@clubedge/create-clubedge-app 0.46.0 → 0.46.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to `create-clubedge-app` are documented here.
 
+## 0.46.1
+
+- **Starter v0.30.1** by default (#167). Its template schema is still 6. The [Starter's release notes](https://github.com/Clubedge/clubedge-starter/releases/tag/v0.30.1) cover:
+  - the native app (`--mobile expo`) reaching its API again: since v0.29.0, each of its calls to the API threw after the API had answered, so the account never loaded, and saving a name or deleting the account failed;
+  - getting the fix to installed apps: a new build in the stores, then `APP_MINIMUM_VERSION` on the API, which sends older installs to the update screen, or an over-the-air update with `--ota eas`;
+  - end-to-end tests of both mobile apps on an Android emulator;
+  - Expo SDK 58's latest patch versions.
+
 ## 0.46.0
 
 - **Add and remove the apps installed on devices** (#161), so a project created without them can take them later, and drop them again, without starting over: `pnpm clubedge add mobile expo` for the native app, `pnpm clubedge add shell capacitor` for the shell that packages the website, and `pnpm clubedge remove mobile` or `pnpm clubedge remove shell`. The shell needs Starter v0.27.0 or later, and the native app v0.28.0.

package/README.md

@@ -243,7 +243,7 @@ pnpm dlx @clubedge/create-clubedge-app my-app --yes --no-git --framework tanstac
 pnpm dlx @clubedge/create-clubedge-app my-app --ref main
 
 # Reproduce a specific Starter release or commit
-pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.30.0
+pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.30.1
 pnpm dlx @clubedge/create-clubedge-app my-app --ref <commit-sha>
 
 # Test local Starter changes before releasing them
@@ -264,7 +264,7 @@ pnpm clubedge add mobile expo                               # the native app; ad
 pnpm clubedge remove mobile
 pnpm dlx @clubedge/create-clubedge-app add infra local --dry-run
 pnpm dlx @clubedge/create-clubedge-app@latest upgrade        # to the newest CLI's Starter release
-pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.30.0 # or a specific tag, branch, or commit
+pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.30.1 # or a specific tag, branch, or commit
 ```
 
 The CLI renders the project twice, from the Starter commit and modules recorded in your `package.json` and from the new state, and merges the difference into your project. The new state has other modules for `add` and `remove`, and the newer Starter with the same modules for `upgrade`. Modules a newer Starter introduces start as `none` where possible, so an upgrade never adds a service on its own.
@@ -413,27 +413,27 @@ Projects created with `--infra neon` also have `.github/workflows/preview.yml`,
 Each CLI release is tested against one specific Starter release:
 
 ```text
-create-clubedge-app v0.46.0
+create-clubedge-app v0.46.1
         |
         v
-Clubedge Starter v0.30.0
-commit 4d341955bd13cb170c7385acb745c3d374259897
+Clubedge Starter v0.30.1
+commit 6d04531ffb2cd9f0e76b6e2b3b542f733b66aed6
 ```
 
 The current relationship is:
 
 | CLI release | Default Starter release | Meaning |
 | --- | --- | --- |
-| `create-clubedge-app@0.46.0` | `clubedge-starter@v0.30.0` | The CLI's required, tested default |
+| `create-clubedge-app@0.46.1` | `clubedge-starter@v0.30.1` | The CLI's required, tested default |
 
 This means the same CLI version always scaffolds the same Starter revision by default. The CLI does not silently follow Starter `main`.
 
-The `v0.30.0` tag is expected to resolve to commit
-`4d341955bd13cb170c7385acb745c3d374259897`. The CLI verifies this before
+The `v0.30.1` tag is expected to resolve to commit
+`6d04531ffb2cd9f0e76b6e2b3b542f733b66aed6`. The CLI verifies this before
 scaffolding with the default reference and fails rather than silently using a
 moved tag.
 
-When the Starter changes, its maintainers first publish a new versioned release, such as `v0.30.0`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
+When the Starter changes, its maintainers first publish a new versioned release, such as `v0.30.1`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
 
 Every generated project records its CLI version, Starter repository, Starter ref, Starter commit, framework, and modules in `package.json` and `README.md`.
