(juneau) branch docs updated: refactor: Group 1 package rename (rest.* -> rest.server.*), module renames (auth/metrics/tracing/reactive prefixes), fix NLS/SPI/resource paths

Sun, 07 Jun 2026 09:24:55 -0700 

This is an automated email from the ASF dual-hosted git repository.

jamesbognar pushed a commit to branch docs
in repository https://gitbox.apache.org/repos/asf/juneau.git


The following commit(s) were added to refs/heads/docs by this push:
     new 084bb1831b refactor: Group 1 package rename (rest.* -> rest.server.*), 
module renames (auth/metrics/tracing/reactive prefixes), fix NLS/SPI/resource 
paths
084bb1831b is described below

commit 084bb1831be2b08b7ad9bd8408ce4a72a5c38969
Author: James Bognar <[email protected]>
AuthorDate: Sun Jun 7 12:24:40 2026 -0400

    refactor: Group 1 package rename (rest.* -> rest.server.*), module renames 
(auth/metrics/tracing/reactive prefixes), fix NLS/SPI/resource paths
---
 pages/release-notes/9.5.0.md                   | 78 +++++++++++++-------------
 pages/topics/10.20e.RestServerAuthGuards.md    | 12 ++--
 pages/topics/10.20g.RestServerObservability.md | 16 +++---
 pages/topics/10.20i.AuthFilterFramework.md     |  8 +--
 pages/topics/10.20j.SamlAuthSupport.md         |  8 +--
 pages/topics/10.20k.OAuthAuthSupport.md        | 16 +++---
 pages/topics/10.20l.OidcRelyingParty.md        | 12 ++--
 pages/topics/10.20m.RestServerReactive.md      | 14 ++---
 8 files changed, 82 insertions(+), 82 deletions(-)

diff --git a/pages/release-notes/9.5.0.md b/pages/release-notes/9.5.0.md
index 2d5cfef3a1..62afc9f8e3 100644
--- a/pages/release-notes/9.5.0.md
+++ b/pages/release-notes/9.5.0.md
@@ -2475,7 +2475,7 @@ When a non-no-op `TracerHook` is active on a request, the 
server now writes the
 - **`org.apache.juneau.rest.tracing.TraceContextResponseProcessor`** (new) — a 
`ResponseProcessor` prepended to the default `ResponseProcessorList`. It reads 
the rendered `traceparent` / `tracestate` strings that a `TracerHook` bridge 
stashed as request attributes (`juneau.traceparent` / `juneau.tracestate`) and 
writes them as response headers. Its first action is a single request-attribute 
read that short-circuits with zero allocations when no tracer ran, preserving 
the off-by-default o [...]
 - **`RestContext.responseTraceparent`** (new env-driven default, 
`${RestContext.responseTraceparent:true}`) — controls whether 
`TraceContextResponseProcessor` is registered. Defaults to `true` 
(on-when-tracer); set it to `false` to keep the processor out of the chain 
entirely even when a tracer is active. Exposed via 
`RestContext.isResponseTraceparent()`. A per-resource 
`@Rest(observability="false")` opt-out is now available via TODO-115 — see 
below.
 
-The companion OTel bridge change lives in `juneau-rest-server-otel`: 
`OtelTracerHook.startSpan(...)` now renders the W3C header values from the 
server-started span context at span-start time (the only point where it is 
reliably active) and stashes them as the request attributes the processor 
reads. See [REST Server — Observability](/docs/topics/RestServerObservability) 
for the full topic.
+The companion OTel bridge change lives in `juneau-rest-server-tracing-otel`: 
`OtelTracerHook.startSpan(...)` now renders the W3C header values from the 
server-started span context at span-start time (the only point where it is 
reliably active) and stashes them as the request attributes the processor 
reads. See [REST Server — Observability](/docs/topics/RestServerObservability) 
for the full topic.
 
 #### Per-resource / per-method observability opt-in attributes (TODO-115)
 
@@ -2640,7 +2640,7 @@ A new JUnit 5 extension and `@TestBean` annotation enable 
Spring-style test-time
 
 #### AuthN Guards — Bearer / API-Key / `@Auth Principal` (TODO-69)
 
-`juneau-rest-server` now ships two opt-in AuthN guards plus an `@Auth 
Principal` argument resolver. The core jar stays JWT-free — a separate 
`juneau-rest-server-jwt` sub-module (see below) carries the nimbus-jose-jwt 
integration. See [REST Server — AuthN 
Guards](/docs/topics/RestServerAuthGuards) for the full reference.
+`juneau-rest-server` now ships two opt-in AuthN guards plus an `@Auth 
Principal` argument resolver. The core jar stays JWT-free — a separate 
`juneau-rest-server-auth-jwt` sub-module (see below) carries the 
nimbus-jose-jwt integration. See [REST Server — AuthN 
Guards](/docs/topics/RestServerAuthGuards) for the full reference.
 
 - **`org.apache.juneau.rest.auth.BearerTokenGuard`** — RFC 6750 bearer-token 
guard with a fluent builder:
   `realm(String)` (default: `"api"`), `validator(TokenValidator)` (required). 
Stashes the resolved `Principal` on `RequestAttributes` under 
`RestServerConstants.PRINCIPAL_ATTR`. Throws 401 with `WWW-Authenticate: Bearer 
realm="<realm>"` on missing / malformed / rejected tokens — preserves richer 
challenges supplied by the validator.
@@ -2717,12 +2717,12 @@ public class MyResource extends BasicRestServlet {
 
     @Bean
     public MetricsRecorder metrics(MeterRegistry r) {
-        return new MicrometerMetricsRecorder(r);   // see 
juneau-rest-server-micrometer below
+        return new MicrometerMetricsRecorder(r);   // see 
juneau-rest-server-metrics-micrometer below
     }
 
     @Bean
     public TracerHook tracer(OpenTelemetry otel) {
-        return new OtelTracerHook(otel);           // see 
juneau-rest-server-otel below
+        return new OtelTracerHook(otel);           // see 
juneau-rest-server-tracing-otel below
     }
 
     @RestGet("/users/{id}") public User get(@Path String id) { ... }
@@ -2842,7 +2842,7 @@ New API:
 
