@o3co/create-auth-provider 0.17.0-rc.2 → 0.17.0-rc.4

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -102,6 +102,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(

package/templates/standalone/src/__tests__/repositories-logger.test.mts

@@ -0,0 +1,119 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The repositories module builds its user repository with the composition's
+ * logger: the yaml user builder's `user_repository_in_memory` line reaches the
+ * `logger` bootstrap component (the template's pino logger, at its level),
+ * not the console.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	type BootstrapMap,
+	createApp,
+	defineModule,
+	type Logger,
+	type UserRepository,
+} from "@o3co/auth-provider-core";
+import {
+	CORE_RELOCATIONS,
+	makeValidCoreConfig,
+	renamedVariableCaptures,
+} from "@o3co/auth-provider-core/testing";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { repositoriesModuleFor } from "../modules.mjs";
+
+const spyLogger = () => {
+	const logger = {
+		trace: vi.fn(),
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn: vi.fn(),
+		error: vi.fn(),
+		fatal: vi.fn(),
+		child: vi.fn(),
+	};
+	logger.child.mockReturnValue(logger);
+	return logger;
+};
+
+describe("the repositories module's user repository", () => {
+	let dir: string;
+	beforeEach(() => {
+		dir = fs.mkdtempSync(path.join(os.tmpdir(), "repositories-logger-"));
+	});
+	afterEach(() => {
+		fs.rmSync(dir, { recursive: true, force: true });
+		vi.restoreAllMocks();
+	});
+
+	it("warns user_repository_in_memory on the composition's logger, built through createApp, and not on the console", async () => {
+		const usersPath = path.join(dir, "users.yaml");
+		fs.writeFileSync(usersPath, 'alice:\n  password: "plainpass"\n');
+		const clientsPath = path.join(dir, "clients.yaml");
+		fs.writeFileSync(clientsPath, "");
+		const consoleWarn = vi.spyOn(console, "warn").mockImplementation(() => {});
+		const logger = spyLogger();
+		let built: UserRepository | undefined;
+		const reader = defineModule({
+			name: "test:user-repository-reader",
+			requires: ["userRepository"] as const,
+			provides: {
+				userRepositoryRead: ({ userRepository }: { userRepository: UserRepository }) => {
+					built = userRepository;
+					return true;
+				},
+			},
+			lifecycle: { userRepositoryRead: { eager: true } },
+		} as never);
+
+		const repositories = repositoriesModuleFor({ client: "yaml", user: "yaml" });
+		const handle = await createApp({
+			modules: [repositories, reader],
+			bootstrapComponents: {
+				config: {
+					...makeValidCoreConfig(),
+					repositories: {
+						client: { yaml: { path: clientsPath } },
+						user: { yaml: { path: usersPath }, http: {} },
+					},
+					// What a resolution with none of the renamed variables set captures.
+					"renamed-variables": renamedVariableCaptures({
+						modules: [repositories],
+						core: CORE_RELOCATIONS,
+						env: {},
+					}),
+				},
+				pathResolver: (p: string) => p,
+				logger: logger as unknown as Logger,
+			} as unknown as BootstrapMap,
+		});
+		try {
+			expect((await built?.authenticate("alice", "plainpass"))?.username).toBe("alice");
+			expect(
+				logger.warn.mock.calls.filter(([, event]) => event === "user_repository_in_memory"),
+			).toEqual([[{ store: "userRepository", adapter: "yaml" }, "user_repository_in_memory"]]);
+			expect(
+				consoleWarn.mock.calls.filter((args) => args.includes("user_repository_in_memory")),
+			).toEqual([]);
+		} finally {
+			await handle.dispose();
+		}
+	});
+});

package/templates/standalone/src/__tests__/scaffold-assets.test.mts

@@ -32,6 +32,7 @@ import { buildModules } from "../buildModules.mjs";
 import { readOwnLayers, readSwitches, resolveConfigPaths } from "../configPath.mjs";
 import { templateReference } from "../modules.mjs";
 import { type Adapters, repositoriesSectionSchema } from "../sections.mjs";
+import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
 
 const standaloneDir = fileURLToPath(new URL("../..", import.meta.url));
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
@@ -355,8 +356,8 @@ function dotenvExample(): Record<string, string> {
 	return env;
 }
 
