@astralarium/repo-auth 0.1.0 → 0.2.0

package/dist/request.d.ts

@@ -9,8 +9,8 @@ export declare const AUTH_BASE_PATH = "/api/auth";
 export declare const AUTHORIZE_PATHS: ReadonlySet<string>;
 /** Endpoints `app`'s client calls: session, social sign-in, each
  *  provider's callback and sign-out; account linking with `linkSocial`;
- *  email sign-in and sign-up with `devEmailSignIn`. */
-export declare function authPaths({ providers, linkSocial, devEmailSignIn, }: Pick<ShellAuthApp<AdditionalFields, SessionLike>, "providers" | "linkSocial" | "devEmailSignIn">): ReadonlySet<string>;
+ *  dev sign-in's endpoints with `devSignIn`. */
+export declare function authPaths({ providers, linkSocial, devSignIn, }: Pick<ShellAuthApp<AdditionalFields, SessionLike>, "providers" | "linkSocial" | "devSignIn">): ReadonlySet<string>;
 /** A per-key limiter: Cloudflare's rate limiting binding. */
 export interface RateLimiter {
     limit(options: {

package/dist/request.js

@@ -4,13 +4,15 @@ export const AUTH_BASE_PATH = "/api/auth";
 export const AUTHORIZE_PATHS = new Set(["/sign-in/social", "/link-social"].map(path => `${AUTH_BASE_PATH}${path}`));
 /** Endpoints `app`'s client calls: session, social sign-in, each
  *  provider's callback and sign-out; account linking with `linkSocial`;
- *  email sign-in and sign-up with `devEmailSignIn`. */
+ *  dev sign-in's endpoints with `devSignIn`. */
 export function authPaths({
   providers,
   linkSocial,
-  devEmailSignIn
+  devSignIn
 }) {
-  return new Set(["/get-session", "/sign-in/social", ...(linkSocial ? ["/link-social"] : []), ...(providers?.ids ?? []).map(id => `/callback/${id}`), "/sign-out", ...(devEmailSignIn ? ["/sign-in/email", "/sign-up/email"] : [])].map(path => `${AUTH_BASE_PATH}${path}`));
+  return new Set(["/get-session", "/sign-in/social", ...(linkSocial ? ["/link-social"] : []), ...(providers?.ids ?? []).map(id => `/callback/${id}`), "/sign-out", ...Object.values(devSignIn?.endpoints ?? {}).map(({
+    path
+  }) => path)].map(path => `${AUTH_BASE_PATH}${path}`));
 }
 /** Whether `request` carries a JSON object without `idToken`. ID-token
  *  sign-in skips state, PKCE and nonce; authorization takes the redirect

package/dist/start/index.d.ts

@@ -0,0 +1,6 @@
+/** TanStack Start bindings of shell-auth, client-safe: the layout route
+ *  context carrying the viewer's session, return paths, and server
+ *  function middleware. */
+export * from "./middleware.ts";
+export * from "./return-path.ts";
+export * from "./viewer.ts";

package/dist/start/index.js

@@ -0,0 +1,6 @@
+/** TanStack Start bindings of shell-auth, client-safe: the layout route
+ *  context carrying the viewer's session, return paths, and server
+ *  function middleware. */
+export * from "./middleware.js";
+export * from "./return-path.js";
+export * from "./viewer.js";