 #### Reactive-Streams return types — `Flow.Publisher` core + Reactor / RxJava 
bridge (TODO-119 + TODO-120)
 
-`@RestOp` handlers may now return reactive-streams values. **The feature is 
fully opt-in by adding a module to the classpath** — a bare 
`juneau-rest-server` has zero reactive behavior and `DefaultConfig` wires no 
reactive processor. The JDK-native `java.util.concurrent.Flow.Publisher<T>` is 
supported by the new dependency-free, opt-in `juneau-rest-server-reactive` 
module; Project Reactor (`Mono` / `Flux`), RxJava 3 (`Single` / `Maybe` / 
`Completable` / `Flowable` / `Observable`), and the [...]
+`@RestOp` handlers may now return reactive-streams values. **The feature is 
fully opt-in by adding a module to the classpath** — a bare 
`juneau-rest-server` has zero reactive behavior and `DefaultConfig` wires no 
reactive processor. The JDK-native `java.util.concurrent.Flow.Publisher<T>` is 
supported by the new dependency-free, opt-in `juneau-rest-server-reactive` 
module; Project Reactor (`Mono` / `Flux`), RxJava 3 (`Single` / `Maybe` / 
`Completable` / `Flowable` / `Observable`), and the [...]
 
 ```java
 @Rest(path="/feed")
@@ -2886,7 +2886,7 @@ Unified architecture (the two promoted plan items ship as 
one coherent feature):
   - **SSE** (`text/event-stream`) — each element emitted as a 
Server-Sent-Events frame; `SseEvent` elements are written verbatim, any other 
element type is JSON-encoded into the `data:` field.
   - **NDJSON** (`application/x-ndjson`, `application/jsonl`) — each element 
JSON-encoded on its own line.
 - **Backpressure** — streaming subscribers request one element at a time 
(`request(1)` on subscribe and again after each frame is flushed). Because the 
servlet output stream blocks until the socket drains, the producer is paced by 
the client and the server-side buffer stays bounded.
-- **Third-party libraries are `provided`-scoped** — `reactive-streams`, 
`reactor-core`, and `rxjava` are all declared `provided` in 
`juneau-rest-server-reactor`. A `dependency:tree` on `juneau-rest-server` never 
surfaces them. Adapters are discovered lazily via `ServiceLoader` and skipped 
at runtime if their backing library is absent, so a consumer adds 
`juneau-rest-server-reactor` plus only the reactive library (and version) they 
actually use.
+- **Third-party libraries are `provided`-scoped** — `reactive-streams`, 
`reactor-core`, and `rxjava` are all declared `provided` in 
`juneau-rest-server-reactive-reactor`. A `dependency:tree` on 
`juneau-rest-server` never surfaces them. Adapters are discovered lazily via 
`ServiceLoader` and skipped at runtime if their backing library is absent, so a 
consumer adds `juneau-rest-server-reactive-reactor` plus only the reactive 
library (and version) they actually use.
 - **Extensibility** — the `ReactiveStreamsAdapter` SPI + `Adaptation` value 
type let third parties bridge any other reactive library to the core 
`Flow.Publisher` / `CompletionStage` plumbing without modifying 
`juneau-rest-server`.
 
 New API (all in the opt-in `juneau-rest-server-reactive` module):
@@ -2911,7 +2911,7 @@ A new dependency-free, opt-in module that holds the 
JDK-native `Flow.Publisher`
 </dependency>
 ```
 
-#### New module: `juneau-rest-server-reactor` (TODO-119)
+#### New module: `juneau-rest-server-reactive-reactor` (TODO-119)
 
 A further opt-in bridge module (depends on `juneau-rest-server-reactive`) 
providing `ReactiveStreamsAdapter` implementations for the popular reactive 
libraries. Server-side only — there is no client-side counterpart. All three 
backing libraries are `provided`-scope.
 
@@ -2926,7 +2926,7 @@ Maven coordinate:
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-reactor</artifactId>
+    <artifactId>juneau-rest-server-reactive-reactor</artifactId>
     <version>9.5.0</version>
 </dependency>
 <!-- plus ONLY the reactive library you use, e.g.: -->
@@ -4520,7 +4520,7 @@ JsonRpcRequest back = JsonParser.DEFAULT.parse(wire, 
JsonRpcRequest.class);
 
 See [juneau-bean-mcp](/docs/topics/JuneauBeanMcp) for the full topic.
 
-### juneau-rest-server-jwt (new module)
+### juneau-rest-server-auth-jwt (new module)
 
 #### `jwksCacheTtl` migrated to `@Value` (TODO-92)
 
@@ -4531,7 +4531,7 @@ See [juneau-bean-mcp](/docs/topics/JuneauBeanMcp) for the 
full topic.
   registered `PropertySource` &rarr; `Settings.setGlobal`). Behavior is 
identical when no
   override is set. See [@Value Framework-Internal 
Adoption](../topics/ValueFrameworkInternal.md).
 
-A new opt-in REST module, `juneau-rest-server-jwt`, adds JWT bearer-token 
verification to `juneau-rest-server` without bleeding the 
[nimbus-jose-jwt](https://connect2id.com/products/nimbus-jose-jwt) dependency 
into the core. The nimbus dep is declared in `provided` scope on the module's 
POM, so consumers explicitly pick the nimbus version they want.
+A new opt-in REST module, `juneau-rest-server-auth-jwt`, adds JWT bearer-token 
verification to `juneau-rest-server` without bleeding the 
[nimbus-jose-jwt](https://connect2id.com/products/nimbus-jose-jwt) dependency 
into the core. The nimbus dep is declared in `provided` scope on the module's 
POM, so consumers explicitly pick the nimbus version they want.
 
 `mvn -pl juneau-rest/juneau-rest-server dependency:tree | grep -i nimbus` 
returns nothing — the containment requirement is verified at build time. See 
[REST Server — AuthN Guards § JWT 
verification](/docs/topics/RestServerAuthGuards) for the full reference.
 
@@ -4581,19 +4581,19 @@ Applies only to `jwksUrl(...)`-backed caches. A 
caller-supplied `jwkSource(...)`
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-jwt</artifactId>
+    <artifactId>juneau-rest-server-auth-jwt</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
     <groupId>com.nimbusds</groupId>
     <artifactId>nimbus-jose-jwt</artifactId>
-    <version>10.3</version>          <!-- consumer-supplied; provided scope on 
juneau-rest-server-jwt -->
+    <version>10.3</version>          <!-- consumer-supplied; provided scope on 
juneau-rest-server-auth-jwt -->
 </dependency>
 ```
 
-### juneau-rest-server-saml (new module)
+### juneau-rest-server-auth-saml (new module)
 
-A new opt-in REST module, `juneau-rest-server-saml`, adds SAML 2.0 
single-sign-on (Web Browser SSO Profile) to `juneau-rest-server` by wrapping 
[OpenSAML 5.x](https://shibboleth.atlassian.net/wiki/spaces/OS30) behind the 
FINISHED-94a `AuthFilter` / `TokenValidator` SPIs. The 
`org.opensaml:opensaml-*` dependency cluster is declared in `provided` scope on 
the module's POM, so consumers explicitly pick the OpenSAML 5.x patch they want 
(default pin: `5.2.2`).
+A new opt-in REST module, `juneau-rest-server-auth-saml`, adds SAML 2.0 
single-sign-on (Web Browser SSO Profile) to `juneau-rest-server` by wrapping 
[OpenSAML 5.x](https://shibboleth.atlassian.net/wiki/spaces/OS30) behind the 
FINISHED-94a `AuthFilter` / `TokenValidator` SPIs. The 
`org.opensaml:opensaml-*` dependency cluster is declared in `provided` scope on 
the module's POM, so consumers explicitly pick the OpenSAML 5.x patch they want 
(default pin: `5.2.2`).
 
 `mvn -pl juneau-rest/juneau-rest-server dependency:tree | grep -i opensaml` 
returns nothing &mdash; the containment requirement is verified at build time. 
See [REST Server &mdash; SAML AuthN Support](/docs/topics/SamlAuthSupport) for 
the full reference.
 
@@ -4625,33 +4625,33 @@ if ("SAML".equals(principal.getClaim("issuerType", 
String.class).orElse(null)))
 
 #### Maven note
 
-OpenSAML 5.x is published to the [Shibboleth Maven 
repository](https://build.shibboleth.net/maven/releases/) rather than Maven 
Central. The `juneau-rest-server-saml` POM declares that repository locally so 
consumers don't need to configure it in their own settings. Pin the version via 
the `<opensaml.version>` POM property (default `5.2.2`; do not use `5.0.0`).
+OpenSAML 5.x is published to the [Shibboleth Maven 
repository](https://build.shibboleth.net/maven/releases/) rather than Maven 
Central. The `juneau-rest-server-auth-saml` POM declares that repository 
locally so consumers don't need to configure it in their own settings. Pin the 
version via the `<opensaml.version>` POM property (default `5.2.2`; do not use 
`5.0.0`).
 
 #### Dependency
 
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-saml</artifactId>
+    <artifactId>juneau-rest-server-auth-saml</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
     <groupId>org.opensaml</groupId>
     <artifactId>opensaml-saml-impl</artifactId>
-    <version>5.2.2</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-saml -->
+    <version>5.2.2</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-auth-saml -->
 </dependency>
 ```
 
-### juneau-rest-server-oauth (new module)
+### juneau-rest-server-auth-oauth (new module)
 
-A new opt-in REST module, `juneau-rest-server-oauth`, adds OAuth 2.0 / OIDC 
bearer-token validation, RFC 7662 token introspection, RFC 6749 client-side 
grant flows, and OIDC discovery to `juneau-rest-server` by wrapping the [Nimbus 
OAuth 2.0 SDK](https://connect2id.com/products/nimbus-oauth-openid-connect-sdk) 
(`com.nimbusds:oauth2-oidc-sdk`) behind the FINISHED-94a `AuthFilter` / 
`TokenValidator` SPIs. Same vendor as the `nimbus-jose-jwt` already used by 
`juneau-rest-server-jwt` &mdash; [...]
+A new opt-in REST module, `juneau-rest-server-auth-oauth`, adds OAuth 2.0 / 
OIDC bearer-token validation, RFC 7662 token introspection, RFC 6749 
client-side grant flows, and OIDC discovery to `juneau-rest-server` by wrapping 
the [Nimbus OAuth 2.0 
SDK](https://connect2id.com/products/nimbus-oauth-openid-connect-sdk) 
(`com.nimbusds:oauth2-oidc-sdk`) behind the FINISHED-94a `AuthFilter` / 
`TokenValidator` SPIs. Same vendor as the `nimbus-jose-jwt` already used by 
`juneau-rest-server-auth-jw [...]
 
