@o3co/create-auth-provider 0.17.0-rc.3 → 0.17.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-provider",
-  "version": "0.17.0-rc.3",
+  "version": "0.17.0-rc.4",
   "description": "Scaffold a new o3co/auth.provider project from one of its templates",
   "license": "Apache-2.0",
   "type": "module",
@@ -29,9 +29,9 @@
   },
   "devDependencies": {
     "@o3co/ts.hocon": "^1.13.0",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "typescript": "^6.0.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   },
   "scripts": {
     "build": "tsc",

package/templates/standalone/README.ja.md

@@ -1,6 +1,6 @@
 # @o3co/auth-provider-standalone
 
-最終更新: 2026-10-06
+最終更新: 2026-10-07
 
 auth.provider のデプロイ可能なサーバーテンプレート。これは composition root であり、設定を読み込み、モジュールをロードし、Express サーバーを起動する。`@o3co/create-auth-provider` で生成される。
 
@@ -465,6 +465,8 @@ core.federations {
 | `REPOSITORIES_USER_HTTP_TIMEOUT` | `5000` | HTTP リクエストタイムアウト（ミリ秒）。`2147483647` 以下の正の整数 |
 | `REPOSITORIES_USER_HTTP_MAX_RESPONSE_BYTES` | `1048576` | 上流レスポンスボディの受け入れ上限（バイト） |
 
+**`yaml` のユーザーファイル**はユーザー名をキーとし、各エントリは `password` と、任意で `id`（無ければユーザー名）とクレームを持つ。パスワードは平文か bcrypt ハッシュ: `$2` で始まるものはハッシュとして読み、コスト 04 から 15 の整った `$2a$`・`$2b$`・`$2y$` ハッシュ（`$2y$` は `$2b$` として比較する）でなければならない（比較 1 回は、コスト 15 で約 2 秒、10 で約 60 ms、Node の libuv スレッドプールの 1 スレッドを使う）。`$2b$` と `$2y$` はパスワードの先頭 72 バイト（UTF-8 の日本語で約 24 文字）しか比較しない。`$2a$` は 254 バイトまでのパスワードでは同じ 72 バイトを読むが、それより長いものは長さを 256 で割った余りとして数えるため、255 バイト以上のパスワードは別のパスワードとして比較されることがある。新しいエントリには `$2b$` を使う。平文のエントリは全長で比較する。bcrypt エントリはすべて一つのコストを使う。これらの規則に反するパスワード、複数のコストにまたがる bcrypt エントリ（コストを名指しする）、空の `id` やユーザー名、同じ id を持つ二人のユーザー、エントリ内の `username` キーは、フィールドと、ユーザーかコストを名指しし、値は出さずに起動時に拒否される。`yaml` バックエンドで起動するたびに、環境を問わず `user_repository_in_memory` をテンプレートのロガーに warn で記録する（`LOGGING_LEVEL` が効く）: ユーザーファイルは開発とテスト用である。[core パッケージの README](../../packages/core/README.ja.md#yaml-からクライアントとユーザーを読み込む) を参照。
+
 ユーザー認証 URL は 2 つとも上流ストアへ**平文のユーザー資格情報**を運ぶため、いずれも絶対 `https://` URL でなければならない。`http://` は loopback ホスト（`localhost`、`127.0.0.0/8` 内のアドレス、`[::1]`）に限って許可され、ローカル開発で証明書を用意せずに済むようにしている。プライベートレンジのアドレス（`http://10.0.0.5/…`）やコンテナネットワークのサービス名（`http://user-service/…`）には依然として `https://` が必要 — これらはデプロイが端から端まで制御していないネットワークを越えるため。URL のどちらか、タイムアウト、レスポンス上限のいずれかが使えない値なら、最初のログイン時ではなく起動時に失敗する。
 
 各 URL には、リダイレクトするエンドポイントではなく応答するエンドポイントを設定する: どのリクエストも `3xx` を追わないので、リダイレクトする URL ではすべての呼び出しが失敗する — [Store が自分で守るべきこと](../../packages/foundation/README.ja.md#store-が自分で守るべきこと) を参照。

package/templates/standalone/README.md

@@ -1,6 +1,6 @@
 # @o3co/auth-provider-standalone
 
-Last updated: 2026-10-06
+Last updated: 2026-10-07
 
 Deployable server template for auth.provider. This is the composition root — it reads config, loads modules, and starts the Express server. Generated by `@o3co/create-auth-provider`.
 
