@stjoseph/prumo 0.2.0 → 0.4.0

package/templates/web/test/features/auth/email-flows.spec.tsx

@@ -0,0 +1,121 @@
+import { fakeTransport, json } from '@test/support/fake-transport'
+import { renderApp } from '@test/support/render-app'
+import { screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { describe, expect, it } from 'vitest'
+import type { Profile } from '@/api-contract'
+
+const user = { id: 'user-1', email: 'ana@example.com' }
+
+const profile: Profile = {
+  id: 'profile-1',
+  userId: user.id,
+  displayName: 'Ana',
+  locale: 'en',
+  timezone: 'UTC',
+  createdAt: '2026-09-14T12:57:24.057Z',
+  updatedAt: '2026-09-14T12:57:24.057Z',
+}
+
+const empty = (status: number) => new Response(null, { status })
+
+const problem = (status: number, body: Record<string, unknown>) =>
+  json(status, { status, title: 'Error', ...body }, 'application/problem+json')
+
+// A visitor whose session appears once `signedIn` flips, as cookies would.
+function app(routes: Parameters<typeof fakeTransport>[0]) {
+  const state = { signedIn: false }
+
+  return {
+    state,
+    transport: fakeTransport({
+      'GET /api/auth/session': () => (state.signedIn ? json(200, { user }) : json(401, {})),
+      'POST /api/auth/refresh': () => json(401, {}),
+      'GET /api/v1/users/me': () => json(200, profile),
+      ...routes,
+    }),
+  }
+}
+
+describe('email verification on the web', () => {
+  it('takes a new account to the code, and into the app once it is entered', async () => {
+    const visitor = userEvent.setup()
+    const { state, transport } = app({
+      'POST /api/auth/sign-up': () => json(201, { verificationRequired: true }),
+      'POST /api/auth/email/verify': () => {
+        state.signedIn = true
+        return empty(204)
+      },
+    })
+
+    renderApp('/sign-up', transport)
+
+    await visitor.type(await screen.findByLabelText('Name'), 'Ana')
+    await visitor.type(screen.getByLabelText('Email'), user.email)
+    await visitor.type(screen.getByLabelText('Password'), 'correct-horse-battery')
+    await visitor.click(screen.getByRole('button', { name: 'Create account' }))
+
+    expect(await screen.findByRole('heading', { name: 'Confirm your email' })).toBeInTheDocument()
+
+    await visitor.type(screen.getByLabelText('Code'), '123456')
+    await visitor.click(screen.getByRole('button', { name: 'Confirm email' }))
+
+    expect(await screen.findByRole('heading', { name: 'Your profile' })).toBeInTheDocument()
+  })
+
+  it('sends an unconfirmed account that signs in to the code page', async () => {
+    const visitor = userEvent.setup()
+    const { transport } = app({
+      'POST /api/auth/sign-in': () => problem(403, { code: 'email_not_verified' }),
+    })
+
+    renderApp('/sign-in', transport)
+
+    await visitor.type(await screen.findByLabelText('Email'), user.email)
+    await visitor.type(screen.getByLabelText('Password'), 'correct-horse-battery')
+    await visitor.click(screen.getByRole('button', { name: 'Sign in' }))
+
+    expect(await screen.findByRole('heading', { name: 'Confirm your email' })).toBeInTheDocument()
+  })
+
+  it('shows a wrong code on the code field', async () => {
+    const visitor = userEvent.setup()
+    const { transport } = app({
+      'POST /api/auth/email/verify': () =>
+        problem(422, { code: 'invalid_code', detail: 'The code is wrong or has expired' }),
+    })
+
+    renderApp(`/verify-email?email=${user.email}`, transport)
+
+    await visitor.type(await screen.findByLabelText('Code'), '000000')
+    await visitor.click(screen.getByRole('button', { name: 'Confirm email' }))
+
+    expect(await screen.findByText(/The code is wrong or has expired/)).toBeInTheDocument()
+  })
+})
+
+describe('password reset on the web', () => {
+  it('goes from forgot to reset to the app', async () => {
+    const visitor = userEvent.setup()
+    const { state, transport } = app({
+      'POST /api/auth/password/forgot': () => empty(204),
+      'POST /api/auth/password/reset': () => {
+        state.signedIn = true
+        return empty(204)
+      },
+    })
+
+    renderApp('/sign-in', transport)
+
+    await visitor.click(await screen.findByRole('link', { name: 'Forgot your password?' }))
+    await screen.findByRole('heading', { name: 'Reset your password' })
+    await visitor.type(screen.getByLabelText('Email'), user.email)
+    await visitor.click(screen.getByRole('button', { name: 'Send a reset code' }))
+    await screen.findByRole('heading', { name: 'Choose a new password' })
+    await visitor.type(screen.getByLabelText('Code'), '123456')
+    await visitor.type(screen.getByLabelText('New password'), 'another-good-password')
+    await visitor.click(screen.getByRole('button', { name: 'Set the new password' }))
+
+    expect(await screen.findByRole('heading', { name: 'Your profile' })).toBeInTheDocument()
+  })
+})

