@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/google-session.fixture.mts

@@ -1,318 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * A browser session with Google linked, on the standalone composed as a
- * deployment does: `oauthEndpointsModule`, the session module and the real Google
- * adapter — the Google federation type `buildModules` lists, handed the
- * shipped `core.federations.google` entry — booted through `createApp` under
- * the shipped configuration.
- *
- * The two logout routes and `POST /oauth/federation/:name/token` live in
- * `@o3co/auth-provider-oauth`, which depends on no adapter; only here can a
- * test see what they hand the real adapter and what they make of what its
- * library raises.
- *
- * Unlike `all-modules-composition.fixture.mts`, the deployment signs with an
- * HS256 secret this file holds, so tests can present an `id_token_hint` and
- * access token of their own; nothing but Google is federated.
- */
-
-import { createHmac } from "node:crypto";
-import { fileURLToPath } from "node:url";
-import {
-	createApp,
-	createKeyStoreFactory,
-	defineModule,
-	type FederationTokenStore,
-	type FederationTokens,
-	InMemoryClientRepository,
-	InMemoryUserRepository,
-	memoryRefreshTokenFamilyStoreModule,
-	registerBuiltinKeyStores,
-	type SessionLifecycle,
-	type UserSessionStore,
-} from "@o3co/auth-provider-core";
-import { googleFederationTypeModule } from "@o3co/auth-provider-federation-google";
-import { parseFile } from "@o3co/ts.hocon";
-import express from "express";
-import request from "supertest";
-import { expect } from "vitest";
-import { buildModules } from "#/buildModules.mjs";
-import { resolveConfigPaths } from "#/configPath.mjs";
-import { templateReference } from "../modules.mjs";
-import { keyStoreSectionSchema } from "../sections.mjs";
-import {
-	type BothPhases,
-	bothPhasesOf,
-	capturedRenames,
-	libraryLayers,
-} from "./library-references.fixture.mjs";
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-export const ISSUER = "https://auth.test";
-const JWT_SECRET = "google-session.fixture.at-least-32-bytes.ok";
-
-/** The one client: first-party, allowed federation tokens, one post-logout URI registered. */
-export const CLIENT_ID = "rp";
-const CLIENT_SECRET = "rp-secret-value";
-const BASIC = `Basic ${Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64")}`;
-export const REGISTERED_POST_LOGOUT_REDIRECT_URI = "https://rp.example/signed-out";
-
-const USERNAME = "alice";
-const PASSWORD = "correct-horse-battery-staple";
-const SUB = "u-alice";
-
-/** The Google client the adapter is configured with. */
-export const GOOGLE_CLIENT_ID = "google-client";
-const GOOGLE_CLIENT_SECRET = "google-secret";
-const GOOGLE_CALLBACK = `${ISSUER}/session/oauth/federation/google/callback`;
-
-const ENV: Readonly<Record<string, string>> = {
-	// A session signed in through Google alone, no second factor.
-	MFA_MODE: "off",
-	KEY_STORE_LOCAL_ALGORITHM: "HS256",
-	KEY_STORE_LOCAL_SECRET: JWT_SECRET,
-	OAUTH_JWT_ISSUER: ISSUER,
-	SESSION_STORE_SECRET: "google-session.fixture-session.at-least-32-bytes.ok",
-	SESSION_STORE_SECURE: "false",
-	SESSION_STORE_NAME: "auth.session",
-	SESSION_STORE_STORAGE_TYPE: "memory",
-	ADAPTERS_USER_REPOSITORY: "yaml",
-	REDIS_CLIENTS_URL: "redis://redis.test:6379",
-	ADAPTERS_USER_SESSION_STORES: "memory",
-	ADAPTERS_RATE_LIMITER: "memory",
-	ADAPTERS_CODE_REPOSITORY: "memory",
-	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
-	ADAPTERS_REPLAY_SEEN_SET: "memory",
-	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
-	ADAPTERS_CONSENT_STORE: "none",
-};
-
-/**
- * Google switched on the way an operator does, through its environment
- * variables, and handled by the Google federation type the template lists.