package/dist/start/index.server.d.ts

@@ -0,0 +1,28 @@
+import type { SessionLike } from "../types.ts";
+/** Runs `fn` with the app's auth instance, its queries scoped to the
+ *  request (`withShellAuth`). */
+export type WithAuth<Auth> = <T>(fn: (auth: Auth) => Promise<T>) => Promise<T>;
+/** What `viewerSession` reads of an auth instance: `shellAuth`'s
+ *  projected `get-session`. */
+export interface ViewerAuth {
+    api: {
+        getSession(context: {
+            headers: Headers;
+            returnHeaders: true;
+        }): Promise<{
+            headers: Headers;
+            response: unknown;
+        }>;
+    };
+    $Infer: {
+        Session: SessionLike;
+    };
+}
+/**
+ * Server function handler: the request's projected session, `null` signed
+ * out, read through `withAuth`; the response carries the read's cookies
+ * and is `private, no-store`. Apps declare the GET server function itself,
+ * as Start compiles top-level declarations alone:
+ * `createServerFn({ method: "GET" }).handler(viewerSession(withAuth))`.
+ */
+export declare function viewerSession<Auth extends ViewerAuth>(withAuth: WithAuth<Auth>): () => Promise<Auth["$Infer"]["Session"] | null>;

package/dist/start/index.server.js

@@ -0,0 +1,29 @@
+/** Server half of shell-auth's TanStack Start bindings: the viewer's
+ *  session read. */
+import { createServerOnlyFn } from "@tanstack/react-start";
+import { appendResponseHeader, getRequestHeaders, setResponseHeader } from "@tanstack/react-start/server";
+/** `auth`'s session of the request, `null` signed out. The response
+ *  carries the read's `Set-Cookie` values (cookie cache refresh, session
+ *  extension) and depends on the request, so shared caches skip it. */
+const readViewerSession = createServerOnlyFn(async auth => {
+  setResponseHeader("cache-control", "private, no-store");
+  const {
+    headers,
+    response
+  } = await auth.api.getSession({
+    headers: getRequestHeaders(),
+    returnHeaders: true
+  });
+  for (const cookie of headers.getSetCookie()) appendResponseHeader("set-cookie", cookie);
+  return response;
+});
+/**
+ * Server function handler: the request's projected session, `null` signed
+ * out, read through `withAuth`; the response carries the read's cookies
+ * and is `private, no-store`. Apps declare the GET server function itself,
+ * as Start compiles top-level declarations alone:
+ * `createServerFn({ method: "GET" }).handler(viewerSession(withAuth))`.
+ */
+export function viewerSession(withAuth) {
+  return () => withAuth(auth => readViewerSession(auth));
+}

package/dist/start/middleware.d.ts

@@ -0,0 +1,33 @@
+/** Plain-text body of the 401 `Response` answering a signed-out call of
+ *  an `authedMiddleware` server function. */
+export declare const UNAUTHENTICATED = "unauthenticated";
+/** Whether `error` is a 401 `Response`, as a signed-out call of an
+ *  `authedMiddleware` server function rejects with. */
+export declare function isUnauthenticated(error: unknown): error is Response;
+/** Adds `sql`: one client over `connectionString()` per server function
+ *  call; its one connection opens at the first query and closes when the
+ *  handler resolves. The connection string reads per call: bindings are
+ *  absent at static prerender. `connectionString` lands in the client
+ *  build: a `createServerOnlyFn` drops its imports there. */
+export declare function dbMiddleware(connectionString: () => string): import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, {
+    sql: import("postgres").Sql<{}>;
+}, undefined, undefined, undefined>;
+/** Adds the viewer's `session` from `readSession` (`viewerSession`'s
+ *  server function), `null` signed out. The read opens its own
+ *  connection (`withAuth`'s scope), closed before the handler runs; the
+ *  cookie cache answers most reads with none. Handlers querying `sql`
+ *  add `dbMiddleware` beside it. */
+export declare function sessionMiddleware<Session>(readSession: () => Promise<Session | null>): import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, {
+    session: Awaited<Session> | null;
+}, undefined, undefined, undefined>;
+/** A `sessionMiddleware` over sessions of `Session`. */
+export type SessionMiddleware<Session> = ReturnType<typeof sessionMiddleware<Session>>;
+/** `session`'s context with a signed-in `session`, opening no
+ *  connection of its own. A signed-out call throws a 401 `Response` with
+ *  body `UNAUTHENTICATED`; Start rejects the caller's call with that
+ *  `Response`, in the browser and during SSR (`isUnauthenticated`). */
+export declare function authedMiddleware<Session>(session: SessionMiddleware<Session>): import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, {
+    session: Awaited<Session> | null;
+}, undefined, undefined, undefined>], undefined, {
+    session: NonNullable<Awaited<Session>>;
+}, undefined, undefined, undefined>;

