@astralarium/repo-auth 0.1.0 → 0.2.0

package/README.md

@@ -9,3 +9,52 @@ App wiring:
 - `/api/auth/$` responds via `serveAuthRequest`.
 - Provider credentials: `AUTH_<ID>_ID`, `AUTH_<ID>_SECRET`.
   Redirect URI: `/api/auth/callback/<id>`.
+
+Dev sign-in:
+
+```ts
+export const webAuthApp = {
+  ...app,
+  devSignIn: import.meta.env.DEV
+    ? devProviderSignIn({
+        provider: "google",
+        accountId: z.string().regex(/^\d+$/),
+        newUser: (id) => ({ name: `Dev ${id}`, email: `${id}@dev.invalid` }),
+      })
+    : undefined,
+};
+
+// dev sign-in page
+await signInWithDevAccount(authClient, accountId);
+```
+
+TanStack Start:
+
+```ts
+export const fetchViewer = createServerFn({ method: "GET" }).handler(
+  viewerSession(withAuth),
+);
+const db = dbMiddleware(
+  createServerOnlyFn(() => databaseConnectionString(env)),
+);
+export const authed = authedMiddleware(sessionMiddleware(fetchViewer));
+
+export const saveDraft = createServerFn({ method: "POST" })
+  .middleware([authed, db])
+  .handler(({ context: { session, sql } }) =>
+    saveDraftOf(sql, session.user.id),
+  );
+
+export const Route = createFileRoute("/_app")({
+  beforeLoad: viewerRouteContext(fetchViewer),
+});
+
+// router `hydrate`
+watchViewerRouter(router, queryClient, "/_app");
+
+// client
+saveDraft().catch((error) => {
+  if (isUnauthenticated(error)) openSignIn();
+  else throw error;
+});
+```

package/dist/client.d.ts

@@ -1,4 +1,3 @@
-/** Browser half of shell-auth: the session store, auth calls and OAuth popups. */
 import type { BetterAuthOptions } from "better-auth";
 import type { SessionLike } from "./types.ts";
 /** Opens `url`, a page starting a provider's OAuth redirect, in a popup
@@ -29,8 +28,8 @@ interface SessionStore<T> {
     get: () => T;
     listen: (listener: () => void) => () => void;
 }
-/** What `watchRouteViewer` reads of a router: TanStack Router's load event
- *  and its matched routes. */
+/** What `watchViewerRouter` reads of a router: TanStack Router's load
+ *  event, its matched routes, and invalidation. */
 export interface ViewerRouter {
     subscribe(event: "onLoad", fn: () => void): () => void;
     state: {
@@ -39,14 +38,33 @@ export interface ViewerRouter {
             context: unknown;
         }[];
     };
+    invalidate(): Promise<unknown>;
 }
-/** The route whose pages read the session, and its session. */
-export interface ViewerRoute<Session> {
-    /** Id of the layout route above every page reading the session. */
-    routeId: string;
-    /** The session in the route's context: `null` signed out, `undefined`
-     *  on a page carrying none. */
-    select: (context: unknown) => Session | null | undefined;
+/** What `watchViewerRouter` reads of a TanStack Query query. */
+interface ViewerQuery {
+    state: {
+        status: string;
+        fetchStatus: string;
+    };
+    reset(): void;
+}
+/** What `watchViewerRouter` reads of a TanStack Query client: its cached
+ *  queries and refetch of the active ones. */
+export interface ViewerQueryClient {
+    getQueryCache(): {
+        getAll(): readonly ViewerQuery[];
+    };
+    refetchQueries(filters: {
+        type: "active";
+        predicate: (query: ViewerQuery) => boolean;
+    }): Promise<unknown>;
+}
+/** Context of the layout route carrying the viewer's session
+ *  (`viewerRouteContext`). */
+export interface ViewerContext<Session> {
+    /** `null` signed out; `undefined` on a page reached by client
+     *  navigation. */
+    session: Session | null | undefined;
 }
 /** Shared live session store and auth operations for `Auth`. */
 export declare function createShellAuthClient<Auth extends ShellAuthLike>(): {
@@ -2142,16 +2160,14 @@ export declare function createShellAuthClient<Auth extends ShellAuthLike>(): {
     }>;
     refreshSession: () => Promise<void>;
     watchSession: (session: Auth["$Infer"]["Session"] | null | undefined, onChange: () => void) => () => void;
-    watchRouteViewer: (router: ViewerRouter, { routeId, select }: ViewerRoute<Auth["$Infer"]["Session"]>, onChange: () => void) => () => void;
-    signInWithProvider: (provider: string, callbackURL: string) => Promise<string | undefined>;
-    signUpOrInWithEmail: (account: {
-        email: string;
-        password: string;
-        name: string;
+    watchViewerRouter: (router: ViewerRouter, queryClient: ViewerQueryClient, routeId: string) => () => void;
+    post: (path: string, body: Record<string, string>, { form }?: {
+        form?: boolean | undefined;
     }) => Promise<{
         message?: string | undefined;
         status: number;
         statusText: string;
     } | undefined>;
+    signInWithProvider: (provider: string, callbackURL: string) => Promise<string | undefined>;
 };
 export {};