 
@@ -488,7 +488,7 @@ CI packs the CLI with `npm pack`, scaffolds clean projects from the packed tarba
 1. Make and validate changes in `clubedge-starter`.
 2. Run lint, typecheck, unit tests, browser tests, and production build.
 3. Update the Starter package versions.
-4. Commit `main`, create a release tag such as `v0.30.0`, and publish the Starter release.
+4. Commit `main`, create a release tag such as `v0.30.1`, and publish the Starter release.
 
 ### CLI maintainers
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/create-clubedge-app",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "description": "Create React apps from Clubedge Starter with a CLI or local MCP server.",
   "type": "module",
   "packageManager": "pnpm@10.9.0",
@@ -24,8 +24,8 @@
   },
   "clubedge": {
     "starterRepository": "Clubedge/clubedge-starter",
-    "starterRef": "v0.30.0",
-    "starterCommit": "4d341955bd13cb170c7385acb745c3d374259897"
+    "starterRef": "v0.30.1",
+    "starterCommit": "6d04531ffb2cd9f0e76b6e2b3b542f733b66aed6"
   },
   "license": "Apache-2.0",
   "repository": {

package/template/apps/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/api",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/apps/api-fastapi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/api-fastapi",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/apps/api-fastapi/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "clubedge-api"
-version = "0.30.0"
+version = "0.30.1"
 description = "The project's API, implementing packages/contract/openapi.yaml."
 requires-python = ">=3.12"
 dependencies = [

package/template/apps/api-fastapi/uv.lock

@@ -389,7 +389,7 @@ wheels = [
 
 [[package]]
 name = "clubedge-api"
-version = "0.30.0"
+version = "0.30.1"
 source = { editable = "." }
 default-groups = "all"
 dependencies = [

package/template/apps/capacitor/capacitor.config.ts

@@ -6,6 +6,11 @@ import site from "../web/src/config/site.json" with { type: "json" };
 // reverse-domain id you own, such as com.yourcompany.app, before the first Android or iOS build.
 const appId = `com.example.${site.serviceId.replace(/[^a-z0-9]/gi, "").replace(/^[0-9]+/, "") || "app"}`;
 
+// A website on this computer, as in the end-to-end tests (e2e/README.md), may be plain HTTP
+// (scripts/build.mjs): Android then lets the app's https pages call it. A store build's website is
+// https, and keeps Android's refusal.
+const plainHttp = (process.env.WEB_URL ?? "").startsWith("http://");
+
 const config: CapacitorConfig = {
   appId,
   appName: site.name,
@@ -15,7 +20,9 @@ const config: CapacitorConfig = {
     // The app's pages load from https://localhost on Android and capacitor://localhost on iOS:
     // the origins the website's server takes the app's requests from (MOBILE_ORIGINS).
     androidScheme: "https",
+    ...(plainHttp ? { cleartext: true } : {}),
   },
+  ...(plainHttp ? { android: { allowMixedContent: true } } : {}),
   // How pnpm release signs the iOS build (scripts/release.mjs), from the environment, never from
   // this file: Xcode's automatic signing, or, with a provisioning profile named, manual signing as
   // in CI. The script signs Android's App Bundle itself.

package/template/apps/capacitor/e2e/README.md

@@ -0,0 +1,23 @@
+# End-to-end tests
+
+[Maestro](https://docs.maestro.dev) goes through the app as a user would, against the website and its API: `account.yaml` creates an account, checks the account the API returns, sets a display name, signs out and in, and deletes the account. A step fails when the app can't do what a user would, such as when it signs up but can't load the account.
+
+To run it on an Android emulator:
+
+1. Start the website and the API with their database (`pnpm dev`, or `pnpm start` after `pnpm build`), with sign-in that needs no confirmed email.
+2. Build the app against the website. The emulator reaches your computer at `10.0.2.2`; the iOS simulator at `localhost`. A plain-HTTP `WEB_URL` is allowed only for those addresses (`scripts/build.mjs`):
+
+   ```sh
+   cd apps/shell
+   WEB_URL=http://10.0.2.2:3000 pnpm run sync android
+   (cd android && ./gradlew assembleDebug)
+   adb install -r android/app/build/outputs/apk/debug/app-debug.apk
+   ```
+
+3. Run the flow with the app's id, from `capacitor.config.ts` or `android/app/build.gradle`'s `applicationId`:
+
+   ```sh
+   maestro test -e APP_ID=com.example.yourapp e2e
+   ```
+
+Each run signs up with a new address, `e2e-<time>@example.com`, so a run that stops before deleting its account doesn't block the next one. `-e PASSWORD=...` changes its password.