package/dist/start/middleware.js

@@ -0,0 +1,70 @@
+/** Server function middleware of shell-auth: a database client per call,
+ *  the viewer's session, and signed-in calls alone. Client-importable:
+ *  this package lists `@tanstack/react-start` as a peer, so Start's Vite
+ *  plugin compiles it, and the client compile strips `.server()` bodies
+ *  and their imports. */
+import { withSql } from "@astralarium/repo-postgres/sql";
+import { createMiddleware } from "@tanstack/react-start";
+/** Plain-text body of the 401 `Response` answering a signed-out call of
+ *  an `authedMiddleware` server function. */
+export const UNAUTHENTICATED = "unauthenticated";
+/** Whether `error` is a 401 `Response`, as a signed-out call of an
+ *  `authedMiddleware` server function rejects with. */
+export function isUnauthenticated(error) {
+  return error instanceof Response && error.status === 401;
+}
+/** Adds `sql`: one client over `connectionString()` per server function
+ *  call; its one connection opens at the first query and closes when the
+ *  handler resolves. The connection string reads per call: bindings are
+ *  absent at static prerender. `connectionString` lands in the client
+ *  build: a `createServerOnlyFn` drops its imports there. */
+export function dbMiddleware(connectionString) {
+  return createMiddleware({
+    type: "function"
+  }).server(({
+    next
+  }) => withSql(connectionString(), sql => next({
+    context: {
+      sql
+    }
+  })));
+}
+/** Adds the viewer's `session` from `readSession` (`viewerSession`'s
+ *  server function), `null` signed out. The read opens its own
+ *  connection (`withAuth`'s scope), closed before the handler runs; the
+ *  cookie cache answers most reads with none. Handlers querying `sql`
+ *  add `dbMiddleware` beside it. */
+export function sessionMiddleware(readSession) {
+  return createMiddleware({
+    type: "function"
+  }).server(async ({
+    next
+  }) => next({
+    context: {
+      session: await readSession()
+    }
+  }));
+}
+/** `session`'s context with a signed-in `session`, opening no
+ *  connection of its own. A signed-out call throws a 401 `Response` with
+ *  body `UNAUTHENTICATED`; Start rejects the caller's call with that
+ *  `Response`, in the browser and during SSR (`isUnauthenticated`). */
+export function authedMiddleware(session) {
+  return createMiddleware({
+    type: "function"
+  }).middleware([session]).server(({
+    next,
+    context
+  }) => {
+    if (!context.session)
+      // eslint-disable-next-line @typescript-eslint/only-throw-error -- Start answers a thrown `Response` as is
+      throw new Response(UNAUTHENTICATED, {
+        status: 401
+      });
+    return next({
+      context: {
+        session: context.session
+      }
+    });
+  });
+}

package/dist/start/return-path.d.ts

@@ -0,0 +1,16 @@
+/** Return paths: where a page sends the visitor once done, kept on this
+ *  site. */
+/** `url` resolved against `base`; null when it fails to parse. Stands in
+ *  for `URL.parse`, which postdates the Vite browser baseline (Safari
+ *  16.4). */
+export declare function parseUrl(url: string, base?: string): URL | null;
+/** `url`'s normalized path, query and fragment when the browser resolves
+ *  it as an origin-relative path; undefined when it or its normalized path
+ *  (`//host`, from dot segments) names a host. */
+export declare function ifUrlOkay(url?: string | null): string | undefined;
+/** Search of a page returning to `r` once done; `validateSearch`. `r` is
+ *  `ifUrlOkay`'s origin-relative path; an unsafe or non-string `r`
+ *  drops. */
+export declare function validateReturnSearch(search: Record<string, unknown>): {
+    r?: string;
+};

