepositoriesModule = defineModule({
 	name: "test:repositories",
@@ -354,6 +340,9 @@ describe("an upstream IdP's amr counts only for a federation that trusts it", ()
 			federation: FEDERATION,
 			upstreamAmr: UPSTREAM_AMR,
 			mfaAt: undefined,
+			// The partner reports no `auth_time`, and the federation does not let
+			// its callback stand for one (`callbackMeetsFreshness`, false by default).
+			upstreamAuthTime: null,
 		});
 	});
 
@@ -379,6 +368,9 @@ describe("an upstream IdP's amr counts only for a federation that trusts it", ()
 			federation: FEDERATION,
 			upstreamAmr: undefined,
 			mfaAt: undefined,
+			// The partner reports no `auth_time`, and the federation does not let
+			// its callback stand for one (`callbackMeetsFreshness`, false by default).
+			upstreamAuthTime: null,
 		});
 	});
 

package/templates/standalone/src/adapters.mts

@@ -19,11 +19,13 @@
  * slot. Phase one reads it alone, before the modules are chosen, with the
  * template's own schema; boot is never handed it. The paths the selections
  * moved from, and the variables renamed with them, are refused here, before
- * any module is chosen, in the words boot refuses a module's in: a renamed
- * variable set alone, or beside its new name at a different value, is
+ * any module is chosen, in the words and under the reasons boot refuses a
+ * module's with (`config-path-relocated`, `environment-variable-renamed`): a
+ * renamed variable set alone, or beside its new name at a different value, is
  * refused, naming the variables and never a value.
  */
 
+import { configRefused, issuesAt, pathsRelocated } from "./bootRefusal.mjs";
 import { refuseRenamedVariables } from "./rootRenames.mjs";
 import { type Adapters, adaptersSchema } from "./sections.mjs";
 
@@ -33,6 +35,7 @@ export const ADAPTERS_SECTION = "adapters";
 /** Each selection's key under `adapters`, and the variable its path is bound to. */
 const VARIABLES: Readonly<Record<keyof Adapters, string>> = {
 	rateLimiter: "ADAPTERS_RATE_LIMITER",
+	attemptCounter: "ADAPTERS_ATTEMPT_COUNTER",
 	userSessionStores: "ADAPTERS_USER_SESSION_STORES",
 	accessTokenDenylist: "ADAPTERS_ACCESS_TOKEN_DENYLIST",
 	replaySeenSet: "ADAPTERS_REPLAY_SEEN_SET",
@@ -101,30 +104,40 @@ function valueAt(config: unknown, path: string): unknown {
 /**
  * `adapters` from `resolved` — the template's own layers over its
  * `config/reference.conf` — under `env`, the environment they were
- * substituted with, parsed with the template's schema. Refuses, with a
- * `RangeError`, a selection still written at the path it moved from, naming
- * its new path and variable; then a variable renamed with one
- * (`refuseRenamedVariables`); then a value or a key the schema refuses,
- * naming its path under `adapters`.
+ * substituted with, parsed with the template's schema. Refuses, each with a
+ * `BootError` (`bootRefusal.mts`), a selection still written at the path it
+ * moved from, naming its new path and variable (`config-path-relocated`);
+ * then a variable renamed with one (`refuseRenamedVariables`); then a value
+ * or a key the schema refuses, naming its path under `adapters`
+ * (`config-validation-failed`).
  */
 export function readAdapters(
 	resolved: Readonly<Record<string, unknown>>,
 	env: Readonly<Record<string, string>>,
 ): Adapters {
 	const moved = MOVED.filter(([from]) => valueAt(resolved, from) !== undefined).map(
-		([from, key]) => {
-			const to = `${ADAPTERS_SECTION}.${key}`;
-			return `${from} has moved to ${to}; see CHANGELOG. Write it there (environment variable ${VARIABLES[key]}) and remove this field from your config (or unset the environment variable that sets it).`;
-		},
+		([from, key]) => ({
+			module: ADAPTERS_SECTION,
+			from,
+			to: `${ADAPTERS_SECTION}.${key}`,
+			environmentVariable: VARIABLES[key],
+		}),
 	);
 	if (moved.length > 0) {
-		throw new RangeError(
-			`Configuration sets ${moved.length} path(s) that moved: ${moved.join(" ")}`,
+		throw pathsRelocated(
+			`Configuration sets ${moved.length} path(s) that moved: ${moved
+				.map(
+					({ from, to, environmentVariable }) =>
+						`${from} has moved to ${to}; see CHANGELOG. Write it there (environment variable ${environmentVariable}) and remove this field from your config (or unset the environment variable that sets it).`,
+				)
+				.join(" ")}`,
+			moved,
 		);
 	}
 	refuseRenamedVariables(
 		env,
 		RENAMED.map(([from, key]) => ({
+			module: ADAPTERS_SECTION,
 			from,
 			to: VARIABLES[key],
 			path: `${ADAPTERS_SECTION}.${key}`,
@@ -132,17 +145,17 @@ export function readAdapters(
 	);
 	const result = adaptersSchema.safeParse(resolved[ADAPTERS_SECTION]);
 	if (!result.success) {
-		const issues = result.error.issues;
-		throw new RangeError(
+		const issues = issuesAt([ADAPTERS_SECTION], result.error.issues);
+		throw configRefused(
 			`Config validation failed — ${issues.length} issue(s) found: ${issues
 				.map((issue) => {
 					const unknown =
 						issue.code === "unrecognized_keys" ? ` ${JSON.stringify(issue.keys)}` : "";
-					const path = [ADAPTERS_SECTION, ...issue.path.map(String)].join(".");
-					return `${path}: ${issue.message}${unknown}`;
+					return `${issue.path.map(String).join(".")}: ${issue.message}${unknown}`;
 				})
 				.join("; ")}`,
-			{ cause: result.error },
+			issues,
+			[{ module: ADAPTERS_SECTION, schemaPath: ADAPTERS_SECTION }],
 		);
 	}
 	return result.data;