-describe("the production compose leaves MFA on, for the deployment to decide", () => {
-	it("reads the switch as required, so a deployment that sets nothing about MFA is refused naming MFA_MODE=off", () => {
+describe("the production compose leaves MFA to the configuration's switch, for the deployment to decide", () => {
+	it("reads the switch as the configuration's files write it: on, a deployment that sets nothing about MFA is refused naming MFA_MODE=off; off, it installs nothing of MFA", () => {
 		// `environment:` wins over `env_file`, so the compose file's block is
 		// laid over the `.env` copied from `.env.example`.
 		const env = { ...dotenvExample(), ...bootableEnv("/docker-compose.production.yml") };
@@ -365,8 +366,14 @@ describe("the production compose leaves MFA on, for the deployment to decide", (
 		expect(configEnv).toBe("production");
 		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
 		const switches = readSwitches(readOwnLayers([envConfPath, applicationConfPath], { env }));
-		expect(switches.mfaMode).toBe("required");
+		const mode = configuredMfaMode(configEnv);
+		expect(switches.mfaMode).toBe(mode);
 
+		if (mode === "off") {
+			const names = buildModules(switches, { environment: configEnv }).map((m) => m.name);
+			expect(names.filter((name) => /mfa/i.test(name))).toEqual([]);
+			return;
+		}
 		let err: unknown;
 		try {
 			buildModules(switches, { environment: configEnv });

package/templates/standalone/src/__tests__/sections.test.mts

@@ -443,12 +443,36 @@ describe("redis-clients", () => {
 		expect(redisClientsSectionSchema.parse({ url: "redis://r:6379", password: "p" })).toEqual({
 			url: "redis://r:6379",
 			password: "p",
+			assumeNoEviction: false,
 		});
 		expect(redisClientsSectionSchema.parse({ url: "redis://r:6379" })).toEqual({
 			url: "redis://r:6379",
+			assumeNoEviction: false,
 		});
 	});
 
+	it.each([
+		[true, true],
+		["true", true],
+		["1", true],
+		["false", false],
+		["", false],
+	])("reads assumeNoEviction %j as %s", (given, read) => {
+		expect(
+			redisClientsSectionSchema.parse({ url: "redis://r:6379", assumeNoEviction: given })
+				.assumeNoEviction,
+		).toBe(read);
+	});
+
+	it("refuses an assumeNoEviction it cannot read as a boolean, naming the key", () => {
+		const parsed = redisClientsSectionSchema.safeParse({
+			url: "redis://r:6379",
+			assumeNoEviction: "yes",
+		});
+		expect(parsed.success).toBe(false);
+		expect(parsed.error?.issues[0]?.path).toEqual(["assumeNoEviction"]);
+	});
+
 	it.each([
 		["no URL", {}],
 		["a null URL", { url: null }],