 `mvn -pl juneau-rest/juneau-rest-server dependency:tree | grep -iE 
"(nimbusds|oauth2-oidc)"` returns nothing &mdash; the containment requirement 
is verified at build time. See [REST Server &mdash; OAuth AuthN 
Support](/docs/topics/OAuthAuthSupport) for the full reference.
 
 #### New Classes
 
 - **`org.apache.juneau.rest.auth.oauth.OAuthIntrospectionValidator`** &mdash; 
`TokenValidator` that validates opaque OAuth 2.0 tokens via RFC 7662 
introspection. Wraps Nimbus's `TokenIntrospectionRequest` + 
`TokenIntrospectionResponse`. Builder: `introspectionEndpoint(URI)`, 
`clientId(String)`, `clientSecret(String)` / 
`clientSecretSupplier(Supplier<String>)`, `requiredScopes(String...)`, 
`tokenCache(TokenCache)` (default `BoundedLruTokenCache`), `cacheTtl(Duration)` 
(default 5m, capped  [...]
-- **`org.apache.juneau.rest.auth.oauth.OAuthFilter`** &mdash; `AuthFilter` 
that authenticates RFC 6750 `Bearer` tokens, delegating to any `TokenValidator` 
(e.g. `OAuthIntrospectionValidator` for opaque tokens or `JwtTokenValidator` 
from `juneau-rest-server-jwt` for JWT access tokens). Extracts roles from a 
configurable claim (default `"scope"`, split on whitespace per RFC 6749 
&sect;3.3).
+- **`org.apache.juneau.rest.auth.oauth.OAuthFilter`** &mdash; `AuthFilter` 
that authenticates RFC 6750 `Bearer` tokens, delegating to any `TokenValidator` 
(e.g. `OAuthIntrospectionValidator` for opaque tokens or `JwtTokenValidator` 
from `juneau-rest-server-auth-jwt` for JWT access tokens). Extracts roles from 
a configurable claim (default `"scope"`, split on whitespace per RFC 6749 
&sect;3.3).
 - **`org.apache.juneau.rest.auth.oauth.OAuthToken`** &mdash; Immutable record 
returned by every flow helper on a successful token acquisition.
 - **`org.apache.juneau.rest.auth.oauth.TokenCache`** + 
**`BoundedLruTokenCache`** &mdash; SPI for caching principals + tokens; default 
impl is a thread-safe bounded LRU (1000 entries, per-entry TTL).
 - **`org.apache.juneau.rest.auth.oauth.flow.OAuthClientCredentialsFlow`** 
&mdash; Wraps Nimbus's `ClientCredentialsGrant` (RFC 6749 &sect;4.4) with 
optional `TokenCache` reuse keyed by `(clientId, scope)`.
@@ -4669,28 +4669,28 @@ A new opt-in REST module, `juneau-rest-server-oauth`, 
adds OAuth 2.0 / OIDC bear
 
 #### Deferred
 
-- **OIDC Relying Party login flow** &mdash; now shipped as the 
`juneau-rest-server-oidc-rp` module (see below); the discovery client + 
auth-code helper here are the building blocks it composes on top of.
+- **OIDC Relying Party login flow** &mdash; now shipped as the 
`juneau-rest-server-auth-oidc-rp` module (see below); the discovery client + 
auth-code helper here are the building blocks it composes on top of.
 - **Device-code grant** (RFC 8628) &mdash; deferred to a follow-on TODO 
if/when needed.
-- **JWKS-on-`kid`-miss eager refresh** &mdash; now shipped; see the 
`juneau-rest-server-jwt` section below.
+- **JWKS-on-`kid`-miss eager refresh** &mdash; now shipped; see the 
`juneau-rest-server-auth-jwt` section below.
 
 #### Dependency
 
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-oauth</artifactId>
+    <artifactId>juneau-rest-server-auth-oauth</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
     <groupId>com.nimbusds</groupId>
     <artifactId>oauth2-oidc-sdk</artifactId>
-    <version>11.37.2</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-oauth -->
+    <version>11.37.2</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-auth-oauth -->
 </dependency>
 ```
 
-### juneau-rest-server-oidc-rp (new module)
+### juneau-rest-server-auth-oidc-rp (new module)
 
-A new opt-in REST module, `juneau-rest-server-oidc-rp`, turns a Juneau REST 
server into a complete OpenID Connect **Relying Party** &mdash; the interactive 
"Log in with Google / Okta / Entra ID / Keycloak" browser flow &mdash; on top 
of `juneau-rest-server-oauth`. It orchestrates the authorization redirect 
&rarr; callback &rarr; session dance (single-use `state`/`nonce`, PKCE S256, 
strict ID-token validation), wrapping the [Nimbus OAuth 2.0 
SDK](https://connect2id.com/products/nimbus-oau [...]
+A new opt-in REST module, `juneau-rest-server-auth-oidc-rp`, turns a Juneau 
REST server into a complete OpenID Connect **Relying Party** &mdash; the 
interactive "Log in with Google / Okta / Entra ID / Keycloak" browser flow 
&mdash; on top of `juneau-rest-server-auth-oauth`. It orchestrates the 
authorization redirect &rarr; callback &rarr; session dance (single-use 
`state`/`nonce`, PKCE S256, strict ID-token validation), wrapping the [Nimbus 
OAuth 2.0 SDK](https://connect2id.com/products/ [...]
 
 `mvn -pl juneau-rest/juneau-rest-server dependency:tree | grep -iE 
"(nimbusds|oauth2-oidc)"` returns nothing &mdash; the containment requirement 
is verified at build time. See [REST Server &mdash; OIDC Relying Party 
Login](/docs/topics/OidcRelyingParty) for the full reference.
 
@@ -4704,7 +4704,7 @@ A new opt-in REST module, `juneau-rest-server-oidc-rp`, 
turns a Juneau REST serv
 - **`org.apache.juneau.rest.auth.oidc.rp.OidcSessionAuthFilter`** &mdash; 
`AuthFilter` (FINISHED-94a) that resolves the session cookie into a 
`ClaimsPrincipal` on each request; fail-open to unauthenticated. Roles come 
from a configurable claim (default `"scope"`), matching `OAuthFilter`'s 
convention.
 - **`org.apache.juneau.rest.auth.oidc.rp.IdTokenValidatorAdapter`** &mdash; 
Wraps Nimbus's `IDTokenValidator` for full OIDC ID-token validation (signature 
vs JWKS, `iss`, `aud`/`azp`, `exp`/`iat`, `nonce`) with a strict algorithm 
allowlist (default `[RS256, ES256]`; `none` rejected) and configurable JWKS 
source (URI / `JWKSet` / `JWKSource`).
 
-#### Building-block extension (`juneau-rest-server-oauth`)
+#### Building-block extension (`juneau-rest-server-auth-oauth`)
 
 - **`OAuthAuthorizationCodeFlow.buildAuthenticationUrl(state, codeChallenge, 
nonce, customizer)`** &mdash; new method emitting an OIDC 
`AuthenticationRequest` (carrying the `nonce`) alongside the existing 
plain-OAuth `buildAuthorizationUrl(...)`. Required so the relying party can 
bind a `nonce` into the authorization request and verify it on the returned ID 
token.
 
@@ -4721,13 +4721,13 @@ A new opt-in REST module, `juneau-rest-server-oidc-rp`, 
turns a Juneau REST serv
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-oidc-rp</artifactId>
+    <artifactId>juneau-rest-server-auth-oidc-rp</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
     <groupId>com.nimbusds</groupId>
     <artifactId>oauth2-oidc-sdk</artifactId>
-    <version>11.37.2</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-oidc-rp -->
+    <version>11.37.2</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-auth-oidc-rp -->
 </dependency>
 ```
 