package/templates/standalone/src/app.mts

@@ -19,6 +19,7 @@ import express from "express";
 import helmet from "helmet";
 import { buildModules } from "./buildModules.mjs";
 import {
+	configDefaultsFor,
 	readLogging,
 	readOwnLayers,
 	readSwitches,
@@ -43,9 +44,7 @@ const { applicationConfPath, envConfPath } = resolveConfigPaths(configDirPath, e
 const own = readOwnLayers([envConfPath, applicationConfPath]);
 // Phase one: what the template reads before it knows its modules, only for
 // those choices — its own `adapters` and MFA switch (`mfaMode`, MFA_MODE),
-// and the switches core's reader parses — and for what the composition
-// expects of session admission: the configuration's list, with `mfa` added
-// when the MFA switch installs MFA.
+// and whether federation grants are installed.
 const switches: Switches = readSwitches(own);
 
 // From the `logging` module's section, so the level holds from the first line;
@@ -83,13 +82,15 @@ await (async (): Promise<void> => {
 	// so `CONFIG_ENV=production` is production to the guard too.
 	//
 	// Phase two: `createApp` parses the configuration as resolved once, with
-	// every loaded module's schema (`configPath.mts`). From here on the
+	// every loaded module's schema (`configPath.mts`), and names each section
+	// nothing loaded reads by the configuration's defaults. From here on the
 	// template reads the parsed configuration.
-	const modules = buildModules(switches, { environment: env, logger });
+	const modules = buildModules(switches, { environment: env });
 	const handle = await createApp({
 		modules,
 		bootstrapComponents: {
 			config: resolveForBoot(own, modules, switches),
+			configDefaults: configDefaultsFor(modules),
 			pathResolver: import.meta.resolve,
 			logger,
 		},

