@o3co/create-auth-provider 0.17.0-rc.1 → 0.17.0-rc.2

package/templates/standalone/src/modules.mts

@@ -18,16 +18,13 @@ import {
 	consoleLogger,
 	createAuditSinkFactory,
 	createFederationTokenStoreFactory,
-	createInMemorySessionFamilyIndex,
-	createInMemorySessionFederationIndex,
-	createInMemorySessionRPRegistry,
+	createInMemorySessionLifecycleStore,
 	createInMemorySubjectRevocation,
 	createInMemorySubjectSessionIndex,
 	createInMemoryUserSessionStore,
 	createKeyStoreFactory,
 	createRepositoryFactories,
 	defineModule,
-	federationsOf,
 	type LifecycleRegistrar,
 	type Logger,
 	loggableError,
@@ -37,15 +34,12 @@ import {
 	registerBuiltinFederationTokenStores,
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
-import type { GoogleProviderConfig } from "@o3co/auth-provider-federation-google";
-import { readOidcFederationConfigs } from "@o3co/auth-provider-federation-oidc";
 import { registerBuiltinAdapters } from "@o3co/auth-provider-foundation";
 import {
 	makeIoredisClients,
 	makeIoredisFederationGrantIntentStoreClient,
 	makeIoredisFederationGrantStoreClient,
 } from "@o3co/auth-provider-redis/ioredis";
-import { extractFederationSection } from "@o3co/auth-provider-session";
 // Named import, not default: ioredis is CJS (`module.exports = Redis`, the
 // class re-exported as both `default` and `Redis`), so under `module:
 // "nodenext"` with esModuleInterop the default import resolves to the
@@ -306,9 +300,8 @@ export const inMemoryCodeRepositoryModule: Module = defineModule({
 });
 
 /**
- * In-memory user-session stores module: the four-store user-session split
- * (userSessionStore, sessionRPRegistry, sessionFamilyIndex,
- * sessionFederationIndex) and the subject-level revocation pair. Wired by
+ * In-memory user-session stores module: the user-session store, the session
+ * lifecycle store and the subject-level revocation pair. Wired by
  * `buildModules` only when `adapters.userSessionStores = "memory"`; the Redis
  * branch swaps in `redisSessionStoresModule` from `@o3co/auth-provider-redis`.
  */
@@ -317,13 +310,10 @@ export const inMemorySessionStoresModule: Module = defineModule({
 	replicaSafety: {
 		unsafe: true,
 		reason:
-			"user sessions, RP registrations, family indexes and the subject-level revocation pair fork per replica — back-channel logout reaches only the replica that received it, so a logged-out session stays valid on the others, and a credential change enumerates and watermarks only the replica that handled it",
+			"user sessions, the session lifecycle record and the subject-level revocation pair fork per replica — back-channel logout reaches only the replica that received it, so a logged-out session stays valid on the others, a close begun on one replica fences nothing on another, and a credential change enumerates and watermarks only the replica that handled it",
 	},
 	provides: {
 		userSessionStore: () => createInMemoryUserSessionStore(),
-		sessionRPRegistry: () => createInMemorySessionRPRegistry(),
-		sessionFamilyIndex: () => createInMemorySessionFamilyIndex(),
-		sessionFederationIndex: () => createInMemorySessionFederationIndex(),
 		// The subject-level revocation slots. Without them `subjectRevocation`
 		// is undefined: `verifyJwt` skips the watermark, the refresh gate is
 		// inert and `revokeAllForSubject` reports `unavailable`, all silently.
@@ -332,6 +322,9 @@ export const inMemorySessionStoresModule: Module = defineModule({
 		// other store on this branch.
 		subjectSessionIndex: () => createInMemorySubjectSessionIndex(),
 		subjectRevocation: () => createInMemorySubjectRevocation(),
+		// The session lifecycle's record, as the Redis branch provides it; read
+		// only where core's session lifecycle module is installed.
+		sessionLifecycleStore: () => createInMemorySessionLifecycleStore(),
 	},
 });
 