package/dist/client.js

@@ -1,3 +1,5 @@
+/** Browser half of shell-auth: the session store, auth calls and OAuth popups. */
+import { log } from "@astralarium/repo-telemetry";
 import { getGlobalBroadcastChannel } from "better-auth/client";
 import { InferServerPlugin } from "better-auth/client/plugins";
 import { createAuthClient } from "better-auth/react";
@@ -124,32 +126,55 @@ export function createShellAuthClient() {
     });
   }
   /**
-   * Watches the signed-in user from the first loaded page under `routeId`;
-   * other pages read no session. A server-rendered page's session seeds
-   * the watch; one reached by client navigation carries none, and the
-   * store's first read sets the user. Calls `onChange` on each user change
-   * after. Returns the unsubscribe.
+   * Watches the signed-in user from the first loaded page under `routeId`,
+   * the layout route carrying `viewerRouteContext`; other pages read no
+   * session. A server-rendered page's session seeds the watch; one reached
+   * by client navigation carries none, and the store's first read sets the
+   * user. Each user change after clears `queryClient`'s queries and
+   * invalidates `router`, both holding the previous user's data; the
+   * route loaders refetch the queries they read, then the active queries
+   * still unread refetch: one fetch per query. Returns the unsubscribe.
    */
-  function watchRouteViewer(router, {
-    routeId,
-    select
-  }, onChange) {
+  function watchViewerRouter(router, queryClient, routeId) {
     let stop = router.subscribe("onLoad", () => {
       const match = router.state.matches.find(route => route.routeId === routeId);
       if (!match) return;
       stop();
-      stop = watchSession(select(match.context), onChange);
+      const {
+        session
+      } = match.context;
+      stop = watchSession(session, () => {
+        for (const query of queryClient.getQueryCache().getAll()) query.reset();
+        const failed = exception => log.warn("auth.viewer_reload_failed", "Reloading the page for a new viewer failed", {
+          exception
+        });
+        void router.invalidate().catch(failed).then(() => queryClient.refetchQueries({
+          type: "active",
+          predicate: ({
+            state
+          }) => state.status === "pending" && state.fetchStatus === "idle"
+        })).catch(failed);
+      });
     });
     return () => stop();
   }
-  /** POSTs `body` to the auth endpoint at `path`; resolves to its error.
-   *  Endpoint methods (`signIn.social`) type per app, unresolved here. */
-  async function post(path, body) {
+  /** POSTs `body` to the auth endpoint at `path`, a form with `form`;
+   *  resolves to its error. Endpoint methods (`signIn.social`) type per
+   *  app, unresolved here; plugin endpoints (`devProviderSignIn`) call
+   *  through it. */
+  async function post(path, body, {
+    form = false
+  } = {}) {
     const {
       error
     } = await authClient.$fetch(path, {
       method: "POST",
-      body
+      body,
+      ...(form && {
+        headers: {
+          "content-type": "application/x-www-form-urlencoded"
+        }
+      })
     });
     return error ?? undefined;
   }
@@ -166,29 +191,13 @@ export function createShellAuthClient() {
       return cause instanceof Error ? cause.message : String(cause);
     }
   }
-  /** Signs up an email account, or into it when it exists, then reads
-   *  the new session in this tab: `$fetch` skips Better Auth's session
-   *  signal; `sessionBroadcast` tells the others. Resolves to the sign-in
-   *  error when both fail. */
-  async function signUpOrInWithEmail(account) {
-    const {
-      email,
-      password
-    } = account;
-    const error = (await post("/sign-up/email", account)) && (await post("/sign-in/email", {
-      email,
-      password
-    }));
-    if (!error) await sessionStore.get().refetch();
-    return error;
-  }
   return {
     authClient,
     sessionStore,
     refreshSession,
     watchSession,
-    watchRouteViewer,
-    signInWithProvider,
-    signUpOrInWithEmail
+    watchViewerRouter,
+    post,
+    signInWithProvider
   };
 }