package/templates/standalone/src/bootRefusal.mts

@@ -0,0 +1,117 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template's refusals before boot, as core's `BootError`: each under the
+ * reason boot raises for the same case, at the stage boot raises it in
+ * (`validateManifests`), so that an alert keyed on a boot error's reason sees
+ * every refusal to start. The template's checks stay its own; only how a
+ * refusal is reported is boot's.
+ *
+ * The details name a module as boot does. A key of the composition root's
+ * own — the `adapters` section, the `mfaMode` switch — is named after itself,
+ * as boot names core's own section "core": a module with a section under
+ * either name is refused (`resolveForBoot`), so the name points at the key.
+ */
+
+import {
+	BootError,
+	type ConfigPathRelocatedDetails,
+	type ConfigValidationFailedDetails,
+	type EnvironmentVariableRenamedDetails,
+} from "@o3co/auth-provider-core";
+
+/** A Zod issue as `config-validation-failed` carries one: its path is the path in the configuration. */
+export type ConfigIssue = ConfigValidationFailedDetails["issues"][number];
+
+/** The stage boot raises the configuration's refusals in. */
+const STAGE = "validateManifests";
+
+/** An issue at `path` of the configuration that no schema raised: what is wrong there, in `message`. */
+export function customIssue(path: readonly string[], message: string): ConfigIssue {
+	return { code: "custom", path: [...path], message } as ConfigIssue;
+}
+
+/** `issues`, each with `prefix`, the path its schema read at, in front of its own path. */
+export function issuesAt(prefix: readonly string[], issues: readonly ConfigIssue[]): ConfigIssue[] {
+	return issues.map((issue) => ({ ...issue, path: [...prefix, ...issue.path] }) as ConfigIssue);
+}
+
+/**
+ * `config-validation-failed`: `issues` at their paths, refused in the
+ * sections `modules` read, each at its `schemaPath`.
+ */
+export function configRefused(
+	message: string,
+	issues: readonly ConfigIssue[],
+	modules: ConfigValidationFailedDetails["modules"],
+): BootError {
+	return new BootError({
+		message,
+		reason: "config-validation-failed",
+		stage: STAGE,
+		details: { reason: "config-validation-failed", issues: [...issues], modules: [...modules] },
+	});
+}
+
+/**
+ * `config-validation-failed` for one key, at `path`, of the section `module`
+ * reads at its own name: `message` is the refusal and the issue's message.
+ */
+export function keyRefused(message: string, module: string, path: readonly string[]): BootError {
+	return configRefused(message, [customIssue(path, message)], [{ module, schemaPath: module }]);
+}
+
+/** `config-path-relocated`: each key still set at a path it moved from. */
+export function pathsRelocated(
+	message: string,
+	relocated: ConfigPathRelocatedDetails["relocated"],
+): BootError {
+	return new BootError({
+		message,
+		reason: "config-path-relocated",
+		stage: STAGE,
+		details: { reason: "config-path-relocated", relocated: [...relocated] },
+	});
+}
+
+/** `environment-variable-renamed`: each old variable name set, with no value. */
+export function variablesRenamed(
+	message: string,
+	renamed: EnvironmentVariableRenamedDetails["renamed"],
+): BootError {
+	return new BootError({
+		message,
+		reason: "environment-variable-renamed",
+		stage: STAGE,
+		details: { reason: "environment-variable-renamed", renamed: [...renamed] },
+	});
+}
+
+/** `module-section-path-invalid`: `module`'s section is read at `at`, which `problem` says it may not be. */
+export function sectionPathRefused(
+	message: string,
+	module: string,
+	at: string,
+	problem: string,
+): BootError {
+	return new BootError({
+		message,
+		reason: "module-section-path-invalid",
+		stage: STAGE,
+		details: { reason: "module-section-path-invalid", module, at, problem },
+	});
+}