@@ -368,7 +361,7 @@ export const inMemoryFederationTokenStoreModule: Module = defineModule({
  * route that emits a security event reads, with the sink the composition
  * root's `adapters.auditSink` names: the template's `"logger"` (its default)
  * or one of core's built-ins, with that sink's options from
- * `audit-sink.<name>`. The slot is `optional` on `oauthModule`,
+ * `audit-sink.<name>`. The slot is `optional` on `oauthEndpointsModule`,
  * `sessionModule` and `webauthnModule`, and `emitAuditEvent` is a no-op when
  * it is empty, so this module is always in the manifest; a name no builder is
  * registered under refuses boot. The sink's options moved from `audit.sink`.
@@ -401,28 +394,6 @@ export function auditSinkModuleFor(sink: string): Module {
 	});
 }
 
-/**
- * @deprecated Split into `inMemorySessionStoresModule` and
- * `inMemoryFederationTokenStoreModule`; use those. Kept for consumers that
- * imported `storesModule` from this file.
- */
-export const storesModule: Module = defineModule({
-	name: "stores",
-	// Everything this bundle provides lives in process memory, so a
-	// composition still on it is refused under `core.deployment.mode = "multi"`
-	// like the split modules it stands in for.
-	replicaSafety: {
-		unsafe: true,
-		reason:
-			"user sessions, RP registrations, family indexes, the subject-level revocation pair and upstream federation tokens fork per replica — back-channel logout reaches only the replica that received it, so a logged-out session stays valid on the others",
-	},
-	requires: ["config"] as const,
-	provides: {
-		...inMemorySessionStoresModule.provides,
-		...inMemoryFederationTokenStoreModule.provides,
-	},
-});
-
 /**
  * Shared ioredis clients module: opens ONE long-lived ioredis connection per
  * replica and derives every per-purpose client from it (`makeIoredisClients`,
@@ -470,33 +441,6 @@ export const standaloneRedisClientsModule: Module = defineModule({
 			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
 				.userSessionStoreClient;
 		},
-		sessionRPRegistryClient: async ({
-			section,
-			lifecycleRegistrar,
-			readinessRegistrar,
-			logger,
-		}) => {
-			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
-				.sessionRPRegistryClient;
-		},
-		sessionFamilyIndexClient: async ({
-			section,
-			lifecycleRegistrar,
-			readinessRegistrar,
-			logger,
-		}) => {
-			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
-				.sessionFamilyIndexClient;
-		},
-		sessionFederationIndexClient: async ({
-			section,
-			lifecycleRegistrar,
-			readinessRegistrar,
-			logger,
-		}) => {
-			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
-				.sessionFederationIndexClient;
-		},
 		// The grant store and the intent store, consumed by the Redis grant
 		// modules when their switches say "redis". Provided whenever this module
 		// is installed, as every slot here is: a slot is cheap, the socket is
@@ -528,6 +472,11 @@ export const standaloneRedisClientsModule: Module = defineModule({
 			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
 				.rateLimiterClient;
 		},
+		// `redisAttemptCounterModule` consumes this slot where a deployment installs it.
+		attemptCounterClient: async ({ section, lifecycleRegistrar, readinessRegistrar, logger }) => {
+			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
+				.attemptCounterClient;
+		},
 		// `redisCodeRepositoryModule` consumes this slot when
 		// `adapters.codeRepository = "redis"`.
 		codeRepositoryClient: async ({ section, lifecycleRegistrar, readinessRegistrar, logger }) => {
@@ -569,9 +518,20 @@ export const standaloneRedisClientsModule: Module = defineModule({
 			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