@@ -751,6 +751,26 @@ and the production compose file mounts it (see [Docker](#docker)).
 | `REPOSITORIES_USER_HTTP_TIMEOUT` | `5000` | HTTP request timeout in milliseconds. Positive integer ≤ `2147483647` |
 | `REPOSITORIES_USER_HTTP_MAX_RESPONSE_BYTES` | `1048576` | Largest upstream response body accepted, in bytes |
 
+**The `yaml` users file** is keyed by username; each entry holds `password`,
+and optionally `id` (the username when absent) and claims. A password is plain
+text, or a bcrypt hash: anything starting with `$2` is read as one, and must be
+a well-formed `$2a$`, `$2b$` or `$2y$` hash (the last compared as `$2b$`) at a
+cost from 04 to 15 (a compare at 15 takes about 2 s, at 10 about 60 ms, on a
+thread of Node's libuv pool). `$2b$` and `$2y$` compare only the first 72
+bytes of a password (about 24 Japanese characters in UTF-8). `$2a$` reads the
+same 72 bytes of a password up to 254 bytes long, but counts a longer one's
+length modulo 256, so a password of 255 bytes or more can compare as a
+different one; use `$2b$` for new entries. A plain-text entry is compared over
+its full length.
+Every bcrypt entry uses one cost. Boot refuses a password that breaks these
+rules, bcrypt entries at more than one cost (naming the costs), an empty `id`
+or username, two users with the same id, and a `username` key inside an entry,
+naming the field and the user or the costs, never a value. Each start with the `yaml` backend logs
+`user_repository_in_memory` at warn on the template's logger (`LOGGING_LEVEL`
+applies), whatever the environment: the users file is meant for development
+and tests. See
+[the core package's README](../../packages/core/README.md#loading-clients-and-users-from-yaml).
+
 Both user-authentication URLs carry **plaintext user credentials** to the
 upstream store, so both must be absolute `https://` URLs. `http://` is accepted
 only for a loopback host — `localhost`, an address in `127.0.0.0/8`, or `[::1]`

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-provider-standalone",
-	"version": "0.17.0-rc.3",
+	"version": "0.17.0-rc.4",
 	"private": true,
 	"license": "Apache-2.0",
 	"engines": {
@@ -37,19 +37,19 @@
 		"express-session": "^1.19.0",
 		"helmet": "^8.3.0",
 		"ioredis": "^6.0.0",
-		"pino": "^10.3.1",
+		"pino": "^10.4.0",
 		"prom-client": "^15.1.3",
-		"redis": "^6.2.1",
+		"redis": "^6.3.0",
 		"zod": "^4.6.5"
 	},
 	"devDependencies": {
 		"@types/express": "^5.0.6",
 		"@types/express-session": "^1",
-		"@types/node": "^26.6.3",
+		"@types/node": "^26.6.4",
 		"@types/supertest": "^7.2.1",
-		"supertest": "^7.3.0",
+		"supertest": "^7.3.1",
 		"tsx": "^4.23.15",
 		"typescript": "^6.0.3",
-		"vitest": "^5.0.2"
+		"vitest": "^5.0.3"
 	}
 }

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -139,7 +139,6 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	OAUTH_SESSION_ENABLED: "false",
 	OAUTH_AUTHORIZATION_GRANTS_AUTHORIZATION_CODE_ENABLED: "true",
 	OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_ENABLED: "true",
-	OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY: "reject",
 	OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED: "true",
 	OAUTH_AUTHORIZATION_GRANTS_JWT_BEARER_ENABLED: "false",
 
@@ -341,7 +340,9 @@ const DELIBERATELY_UNSET: Readonly<Record<string, string>> = {
 	OAUTH_GRANTS_REFRESH_TOKEN_ENABLED:
 		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY, and only captured — set at any value, beside its new name or not, it fails boot",
+		"the variable of a removed key, and only captured — any value fails boot",
+	OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY:
+		"the variable of a removed key, and only captured — any value fails boot",
 	OAUTH_GRANTS_CLIENT_CREDENTIALS_ENABLED:
 		"renamed OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_JWT_BEARER_ENABLED:

