@o3co/create-auth-provider 0.17.0-rc.1 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/adapters.test.mts

@@ -28,7 +28,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { defineModule } from "@o3co/auth-provider-core";
+import { BootError, defineModule } from "@o3co/auth-provider-core";
 import { afterAll, describe, expect, it } from "vitest";
 import { z } from "zod";
 import { buildModules } from "#/buildModules.mjs";
@@ -60,12 +60,13 @@ const MFA_OFF: Readonly<Record<string, string>> = { MFA_MODE: "off" };
 const adaptersFrom = (env: Record<string, string> = {}, hocon?: string) =>
 	readSwitches(readOwnLayers(ownFiles(hocon), { env })).adapters;
 
-/** What phase one refuses under `env` and an operator's `hocon`. */
-function refusal(env: Record<string, string> = {}, hocon?: string): Error {
+/** What phase one refuses under `env` and an operator's `hocon`: a `BootError`. */
+function refusal(env: Record<string, string> = {}, hocon?: string): BootError {
 	try {
 		adaptersFrom(env, hocon);
 	} catch (err) {
-		return err as Error;
+		expect(err).toBeInstanceOf(BootError);
+		return err as BootError;
 	}
 	throw new Error("phase one read the adapters");
 }
@@ -141,6 +142,7 @@ describe("the shipped selections", () => {
 	it("reads every selection from the template's reference.conf, at the values the template ships", () => {
 		expect(adaptersFrom()).toEqual({
 			rateLimiter: "memory",
+			attemptCounter: "memory",
 			userSessionStores: "memory",
 			accessTokenDenylist: "redis",
 			replaySeenSet: "redis",
@@ -164,14 +166,25 @@ describe("the shipped selections", () => {
 		},
 	);
 
+	it("reads adapters.attemptCounter from ADAPTERS_ATTEMPT_COUNTER", () => {
+		expect(adaptersFrom({ ADAPTERS_ATTEMPT_COUNTER: "redis" }).attemptCounter).toBe("redis");
+		expect(refusal({ ADAPTERS_ATTEMPT_COUNTER: "memcached" }).message).toMatch(
+			/adapters\.attemptCounter/,
+		);
+	});
+
 	it("reads a selection an operator writes in HOCON", () => {
 		expect(adaptersFrom({}, 'adapters.rateLimiter = "redis"\n').rateLimiter).toBe("redis");
 	});
 
 	it("refuses a value its schema does not know, naming the key", () => {
-		expect(refusal({ ADAPTERS_RATE_LIMITER: "memcached" }).message).toMatch(
-			/adapters\.rateLimiter/,
-		);
+		const err = refusal({ ADAPTERS_RATE_LIMITER: "memcached" });
+		expect(err.message).toMatch(/adapters\.rateLimiter/);
+		expect(err.reason).toBe("config-validation-failed");
+		expect(err.details).toMatchObject({
+			issues: [{ path: ["adapters", "rateLimiter"] }],
+			modules: [{ module: "adapters", schemaPath: "adapters" }],
+		});
 	});
 
 	it("refuses the Store for the MFA transaction store, which holds verification state, and accepts it for the factor store", () => {
@@ -198,9 +211,20 @@ describe("a path a selection moved from, written in the operator's own layer", (
 		"adapters.%s: refused where it was, %s's old path, naming the new path and ADAPTERS_%s",
 		(key, name, oldPath, _oldName, value) => {
 			const err = refusal({}, `${oldPath} = "${value}"\n`);
-			expect(err).toBeInstanceOf(RangeError);
 			expect(err.message).toContain(`${oldPath} has moved to adapters.${key}`);
 			expect(err.message).toContain(`ADAPTERS_${name}`);
+			expect(err.reason).toBe("config-path-relocated");
+			expect(err.details).toEqual({
+				reason: "config-path-relocated",
+				relocated: [
+					{
+						module: "adapters",
+						from: oldPath,
+						to: `adapters.${key}`,
+						environmentVariable: `ADAPTERS_${name}`,
+					},
+				],
+			});
 		},
 	);
 
