@lunora/react-native 1.0.0-alpha.90 → 1.0.0-alpha.91

package/README.md

@@ -13,8 +13,8 @@
 The same live hooks you use on the web — `useQuery`, `useMutation`,
 `useSubscription`, `useAuth`, `usePresence`, … — running on your phone, plus the
 two seams a native app needs that a browser gives you for free: a durable offline
-queue backed by `AsyncStorage`, and credentialed requests (there is no cookie jar
-in React Native, so the session has to be attached explicitly).
+queue backed by `AsyncStorage`, and credentialed requests (the session is a
+bearer, attached explicitly).
 
 This package **re-exports the whole `@lunora/react` surface** (see
 [below](#re-exported-lunorareact-surface)), so you import your hooks and
@@ -90,10 +90,9 @@ other clients write, and `send` is optimistic and offline-safe.
 
 ## Authentication (better-auth + Expo)
 
-React Native has no cookie jar, so the session is sent as a **bearer** token: the
-HTTP RPC carries it in the `Authorization` header and the live socket carries it
-in the `?token=` query param. A bearer avoids the `Cookie` header the runtime's
-CSRF guard rejects on an `Origin`-less native request (see [Why a bearer token](#why-a-bearer-token)).
+The session is sent as a **bearer** token: the HTTP RPC carries it in the
+`Authorization` header and the live socket carries it in the `?token=` query
+param (see [Why a bearer token](#why-a-bearer-token)).
 
 ```tsx
 // auth.ts
@@ -182,11 +181,22 @@ import { expo } from "@better-auth/expo";
 
 Lunora's runtime enables a CSRF Origin-check by default — it rejects any
 state-changing HTTP request or WebSocket upgrade that carries a `Cookie` but no
-trusted `Origin`. React Native sends no `Origin`, so a cookie-based credential
-would be **rejected** once signed in. A bearer token carries no `Cookie`, so it's
-exempt — and it works identically on `react-native-web` (the browser lets you set
+trusted `Origin`. React Native sends no `Origin`, so a cookie-based credential is
+**rejected** once signed in. A bearer token is the credential instead, and it
+works identically on `react-native-web` (the browser lets you set
 `Authorization`, and the token rides `?token=` on the socket).
 
+Using a bearer does **not** by itself guarantee the absence of a `Cookie` header.
+React Native has a real cookie jar — `fetch` is backed by the platform HTTP stack
+(`NSURLSession` / `OkHttp`) and its shared cookie store — so the `Set-Cookie` a
+better-auth sign-in returns is kept and re-attached to later requests, and the
+guard then 403s every state-changing RPC with `FORBIDDEN_ORIGIN`. It is
+intermittent (it depends on whether the jar holds the cookie that launch), and
+`security.csrf.trustedOrigins` cannot fix it: the trust list is only consulted
+for an `Origin` that was actually received, and a missing one is rejected
+outright. `createLunoraClient` closes this by sending `credentials: "omit"` on
+every request; if you pass your own `fetch`, wrap it in `withoutAmbientCookies`.
+
 ### TanStack Query focus / online managers
 
 React Native doesn't fire the browser's `focus` / `online` events, so Query

package/dist/index.d.mts

@@ -3,15 +3,15 @@ export * from '@lunora/react';
 /**
  * A `() => headers` factory the React Native client threads onto every HTTP RPC
  * request *and* the WebSocket upgrade — a generic escape hatch for attaching a
- * **custom** credential header (an API-gateway key, a proxy token, …) that
- * React Native's missing cookie jar can't carry implicitly. Return `undefined`
- * (or an empty object) when there's nothing to attach.
+ * **custom** credential header (an API-gateway key, a proxy token, …). Return
+ * `undefined` (or an empty object) when there's nothing to attach.
  *
  * For better-auth Expo sessions, prefer a **bearer** token instead: read it with
  * `@lunora/react-native/auth`'s `expoBearerToken` and feed it to
- * `client.setAuthToken` / `setWsToken` (see the package README). A bearer avoids
- * the `Cookie` header the runtime's CSRF guard rejects on `Origin`-less native
- * requests.