package/dist/dev-sign-in/client.d.ts

@@ -0,0 +1,21 @@
+/** Dev builds' browser sign-in as provider accounts. */
+import type { createShellAuthClient } from "../client.ts";
+/** What dev sign-in calls of a shell auth client
+ *  (`createShellAuthClient`). */
+export interface DevSignInClient {
+    post: ReturnType<typeof createShellAuthClient>["post"];
+    sessionStore: {
+        get(): {
+            refetch(): Promise<unknown>;
+        };
+    };
+}
+/** Signs in through `client`'s dev sign-in (`devProviderSignIn`) as the
+ *  provider account `accountId`, then reads the new session in this tab:
+ *  `post` skips Better Auth's session signal; `sessionBroadcast` tells the
+ *  others. Resolves to the error when sign-in fails. */
+export declare function signInWithDevAccount({ post, sessionStore }: DevSignInClient, accountId: string): Promise<{
+    message?: string | undefined;
+    status: number;
+    statusText: string;
+} | undefined>;

package/dist/dev-sign-in/client.js

@@ -0,0 +1,17 @@
+import { DEV_SIGN_IN_ENDPOINT } from "./endpoint.js";
+/** Signs in through `client`'s dev sign-in (`devProviderSignIn`) as the
+ *  provider account `accountId`, then reads the new session in this tab:
+ *  `post` skips Better Auth's session signal; `sessionBroadcast` tells the
+ *  others. Resolves to the error when sign-in fails. */
+export async function signInWithDevAccount({
+  post,
+  sessionStore
+}, accountId) {
+  const error = await post(DEV_SIGN_IN_ENDPOINT, {
+    accountId
+  }, {
+    form: true
+  });
+  if (!error) await sessionStore.get().refetch();
+  return error;
+}

package/dist/dev-sign-in/endpoint.d.ts

@@ -0,0 +1,2 @@
+/** Dev sign-in's endpoint under `AUTH_BASE_PATH`. */
+export declare const DEV_SIGN_IN_ENDPOINT = "/dev/sign-in";

package/dist/dev-sign-in/endpoint.js

@@ -0,0 +1,2 @@
+/** Dev sign-in's endpoint under `AUTH_BASE_PATH`. */
+export const DEV_SIGN_IN_ENDPOINT = "/dev/sign-in";

package/dist/dev-sign-in/index.d.ts

@@ -0,0 +1,4 @@
+/** Dev builds' sign-in as provider accounts, and provider accounts
+ *  resolved to users for seeds. */
+export { type ContextAuth, ensureProviderUser, type ProviderUser, } from "./provider-user.ts";
+export { type DevProviderSignIn, devProviderSignIn, type DevProviderSignInOptions, isDevSignIn, } from "./sign-in.ts";