package/templates/standalone/src/__tests__/shipped-config-notices.test.mts

@@ -74,6 +74,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(

package/templates/standalone/src/__tests__/startup-log-lines.test.mts

@@ -0,0 +1,148 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * What the template writes while it starts: `src/app.mts` in a process of its
+ * own, in development on the memory stores, until it listens and then until
+ * it has shut down. Every line on stdout and on stderr is one JSON object from
+ * the structured logger — a warning a store gives at boot included.
+ */
+
+import { type ChildProcess, spawn } from "node:child_process";
+import { generateKeyPairSync } from "node:crypto";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const templateRoot = fileURLToPath(new URL("../..", import.meta.url));
+const tsxCli = createRequire(import.meta.url).resolve("tsx/cli");
+
+const keyPair = generateKeyPairSync("ed25519", {
+	publicKeyEncoding: { type: "spki", format: "pem" },
+	privateKeyEncoding: { type: "pkcs8", format: "pem" },
+});
+
+/** An empty client registry: a scaffolded project's clone has no `config/clients.yaml`. */
+const clientsFile = (() => {
+	const file = join(mkdtempSync(join(tmpdir(), "startup-log-lines-")), "clients.yaml");
+	writeFileSync(file, "");
+	return file;
+})();
+
+/**
+ * Development, with every store the `adapters` section selects in memory.
+ * The refresh-token family store has no memory choice in the template; its
+ * shared Redis socket points at a port nothing answers, so the run reaches no
+ * real server. Nothing is inherited from the test runner's environment but
+ * PATH, so its NODE_ENV and LOGGING_LEVEL do not reach the child.
+ */
+const ENV: Readonly<Record<string, string>> = {
+	PATH: process.env.PATH ?? "",
+	CONFIG_ENV: "development",
+	NODE_ENV: "development",
+	LOGGING_LEVEL: "info",
+	HTTP_PORT: "0",
+	OAUTH_JWT_ISSUER: "http://localhost:3000",
+	KEY_STORE_LOCAL_PRIVATE_KEY: keyPair.privateKey,
+	KEY_STORE_LOCAL_PUBLIC_KEY: keyPair.publicKey,
+	SESSION_STORE_SECRET: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.sid",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_ATTEMPT_COUNTER: "memory",
+	ADAPTERS_USER_SESSION_STORES: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+	ADAPTERS_MFA_FACTOR_STORE: "memory",
+	ADAPTERS_MFA_TRANSACTION_STORE: "memory",
+	REDIS_CLIENTS_URL: "redis://127.0.0.1:9",
+	REPOSITORIES_CLIENT_YAML_PATH: clientsFile,
+	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: "http://127.0.0.1:9/authenticate",
+	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: "http://127.0.0.1:9/authenticate-by-token",
+};
+
+interface Run {
+	readonly stdout: string;
+	readonly stderr: string;
+	readonly listened: boolean;
+}
+
+/** Starts the template, stops it once it listens (or gives up), and returns what it wrote. */
+function startAndStop(timeoutMs: number): Promise<Run> {
+	return new Promise((resolve, reject) => {
+		const child: ChildProcess = spawn(process.execPath, [tsxCli, "src/app.mts"], {
+			cwd: templateRoot,
+			env: ENV,
+			stdio: ["ignore", "pipe", "pipe"],
+		});
+		let stdout = "";
+		let stderr = "";
+		let listened = false;
+		const stop = (): void => {
+			if (child.exitCode === null && child.signalCode === null) child.kill("SIGTERM");
+		};
+		const deadline = setTimeout(stop, timeoutMs);
+		child.stdout?.setEncoding("utf8").on("data", (chunk: string) => {
+			stdout += chunk;
+			if (!listened && stdout.includes('"msg":"server_listening"')) {
+				listened = true;
+				stop();
+			}
+		});
+		child.stderr?.setEncoding("utf8").on("data", (chunk: string) => {
+			stderr += chunk;
+		});
+		child.on("error", (err) => {
+			clearTimeout(deadline);
+			reject(err);
+		});
+		child.on("close", () => {
+			clearTimeout(deadline);
+			resolve({ stdout, stderr, listened });
+		});
+	});
+}
+
+/** Each line of `text` that is not one JSON object. */
+function linesThatAreNotJsonObjects(text: string): string[] {
+	return text
+		.split("\n")
+		.filter((line) => line.trim() !== "")
+		.filter((line) => {
+			try {
+				const parsed: unknown = JSON.parse(line);
+				return typeof parsed !== "object" || parsed === null || Array.isArray(parsed);
+			} catch {
+				return true;
+			}
+		});
+}
+
+describe("the template's startup output", () => {
+	it("is one JSON object per line on stdout and stderr, in development on the memory stores", async () => {
+		const run = await startAndStop(15_000);
+
+		expect(run.listened, `the template did not listen; stderr:\n${run.stderr}`).toBe(true);
+		expect(linesThatAreNotJsonObjects(run.stdout)).toEqual([]);
+		expect(linesThatAreNotJsonObjects(run.stderr)).toEqual([]);
+	}, 30_000);
+});

package/templates/standalone/src/__tests__/three-tier-resolution.test.mts

@@ -29,6 +29,7 @@ import {
 	type Switches,
 } from "../configPath.mjs";
 import { templateReference } from "../modules.mjs";
+import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
 import { type BothPhases, withSwitches } from "./library-references.fixture.mjs";
 
 // config/ is two levels above this test file:
@@ -109,15 +110,18 @@ describe("three-tier HOCON resolution (env → application.conf → reference.co
 		expect(grants(config).authorizationCode?.enabled).toBe("false");
 	});
 