package/templates/standalone/src/buildModules.mts

@@ -14,12 +14,9 @@
  * limitations under the License.
  */
 import {
-	consoleLogger,
 	defaultRefreshTokenFamilyRevocationModule,
 	defaultRefreshTokenFamilyRotationModule,
-	federationsOf,
 	jwksModule,
-	type Logger,
 	type Module,
 	memoryAccessTokenDenylistModule,
 	memoryConsentStoreModule,
@@ -27,18 +24,20 @@ import {
 	memoryFederationGrantStoreModule,
 	memoryRateLimiterModule,
 	memoryReplaySeenSetModule,
+	sessionLifecycleModule,
 } from "@o3co/auth-provider-core";
-import { googleFederationModule } from "@o3co/auth-provider-federation-google";
+import { googleFederationTypeModule } from "@o3co/auth-provider-federation-google";
 import { federationGrantsModules } from "@o3co/auth-provider-federation-grants";
-import { oidcFederationModule, oidcFederationNames } from "@o3co/auth-provider-federation-oidc";
+import { oidcFederationTypeModule } from "@o3co/auth-provider-federation-oidc";
 import {
-	oauthAuthorizationModule,
-	oauthModule,
-	oauthSessionModule,
+	oauthAuthorizationGrantsModule,
+	oauthEndpointsModule,
+	oauthSessionGrantModule,
 	subjectRevocationServiceModule,
 } from "@o3co/auth-provider-oauth";
 import {
 	redisAccessTokenDenylistModule,
+	redisAttemptCounterModule,
 	redisCodeRepositoryModule,
 	redisConsentStoreModule,
 	redisFederationGrantIntentStoreModule,
@@ -49,11 +48,7 @@ import {
 	redisReplaySeenSetModule,
 	redisSessionStoresModule,
 } from "@o3co/auth-provider-redis";
-import {
-	extractFederationSection,
-	sessionModule,
-	sessionStoreModuleFor,
-} from "@o3co/auth-provider-session";
+import { sessionModule, sessionStoreModule } from "@o3co/auth-provider-session";
 import {
 	standardDevelopmentMailSenderModule,
 	standardSmtpMailSenderModule,
@@ -62,20 +57,18 @@ import type { Switches } from "./configPath.mjs";
 import { mfaModulesFor } from "./mfaSwitch.mjs";
 import {
 	auditSinkModuleFor,
-	googleFederationConfigModule,
 	httpModule,
 	inMemoryCodeRepositoryModule,
 	inMemoryFederationTokenStoreModule,
 	inMemorySessionStoresModule,
 	keyStoreModule,
 	loggingModule,
-	oidcFederationConfigModule,
 	repositoriesModuleFor,
 	standaloneRedisClientsModule,
 } from "./modules.mjs";
 
 /**
- * Overrides for the composition. All but `environment`, `logger` and
+ * Overrides for the composition. All but `environment` and
  * `mailSenderModules` are test-only: they let the smoke test substitute
  * in-memory implementations of the file-system-backed modules, and production
  * callers should not pass them — the defaults match the standalone scaffold.
@@ -93,15 +86,8 @@ export interface BuildModulesOverrides {
 	 * MFA module reads it too, for the development sample key's refusal.
 	 */
 	readonly environment?: string;
-	/**
-	 * Where the composition's own notices go — a deprecated config key, one
-	 * `config_key_deprecated` line (warn) each. `app.mts` passes the logger it
-	 * hands every module; omitted, `consoleLogger`.
-	 */
-	readonly logger?: Logger;
 	readonly keyStoreModule?: Module;
 	readonly repositoriesModule?: Module;
-	readonly storesModule?: Module;
 	/**
 	 * Replaces the refresh-token family store modules (default
 	 * `[redisRefreshTokenFamilyStoreModule]`, on the shared ioredis socket).
@@ -127,41 +113,16 @@ export interface BuildModulesOverrides {
 	readonly mailSenderModules?: readonly Module[];
 }
 
-/**
- * The access-token lifetime core's `reference.conf` ships on the deprecated
- * `oauth.accessToken.expiresIn`. Not a default — nothing mints with it — only
- * what an unmodified deployment carries there, so the deprecation line can tell
- * an operator's override from the shipped value. Pinned against the real file
- * by `access-token-lifetime-alias.test.mts`.
- */
-const SHIPPED_ACCESS_TOKEN_EXPIRES_IN = 3600;
-
-/** Whether `value` sets anything: a value, or a section with one somewhere under it. */
-function setsAnything(value: unknown): boolean {
-	if (value === undefined) return false;
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return true;
-	return Object.values(value).some(setsAnything);
-}
-
 /**
  * Compose the standalone module list from phase one's `config`: the
  * composition root's `adapters`, which choose the adapter behind each slot,
- * and the switches core's reader parsed. Kept out of `app.mts` so a smoke
- * test can check the manifest (that disabling a federation removes its module
- * pair, say) without an HTTP server. The rules for editing the list (order,
- * one module per store slot, federation adapters with their config bridges)
- * are in the template README, "Module Composition Order".
+ * its MFA switch, and whether federation grants are installed. Kept out of
+ * `app.mts` so a smoke test can check the manifest (that disabling federation
+ * grants removes their modules, say) without an HTTP server. The rules for
+ * editing the list (order, one module per store slot, the federation types it
+ * bundles) are in the template README, "Module Composition Order".
  */
 export function buildModules(config: Switches, overrides: BuildModulesOverrides = {}): Module[] {
-	// An entry's `type` names the implementation, so the two gates never both
-	// select one entry: `core.federations.google` is the built-in Google
-	// federation only when its type is `google` (that name's default); with
-	// `type = "oidc"` it is a generic OIDC instance, and composing both would
-	// contribute the same federation and redirect-policy keys twice.
-	const federations = federationsOf(config);
-	const googleEnabled = extractFederationSection(federations, "google")?.type === "google";
-	const oidcFederations = oidcFederationNames(federations);
-	const logger = overrides.logger ?? consoleLogger;
 	const adapters = config.adapters;
 