- * `"shipped"` is that alone. Otherwise, beside it: `endSessionEndpoint`, a key
- * of the entry with no environment form, written into the entry as an
- * operator's own layer would; and `fetch`, the one the type module is built
- * with in place of the global one.
- */
-export type GoogleWiring =
-	| "shipped"
-	| { readonly endSessionEndpoint?: string; readonly fetch?: typeof fetch };
-
-const GOOGLE_ENV: Readonly<Record<string, string>> = {
-	CORE_FEDERATIONS_GOOGLE_ENABLED: "true",
-	CORE_FEDERATIONS_GOOGLE_CLIENT_ID: GOOGLE_CLIENT_ID,
-	CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: GOOGLE_CLIENT_SECRET,
-	CORE_FEDERATIONS_GOOGLE_CALLBACK_URL: GOOGLE_CALLBACK,
-};
-
-function resolveConfig(google: GoogleWiring): BothPhases {
-	const env: Record<string, string> = { ...ENV, ...GOOGLE_ENV };
-	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	const layers = parseFile(envConfPath, { env })
-		.withFallback(parseFile(applicationConfPath, { env }))
-		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
-		.withFallback(libraryLayers(env));
-	const config = bothPhasesOf(layers, env);
-	const endSessionEndpoint = google === "shipped" ? undefined : google.endSessionEndpoint;
-	const federations = config.core?.federations;
-	return {
-		...config,
-		...(endSessionEndpoint === undefined
-			? {}
-			: {
-					core: {
-						...config.core,
-						federations: {
-							...federations,
-							google: { ...federations?.google, endSessionEndpoint },
-						},
-					},
-				}),
-		// What the resolution captured of the renamed variables.
-		"renamed-variables": capturedRenames(env),
-	} as BothPhases;
-}
-
-const testRepositoriesModule = defineModule({
-	name: "test:repositories",
-	provides: {
-		clientRepository: () =>
-			new InMemoryClientRepository(
-				new Map([
-					[
-						CLIENT_ID,
-						{
-							tokenEndpointAuthMethod: "client_secret_basic",
-							clientSecret: CLIENT_SECRET,
-							allowedRedirectUris: [],
-							allowedScopes: ["openid", "profile"],
-							allowedAudiences: [],
-							allowedGrantTypes: ["session"],
-							postLogoutRedirectUris: [REGISTERED_POST_LOGOUT_REDIRECT_URI],
-							backchannelLogoutSessionRequired: true,
-							frontchannelLogoutSessionRequired: true,
-							allowedAzpForFederationToken: true,
-						},
-					],
-				]),
-			),
-		userRepository: () =>
-			new InMemoryUserRepository(
-				new Map([[USERNAME, { id: SUB, password: PASSWORD, email: "alice@example.com" }]]),
-			),
-	} as never,
-});
-
-// The template's `key-store` section, read by its own schema, without the
-// section's relocation bridge.
-const testKeyStoreModule = defineModule({
-	name: "key-store",
-	section: { schema: keyStoreSectionSchema },
-	provides: {
-		keyStore: async ({ section }) => {
-			const factory = createKeyStoreFactory();
-			registerBuiltinKeyStores(factory);
-			return factory.create({
-				type: "local",
-				...(section.local ?? {}),
-			});
-		},
-	},
-});
-
-const base64url = (value: unknown): string =>
-	Buffer.from(JSON.stringify(value)).toString("base64url");
-
-/** A JWT signed with the deployment's own HS256 key: what its keystore verifies. */
-function signed(typ: string, claims: Record<string, unknown>): string {
-	const header = base64url({ alg: "HS256", kid: "v0", typ });
-	const now = Math.floor(Date.now() / 1000);
-	const payload = base64url({ iss: ISSUER, sub: SUB, iat: now, exp: now + 3600, ...claims });
-	const signature = createHmac("sha256", JWT_SECRET)
-		.update(`${header}.${payload}`)
-		.digest("base64url");
-	return `${header}.${payload}.${signature}`;
-}
-
-/**
- * A fresh id_token for the session, issued to the client: what an RP — or
- * anyone holding an id_token of their own — presents as `id_token_hint`.