 				.subjectRevocationClient;
 		},
+		// Required by `redisSessionStoresModule`, which builds the session
+		// lifecycle store from it once a module reads that store.
+		sessionLifecycleStoreClient: async ({
+			section,
+			lifecycleRegistrar,
+			readinessRegistrar,
+			logger,
+		}) => {
+			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
+				.sessionLifecycleStoreClient;
+		},
 		// Required by `redisDeviceCodeStoreModule`. This template does not mount
 		// the device grant; the slot is provided anyway, so a deployment that
-		// adds `deviceGrantModule` with the Redis store is not refused at boot
+		// adds `deviceAuthorizationGrantModule` with the Redis store is not refused at boot
 		// (`missing-required-component`) for a client slot nothing provided.
 		deviceCodeStoreClient: async ({ section, lifecycleRegistrar, readinessRegistrar, logger }) => {
 			return getOrCreateClients(section, lifecycleRegistrar, readinessRegistrar, logger)
@@ -731,151 +691,3 @@ function getOrCreateClients(
 	if (lifecycleRegistrar) clientsCache.set(lifecycleRegistrar, clients);
 	return clients;
 }
-
-/**
- * Reads an optional string field off a federation slice. An unset field stays
- * absent rather than becoming `undefined`, so `"sessionDomain" in config`
- * still distinguishes the two. A present non-string throws: HOCON hands
- * through whatever the file holds, and silently ignoring `sessionDomain = 42`
- * would run the redirect policy with one fewer constraint than the operator
- * wrote down.
- */
-function optionalString(
-	slice: Record<string, unknown>,
-	field: string,
-): Record<string, string> | Record<string, never> {
-	const value = slice[field];
-	if (value === undefined || value === null) return {};
-	if (typeof value !== "string") {
-		throw new Error(`core.federations.google.${field} must be a string when present`);
-	}
-	return { [field]: value };
-}
-
-/**
- * An optional boolean from the `core.federations.google` entry: a HOCON boolean, or
- * from an environment override (`${?VAR}`) a string in the spellings core's
- * `coerceBooleanFromEnv` accepts ("true" / "false" / "1" / "0", trimmed, any
- * case). Unlike that coercion, an empty value is refused, not read as false:
- * HOCON substitutes an exported-but-empty variable as "", and a security
- * switch must not quietly turn the check off. Anything else is refused too,
- * so a typo fails boot rather than reading as either value.
- */
-function optionalBoolean(
-	slice: Record<string, unknown>,
-	field: string,
-): Record<string, boolean> | Record<string, never> {
-	const value = slice[field];
-	if (value === undefined || value === null) return {};
-	if (typeof value === "boolean") return { [field]: value };
-	if (typeof value === "string") {
-		const normalized = value.trim().toLowerCase();
-		if (normalized === "true" || normalized === "1") return { [field]: true };
-		if (normalized === "false" || normalized === "0") return { [field]: false };
-	}
-	throw new Error(
-		`core.federations.google.${field} must be one of true, false, "true", "false", "1" or "0" when present`,
-	);
-}
-
-/**
- * `accessType` from the `core.federations.google` entry: `"offline"` or `"online"`,
- * exactly, or absent. `federation-google` refuses any other value too; this
- * refuses it first, naming the key, as the fields above do.
- */
-function optionalAccessType(
-	slice: Record<string, unknown>,
-): { accessType: "offline" | "online" } | Record<string, never> {
-	const value = slice.accessType;
-	if (value === undefined || value === null) return {};
-	if (value === "offline" || value === "online") return { accessType: value };
-	throw new Error('core.federations.google.accessType must be "offline" or "online" when present');