package/templates/standalone/src/__tests__/logout-session-cookie.test.mts

@@ -0,0 +1,113 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template's two logout endpoints and the session cookie: the session
+ * store module expires the cookie of a session destroyed during the request,
+ * whichever route destroyed it, so `POST /oauth/logout` — whose package knows
+ * no cookie name — and `POST /session/logout` both answer with the cookie
+ * expired, with the attributes the login set it with.
+ */
+
+import type { SessionCookiePolicy } from "@o3co/auth-provider-core";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+import { authorize, codeFrom, compose, login, redeem } from "./all-modules-composition.fixture.mjs";
+
+/** The `Set-Cookie` lines among `lines` for the cookie `name`. */
+const linesNamed = (lines: readonly string[], name: string): string[] =>
+	lines.filter((line) => line.startsWith(`${name}=`));
+
+/** A response's `Set-Cookie` lines. */
+const setCookies = (res: request.Response): string[] =>
+	([] as string[]).concat(res.headers["set-cookie"] ?? []);
+
+/** A `Set-Cookie` line's attributes, lower-cased, with its value and expiry left out. */
+const attributesOf = (line: string): string[] =>
+	line
+		.split(";")
+		.slice(1)
+		.map((part) => part.trim().toLowerCase())
+		.filter((part) => !part.startsWith("expires=") && !part.startsWith("max-age="))
+		.sort();
+
+/** The CSRF token a login reissued, read off its double-submit cookie. */
+const csrfTokenOf = (cookies: readonly string[]): string => {
+	const cookie = cookies.find((c) => /^[^=]*\.csrf=/.test(c));
+	if (cookie === undefined) throw new Error("the login reissued no CSRF cookie");
+	return decodeURIComponent(cookie.slice(cookie.indexOf("=") + 1).split(";")[0] ?? "");
+};
+
+/**
+ * The one `Set-Cookie` line of `res` for the session cookie, checked to
+ * expire it with the attributes of `setLine`, the line the login set it with.
+ */
+function expectExpired(res: request.Response, name: string, setLine: string): void {
+	const lines = linesNamed(setCookies(res), name);
+	expect(lines).toHaveLength(1);
+	const [line] = lines as [string];
+	expect(line.startsWith(`${name}=;`)).toBe(true);
+	expect(line).toContain("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
+	expect(attributesOf(line)).toEqual(attributesOf(setLine));
+}
+
+describe("the session cookie at the template's logout endpoints", () => {
+	it("POST /oauth/logout expires the session cookie, with the attributes the login set it with", async () => {
+		const { app, handle } = await compose();
+		try {
+			const policy = handle.components.sessionCookiePolicy as SessionCookiePolicy;
+			const { res: signedIn, cookies } = await login(app);
+			expect(signedIn.status).toBe(200);
+			const [setLine] = linesNamed(cookies, policy.name);
+			expect(setLine).toBeDefined();
+			const tokens = await redeem(app, codeFrom(await authorize(app, cookies)));
+			expect(tokens.status).toBe(200);
+
+			const res = await request(app)
+				.post("/oauth/logout")
+				.set("Cookie", cookies)
+				.type("form")
+				.send({ id_token_hint: tokens.body.id_token as string });
+
+			expect(res.status).toBe(200);
+			expect(res.body).toEqual({ logged_out: true });
+			expectExpired(res, policy.name, setLine as string);
+		} finally {
+			await handle.dispose();
+		}
+	});
+
+	it("POST /session/logout expires the session cookie, with the attributes the login set it with", async () => {
+		const { app, handle } = await compose();
+		try {
+			const policy = handle.components.sessionCookiePolicy as SessionCookiePolicy;
+			const { res: signedIn, cookies } = await login(app);
+			expect(signedIn.status).toBe(200);
+			const [setLine] = linesNamed(cookies, policy.name);
+			expect(setLine).toBeDefined();
+
+			const res = await request(app)
+				.post("/session/logout")
+				.set("Cookie", cookies)
+				.set("x-csrf-token", csrfTokenOf(cookies));
+
+			expect(res.status).toBe(200);
+			expectExpired(res, policy.name, setLine as string);
+		} finally {
+			await handle.dispose();
+		}
+	});
+});

package/templates/standalone/src/__tests__/repositories-logger.test.mts

@@ -0,0 +1,119 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The repositories module builds its user repository with the composition's
+ * logger: the yaml user builder's `user_repository_in_memory` line reaches the
+ * `logger` bootstrap component (the template's pino logger, at its level),
+ * not the console.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	type BootstrapMap,
+	createApp,
+	defineModule,
+	type Logger,
+	type UserRepository,
+} from "@o3co/auth-provider-core";
+import {
+	CORE_RELOCATIONS,
+	makeValidCoreConfig,
+	renamedVariableCaptures,
+} from "@o3co/auth-provider-core/testing";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { repositoriesModuleFor } from "../modules.mjs";
+
+const spyLogger = () => {
+	const logger = {
+		trace: vi.fn(),
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn: vi.fn(),
+		error: vi.fn(),
+		fatal: vi.fn(),
+		child: vi.fn(),
+	};
+	logger.child.mockReturnValue(logger);
+	return logger;
+};
+
+describe("the repositories module's user repository", () => {
+	let dir: string;
+	beforeEach(() => {
+		dir = fs.mkdtempSync(path.join(os.tmpdir(), "repositories-logger-"));
+	});
+	afterEach(() => {
+		fs.rmSync(dir, { recursive: true, force: true });
+		vi.restoreAllMocks();
+	});
+
+	it("warns user_repository_in_memory on the composition's logger, built through createApp, and not on the console", async () => {
+		const usersPath = path.join(dir, "users.yaml");
+		fs.writeFileSync(usersPath, 'alice:\n  password: "plainpass"\n');
+		const clientsPath = path.join(dir, "clients.yaml");
+		fs.writeFileSync(clientsPath, "");
+		const consoleWarn = vi.spyOn(console, "warn").mockImplementation(() => {});
+		const logger = spyLogger();
+		let built: UserRepository | undefined;
+		const reader = defineModule({
+			name: "test:user-repository-reader",
+			requires: ["userRepository"] as const,
+			provides: {
+				userRepositoryRead: ({ userRepository }: { userRepository: UserRepository }) => {
+					built = userRepository;
+					return true;
+				},
+			},
+			lifecycle: { userRepositoryRead: { eager: true } },
+		} as never);
+
+		const repositories = repositoriesModuleFor({ client: "yaml", user: "yaml" });
+		const handle = await createApp({
+			modules: [repositories, reader],
+			bootstrapComponents: {
+				config: {
+					...makeValidCoreConfig(),
+					repositories: {
+						client: { yaml: { path: clientsPath } },
+						user: { yaml: { path: usersPath }, http: {} },
+					},
+					// What a resolution with none of the renamed variables set captures.
+					"renamed-variables": renamedVariableCaptures({
+						modules: [repositories],
+						core: CORE_RELOCATIONS,
+						env: {},
+					}),
+				},
+				pathResolver: (p: string) => p,
+				logger: logger as unknown as Logger,
+			} as unknown as BootstrapMap,
+		});
+		try {
+			expect((await built?.authenticate("alice", "plainpass"))?.username).toBe("alice");
+			expect(
+				logger.warn.mock.calls.filter(([, event]) => event === "user_repository_in_memory"),
+			).toEqual([[{ store: "userRepository", adapter: "yaml" }, "user_repository_in_memory"]]);
+			expect(
+				consoleWarn.mock.calls.filter((args) => args.includes("user_repository_in_memory")),
+			).toEqual([]);
+		} finally {
+			await handle.dispose();
+		}
+	});
+});