package/templates/web/test/features/auth/sign-in-form.spec.tsx

@@ -11,8 +11,12 @@ describe('SignInForm', () => {
     renderApp(
       '/sign-in',
       fakeTransport({
-        'POST /api/auth/sign-in/email': () =>
-          json(401, { message: 'Invalid email or password', code: 'INVALID_EMAIL_OR_PASSWORD' }),
+        'POST /api/auth/sign-in': () =>
+          json(
+            401,
+            { title: 'Unauthorized', status: 401, detail: 'Invalid email or password' },
+            'application/problem+json',
+          ),
       }),
     )
 

package/templates/web/test/features/auth/social-buttons.spec.tsx

@@ -0,0 +1,35 @@
+import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
+import { renderApp } from '@test/support/render-app'
+import { screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+const signedOut = fakeTransport({
+  'GET /api/auth/session': () => json(401, {}),
+  'POST /api/auth/refresh': () => json(401, {}),
+})
+
+describe('SocialButtons', () => {
+  it('send the browser to the API, which returns it to the page it was turned away from', async () => {
+    renderApp('/sign-in?redirect=%2Forders', signedOut)
+
+    for (const name of [
+      'Continue with Google', // prumo:google
+      'Continue with Apple', // prumo:apple
+    ]) {
+      const link = await screen.findByRole('link', { name })
+      const href = new URL(link.getAttribute('href') ?? '')
+
+      expect(`${href.origin}${href.pathname}`).toMatch(
+        new RegExp(`^${API_URL}/api/auth/social/(google|apple)$`),
+      )
+      expect(href.searchParams.get('client')).toBe('web')
+      expect(href.searchParams.get('returnTo')).toBe('/orders')
+    }
+  })
+
+  it('says why a provider sign-in came back without a session', async () => {
+    renderApp('/sign-in?error=provider_email_unverified', signedOut)
+
+    expect(await screen.findByRole('alert')).toHaveTextContent('not verified with the provider')
+  })
+})

package/templates/web/test/features/oauth/consent-form.spec.tsx

@@ -1,45 +1,109 @@
-import { fakeTransport, json } from '@test/support/fake-transport'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { renderApp } from '@test/support/render-app'
-import { screen } from '@testing-library/react'
+import { render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import { afterEach, describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
+import { createAuthClient } from '@/api-contract'
+import { ConsentForm } from '@/features/oauth/consent-form'
 
-const user = { id: 'user-1', email: 'ana@example.com', name: 'Ana' }
+const REQUEST = '0199a7e2-0000-7000-8000-000000000000'
 
-// The shape Better Auth signs: every signed name listed in ba_param, then the signature.
-const SIGNED =
-  'client_id=client-1&scope=openid+profile&ba_param=ba_param&ba_param=client_id&ba_param=scope&sig=signature'
+const view = {
+  clientId: 'https://claude.example.com/client.json',
+  clientName: 'Claude',
+  clientHost: 'claude.example.com',
+  redirectHost: 'claude.example.com',
+  redirectsToThisDevice: false,
+  scopes: [
+    { scope: 'profile:read', description: 'Read your profile' },
+    { scope: 'profile:write', description: 'Change your display name, language and timezone' },
+  ],
+}
 
-afterEach(() => {
-  window.history.replaceState(null, '', '/')
-})
+function renderForm(routes: Parameters<typeof fakeTransport>[0]) {
+  const leave = vi.fn()
+  const auth = createAuthClient({ baseUrl: API_URL, fetch: fakeTransport(routes) })
+
+  render(
+    <QueryClientProvider client={new QueryClient()}>
+      <ConsentForm auth={auth} requestId={REQUEST} leave={leave} />
+    </QueryClientProvider>,
+  )
+
+  return leave
+}
 