- */
-export const idTokenHint = (sid: string): string => signed("JWT", { aud: CLIENT_ID, sid });
-
-/**
- * An access token for the session as the authorization-code grant issues it
- * to the client, for the client itself: `aud` and `azp`, `sid` and a
- * refresh-token `family_id`. The `session` grant's token names no family, and
- * the federation token route asks for one.
- */
-export const accessTokenWithFamily = (sid: string): string =>
-	signed("at+jwt", {
-		aud: CLIENT_ID,
-		azp: CLIENT_ID,
-		sid,
-		family_id: "family-1",
-		scope: "openid",
-	});
-
-const claimsOf = (jwt: string): Record<string, unknown> =>
-	JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8")) as Record<
-		string,
-		unknown
-	>;
-
-export interface GoogleSession {
-	readonly app: express.Express;
-	readonly sid: string;
-	/** The access token the `session` grant minted for the session; it carries `azp`. */
-	readonly accessToken: string;
-	readonly userSessionStore: UserSessionStore;
-	readonly sessionLifecycle: SessionLifecycle;
-	readonly federationTokenStore: FederationTokenStore;
-	readonly dispose: () => Promise<void>;
-}
-
-/**
- * Boots the deployment, signs alice in with her password, and links Google to
- * her session as a federated sign-in would: the token store holds `tokens`,
- * and Google joins the session through its lifecycle.
- */
-export async function signInLinkedToGoogle(options: {
-	readonly google: GoogleWiring;
-	readonly tokens: FederationTokens;
-}): Promise<GoogleSession> {
-	const { google, tokens } = options;
-	const config = resolveConfig(google);
-	const upstreamFetch = google === "shipped" ? undefined : google.fetch;
-	const googleType = googleFederationTypeModule().name;
-	const handle = await createApp({
-		modules: buildModules(config, {
-			keyStoreModule: testKeyStoreModule,
-			repositoriesModule: testRepositoriesModule,
-			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-		}).map((module) =>
-			module.name === googleType && upstreamFetch !== undefined
-				? googleFederationTypeModule({ fetch: upstreamFetch })
-				: module,
-		),
-		bootstrapComponents: { config, pathResolver: (s) => s },
-	});
-	try {
-		const components = handle.components as {
-			userSessionStore: UserSessionStore;
-			sessionLifecycle: SessionLifecycle;
-			federationTokenStore: FederationTokenStore;
-		};
-		const app = express();
-		app.use(handle.router);
-
-		const csrfRes = await request(app).get("/session/csrf");
-		expect(csrfRes.status).toBe(200);
-		const loginRes = await request(app)
-			.post("/session/login")
-			.set("Cookie", csrfRes.headers["set-cookie"] as unknown as string[])
-			.set(csrfRes.body.header_name as string, csrfRes.body.csrf_token as string)
-			.type("form")
-			.send({ username: USERNAME, password: PASSWORD });
-		expect(loginRes.status).toBe(200);
-
-		const tokenRes = await request(app)
-			.post("/oauth/token")
-			.set("Authorization", BASIC)
-			.set("Cookie", loginRes.headers["set-cookie"] as unknown as string[])
-			.type("form")
-			.send({ grant_type: "session" });
-		expect(tokenRes.status).toBe(200);
-		const accessToken = tokenRes.body.access_token as string;
-		const claims = claimsOf(accessToken);
-		expect(claims.azp).toBe(CLIENT_ID);
-		const sid = claims.sid as string;
-		expect(typeof sid).toBe("string");
-
-		await components.federationTokenStore.attach(sid, "google", tokens);
-		expect(await components.sessionLifecycle.join(sid, { federation: "google" })).toEqual({
-			outcome: "joined",
-		});
-		return { app, sid, accessToken, ...components, dispose: () => handle.dispose() };
-	} catch (error) {
-		await handle.dispose();
-		throw error;
-	}
-}

package/templates/standalone/src/__tests__/host-routes.test.mts

@@ -1,134 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The host's own routes (liveness, readiness, the metrics scrape), mounted as
- * the process mounts them (`mountRoutes`), and what an error one of them lets
- * through is answered with: core's terminal handler, the same one behind the
- * composed router, so every route's error is answered the same way.