package/dist/dev-sign-in/index.js

@@ -0,0 +1,4 @@
+/** Dev builds' sign-in as provider accounts, and provider accounts
+ *  resolved to users for seeds. */
+export { ensureProviderUser } from "./provider-user.js";
+export { devProviderSignIn, isDevSignIn } from "./sign-in.js";

package/dist/dev-sign-in/provider-user.d.ts

@@ -0,0 +1,30 @@
+/** Provider accounts resolved to users through better-auth's adapter. */
+import type { AuthContext } from "better-auth";
+/** A provider account and the user it creates when new. */
+export interface ProviderUser {
+    /** Provider id (`google`, `github`). */
+    providerId: string;
+    /** The provider's account id. */
+    accountId: string;
+    /** Name of a new user. */
+    name: string;
+    /** Email of a new user; a user holding it gains the account. */
+    email: string;
+}
+/** What a dev sign-in function reads of an auth instance: its context's
+ *  `Keys`; `ensureProviderUser` reads `internalAdapter`. */
+export interface ContextAuth<Keys extends keyof AuthContext = "internalAdapter"> {
+    $context: Promise<Pick<AuthContext, Keys>>;
+}
+/**
+ * The id of the user owning `providerId` account `accountId`, else of the
+ * user holding `email`, else of a new user (`name`, verified `email`); the
+ * latter two gain a token-less account. `email` must be trusted (the
+ * account's own claim): its holder gains the account. Rows go through
+ * better-auth's adapter, so the app's `databaseHooks` run. Concurrent
+ * calls for one new account resolve to one user. Queries run inside
+ * `withShellAuth`. Seeds call it outside any request: better-auth's
+ * `handleOAuthUserInfo`, which dev sign-in uses, takes an endpoint context
+ * and creates a session.
+ */
+export declare function ensureProviderUser(auth: ContextAuth, { providerId, accountId, name, email }: ProviderUser): Promise<string>;

package/dist/dev-sign-in/provider-user.js

@@ -0,0 +1,55 @@
+/**
+ * The id of the user owning `providerId` account `accountId`, else of the
+ * user holding `email`, else of a new user (`name`, verified `email`); the
+ * latter two gain a token-less account. `email` must be trusted (the
+ * account's own claim): its holder gains the account. Rows go through
+ * better-auth's adapter, so the app's `databaseHooks` run. Concurrent
+ * calls for one new account resolve to one user. Queries run inside
+ * `withShellAuth`. Seeds call it outside any request: better-auth's
+ * `handleOAuthUserInfo`, which dev sign-in uses, takes an endpoint context
+ * and creates a session.
+ */
+export async function ensureProviderUser(auth, {
+  providerId,
+  accountId,
+  name,
+  email
+}) {
+  const {
+    internalAdapter
+  } = await auth.$context;
+  const owner = () => internalAdapter.findAccountOwnerByKey({
+    providerId,
+    accountId
+  }).then(found => found?.kind === "owned" ? found.user.id : undefined);
+  const existing = await owner();
+  if (existing) return existing;
+  try {
+    const holder = await internalAdapter.findUserByEmail(email);
+    if (holder) {
+      await internalAdapter.linkAccount({
+        userId: holder.user.id,
+        providerId,
+        accountId
+      });
+      return holder.user.id;
+    }
+    const {
+      user
+    } = await internalAdapter.createOAuthUser({
+      name,
+      email,
+      emailVerified: true
+    }, {
+      providerId,
+      accountId
+    });
+    return user.id;
+  } catch (error) {
+    // A concurrent call created the account first: the unique account or
+    // email index rejected this one. A failed re-read leaves `error`.
+    const winner = await owner().catch(() => undefined);
+    if (winner) return winner;
+    throw error;
+  }
+}