package/dist/start/return-path.js

@@ -0,0 +1,32 @@
+/** Return paths: where a page sends the visitor once done, kept on this
+ *  site. */
+/** `url` resolved against `base`; null when it fails to parse. Stands in
+ *  for `URL.parse`, which postdates the Vite browser baseline (Safari
+ *  16.4). */
+export function parseUrl(url, base) {
+  try {
+    return new URL(url, base);
+  } catch {
+    return null;
+  }
+}
+/** Stand-in origin for resolving paths. */
+const PATH_BASE = "http://path.invalid";
+/** `url`'s normalized path, query and fragment when the browser resolves
+ *  it as an origin-relative path; undefined when it or its normalized path
+ *  (`//host`, from dot segments) names a host. */
+export function ifUrlOkay(url) {
+  if (!url?.startsWith("/")) return;
+  const resolved = parseUrl(url, PATH_BASE);
+  if (resolved?.origin !== PATH_BASE || resolved.pathname.startsWith("//")) return;
+  return resolved.pathname + resolved.search + resolved.hash;
+}
+/** Search of a page returning to `r` once done; `validateSearch`. `r` is
+ *  `ifUrlOkay`'s origin-relative path; an unsafe or non-string `r`
+ *  drops. */
+export function validateReturnSearch(search) {
+  const r = typeof search.r === "string" ? ifUrlOkay(search.r) : undefined;
+  return r === undefined ? {} : {
+    r
+  };
+}

package/dist/start/viewer.d.ts

@@ -0,0 +1,8 @@
+import type { ViewerContext } from "../client.ts";
+/**
+ * `beforeLoad` of the layout route above every page reading the session:
+ * `{ session }` from `fetchViewer` (`viewerSession`'s server function) on
+ * the server, dehydrated with the match; `undefined` in the browser,
+ * whose live session store holds it (`watchViewerRouter`).
+ */
+export declare function viewerRouteContext<Session>(fetchViewer: () => Promise<Session | null>): () => Promise<ViewerContext<Session>>;

package/dist/start/viewer.js

@@ -0,0 +1,15 @@
+/** The layout route context carrying the viewer's session in a TanStack
+ *  Start app. */
+import { createIsomorphicFn } from "@tanstack/react-start";
+/**
+ * `beforeLoad` of the layout route above every page reading the session:
+ * `{ session }` from `fetchViewer` (`viewerSession`'s server function) on
+ * the server, dehydrated with the match; `undefined` in the browser,
+ * whose live session store holds it (`watchViewerRouter`).
+ */
+export function viewerRouteContext(fetchViewer) {
+  const read = createIsomorphicFn().server(() => fetchViewer());
+  return async () => ({
+    session: await read()
+  });
+}