@@ -212,6 +236,13 @@ describe("a path a selection moved from, written in the operator's own layer", (
 		for (const path of ["rateLimiter.adapter", "consentStore.adapter", "audit.sink.type"]) {
 			expect(err.message).toContain(path);
 		}
+		expect(err.details).toMatchObject({
+			relocated: [
+				{ from: "rateLimiter.adapter" },
+				{ from: "consentStore.adapter" },
+				{ from: "audit.sink.type" },
+			],
+		});
 	});
 });
 
@@ -220,9 +251,21 @@ describe("a variable renamed with a selection", () => {
 		"adapters.%s: %s's old variable set alone is refused, naming ADAPTERS_%s",
 		(key, name, _oldPath, oldName, value) => {
 			const err = refusal({ [oldName]: value });
-			expect(err).toBeInstanceOf(RangeError);
 			expect(err.message).toContain(`${oldName} was renamed ADAPTERS_${name}`);
 			expect(err.message).toContain(`adapters.${key}`);
+			expect(err.reason).toBe("environment-variable-renamed");
+			expect(err.details).toEqual({
+				reason: "environment-variable-renamed",
+				renamed: [
+					{
+						module: "adapters",
+						from: oldName,
+						to: `ADAPTERS_${name}`,
+						path: `adapters.${key}`,
+						state: "unset",
+					},
+				],
+			});
 		},
 	);
 
@@ -233,6 +276,8 @@ describe("a variable renamed with a selection", () => {
 			expect(err.message).toContain(oldName);
 			expect(err.message).not.toContain("old-value-5e2d");
 			expect(err.message).not.toContain("new-value-c81a");
+			expect(err.details).toMatchObject({ renamed: [{ from: oldName, state: "different" }] });
+			expect(JSON.stringify(err.details)).not.toMatch(/old-value-5e2d|new-value-c81a/);
 		},
 	);
 
@@ -277,6 +322,13 @@ describe("the modules phase one chooses by the selections", () => {
 		expect(modules).toContain(installed);
 		expect(modules).not.toContain(absent);
 	});
+
+	it("ADAPTERS_ATTEMPT_COUNTER=redis installs redis-attempt-counter over the shared Redis socket; memory installs no counter", () => {
+		const onRedis = names({ ADAPTERS_ATTEMPT_COUNTER: "redis" });
+		expect(onRedis).toContain("redis-attempt-counter");
+		expect(onRedis).toContain("redis-clients");
+		expect(names({ ADAPTERS_ATTEMPT_COUNTER: "memory" })).not.toContain("redis-attempt-counter");
+	});
 });
 
 describe("the federation-grant stores", () => {
@@ -335,24 +387,33 @@ describe("boot and the section", () => {
 	});
 
 	it.each([
-		["named adapters", "adapters", undefined],
-		["with its section at adapters.custom", "custom-thing", "adapters.custom"],
-	] as const)("refuses a module %s: its section would never reach boot", (_label, name, at) => {
+		["named adapters", "adapters"],
+		["named mfaMode", "mfaMode"],
+	] as const)("refuses a module %s: its section would never reach boot", (_label, name) => {
 		const own = readOwnLayers(ownFiles(), { env: MFA_OFF });
 		const switches = readSwitches(own);
 		const mine = defineModule({
 			name,
-			section: {
-				schema: z.object({}).passthrough().optional(),
-				...(at === undefined ? {} : { at }),
-			},
+			section: { schema: z.object({}).passthrough().optional() },
 		});
-		expect(() =>
+		const run = () =>
 			resolveForBoot(
 				own,
 				[...buildModules(switches, { environment: "production" }), mine],
 				switches,
-			),
-		).toThrow(new RegExp(`"${name}".*adapters`));
+			);
+		expect(run).toThrow(new RegExp(`"${name}".*composition root's own section`));
+		const err = (() => {
+			try {
+				run();
+			} catch (thrown) {
+				return thrown;
+			}
+		})();
+		expect(err).toBeInstanceOf(BootError);
+		expect(err).toMatchObject({
+			reason: "module-section-path-invalid",
+			details: { module: name, at: name },
+		});
 	});
 });

