@o3co/create-auth-provider 0.15.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/google-session.fixture.mts

@@ -0,0 +1,315 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * A browser session with Google linked, on the standalone composed as a
+ * deployment does: `oauthModule`, the session module and the real Google
+ * adapter, booted through `createApp` under the shipped configuration.
+ *
+ * The two logout routes and `POST /oauth/federation/:name/token` live in
+ * `@o3co/auth-provider-oauth`, which depends on no adapter; only here can a
+ * test see what they hand the real adapter and what they make of what its
+ * library raises.
+ *
+ * Unlike `all-modules-composition.fixture.mts`, the deployment signs with an
+ * HS256 secret this file holds, so tests can present an `id_token_hint` and
+ * access token of their own; nothing but Google is federated.
+ */
+
+import { createHmac } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import {
+	AppConfigSchema,
+	createApp,
+	createKeyStoreFactory,
+	defineModule,
+	type FederationTokenStore,
+	type FederationTokens,
+	InMemoryClientRepository,
+	InMemoryUserRepository,
+	memoryRefreshTokenFamilyStoreModule,
+	registerBuiltinKeyStores,
+	type SessionFederationIndex,
+	type UserSessionStore,
+} from "@o3co/auth-provider-core";
+import {
+	type GoogleProviderConfig,
+	googleFederationModule,
+} from "@o3co/auth-provider-federation-google";
+import { parseFile } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+import express from "express";
+import request from "supertest";
+import { expect } from "vitest";
+import { buildModules } from "#/buildModules.mjs";
+import { resolveConfigPaths, type Switches } from "#/configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import {
+	capturedRenames,
+	libraryLayers,
+	rootSectionsOf,
+	sectionsCoreDoesNotDeclare,
+} from "./library-references.fixture.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+export const ISSUER = "https://auth.test";
+const JWT_SECRET = "google-session.fixture.at-least-32-bytes.ok";
+
+/** The one client: first-party, allowed federation tokens, one post-logout URI registered. */
+export const CLIENT_ID = "rp";
+const CLIENT_SECRET = "rp-secret-value";
+const BASIC = `Basic ${Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64")}`;
+export const REGISTERED_POST_LOGOUT_REDIRECT_URI = "https://rp.example/signed-out";
+
+const USERNAME = "alice";
+const PASSWORD = "correct-horse-battery-staple";
+const SUB = "u-alice";
+
+/** The Google client the adapter is configured with. */
+export const GOOGLE_CLIENT_ID = "google-client";
+const GOOGLE_CLIENT_SECRET = "google-secret";
+const GOOGLE_CALLBACK = `${ISSUER}/session/oauth/federation/google/callback`;
+
+const ENV: Readonly<Record<string, string>> = {
+	// A session signed in through Google alone, no second factor.
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: JWT_SECRET,
+	OAUTH_JWT_ISSUER: ISSUER,
+	SESSION_STORE_SECRET: "google-session.fixture-session.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "memory",
+	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+	ADAPTERS_CONSENT_STORE: "none",
+};
+
+/**
+ * `"shipped"`: Google switched on the way an operator does, through its
+ * environment variables and the template's own configuration bridge — which
+ * has no setting for an end-session endpoint or a `fetch`. Otherwise the
+ * adapter's configuration beyond its credentials, composed with
+ * `googleFederationModule` directly.
+ */
+export type GoogleWiring =
+	| "shipped"
+	| Omit<GoogleProviderConfig, "clientId" | "clientSecret" | "callbackURL">;
+
+function resolveConfig(google: GoogleWiring): Switches {
+	const env: Record<string, string> =
+		google === "shipped"
+			? {
+					...ENV,
+					CORE_FEDERATIONS_GOOGLE_ENABLED: "true",
+					CORE_FEDERATIONS_GOOGLE_CLIENT_ID: GOOGLE_CLIENT_ID,
+					CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: GOOGLE_CLIENT_SECRET,
+					CORE_FEDERATIONS_GOOGLE_CALLBACK_URL: GOOGLE_CALLBACK,
+				}
+			: { ...ENV };
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
+	const layers = parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.withFallback(libraryLayers(env));
+	return {
+		...sectionsCoreDoesNotDeclare(layers),
+		...rootSectionsOf(layers, env),
+		...validate(layers, AppConfigSchema),
+		// What the resolution captured of core's renamed variables, which the
+		// schema's parse drops.