package/templates/standalone/src/modules.mts

@@ -240,7 +240,10 @@ export function repositoriesModuleFor(selection: RepositorySelection): Module {
 		// Forwarded into the repository factories so client/user adapters can
 		// register disposal callbacks (file-watch closers, say). Without it, a
 		// builder's `ctx.lifecycle?.register` is a no-op and those resources leak.
-		optional: ["lifecycleRegistrar"] as const,
+		// The logger is the composition's, so what a builder logs (the yaml user
+		// repository's `user_repository_in_memory`) goes where the template's
+		// logging goes, at its level, rather than to the console.
+		optional: ["lifecycleRegistrar", "logger"] as const,
 		provides: {
 			clientRepository: async ({ section, lifecycleRegistrar }) => {
 				const { clientFactory } = createRepositoryFactories({ lifecycle: lifecycleRegistrar });
@@ -250,8 +253,11 @@ export function repositoriesModuleFor(selection: RepositorySelection): Module {
 					path: path.resolve(process.cwd(), file.path),
 				});
 			},
-			userRepository: async ({ section, lifecycleRegistrar }) => {
-				const { userFactory } = createRepositoryFactories({ lifecycle: lifecycleRegistrar });
+			userRepository: async ({ section, lifecycleRegistrar, logger }) => {
+				const { userFactory } = createRepositoryFactories({
+					lifecycle: lifecycleRegistrar,
+					logger,
+				});
 				registerBuiltinAdapters({ userFactory });
 				return userFactory.create(
 					flattenAdapterConfig({