package/dist/testkit/index.d.ts

@@ -1,9 +1,10 @@
 /** Test support: a deployed `auth.*` schema checked against an app's auth
  *  instance, endpoint conformance (unserved paths, ID-token refusal,
  *  anonymous sessions), cookies out of auth responses, a rate-limit probe,
- *  social sign-in starts, session reads held on a lock, `auth.users`
- *  rows inserted directly, and a fake OpenID Connect provider. */
-import type { Sql, TransactionSql } from "@astralarium/repo-postgres/sql";
+ *  social sign-in starts, session reads held on a lock, `testUtils`
+ *  sessions, `auth.users` rows inserted directly, and a fake OpenID
+ *  Connect provider. */
+import { type Sql, type TransactionSql } from "@astralarium/repo-postgres/sql";
 import { authPaths } from "../request.ts";
 import { type JsonPost } from "./json-post.ts";
 export * from "./oidc.ts";
@@ -108,13 +109,22 @@ export interface BlockedSessionReadOptions {
     timeout?: number;
 }
 /**
- * Runs `fn` while a connection over `db` holds `auth.session` exclusively
- * and `readSession` (a database session read, e.g. `get-session` with a
- * session cookie and `disableCookieCache`) waits on the lock. The lock
- * releases as `fn` settles; rejects when no read reaches it within
- * `timeout`.
+ * Runs `fn` while a transaction over `db` holds `auth.session` exclusively
+ * (`holdTransaction`) and `readSession` (a database session read, e.g.
+ * `get-session` with a session cookie and `disableCookieCache`) waits on
+ * it. The lock releases as `fn` settles; rejects when no read reaches it
+ * within `timeout`.
  */
 export declare function withBlockedSessionRead<R, T>(db: string, readSession: () => Promise<R>, fn: (blocked: BlockedSessionRead<R>) => T | Promise<T>, { applicationName, timeout }?: BlockedSessionReadOptions): Promise<T>;
+/** What `userSession` reads of an auth instance: one with better-auth's
+ *  `testUtils` plugin. */
+interface TestUtilsAuth {
+    $context: Promise<object>;
+}
+/** A `cookie` header carrying a new session of user `userId`, signed in
+ *  through `auth`'s `testUtils` login in a `withShellAuth` scope over
+ *  `db`. */
+export declare function userSession(db: string, auth: TestUtilsAuth, userId: string): Promise<string>;
 /** Inserts an `auth.users` row: a fresh verified email, created now,
  *  `fields` adding or overriding columns (the app's `additionalFields`).
  *  Resolves to the new user's id. */