+		"renamed-variables": capturedRenames(env),
+	} as Switches;
+}
+
+const testRepositoriesModule = defineModule({
+	name: "test:repositories",
+	provides: {
+		clientRepository: () =>
+			new InMemoryClientRepository(
+				new Map([
+					[
+						CLIENT_ID,
+						{
+							tokenEndpointAuthMethod: "client_secret_basic",
+							clientSecret: CLIENT_SECRET,
+							allowedRedirectUris: [],
+							allowedScopes: ["openid", "profile"],
+							allowedAudiences: [],
+							allowedGrantTypes: ["session"],
+							postLogoutRedirectUris: [REGISTERED_POST_LOGOUT_REDIRECT_URI],
+							backchannelLogoutSessionRequired: true,
+							frontchannelLogoutSessionRequired: true,
+							allowedAzpForFederationToken: true,
+						},
+					],
+				]),
+			),
+		userRepository: () =>
+			new InMemoryUserRepository(
+				new Map([[USERNAME, { id: SUB, password: PASSWORD, email: "alice@example.com" }]]),
+			),
+	} as never,
+});
+
+const testKeyStoreModule = defineModule({
+	name: "test:key-store",
+	requires: ["config"] as const,
+	provides: {
+		keyStore: async ({ config: c }) => {
+			const factory = createKeyStoreFactory();
+			registerBuiltinKeyStores(factory);
+			return factory.create({
+				type: "local",
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+			});
+		},
+	},
+});
+
+const base64url = (value: unknown): string =>
+	Buffer.from(JSON.stringify(value)).toString("base64url");
+
+/** A JWT signed with the deployment's own HS256 key: what its keystore verifies. */
+function signed(typ: string, claims: Record<string, unknown>): string {
+	const header = base64url({ alg: "HS256", kid: "v0", typ });
+	const now = Math.floor(Date.now() / 1000);
+	const payload = base64url({ iss: ISSUER, sub: SUB, iat: now, exp: now + 3600, ...claims });
+	const signature = createHmac("sha256", JWT_SECRET)
+		.update(`${header}.${payload}`)
+		.digest("base64url");
+	return `${header}.${payload}.${signature}`;
+}
+
+/**
+ * A fresh id_token for the session, issued to the client: what an RP — or
+ * anyone holding an id_token of their own — presents as `id_token_hint`.
+ */
+export const idTokenHint = (sid: string): string => signed("JWT", { aud: CLIENT_ID, sid });
+
+/**
+ * An access token for the session as the authorization-code grant issues it
+ * to the client: `azp`, `sid` and a refresh-token `family_id`. The `session`
+ * grant's token names no family, and the federation token route asks for one.
+ */
+export const accessTokenWithFamily = (sid: string): string =>
+	signed("at+jwt", { azp: CLIENT_ID, sid, family_id: "family-1", scope: "openid" });
+
+const claimsOf = (jwt: string): Record<string, unknown> =>
+	JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8")) as Record<
+		string,
+		unknown
+	>;
+
+export interface GoogleSession {
+	readonly app: express.Express;
+	readonly sid: string;
+	/** The access token the `session` grant minted for the session; it carries `azp`. */
+	readonly accessToken: string;
+	readonly userSessionStore: UserSessionStore;
+	readonly sessionFederationIndex: SessionFederationIndex;
+	readonly federationTokenStore: FederationTokenStore;
+	readonly dispose: () => Promise<void>;
+}
+
+/**
+ * Boots the deployment, signs alice in with her password, and links Google to
+ * her session as a federated sign-in would: the session's federation index
+ * names it and the token store holds `tokens`.