@@ -4801,9 +4801,9 @@ Requests without an `id` are treated as JSON-RPC 
notifications: handlers run, ex
 
 See [juneau-rest-server-mcp](/docs/topics/JuneauRestServerMcpBasics) for the 
full topic.
 
-### juneau-rest-server-micrometer (new module)
+### juneau-rest-server-metrics-micrometer (new module)
 
-A new opt-in REST module, `juneau-rest-server-micrometer`, bridges the new 
`MetricsRecorder` SPI (see [juneau-rest-server](#juneau-rest-server)) into a 
Micrometer `MeterRegistry` so a Juneau REST service can drop into existing 
Prometheus / StatsD / JMX scrape pipelines with no hand-rolled instrumentation. 
Engine-agnostic POM stance (TODO-67 resolved decision #1, mirroring TODO-68 / 
TODO-78 / TODO-82 / TODO-83 / TODO-84): `io.micrometer:micrometer-core` is 
declared in `provided` scope on  [...]
+A new opt-in REST module, `juneau-rest-server-metrics-micrometer`, bridges the 
new `MetricsRecorder` SPI (see [juneau-rest-server](#juneau-rest-server)) into 
a Micrometer `MeterRegistry` so a Juneau REST service can drop into existing 
Prometheus / StatsD / JMX scrape pipelines with no hand-rolled instrumentation. 
Engine-agnostic POM stance (TODO-67 resolved decision #1, mirroring TODO-68 / 
TODO-78 / TODO-82 / TODO-83 / TODO-84): `io.micrometer:micrometer-core` is 
declared in `provided` s [...]
 
 `mvn -pl juneau-rest/juneau-rest-server dependency:tree | grep -i micrometer` 
returns nothing — the containment requirement is verified at build time.
 
@@ -4813,7 +4813,7 @@ A new opt-in REST module, 
`juneau-rest-server-micrometer`, bridges the new `Metr
 
 #### Naming convention
 
-Spring Boot's `http.server.requests` + `{method, uri, status, exception}` was 
chosen (TODO-67 resolved decision #2) over the OTel-native 
`http.server.duration` shape because the wider Prometheus / Grafana 
scrape-config and dashboard ecosystem already standardizes on it. The 
OTel-native attribute names live in the sibling `juneau-rest-server-otel` 
module (see below).
+Spring Boot's `http.server.requests` + `{method, uri, status, exception}` was 
chosen (TODO-67 resolved decision #2) over the OTel-native 
`http.server.duration` shape because the wider Prometheus / Grafana 
scrape-config and dashboard ecosystem already standardizes on it. The 
OTel-native attribute names live in the sibling 
`juneau-rest-server-tracing-otel` module (see below).
 
 #### Wiring
 
@@ -4830,21 +4830,21 @@ public class ObservabilityConfig {
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-micrometer</artifactId>
+    <artifactId>juneau-rest-server-metrics-micrometer</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
     <groupId>io.micrometer</groupId>
     <artifactId>micrometer-core</artifactId>
-    <version>1.13.6</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-micrometer -->
+    <version>1.13.6</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-metrics-micrometer -->
 </dependency>
 ```
 
 See [REST Server — Observability (Micrometer + 
OpenTelemetry)](/docs/topics/RestServerObservability) for the full topic.
 
-### juneau-rest-server-otel (new module)
+### juneau-rest-server-tracing-otel (new module)
 
-A new opt-in REST module, `juneau-rest-server-otel`, bridges the new 
`TracerHook` SPI (see [juneau-rest-server](#juneau-rest-server)) into an 
OpenTelemetry `Tracer` so each `@RestOp` invocation becomes a server span with 
HTTP semantic-convention attributes and W3C trace-context propagation. 
Engine-agnostic POM stance: `io.opentelemetry:opentelemetry-api` is declared in 
`provided` scope on the module's POM, so consumers explicitly pick the 
OpenTelemetry version they want.
+A new opt-in REST module, `juneau-rest-server-tracing-otel`, bridges the new 
`TracerHook` SPI (see [juneau-rest-server](#juneau-rest-server)) into an 
OpenTelemetry `Tracer` so each `@RestOp` invocation becomes a server span with 
HTTP semantic-convention attributes and W3C trace-context propagation. 
Engine-agnostic POM stance: `io.opentelemetry:opentelemetry-api` is declared in 
`provided` scope on the module's POM, so consumers explicitly pick the 
OpenTelemetry version they want.
 
 `mvn -pl juneau-rest/juneau-rest-server dependency:tree | grep -i 
opentelemetry` returns nothing — the containment requirement is verified at 
build time.
 
@@ -4855,7 +4855,7 @@ A new opt-in REST module, `juneau-rest-server-otel`, 
bridges the new `TracerHook
 
 #### Attribute naming convention
 
-OpenTelemetry HTTP semantic conventions (`http.request.method`, 
`http.response.status_code`, `http.route`) were chosen (TODO-67 resolved 
decision #2) for the tracer hook to keep the spans interoperable with any OTel 
collector / backend. The Spring-Boot-style `http.server.requests` metric shape 
lives in the sibling `juneau-rest-server-micrometer` module (see above).
+OpenTelemetry HTTP semantic conventions (`http.request.method`, 
`http.response.status_code`, `http.route`) were chosen (TODO-67 resolved 
decision #2) for the tracer hook to keep the spans interoperable with any OTel 
collector / backend. The Spring-Boot-style `http.server.requests` metric shape 
lives in the sibling `juneau-rest-server-metrics-micrometer` module (see above).
 
 #### Wiring
 
@@ -4882,13 +4882,13 @@ On the **outgoing** side (TODO-114), 
`OtelTracerHook.startSpan(...)` now also re
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-otel</artifactId>
+    <artifactId>juneau-rest-server-tracing-otel</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
     <groupId>io.opentelemetry</groupId>
     <artifactId>opentelemetry-api</artifactId>
-    <version>1.62.0</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-otel -->
+    <version>1.62.0</version>          <!-- consumer-supplied; provided scope 
on juneau-rest-server-tracing-otel -->
 </dependency>
 ```
 
diff --git a/pages/topics/10.20e.RestServerAuthGuards.md 
b/pages/topics/10.20e.RestServerAuthGuards.md
index 765ab97896..6aedd6bcdc 100644
--- a/pages/topics/10.20e.RestServerAuthGuards.md
+++ b/pages/topics/10.20e.RestServerAuthGuards.md
@@ -3,7 +3,7 @@ title: "AuthN Guards — Bearer / API-Key / JWT"
 slug: RestServerAuthGuards
 ---
 
-Juneau REST servers ship two opt-in authentication (AuthN) guards in 
`org.apache.juneau.rest.auth` plus an `@Auth Principal` argument resolver. A 
separate, optional sub-module — `juneau-rest-server-jwt` — adds JWT 
verification on top via 
[nimbus-jose-jwt](https://connect2id.com/products/nimbus-jose-jwt). The core 
`juneau-rest-server` jar stays JWT-free; teams that don't want JWT pay zero 
classpath cost.
+Juneau REST servers ship two opt-in authentication (AuthN) guards in 
`org.apache.juneau.rest.auth` plus an `@Auth Principal` argument resolver. A 
separate, optional sub-module — `juneau-rest-server-auth-jwt` — adds JWT 
verification on top via 
[nimbus-jose-jwt](https://connect2id.com/products/nimbus-jose-jwt). The core 
`juneau-rest-server` jar stays JWT-free; teams that don't want JWT pay zero 
classpath cost.
 