 describe('ConsentForm', () => {
-  it('names the client, lists the scopes and sends the signed query with the answer', async () => {
+  it('names the client and both hosts, and sends the browser where the API says', async () => {
     const visitor = userEvent.setup()
-    let consent: Record<string, unknown> | undefined
+    let decision: unknown
+    const leave = renderForm({
+      [`GET /api/oauth/authorizations/${REQUEST}`]: () => json(200, view),
+      [`POST /api/oauth/authorizations/${REQUEST}/decision`]: async (request) => {
+        decision = await request.json()
+        return json(200, { redirectTo: 'https://claude.example.com/callback?code=c' })
+      },
+    })
+
+    expect(await screen.findByText('Claude')).toBeInTheDocument()
+    expect(screen.getByText(/claude\.example\.com\)/)).toBeInTheDocument()
+    expect(screen.getByRole('list', { name: 'What it will be able to do' })).toHaveTextContent(
+      'Read your profile',
+    )
+
+    await visitor.click(screen.getByRole('button', { name: 'Allow' }))
+
+    expect(decision).toEqual({ accept: true })
+    expect(leave).toHaveBeenCalledWith('https://claude.example.com/callback?code=c')
+  })
+
+  it('warns when the code returns to a program on this device', async () => {
+    renderForm({
+      [`GET /api/oauth/authorizations/${REQUEST}`]: () =>
+        json(200, { ...view, redirectHost: 'localhost:33418', redirectsToThisDevice: true }),
+    })
 
-    // The OAuth client plugin reads the browser's own URL, not the router's memory history.
-    window.history.replaceState(null, '', `/consent?${SIGNED}&unrelated=1`)
+    expect(await screen.findByRole('note')).toHaveTextContent('a program on this device')
+  })
+
+  it('says so when the request has expired', async () => {
+    renderForm({
+      [`GET /api/oauth/authorizations/${REQUEST}`]: () =>
+        json(404, { title: 'Not Found', status: 404 }, 'application/problem+json'),
+    })
+
+    expect(await screen.findByRole('alert')).toHaveTextContent('expired')
+  })
+})
+
+describe('the consent route', () => {
+  // The MCP client opened the browser at the API, which sent it here; without a session, sign-in comes first.
+  it('sends a visitor to sign in first, and back to the same request after', async () => {
+    const visitor = userEvent.setup()
+    let signedIn = false
 
     renderApp(
-      `/consent?${SIGNED}`,
+      `/consent?request=${REQUEST}`,
       fakeTransport({
-        'GET /api/auth/get-session': () =>
-          json(200, { session: { id: 's-1', userId: user.id }, user }),
-        'GET /api/auth/oauth2/public-client': () => json(200, { client_name: 'Claude' }),
-        'POST /api/auth/oauth2/consent': async (request) => {
-          consent = await request.json()
-          return json(200, { redirect: false })
+        'GET /api/auth/session': () =>
+          signedIn
+            ? json(200, { user: { id: 'user-1', email: 'ana@example.com' } })
+            : json(401, {}),
+        'POST /api/auth/refresh': () => json(401, {}),
+        'POST /api/auth/sign-in': () => {
+          signedIn = true
+          return new Response(null, { status: 204 })
         },
+        [`GET /api/oauth/authorizations/${REQUEST}`]: () => json(200, view),
       }),
     )
 
-    expect(await screen.findByText('Claude')).toBeInTheDocument()
-    expect(screen.getByText('profile')).toBeInTheDocument()
+    await visitor.type(await screen.findByLabelText('Email'), 'ana@example.com')
+    await visitor.type(screen.getByLabelText('Password'), 'correct-horse-battery')
+    await visitor.click(screen.getByRole('button', { name: 'Sign in' }))
 
-    await visitor.click(screen.getByRole('button', { name: 'Allow' }))
-
-    expect(consent).toMatchObject({ accept: true, oauth_query: SIGNED })
+    expect(await screen.findByRole('heading', { name: 'Allow access' })).toBeInTheDocument()
+    expect(await screen.findByText('Claude')).toBeInTheDocument()
   })
 })

package/templates/web/test/support/render-app.tsx

@@ -2,15 +2,15 @@ import { QueryClient } from '@tanstack/react-query'
 import { createMemoryHistory } from '@tanstack/react-router'
 import { API_URL } from '@test/support/fake-transport'
 import { render } from '@testing-library/react'
-import { createClient, type Transport } from '@/api-contract'
+import { createAuthClient, createClient, type Transport } from '@/api-contract'
 import { App } from '@/app'
-import { createAuth } from '@/features/auth/auth-client'
 