+ */
+export async function signInLinkedToGoogle(options: {
+	readonly google: GoogleWiring;
+	readonly tokens: FederationTokens;
+}): Promise<GoogleSession> {
+	const { google, tokens } = options;
+	const config = resolveConfig(google);
+	const googleModules =
+		google === "shipped"
+			? []
+			: [
+					googleFederationModule,
+					defineModule({
+						name: "test:google-federation-config",
+						provides: {
+							googleFederationConfig: (): GoogleProviderConfig => ({
+								clientId: GOOGLE_CLIENT_ID,
+								clientSecret: GOOGLE_CLIENT_SECRET,
+								callbackURL: GOOGLE_CALLBACK,
+								...google,
+							}),
+						},
+					}),
+				];
+	const handle = await createApp({
+		modules: [
+			...buildModules(config, {
+				keyStoreModule: testKeyStoreModule,
+				repositoriesModule: testRepositoriesModule,
+				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+			}),
+			...googleModules,
+		],
+		bootstrapComponents: { config, pathResolver: (s) => s },
+	});
+	try {
+		const components = handle.components as {
+			userSessionStore: UserSessionStore;
+			sessionFederationIndex: SessionFederationIndex;
+			federationTokenStore: FederationTokenStore;
+		};
+		const app = express();
+		app.use(handle.router);
+
+		const csrfRes = await request(app).get("/session/csrf");
+		expect(csrfRes.status).toBe(200);
+		const loginRes = await request(app)
+			.post("/session/login")
+			.set("Cookie", csrfRes.headers["set-cookie"] as unknown as string[])
+			.set(csrfRes.body.header_name as string, csrfRes.body.csrf_token as string)
+			.type("form")
+			.send({ username: USERNAME, password: PASSWORD });
+		expect(loginRes.status).toBe(200);
+
+		const tokenRes = await request(app)
+			.post("/oauth/token")
+			.set("Authorization", BASIC)
+			.set("Cookie", loginRes.headers["set-cookie"] as unknown as string[])
+			.type("form")
+			.send({ grant_type: "session" });
+		expect(tokenRes.status).toBe(200);
+		const accessToken = tokenRes.body.access_token as string;
+		const claims = claimsOf(accessToken);
+		expect(claims.azp).toBe(CLIENT_ID);
+		const sid = claims.sid as string;
+		expect(typeof sid).toBe("string");
+
+		const session = await components.userSessionStore.get(sid);
+		if (session === null) throw new Error("fixture: the sign-in left no session");
+		await components.sessionFederationIndex.addFederation(sid, "google", session.expiresAt);
+		await components.federationTokenStore.attach(sid, "google", tokens);
+		return { app, sid, accessToken, ...components, dispose: () => handle.dispose() };
+	} catch (error) {
+		await handle.dispose();
+		throw error;
+	}
+}

package/templates/standalone/src/__tests__/host-routes.test.mts

@@ -0,0 +1,134 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The host's own routes (liveness, readiness, the metrics scrape), mounted as
+ * the process mounts them (`mountRoutes`), and what an error one of them lets
+ * through is answered with: core's terminal handler, the same one behind the
+ * composed router, so every route's error is answered the same way.
+ */
+
+import type { Logger, ReadinessProbe } from "@o3co/auth-provider-core";
+import express, { Router } from "express";
+import request from "supertest";
+import { describe, expect, it, vi } from "vitest";
+import { createMetrics } from "#/metrics.mjs";
+import { mountRoutes } from "#/routes.mjs";
+
+const spyLogger = () => {
+	const logger = {
+		trace: vi.fn(),
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn: vi.fn(),
+		error: vi.fn(),
+		fatal: vi.fn(),
+		child: () => logger,
+	};
+	return logger;
+};
+
+/** A probe that breaks its own contract: reading its `name` throws. */
+const probeWhoseNameThrows = (thrown: Error): ReadinessProbe =>
+	({
+		get name(): string {
+			throw thrown;
+		},
+		check: async () => undefined,
+	}) as ReadinessProbe;
+
+const host = (probes: readonly ReadinessProbe[]) => {
+	const logger = spyLogger();
+	const app = express();
+	mountRoutes(app, {
+		router: Router(),
+		probes,
+		readinessTimeoutMs: 1_000,
+		metrics: createMetrics(),
+		logger: logger as unknown as Logger,
+	});
+	return { app, logger };
+};
+
+/** Every call on a level other than `error`. */
+const otherLevels = (logger: ReturnType<typeof spyLogger>) =>
+	[logger.trace, logger.debug, logger.info, logger.warn, logger.fatal].flatMap(
+		(level) => level.mock.calls,
+	);
+
+describe("the host's routes, mounted as the process mounts them", () => {
+	it("/_healthcheck answers 200, and nothing is logged", async () => {
+		const { app, logger } = host([]);
+		const res = await request(app).get("/_healthcheck");
+		expect(res.status).toBe(200);
+		expect(res.body).toEqual({ status: "ok" });
+		expect(logger.error).not.toHaveBeenCalled();
+		expect(otherLevels(logger)).toEqual([]);
+	});
+
+	it.each(["/readyz", "/metrics"])(
+		"%s: an error it lets through is 500 server_error in the envelope, no-store, logged once with its projection",
+		async (path) => {
+			const { app, logger } = host([
+				probeWhoseNameThrows(new Error("probe registry at internal-host-marker is gone")),
+			]);
+
+			const res = await request(app).get(path);
+
+			expect(res.status).toBe(500);
+			expect(res.headers["content-type"]).toMatch(/^application\/json/);
+			expect(res.headers["cache-control"]).toBe("no-store");
+			expect(res.body).toEqual({ error: "server_error", error_description: "unexpected_error" });
+			expect(res.text).not.toContain("internal-host-marker");
+			expect(logger.error).toHaveBeenCalledTimes(1);
+			const [fields, event, ...rest] = logger.error.mock.calls[0] as unknown[];
+			expect(event).toBe("unhandled_request_error");
+			expect(rest).toEqual([]);
+			expect(fields).toEqual({
+				endpoint: path,
+				err: expect.objectContaining({
+					name: "Error",
+					detail: "probe registry at internal-host-marker is gone",
+				}),
+			});
+			expect((fields as { err: unknown }).err).not.toBeInstanceOf(Error);
+			expect(otherLevels(logger)).toEqual([]);
+		},
+	);
+
+	it("takes a 4xx status an error did not mark as the client's for the server's: 500, logged", async () => {
+		// A store's or a library's error can carry an HTTP status of its own —
+		// the answer it got — which is not this server's answer to the client.