-	it("reads the MFA switch, mfaMode, as required where MFA_MODE is unset, and installs no MFA module under MFA_MODE=off", () => {
-		// The template's reference.conf ships the switch required and binds MFA_MODE.
+	it("reads the MFA switch, mfaMode, as the files write it where MFA_MODE is unset, and installs no MFA module under MFA_MODE=off", () => {
+		// The template's reference.conf ships the switch required and binds
+		// MFA_MODE; a project's application.conf may write it over that.
 		const mfaNames = (config: Switches) =>
 			buildModules(config)
 				.map((m) => m.name)
 				.filter((name) => /mfa/i.test(name));
 		const shipped = buildResolvedConfig("development");
-		expect(shipped.mfaMode).toBe("required");
-		expect(mfaNames(shipped)).toContain("mfa");
+		const configured = configuredMfaMode("development");
+		expect(shipped.mfaMode).toBe(configured);
+		if (configured === "off") expect(mfaNames(shipped)).toEqual([]);
+		else expect(mfaNames(shipped)).toContain("mfa");
 		const off = buildResolvedConfig("development", { MFA_MODE: "off" });
 		expect(off.mfaMode).toBe("off");
 		expect(mfaNames(off)).toEqual([]);

package/templates/standalone/src/__tests__/two-phase-config.test.mts

@@ -69,6 +69,7 @@ import {
 	type Switches,
 } from "../configPath.mjs";
 import { MFA_SWITCH } from "../mfaSwitch.mjs";
+import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 
@@ -270,7 +271,7 @@ describe("phase one reads federation-grants.enabled as the federation-grants mod
 	it("reads the MFA switch as its own mfaMode, as the environment sets it, and no key of the MFA module's", () => {
 		for (const [name, env] of Object.entries(ENVIRONMENTS)) {
 			const switches = readSwitches(readOwnLayers(ownFiles("production"), { env }));
-			expect(switches.mfaMode, name).toBe(env.MFA_MODE ?? "required");
+			expect(switches.mfaMode, name).toBe(env.MFA_MODE ?? configuredMfaMode("production"));
 			expect(switches, name).not.toHaveProperty("mfa");
 		}
 	});

package/templates/standalone/src/adapters.mts

@@ -21,7 +21,7 @@
  * moved from, and the variables renamed with them, are refused here, before
  * any module is chosen, in the words and under the reasons boot refuses a
  * module's with (`config-path-relocated`, `environment-variable-renamed`): a
- * renamed variable set alone, or beside its new name at a different value, is
+ * renamed variable set, alone or beside its new name at any value, is
  * refused, naming the variables and never a value.
  */
 
@@ -128,7 +128,7 @@ export function readAdapters(
 			`Configuration sets ${moved.length} path(s) that moved: ${moved
 				.map(
 					({ from, to, environmentVariable }) =>
-						`${from} has moved to ${to}; see CHANGELOG. Write it there (environment variable ${environmentVariable}) and remove this field from your config (or unset the environment variable that sets it).`,
+						`${from} has moved to ${to}; see the upgrade guide (docs/upgrading-from-v0.16.0.md). Write it there (environment variable ${environmentVariable}) and remove this field from your config (or unset the environment variable that sets it).`,
 				)
 				.join(" ")}`,
 			moved,

package/templates/standalone/src/mfaSwitch.mts

@@ -38,6 +38,7 @@
  */
 
 import {
+	isDevelopmentEnvironment,
 	type Module,
 	memoryMfaFactorStoreModule,
 	memoryMfaTransactionStoreModule,
@@ -96,13 +97,11 @@ export function readMfaSwitch(
 	return result.data;
 }
 
-/** The names the memory MFA stores are let in under. */
-const DEVELOPMENT_NAMES: ReadonlySet<string> = new Set(["development", "test"]);
-
 /**
  * Why the MFA stores may not be kept in memory under `environment` and
- * `CONFIG_ENV` and `NODE_ENV` wherever they are set: each name that is not
- * development or test, or that nothing is named. None lifts another's.
+ * `CONFIG_ENV` and `NODE_ENV` wherever they are set, as core's
+ * `isDevelopmentEnvironment` reads them: each name that is not development
+ * or test, or that nothing is named. None lifts another's.
  */
 function memoryRefusals(environment: string | undefined): string[] {
 	const named: [string, string][] =
@@ -113,10 +112,10 @@ function memoryRefusals(environment: string | undefined): string[] {
 	}
 	if (named.length === 0) return ["no environment is named"];
 	return named.flatMap(([label, value]) => {
+		if (isDevelopmentEnvironment([value])) return [];
 		const production = productionEnvironmentIn([value]);
 		if (production !== undefined) return [`${label} is "${production}"`];
-		const name = readEnvironmentName(value) ?? "";
-		return DEVELOPMENT_NAMES.has(name) ? [] : [`${label} "${name}" is not development or test`];
+		return [`${label} "${readEnvironmentName(value)}" is not development or test`];
 	});
 }
 