package/template/apps/capacitor/e2e/account.yaml

@@ -0,0 +1,116 @@
+# The account from start to end, in the app's build of the website, against the website and its
+# API: creating it, the account the API returns, a new display name, signing out and in, and
+# deleting it. Each step fails when the app can't do what a user would. e2e/README.md says how
+# to run it. The website's fields are found by their id.
+appId: ${APP_ID}
+name: Account
+env:
+  PASSWORD: e2e-password-1234
+  NAME: Robin Tester
+---
+# A new address for each run, so a run that stops before deleting its account doesn't block the
+# next one.
+- evalScript: ${output.email = 'e2e-' + Date.now() + '@example.com'}
+- launchApp:
+    clearState: true
+# The app opens on the website's start page; the dashboard asks a signed-out user to sign in.
+- extendedWaitUntil:
+    visible: Explore the dashboard.*
+    timeout: 60000
+- tapOn: Explore the dashboard.*
+- extendedWaitUntil:
+    visible: Create one
+    timeout: 30000
+- tapOn: Create one
+- extendedWaitUntil:
+    visible: Create your account
+    timeout: 15000
+- tapOn:
+    id: email
+- inputText: ${output.email}
+- tapOn:
+    id: password
+- inputText: ${PASSWORD}
+- hideKeyboard
+- tapOn: Create account
+
+# Signed in: the dashboard, and Settings with the account the API returns.
+- extendedWaitUntil:
+    visible: A better place to start building.
+    timeout: 30000
+- takeScreenshot: 1-dashboard
+# On a phone, the account's links are in the dashboard's menu.
+- tapOn: Open navigation
+- tapOn: Settings
+- extendedWaitUntil:
+    visible: Signed in as ${output.email}.
+    timeout: 30000
+- takeScreenshot: 2-settings
+
+# A display name, which the API keeps.
+- tapOn:
+    id: displayName
+- inputText: ${NAME}
+- hideKeyboard
+- tapOn: Save profile
+- extendedWaitUntil:
+    visible: Your profile was saved.
+    timeout: 15000
+
+# Signing out, then in again: the session and the name come back.
+- tapOn: Dashboard
+- extendedWaitUntil:
+    visible: Open navigation
+    timeout: 15000
+- tapOn: Open navigation
+- tapOn: Sign out
+- extendedWaitUntil:
+    visible: Forgot password\?
+    timeout: 15000
+- tapOn:
+    id: email
+- inputText: ${output.email}
+- tapOn:
+    id: password
+- inputText: ${PASSWORD}
+- hideKeyboard
+# The button, under the page's title of the same name.
+- tapOn:
+    text: Sign in
+    index: 1
+- extendedWaitUntil:
+    visible: A better place to start building.
+    timeout: 30000
+- tapOn: Open navigation
+- tapOn: Settings
+- extendedWaitUntil:
+    visible: Signed in as ${output.email}.
+    timeout: 30000
+- assertVisible: ${NAME}
+- takeScreenshot: 3-signed-in-again
+
+# Deleting the account signs out, and its password no longer signs in.
+- scrollUntilVisible:
+    element: Delete my account
+- tapOn:
+    id: password
+- inputText: ${PASSWORD}
+- hideKeyboard
+- tapOn: Delete my account
+- extendedWaitUntil:
+    visible: Your account was deleted.
+    timeout: 30000
+- takeScreenshot: 4-deleted
+- tapOn:
+    id: email
+- inputText: ${output.email}
+- tapOn:
+    id: password
+- inputText: ${PASSWORD}
+- hideKeyboard
+- tapOn:
+    text: Sign in
+    index: 1
+- extendedWaitUntil:
+    visible: Email or password could not be verified.
+    timeout: 30000

package/template/apps/capacitor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/capacitor",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/apps/capacitor/scripts/build.mjs

@@ -21,7 +21,8 @@ const platforms = ["android", "ios"];
 
 /**
  * The website's origin, from WEB_URL. It must be https: the app sends its session there, and
- * emailed links open it.