+		const { app, logger } = host([
+			probeWhoseNameThrows(
+				Object.assign(new Error("the probe registry refused this deployment"), { status: 403 }),
+			),
+		]);
+
+		const res = await request(app).get("/readyz");
+
+		expect(res.status).toBe(500);
+		expect(res.body).toEqual({ error: "server_error", error_description: "unexpected_error" });
+		expect(logger.error).toHaveBeenCalledTimes(1);
+		expect(logger.error).toHaveBeenCalledWith(
+			{
+				endpoint: "/readyz",
+				err: expect.objectContaining({ name: "Error", status: 403 }),
+			},
+			"unhandled_request_error",
+		);
+	});
+});

package/templates/standalone/src/__tests__/library-references.fixture.mts

@@ -0,0 +1,183 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The libraries' layers beneath the template's own files, for a test that
+ * resolves its configuration by hand: the `reference.conf` of every package
+ * the template composes a module from, core's last, as `app.mts` layers them;
+ * and what that resolution captures of the renamed variables.
+ */
+
+import { fileURLToPath } from "node:url";
+import {
+	AppConfigSchema,
+	memoryRateLimiterModule,
+	moduleReferences,
+} from "@o3co/auth-provider-core";
+import { CORE_RELOCATIONS, renamedVariableCaptures } from "@o3co/auth-provider-core/testing";
+import { federationGrantsModules } from "@o3co/auth-provider-federation-grants";
+import {
+	oauthAuthorizationModule,
+	oauthModule,
+	oauthSessionModule,
+} from "@o3co/auth-provider-oauth";
+import {
+	redisCodeRepositoryModule,
+	redisFederationGrantStoreModule,
+	redisRateLimiterModule,
+	redisRefreshTokenFamilyStoreModule,
+} from "@o3co/auth-provider-redis";
+import { sessionModule, sessionStoreModule } from "@o3co/auth-provider-session";
+import { type Config, empty, parseFile } from "@o3co/ts.hocon";
+import { ADAPTERS_SECTION, readAdapters } from "../adapters.mjs";
+import { MFA_SWITCH, readMfaSwitch } from "../mfaSwitch.mjs";
+import {
+	httpModule,
+	inMemoryCodeRepositoryModule,
+	keyStoreModule,
+	loggingModule,
+	repositoriesModuleFor,
+	standaloneRedisClientsModule,
+	templateReference,
+} from "../modules.mjs";
+import type { Adapters, MfaSwitch } from "../sections.mjs";
+
+/** The oauth package's modules, whose manifests read nothing of the configuration they are handed but the grant switches. */
+const OAUTH_MODULES = [
+	oauthModule({ config: {} as never }),
+	oauthSessionModule({ config: {} as never }),
+	oauthAuthorizationModule({ config: {} as never }),
+];
+
+/** The modules the template composes that declare a renamed variable. */
+const RENAMING_MODULES = [
+	memoryRateLimiterModule,
+	redisRateLimiterModule,
+	redisRefreshTokenFamilyStoreModule,
+	redisFederationGrantStoreModule,
+	...OAUTH_MODULES,
+	sessionModule,
+	sessionStoreModule,
+	loggingModule,
+	httpModule,
+	keyStoreModule,
+	standaloneRedisClientsModule,
+	repositoriesModuleFor({ client: "yaml", user: "yaml" }),
+	inMemoryCodeRepositoryModule,
+];
+
+/** Every package reference the template's modules declare, core's last. */
+const LIBRARY_REFERENCES: readonly URL[] = moduleReferences([
+	redisRateLimiterModule,
+	...federationGrantsModules,
+	...OAUTH_MODULES,
+	sessionModule,
+	sessionStoreModule,
+]);
+
+/** The libraries' references resolved under `env`, in the order `app.mts` layers them. */
+export function libraryLayers(env: Readonly<Record<string, string>>): Config {
+	return LIBRARY_REFERENCES.reduce<Config>(
+		(layered, reference) =>
+			layered.withFallback(parseFile(fileURLToPath(reference), { env: { ...env } })),
+		empty(),
+	);
+}
+
+/**
+ * What a test that parses `layers` with `AppConfigSchema` lays beside that
+ * parse: every top-level section core's schema does not declare — the
+ * template's own modules' among them — as written, which the parse drops;
+ * not the composition root's `adapters`, which boot is never handed
+ * (`adaptersOf`).