-}
-
-/**
- * Google federation config bridge: supplies the typed `googleFederationConfig`
- * slot from the `core.federations.google` entry. The bridge is the
- * composition root's responsibility because the slot's content is
- * consumer-specific (see the `@o3co/auth-provider-federation-google` README).
- *
- * It carries every field the provider reads, not only the credentials:
- * `googleFederationModule` hands this same object to
- * `createFederationRedirectPolicy`, so a dropped `redirectAllowlist` /
- * `sessionDomain` / `authCallbackUrl` / `clientUrl` would silently run the
- * policy without the constraints the operator configured.
- */
-export const googleFederationConfigModule: Module = defineModule({
-	name: "google-federation-config",
-	requires: ["config"] as const,
-	provides: {
-		googleFederationConfig: ({ config }): GoogleProviderConfig => {
-			const slice = extractFederationSection(federationsOf(config), "google");
-			if (!slice) {
-				throw new Error(
-					"core.federations.google must be enabled with credentials when googleFederationModule is in the manifest",
-				);
-			}
-			const clientId = slice.clientId;
-			const clientSecret = slice.clientSecret;
-			const callbackURL = slice.callbackURL;
-			if (
-				typeof clientId !== "string" ||
-				typeof clientSecret !== "string" ||
-				typeof callbackURL !== "string"
-			) {
-				throw new Error(
-					"core.federations.google requires clientId, clientSecret, callbackURL when enabled",
-				);
-			}
-
-			// The allowlist is checked for shape here and for content by
-			// `createFederationRedirectPolicy`, which owns the URL rules. This
-			// only has to establish that HOCON produced a list of strings —
-			// `redirectAllowlist = "https://…"` (a bare string, the natural typo)
-			// would otherwise reach the policy as a config it cannot read.
-			const rawAllowlist = slice.redirectAllowlist;
-			let redirectAllowlist: Record<string, readonly string[]> | Record<string, never> = {};
-			if (rawAllowlist !== undefined && rawAllowlist !== null) {
-				if (!Array.isArray(rawAllowlist) || rawAllowlist.some((e) => typeof e !== "string")) {
-					throw new Error(
-						"core.federations.google.redirectAllowlist must be a list of URL strings, " +
-							'e.g. ["https://app.example.com/welcome"]',
-					);
-				}
-				redirectAllowlist = { redirectAllowlist: rawAllowlist as readonly string[] };
-			}
-
-			return {
-				clientId,
-				clientSecret,
-				callbackURL,
-				...redirectAllowlist,
-				...optionalString(slice, "sessionDomain"),
-				...optionalString(slice, "authCallbackUrl"),
-				...optionalString(slice, "clientUrl"),
-				// Absent means the provider's default, which is to require it.
-				...optionalBoolean(slice, "requireAuthorizationResponseIss"),
-				// Absent means the provider's default, "offline": consent on every
-				// sign-in, and a refresh token for every session.
-				...optionalAccessType(slice),
-			};
-		},
-	},
-});
-
-/**
- * OIDC federation config bridge: supplies the `oidcFederationConfigs`
- * slot every `oidcFederationModule(<name>)` in the manifest reads its entry
- * from. One bridge for all instances: `readOidcFederationConfigs` walks
- * `core.federations` and reads every enabled entry of type `oidc`,
- * refusing a malformed field by `core.federations.<name>.<field>` at boot.
- * `buildModules` lists this module only when at least one such section
- * exists.
- */
-export const oidcFederationConfigModule: Module = defineModule({
-	name: "oidc-federation-config",
-	requires: ["config"] as const,
-	provides: {
-		oidcFederationConfigs: ({ config }) => readOidcFederationConfigs(federationsOf(config)),
-	},
-});