 All three pieces are purely additive — they are wired in through the existing 
`@Bean` / `RestGuardList` extension point and do not change the behavior of any 
pre-existing handler.
 
@@ -18,7 +18,7 @@ All three pieces are purely additive — they are wired in 
through the existing
 | `@Auth Principal`        | `juneau-rest-server`      | Inject the 
authenticated `Principal` into `@RestOp` method parameters.                    |
 | `ClaimsPrincipal`        | `juneau-rest-server`      | `Principal` subclass 
with typed claim access (used by JWT validators).                    |
 | `AuthenticationException`| `juneau-rest-server`      | 401 with a fluent 
`WWW-Authenticate` setter.                                              |
-| `JwtTokenValidator`      | `juneau-rest-server-jwt`  | JWKS-backed JWT 
validator with algorithm allowlisting, mandatory claim checks, and clock-skew 
tolerance. |
+| `JwtTokenValidator`      | `juneau-rest-server-auth-jwt`  | JWKS-backed JWT 
validator with algorithm allowlisting, mandatory claim checks, and clock-skew 
tolerance. |
 
 ## `BearerTokenGuard` — RFC 6750 bearer tokens
 
@@ -95,22 +95,22 @@ public String claims(@Auth ClaimsPrincipal cp) {
 
 [`AuthArg`](/site/apidocs/org/apache/juneau/rest/auth/AuthArg.html) is 
registered in 
[`DefaultConfig`](/site/apidocs/org/apache/juneau/rest/config/DefaultConfig.html),
 so no extra wiring is required to enable type-driven resolution.
 
-## JWT verification — `juneau-rest-server-jwt`
+## JWT verification — `juneau-rest-server-auth-jwt`
 
-The optional `juneau-rest-server-jwt` sub-module adds 
[`JwtTokenValidator`](/site/apidocs/org/apache/juneau/rest/auth/jwt/JwtTokenValidator.html)
 — a `TokenValidator` that fetches keys from a JWKS endpoint, verifies 
signatures, and enforces `iss` / `aud` / `exp` / `nbf` with secure defaults.
+The optional `juneau-rest-server-auth-jwt` sub-module adds 
[`JwtTokenValidator`](/site/apidocs/org/apache/juneau/rest/auth/jwt/JwtTokenValidator.html)
 — a `TokenValidator` that fetches keys from a JWKS endpoint, verifies 
signatures, and enforces `iss` / `aud` / `exp` / `nbf` with secure defaults.
 
 ### Maven dependency
 
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-jwt</artifactId>
+    <artifactId>juneau-rest-server-auth-jwt</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
     <groupId>com.nimbusds</groupId>
     <artifactId>nimbus-jose-jwt</artifactId>
-    <version>10.3</version>          <!-- consumer-supplied; provided scope on 
juneau-rest-server-jwt -->
+    <version>10.3</version>          <!-- consumer-supplied; provided scope on 
juneau-rest-server-auth-jwt -->
 </dependency>
 ```
 
diff --git a/pages/topics/10.20g.RestServerObservability.md 
b/pages/topics/10.20g.RestServerObservability.md
index 3f90f40c22..a176d305aa 100644
--- a/pages/topics/10.20g.RestServerObservability.md
+++ b/pages/topics/10.20g.RestServerObservability.md
@@ -9,12 +9,12 @@ This is a deliberate departure from Spring Boot's 
auto-configuration, where `Web
 
 ## Motivation
 
-Juneau REST already tracks per-method execution statistics via 
`MethodExecStats` / `RestContextStats`. The data is there — only the wiring to 
the dominant observability stacks (Prometheus / Grafana via Micrometer; 
distributed tracing via OpenTelemetry) was missing. The new SPIs 
(`MetricsRecorder`, `TracerHook`) plus two opt-in bridge modules 
(`juneau-rest-server-micrometer`, `juneau-rest-server-otel`) close that gap 
without dragging either runtime into the core.
+Juneau REST already tracks per-method execution statistics via 
`MethodExecStats` / `RestContextStats`. The data is there — only the wiring to 
the dominant observability stacks (Prometheus / Grafana via Micrometer; 
distributed tracing via OpenTelemetry) was missing. The new SPIs 
(`MetricsRecorder`, `TracerHook`) plus two opt-in bridge modules 
(`juneau-rest-server-metrics-micrometer`, `juneau-rest-server-tracing-otel`) 
close that gap without dragging either runtime into the core.
 
 End-state developer experience:
 
 ```java
-// pom: add juneau-rest-server-micrometer + your preferred MeterRegistry (e.g. 
micrometer-registry-prometheus).
+// pom: add juneau-rest-server-metrics-micrometer + your preferred 
MeterRegistry (e.g. micrometer-registry-prometheus).
 @Configuration
 public class ObservabilityConfig {
     @Bean MeterRegistry registry() { return new 
PrometheusMeterRegistry(PrometheusConfig.DEFAULT); }
@@ -22,7 +22,7 @@ public class ObservabilityConfig {
 }
 // → Each @RestOp call records a Timer sample on the registry; scrape via 
/actuator/prometheus.
 
-// pom: add juneau-rest-server-otel + OTel SDK.
+// pom: add juneau-rest-server-tracing-otel + OTel SDK.
 @Bean OpenTelemetry otel() { return GlobalOpenTelemetry.get(); }
 @Bean TracerHook hook(OpenTelemetry otel) { return new OtelTracerHook(otel); }
 // → Each @RestOp call becomes a SERVER span; incoming traceparent continues 
the upstream trace.
@@ -105,7 +105,7 @@ The hooks wrap the handler invocation in 
`RestOpInvoker.invokeOp(...)`. The sequ
 
 Pre / post-call lifecycle methods (`@RestPreCall` / `@RestPostCall`) are 
intentionally outside the observability boundary — the metric / span describes 
the user-facing operation only.
 
-## Micrometer bridge — `juneau-rest-server-micrometer`
+## Micrometer bridge — `juneau-rest-server-metrics-micrometer`
 
 The Micrometer bridge ships a single `MetricsRecorder` implementation that 
records to any `MeterRegistry`:
 
@@ -139,7 +139,7 @@ http_server_requests_seconds_sum  
{method="GET",uri="/users/{id}",status="200",e
 
 ### Why Spring's naming convention (not OTel-native)
 
-OpenTelemetry's metric semantic conventions specify `http.server.duration` 
with `http.request.method` / `http.response.status_code` / `http.route` 
attribute names. We chose Spring Boot's older `http.server.requests` shape for 
the **Micrometer** bridge because the wider Prometheus / Grafana scrape-config 
and dashboard ecosystem already standardizes on it. The OTel-native attribute 
names live on the **tracing** side — see [OpenTelemetry bridge — 
`juneau-rest-server-otel`](#opentelemetry-br [...]
+OpenTelemetry's metric semantic conventions specify `http.server.duration` 
with `http.request.method` / `http.response.status_code` / `http.route` 
attribute names. We chose Spring Boot's older `http.server.requests` shape for 
the **Micrometer** bridge because the wider Prometheus / Grafana scrape-config 
and dashboard ecosystem already standardizes on it. The OTel-native attribute 
names live on the **tracing** side — see [OpenTelemetry bridge — 
`juneau-rest-server-tracing-otel`](#opentele [...]
 