 export function renderApp(path: string, transport: Transport) {
+  const auth = createAuthClient({ baseUrl: API_URL, fetch: transport })
   const context = {
     queryClient: new QueryClient({ defaultOptions: { queries: { retry: false } } }),
-    api: createClient({ baseUrl: API_URL, fetch: transport }),
-    auth: createAuth({ baseUrl: API_URL, fetch: transport }),
+    api: createClient({ baseUrl: API_URL, fetch: auth.fetch }),
+    auth,
   }
 
   return render(<App context={context} history={createMemoryHistory({ initialEntries: [path] })} />)

package/templates/workspace/scripts/ports.mjs

@@ -25,7 +25,7 @@ const APPS = {
 // A port that moves takes these with it: the key to write, in which app, from which app's port.
 const FOLLOWERS = {
   api: [
-    { app: 'api', key: 'BETTER_AUTH_URL' },
+    { app: 'api', key: 'API_URL' },
     { app: 'web', key: 'VITE_API_URL' },
     { app: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
   ],

package/dist/mcp.js

@@ -1,100 +0,0 @@
-import { existsSync } from 'node:fs';
-import { readdir, readFile, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { setJsonc } from "./jsonc.js";
-// The api and web templates ship with MCP. A project that answered no receives them without it: these files are
-// deleted, these dependencies removed, and every marked line or block cut. Every other type has nothing to cut.
-const FILES = {
-    api: [
-        'src/infra/mcp',
-        'src/infra/http/controllers/mcp.controller.ts',
-        'test/infra/http/controllers/mcp.controller.spec.ts',
-    ],
-    web: ['src/features/oauth', 'src/routes/_authenticated/consent.tsx', 'test/features/oauth'],
-};
-const DEPENDENCIES = {
-    api: [
-        '@better-auth/cimd',
-        '@better-auth/mcp',
-        '@modelcontextprotocol/client',
-        '@modelcontextprotocol/server',
-    ],
-    web: ['@better-auth/oauth-provider'],
-};
-const BLOCK_START = /^\s*\/\/ prumo:mcp$/;
-const BLOCK_END = /^\s*\/\/ prumo:end-mcp$/;
-// A marked import keeps its marker as a trailing comment, which the import sorter carries along.
-const MARKED_LINE = /\s*\/\/ prumo:mcp$/;
-export function cutMcp(text, keep, file = 'a file') {
-    const kept = [];
-    let inBlock = false;
-    for (const line of text.split('\n')) {
-        if (BLOCK_START.test(line)) {
-            if (inBlock) {
-                throw new Error(`${file} opens a prumo:mcp block inside another`);
-            }
-            inBlock = true;
-        }
-        else if (BLOCK_END.test(line)) {
-            if (!inBlock) {
-                throw new Error(`${file} closes a prumo:mcp block it never opened`);
-            }
-            inBlock = false;
-        }
-        else if (MARKED_LINE.test(line)) {
-            if (keep) {
-                kept.push(line.replace(MARKED_LINE, ''));
-            }
-        }
-        else if (keep || !inBlock) {
-            kept.push(line);
-        }
-    }
-    if (inBlock) {
-        throw new Error(`${file} leaves a prumo:mcp block open`);
-    }
-    return kept.join('\n');
-}
-async function sourceFiles(directory) {
-    if (!existsSync(directory)) {
-        return [];
-    }
-    const entries = await readdir(directory, { withFileTypes: true, recursive: true });
-    return entries
-        .filter((entry) => entry.isFile() && /\.tsx?$/.test(entry.name))
-        .map((entry) => join(entry.parentPath, entry.name));
-}
-export async function applyMcp(app, type, enabled) {
-    const files = FILES[type];
-    const dependencies = DEPENDENCIES[type];
-    if (files === undefined || dependencies === undefined) {
-        return;
-    }
-    if (!enabled) {
-        for (const file of files) {
-            await rm(join(app, file), { recursive: true, force: true });
-        }
-        const manifest = join(app, 'package.json');
-        let text = await readFile(manifest, 'utf8');
-        for (const section of ['dependencies', 'devDependencies']) {
-            for (const dependency of dependencies) {
-                text = setJsonc(text, [section, dependency], undefined);
-            }
-        }
-        await writeFile(manifest, text);
-    }
-    const sources = [
-        ...(await sourceFiles(join(app, 'src'))),
-        ...(await sourceFiles(join(app, 'test'))),
-    ];
-    for (const source of sources) {
-        const text = await readFile(source, 'utf8');
-        const cut = cutMcp(text, enabled, source);
-        if (!enabled && dependencies.some((dependency) => cut.includes(`'${dependency}`))) {
-            throw new Error(`${source} still imports an MCP package outside a prumo:mcp marker`);
-        }
-        if (cut !== text) {
-            await writeFile(source, cut);
-        }
-    }
-}