package/templates/standalone/src/rootRenames.mts

@@ -18,46 +18,62 @@
  * The variables renamed with a path of the composition root's own layers,
  * which no module declares: the adapter selections and the federations the
  * template ships. Phase one refuses an old name set alone, or beside its new
- * name at a different value, before any module is chosen; the two at one
- * value are accepted.
+ * name at a different value, before any module is chosen, as boot refuses a
+ * variable a module declares renamed (`environment-variable-renamed`); the
+ * two at one value are accepted. Boot's own check cannot hold these: an
+ * adapter selection decides which modules are chosen before boot, and a
+ * federation's key sits in core's section, whose renames core alone declares.
  */
 
-/** A variable renamed with a path of the composition root's own: its old name, its new one, and the path the new one binds. */
+import { variablesRenamed } from "./bootRefusal.mjs";
+
+/**
+ * A variable renamed with a path of the composition root's own: its old name,
+ * its new one, the path the new one binds, and the module that path's section
+ * is named after in a refusal's details (`bootRefusal.mts`).
+ */
 export interface RootRename {
+	readonly module: string;
 	readonly from: string;
 	readonly to: string;
 	readonly path: string;
 }
 
 /**
- * Refuses, with a `RangeError`, an old name in `env` set alone, or beside its
- * new name at a different value; the two at one value are accepted. Every
- * such rename is named at once; no value is quoted.
+ * Refuses, with an `environment-variable-renamed` `BootError`, an old name in
+ * `env` set alone (`unset`), or beside its new name at a different value
+ * (`different`); the two at one value are accepted. Every such rename is
+ * named at once; no value is quoted or carried.
  */
 export function refuseRenamedVariables(
 	env: Readonly<Record<string, string>>,
 	renames: readonly RootRename[],
 ): void {
-	const refused = renames.flatMap(({ from, to, path }) => {
+	const refused = renames.flatMap((rename) => {
+		const { from, to } = rename;
 		const old = env[from];
 		if (old === undefined || env[to] === old) return [];
+		return [
+			{ ...rename, state: env[to] === undefined ? ("unset" as const) : ("different" as const) },
+		];
+	});
+	if (refused.length === 0) return;
+	const named = refused.map(({ from, to, path, state }) => {
 		const renamed = `${from} was renamed ${to}, the variable ${path} is bound to; see CHANGELOG.`;
-		return env[to] === undefined
-			? [`${renamed} Set ${to} instead and unset ${from}.`]
-			: [
-					`${renamed} ${to} is set to a different value: keep the one you mean in ${to} and unset ${from}.`,
-				];
+		return state === "unset"
+			? `${renamed} Set ${to} instead and unset ${from}.`
+			: `${renamed} ${to} is set to a different value: keep the one you mean in ${to} and unset ${from}.`;
 	});
-	if (refused.length > 0) {
-		throw new RangeError(
-			`The environment sets ${refused.length} variable(s) that were renamed: ${refused.join(" ")}`,
-		);
-	}
+	throw variablesRenamed(
+		`The environment sets ${refused.length} variable(s) that were renamed: ${named.join(" ")}`,
+		refused.map(({ module, from, to, path, state }) => ({ module, from, to, path, state })),
+	);
 }
 
 /**
  * The variables `config/application.conf` binds for the two federations the
- * template ships, each renamed after its path under `core.federations`.
+ * template ships, each renamed after its path under `core.federations`: in
+ * core's section, so named under module "core" in a refusal's details.
  */
 export const SHIPPED_FEDERATION_RENAMES: readonly RootRename[] = (
 	[
@@ -73,6 +89,7 @@ export const SHIPPED_FEDERATION_RENAMES: readonly RootRename[] = (
 		["OIDC", "oidc", ["CALLBACK_URL", "callbackURL"]],
 	] as const
 ).map(([federation, name, [key, path]]) => ({
+	module: "core",
 	from: `FEDERATIONS_${federation}_${key}`,
 	to: `CORE_FEDERATIONS_${federation}_${key}`,
 	path: `core.federations.${name}.${path}`,

package/templates/standalone/src/sections.mts

@@ -255,6 +255,7 @@ export const redisClientsSectionSchema = z
 export const adaptersSchema = z
 	.object({
 		rateLimiter: z.enum(["memory", "redis"]),
+		attemptCounter: z.enum(["memory", "redis"]),
 		userSessionStores: z.enum(["memory", "redis"]),
 		accessTokenDenylist: z.enum(["memory", "redis"]),
 		replaySeenSet: z.enum(["memory", "redis"]),

package/templates/standalone/tests/index.test.js

@@ -262,9 +262,10 @@ describe("GET /oauth/authorize", () => {
 
 describe("GET /session/oauth/federation/google", () => {
 	// NOTE: Development config has Google federation disabled (google.enabled: false).
-	// The googleEnabled check runs first and returns 404, so redirect_to validation
-	// tests cannot run in this environment. Validation logic is identical to
-	// POST /session/login and covered by those tests.
+	// No federation is registered under that name, so the route answers 404 before
+	// redirect_to is validated, and redirect_to validation tests cannot run in this
+	// environment. Validation logic is identical to POST /session/login and covered
+	// by those tests.
 