package/dist/testkit/index.js

@@ -1,4 +1,11 @@
-import { Client } from "pg";
+/** Test support: a deployed `auth.*` schema checked against an app's auth
+ *  instance, endpoint conformance (unserved paths, ID-token refusal,
+ *  anonymous sessions), cookies out of auth responses, a rate-limit probe,
+ *  social sign-in starts, session reads held on a lock, `testUtils`
+ *  sessions, `auth.users` rows inserted directly, and a fake OpenID
+ *  Connect provider. */
+import { sql as pooledSql } from "@astralarium/repo-postgres/sql";
+import { holdTransaction } from "@astralarium/repo-postgres/testkit";
 import { z } from "zod";
 import { withShellAuth } from "../index.server.js";
 import { AUTH_BASE_PATH, AUTHORIZE_PATHS, authPaths } from "../request.js";
@@ -134,59 +141,83 @@ export async function socialSignIn(request, {
   return new URL(url);
 }
 /**
- * Runs `fn` while a connection over `db` holds `auth.session` exclusively
- * and `readSession` (a database session read, e.g. `get-session` with a
- * session cookie and `disableCookieCache`) waits on the lock. The lock
- * releases as `fn` settles; rejects when no read reaches it within
- * `timeout`.
+ * Runs `fn` while a transaction over `db` holds `auth.session` exclusively
+ * (`holdTransaction`) and `readSession` (a database session read, e.g.
+ * `get-session` with a session cookie and `disableCookieCache`) waits on
+ * it. The lock releases as `fn` settles; rejects when no read reaches it
+ * within `timeout`.
  */
 export async function withBlockedSessionRead(db, readSession, fn, {
   applicationName,
   timeout = 10_000
 } = {}) {
-  const sql = new Client({
-    connectionString: db
-  });
-  await sql.connect();
+  const client = pooledSql(db);
   try {
-    await sql.query("BEGIN");
-    await sql.query("LOCK TABLE auth.session IN ACCESS EXCLUSIVE MODE");
-    const response = readSession();
-    // Rejections surface through `fn`; a timeout leaves them unobserved.
-    response.catch(() => undefined);
-    const deadline = Date.now() + timeout;
-    for (;;) {
-      // Activity stats are snapshotted per transaction.
-      await sql.query("SELECT pg_stat_clear_snapshot()");
-      // pg_locks and pg_stat_activity.usename are visible across roles.
-      const {
-        rows
-      } = await sql.query(`SELECT a.pid, a.usename, r.rolsuper
-         FROM pg_locks l
-         JOIN pg_stat_activity a ON a.pid = l.pid
-         JOIN pg_roles r ON r.rolname = a.usename
-         WHERE a.datname = current_database()
-           AND ($1::text IS NULL OR a.application_name = $1)
-           AND l.relation = 'auth.session'::regclass AND NOT l.granted
-           AND l.mode = 'AccessShareLock'`, [applicationName ?? null]);
-      const [row] = rows;
-      if (row) {
-        return await fn({
-          pid: row.pid,
-          role: row.usename,
-          superuser: row.rolsuper,
-          response
-        });
-      }
-      if (Date.now() > deadline) {
-        throw new Error(`no session read waited on auth.session in ${timeout} ms`);
+    const held = await holdTransaction(hold => client.begin(async tx => {
+      await tx`LOCK TABLE auth.session IN ACCESS EXCLUSIVE MODE`;
+      await hold(tx);
+    }));
+    try {
+      const response = readSession();
+      // Rejections surface through `fn`; a timeout leaves them unobserved.
+      response.catch(() => undefined);
+      const deadline = Date.now() + timeout;
+      for (;;) {
+        // pg_locks and pg_stat_activity.usename are visible across roles.
+        const [row] = await client`
+          SELECT a.pid, a.usename, r.rolsuper
+          FROM pg_locks l
+          JOIN pg_stat_activity a ON a.pid = l.pid
+          JOIN pg_roles r ON r.rolname = a.usename
+          WHERE l.relation = 'auth.session'::regclass AND NOT l.granted
+            AND l.mode = 'AccessShareLock'
+            AND ${held.holder}::integer = ANY(pg_blocking_pids(l.pid))
+            AND (${applicationName ?? null}::text IS NULL
+              OR a.application_name = ${applicationName ?? null})
+        `;
+        if (row) {
+          return await fn({
+            pid: row.pid,
+            role: row.usename,
+            superuser: row.rolsuper,
+            response
+          });
+        }
+        if (Date.now() > deadline) {
+          throw new Error(`no session read waited on auth.session in ${timeout} ms`);
+        }
+        await new Promise(resolve => setTimeout(resolve, 50));
       }
-      await new Promise(resolve => setTimeout(resolve, 50));
+    } finally {
+      held.release();
+      await held.done;
     }
   } finally {
-    await sql.end();
+    await client.end();
   }
 }
+/** Whether `context` carries `testUtils`' helpers. */
+function hasTestHelpers(context) {
+  return "test" in context;
+}
+/** A `cookie` header carrying a new session of user `userId`, signed in
+ *  through `auth`'s `testUtils` login in a `withShellAuth` scope over
+ *  `db`. */
+export function userSession(db, auth, userId) {
+  return withShellAuth(db, async () => {
+    const context = await auth.$context;
+    if (!hasTestHelpers(context)) throw new Error("userSession: the auth instance lacks testUtils");
+    const {
+      cookies
+    } = await context.test.login({
+      userId
+    });
+    return cookies.map(({
+      name,
+      value
+    }) => `${name}=${value}`).join("; ");
+  });
+}
 /** Inserts an `auth.users` row: a fresh verified email, created now,
  *  `fields` adding or overriding columns (the app's `additionalFields`).
  *  Resolves to the new user's id. */