 To override the timer name, use the two-arg constructor:
 
@@ -154,7 +154,7 @@ To override the timer name, use the two-arg constructor:
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-micrometer</artifactId>
+    <artifactId>juneau-rest-server-metrics-micrometer</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
@@ -172,7 +172,7 @@ To override the timer name, use the two-arg constructor:
 
 The bridge declares `micrometer-core` in `provided` scope so the consumer 
picks the version. `mvn -pl juneau-rest/juneau-rest-server dependency:tree | 
grep -i micrometer` returns nothing — the containment requirement is verified 
at build time.
 
-## OpenTelemetry bridge — `juneau-rest-server-otel`
+## OpenTelemetry bridge — `juneau-rest-server-tracing-otel`
 
 The OpenTelemetry bridge ships a single `TracerHook` implementation that opens 
a span per request and propagates W3C trace context:
 
@@ -258,7 +258,7 @@ public class ObservabilityConfig {
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-otel</artifactId>
+    <artifactId>juneau-rest-server-tracing-otel</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
diff --git a/pages/topics/10.20i.AuthFilterFramework.md 
b/pages/topics/10.20i.AuthFilterFramework.md
index f143013953..93f93c5436 100644
--- a/pages/topics/10.20i.AuthFilterFramework.md
+++ b/pages/topics/10.20i.AuthFilterFramework.md
@@ -77,7 +77,7 @@ public AuthFilterChain authFilters(BeanStore bs) {
         .append(ApiKeyAuthFilter.create()
             .store(apiKeyStore)
             .build())
-        // /sso/** accepts only SAML (provided by juneau-rest-server-saml, a 
future sibling module):
+        // /sso/** accepts only SAML (provided by 
juneau-rest-server-auth-saml, a future sibling module):
         .append(mySamlFilter, "/sso/*")
         .build();
 }
@@ -232,9 +232,9 @@ Spring Security's 
[`SecurityFilterChain`](https://docs.spring.io/spring-security
 ## See also
 
 - [AuthN Guards — Bearer / API-Key / JWT](/docs/topics/RestServerAuthGuards) — 
the FINISHED-69 op-level guards that compose with this framework.
-- [SAML 2.0 AuthN Support](/docs/topics/SamlAuthSupport) — the opt-in 
`juneau-rest-server-saml` module that adds a `SamlAuthFilter` implementation.
-- [OAuth 2.0 / OIDC AuthN Support](/docs/topics/OAuthAuthSupport) — the opt-in 
`juneau-rest-server-oauth` module that adds an `OAuthFilter` + introspection / 
OIDC discovery / grant-flow helpers.
-- [OIDC Relying Party Login](/docs/topics/OidcRelyingParty) — the opt-in 
`juneau-rest-server-oidc-rp` module whose `OidcSessionAuthFilter` resolves an 
OIDC login-session cookie into a `ClaimsPrincipal`.
+- [SAML 2.0 AuthN Support](/docs/topics/SamlAuthSupport) — the opt-in 
`juneau-rest-server-auth-saml` module that adds a `SamlAuthFilter` 
implementation.
+- [OAuth 2.0 / OIDC AuthN Support](/docs/topics/OAuthAuthSupport) — the opt-in 
`juneau-rest-server-auth-oauth` module that adds an `OAuthFilter` + 
introspection / OIDC discovery / grant-flow helpers.
+- [OIDC Relying Party Login](/docs/topics/OidcRelyingParty) — the opt-in 
`juneau-rest-server-auth-oidc-rp` module whose `OidcSessionAuthFilter` resolves 
an OIDC login-session cookie into a `ClaimsPrincipal`.
 - 
[`AuthFilterChain`](/site/apidocs/org/apache/juneau/rest/auth/filter/AuthFilterChain.html)
 - 
[`AuthFilter`](/site/apidocs/org/apache/juneau/rest/auth/filter/AuthFilter.html)
 - 
[`BearerTokenAuthFilter`](/site/apidocs/org/apache/juneau/rest/auth/filter/BearerTokenAuthFilter.html)
diff --git a/pages/topics/10.20j.SamlAuthSupport.md 
b/pages/topics/10.20j.SamlAuthSupport.md
index 60d1064a30..5950098c6e 100644
--- a/pages/topics/10.20j.SamlAuthSupport.md
+++ b/pages/topics/10.20j.SamlAuthSupport.md
@@ -1,9 +1,9 @@
 ---
-title: "SAML 2.0 AuthN Support (juneau-rest-server-saml)"
+title: "SAML 2.0 AuthN Support (juneau-rest-server-auth-saml)"
 slug: SamlAuthSupport
 ---
 
-The opt-in `juneau-rest-server-saml` module adds SAML 2.0 single-sign-on (Web 
Browser SSO Profile) to `juneau-rest-server` by wrapping [OpenSAML 
5.x](https://shibboleth.atlassian.net/wiki/spaces/OS30) behind the 
[AuthFilter](/docs/topics/AuthFilterFramework) / 
[TokenValidator](/docs/topics/AuthGuards) SPIs that ship in 
`juneau-rest-server`.
+The opt-in `juneau-rest-server-auth-saml` module adds SAML 2.0 single-sign-on 
(Web Browser SSO Profile) to `juneau-rest-server` by wrapping [OpenSAML 
5.x](https://shibboleth.atlassian.net/wiki/spaces/OS30) behind the 
[AuthFilter](/docs/topics/AuthFilterFramework) / 
[TokenValidator](/docs/topics/AuthGuards) SPIs that ship in 
`juneau-rest-server`.
 
 OpenSAML is an Apache 2.0-licensed library maintained by 
[Shibboleth](https://shibboleth.atlassian.net/). It is declared in `provided` 
scope on the module's POM so the dependency does **not** bleed into 
`juneau-rest-server` &mdash; consumers explicitly pick the OpenSAML 5.x patch 
they want (default pin: `5.2.2`).
 
@@ -109,12 +109,12 @@ The decrypter uses OpenSAML's `opensaml-xmlsec-impl` 
chain (`InlineEncryptedKeyR
 
 ## Maven dependency
 
-OpenSAML 5.x is published to the [Shibboleth Maven 
repository](https://build.shibboleth.net/maven/releases/) rather than Maven 
Central. The `juneau-rest-server-saml` POM declares that repository locally so 
consumers don't need to configure it in their own `settings.xml`. Pin the 
version via the `<opensaml.version>` POM property (default `5.2.2`; do not use 
`5.0.0`).
+OpenSAML 5.x is published to the [Shibboleth Maven 
repository](https://build.shibboleth.net/maven/releases/) rather than Maven 
Central. The `juneau-rest-server-auth-saml` POM declares that repository 
locally so consumers don't need to configure it in their own `settings.xml`. 
Pin the version via the `<opensaml.version>` POM property (default `5.2.2`; do 
not use `5.0.0`).
 
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-saml</artifactId>
+    <artifactId>juneau-rest-server-auth-saml</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
diff --git a/pages/topics/10.20k.OAuthAuthSupport.md 
b/pages/topics/10.20k.OAuthAuthSupport.md
index e11449f1a1..ba7e360bcd 100644
--- a/pages/topics/10.20k.OAuthAuthSupport.md
+++ b/pages/topics/10.20k.OAuthAuthSupport.md
@@ -1,11 +1,11 @@
 ---
-title: "OAuth 2.0 / OIDC AuthN Support (juneau-rest-server-oauth)"
+title: "OAuth 2.0 / OIDC AuthN Support (juneau-rest-server-auth-oauth)"
 slug: OAuthAuthSupport
 ---
 
-The opt-in `juneau-rest-server-oauth` module adds OAuth 2.0 + OIDC 
bearer-token validation, RFC 7662 token introspection, RFC 6749 client-side 
grant flows, and OIDC discovery to `juneau-rest-server` by wrapping the [Nimbus 
OAuth 2.0 SDK](https://connect2id.com/products/nimbus-oauth-openid-connect-sdk) 
(`com.nimbusds:oauth2-oidc-sdk`) behind the 
[AuthFilter](/docs/topics/AuthFilterFramework) / 
[TokenValidator](/docs/topics/AuthGuards) SPIs.
+The opt-in `juneau-rest-server-auth-oauth` module adds OAuth 2.0 + OIDC 
bearer-token validation, RFC 7662 token introspection, RFC 6749 client-side 
grant flows, and OIDC discovery to `juneau-rest-server` by wrapping the [Nimbus 
OAuth 2.0 SDK](https://connect2id.com/products/nimbus-oauth-openid-connect-sdk) 
(`com.nimbusds:oauth2-oidc-sdk`) behind the 
[AuthFilter](/docs/topics/AuthFilterFramework) / 
[TokenValidator](/docs/topics/AuthGuards) SPIs.
 