 	it("returns 404 when Google federation is disabled", async () => {
 		const res = await client.get(

package/templates/versions.json

@@ -1,20 +1,20 @@
 {
-	"@o3co/auth-provider-core": "0.17.0-rc.1",
-	"@o3co/auth-provider-device-grant": "0.17.0-rc.1",
-	"@o3co/auth-provider-dpop": "0.17.0-rc.1",
-	"@o3co/auth-provider-mtls": "0.17.0-rc.1",
-	"@o3co/auth-provider-federation-apple": "0.17.0-rc.1",
-	"@o3co/auth-provider-federation-google": "0.17.0-rc.1",
-	"@o3co/auth-provider-federation-github": "0.17.0-rc.1",
-	"@o3co/auth-provider-federation-grants": "0.17.0-rc.1",
-	"@o3co/auth-provider-federation-oidc": "0.17.0-rc.1",
-	"@o3co/auth-provider-oauth": "0.17.0-rc.1",
-	"@o3co/auth-provider-oauth-token-exchange": "0.17.0-rc.1",
-	"@o3co/auth-provider-session": "0.17.0-rc.1",
-	"@o3co/auth-provider-foundation": "0.17.0-rc.1",
-	"@o3co/auth-provider-mfa": "0.17.0-rc.1",
-	"@o3co/auth-provider-redis": "0.17.0-rc.1",
-	"@o3co/auth-provider-standard": "0.17.0-rc.1",
-	"@o3co/auth-provider-test-kit": "0.17.0-rc.1",
-	"@o3co/auth-provider-webauthn": "0.17.0-rc.1"
+	"@o3co/auth-provider-core": "0.17.0-rc.2",
+	"@o3co/auth-provider-device-grant": "0.17.0-rc.2",
+	"@o3co/auth-provider-dpop": "0.17.0-rc.2",
+	"@o3co/auth-provider-mtls": "0.17.0-rc.2",
+	"@o3co/auth-provider-federation-apple": "0.17.0-rc.2",
+	"@o3co/auth-provider-federation-google": "0.17.0-rc.2",
+	"@o3co/auth-provider-federation-github": "0.17.0-rc.2",
+	"@o3co/auth-provider-federation-grants": "0.17.0-rc.2",
+	"@o3co/auth-provider-federation-oidc": "0.17.0-rc.2",
+	"@o3co/auth-provider-oauth": "0.17.0-rc.2",
+	"@o3co/auth-provider-oauth-token-exchange": "0.17.0-rc.2",
+	"@o3co/auth-provider-session": "0.17.0-rc.2",
+	"@o3co/auth-provider-foundation": "0.17.0-rc.2",
+	"@o3co/auth-provider-mfa": "0.17.0-rc.2",
+	"@o3co/auth-provider-redis": "0.17.0-rc.2",
+	"@o3co/auth-provider-standard": "0.17.0-rc.2",
+	"@o3co/auth-provider-test-kit": "0.17.0-rc.2",
+	"@o3co/auth-provider-webauthn": "0.17.0-rc.2"
 }