- */
-
-import type { Logger, ReadinessProbe } from "@o3co/auth-provider-core";
-import express, { Router } from "express";
-import request from "supertest";
-import { describe, expect, it, vi } from "vitest";
-import { createMetrics } from "#/metrics.mjs";
-import { mountRoutes } from "#/routes.mjs";
-
-const spyLogger = () => {
-	const logger = {
-		trace: vi.fn(),
-		debug: vi.fn(),
-		info: vi.fn(),
-		warn: vi.fn(),
-		error: vi.fn(),
-		fatal: vi.fn(),
-		child: () => logger,
-	};
-	return logger;
-};
-
-/** A probe that breaks its own contract: reading its `name` throws. */
-const probeWhoseNameThrows = (thrown: Error): ReadinessProbe =>
-	({
-		get name(): string {
-			throw thrown;
-		},
-		check: async () => undefined,
-	}) as ReadinessProbe;
-
-const host = (probes: readonly ReadinessProbe[]) => {
-	const logger = spyLogger();
-	const app = express();
-	mountRoutes(app, {
-		router: Router(),
-		probes,
-		readinessTimeoutMs: 1_000,
-		metrics: createMetrics(),
-		logger: logger as unknown as Logger,
-	});
-	return { app, logger };
-};
-
-/** Every call on a level other than `error`. */
-const otherLevels = (logger: ReturnType<typeof spyLogger>) =>
-	[logger.trace, logger.debug, logger.info, logger.warn, logger.fatal].flatMap(
-		(level) => level.mock.calls,
-	);
-
-describe("the host's routes, mounted as the process mounts them", () => {
-	it("/_healthcheck answers 200, and nothing is logged", async () => {
-		const { app, logger } = host([]);
-		const res = await request(app).get("/_healthcheck");
-		expect(res.status).toBe(200);
-		expect(res.body).toEqual({ status: "ok" });
-		expect(logger.error).not.toHaveBeenCalled();
-		expect(otherLevels(logger)).toEqual([]);
-	});
-
-	it.each(["/readyz", "/metrics"])(
-		"%s: an error it lets through is 500 server_error in the envelope, no-store, logged once with its projection",
-		async (path) => {
-			const { app, logger } = host([
-				probeWhoseNameThrows(new Error("probe registry at internal-host-marker is gone")),
-			]);
-
-			const res = await request(app).get(path);
-
-			expect(res.status).toBe(500);
-			expect(res.headers["content-type"]).toMatch(/^application\/json/);
-			expect(res.headers["cache-control"]).toBe("no-store");
-			expect(res.body).toEqual({ error: "server_error", error_description: "unexpected_error" });
-			expect(res.text).not.toContain("internal-host-marker");
-			expect(logger.error).toHaveBeenCalledTimes(1);
-			const [fields, event, ...rest] = logger.error.mock.calls[0] as unknown[];
-			expect(event).toBe("unhandled_request_error");
-			expect(rest).toEqual([]);
-			expect(fields).toEqual({
-				endpoint: path,
-				err: expect.objectContaining({
-					name: "Error",
-					detail: "probe registry at internal-host-marker is gone",
-				}),
-			});
-			expect((fields as { err: unknown }).err).not.toBeInstanceOf(Error);
-			expect(otherLevels(logger)).toEqual([]);
-		},
-	);
-
-	it("takes a 4xx status an error did not mark as the client's for the server's: 500, logged", async () => {
-		// A store's or a library's error can carry an HTTP status of its own —
-		// the answer it got — which is not this server's answer to the client.
