@udibo/oauth2 0.14.1 → 0.15.1

package/{esm → dist}/adapters/hono/bff/testing.js

@@ -14,10 +14,8 @@
  *
  * @module
  */
-import "../../../_dnt.polyfills.js";
-import { assert, assertEquals, assertStrictEquals } from "../../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { delay } from "../../../deps/jsr.io/@std/async/1.5.0/delay.js";
-import { beforeEach, describe, it } from "../../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { assert, beforeEach, describe, expect, it } from "vitest";
+import { delay } from "../../../utils/_delay.js";
 import { sessionStoreMaxAgeMs, } from "./session-store.js";
 /**
  * Seeds a session in `bff.sessionStore` and returns a `Cookie` header
@@ -53,8 +51,7 @@ export async function createTestSession(bff, options = {}) {
     const data = {
         tokens: {
             accessToken: options.tokens?.accessToken ?? crypto.randomUUID(),
-            accessTokenExpiresAt: options.tokens?.accessTokenExpiresAt ??
-                now + 60 * 60 * 1000,
+            accessTokenExpiresAt: options.tokens?.accessTokenExpiresAt ?? now + 60 * 60 * 1000,
             tokenType: options.tokens?.tokenType ?? "Bearer",
             scope: options.tokens?.scope,
             idToken: options.tokens?.idToken,
@@ -170,7 +167,7 @@ function parseCookieHeader(header, name) {
 const BOUND_MS = 1000;
 /**
  * Contract test suite for {@link SessionStore} implementations. Registers
- * `describe`/`it` blocks from `@std/testing/bdd`, so call it at a test
+ * `describe`/`it` blocks from Vitest, so call it at a test
  * module's top level. It does not check that a stateful store's `update`
  * rejects a missing or destroyed session, which {@link SessionStore.update}
  * requires — test that yourself.
@@ -199,28 +196,28 @@ export function runSessionStoreContractTests(options) {
         }
         it("create returns a non-empty cookie value", async () => {
             const value = await store.create(sampleSession());
-            assertEquals(typeof value, "string");
+            expect(typeof value).toStrictEqual("string");
             assert(value.length > 0);
         });
         it("read returns null for an unknown cookie value", async () => {
-            assertStrictEquals(await store.read("no-such-session"), null);
+            expect(await store.read("no-such-session")).toBe(null);
         });
         it("create + read round-trips the session data", async () => {
             const original = sampleSession();
             const value = await store.create(original);
             const fetched = await store.read(value);
             assert(fetched !== null, "read should return data for a created session");
-            assertEquals(fetched.tokens.accessToken, original.tokens.accessToken);
-            assertEquals(fetched.refreshToken, original.refreshToken);
-            assertEquals(fetched.user, original.user);
+            expect(fetched.tokens.accessToken).toStrictEqual(original.tokens.accessToken);
+            expect(fetched.refreshToken).toStrictEqual(original.refreshToken);
+            expect(fetched.user).toStrictEqual(original.user);
         });
         it("preserves createdAt, which carries the session's absolute age", async () => {
             const original = sampleSession();
             const value = await store.create(original);
             const fetched = await store.read(value);
             assert(fetched !== null, "read should return data for a created session");
-            assertEquals(fetched.createdAt, original.createdAt, "a store that drops createdAt silently opts its sessions out of " +
-                "HonoBffOptions.sessionMaxAgeMs, so they never age out");
+            expect(fetched.createdAt, "a store that drops createdAt silently opts its sessions out of " +
+                "HonoBffOptions.sessionMaxAgeMs, so they never age out").toStrictEqual(original.createdAt);
         });
         it("update reflects changes on subsequent read", async () => {
             const value = await store.create(sampleSession());
@@ -231,34 +228,34 @@ export function runSessionStoreContractTests(options) {
             };
             const newValue = await store.update(value, updated);
             const fetched = await store.read(newValue);
-            assertEquals(fetched?.user, { sub: "u1", role: "admin" });
+            expect(fetched?.user).toStrictEqual({ sub: "u1", role: "admin" });
         });
         if (destroyClearsRead) {
             it("destroy removes the session", async () => {
                 const value = await store.create(sampleSession());
                 await store.destroy(value);
-                assertStrictEquals(await store.read(value), null);
+                expect(await store.read(value)).toBe(null);
             });
         }
         it("never advertises a max age without proving it enforces one", () => {
             const advertised = sessionStoreMaxAgeMs(store);
-            assertEquals(advertised !== undefined && makeBoundedStore === undefined, false, `this store advertises maxAgeMs=${advertised}, which HonoBff trusts ` +
+            expect(advertised !== undefined && makeBoundedStore === undefined, `this store advertises maxAgeMs=${advertised}, which HonoBff trusts ` +
                 "when it refuses a session cookie that would expire before the " +
                 "session does. Supply makeBoundedStore so the contract can prove " +
-                "the bound is real.");
+                "the bound is real.").toStrictEqual(false);
         });
         if (makeBoundedStore) {
             it("reports the max age it was built with, so a BFF can outlive it", async () => {
                 const bounded = await makeBoundedStore(BOUND_MS);
-                assertStrictEquals(sessionStoreMaxAgeMs(bounded), BOUND_MS, "a store that hides its bound gets no divergence check from HonoBff");
+                expect(sessionStoreMaxAgeMs(bounded), "a store that hides its bound gets no divergence check from HonoBff").toBe(BOUND_MS);
             });
             it("stops reading a session older than the max age it enforces", async () => {
                 const bounded = await makeBoundedStore(BOUND_MS);
                 const value = await bounded.create(sampleSession());
-                assert(await bounded.read(value) !== null, "a session created moments ago must still read");
+                assert((await bounded.read(value)) !== null, "a session created moments ago must still read");
                 await delay(BOUND_MS + 500);
-                assertStrictEquals(await bounded.read(value), null, "a session past the store's own bound must stop reading, or a " +
-                    "captured cookie outlives the window the bound promises");
+                expect(await bounded.read(value), "a session past the store's own bound must stop reading, or a " +
+                    "captured cookie outlives the window the bound promises").toBe(null);
             });
         }
     });