 	// Federation grants: a user's standing consent that a client may obtain
@@ -174,11 +135,10 @@ export function buildModules(config: Switches, overrides: BuildModulesOverrides
 	// subject holds" include the grants. Enabling it also states the deployment
 	// has a consent page, a callback per connection and a user repository
 	// covering each connection's registration; the routes module refuses at
-	// boot what is missing, naming it. A setting still written at the section's
-	// old path, `federationGrants`, installs the feature too, so that boot
-	// refuses it naming the new path rather than reading the feature as off.
-	const federationGrantsEnabled =
-		config["federation-grants"]?.enabled === true || setsAnything(config.federationGrants);
+	// boot what is missing, naming it. Phase one decides it (`readSwitches`): a
+	// value boot would refuse installs the feature, so that boot refuses it
+	// rather than reading the feature as off.
+	const federationGrantsEnabled = config["federation-grants"]?.enabled === true;
 
 	// MFA: the template's own switch, `mfaMode` (MFA_MODE). `off` installs
 	// nothing of MFA; `optional` and `required` install what `mfaModulesFor`
@@ -187,28 +147,6 @@ export function buildModules(config: Switches, overrides: BuildModulesOverrides
 	// switch (`resolveForBoot`).
 	const mfaInstalled = config.mfaMode !== "off";
 
-	// The deprecated alias `oauth.accessToken.expiresIn`
-	// (OAUTH_ACCESS_TOKEN_EXPIRES_IN) is still read as the default while
-	// `defaultExpiresIn` is unset; `resolveAccessTokenLifetime` does that, and
-	// this only warns. Core's `reference.conf` ships the lifetime on the
-	// deprecated key, so only an override of it has something to move. See
-	// CHANGELOG for the removal version.
-	const accessToken = config.oauth.accessToken;
-	if (
-		accessToken.defaultExpiresIn === undefined &&
-		accessToken.expiresIn !== SHIPPED_ACCESS_TOKEN_EXPIRES_IN
-	) {
-		logger.warn(
-			{
-				key: "oauth.accessToken.expiresIn",
-				env: "OAUTH_ACCESS_TOKEN_EXPIRES_IN",
-				replacement: "oauth.accessToken.defaultExpiresIn",
-				replacementEnv: "OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN",
-			},
-			"config_key_deprecated",
-		);
-	}
-
 	const refreshTokenFamilyModules: readonly Module[] = overrides.refreshTokenFamilyModules ?? [
 		redisRefreshTokenFamilyStoreModule,
 	];
@@ -225,6 +163,7 @@ export function buildModules(config: Switches, overrides: BuildModulesOverrides
 	const usingRedisAnywhere =
 		refreshTokenFamilyUsesRedis ||
 		adapters.rateLimiter === "redis" ||
+		adapters.attemptCounter === "redis" ||
 		adapters.userSessionStores === "redis" ||
 		adapters.codeRepository === "redis" ||
 		adapters.accessTokenDenylist === "redis" ||
@@ -245,13 +184,16 @@ export function buildModules(config: Switches, overrides: BuildModulesOverrides
 	const sessionStoresModules: Module[] =
 		adapters.userSessionStores === "redis"
 			? [redisSessionStoresModule]
-			: overrides.storesModule
-				? [overrides.storesModule]
-				: [inMemorySessionStoresModule];
+			: [inMemorySessionStoresModule];
 
 	const rateLimiterModules: Module[] =
 		adapters.rateLimiter === "redis" ? [redisRateLimiterModule] : [memoryRateLimiterModule];
 