package/templates/api/docker/init/01-auth-schema.sql

@@ -1 +0,0 @@
-CREATE SCHEMA IF NOT EXISTS auth;

package/templates/api/migrations/Migration20260914123239_create_profile.ts

@@ -1,13 +0,0 @@
-import { Migration } from '@mikro-orm/migrations';
-
-export class Migration20260914123239_create_profile extends Migration {
-
-  override name = 'Migration20260914123239_create_profile';
-
-  override up(): void | Promise<void> {
-    this.addSql(`create table "profile" ("id" uuid not null default uuidv7(), "user_id" uuid not null, "display_name" text not null, "locale" text not null default 'en', "timezone" text not null default 'UTC', "created_at" timestamptz not null default now(), "updated_at" timestamptz not null default now(), primary key ("id"));`);
-    this.addSql(`alter table "profile" add constraint "profile_user_id_unique" unique ("user_id");`);
-    this.addSql(`alter table "profile" add constraint "profile_user_id_foreign" foreign key ("user_id") references "auth"."user" ("id") on delete restrict;`);
-  }
-
-}

package/templates/api/src/infra/auth/auth.cli.ts

@@ -1,5 +0,0 @@
-import { loadEnv } from '@/infra/config/env'
-import { createAuth } from './auth.factory'
-
-// Read by Better Auth's CLI (`auth migrate --config`), which only needs the schema, not the hooks.
-export const auth = createAuth(loadEnv())

package/templates/api/src/infra/auth/auth.factory.ts

@@ -1,77 +0,0 @@
-import { cimd } from '@better-auth/cimd' // prumo:mcp
-import { fetchClientMetadataResource } from '@better-auth/cimd/node' // prumo:mcp
-import { expo } from '@better-auth/expo'
-import { mcp } from '@better-auth/mcp' // prumo:mcp
-import { type BetterAuthPlugin, betterAuth } from 'better-auth'
-import { jwt } from 'better-auth/plugins' // prumo:mcp
-import { Pool } from 'pg'
-import type { Env } from '@/infra/config/env'
-
-type NewUser = { id: string; name: string }
-
-export type AuthHooks = {
-  onUserCreated?: (user: NewUser) => Promise<void>
-}
-
-export const AUTH = Symbol('Auth')
-
-// prumo:mcp
-// The protected resource MCP clients ask a token for; access tokens carry it as their audience.
-export function mcpResource(env: Pick<Env, 'BETTER_AUTH_URL'>): string {
-  return `${env.BETTER_AUTH_URL}/api/mcp`
-}
-
-// prumo:end-mcp
-export function createAuth(
-  env: Pick<
-    Env,
-    | 'AUTH_DATABASE_URL'
-    | 'BETTER_AUTH_SECRET'
-    | 'BETTER_AUTH_URL'
-    | 'WEB_ORIGIN'
-    | 'MOBILE_APP_SCHEME'
-  >,
-  hooks: AuthHooks = {},
-) {
-  const mobile = env.MOBILE_APP_SCHEME
-  const plugins: BetterAuthPlugin[] = mobile === undefined ? [] : [expo()]
-
-  // prumo:mcp
-  plugins.push(
-    jwt(),
-    mcp({
-      loginPage: `${env.WEB_ORIGIN}/sign-in`,
-      consentPage: `${env.WEB_ORIGIN}/consent`,
-      resource: mcpResource(env),
-    }),
-    cimd({ fetchClientMetadataResource, metadataProfile: 'mcp-2026-07-28' }),
-  )
-
-  // prumo:end-mcp
-  return betterAuth({
-    baseURL: env.BETTER_AUTH_URL,
-    basePath: '/api/auth',
-    secret: env.BETTER_AUTH_SECRET,
-    trustedOrigins: mobile === undefined ? [env.WEB_ORIGIN] : [env.WEB_ORIGIN, `${mobile}://`],
-    plugins,
-    database: new Pool({
-      connectionString: env.AUTH_DATABASE_URL,
-      options: '-c search_path=auth',
-    }),
-    emailAndPassword: { enabled: true },
-    advanced: { database: { generateId: 'uuid' } },
-    databaseHooks: {
-      user: {
-        create: {
-          after: async (user) => {
-            await hooks.onUserCreated?.(user)
-          },
-        },
-      },
-    },
-  })
-}
-
-export type Auth = ReturnType<typeof createAuth>
-export type AuthSession = Awaited<ReturnType<Auth['api']['getSession']>>
-export type AuthUser = NonNullable<AuthSession>['user']