package/{esm → dist}/adapters/hono/identity.d.ts

@@ -39,10 +39,9 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 import { Hono } from "hono";
 import type { Context } from "hono";
-import type { IdentityService, IdentityUser } from "../../identity/service.js";
+import type { IdentityService, IdentityUser } from "../../identity/service.ts";
 /** Paths for the routes mounted by {@link honoIdentityRoutes}. */
 export interface HonoIdentityPaths {
     /** `POST` sign-up. Default `/signup`. */

package/{esm → dist}/adapters/hono/identity.js

@@ -39,7 +39,6 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 import { Hono } from "hono";
 import { identityErrorStatus, isIdentityError, } from "../../identity/errors.js";
 function handle(fn) {
@@ -68,10 +67,10 @@ async function readBody(c) {
             }
             const out = {};
             for (const [key, value] of Object.entries(body)) {
-                out[key] = STRING_FIELDS.has(key) && value !== null &&
-                    value !== undefined
-                    ? String(value)
-                    : value;
+                out[key] =
+                    STRING_FIELDS.has(key) && value !== null && value !== undefined
+                        ? String(value)
+                        : value;
             }
             return out;
         }
@@ -104,18 +103,19 @@ function isTrustedOrigin(c, allowedOrigins) {
     const origin = c.req.header("origin");
     const site = c.req.header("sec-fetch-site");
     if (site) {
-        return site === "same-origin" || site === "none" ||
-            (!!origin && allowedOrigins.has(origin));
+        return (site === "same-origin" ||
+            site === "none" ||
+            (!!origin && allowedOrigins.has(origin)));
     }
     if (!origin)
         return true;
-    return allowedOrigins.has(origin) ||
-        hostOf(origin) === new URL(c.req.url).host;
+    return (allowedOrigins.has(origin) || hostOf(origin) === new URL(c.req.url).host);
 }
 function sameOriginGuard(options) {
     const allowedOrigins = new Set(options.allowedOrigins ?? []);
     return async (c, next) => {
-        if (!SAFE_METHODS.has(c.req.method) && !isTrustedOrigin(c, allowedOrigins)) {
+        if (!SAFE_METHODS.has(c.req.method) &&
+            !isTrustedOrigin(c, allowedOrigins)) {
             return c.json({ error: FORBIDDEN_ORIGIN }, identityErrorStatus(FORBIDDEN_ORIGIN));
         }
         await next();

package/{esm → dist}/adapters/hono/log.d.ts

@@ -3,7 +3,6 @@
  *
  * @module hono/log
  */
-import "../../_dnt.polyfills.js";
 import type { MiddlewareHandler } from "hono";
 /**
  * Produces a request target with every query value replaced by `[redacted]`.