package/templates/standalone/tests/package-lock.json

@@ -12,7 +12,7 @@
 				"jsonwebtoken": "^9.0.3"
 			},
 			"devDependencies": {
-				"vitest": "^5.0.2"
+				"vitest": "^5.0.3"
 			}
 		},
 		"node_modules/@jridgewell/resolve-uri": {
@@ -44,9 +44,9 @@
 			}
 		},
 		"node_modules/@oxc-project/types": {
-			"version": "0.151.0",
-			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.151.0.tgz",
-			"integrity": "sha512-J1yXrIlNDZVzE3ada310xeAw7nH8yCAyLPuUIsjKatFPmfn5bS1oW+cM+QsGOtVWd5nhSpbwZWx/rue+r5Z+PA==",
+			"version": "0.152.0",
+			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.152.0.tgz",
+			"integrity": "sha512-oM/5rLBm2tPkg0iBgkH/FOeR3PCDpY19GTgAZjMFM8h9WI9VW7cLgzp6nwtarYKmovavIQZ+Fe/RKX/8C8O/Rw==",
 			"dev": true,
 			"license": "MIT",
 			"peer": true,
@@ -55,9 +55,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-android-arm-eabi": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.11.tgz",
-			"integrity": "sha512-A5kXfGKvKWWZE0TtPrfsvT+q4Y5d1QG8gGUzpYjGydM+fARM9MuX90PrXYXe0XbsDVgyxxNzHo6giCj90bsFNw==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.12.tgz",
+			"integrity": "sha512-dB/a1214qKfHMXCpgqR4OZT+jS4kTyEXbQGJPqzobt5EwH5rX080pxE37alt3RzvR1bf1Yz/yGqRfrYAxuPw0A==",
 			"cpu": [
 				"arm"
 			],
@@ -73,9 +73,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-android-arm64": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.11.tgz",
-			"integrity": "sha512-z6cTycz+iJ4PVkuL4HHW4DfTfoeU/2nqYYuSOrTmH7yHK5Y0LCOnA03V4ZNxavyVaU1oOqUgIg2klN/s+USGOA==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.12.tgz",
+			"integrity": "sha512-7KHFgQ5VJxIHcLlrwrc3Xbds7oTNQT7Pgi9gQCJKrd2VGab/UksIOYp6VD8MzCstGxOKMgNamPwUCfxPdP1OHg==",
 			"cpu": [
 				"arm64"
 			],
@@ -91,9 +91,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-darwin-arm64": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.11.tgz",
-			"integrity": "sha512-jShvqNtP6vDC6/A5JOAzbVV+DkgHqhl/ScVCJEbt+TUY6QYz7YnXcrg3sLtFBniro0f/Ld50ZwCWA6f7KYD1nQ==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.12.tgz",
+			"integrity": "sha512-3YIhqHD96nA5SaYNRBR16HnGv4oavZvXfD/ayHM+oYZ0WD/8lBAtf6zQua4kEyAvpqrluKXl0lnOBoiNby7x9w==",
 			"cpu": [
 				"arm64"
 			],
@@ -109,9 +109,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-darwin-x64": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.11.tgz",
-			"integrity": "sha512-f2i2xiNWq1Z1l2++q2fuhZRdLAT3aqxD6vRNm1RAxpUoBcdqNB3C0s1Bt+K+PbEx2F5F4gQp6hqKkphCY/xF9w==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.12.tgz",
+			"integrity": "sha512-UuuJ35MFw4gmFOrE9pEqIV+K3syIKveph+Qc1/ljHZVdoDW4pz/JHR/eMVom+TZGl/5OOvGJOWaOCVt3ZfqhxA==",
 			"cpu": [
 				"x64"
 			],
@@ -127,9 +127,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-freebsd-x64": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.11.tgz",
-			"integrity": "sha512-4Ir5FSOKIAMr4r0kExpt1s3bMgzJU3rA45AYOHtQpls0oNeqcYBKrWMlckrYH4KCfGLfkfn1tN1dmZPMVsdXow==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.12.tgz",
+			"integrity": "sha512-uMvssit0a4W+/7D8CbHUvG719mH3R2jwXAlh/XcPvuHTE0g++LymF88DCGNX0HM2rBOn0xrzgXktIB6fLSJBTQ==",
 			"cpu": [
 				"x64"
 			],
@@ -145,9 +145,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.11.tgz",
-			"integrity": "sha512-/gnRDM+39BROzAN/k1OZjDPnDMcZxB/0EUxKjONO5yVkNEvlsoMDrxGNKgZi/ttFriS2gwlDNzB65pvNbFOXIQ==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.12.tgz",
+			"integrity": "sha512-XcFu0R0xWnwzSf4IQgFH1rJIckPN1pLy2R+4r9IDB7Yfu/ys9cVqfa4pBrMHj7a3gl8mIR4nRNPg0e5IvEVs6g==",
 			"cpu": [
 				"arm"
 			],
@@ -163,9 +163,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm64-gnu": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.11.tgz",
-			"integrity": "sha512-PFaK8HwvAHbaKbBcDNQihjMKYvFnA5hiENx/l5tphTDz1E0WFp32l0A7aq7lyUwGsRw/xSrNIy/gIK4thrSCrw==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.12.tgz",
+			"integrity": "sha512-260UrKgn8tz39ak+SMDOirKzr7V04M9dWPw5llW00SwBivCZoWcRBKV1d8cXnRkUmSZA3BdiUmBHWk7734Ulpw==",
 			"cpu": [
 				"arm64"
 			],
@@ -184,9 +184,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm64-musl": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.11.tgz",
-			"integrity": "sha512-AskzJUIKRLPxkruR1wLKewGbOw+EYfU/9lOrBFj4AFrEA8hPpKFnODWNu2WLaNs0QNkEb9QIJufmVZZIL/bJlg==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.12.tgz",
+			"integrity": "sha512-5YK1I9SqDkbPgc1IA8BgDl34suqUS2q0KWnBrirm0E51YjOs6eo6dV6jbQfNE/argHRSvd0QUGgtpIoYx+WWpw==",
 			"cpu": [
 				"arm64"
 			],
@@ -205,9 +205,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-ppc64-gnu": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.11.tgz",
-			"integrity": "sha512-qlUGAheh2yh8afH7QBgx0PrRHN85hKnNd78x8MeMhXivuevgd8vgf6/CstOzmNKY/lLTHvNTrPy98cLnAugzJw==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.12.tgz",
+			"integrity": "sha512-Rkcrmp7eFRg74yL5fXEU91JEWbdEPLevWwGtXpmhbjlD1StScbWTmO94Bhly+Mo+ketKYkdmM1vNUKeWSlx8cQ==",