+ * emailed links open it. Only a website on this computer may be plain HTTP, as in the end-to-end
+ * tests: the Android emulator reaches it at 10.0.2.2, and the iOS simulator at localhost.
  */
 export function webOrigin(value) {
   const example = "such as https://app.example.com";
@@ -34,7 +35,8 @@ export function webOrigin(value) {
   } catch {
     throw new Error(`WEB_URL must be the website's address, ${example}, not "${value}".`);
   }
-  if (url.protocol !== "https:") {
+  const local = ["10.0.2.2", "localhost", "127.0.0.1"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
     throw new Error("WEB_URL must be an https:// address: the app sends its session there.");
   }
   if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {

package/template/apps/expo/app.config.ts

@@ -1,4 +1,5 @@
 import type { ConfigContext, ExpoConfig } from "expo/config";
+import { type ConfigPlugin, withAndroidManifest } from "expo/config-plugins";
 import site from "./src/config/site.json";
 
 // The app's id on Android and iOS, made from the project's name until you set your own. It
@@ -33,6 +34,18 @@ export function buildNumber(version: string): number {
   return major * 1_000_000 + minor * 1_000 + patch;
 }
 
+// A build that calls its API over plain HTTP, such as the API on this computer in the end-to-end
+// tests (e2e/README.md), may: Android and iOS refuse plain HTTP otherwise. A store build calls an
+// https address, and keeps that refusal.
+const plainHttp = (process.env.EXPO_PUBLIC_API_URL ?? "").startsWith("http://");
+
+const allowPlainHttpOnAndroid: ConfigPlugin = (config) =>
+  withAndroidManifest(config, (android) => {
+    const application = android.modResults.manifest.application?.[0];
+    if (application) application.$["android:usesCleartextTraffic"] = "true";
+    return android;
+  });
+
 // Firebase's Android settings, which FCM needs to deliver notifications: the path to // clubedge:only push!=none
 // google-services.json, from .env.local or an EAS file variable of the same name. // clubedge:only push!=none
 const googleServicesFile = process.env.GOOGLE_SERVICES_JSON || undefined; // clubedge:only push!=none
@@ -44,7 +57,7 @@ export default ({ config }: ConfigContext): ExpoConfig => {
   // APP_LATEST_VERSION: raise it with each release.
   const version = config.version ?? "1.0.0";
   const projectId: unknown = config.extra?.eas?.projectId; // clubedge:only ota=eas
-  return {
+  const app: ExpoConfig = {
     ...config,
     name: site.name,
     slug: site.serviceId,
@@ -58,6 +71,9 @@ export default ({ config }: ConfigContext): ExpoConfig => {
       bundleIdentifier: appId,
       buildNumber: String(buildNumber(version)),
       supportsTablet: true,
+      ...(plainHttp
+        ? { infoPlist: { NSAppTransportSecurity: { NSAllowsArbitraryLoads: true } } }
+        : {}),
     },
     android: {
       package: appId,
@@ -91,4 +107,5 @@ export default ({ config }: ConfigContext): ExpoConfig => {
       ],
     ],
   };
+  return plainHttp ? allowPlainHttpOnAndroid(app) : app;
 };

package/template/apps/expo/e2e/README.md

@@ -0,0 +1,26 @@
+# End-to-end tests
+
+[Maestro](https://docs.maestro.dev) goes through the app as a user would, on a release build that calls a real API: `account.yaml` creates an account, checks the account the API returns, sets a display name, signs out and in, and deletes the account. A step fails when the app can't do what a user would, such as when it signs in but can't load the account.
+
+To run it on an Android emulator:
+
+1. Start the API with its database (`pnpm dev`, or `pnpm start` after `pnpm build`), with sign-in that needs no confirmed email.
+2. Build the app against it. The emulator reaches your computer at `10.0.2.2`; the iOS simulator at `localhost`. A plain-HTTP address is allowed only in such a build (`app.config.ts`). Keep `EXPO_PUBLIC_API_URL` set for both commands: the release build bundles the app's JavaScript with it.
+
+   ```sh
+   cd apps/mobile
+   export EXPO_PUBLIC_API_URL=http://10.0.2.2:3001
+   pnpm exec expo prebuild --platform android
+   (cd android && ./gradlew assembleRelease)
+   adb install -r android/app/build/outputs/apk/release/app-release.apk
+   ```
+
+   With a website, use its address, port 3000, which forwards the API's routes.