package/{esm → dist}/adapters/hono/log.js

@@ -1,9 +1,3 @@
-/**
- * Request logging that removes query values, including OAuth callback credentials.
- *
- * @module hono/log
- */
-import "../../_dnt.polyfills.js";
 /**
  * Produces a request target with every query value replaced by `[redacted]`.
  * Keeps the pathname and percent-encoded parameter names, including repeats,

package/{esm → dist}/adapters/hono/resource-server.d.ts

@@ -27,13 +27,12 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 import type { Context, MiddlewareHandler } from "hono";
-import type { ClientInterface } from "../../models/client.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import { type AuthenticatedContext, ResourceServer } from "../../server/resource-server.js";
-import type { RequireConditions } from "../../models/authorization.js";
-export { type HonoResourceServerVariables, OAUTH2_CONTEXT_KEY, } from "./_common.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import { type AuthenticatedContext, ResourceServer } from "../../server/resource-server.ts";
+import type { RequireConditions } from "../../models/authorization.ts";
+export { type HonoResourceServerVariables, OAUTH2_CONTEXT_KEY, } from "./_common.ts";
 /**
  * Hono-specific wrapper around {@link ResourceServer}. Construction options
  * are identical to the core server; the subclass only adds Hono middleware

package/{esm → dist}/adapters/hono/resource-server.js

@@ -27,7 +27,6 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 import { ResourceServer, } from "../../server/resource-server.js";
 import { authenticateHonoRequest, createProtectMiddleware, createRequireMiddleware, createRequireScopeMiddleware, readContext, } from "./_common.js";
 export { OAUTH2_CONTEXT_KEY, } from "./_common.js";

package/dist/cli/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/bin.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { runCli } from "./mod.js";
+process.exitCode = await runCli(process.argv.slice(2));