-The Nimbus SDK is Apache 2.0-licensed and is from the same vendor as the 
`nimbus-jose-jwt` already used by 
[juneau-rest-server-jwt](/docs/topics/RestServerAuthGuards). It is declared in 
`provided` scope on the module's POM so the dependency does **not** bleed into 
`juneau-rest-server` &mdash; consumers explicitly pick the SDK version they 
want (default pin: `11.37.2`).
+The Nimbus SDK is Apache 2.0-licensed and is from the same vendor as the 
`nimbus-jose-jwt` already used by 
[juneau-rest-server-auth-jwt](/docs/topics/RestServerAuthGuards). It is 
declared in `provided` scope on the module's POM so the dependency does **not** 
bleed into `juneau-rest-server` &mdash; consumers explicitly pick the SDK 
version they want (default pin: `11.37.2`).
 
 ## At a glance
 
@@ -26,7 +26,7 @@ The Nimbus SDK is Apache 2.0-licensed and is from the same 
vendor as the `nimbus
 The most common deployment is a resource-server that validates a Bearer access 
token on every request. There are two token shapes:
 
 - **Opaque tokens** &mdash; validated via RFC 7662 introspection against the 
IdP's `/oauth2/introspect` endpoint (this module's 
`OAuthIntrospectionValidator`).
-- **JWT access tokens** &mdash; validated locally against the IdP's JWKS (use 
[`JwtTokenValidator`](/site/apidocs/org/apache/juneau/rest/auth/jwt/JwtTokenValidator.html)
 from `juneau-rest-server-jwt`). The OIDC default is JWT.
+- **JWT access tokens** &mdash; validated locally against the IdP's JWKS (use 
[`JwtTokenValidator`](/site/apidocs/org/apache/juneau/rest/auth/jwt/JwtTokenValidator.html)
 from `juneau-rest-server-auth-jwt`). The OIDC default is JWT.
 
 Both shapes plug into the same `OAuthFilter`:
 
@@ -198,7 +198,7 @@ mvn -pl juneau-rest/juneau-rest-server dependency:tree | 
grep -iE "(nimbusds|oau
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-oauth</artifactId>
+    <artifactId>juneau-rest-server-auth-oauth</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
@@ -208,16 +208,16 @@ mvn -pl juneau-rest/juneau-rest-server dependency:tree | 
grep -iE "(nimbusds|oau
 </dependency>
 ```
 
-The Nimbus SDK pulls `nimbus-jose-jwt` transitively, which is fine &mdash; 
`juneau-rest-server-jwt` already uses that JAR.
+The Nimbus SDK pulls `nimbus-jose-jwt` transitively, which is fine &mdash; 
`juneau-rest-server-auth-jwt` already uses that JAR.
 
 ## Deferred
 
 - **Device-code grant** (RFC 8628) &mdash; deferred. File an issue if needed.
-- **JWKS-on-`kid`-miss eager refresh** &mdash; shipped in 9.5.0 on 
`juneau-rest-server-jwt`'s `JwksCache`; see [REST Server &mdash; AuthN Guards 
&sect; JWKS eager refresh on kid miss](/docs/topics/RestServerAuthGuards).
+- **JWKS-on-`kid`-miss eager refresh** &mdash; shipped in 9.5.0 on 
`juneau-rest-server-auth-jwt`'s `JwksCache`; see [REST Server &mdash; AuthN 
Guards &sect; JWKS eager refresh on kid 
miss](/docs/topics/RestServerAuthGuards).
 
 ## See also
 
-- [OIDC Relying Party Login](/docs/topics/OidcRelyingParty) &mdash; the 
`juneau-rest-server-oidc-rp` module that composes the discovery client + 
auth-code helper here into a full interactive browser-login flow (`startLogin` 
/ `completeLogin` / `logout`).
+- [OIDC Relying Party Login](/docs/topics/OidcRelyingParty) &mdash; the 
`juneau-rest-server-auth-oidc-rp` module that composes the discovery client + 
auth-code helper here into a full interactive browser-login flow (`startLogin` 
/ `completeLogin` / `logout`).
 - [AuthN Filter Framework](/docs/topics/AuthFilterFramework) &mdash; the SPI 
both this module's filter and the bundled bearer/api-key filters implement.
 - [AuthN Guards](/docs/topics/RestServerAuthGuards) &mdash; the op-level guard 
family (`ClaimsPrincipal`, `TokenValidator`, `JwtTokenValidator`) that composes 
with this framework.
 - [SAML 2.0 AuthN Support](/docs/topics/SamlAuthSupport) &mdash; the sibling 
SAML module.
diff --git a/pages/topics/10.20l.OidcRelyingParty.md 
b/pages/topics/10.20l.OidcRelyingParty.md
index eeb0e6b998..afc1536acb 100644
--- a/pages/topics/10.20l.OidcRelyingParty.md
+++ b/pages/topics/10.20l.OidcRelyingParty.md
@@ -1,11 +1,11 @@
 ---
-title: "OIDC Relying Party Login (juneau-rest-server-oidc-rp)"
+title: "OIDC Relying Party Login (juneau-rest-server-auth-oidc-rp)"
 slug: OidcRelyingParty
 ---
 
-The opt-in `juneau-rest-server-oidc-rp` module turns a Juneau REST server into 
a complete OpenID Connect **Relying Party** &mdash; the "Log in with Google / 
Okta / Entra ID / Keycloak" end-to-end glue. It orchestrates the interactive 
browser login dance (authorization redirect &rarr; callback &rarr; session) on 
top of the building blocks in 
[juneau-rest-server-oauth](/docs/topics/OAuthAuthSupport), wrapping the [Nimbus 
OAuth 2.0 SDK](https://connect2id.com/products/nimbus-oauth-openid-co [...]
+The opt-in `juneau-rest-server-auth-oidc-rp` module turns a Juneau REST server 
into a complete OpenID Connect **Relying Party** &mdash; the "Log in with 
Google / Okta / Entra ID / Keycloak" end-to-end glue. It orchestrates the 
interactive browser login dance (authorization redirect &rarr; callback &rarr; 
session) on top of the building blocks in 
[juneau-rest-server-auth-oauth](/docs/topics/OAuthAuthSupport), wrapping the 
[Nimbus OAuth 2.0 SDK](https://connect2id.com/products/nimbus-oauth [...]
 
-The Nimbus SDK is declared in `provided` scope on the module's POM so the 
dependency does **not** bleed into `juneau-rest-server` &mdash; consumers 
explicitly pick the SDK version they want (default pin: `11.37.2`, the same 
line as `juneau-rest-server-oauth`).
+The Nimbus SDK is declared in `provided` scope on the module's POM so the 
dependency does **not** bleed into `juneau-rest-server` &mdash; consumers 
explicitly pick the SDK version they want (default pin: `11.37.2`, the same 
line as `juneau-rest-server-auth-oauth`).
 
 This module owns only orchestration, the session SPI, and the single-use 
`state`/`nonce` store. Every flow / parse / validate step is offloaded to 
Nimbus; there is no bespoke crypto.
 
@@ -99,7 +99,7 @@ The module is opt-in, security-reviewed glue. The defaults 
are fail-closed:
 
 - **Single-use `state` + `nonce`** &mdash; generated before the redirect, 
stored TTL-bounded (default 5&nbsp;min), and atomically consumed on the 
callback. A missing / replayed `state` fails the callback (CSRF + 
ID-token-replay defense).
 - **PKCE S256** is enforced end-to-end (verifier persisted across the 
redirect, used at exchange).
-- **Strict ID-token validation** &mdash; signature against the IdP JWKS, exact 
`iss` match, `aud` contains the client id, `azp` on multi-audience tokens, 
`exp`/`iat` within clock skew, and `nonce` match. The signing-algorithm 
allowlist defaults to `[RS256, ES256]`; `none` and SHA-1-family algorithms are 
rejected (inheriting the `juneau-rest-server-jwt` strict-default stance).
+- **Strict ID-token validation** &mdash; signature against the IdP JWKS, exact 
`iss` match, `aud` contains the client id, `azp` on multi-audience tokens, 
`exp`/`iat` within clock skew, and `nonce` match. The signing-algorithm 
allowlist defaults to `[RS256, ES256]`; `none` and SHA-1-family algorithms are 
rejected (inheriting the `juneau-rest-server-auth-jwt` strict-default stance).
 - **Session-id rotation** &mdash; a fresh session id is generated on login; 
there is no pre-auth fixation window.
 - **Token redaction** &mdash; auth responses set `Cache-Control: no-store`; 
tokens are never logged.
 - **Cookie flags** &mdash; the session cookie is `HttpOnly` + `Secure` + 
`SameSite=Lax` by default (override via the builder).
@@ -147,7 +147,7 @@ mvn -pl juneau-rest/juneau-rest-server dependency:tree | 
grep -iE "(nimbusds|oau
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-oidc-rp</artifactId>
+    <artifactId>juneau-rest-server-auth-oidc-rp</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
@@ -157,7 +157,7 @@ mvn -pl juneau-rest/juneau-rest-server dependency:tree | 
grep -iE "(nimbusds|oau
 </dependency>
 ```
 