+ * `client.setAuthToken` / `setWsToken` (see the package README). Either way the
+ * client sends `credentials: "omit"`, so the platform cookie jar never attaches a
+ * session cookie the runtime's CSRF guard would reject on an `Origin`-less native
+ * request.
  * @experimental
  */
 type AuthHeadersFactory = () => Record<string, string> | undefined;
@@ -59,6 +59,51 @@ interface CreateLunoraClientOptions extends LunoraClientOptions {
    */
   storage?: AsyncStorageLike;
 }
+/**
+ * Wrap a `fetch` so no request carries the platform's ambient cookie credential.
+ *
+ * React Native **does** have a cookie jar — its `fetch` is backed by the
+ * platform HTTP stack (`NSURLSession` / `OkHttp`), which owns a shared,
+ * persistent cookie store — so a `Set-Cookie` from a better-auth sign-in is kept
+ * and re-attached to later requests automatically. The package's own docs used
+ * to assert the opposite, and the bearer design leaned on it: "there is no jar,
+ * therefore no `Cookie` header, therefore the runtime's CSRF guard never sees
+ * one".
+ *
+ * It does see one. The guard rejects an unsafe, cookie-bearing request whose
+ * `Origin` is missing or untrusted, and a native request sends no `Origin` — so
+ * every state-changing RPC 403s with `FORBIDDEN_ORIGIN` for as long as the jar
+ * holds that cookie. `security.csrf.trustedOrigins` cannot fix it: the trust list
+ * is only consulted for an `Origin` that was actually received, and a missing one
+ * is rejected outright. It is also intermittent — it depends on whether the jar
+ * happens to hold the session cookie that launch — which is what let it hide.
+ *
+ * `credentials: "omit"` is the fix, and it costs nothing on native: the session
+ * is a bearer there (`setAuthToken` / `setWsToken`), so the cookie was never the
+ * credential — only an accident of transport riding along. Wrapped INNERMOST by
+ * {@link createLunoraClient}, so it runs after every other layer and also
+ * overrides the `credentials: "include"` `@lunora/client` sends on its
+ * `get-session` probe.
+ *
+ * **Scope.** This covers `fetch`, which is the whole HTTP RPC/REST/storage
+ * surface. It does NOT cover the WebSocket upgrade — React Native attaches the
+ * same jar's cookie to the handshake and exposes no per-socket opt-out — nor
+ * `httpStream` imported standalone from `@lunora/client`, which resolves
+ * `globalThis.fetch` itself. Neither is a live 403 today: React Native sends an
+ * `Origin` equal to the server's on a WS handshake, and better-auth's `bearer`
+ * plugin overwrites the session cookie with the bearer rather than deferring to
+ * it. Both are noted so the guarantee is not read wider than it is.
+ *
+ * {@link createLunoraClient} applies it only on native — see
+ * {@link isNativeRuntime} — and only to the global `fetch`. Under
+ * `react-native-web` the jar is the browser's, `Origin` IS sent, the CSRF guard
+ * never fires, and a cookie session is a legitimate setup that this would
+ * silently sign out (`getCurrentUser` deliberately sends `credentials:
+ * "include"`). A caller-supplied `fetch` is never wrapped either, so a
+ * cookie-forwarding SSR transport keeps its credentials; apply this yourself if
+ * you want it.
+ */
+declare const withoutAmbientCookies: (fetchImpl: typeof fetch) => typeof fetch;
 /**
  * Construct a `LunoraClient` tuned for React Native / Expo — a thin wrapper over
  * `new LunoraClient(options)` that fills in the three things a browser gets for
@@ -75,17 +120,21 @@ interface CreateLunoraClientOptions extends LunoraClientOptions {
  * after a restart while the socket reconnects — mirroring the browser's
  * IndexedDB-backed default.