+
+3. Run the flow with the app's id, from `android/app/build.gradle`'s `applicationId`:
+
+   ```sh
+   maestro test -e APP_ID=com.example.yourapp e2e
+   ```
+
+Each run signs up with a new address, `e2e-<time>@example.com`, so a run that stops before deleting its account doesn't block the next one. `-e PASSWORD=...` changes its password.

package/template/apps/expo/e2e/account.yaml

@@ -0,0 +1,111 @@
+# The account from start to end, on a build of the app that calls a real API: creating it, the
+# account the API returns, a new display name, signing out and in, and deleting it. Each step
+# fails when the app can't do what a user would. e2e/README.md says how to run it.
+appId: ${APP_ID}
+name: Account
+env:
+  PASSWORD: e2e-password-1234
+  NAME: Robin Tester
+---
+# A new address for each run, so a run that stops before deleting its account doesn't block the
+# next one.
+- evalScript: ${output.email = 'e2e-' + Date.now() + '@example.com'}
+- launchApp:
+    clearState: true
+# Signed out, the app opens on its welcome screen.
+- extendedWaitUntil:
+    visible: Create account
+    timeout: 60000
+- tapOn: Create account
+- tapOn: Email
+- inputText: ${output.email}
+- tapOn: Password
+- inputText: ${PASSWORD}
+- hideKeyboard
+- tapOn: Create account
+
+# Signed in, Home greets the user the API found for the session.
+- extendedWaitUntil:
+    visible: Hey e2e-.*
+    timeout: 30000
+- assertNotVisible: The API did not find your session.*
+- takeScreenshot: 1-home
+
+# Settings shows the account the API returns.
+- tapOn: Settings
+- extendedWaitUntil:
+    visible: ${output.email}
+    timeout: 15000
+- takeScreenshot: 2-settings
+
+# A display name, which the API keeps.
+- tapOn: Edit
+- extendedWaitUntil:
+    visible: ${output.email}
+    timeout: 15000
+- tapOn: Display name
+- eraseText: 40
+- inputText: ${NAME}
+- hideKeyboard
+- tapOn: Save
+- extendedWaitUntil:
+    visible: Saved.
+    timeout: 15000
+- tapOn: Back
+- extendedWaitUntil:
+    visible: ${NAME}
+    timeout: 15000
+- tapOn: Home
+- extendedWaitUntil:
+    visible: Hey Robin
+    timeout: 15000
+- takeScreenshot: 3-name
+
+# Signing out, then in again: the session and the name come back.
+- tapOn: Settings
+- tapOn: Sign out
+- tapOn: Sign out of ${NAME}
+- extendedWaitUntil:
+    visible: Continue with email
+    timeout: 15000
+- tapOn: Continue with email
+- tapOn: Email
+- inputText: ${output.email}
+- tapOn: Password
+- inputText: ${PASSWORD}
+- hideKeyboard
+- tapOn: Sign in
+- extendedWaitUntil:
+    visible: Hey Robin
+    timeout: 30000
+- takeScreenshot: 4-signed-in-again
+
+# Deleting the account signs out, and its password no longer signs in.
+- tapOn: Settings
+- tapOn: Delete account
+- tapOn: Password
+- inputText: ${PASSWORD}
+- hideKeyboard
+# The button, under the screen's title of the same name.
+- tapOn:
+    text: Delete account
+    index: 1
+- extendedWaitUntil:
+    visible: Delete your account\?
+    timeout: 10000
+# Android may show the dialog's buttons in capitals.