+	// `memory` installs no counter: the login's attempt guard counts per
+	// process, which `core.deployment.mode = "multi"` refuses.
+	const attemptCounterModules: Module[] =
+		adapters.attemptCounter === "redis" ? [redisAttemptCounterModule] : [];
+
 	// Mutually exclusive: both modules provide the `codeRepository` slot, and
 	// including both would be a boot-time slot collision.
 	const codeRepositoryModules: Module[] =
@@ -259,7 +201,7 @@ export function buildModules(config: Switches, overrides: BuildModulesOverrides
 			? [redisCodeRepositoryModule]
 			: [inMemoryCodeRepositoryModule];
 
-	// The RFC 7009 access-token denylist has no "none": `oauthModule` mounts
+	// The RFC 7009 access-token denylist has no "none": `oauthEndpointsModule` mounts
 	// `/oauth/revoke` and reads the `accessTokenDenylist` slot, and core's boot
 	// validator refuses a composition that reads the slot with nothing filling
 	// it, since the endpoint would answer 200 while the token kept working. The
@@ -349,25 +291,26 @@ export function buildModules(config: Switches, overrides: BuildModulesOverrides
 	return [
 		// MUST stay first: it declares no `before`/`after`, so this position is
 		// what mounts express-session ahead of every session-consuming module.
-		// Built from `config` so that `session-store.storage.type = "memory"` declares
-		// itself replica-unsafe and `core.deployment.mode = "multi"` refuses it.
-		sessionStoreModuleFor(config),
-		// Under `/oauth` beside `oauthModule`, each parsing its own requests, so
+		// It declares `session-store.storage.type = "memory"` replica-unsafe from
+		// its own section, so `core.deployment.mode = "multi"` refuses it.
+		sessionStoreModule,
+		// Under `/oauth` beside `oauthEndpointsModule`, each parsing its own requests, so
 		// their relative order does not matter; the browser half orders itself
 		// after the session middleware by its own `after`.
 		...(federationGrantsEnabled ? federationGrantsModules : []),
-		oauthModule({ config }),
-		oauthSessionModule({ config }),
-		oauthAuthorizationModule({ config }),
+		oauthEndpointsModule,
+		oauthSessionGrantModule,
+		oauthAuthorizationGrantsModule,
 		// Always wired: a provider that signs tokens must publish its
-		// verification keys regardless of OIDC issuer config, and `oauthModule`'s
+		// verification keys regardless of OIDC issuer config, and `oauthEndpointsModule`'s
 		// discovery `jwks_uri` (advertised when an issuer is set) must resolve.
 		jwksModule,
 		sessionModule,
-		...(googleEnabled ? [googleFederationModule, googleFederationConfigModule] : []),
-		...(oidcFederations.length > 0
-			? [oidcFederationConfigModule, ...oidcFederations.map((name) => oidcFederationModule(name))]
-			: []),
+		// The federation types the template bundles, always: each contributes
+		// its type, and boot hands it every enabled `core.federations` entry
+		// that names it, under the entry's name. Nothing here reads an entry.
+		googleFederationTypeModule(),
+		oidcFederationTypeModule(),
 		// The template's own settings: `logging {}` and `http {}`.
 		loggingModule,
 		httpModule,
@@ -386,7 +329,14 @@ export function buildModules(config: Switches, overrides: BuildModulesOverrides
 		...federationGrantStoreModules,
 		...federationGrantIntentStoreModules,
 		...sessionStoresModules,
+		// Core's session lifecycle, over the session stores' lifecycle store:
+		// a login opens its session's record, a code exchange joins its relying
+		// party and family to it, and both logout endpoints close it, which
+		// revokes the families and tells the relying parties. Its sweep resumes
+		// a close left pending.
+		sessionLifecycleModule,
 		...rateLimiterModules,
+		...attemptCounterModules,
 		...codeRepositoryModules,
 		...accessTokenDenylistModules,
 		...replaySeenSetModules,