  *
- * Third, credentialed requests: pass `getAuthHeaders` and the returned headers
- * ride both the HTTP RPC path and the WebSocket upgrade, since React Native has
- * no cookie jar to attach a session implicitly.
+ * Third, credentialed requests: the session is a bearer on this platform, so the
+ * returned `fetch` is wrapped in {@link withoutAmbientCookies} (React Native's
+ * cookie jar is real, and a stray session cookie 403s every state-changing RPC —
+ * see there), and passing `getAuthHeaders` additionally rides its headers on both
+ * the HTTP RPC path and the WebSocket upgrade.
  *
  * Everything on `LunoraClientOptions` is still accepted and passed through; an
- * explicit `persistence`, `queryCache`, `fetch`, or `WebSocket` takes precedence
- * over the convenience derived from `storage` / `getAuthHeaders`. `persistence`
+ * explicit `persistence`, `queryCache`, `fetch`, or `WebSocket` replaces the
+ * transport derived from `storage`. A `getAuthHeaders` factory is layered over a
+ * caller-supplied `fetch` rather than ignored — the previous behaviour dropped
+ * the credential on HTTP while still injecting it on the WS upgrade. `persistence`
  * and `queryCache` override independently — `storage` backs both, so opting out
  * of one leaves the other wired. See the package README
  * for a full setup example.
  * @experimental
  */
 declare const createLunoraClient: (options: CreateLunoraClientOptions) => LunoraClient;
-export { type AuthHeadersFactory, type CreateLunoraClientOptions, createLunoraClient };
+export { type AuthHeadersFactory, type CreateLunoraClientOptions, createLunoraClient, withoutAmbientCookies };

package/dist/index.d.ts

@@ -3,15 +3,15 @@ export * from '@lunora/react';
 /**
  * A `() => headers` factory the React Native client threads onto every HTTP RPC
  * request *and* the WebSocket upgrade — a generic escape hatch for attaching a
- * **custom** credential header (an API-gateway key, a proxy token, …) that
- * React Native's missing cookie jar can't carry implicitly. Return `undefined`
- * (or an empty object) when there's nothing to attach.
+ * **custom** credential header (an API-gateway key, a proxy token, …). Return
+ * `undefined` (or an empty object) when there's nothing to attach.
  *
  * For better-auth Expo sessions, prefer a **bearer** token instead: read it with
  * `@lunora/react-native/auth`'s `expoBearerToken` and feed it to
- * `client.setAuthToken` / `setWsToken` (see the package README). A bearer avoids
- * the `Cookie` header the runtime's CSRF guard rejects on `Origin`-less native
- * requests.
+ * `client.setAuthToken` / `setWsToken` (see the package README). Either way the
+ * client sends `credentials: "omit"`, so the platform cookie jar never attaches a
+ * session cookie the runtime's CSRF guard would reject on an `Origin`-less native
+ * request.
  * @experimental
  */
 type AuthHeadersFactory = () => Record<string, string> | undefined;
@@ -59,6 +59,51 @@ interface CreateLunoraClientOptions extends LunoraClientOptions {
    */
   storage?: AsyncStorageLike;
 }
+/**
+ * Wrap a `fetch` so no request carries the platform's ambient cookie credential.
+ *
+ * React Native **does** have a cookie jar — its `fetch` is backed by the
+ * platform HTTP stack (`NSURLSession` / `OkHttp`), which owns a shared,
+ * persistent cookie store — so a `Set-Cookie` from a better-auth sign-in is kept
+ * and re-attached to later requests automatically. The package's own docs used
+ * to assert the opposite, and the bearer design leaned on it: "there is no jar,
+ * therefore no `Cookie` header, therefore the runtime's CSRF guard never sees
+ * one".