-		const { app, logger } = host([
-			probeWhoseNameThrows(
-				Object.assign(new Error("the probe registry refused this deployment"), { status: 403 }),
-			),
-		]);
-
-		const res = await request(app).get("/readyz");
-
-		expect(res.status).toBe(500);
-		expect(res.body).toEqual({ error: "server_error", error_description: "unexpected_error" });
-		expect(logger.error).toHaveBeenCalledTimes(1);
-		expect(logger.error).toHaveBeenCalledWith(
-			{
-				endpoint: "/readyz",
-				err: expect.objectContaining({ name: "Error", status: 403 }),
-			},
-			"unhandled_request_error",
-		);
-	});
-});

package/templates/standalone/src/__tests__/library-reference-resolution.smoke.test.mts

@@ -1,29 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { existsSync, readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
-
-describe("library reference.conf subpath resolution", () => {
-	it("resolves @o3co/auth-provider-core/reference.conf to a readable file", () => {
-		const url = import.meta.resolve("@o3co/auth-provider-core/reference.conf");
-		const path = fileURLToPath(url);
-		expect(existsSync(path)).toBe(true);
-		const content = readFileSync(path, "utf-8");
-		expect(content).toMatch(/^core\s*\{/m); // sanity: HOCON content, core's own section
-	});
-});

package/templates/standalone/src/__tests__/library-references.fixture.mts

@@ -1,188 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The libraries' layers beneath the template's own files, for a test that
- * resolves its configuration by hand: the `reference.conf` of every package
- * the template composes a module from, core's last, as `app.mts` layers them;
- * the resolution handed to both phases at once; and what that resolution
- * captures of the renamed variables.
- */
-
-import { fileURLToPath } from "node:url";
-import {
-	type AppConfig,
-	memoryRateLimiterModule,
-	moduleReferences,
-} from "@o3co/auth-provider-core";
-import { CORE_RELOCATIONS, renamedVariableCaptures } from "@o3co/auth-provider-core/testing";
-import { federationGrantsModules } from "@o3co/auth-provider-federation-grants";
-import {
-	oauthAuthorizationGrantsModule,
-	oauthEndpointsModule,
-	oauthSessionGrantModule,
-} from "@o3co/auth-provider-oauth";
-import {
-	redisCodeRepositoryModule,
-	redisFederationGrantStoreModule,
-	redisRateLimiterModule,
-	redisRefreshTokenFamilyStoreModule,
-} from "@o3co/auth-provider-redis";
-import { sessionModule, sessionStoreModule } from "@o3co/auth-provider-session";
-import { type Config, empty, parseFile } from "@o3co/ts.hocon";
-import { readAdapters } from "../adapters.mjs";
-import { readSwitches, type Switches } from "../configPath.mjs";
-import {
-	httpModule,
-	inMemoryCodeRepositoryModule,
-	keyStoreModule,
-	loggingModule,
-	repositoriesModuleFor,
-	standaloneRedisClientsModule,
-	templateReference,
-} from "../modules.mjs";
-import { type Adapters, isPlainSection } from "../sections.mjs";
-
-/** The oauth package's modules: none reads the configuration it is handed. */
-const OAUTH_MODULES = [
-	oauthEndpointsModule,
-	oauthSessionGrantModule,
-	oauthAuthorizationGrantsModule,
-];
-
-/** The modules the template composes that declare a renamed variable. */
-const RENAMING_MODULES = [
-	memoryRateLimiterModule,
-	redisRateLimiterModule,
-	redisRefreshTokenFamilyStoreModule,
-	redisFederationGrantStoreModule,
-	...OAUTH_MODULES,
-	sessionModule,
-	sessionStoreModule,
-	loggingModule,
-	httpModule,
-	keyStoreModule,
-	standaloneRedisClientsModule,
-	repositoriesModuleFor({ client: "yaml", user: "yaml" }),
-	inMemoryCodeRepositoryModule,
-];
-
-/** Every package reference the template's modules declare, core's last. */
-const LIBRARY_REFERENCES: readonly URL[] = moduleReferences([
-	redisRateLimiterModule,
-	...federationGrantsModules,
-	...OAUTH_MODULES,
-	sessionModule,
-	sessionStoreModule,
-]);
-
-/** The libraries' references resolved under `env`, in the order `app.mts` layers them. */
-export function libraryLayers(env: Readonly<Record<string, string>>): Config {
-	return LIBRARY_REFERENCES.reduce<Config>(
-		(layered, reference) =>
-			layered.withFallback(parseFile(fileURLToPath(reference), { env: { ...env } })),
-		empty(),
-	);
-}
-
-/** Phase one's switches laid over the configuration boot parses. */
-export type BothPhases = Switches & AppConfig;
-
-/**
- * `switches` laid over `resolved`, the configuration boot parses, as a test
- * that hands one object to both phases does: the composition root's own keys
- * beside the sections, and `federation-grants.enabled` written as phase one
- * decided it into the section as resolved. Boot is so handed phase one's
- * boolean, not the value as written, unlike `app.mts`; boot's refusal of a
- * written value phase one installs the modules for is pinned in
- * `two-phase-config.test.mts`.