-The module also pulls `juneau-rest-server-oauth` (its building-block 
dependency) transitively at compile scope.
+The module also pulls `juneau-rest-server-auth-oauth` (its building-block 
dependency) transitively at compile scope.
 
 ## See also
 
diff --git a/pages/topics/10.20m.RestServerReactive.md 
b/pages/topics/10.20m.RestServerReactive.md
index b5fd87afe7..e1bd987c86 100644
--- a/pages/topics/10.20m.RestServerReactive.md
+++ b/pages/topics/10.20m.RestServerReactive.md
@@ -11,9 +11,9 @@ Two layers stack on top of core:
 |---|---|
 | bare `juneau-rest-server` | *(no reactive behavior — a `Flow.Publisher` 
return is serialized as an ordinary object)* |
 | `+ juneau-rest-server-reactive` | JDK-native 
`java.util.concurrent.Flow.Publisher<T>` returns (dependency-free) |
-| `+ juneau-rest-server-reactor` | Project Reactor (`Mono` / `Flux`), RxJava 3 
(`Single` / `Maybe` / `Completable` / `Flowable` / `Observable`), and the 
generic `org.reactivestreams.Publisher<T>` |
+| `+ juneau-rest-server-reactive-reactor` | Project Reactor (`Mono` / `Flux`), 
RxJava 3 (`Single` / `Maybe` / `Completable` / `Flowable` / `Observable`), and 
the generic `org.reactivestreams.Publisher<T>` |
 
-Both modules are server-side only. `juneau-rest-server-reactive` is 
dependency-free; `juneau-rest-server-reactor` declares Reactor / RxJava / 
Reactive-Streams in `provided` scope.
+Both modules are server-side only. `juneau-rest-server-reactive` is 
dependency-free; `juneau-rest-server-reactive-reactor` declares Reactor / 
RxJava / Reactive-Streams in `provided` scope.
 
 This feature shares the [async-returns](/docs/topics/RestServerAsyncDispatch) 
plumbing: single-value reactive types collapse onto the existing 
`CompletableFuture` path, and multi-value streams are rendered as a buffered 
list, Server-Sent Events, or newline-delimited JSON.
 
@@ -53,7 +53,7 @@ A single response processor — `ReactiveResponseProcessor` 
(`org.apache.juneau.
 **Auto-registration (no manual wiring).** The processor is *not* listed in 
`DefaultConfig`. Instead, `juneau-rest-server-reactive` ships a 
`META-INF/services/org.apache.juneau.rest.processor.ResponseProcessor` provider 
file naming `ReactiveResponseProcessor`. `RestContext` discovers 
module-contributed response processors via `ServiceLoader` and front-loads them 
ahead of `AsyncResponseProcessor` in the chain. On a bare `juneau-rest-server` 
classpath this discovery finds nothing, so the ch [...]
 
 1. Natively recognizes `java.util.concurrent.Flow.Publisher<T>` (no external 
dependency).
-2. For any other return value, consults registered `ReactiveStreamsAdapter` 
providers (discovered via the same `ServiceLoader` mechanism). The 
`juneau-rest-server-reactor` module supplies adapters for Reactor, RxJava 3, 
and the generic Reactive-Streams `Publisher`.
+2. For any other return value, consults registered `ReactiveStreamsAdapter` 
providers (discovered via the same `ServiceLoader` mechanism). The 
`juneau-rest-server-reactive-reactor` module supplies adapters for Reactor, 
RxJava 3, and the generic Reactive-Streams `Publisher`.
 
 Each adapter converts its library's type into one of two JDK-native shapes, 
expressed by the `Adaptation` value type:
 
@@ -141,14 +141,14 @@ Dependency-free. Carries `ReactiveResponseProcessor`, the 
`ReactiveStreamsAdapte
 </dependency>
 ```
 
-### `juneau-rest-server-reactor` (third-party bridge)
+### `juneau-rest-server-reactive-reactor` (third-party bridge)
 
 The bridge module is **server-side only** and opt-in, and depends on 
`juneau-rest-server-reactive`. All three backing libraries are 
`provided`-scope: a `dependency:tree` on `juneau-rest-server` (or 
`juneau-rest-server-reactive`) never surfaces `reactor-core`, `rxjava`, or 
`reactive-streams`. Adapters are discovered lazily via `ServiceLoader` and 
skipped at runtime if their backing library is absent from the classpath, so 
you add the module plus **only the reactive library you actually us [...]
 
 ```xml
 <dependency>
     <groupId>org.apache.juneau</groupId>
-    <artifactId>juneau-rest-server-reactor</artifactId>
+    <artifactId>juneau-rest-server-reactive-reactor</artifactId>
     <version>9.5.0</version>
 </dependency>
 <dependency>
@@ -190,8 +190,8 @@ com.example.MyLibAdapter
 | Setting | Where | Effect |
 |---|---|---|
 | return `Flow.Publisher<T>` | `@RestOp` method (with 
`juneau-rest-server-reactive`) | JDK-native streaming, no third-party 
dependency |
-| return `Mono` / `Single` / `Maybe` / `Completable` | `@RestOp` method (with 
`juneau-rest-server-reactor`) | single value via async path |
-| return `Flux` / `Flowable` / `Observable` / `Publisher` | `@RestOp` method 
(with `juneau-rest-server-reactor`) | stream — shape by content type |
+| return `Mono` / `Single` / `Maybe` / `Completable` | `@RestOp` method (with 
`juneau-rest-server-reactive-reactor`) | single value via async path |
+| return `Flux` / `Flowable` / `Observable` / `Publisher` | `@RestOp` method 
(with `juneau-rest-server-reactive-reactor`) | stream — shape by content type |
 | `res.setContentType("text/event-stream")` | handler body | force SSE shape |
 | `res.setContentType("application/x-ndjson")` | handler body | force NDJSON 
shape |
 | (no content type) | — | buffer to list (JSON array) |

Reply via email to