+ *
+ * It does see one. The guard rejects an unsafe, cookie-bearing request whose
+ * `Origin` is missing or untrusted, and a native request sends no `Origin` — so
+ * every state-changing RPC 403s with `FORBIDDEN_ORIGIN` for as long as the jar
+ * holds that cookie. `security.csrf.trustedOrigins` cannot fix it: the trust list
+ * is only consulted for an `Origin` that was actually received, and a missing one
+ * is rejected outright. It is also intermittent — it depends on whether the jar
+ * happens to hold the session cookie that launch — which is what let it hide.
+ *
+ * `credentials: "omit"` is the fix, and it costs nothing on native: the session
+ * is a bearer there (`setAuthToken` / `setWsToken`), so the cookie was never the
+ * credential — only an accident of transport riding along. Wrapped INNERMOST by
+ * {@link createLunoraClient}, so it runs after every other layer and also
+ * overrides the `credentials: "include"` `@lunora/client` sends on its
+ * `get-session` probe.
+ *
+ * **Scope.** This covers `fetch`, which is the whole HTTP RPC/REST/storage
+ * surface. It does NOT cover the WebSocket upgrade — React Native attaches the
+ * same jar's cookie to the handshake and exposes no per-socket opt-out — nor
+ * `httpStream` imported standalone from `@lunora/client`, which resolves
+ * `globalThis.fetch` itself. Neither is a live 403 today: React Native sends an
+ * `Origin` equal to the server's on a WS handshake, and better-auth's `bearer`
+ * plugin overwrites the session cookie with the bearer rather than deferring to
+ * it. Both are noted so the guarantee is not read wider than it is.
+ *
+ * {@link createLunoraClient} applies it only on native — see
+ * {@link isNativeRuntime} — and only to the global `fetch`. Under
+ * `react-native-web` the jar is the browser's, `Origin` IS sent, the CSRF guard
+ * never fires, and a cookie session is a legitimate setup that this would
+ * silently sign out (`getCurrentUser` deliberately sends `credentials:
+ * "include"`). A caller-supplied `fetch` is never wrapped either, so a
+ * cookie-forwarding SSR transport keeps its credentials; apply this yourself if
+ * you want it.
+ */
+declare const withoutAmbientCookies: (fetchImpl: typeof fetch) => typeof fetch;
 /**
  * Construct a `LunoraClient` tuned for React Native / Expo — a thin wrapper over
  * `new LunoraClient(options)` that fills in the three things a browser gets for
@@ -75,17 +120,21 @@ interface CreateLunoraClientOptions extends LunoraClientOptions {
  * after a restart while the socket reconnects — mirroring the browser's
  * IndexedDB-backed default.
  *
- * Third, credentialed requests: pass `getAuthHeaders` and the returned headers
- * ride both the HTTP RPC path and the WebSocket upgrade, since React Native has
- * no cookie jar to attach a session implicitly.
+ * Third, credentialed requests: the session is a bearer on this platform, so the
+ * returned `fetch` is wrapped in {@link withoutAmbientCookies} (React Native's
+ * cookie jar is real, and a stray session cookie 403s every state-changing RPC —
+ * see there), and passing `getAuthHeaders` additionally rides its headers on both
+ * the HTTP RPC path and the WebSocket upgrade.
  *
  * Everything on `LunoraClientOptions` is still accepted and passed through; an
- * explicit `persistence`, `queryCache`, `fetch`, or `WebSocket` takes precedence
- * over the convenience derived from `storage` / `getAuthHeaders`. `persistence`
+ * explicit `persistence`, `queryCache`, `fetch`, or `WebSocket` replaces the
+ * transport derived from `storage`. A `getAuthHeaders` factory is layered over a
+ * caller-supplied `fetch` rather than ignored — the previous behaviour dropped
+ * the credential on HTTP while still injecting it on the WS upgrade. `persistence`
  * and `queryCache` override independently — `storage` backs both, so opting out
  * of one leaves the other wired. See the package README
  * for a full setup example.