+- tapOn: (?i)delete
+- extendedWaitUntil:
+    visible: Continue with email
+    timeout: 30000
+- takeScreenshot: 5-deleted
+- tapOn: Continue with email
+- tapOn: Email
+- inputText: ${output.email}
+- tapOn: Password
+- inputText: ${PASSWORD}
+- hideKeyboard
+- tapOn: Sign in
+- extendedWaitUntil:
+    visible: .*[Ii]nvalid email or password.*
+    timeout: 30000

package/template/apps/expo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/expo",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "license": "Apache-2.0",
   "main": "expo-router/entry",
@@ -20,22 +20,22 @@
     "@clubedge/contract": "workspace:*",
     "@expo-google-fonts/inter": "^0.4.2",
     "better-auth": "^1.7.13",
-    "expo": "~58.0.19",
+    "expo": "~58.0.20",
     "expo-application": "~58.1.2",
     "expo-blur": "~58.0.5",
     "expo-constants": "~58.0.13",
-    "expo-dev-client": "~58.0.15",
+    "expo-dev-client": "~58.0.16",
     "expo-font": "~58.0.10",
     "expo-linking": "~58.0.14",
     "expo-network": "~58.0.4",
     "expo-notifications": "~58.1.6",
-    "expo-router": "~58.0.26",
+    "expo-router": "~58.0.27",
     "expo-secure-store": "~58.0.2",
     "expo-splash-screen": "~58.0.11",
     "expo-sqlite": "~58.0.14",
     "expo-status-bar": "~58.0.4",
     "expo-updates": "~58.0.18",
-    "expo-web-browser": "~58.0.6",
+    "expo-web-browser": "~58.0.7",
     "phosphor-react-native": "^3.0.6",
     "react": "19.3.0",
     "react-native": "0.88.0",

package/template/apps/expo/src/lib/api.ts

@@ -1,6 +1,7 @@
 import { createApiClient } from "@clubedge/contract";
 import { apiUrl } from "@/lib/config";
+import { send } from "@/lib/send";
 
 // The API, through the website: its server forwards /api to the API service. // clubedge:only framework!=none
 // The API, which the app calls at its own address. // clubedge:only framework=none
-export const api = createApiClient({ baseUrl: apiUrl });
+export const api = createApiClient({ baseUrl: apiUrl, fetch: (input, init) => send(input, init) });

package/template/apps/expo/src/lib/send.ts

@@ -0,0 +1,27 @@
+/**
+ * Sends one of the API client's requests to React Native's fetch as an address and its options,
+ * the way Better Auth's client sends its own. `extraHeaders`, such as the session's, are added to
+ * the request's own; the app sends no cookies of its own.
+ */
+export async function send(
+  input: RequestInfo | URL,
+  init?: RequestInit,
+  extraHeaders: Record<string, string> = {},
+): Promise<Response> {
+  // The API client (openapi-fetch) always hands over a Request.
+  const request = input as Request;
+  const headers: Record<string, string> = {};
+  request.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  Object.assign(headers, extraHeaders);
+  const body =
+    request.method === "GET" || request.method === "HEAD" ? undefined : await request.text();
+  return fetch(request.url, {
+    ...init,
+    method: request.method,
+    headers,
+    body,
+    credentials: "omit",
+  });
+}

package/template/apps/expo/src/variants/api.auth.ts

@@ -1,18 +1,13 @@
 import { createApiClient } from "@clubedge/contract";
 import { authClient } from "@/lib/auth";
 import { apiUrl } from "@/lib/config";
+import { send } from "@/lib/send";
 
 // The API, through the website: its server forwards /api to the API service, with the session. // clubedge:only framework!=none
 // The API, which the app calls at its own address, with the session. // clubedge:only framework=none
-export const api = createApiClient({ baseUrl: apiUrl });
-
-api.use({
-  async onRequest({ request }) {
-    // The auth client says how the session travels: a bearer token, or the session cookie it
-    // keeps on the device. The app sends no cookies of its own.
-    for (const [name, value] of Object.entries(await authClient.sessionHeaders())) {
-      request.headers.set(name, value);
-    }
-    return new Request(request, { credentials: "omit" });
-  },
+// The auth client says how the session travels: a bearer token, or the session cookie it keeps
+// on the device.
+export const api = createApiClient({
+  baseUrl: apiUrl,
+  fetch: async (input, init) => send(input, init, await authClient.sessionHeaders()),
 });

package/template/apps/start/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/start",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
@@ -41,8 +41,8 @@
     "@tanstack/react-router": "1.170.42",
     "@tanstack/react-start": "1.168.61",
     "lucide-react": "^0.468.0",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "use-sync-external-store": "^1.7.0",
     "zod": "^4.6.7"
   },

package/template/apps/vite/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/vite",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
@@ -29,8 +29,8 @@
     "drizzle-orm": "^0.45.4",
     "firebase": "^12.15.0",
     "lucide-react": "^0.468.0",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0"
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1"
   },
   "devDependencies": {
     "@tailwindcss/vite": "^4.3.3",