 			"cpu": [
 				"ppc64"
 			],
@@ -226,9 +226,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-s390x-gnu": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.11.tgz",
-			"integrity": "sha512-secpEad+0vCbSfn8upFySkDskv+bGPk3THSDS9Y89yc4rb4kzqHp8Dmyd9BkQW4SnhNXBZCl/6CrO//hZahNJQ==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.12.tgz",
+			"integrity": "sha512-qvK4DuAsQc2BSjlx+Xr+IzOIvvxbGZqxFwdWfG6F518Erj0GGISyQbJ6pIappnOxlNPzNHvo/L0BwB30GZ+zVw==",
 			"cpu": [
 				"s390x"
 			],
@@ -247,9 +247,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-x64-gnu": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.11.tgz",
-			"integrity": "sha512-mOVBT3dPpkWm8XBWPmU4bf+U6dYDLeMo/9ojUmis4N0L5uu10qra5vOyngZ7/PSdoE4G9KvRt4bloRxNjLas7A==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.12.tgz",
+			"integrity": "sha512-Q9uLBO53Xd4QIq1WOycVQyPP1O4HhraEV2qqb3uTrnVw6QZih9duY4vNXOivL1xoUS1/z+W8eF4NMfl2a8Sdjw==",
 			"cpu": [
 				"x64"
 			],
@@ -268,9 +268,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-x64-musl": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.11.tgz",
-			"integrity": "sha512-Is78i9A8Ui4SqcxUwFJ9uMmjDn58IbVTjFWYdQestFEgeuEmHMLGNriXnVJKkwG2YiZjw8cP0zCTyDMdDGtOOg==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.12.tgz",
+			"integrity": "sha512-3IBxWFMjbOZskDPKv8Lf9BCnahlKuHthWkYnyIxOH/QcJrFcS4EmcenthApkwr/5+nEqZlLzeYbxeMaX7A5u4g==",
 			"cpu": [
 				"x64"
 			],
@@ -289,9 +289,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-openharmony-arm64": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.11.tgz",
-			"integrity": "sha512-dUCXneZ87INUMyQ0D+C0HrEBNUPNXHaPmU5GTjyKTJEiussw9Kaj5Ln8UztPe4epV/ffvgNBEadksdYhmW6xJA==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.12.tgz",
+			"integrity": "sha512-xtX61xg4LKPkPWilZU1ynKClz5Gj4bf74LML4r3eVLWumKnGjoEr1OSHQhMdbBDoYTi+yjrujvpZe2pUnqCrrA==",
 			"cpu": [
 				"arm64"
 			],
@@ -307,9 +307,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-win32-arm64-msvc": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.11.tgz",
-			"integrity": "sha512-jByxb6qfd+bH1xUd0qnfFnb17i9sWBPY2tOavJ0l3tdr3OTu+Kvtm8cd/JV5nFt657b1VqGltxg9olOEfofXWw==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.12.tgz",
+			"integrity": "sha512-At7fPB6PCaIjzgIhEZFxuT+BBFqiQibJDT4d3PhiR3f4E7bbMZF4aKblbFfEM3sETRDd1YiQx/+U/g/B/ou5Ew==",
 			"cpu": [
 				"arm64"
 			],
@@ -325,9 +325,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-win32-x64-msvc": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.11.tgz",
-			"integrity": "sha512-/PzKqzAJ03i19oy2ItPvyvaVjOjBCNnfaJs8yvUdGBKmiESgnrJSQ2awd81QzFbbnAmu7YO9ZnJrDCb9VSJPRA==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.12.tgz",
+			"integrity": "sha512-WIw2haVKwjuYdXkHaoC0mF8Le71TuCBxjrdKqLbJGctbBABj+ClfmNvtbOnzpq3RokNo5+V1qhtSzJyXorsklQ==",
 			"cpu": [
 				"x64"
 			],
@@ -376,14 +376,14 @@
 			"license": "MIT"
 		},
 		"node_modules/@vitest/mocker": {
-			"version": "5.0.2",
-			"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.2.tgz",
-			"integrity": "sha512-Z5FS00Q1SJHkB35xATsmWGdQ5WA1/0MV3CDjqyv7GavHv1OfOj145MNfHOlHk7QLes21dKFDHr8EO2zvL+9WGA==",
+			"version": "5.0.3",
+			"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.3.tgz",
+			"integrity": "sha512-T8sWAIbkSyAjkwTcaEc3Iu0o9A27X1/kdXrizhZkGuSKScRQtRzclfAMpOTcGdXCsqxeWlpGy3XjqaW8CpLORg==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@jridgewell/trace-mapping": "0.3.31",
-				"@vitest/spy": "5.0.2",
+				"@vitest/spy": "5.0.3",
 				"estree-walker": "^3.0.3",
 				"magic-string": "^1.2.3"
 			},
@@ -404,9 +404,9 @@
 			}
 		},
 		"node_modules/@vitest/spy": {
-			"version": "5.0.2",
-			"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.2.tgz",
-			"integrity": "sha512-Ijc7T1nT9efNb5LxvjaBrEqw3f/QwUv5EE0nKqZxgqsaV/FxAAZ8baGylA8X/Z2oS4Lp+K74Jr6dTJsDKxJDeg==",
+			"version": "5.0.3",
+			"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.3.tgz",
+			"integrity": "sha512-XhFysQTB8AZ+P4gMi+Lpo99vg2AZi0qKpaB9yXQl37+CaMEAPO3iH/wGVnSyL5MPERiLezpqTVtrR6UZH5GCXg==",
 			"dev": true,
 			"license": "MIT",
 			"funding": {
@@ -1317,14 +1317,14 @@
 			}
 		},
 		"node_modules/rolldown": {
-			"version": "1.2.11",
-			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.11.tgz",
-			"integrity": "sha512-qpSwIyz0jHQq5qXBTNxFmE6664rJ7O+4TvPFOiOaBSrz8IOHc1koKKSqTM2H6u1UG1+TveuC6vaDHKXFOvb1Kw==",
+			"version": "1.2.12",
+			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.12.tgz",
+			"integrity": "sha512-8wafseiaG80xmXSfqidUNqZcylTlhmPZZt+za2m+js2sFZ8dTNlhIOV2WcbIPx2hgwPBJpEUGFAMZ9bgBBLTSQ==",
 			"dev": true,
 			"license": "MIT",
 			"peer": true,
 			"dependencies": {
-				"@oxc-project/types": "=0.151.0",
+				"@oxc-project/types": "=0.152.0",
 				"@rolldown/pluginutils": "^1.0.0"
 			},
 			"bin": {
@@ -1334,21 +1334,21 @@