package/dist/dev-sign-in/sign-in.d.ts

@@ -0,0 +1,62 @@
+import { z } from "zod";
+import type { ContextAuth } from "./provider-user.ts";
+/** Dev sign-in's provider and its accounts: `devProviderSignIn`'s options. */
+export interface DevProviderSignInOptions {
+    /** Provider id the signed-in accounts belong to. */
+    provider: string;
+    /** Valid account ids; others answer 400. Default: any non-empty id. */
+    accountId?: z.ZodType<string>;
+    /** Name and email of a new account's user. */
+    newUser: (accountId: string) => {
+        name: string;
+        email: string;
+    };
+}
+/**
+ * better-auth plugin for dev builds, `ShellAuthApp.devSignIn`: `POST
+ * /dev/sign-in` with form field `accountId` signs in as that `provider`
+ * account through better-auth's OAuth sign-in (`handleOAuthUserInfo`): its
+ * owner, else the user holding `newUser`'s email under the app's account
+ * linking, else a new user (`newUser`, verified email); new accounts hold
+ * no tokens, stored tokens stay. Requests from a better-auth trusted origin
+ * only (`isTrustedOrigin`: the base URL, allowed hosts, `trustedOrigins`);
+ * others and a missing `Origin` answer 403; a refused sign-in answers 401.
+ * better-auth sets the session cookies, plus a marker cookie holding the
+ * session id signed like the session token (`isDevSignIn`), expiring at
+ * the session's sign-in expiry. Answers the session's `token` and `user`
+ * id.
+ */
+export declare function devProviderSignIn({ provider, accountId, newUser, }: DevProviderSignInOptions): {
+    id: "dev-provider-sign-in";
+    endpoints: {
+        devProviderSignIn: import("better-auth").StrictEndpoint<"/dev/sign-in", {
+            method: "POST";
+            body: z.ZodObject<{
+                accountId: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+            }, z.core.$strip>;
+            requireRequest: true;
+            metadata: {
+                allowedMediaTypes: string[];
+            };
+        }, {
+            token: string;
+            user: {
+                id: string;
+            };
+        }>;
+    };
+};
+/** The dev sign-in plugin `devProviderSignIn` builds. */
+export type DevProviderSignIn = ReturnType<typeof devProviderSignIn>;
+/**
+ * Whether `headers` carry `auth`'s marker cookie holding `session`'s id
+ * signed with `auth`'s secret: the auth server signed that id, as dev
+ * sign-in does for each session it creates. The marker's name follows
+ * `auth`'s cookie naming (prefix, `__Secure-` on HTTPS). False past the
+ * marker's sign-in expiry, while an extended session lives on.
+ */
+export declare function isDevSignIn(auth: ContextAuth<"createAuthCookie" | "secret">, headers: Headers, session: {
+    session: {
+        id: string;
+    };
+} | null): Promise<boolean>;