package/templates/standalone/src/__tests__/admission-lifecycle.test.mts

@@ -0,0 +1,87 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The oauth package's consumers of session admission read the session
+ * lifecycle's record the template's session stores provide: a session whose
+ * record is closing is refused at `/authorize`, the code exchange and the
+ * refresh grant, while its user session is still there.
+ */
+
+import type { SessionLifecycleStore, UserSessionStore } from "@o3co/auth-provider-core";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+import {
+	authorize,
+	basic,
+	codeFrom,
+	compose,
+	login,
+	redeem,
+	WEB,
+} from "./all-modules-composition.fixture.mjs";
+
+/** A JWT's claims, unverified. */
+const claimsOf = (token: string): Record<string, unknown> =>
+	JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+
+describe("a session whose lifecycle record is closing", () => {
+	it("is refused at /authorize, the code exchange and the refresh grant", async () => {
+		const { app, handle } = await compose();
+		try {
+			const components = handle.components as Record<string, unknown>;
+			const store = components.sessionLifecycleStore as SessionLifecycleStore;
+			const sessions = components.userSessionStore as UserSessionStore;
+			const { cookies } = await login(app);
+			const tokens = (await redeem(app, codeFrom(await authorize(app, cookies)))).body as Record<
+				string,
+				string
+			>;
+			const sid = String(claimsOf(tokens.id_token ?? "").sid);
+			const pendingCode = codeFrom(await authorize(app, cookies));
+
+			// The session's close commits, its work pending: the user session stays.
+			const session = await sessions.get(sid);
+			if (session === null) throw new Error("the login wrote no session");
+			expect((await store.open(sid, session.sub, session.expiresAt)).outcome).toBe("opened");
+			const closing = await store.beginClose(sid, {
+				cause: "rp_logout",
+				steps: ["held_open"],
+				perParticipant: [],
+				retainMs: 0,
+			});
+			expect(closing.outcome).toBe("closing");
+			expect(await sessions.get(sid)).not.toBeNull();
+
+			const again = await authorize(app, cookies);
+			// Sent to log in again, with no code.
+			expect(again.status).toBe(302);
+			expect(String(again.headers.location)).not.toMatch(/[?&]code=/);
+
+			expect((await redeem(app, pendingCode)).body).toMatchObject({ error: "invalid_grant" });
+
+			const refreshed = await request(app)
+				.post("/oauth/token")
+				.set("Authorization", basic(WEB))
+				.type("form")
+				.send({ grant_type: "refresh_token", refresh_token: tokens.refresh_token });
+			expect(refreshed.status).toBe(400);
+			expect(refreshed.body).toMatchObject({ error: "invalid_grant" });
+		} finally {
+			await handle.dispose();
+		}
+	});
+});

package/templates/standalone/src/__tests__/all-modules-composition.fixture.mts

@@ -31,9 +31,9 @@
  * - the refresh-token family store under `core.deployment.mode = "single"`: memory,
  *   not the shipped Redis, so the single-replica boot opens no sockets;
  * - upstream identity providers: core's fake OpenID Provider, through the
- *   `fetch` option the Google and OIDC adapters take; the config bridges'
- *   values are read as shipped (`googleFederationConfigModule`, the OIDC
- *   package's reader), with only `fetch` added;
+ *   `fetch` option the Google and OIDC federation type modules take: each is
+ *   the module `buildModules` lists, built with that option, and the entries
+ *   it handles are read as shipped;
  * - configuration with no environment form (grant connections, a key ring, a
  *   landing URL): one more HOCON layer above the shipped ones.
  *
@@ -62,12 +62,15 @@ import {
 	terminalErrorHandler,
 } from "@o3co/auth-provider-core";
 import { createFakeIdp, type FakeIdp } from "@o3co/auth-provider-core/testing";
+import { googleFederationTypeModule } from "@o3co/auth-provider-federation-google";
+import { oidcFederationTypeModule } from "@o3co/auth-provider-federation-oidc";
 import express from "express";
 import helmet from "helmet";
 import request from "supertest";
 import { beforeAll, describe, expect, it } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
 import {
+	configDefaultsFor,
 	type OwnLayers,
 	readOwnLayers,
 	readSwitches,
@@ -75,7 +78,6 @@ import {
 	resolveForBoot,
 	type Switches,
 } from "#/configPath.mjs";
-import { googleFederationConfigModule, oidcFederationConfigModule } from "#/modules.mjs";
 