package/templates/standalone/src/modules.mts

@@ -240,7 +240,10 @@ export function repositoriesModuleFor(selection: RepositorySelection): Module {
 		// Forwarded into the repository factories so client/user adapters can
 		// register disposal callbacks (file-watch closers, say). Without it, a
 		// builder's `ctx.lifecycle?.register` is a no-op and those resources leak.
-		optional: ["lifecycleRegistrar"] as const,
+		// The logger is the composition's, so what a builder logs (the yaml user
+		// repository's `user_repository_in_memory`) goes where the template's
+		// logging goes, at its level, rather than to the console.
+		optional: ["lifecycleRegistrar", "logger"] as const,
 		provides: {
 			clientRepository: async ({ section, lifecycleRegistrar }) => {
 				const { clientFactory } = createRepositoryFactories({ lifecycle: lifecycleRegistrar });
@@ -250,8 +253,11 @@ export function repositoriesModuleFor(selection: RepositorySelection): Module {
 					path: path.resolve(process.cwd(), file.path),
 				});
 			},
-			userRepository: async ({ section, lifecycleRegistrar }) => {
-				const { userFactory } = createRepositoryFactories({ lifecycle: lifecycleRegistrar });
+			userRepository: async ({ section, lifecycleRegistrar, logger }) => {
+				const { userFactory } = createRepositoryFactories({
+					lifecycle: lifecycleRegistrar,
+					logger,
+				});
 				registerBuiltinAdapters({ userFactory });
 				return userFactory.create(
 					flattenAdapterConfig({
@@ -338,7 +344,7 @@ export const inMemorySessionStoresModule: Module = defineModule({
  * the `adapters.userSessionStores` selection.
  *
  * The memory adapter comes through core's factory: that is where its
- * "dev/test only" boot warning lives.
+ * "dev/test only" boot warning lives, said on the composition's `logger`.
  */
 export const inMemoryFederationTokenStoreModule: Module = defineModule({
 	name: "standalone-in-memory-federation-token-store",
@@ -347,10 +353,11 @@ export const inMemoryFederationTokenStoreModule: Module = defineModule({
 		reason:
 			"upstream federation tokens fork per replica — a token stored by the replica that completed the federation callback is missing on the others, so a session cannot refresh its upstream token from another replica, and logout removes only the tokens the replica it lands on can see",
 	},
+	optional: ["logger"] as const,
 	provides: {
-		federationTokenStore: async () => {
+		federationTokenStore: async ({ logger }) => {
 			const factory = createFederationTokenStoreFactory();
-			registerBuiltinFederationTokenStores(factory);
+			registerBuiltinFederationTokenStores(factory, logger);
 			return factory.create({ type: "memory" });
 		},
 	},
@@ -408,7 +415,8 @@ export function auditSinkModuleFor(sink: string): Module {
  * `redis-clients`, which moved from `refreshTokenFamilyStore.redis` with its
  * variables (`REDIS_CLIENTS_*`). Per-store Redis instances belong in a
  * custom composition root. An empty URL throws rather than falling back to
- * localhost. `io.quit()` is registered once with `lifecycleRegistrar`, so
+ * localhost. `assumeNoEviction` is handed to every client, for the Redis
+ * stores' eviction gate. `io.quit()` is registered once with `lifecycleRegistrar`, so
  * `handle.dispose()` closes the connection.
  *
  * `buildModules` adds this module only when some composed module needs a
@@ -639,7 +647,11 @@ type StandaloneRedisClients = ReturnType<typeof makeIoredisClients> & {
 // registrar (tests that seed none), each call creates a fresh client.
 const clientsCache = new WeakMap<LifecycleRegistrar, StandaloneRedisClients>();
 function getOrCreateClients(
-	section: { readonly url: string; readonly password?: string | undefined },
+	section: {
+		readonly url: string;
+		readonly password?: string | undefined;
+		readonly assumeNoEviction: boolean;
+	},
 	lifecycleRegistrar: LifecycleRegistrar | undefined,
 	readinessRegistrar?: ReadinessRegistrar,
 	injectedLogger?: Logger,
@@ -684,7 +696,7 @@ function getOrCreateClients(
 	// (`refreshTokenFamilyClient.duplicate()`), which inherit no listeners from
 	// `io`; passing the logger lets those report through the same channel.
 	const clients: StandaloneRedisClients = {
-		...makeIoredisClients(io, { logger }),
+		...makeIoredisClients(io, { logger, assumeNoEviction: section.assumeNoEviction }),
 		federationGrantStoreClient: makeIoredisFederationGrantStoreClient(io),
 		federationGrantIntentStoreClient: makeIoredisFederationGrantIntentStoreClient(io),
 	};