package/templates/standalone/src/__tests__/access-token-lifetime-alias.test.mts

@@ -1,134 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * `oauth.accessToken.expiresIn` / OAUTH_ACCESS_TOKEN_EXPIRES_IN is a deprecated
- * alias of `defaultExpiresIn`, and the composition says so once.
- *
- * Core's `reference.conf` keeps the shipped lifetime on the deprecated key, so
- * the alias supplies the default for every deployment that set nothing; a
- * warning there would train operators to ignore it. Only an override of the old
- * key is something to move.
- */
-
-import { fileURLToPath } from "node:url";
-import { AppConfigSchema, coreReference, type Logger } from "@o3co/auth-provider-core";
-import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, type Switches } from "../configPath.mjs";
-import { templateReference } from "../modules.mjs";
-import { rootSectionsOf } from "./library-references.fixture.mjs";
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-const REQUIRED_ENV = {
-	KEY_STORE_LOCAL_SECRET: "access-token-alias.at-least-32-bytes.ok",
-	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_STORE_SECRET: "access-token-alias-session.at-least-32-bytes.ok",
-};
-
-/** The shipped layers, resolved the way `app.mts` resolves them. */
-function loadShipped(env: Record<string, string> = {}): Switches {
-	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "development");
-	const resolvedEnv = { ...REQUIRED_ENV, ...env };
-	const layers = parseFile(envConfPath, { env: resolvedEnv })
-		.withFallback(parseFile(applicationConfPath, { env: resolvedEnv }))
-		.withFallback(parseFile(fileURLToPath(templateReference()), { env: resolvedEnv }))
-		.withFallback(parseFile(fileURLToPath(coreReference()), { env: resolvedEnv }));
-	return { ...validate(layers, AppConfigSchema), ...rootSectionsOf(layers, resolvedEnv) };
-}
-
-/** What `buildModules` hands the logger it is given, per level. */
-function logged(config: Switches): Array<{ level: string; args: unknown[] }> {
-	const calls: Array<{ level: string; args: unknown[] }> = [];
-	const record =
-		(level: string) =>
-		(...args: unknown[]): void => {
-			calls.push({ level, args });
-		};
-	const logger: Logger = {
-		trace: record("trace"),
-		debug: record("debug"),
-		info: record("info"),
-		warn: record("warn"),
-		error: record("error"),
-		fatal: record("fatal"),
-		child: () => logger,
-	};
-	buildModules(config, { logger });
-	return calls;
-}
-
-/** The one line the alias is reported by: object-first, an event name, at warn. */
-const ALIAS_WARNING = {
-	level: "warn",
-	args: [
-		{
-			key: "oauth.accessToken.expiresIn",
-			env: "OAUTH_ACCESS_TOKEN_EXPIRES_IN",
-			replacement: "oauth.accessToken.defaultExpiresIn",
-			replacementEnv: "OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN",
-		},
-		"config_key_deprecated",
-	],
-};
-
-/** Every line `buildModules` writes about the deprecated key. */
-const aliasWarnings = (config: Switches) =>
-	logged(config).filter(
-		({ args }) => (args[0] as { key?: unknown } | undefined)?.key === "oauth.accessToken.expiresIn",
-	);
-
-describe("the deprecated access-token lifetime alias", () => {
-	afterEach(() => {
-		vi.restoreAllMocks();
-	});
-
-	it("says nothing for a deployment that sets no lifetime at all", () => {
-		// Also what keeps the template's idea of "the shipped value" honest: it
-		// is measured against core's real `reference.conf`, so a change to the
-		// shipped literal fails here rather than warning every deployment.
-		expect(aliasWarnings(loadShipped())).toEqual([]);
-	});
-
-	it("says nothing for a deployment on the new variable", () => {
-		expect(aliasWarnings(loadShipped({ OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "900" }))).toEqual(
-			[],
-		);
-	});
-
-	it("warns once, object-first, when OAUTH_ACCESS_TOKEN_EXPIRES_IN still decides the default", () => {
-		expect(logged(loadShipped({ OAUTH_ACCESS_TOKEN_EXPIRES_IN: "900" }))).toEqual([ALIAS_WARNING]);
-	});
-
-	it("warns for a hand-built configuration that overrides only the old key", () => {
-		const config = loadShipped();
-		expect(
-			aliasWarnings({
-				...config,
-				oauth: { ...config.oauth, accessToken: { expiresIn: 900 } },
-			}),
-		).toEqual([ALIAS_WARNING]);
-	});
-
-	it("writes the same line through consoleLogger when no logger is handed over", () => {
-		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
-		buildModules(loadShipped({ OAUTH_ACCESS_TOKEN_EXPIRES_IN: "900" }));
-		expect(warn.mock.calls).toEqual([ALIAS_WARNING.args]);
-	});
-});