- */
-export function withSwitches(
-	resolved: Readonly<Record<string, unknown>>,
-	switches: Switches,
-): BothPhases {
-	const grants = resolved["federation-grants"];
-	return {
-		...resolved,
-		...switches,
-		"federation-grants": {
-			...(isPlainSection(grants) ? grants : {}),
-			...switches["federation-grants"],
-		},
-	} as unknown as BothPhases;
-}
-
-/**
- * A resolution — `layers`, the template's `config/reference.conf` among them,
- * under `env` — as a test that resolves by hand hands it to both phases at
- * once: the configuration as resolved and unparsed, which boot parses as
- * `app.mts` hands it on, with what phase one reads of it (`readSwitches`)
- * laid over it — the composition root's `adapters` and `mfaMode`, the Store
- * transport settings, and `federation-grants.enabled` as phase one decides
- * it.
- */
-export function bothPhasesOf(layers: Config, env: Readonly<Record<string, string>>): BothPhases {
-	return withSwitches(
-		layers.toObject() as Record<string, unknown>,
-		readSwitches({ config: layers, env }),
-	);
-}
-
-/**
- * The composition root's `adapters` a resolution holds — `layers`, the
- * template's `config/reference.conf` among them, under `env` — as phase one
- * reads them.
- */
-export function adaptersOf(layers: Config, env: Readonly<Record<string, string>>): Adapters {
-	return readAdapters(layers.toObject() as Record<string, unknown>, env);
-}
-
-/** The adapters the template ships, as its `config/reference.conf` sets them with no environment. */
-export function shippedAdapters(): Adapters {
-	return adaptersOf(parseFile(fileURLToPath(templateReference()), { env: {} }), {});
-}
-
-/** The shipped adapters with every store the template can hold in process there: no Redis connection needed. */
-export function inProcessAdapters(): Adapters {
-	return {
-		...shippedAdapters(),
-		rateLimiter: "memory",
-		userSessionStores: "memory",
-		accessTokenDenylist: "memory",
-		replaySeenSet: "memory",
-		federationTokenStore: "memory",
-		federationGrantStore: "memory",
-		federationGrantIntentStore: "memory",
-		mfaFactorStore: "memory",
-		mfaTransactionStore: "memory",
-		codeRepository: "memory",
-	};
-}
-
-/**
- * The `renamed-variables` section a resolution under `env` holds: what every
- * module above captures, and the Redis code repository's, which the
- * in-process one's excludes from one composition (both declare
- * CLIENT_CODE_DEFAULT_EXPIRES_IN renamed, each to its own new name).
- */
-export function capturedRenames(
-	env: Readonly<Record<string, string | undefined>>,
-): Record<string, string | null> {
-	return {
-		...renamedVariableCaptures({ modules: [redisCodeRepositoryModule], env }),
-		...renamedVariableCaptures({ modules: RENAMING_MODULES, core: CORE_RELOCATIONS, env }),
-	};
-}