package/dist/cli/idp/config.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Configuration for the development identity provider: the shape of the JSON
+ * file `idp dev` reads, the built-in demo defaults, and the validation that
+ * turns untrusted JSON into a {@link DevIdpConfig}.
+ *
+ * @module
+ */
+/** Grant types the development identity provider will serve. */
+export interface DevIdpGrantsConfig {
+    /** Authorization code grant with PKCE. */
+    authorization_code: boolean;
+    /** Client credentials grant (machine-to-machine). */
+    client_credentials: boolean;
+    /** Refresh token grant. */
+    refresh_token: boolean;
+    /** Resource owner password credentials grant. */
+    password: boolean;
+}
+/** A user seeded into the development identity provider at startup. */
+export interface DevIdpUserConfig {
+    /** Subject identifier: the `sub` claim and the id the admin API takes. */
+    id: string;
+    /** Login name typed into the sign-in form. */
+    username: string;
+    /** Password the sign-in form accepts. Plaintext, because this is a dev tool. */
+    password: string;
+    /** Extra claims merged into this user's id_token and UserInfo response. */
+    claims: Record<string, unknown>;
+}
+/** A client registered with the development identity provider at startup. */
+export interface DevIdpClientConfig {
+    /** The `client_id` the application authenticates with. */
+    id: string;
+    /** Omit for a public (PKCE-only) client; set for a confidential one. */
+    secret?: string;
+    /**
+     * Redirect URIs, matched exactly — list every one your app sends. An entry
+     * on `127.0.0.1` or `[::1]` also matches the same URI on any port.
+     */
+    redirectUris: string[];
+    /** Grant types this client may use. */
+    grants: string[];
+    /**
+     * User the client-credentials grant puts on the token. Omit it — the
+     * default — for a machine token with no user, which introspection reports
+     * with a `client_id` and no `sub`. Set it only to model a dedicated
+     * service-account user, never a human owner.
+     */
+    ownerUserId?: string;
+}
+/**
+ * A fully resolved configuration. Every field the server needs is present:
+ * {@link parseDevIdpConfig} fills the defaults so nothing downstream has to.
+ */
+export interface DevIdpConfig {
+    /**
+     * Issuer identifier stamped into tokens and discovery. When omitted it is
+     * pinned at startup to the bound address (`localhost` for a wildcard bind
+     * such as `0.0.0.0`); set it when clients reach the server under another
+     * name, such as a CI service hostname.
+     */
+    issuer?: string;
+    /** Interface to bind. */
+    hostname: string;
+    /** Port to bind. `0` asks the OS for a free one. */
+    port: number;
+    /** `"prompt"` shows a consent screen; `"auto"` grants the requested scope. */
+    consent: "auto" | "prompt";
+    /** Scope vocabulary advertised in discovery. */
+    scopesSupported: string[];
+    /** Access token lifetime in seconds — shorten it to test expiry handling. */
+    accessTokenLifetime: number;
+    /** Grant types the server enables. */
+    grants: DevIdpGrantsConfig;
+    /**
+     * ES256 private JWK, as printed by `oidc keygen`. Pins the signing key so
+     * tokens and JWKS survive a restart. `OIDC_SIGNING_KEY` overrides it.
+     */
+    signingKey?: JsonWebKey & {
+        kid?: string;
+    };
+    /** Users to seed. */
+    users: DevIdpUserConfig[];
+    /** Clients to register. */
+    clients: DevIdpClientConfig[];
+}
+/**
+ * The configuration used when `idp dev` runs without `--config`: one
+ * confidential client, one public client, and one user, all on well-known
+ * localhost ports.
+ */
+export declare function defaultDevIdpConfig(): DevIdpConfig;
+/**
+ * Validates parsed JSON and fills in defaults, so the caller gets a config
+ * with no optional plumbing left to resolve.
+ *
+ * Unknown fields are rejected rather than ignored — a typo in a dev config is
+ * otherwise a silent no-op that costs an hour.
+ *
+ * @throws {Error} When a field is missing, mistyped, or unrecognized. The
+ * message names the offending path (e.g. `users[0].password`).
+ */
+export declare function parseDevIdpConfig(value: unknown): DevIdpConfig;
+/**
+ * Reads and validates a config file.
+ *
+ * @throws {Error} When the file is unreadable, is not valid JSON, or fails
+ * {@link parseDevIdpConfig}. Every message names the file.
+ */
+export declare function loadDevIdpConfig(path: string): Promise<DevIdpConfig>;