 export const ISSUER = "https://auth.test";
 const OIDC_ISSUER = "https://idp.test";
@@ -109,6 +111,7 @@ export const SINGLE_ENV: Readonly<Record<string, string>> = {
 	SESSION_STORE_STORAGE_TYPE: "memory",
 	ADAPTERS_USER_SESSION_STORES: "memory",
 	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_ATTEMPT_COUNTER: "memory",
 	ADAPTERS_CODE_REPOSITORY: "memory",
 	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
 	ADAPTERS_REPLAY_SEEN_SET: "memory",
@@ -150,6 +153,8 @@ export const MULTI_ENV: Readonly<Record<string, string>> = {
 	REDIS_CLIENTS_URL: "redis://redis.test:6379",
 	ADAPTERS_USER_SESSION_STORES: "redis",
 	ADAPTERS_RATE_LIMITER: "redis",
+	// The login's attempt counter, shared: per process, `multi` refuses the login.
+	ADAPTERS_ATTEMPT_COUNTER: "redis",
 	ADAPTERS_CODE_REPOSITORY: "redis",
 	ADAPTERS_ACCESS_TOKEN_DENYLIST: "redis",
 	ADAPTERS_REPLAY_SEEN_SET: "redis",
@@ -165,19 +170,19 @@ export const CONNECTION = "calendar";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 
+const quoted = (value: string) => JSON.stringify(value);
+
 /**
- * What has no environment form — the federations' landing page, the grant
- * key ring and one grant connection — as an operator writes it: a HOCON
- * file of their own, the highest layer. Written once per process.
+ * What has no environment form — the federations' landing page and one grant
+ * connection — as an operator writes it: a HOCON file of their own, the
+ * highest layer. Written once per process.
  */
 const OPERATOR_LAYER: string = (() => {
 	const file = join(mkdtempSync(join(tmpdir(), "all-modules-composition-")), "operator.conf");
-	const quoted = (value: string) => JSON.stringify(value);
 	writeFileSync(
 		file,
 		`core.federations.google.clientUrl = ${quoted(FEDERATION_LANDING)}
 core.federations.oidc.clientUrl = ${quoted(FEDERATION_LANDING)}
-redis-federation-grant-store.encryptionKeys = [{ id = "k-test", key = ${quoted(ENCRYPTION_KEY)} }]
 federation-grants {
   connections {
     ${CONNECTION} {
@@ -201,26 +206,44 @@ function hoconFile(text: string): string {
 	return file;
 }
 
-/** The composition's own files, highest first: the operator's layer, then the shipped production ones. */
-export function ownFiles(): string[] {
+/**
+ * The Redis grant store's key ring, which has no environment form either, in
+ * a layer of its own: an operator writes it where that store is installed,
+ * since written for a store the composition does not load it reaches nothing
+ * and boot may name its section. Written once per process.
+ */
+const GRANT_KEY_RING_LAYER: string = (() => {
+	const file = join(mkdtempSync(join(tmpdir(), "all-modules-composition-")), "grant-keys.conf");
+	writeFileSync(
+		file,
+		`redis-federation-grant-store.encryptionKeys = [{ id = "k-test", key = ${quoted(ENCRYPTION_KEY)} }]\n`,
+	);
+	return file;
+})();
+
+/**
+ * The composition's own files under `env`, highest first: the operator's
+ * layers — the grant key ring among them where `env` turns federation grants
+ * on and puts their store on Redis — then the shipped production ones.
+ */
+export function ownFiles(env: Readonly<Record<string, string>> = SINGLE_ENV): string[] {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return [OPERATOR_LAYER, envConfPath, applicationConfPath];
+	const grantStoreOnRedis =
+		env.FEDERATION_GRANTS_ENABLED === "true" && env.ADAPTERS_FEDERATION_GRANT_STORE === "redis";
+	const keyRing = grantStoreOnRedis ? [GRANT_KEY_RING_LAYER] : [];
+	return [OPERATOR_LAYER, ...keyRing, envConfPath, applicationConfPath];
 }
 