 				"node": "^20.19.0 || >=22.12.0"
 			},
 			"optionalDependencies": {
-				"@rolldown/binding-android-arm-eabi": "1.2.11",
-				"@rolldown/binding-android-arm64": "1.2.11",
-				"@rolldown/binding-darwin-arm64": "1.2.11",
-				"@rolldown/binding-darwin-x64": "1.2.11",
-				"@rolldown/binding-freebsd-x64": "1.2.11",
-				"@rolldown/binding-linux-arm-gnueabihf": "1.2.11",
-				"@rolldown/binding-linux-arm64-gnu": "1.2.11",
-				"@rolldown/binding-linux-arm64-musl": "1.2.11",
-				"@rolldown/binding-linux-ppc64-gnu": "1.2.11",
-				"@rolldown/binding-linux-s390x-gnu": "1.2.11",
-				"@rolldown/binding-linux-x64-gnu": "1.2.11",
-				"@rolldown/binding-linux-x64-musl": "1.2.11",
-				"@rolldown/binding-openharmony-arm64": "1.2.11",
-				"@rolldown/binding-win32-arm64-msvc": "1.2.11",
-				"@rolldown/binding-win32-x64-msvc": "1.2.11"
+				"@rolldown/binding-android-arm-eabi": "1.2.12",
+				"@rolldown/binding-android-arm64": "1.2.12",
+				"@rolldown/binding-darwin-arm64": "1.2.12",
+				"@rolldown/binding-darwin-x64": "1.2.12",
+				"@rolldown/binding-freebsd-x64": "1.2.12",
+				"@rolldown/binding-linux-arm-gnueabihf": "1.2.12",
+				"@rolldown/binding-linux-arm64-gnu": "1.2.12",
+				"@rolldown/binding-linux-arm64-musl": "1.2.12",
+				"@rolldown/binding-linux-ppc64-gnu": "1.2.12",
+				"@rolldown/binding-linux-s390x-gnu": "1.2.12",
+				"@rolldown/binding-linux-x64-gnu": "1.2.12",
+				"@rolldown/binding-linux-x64-musl": "1.2.12",
+				"@rolldown/binding-openharmony-arm64": "1.2.12",
+				"@rolldown/binding-win32-arm64-msvc": "1.2.12",
+				"@rolldown/binding-win32-x64-msvc": "1.2.12"
 			}
 		},
 		"node_modules/safe-buffer": {
@@ -1384,9 +1384,9 @@
 			}
 		},
 		"node_modules/source-map-js": {
-			"version": "1.2.1",
-			"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-			"integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+			"integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
 			"dev": true,
 			"license": "BSD-3-Clause",
 			"peer": true,
@@ -1439,9 +1439,9 @@
 			}
 		},
 		"node_modules/vite": {
-			"version": "8.3.1",
-			"resolved": "https://registry.npmjs.org/vite/-/vite-8.3.1.tgz",
-			"integrity": "sha512-/bvH9E9tmCXRGp2uXY3WbOldqpTwFkbha/8ANaEQ6VkxhH60KyqLwgZq6lG2y+4uT55x9+9eUHMpQ7uGnOCKjA==",
+			"version": "8.3.2",
+			"resolved": "https://registry.npmjs.org/vite/-/vite-8.3.2.tgz",
+			"integrity": "sha512-SQr1x6W5vVSbROg7vsyXIaxK9b0G7zsT68acdWWRmnBUsgDieLCRG+Rep9WdZgcposvv/GSnr4GUUBqB3vXq6w==",
 			"dev": true,
 			"license": "MIT",
 			"peer": true,
@@ -1449,7 +1449,7 @@
 				"lightningcss": "^1.33.0",
 				"picomatch": "^4.0.7",
 				"postcss": "^8.5.28",
-				"rolldown": "~1.2.9",
+				"rolldown": "~1.2.11",
 				"tinyglobby": "^0.2.17"
 			},
 			"bin": {
@@ -1518,14 +1518,14 @@
 			}
 		},
 		"node_modules/vitest": {
-			"version": "5.0.2",
-			"resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.2.tgz",
-			"integrity": "sha512-7MQrx9pDv5aHiUcovIb/70Ys3tgtkUVgCtledvKdCmEO+/1Dicq5ZqoSxOW034m03oqC+oHOKui2dM6qtMLoJg==",
+			"version": "5.0.3",
+			"resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.3.tgz",
+			"integrity": "sha512-xMw97S3rjdtj5dkVat7jCsqWBpvchs3RlpQctUqwJD0KkERk40vz2fJ77lDwW/Vzh/pk18eItYAzkodhSes3jQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@types/chai": "^5.2.2",
-				"@vitest/mocker": "5.0.2",
+				"@vitest/mocker": "5.0.3",
 				"chai": "^6.2.2",
 				"es-module-lexer": "^2.3.2",
 				"expect-type": "^1.4.0",
@@ -1536,7 +1536,7 @@
 				"tinybench": "^6.1.4",
 				"tinyexec": "^1.3.0",
 				"tinyglobby": "^0.2.17",
-				"why-is-node-running": "^3.2.1"
+				"why-is-node-running": "3.2.1"
 			},
 			"bin": {
 				"vitest": "vitest.mjs"
@@ -1551,12 +1551,12 @@
 				"@edge-runtime/vm": "*",
 				"@opentelemetry/api": "^1.9.0",
 				"@types/node": "^22.0.0 || >=24.0.0",
-				"@vitest/browser-playwright": "5.0.2",
-				"@vitest/browser-preview": "5.0.2",
+				"@vitest/browser-playwright": "5.0.3",
+				"@vitest/browser-preview": "5.0.3",
 				"@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0",
-				"@vitest/coverage-istanbul": "5.0.2",
-				"@vitest/coverage-v8": "5.0.2",
-				"@vitest/ui": "5.0.2",
+				"@vitest/coverage-istanbul": "5.0.3",
+				"@vitest/coverage-v8": "5.0.3",
+				"@vitest/ui": "5.0.3",
 				"happy-dom": "*",
 				"jsdom": "*",
 				"vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
@@ -1601,9 +1601,9 @@
 			}
 		},
 		"node_modules/why-is-node-running": {
-			"version": "3.2.2",
-			"resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.2.tgz",
-			"integrity": "sha512-NKUzAelcoCXhXL4dJzKIwXeR8iEVqsA0Lq6Vnd0UXvgaKbzVo4ZTHROF2Jidrv+SgxOQ03fMinnNhzZATxOD3A==",
+			"version": "3.2.1",
+			"resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.1.tgz",
+			"integrity": "sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==",
 			"dev": true,
 			"license": "MIT",
 			"bin": {