package/dist/cli/idp/config.js

@@ -0,0 +1,269 @@
+/**
+ * Configuration for the development identity provider: the shape of the JSON
+ * file `idp dev` reads, the built-in demo defaults, and the validation that
+ * turns untrusted JSON into a {@link DevIdpConfig}.
+ *
+ * @module
+ */
+import { readFile } from "node:fs/promises";
+const DEFAULT_PORT = 9000;
+const DEFAULT_HOSTNAME = "127.0.0.1";
+const DEFAULT_ACCESS_TOKEN_LIFETIME = 3600;
+const DEFAULT_SCOPES = ["openid", "profile", "email", "offline_access"];
+const DEFAULT_GRANTS = {
+    authorization_code: true,
+    client_credentials: true,
+    refresh_token: true,
+    password: false,
+};
+const DEFAULT_REDIRECT_URIS = [
+    "http://localhost:3000/callback",
+    "http://localhost:5173/callback",
+    "http://localhost:8000/callback",
+];
+const DEFAULT_CLIENT_GRANTS = ["authorization_code", "refresh_token"];
+const CONFIG_FIELDS = [
+    "issuer",
+    "hostname",
+    "port",
+    "consent",
+    "scopesSupported",
+    "accessTokenLifetime",
+    "grants",
+    "signingKey",
+    "users",
+    "clients",
+];
+const USER_FIELDS = ["id", "username", "password", "claims"];
+const CLIENT_FIELDS = ["id", "secret", "redirectUris", "grants", "ownerUserId"];
+/**
+ * The configuration used when `idp dev` runs without `--config`: one
+ * confidential client, one public client, and one user, all on well-known
+ * localhost ports.
+ */
+export function defaultDevIdpConfig() {
+    return {
+        hostname: DEFAULT_HOSTNAME,
+        port: DEFAULT_PORT,
+        consent: "auto",
+        scopesSupported: [...DEFAULT_SCOPES],
+        accessTokenLifetime: DEFAULT_ACCESS_TOKEN_LIFETIME,
+        grants: { ...DEFAULT_GRANTS },
+        users: [
+            {
+                id: "user-alice",
+                username: "alice@example.com",
+                password: "password",
+                claims: {
+                    name: "Alice Example",
+                    email: "alice@example.com",
+                    email_verified: true,
+                },
+            },
+        ],
+        clients: [
+            {
+                id: "dev-client",
+                secret: "dev-secret",
+                redirectUris: [...DEFAULT_REDIRECT_URIS],
+                grants: ["authorization_code", "refresh_token", "client_credentials"],
+                ownerUserId: "user-alice",
+            },
+            {
+                id: "dev-public-client",
+                redirectUris: [...DEFAULT_REDIRECT_URIS],
+                grants: [...DEFAULT_CLIENT_GRANTS],
+            },
+        ],
+    };
+}
+function fail(path, expectation) {
+    throw new Error(`${path} ${expectation}`);
+}
+function record(value, path) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        fail(path, "must be an object");
+    }
+    return value;
+}
+function rejectUnknown(value, path, allowed) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key)) {
+            fail(`${path}.${key}`, `is not a known option (expected one of: ${allowed.join(", ")})`);
+        }
+    }
+}
+function string(value, path) {
+    if (typeof value !== "string" || value.length === 0) {
+        fail(path, "must be a non-empty string");
+    }
+    return value;
+}
+function optionalString(value, path) {
+    return value === undefined ? undefined : string(value, path);
+}
+function stringArray(value, path) {
+    if (!Array.isArray(value))
+        fail(path, "must be an array of strings");
+    return value.map((entry, index) => string(entry, `${path}[${index}]`));
+}
+function integer(value, path, min) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value < min) {
+        fail(path, `must be an integer >= ${min}`);
+    }
+    return value;
+}
+function boolean(value, path) {
+    if (typeof value !== "boolean")
+        fail(path, "must be true or false");
+    return value;
+}
+function array(value, path) {
+    if (!Array.isArray(value))
+        fail(path, "must be an array");
+    return value;
+}
+function parseGrants(value, path) {
+    const source = record(value, path);
+    rejectUnknown(source, path, Object.keys(DEFAULT_GRANTS));
+    const grants = { ...DEFAULT_GRANTS };
+    for (const key of Object.keys(DEFAULT_GRANTS)) {
+        if (source[key] !== undefined) {
+            grants[key] = boolean(source[key], `${path}.${key}`);
+        }
+    }
+    return grants;
+}
+function parseUser(value, path) {
+    const source = record(value, path);
+    rejectUnknown(source, path, USER_FIELDS);
+    const username = string(source.username, `${path}.username`);
+    return {
+        id: optionalString(source.id, `${path}.id`) ?? username,
+        username,
+        password: string(source.password, `${path}.password`),
+        claims: source.claims === undefined
+            ? {}
+            : record(source.claims, `${path}.claims`),
+    };
+}
+function parseClient(value, path) {
+    const source = record(value, path);
+    rejectUnknown(source, path, CLIENT_FIELDS);
+    const grants = source.grants === undefined
+        ? [...DEFAULT_CLIENT_GRANTS]
+        : stringArray(source.grants, `${path}.grants`);