 /**
- * Phase one, as `app.mts` reads it: the switches `buildModules` chooses
- * the modules by — and `reads`, what a module added to the composition reads
- * when it is built — from the composition's own files under `env` over core's
- * `reference.conf`. What the composition expects of session admission is
- * derived from it (`resolveForBoot`), after `config` adjusts it as an
- * operator's layer would.
+ * Phase one, as `app.mts` reads it: the switches `buildModules` chooses the
+ * modules by, from the composition's own files under `env` over the
+ * template's `reference.conf`.
  */
 export function resolveConfig(
 	env: Readonly<Record<string, string>>,
-	reads: readonly string[] = [],
-	own: OwnLayers = readOwnLayers(ownFiles(), { env }),
+	own: OwnLayers = readOwnLayers(ownFiles(env), { env }),
 ): Switches {
-	return readSwitches(own, { reads });
+	return readSwitches(own);
 }
 
 // ---------------------------------------------------------------------------
@@ -345,15 +368,41 @@ let upstreams: Promise<{ fakes: Upstreams; reset: () => void }> | undefined;
  * run if one did.
  */
 export async function sharedUpstreams(): Promise<Upstreams> {
+	const { fakes, reset } = await madeUpstreams();
+	reset();
+	return fakes;
+}
+
+/** The two fake upstreams, made on first use and never reset here. */
+function madeUpstreams(): Promise<{ fakes: Upstreams; reset: () => void }> {
 	upstreams ??= createUpstreams().then((fakes) => ({
 		fakes,
 		reset: resettable(fakes.oidc, fakes.google),
 	}));
-	const { fakes, reset } = await upstreams;
-	reset();
-	return fakes;
+	return upstreams;
 }
 
+/** A `fetch` that reaches the shared fake upstream `name`. */
+const upstreamFetch =
+	(name: keyof Upstreams): typeof fetch =>
+	async (input, init) =>
+		(await madeUpstreams()).fakes[name].fetch(input, init);
+
+/**
+ * The federation type modules `buildModules` lists, by name, each built as
+ * the template builds it but with a `fetch` that reaches its fake upstream.
+ */
+const UPSTREAM_TYPE_MODULES: ReadonlyMap<string, () => Module> = new Map([
+	[
+		googleFederationTypeModule().name,
+		() => googleFederationTypeModule({ fetch: upstreamFetch("google") }),
+	],
+	[
+		oidcFederationTypeModule().name,
+		() => oidcFederationTypeModule({ fetch: upstreamFetch("oidc") }),
+	],
+]);
+
 /**
  * Snapshots each fake's settings (every property that is not a function) and
  * returns what puts them back: primitives reassigned, objects restored in
@@ -432,52 +481,6 @@ async function createUpstreams(): Promise<Upstreams> {
 	};
 }
 