+ */
+export function sectionsCoreDoesNotDeclare(layers: Config): Record<string, unknown> {
+	const raw = layers.toObject() as Record<string, unknown>;
+	return Object.fromEntries(
+		Object.entries(raw).filter(
+			([key]) =>
+				!Object.hasOwn(AppConfigSchema.shape, key) &&
+				key !== "renamed-variables" &&
+				key !== ADAPTERS_SECTION &&
+				key !== MFA_SWITCH,
+		),
+	);
+}
+
+/**
+ * The composition root's `adapters` a resolution holds — `layers`, the
+ * template's `config/reference.conf` among them, under `env` — as phase one
+ * reads them.
+ */
+export function adaptersOf(layers: Config, env: Readonly<Record<string, string>>): Adapters {
+	return readAdapters(layers.toObject() as Record<string, unknown>, env);
+}
+
+/**
+ * What phase one reads from a resolution beside core's switches —
+ * `layers`, the template's `config/reference.conf` among them, under `env` —
+ * as `readSwitches` reads it: the composition root's `adapters` and
+ * `mfaMode`, and the Store transport settings.
+ */
+export function rootSectionsOf(
+	layers: Config,
+	env: Readonly<Record<string, string>>,
+): { readonly adapters: Adapters; readonly mfaMode: MfaSwitch; readonly storeTransport: unknown } {
+	const raw = layers.toObject() as Record<string, unknown>;
+	const repositories = raw.repositories as { user?: { http?: unknown } } | undefined;
+	return {
+		adapters: readAdapters(raw, env),
+		mfaMode: readMfaSwitch(raw, env),
+		storeTransport: repositories?.user?.http,
+	};
+}
+
+/** The adapters the template ships, as its `config/reference.conf` sets them with no environment. */
+export function shippedAdapters(): Adapters {
+	return adaptersOf(parseFile(fileURLToPath(templateReference()), { env: {} }), {});
+}
+
+/** The shipped adapters with every store the template can hold in process there: no Redis connection needed. */
+export function inProcessAdapters(): Adapters {
+	return {
+		...shippedAdapters(),
+		rateLimiter: "memory",
+		userSessionStores: "memory",
+		accessTokenDenylist: "memory",
+		replaySeenSet: "memory",
+		federationTokenStore: "memory",
+		federationGrantStore: "memory",
+		federationGrantIntentStore: "memory",
+		mfaFactorStore: "memory",
+		mfaTransactionStore: "memory",
+		codeRepository: "memory",
+	};
+}
+
+/**
+ * The `renamed-variables` section a resolution under `env` holds: what every
+ * module above captures, and the Redis code repository's, which the
+ * in-process one's excludes from one composition (both declare
+ * CLIENT_CODE_DEFAULT_EXPIRES_IN renamed, each to its own new name).
+ */
+export function capturedRenames(
+	env: Readonly<Record<string, string | undefined>>,
+): Record<string, string | null> {
+	return {
+		...renamedVariableCaptures({ modules: [redisCodeRepositoryModule], env }),
+		...renamedVariableCaptures({ modules: RENAMING_MODULES, core: CORE_RELOCATIONS, env }),
+	};
+}