+    const redirectUris = source.redirectUris === undefined
+        ? []
+        : stringArray(source.redirectUris, `${path}.redirectUris`);
+    if (grants.includes("authorization_code") && redirectUris.length === 0) {
+        fail(`${path}.redirectUris`, "must list at least one URI for a client using the authorization_code grant");
+    }
+    return {
+        id: string(source.id, `${path}.id`),
+        secret: optionalString(source.secret, `${path}.secret`),
+        redirectUris,
+        grants,
+        ownerUserId: optionalString(source.ownerUserId, `${path}.ownerUserId`),
+    };
+}
+function parseConsent(value, path) {
+    const consent = string(value, path);
+    if (consent !== "auto" && consent !== "prompt") {
+        fail(path, 'must be "auto" or "prompt"');
+    }
+    return consent;
+}
+function parseSigningKey(value, path) {
+    const jwk = record(value, path);
+    string(jwk.kty, `${path}.kty`);
+    string(jwk.d, `${path}.d`);
+    return jwk;
+}
+/**
+ * Validates parsed JSON and fills in defaults, so the caller gets a config
+ * with no optional plumbing left to resolve.
+ *
+ * Unknown fields are rejected rather than ignored — a typo in a dev config is
+ * otherwise a silent no-op that costs an hour.
+ *
+ * @throws {Error} When a field is missing, mistyped, or unrecognized. The
+ * message names the offending path (e.g. `users[0].password`).
+ */
+export function parseDevIdpConfig(value) {
+    const source = record(value, "config");
+    rejectUnknown(source, "config", CONFIG_FIELDS);
+    const defaults = defaultDevIdpConfig();
+    const users = source.users === undefined
+        ? defaults.users
+        : array(source.users, "config.users").map((entry, index) => parseUser(entry, `users[${index}]`));
+    const clients = source.clients === undefined
+        ? defaults.clients
+        : array(source.clients, "config.clients").map((entry, index) => parseClient(entry, `clients[${index}]`));
+    const seenUserIds = new Set();
+    for (const user of users) {
+        if (seenUserIds.has(user.id)) {
+            fail(`users`, `contains more than one user with id "${user.id}"`);
+        }
+        seenUserIds.add(user.id);
+    }
+    const seenClientIds = new Set();
+    for (const client of clients) {
+        if (seenClientIds.has(client.id)) {
+            fail(`clients`, `contains more than one client with id "${client.id}"`);
+        }
+        seenClientIds.add(client.id);
+    }
+    return {
+        issuer: optionalString(source.issuer, "config.issuer"),
+        hostname: optionalString(source.hostname, "config.hostname") ?? defaults.hostname,
+        port: source.port === undefined
+            ? defaults.port
+            : integer(source.port, "config.port", 0),
+        consent: source.consent === undefined
+            ? defaults.consent
+            : parseConsent(source.consent, "config.consent"),
+        scopesSupported: source.scopesSupported === undefined
+            ? defaults.scopesSupported
+            : stringArray(source.scopesSupported, "config.scopesSupported"),
+        accessTokenLifetime: source.accessTokenLifetime === undefined
+            ? defaults.accessTokenLifetime
+            : integer(source.accessTokenLifetime, "config.accessTokenLifetime", 1),
+        grants: source.grants === undefined
+            ? defaults.grants
+            : parseGrants(source.grants, "config.grants"),
+        signingKey: source.signingKey === undefined
+            ? undefined
+            : parseSigningKey(source.signingKey, "config.signingKey"),
+        users,
+        clients,
+    };
+}
+/**
+ * Reads and validates a config file.
+ *
+ * @throws {Error} When the file is unreadable, is not valid JSON, or fails
+ * {@link parseDevIdpConfig}. Every message names the file.
+ */
+export async function loadDevIdpConfig(path) {
+    let text;
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch (error) {
+        throw new Error(`cannot read config ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+        return parseDevIdpConfig(parsed);
+    }
+    catch (error) {
+        throw new Error(`${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}

package/dist/cli/idp/mod.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The `idp dev` command: runs the development identity provider from a config
+ * file (or the built-in demo config) and prints what it seeded.
+ *
+ * @module
+ */
+/**
+ * Runs the development identity provider until the process is stopped.
+ *
+ * Accepts `--config <path>`, `--port <number>`, `--hostname <host>`,
+ * `--issuer <url>`, `--admin-token <token>`, and `--unsafe-remote-access`;
+ * flags win over the config file, which wins over the built-in demo config.
+ * `IDP_ADMIN_TOKEN` supplies the admin token when the flag is absent.
+ *
+ * Aborting `signal` shuts the server down and resolves the returned promise.
+ *
+ * @throws {Error} When an option or the config file is invalid, or when the
+ * bind address is not loopback and `--unsafe-remote-access` was not passed.
+ */
+export declare function idpDev(args: string[], signal?: AbortSignal): Promise<void>;