-/**
- * What one of the template's config bridges provides for `config`. Read
- * through a record, not the typed slot: a program that loads this file without
- * a federation package's ComponentMap augmentation (`tools/composition` does)
- * has no key to name.
- */
-const bridged = <T,>(module: Module, slot: string, config: AppConfig): T => {
-	const provider = (module.provides as Record<string, unknown> | undefined)?.[slot];
-	if (typeof provider !== "function") throw new Error(`${module.name} provides no ${slot}`);
-	return (provider as (deps: { config: AppConfig }) => T)({ config });
-};
-
-/**
- * The two federation config slots, read by the template's own bridges
- * (`oidcFederationConfigModule`, `googleFederationConfigModule`), with each
- * adapter's `fetch` pointed at its fake upstream. Only for the federations the
- * config enables — which is when `buildModules` lists the bridges.
- */
-async function federationOverrides(
-	config: Switches,
-	upstreams: Upstreams,
-): Promise<Record<string, unknown>> {
-	const overrides: Record<string, unknown> = {};
-	const modules = buildModules(config).map((m) => m.name);
-	if (modules.includes(oidcFederationConfigModule.name)) {
-		const oidc = bridged<Record<string, object>>(
-			oidcFederationConfigModule,
-			"oidcFederationConfigs",
-			config,
-		);
-		overrides.oidcFederationConfigs = Object.fromEntries(
-			Object.entries(oidc).map(([name, entry]) => [
-				name,
-				{ ...entry, fetch: upstreams.oidc.fetch },
-			]),
-		);
-	}
-	if (modules.includes(googleFederationConfigModule.name)) {
-		overrides.googleFederationConfig = {
-			...bridged<object>(googleFederationConfigModule, "googleFederationConfig", config),
-			fetch: upstreams.google.fetch,
-		};
-	}
-	return overrides;
-}
-
 // ---------------------------------------------------------------------------
 // Logger spy
 // ---------------------------------------------------------------------------
@@ -588,30 +591,24 @@ export interface ComposeOptions {
 	readonly environment?: string;
 	/** HOCON an operator writes above the composition's own files, read in both phases. */
 	readonly operatorHocon?: string;
-	/**
-	 * Paths read before boot beside the template's switches: what a module
-	 * `extraModules` adds reads when it is built (`readSwitches`'s `reads`).
-	 */
-	readonly reads?: readonly string[];
 	/** The deployment's own mail sender modules, handed to `buildModules` as `mailSenderModules`. */
 	readonly mailSenderModules?: readonly Module[];
 	/** Modules added after the template's own, before the order and the outage apply. */
 	readonly extraModules?: (config: Switches) => readonly Module[];
-	/** Components laid over the boot's, beside the federation config slots. */
+	/** Components laid over the boot's (`overrideComponents`). */
 	readonly extraOverrides?: (config: Switches) => Record<string, unknown>;
 	/** Client registrations beside the fixture's own, as `ClientEntrySchema` input. */
 	readonly extraClients?: Readonly<Record<string, Record<string, unknown>>>;
 	/** Users beside the fixture's own, keyed by username. */
 	readonly extraUsers?: Readonly<Record<string, Record<string, unknown>>>;
 	/**
-	 * Adjust the configuration before anything reads it, as an operator's own
-	 * layer would: applied to phase one's switches, and to what `createApp` is
-	 * handed, as resolved.
+	 * Adjust what `createApp` is handed, as resolved, as an operator's own
+	 * layer would.
 	 */
-	readonly config?: (config: Switches) => Switches;
+	readonly config?: (config: AppConfig) => AppConfig;
 	/**
-	 * Adjust phase one's switches alone, after `config`: what only phase one
-	 * reads, such as the Store transport settings a hand-built root passes.
+	 * Adjust phase one's switches: what only phase one reads, such as the
+	 * Store transport settings a hand-built root passes.
 	 */
 	readonly switches?: (switches: Switches) => Switches;
 	readonly order?: ModuleOrder;
@@ -639,7 +636,7 @@ export function composedModules(config: Switches, options: ComposeOptions = {}):
 			...(options.shippedRefreshTokenFamilyStore
 				? {}
 				: { refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule] }),
-		}),
+		}).map((module) => UPSTREAM_TYPE_MODULES.get(module.name)?.() ?? module),
 		...(options.extraModules?.(config) ?? []),
 	];
 	if (options.outage) modules = withOutage(modules, options.outage.slot, options.outage.outage);
@@ -667,35 +664,32 @@ export interface Composition {
  */
 export async function compose(options: ComposeOptions = {}): Promise<Composition> {
 	const env = options.env ?? SINGLE_ENV;
-	const adjust = <C extends AppConfig>(config: C): C =>
-		options.config ? (options.config(config as unknown as Switches) as unknown as C) : config;
 	// The composition's own layers, read once for both phases, as `app.mts`
 	// reads them. Phase one: the switches the modules are chosen by.
 	const own = readOwnLayers(
 		options.operatorHocon === undefined
-			? ownFiles()
-			: [hoconFile(options.operatorHocon), ...ownFiles()],
+			? ownFiles(env)
+			: [hoconFile(options.operatorHocon), ...ownFiles(env)],
 		{ env },
 	);
-	const switches = resolveConfig(env, options.reads, own);
-	const config = options.switches ? options.switches(adjust(switches)) : adjust(switches);
+	const switches = resolveConfig(env, own);
+	const config = options.switches ? options.switches(switches) : switches;
 	const fakes = await sharedUpstreams();
 	const modules = composedModules(config, options);
 	const logger = createRecordingLogger();
 	// Phase two: the configuration as resolved over every loaded package's
-	// reference.conf, which createApp parses once.
-	const resolved = adjust(resolveForBoot(own, modules, config));
+	// reference.conf, which createApp parses once, and its defaults.
+	const forBoot = resolveForBoot(own, modules, config);
+	const resolved = options.config ? options.config(forBoot) : forBoot;
 	const handle = await createApp({
 		modules,
 		bootstrapComponents: {
 			config: resolved,
+			configDefaults: configDefaultsFor(modules),
 			pathResolver: (s) => s,
 			logger,
 		},
-		overrideComponents: {
-			...(await federationOverrides(config, fakes)),
-			...options.extraOverrides?.(config),
-		} as never,
+		overrideComponents: { ...options.extraOverrides?.(config) } as never,
 	});
 	const parsed = handle.components.config;
 	if (parsed === undefined) throw new Error("createApp booted without the parsed configuration");
@@ -1056,6 +1050,11 @@ export interface OutageCase<C extends Composition = Composition> {
 	readonly storeFieldNotRequired?: string;
 	/** The predicates the composition breaks today, each naming its defect. */
 	readonly defects?: Partial<Record<OutagePredicate, string>>;
+	/**
+	 * The warn lines a `no-warn` defect writes, pinned exactly while it stands,
+	 * so the defect covers those lines and no other.
+	 */
+	readonly defectWarns?: readonly string[];
 }
 