package/dist/dev-sign-in/sign-in.js

@@ -0,0 +1,116 @@
+import { APIError, createAuthEndpoint } from "better-auth/api";
+import { parseCookies, setSessionCookie } from "better-auth/cookies";
+import { constantTimeEqual, makeSignature } from "better-auth/crypto";
+import { handleOAuthUserInfo } from "better-auth/oauth2";
+import { z } from "zod";
+import { DEV_SIGN_IN_ENDPOINT } from "./endpoint.js";
+/** better-auth cookie holding the id of the session dev sign-in created,
+ *  signed with the auth secret. Its lifetime is fixed at sign-in to the
+ *  session's `expiresIn`; a session extended on refresh (`updateAge`)
+ *  outlives it. */
+const MARKER = "dev_sign_in";
+/**
+ * better-auth plugin for dev builds, `ShellAuthApp.devSignIn`: `POST
+ * /dev/sign-in` with form field `accountId` signs in as that `provider`
+ * account through better-auth's OAuth sign-in (`handleOAuthUserInfo`): its
+ * owner, else the user holding `newUser`'s email under the app's account
+ * linking, else a new user (`newUser`, verified email); new accounts hold
+ * no tokens, stored tokens stay. Requests from a better-auth trusted origin
+ * only (`isTrustedOrigin`: the base URL, allowed hosts, `trustedOrigins`);
+ * others and a missing `Origin` answer 403; a refused sign-in answers 401.
+ * better-auth sets the session cookies, plus a marker cookie holding the
+ * session id signed like the session token (`isDevSignIn`), expiring at
+ * the session's sign-in expiry. Answers the session's `token` and `user`
+ * id.
+ */
+export function devProviderSignIn({
+  provider,
+  accountId = z.string().min(1),
+  newUser
+}) {
+  return {
+    id: "dev-provider-sign-in",
+    endpoints: {
+      devProviderSignIn: createAuthEndpoint(DEV_SIGN_IN_ENDPOINT, {
+        method: "POST",
+        body: z.object({
+          accountId
+        }),
+        requireRequest: true,
+        metadata: {
+          allowedMediaTypes: ["application/x-www-form-urlencoded"]
+        }
+      }, async ctx => {
+        const {
+          request,
+          context
+        } = ctx;
+        const origin = request.headers.get("origin");
+        if (!origin || !context.isTrustedOrigin(origin)) throw APIError.fromStatus("FORBIDDEN", {
+          message: "Untrusted origin sign-in forbidden."
+        });
+        const id = ctx.body.accountId;
+        const signIn = () => handleOAuthUserInfo(ctx, {
+          userInfo: {
+            id,
+            ...newUser(id),
+            emailVerified: true
+          },
+          account: {
+            providerId: provider,
+            accountId: id
+          }
+        });
+        const first = await signIn();
+        // A concurrent sign-in as the same new account fails this one's
+        // create; the retry signs in as the winner's user.
+        const {
+          data,
+          error
+        } = first.data ? first : await signIn();
+        if (!data) throw APIError.fromStatus("UNAUTHORIZED", {
+          message: error
+        });
+        const {
+          session,
+          user
+        } = data;
+        await setSessionCookie(ctx, {
+          session,
+          user
+        });
+        const marker = context.createAuthCookie(MARKER);
+        await ctx.setSignedCookie(marker.name, session.id, context.secret, {
+          ...marker.attributes,
+          maxAge: context.sessionConfig.expiresIn
+        });
+        return ctx.json({
+          token: session.token,
+          user: {
+            id: user.id
+          }
+        });
+      })
+    }
+  };
+}
+/**
+ * Whether `headers` carry `auth`'s marker cookie holding `session`'s id
+ * signed with `auth`'s secret: the auth server signed that id, as dev
+ * sign-in does for each session it creates. The marker's name follows
+ * `auth`'s cookie naming (prefix, `__Secure-` on HTTPS). False past the
+ * marker's sign-in expiry, while an extended session lives on.
+ */
+export async function isDevSignIn(auth, headers, session) {
+  if (!session) return false;
+  const {
+    createAuthCookie,
+    secret
+  } = await auth.$context;
+  const value = parseCookies(headers.get("cookie") ?? "").get(createAuthCookie(MARKER).name);
+  if (value === undefined) return false;
+  const {
+    id
+  } = session.session;
+  return constantTimeEqual(value, `${id}.${await makeSignature(id, secret)}`);
+}