package/dist/testkit/suites.d.ts

@@ -26,16 +26,55 @@ export interface SessionSource {
     start(): Promise<string>;
     end(): Promise<void>;
 }
-/** A throwaway email user signed up through the app at `origin` (apps
- *  with `devEmailSignIn`), deleted from `db` at `end`. */
-export declare function emailSession(request: AppRequester, { origin, db }: {
-    origin: string;
-    db: string;
-}): SessionSource;
+/** Dev sign-in through the app at `origin` as `accountId`
+ *  (`ShellAuthApp.devSignIn`): its answer. */
+export declare function devSignIn(request: AppRequester, origin: string, accountId: string): Promise<{
+    status: number;
+    headers: {
+        get(name: string): string | null;
+        getSetCookie(): string[];
+    };
+    text(): Promise<string>;
+    body: {
+        cancel(): Promise<void>;
+    } | null;
+}>;
+/** A session `devSignInAs` signed in. */
+export interface DevSignedIn {
+    /** The session's user. */
+    userId: string;
+    /** `cookie` header of the response's cookies. */
+    cookie: string;
+    /** The response's `Set-Cookie` values. */
+    setCookies: string[];
+}
+/** Signs in through the app's dev sign-in at `origin` as `accountId`;
+ *  rejects naming any answer other than 200. */
+export declare function devSignInAs(request: AppRequester, origin: string, accountId: string): Promise<DevSignedIn>;
+/** The session and user ids `cookie` carries, read past the cookie
+ *  cache. */
+export declare function sessionOf(request: AppRequester, cookie: string): Promise<{
+    session: {
+        id: string;
+    };
+    user: {
+        id: string;
+    };
+}>;
+/** A session signed in through the app's dev sign-in at `origin` as a
+ *  fresh `devAccountId()` (apps with `devSignIn`); its new user is deleted
+ *  from `db` at `end`. */
+export declare function devSignInSession(request: AppRequester, { origin, db, devAccountId, }: Pick<DevAuthSuite, "origin" | "db" | "devAccountId">): SessionSource;
 /** What `testDevAuth` runs against. */
 export interface DevAuthSuite {
     /** The signed-in visitor. */
     session: SessionSource;
+    /** The app's origin; dev sign-in posts from it. */
+    origin: string;
+    /** A fresh account id of the app's `devSignIn` provider: unheld by any
+     *  account, its `newUser` email by any user. The suite deletes each user
+     *  dev sign-in answers for one. */
+    devAccountId: () => string;
     /** Connection string of the app's database. */
     db: string;
     /** Postgres role the app queries as. */
@@ -55,11 +94,12 @@ export interface DevAuthSuite {
 }
 /**
  * Tests of `request`'s dev app serving auth over its Postgres: the database
- * role, public pages independent of the viewer, provider callbacks on
- * each local origin, and the rate limit, last: it exhausts the client's
- * budget for the window.
+ * role, public pages independent of the viewer, dev sign-in, provider
+ * callbacks on each local origin, and the rate limit, last: it exhausts
+ * the client's budget for the window. Users dev sign-in creates are
+ * deleted from `db` after.
  */
-export declare function testDevAuth(request: AppRequester, { session, db, role, publicPages, provider, localOrigins, rateLimit, }: DevAuthSuite): void;
+export declare function testDevAuth(request: AppRequester, { session, origin, devAccountId, db, role, publicPages, provider, localOrigins, rateLimit, }: DevAuthSuite): void;
 /** What `testProductionAuth` runs against. */
 export interface ProductionAuthSuite<Fields extends AdditionalFields, Projected extends SessionLike> {
     /** The app's public origin. */
@@ -78,8 +118,8 @@ export interface ProductionAuthSuite<Fields extends AdditionalFields, Projected
 }
 /**
  * Tests of `request`'s production app serving auth, against `app` built for
- * production (`devEmailSignIn` off): its schema, 404s outside the served
- * endpoints, ID-token refusal, the anonymous session, a failed provider
+ * production (`devSignIn` off): its schema, 404s outside the served
+ * endpoints and at dev sign-in, ID-token refusal, the anonymous session, a failed provider
  * callback landing on the error page, and each provider's sign-in with its
  * runtime client and callback.
  */