 /** The same defect text for every predicate that depends on the one missing line. */
@@ -1086,6 +1085,14 @@ export function describeOutages<C extends Composition>(
 ): void {
 	describe(title, () => {
 		for (const c of cases) {
+			if (
+				c.defectWarns !== undefined &&
+				(c.defects?.["no-warn"] === undefined || c.defectWarns.length === 0)
+			) {
+				throw new Error(
+					`${c.module}: ${c.slot} down at ${c.surface}: defectWarns pins the lines of a no-warn defect, so it needs defects["no-warn"] and at least one line`,
+				);
+			}
 			describe(`${c.module}: ${c.slot} down at ${c.surface}`, () => {
 				let res: request.Response;
 				let lines: LogLine[] = [];
@@ -1165,13 +1172,20 @@ export function describeOutages<C extends Composition>(
 					expect(err).toMatchObject({ name: expect.any(String) });
 					expect(err).not.toBeInstanceOf(Error);
 				});
-				check("no-warn", "writes no warn line for it", () => {
-					const warns = lines
+				const outageWarns = () =>
+					lines
 						.filter((line) => line.level === "warn")
 						.map((line) => (typeof line.args[1] === "string" ? line.args[1] : String(line.args[0])))
 						.filter((event) => !(c.unrelatedWarns ?? []).includes(event));
-					expect(warns).toEqual([]);
+				check("no-warn", "writes no warn line for it", () => {
+					expect(outageWarns()).toEqual([]);
 				});
+				if (c.defectWarns !== undefined) {
+					const pinned = c.defectWarns;
+					it(`writes exactly the warn lines its no-warn defect names: ${pinned.join(", ")}`, () => {
+						expect(outageWarns()).toEqual(pinned);
+					});
+				}
 			});
 		}
 	});