package/templates/api/src/infra/database/mikroorm/entities/auth-user.schema.ts

@@ -1,16 +0,0 @@
-import { EntitySchema } from '@mikro-orm/core'
-
-// Better Auth owns auth.user. This maps only its id, so a foreign key into it is declared rather than
-// hand-written; schema diffing skips the table, and nothing reads or writes it through the ORM.
-export class AuthUser {
-  id: string
-}
-
-export const AuthUserSchema = new EntitySchema({
-  class: AuthUser,
-  schema: 'auth',
-  tableName: 'user',
-  properties: {
-    id: { type: 'uuid', primary: true },
-  },
-})

package/templates/api/test/infra/auth/auth.factory.spec.ts

@@ -1,22 +0,0 @@
-import { testEnv } from '@test/support/setup'
-import { describe, expect, it } from 'vitest'
-import { createAuth } from '@/infra/auth/auth.factory'
-
-const proxy =
-  'http://localhost:3000/api/auth/expo-authorization-proxy?authorizationURL=https://example.com/authorize&oauthState=s'
-
-describe('createAuth', () => {
-  it('exposes no Expo redirect endpoint without a mobile scheme', async () => {
-    const response = await createAuth(testEnv()).handler(new Request(proxy))
-
-    expect(response.status).toBe(404)
-  })
-
-  it('exposes the Expo endpoint and trusts the scheme once a mobile scheme is set', async () => {
-    const auth = createAuth({ ...testEnv(), MOBILE_APP_SCHEME: 'app' })
-    const response = await auth.handler(new Request(proxy))
-
-    expect(response.status).toBe(302)
-    expect(auth.options.trustedOrigins).toContain('app://')
-  })
-})

package/templates/mobile/src/features/auth/auth-client.ts

@@ -1,27 +0,0 @@
-import { expoClient } from '@better-auth/expo/client'
-import { createAuthClient } from 'better-auth/react'
-import * as SecureStore from 'expo-secure-store'
-import type { Transport } from '@/api-contract'
-
-export type AuthClient = ReturnType<typeof createAuth>
-
-export type SessionAuth = Pick<AuthClient, 'signIn' | 'signUp' | 'getSession'>
-
-export function createAuth({ baseUrl, fetch }: { baseUrl: string; fetch: Transport }) {
-  return createAuthClient({
-    baseURL: baseUrl,
-    basePath: '/api/auth',
-    fetchOptions: { customFetchImpl: fetch },
-    plugins: [expoClient({ storage: SecureStore })],
-  })
-}
-
-export function withSessionCookie(auth: AuthClient, fetch: Transport): Transport {
-  return async (input, init) => {
-    const headers = new Headers(init?.headers)
-
-    headers.set('cookie', await auth.getCookie())
-
-    return fetch(input, { ...init, headers, credentials: 'omit' })
-  }
-}

package/templates/mobile/src/features/auth/session.ts

@@ -1,17 +0,0 @@
-import { queryOptions } from '@tanstack/react-query'
-import { ApiError } from '@/api-contract'
-import type { SessionAuth } from './auth-client'
-
-export const sessionQuery = (auth: SessionAuth) =>
-  queryOptions({
-    queryKey: ['session'],
-    queryFn: async () => {
-      const { data, error } = await auth.getSession()
-
-      if (error !== null) {
-        throw ApiError.fromAuthError(error)
-      }
-
-      return data
-    },
-  })

package/templates/web/src/features/auth/auth-client.ts

@@ -1,17 +0,0 @@
-import { oauthProviderClient } from '@better-auth/oauth-provider/client' // prumo:mcp
-import { createAuthClient } from 'better-auth/react'
-import type { Transport } from '@/api-contract'
-
-export type AuthClient = ReturnType<typeof createAuth>
-
-export function createAuth({ baseUrl, fetch }: { baseUrl: string; fetch: Transport }) {
-  return createAuthClient({
-    baseURL: baseUrl,
-    basePath: '/api/auth',
-    fetchOptions: { customFetchImpl: fetch },
-    // prumo:mcp
-    // Carries the signed query of an MCP client's authorization through sign-in and consent.
-    plugins: [oauthProviderClient()],
-    // prumo:end-mcp
-  })
-}