package/templates/standalone/tests/package.json

@@ -11,6 +11,6 @@
 		"jsonwebtoken": "^9.0.3"
 	},
 	"devDependencies": {
-		"vitest": "^5.0.2"
+		"vitest": "^5.0.3"
 	}
 }

package/templates/versions.json

@@ -1,20 +1,20 @@
 {
-	"@o3co/auth-provider-core": "0.17.0-rc.3",
-	"@o3co/auth-provider-device-grant": "0.17.0-rc.3",
-	"@o3co/auth-provider-dpop": "0.17.0-rc.3",
-	"@o3co/auth-provider-mtls": "0.17.0-rc.3",
-	"@o3co/auth-provider-federation-apple": "0.17.0-rc.3",
-	"@o3co/auth-provider-federation-google": "0.17.0-rc.3",
-	"@o3co/auth-provider-federation-github": "0.17.0-rc.3",
-	"@o3co/auth-provider-federation-grants": "0.17.0-rc.3",
-	"@o3co/auth-provider-federation-oidc": "0.17.0-rc.3",
-	"@o3co/auth-provider-oauth": "0.17.0-rc.3",
-	"@o3co/auth-provider-oauth-token-exchange": "0.17.0-rc.3",
-	"@o3co/auth-provider-session": "0.17.0-rc.3",
-	"@o3co/auth-provider-foundation": "0.17.0-rc.3",
-	"@o3co/auth-provider-mfa": "0.17.0-rc.3",
-	"@o3co/auth-provider-redis": "0.17.0-rc.3",
-	"@o3co/auth-provider-standard": "0.17.0-rc.3",
-	"@o3co/auth-provider-test-kit": "0.17.0-rc.3",
-	"@o3co/auth-provider-webauthn": "0.17.0-rc.3"
+	"@o3co/auth-provider-core": "0.17.0-rc.4",
+	"@o3co/auth-provider-device-grant": "0.17.0-rc.4",
+	"@o3co/auth-provider-dpop": "0.17.0-rc.4",
+	"@o3co/auth-provider-mtls": "0.17.0-rc.4",
+	"@o3co/auth-provider-federation-apple": "0.17.0-rc.4",
+	"@o3co/auth-provider-federation-google": "0.17.0-rc.4",
+	"@o3co/auth-provider-federation-github": "0.17.0-rc.4",
+	"@o3co/auth-provider-federation-grants": "0.17.0-rc.4",
+	"@o3co/auth-provider-federation-oidc": "0.17.0-rc.4",
+	"@o3co/auth-provider-oauth": "0.17.0-rc.4",
+	"@o3co/auth-provider-oauth-token-exchange": "0.17.0-rc.4",
+	"@o3co/auth-provider-session": "0.17.0-rc.4",
+	"@o3co/auth-provider-foundation": "0.17.0-rc.4",
+	"@o3co/auth-provider-mfa": "0.17.0-rc.4",
+	"@o3co/auth-provider-redis": "0.17.0-rc.4",
+	"@o3co/auth-provider-standard": "0.17.0-rc.4",
+	"@o3co/auth-provider-test-kit": "0.17.0-rc.4",
+	"@o3co/auth-provider-webauthn": "0.17.0-rc.4"
 }