package/templates/standalone/src/rootRenames.mts

@@ -17,12 +17,12 @@
 /**
  * The variables renamed with a path of the composition root's own layers,
  * which no module declares: the adapter selections and the federations the
- * template ships. Phase one refuses an old name set alone, or beside its new
- * name at a different value, before any module is chosen, as boot refuses a
- * variable a module declares renamed (`environment-variable-renamed`); the
- * two at one value are accepted. Boot's own check cannot hold these: an
- * adapter selection decides which modules are chosen before boot, and a
- * federation's key sits in core's section, whose renames core alone declares.
+ * template ships. Phase one refuses an old name set, alone or beside its new
+ * name at any value, before any module is chosen, as boot refuses a
+ * variable a module declares renamed (`environment-variable-renamed`).
+ * Boot's own check cannot hold these: an adapter selection decides which
+ * modules are chosen before boot, and a federation's key sits in core's
+ * section, whose renames core alone declares.
  */
 
 import { variablesRenamed } from "./bootRefusal.mjs";
@@ -41,9 +41,9 @@ export interface RootRename {
 
 /**
  * Refuses, with an `environment-variable-renamed` `BootError`, an old name in
- * `env` set alone (`unset`), or beside its new name at a different value
- * (`different`); the two at one value are accepted. Every such rename is
- * named at once; no value is quoted or carried.
+ * `env` set alone (`unset`), or beside its new name (`different`, whatever
+ * either holds), in the words core refuses a module's rename in. Every such
+ * rename is named at once; no value is compared, quoted or carried.
  */
 export function refuseRenamedVariables(
 	env: Readonly<Record<string, string>>,
@@ -51,18 +51,17 @@ export function refuseRenamedVariables(
 ): void {
 	const refused = renames.flatMap((rename) => {
 		const { from, to } = rename;
-		const old = env[from];
-		if (old === undefined || env[to] === old) return [];
+		if (env[from] === undefined) return [];
 		return [
 			{ ...rename, state: env[to] === undefined ? ("unset" as const) : ("different" as const) },
 		];
 	});
 	if (refused.length === 0) return;
 	const named = refused.map(({ from, to, path, state }) => {
-		const renamed = `${from} was renamed ${to}, the variable ${path} is bound to; see CHANGELOG.`;
+		const renamed = `${from} was renamed ${to}, the variable ${path} is bound to; see the upgrade guide (docs/upgrading-from-v0.16.0.md).`;
 		return state === "unset"
 			? `${renamed} Set ${to} instead and unset ${from}.`
-			: `${renamed} ${to} is set to a different value: keep the one you mean in ${to} and unset ${from}.`;
+			: `${renamed} ${to} is set as well: keep the value you mean in ${to} and unset ${from}.`;
 	});
 	throw variablesRenamed(
 		`The environment sets ${refused.length} variable(s) that were renamed: ${named.join(" ")}`,

package/templates/standalone/src/sections.mts

@@ -29,6 +29,7 @@
 import {
 	checkSerializedOrigin,
 	checkTrustedProxyEntry,
+	coerceBooleanFromEnv,
 	describeSerializedOriginRejection,
 	describeTrustedProxyEntryRejection,
 	isWellFormedKid,
@@ -239,9 +240,18 @@ export const keyStoreSectionSchema = z
 	})
 	.strict();
 
-/** `redis-clients`: the one Redis connection every Redis-backed store shares. */
+/**
+ * `redis-clients`: the one Redis connection every Redis-backed store shares.
+ * `assumeNoEviction` is the operator's assertion that the server runs
+ * `maxmemory-policy noeviction`, read by the Redis stores' eviction gate only
+ * where the server will not report its policy.
+ */
 export const redisClientsSectionSchema = z
-	.object({ url: z.string(), password: z.string().optional() })
+	.object({
+		url: z.string(),
+		password: z.string().optional(),
+		assumeNoEviction: coerceBooleanFromEnv.default(false),
+	})
 	.strict();
 
 /**