package/dist/index.server.d.ts

@@ -1,6 +1,7 @@
 import { type BetterAuthOptions, type BetterAuthPlugin, type Session, type User } from "better-auth";
 import { type Dialect } from "kysely";
 import { z } from "zod";
+import type { DevProviderSignIn } from "./dev-sign-in/sign-in.ts";
 import type { AuthProviderCredentials, AuthProviders } from "./providers/provider.ts";
 import type { SessionLike } from "./types.ts";
 /** `auth.users` columns beside better-auth's core fields. */
@@ -22,8 +23,16 @@ export interface ShellAuthApp<Fields extends AdditionalFields, Projected extends
     providers?: AuthProviders;
     /** Signed-in users link more provider accounts (`/link-social`). */
     linkSocial?: boolean;
-    /** Email+password sign-in and sign-up endpoints, for dev builds. */
-    devEmailSignIn?: boolean;
+    /**
+     * Dev sign-in as any account of a provider (`devProviderSignIn`): `POST
+     * /api/auth/dev/sign-in` grants a session for any account id to any
+     * caller reaching the server; its trusted-origin `Origin` check is the
+     * one gate. Build it under the dev build flag alone
+     * (`import.meta.env.DEV`), which drops it from production bundles;
+     * `testProductionAuth` proves the production build serves no dev
+     * sign-in.
+     */
+    devSignIn?: DevProviderSignIn;
     /** Page OAuth failures redirect to, with `error` and `error_description`
      *  query params. */
     errorURL: string;
@@ -300,15 +309,9 @@ export interface ShellSession<Fields extends AdditionalFields> {
     user: User<SchemaOptions<Fields>["user"]>;
 }
 /** better-auth for `config` over the running scope's database: the `auth.*`
- *  schema, the session projection, the providers' plugins, then
- *  `config.plugins`. */
+ *  schema, the session projection, the providers' plugins, dev sign-in,
+ *  then `config.plugins`. */
 declare function buildAuth<Fields extends AdditionalFields, Projected extends SessionLike>(config: ShellAuthConfig<Fields, Projected>): import("better-auth").Auth<{
-    onAPIError: {
-        errorURL: string;
-    };
-    emailAndPassword?: {
-        enabled: true;
-    } | undefined;
     baseURL: NonNullable<import("better-auth").BaseURLConfig | undefined>;
     secret: string;
     database: {
@@ -361,7 +364,29 @@ declare function buildAuth<Fields extends AdditionalFields, Projected extends Se
         $Infer: {
             Session: Projected;
         };
-    }, ...BetterAuthPlugin[]];
+    }, ...(BetterAuthPlugin | {
+        id: "dev-provider-sign-in";
+        endpoints: {
+            devProviderSignIn: import("better-auth").StrictEndpoint<"/dev/sign-in", {
+                method: "POST";
+                body: z.ZodObject<{
+                    accountId: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+                }, z.core.$strip>;
+                requireRequest: true;
+                metadata: {
+                    allowedMediaTypes: string[];
+                };
+            }, {
+                token: string;
+                user: {
+                    id: string;
+                };
+            }>;
+        };
+    })[]];
+    onAPIError: {
+        errorURL: string;
+    };
     appName: string;
     advanced: {
         disableOriginCheck: false;

package/dist/index.server.js

@@ -238,14 +238,14 @@ const scopedPostgres = {
   createIntrospector: db => new PostgresIntrospector(db)
 };
 /** better-auth for `config` over the running scope's database: the `auth.*`
- *  schema, the session projection, the providers' plugins, then
- *  `config.plugins`. */
+ *  schema, the session projection, the providers' plugins, dev sign-in,
+ *  then `config.plugins`. */
 function buildAuth(config) {
   const {
     baseURL,
     secret,
     plugins,
-    devEmailSignIn,
+    devSignIn,
     errorURL
   } = config;
   const schema = schemaOptions(config);
@@ -260,12 +260,7 @@ function buildAuth(config) {
       transaction: true
     },
     socialProviders: providers.socialProviders,
-    plugins: [sessionProjection(config.projectSession), ...providers.plugins, ...(plugins ?? [])],
-    ...(devEmailSignIn && {
-      emailAndPassword: {
-        enabled: true
-      }
-    }),
+    plugins: [sessionProjection(config.projectSession), ...providers.plugins, ...(devSignIn ? [devSignIn] : []), ...(plugins ?? [])],
     onAPIError: {
       errorURL
     }