  * @experimental
  */
 declare const createLunoraClient: (options: CreateLunoraClientOptions) => LunoraClient;
-export { type AuthHeadersFactory, type CreateLunoraClientOptions, createLunoraClient };
+export { type AuthHeadersFactory, type CreateLunoraClientOptions, createLunoraClient, withoutAmbientCookies };

package/dist/index.mjs

@@ -1 +1 @@
-import{createLunoraClient as o}from"./packem_shared/createLunoraClient-DriS3kEf.mjs";export*from"@lunora/react";export{o as createLunoraClient};
+import{createLunoraClient as t,withoutAmbientCookies as r}from"./packem_shared/createLunoraClient-WOgHmG35.mjs";export*from"@lunora/react";export{t as createLunoraClient,r as withoutAmbientCookies};

package/dist/packem_shared/createLunoraClient-WOgHmG35.mjs

@@ -0,0 +1 @@
+import{LunoraClient as d,createAsyncStorageQueryCache as h,createAsyncStoragePersistence as i}from"@lunora/client";const u=()=>typeof document>"u",f=s=>(t,o)=>s(t,{...o,credentials:"omit"}),b=(s,t)=>(o,e)=>{const r=t();if(!r)return s(o,e);const c=new Headers(r);return e?.headers&&new Headers(e.headers).forEach((n,a)=>{c.set(a,n)}),s(o,{...e,headers:c})},S=(s,t)=>class extends s{constructor(e,r){const c=t();super(e,r,c?{headers:c}:void 0)}},y=s=>{const{getAuthHeaders:t,storage:o,...e}=s,r=e.fetch===void 0&&typeof fetch=="function"?fetch.bind(globalThis):void 0,c=e.fetch??(r&&u()?f(r):r),n=t&&c?b(c,t):c,a=t&&e.WebSocket===void 0&&typeof WebSocket=="function"?S(WebSocket,t):e.WebSocket;return new d({...e,persistence:e.persistence??(o?i({storage:o}):void 0),queryCache:e.queryCache??(o?h({storage:o}):void 0),fetch:n,WebSocket:a})};export{y as createLunoraClient,b as withAuthHeaders,S as withAuthWebSocket,f as withoutAmbientCookies};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/react-native",
-  "version": "1.0.0-alpha.90",
+  "version": "1.0.0-alpha.91",
   "description": "React Native / Expo integration for Lunora: an AsyncStorage-backed client factory, the useQuery/useMutation/useSubscription hooks, and a one-call better-auth Expo client",
   "keywords": [
     "cloudflare",
@@ -50,8 +50,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/client": "1.0.0-alpha.113",
-    "@lunora/react": "1.0.0-alpha.118"
+    "@lunora/client": "1.0.0-alpha.114",
+    "@lunora/react": "1.0.0-alpha.119"
   },
   "peerDependencies": {
     "@better-auth/expo": "^1.7.1",

package/dist/packem_shared/createLunoraClient-DriS3kEf.mjs

@@ -1 +0,0 @@
-import{LunoraClient as h,createAsyncStorageQueryCache as d,createAsyncStoragePersistence as u}from"@lunora/client";const f=(r,t)=>(c,e)=>{const s=t();if(!s)return r(c,e);const o=new Headers(s);return e?.headers&&new Headers(e.headers).forEach((n,a)=>{o.set(a,n)}),r(c,{...e,headers:o})},i=(r,t)=>class extends r{constructor(e,s){const o=t();super(e,s,o?{headers:o}:void 0)}},k=r=>{const{getAuthHeaders:t,storage:c,...e}=r,s=t&&e.fetch===void 0&&typeof fetch=="function"?f(fetch.bind(globalThis),t):e.fetch,o=t&&e.WebSocket===void 0&&typeof WebSocket=="function"?i(WebSocket,t):e.WebSocket;return new h({...e,persistence:e.persistence??(c?u({storage:c}):void 0),queryCache:e.queryCache??(c?d({storage:c}):void 0),fetch:s,WebSocket:o})};export{k as createLunoraClient,f as withAuthHeaders,i as withAuthWebSocket};