fix: persist mobile sessions by matching the API auth cookie prefix

[adelrodriguez]

Stacked on #151. Flagged there by review: the generated Expo auth client has never persisted a session, against either cookie prefix. @better-auth/expo gates all cookie storage behind a startsWith(cookiePrefix) check that defaults to "better-auth", and our expoClient wrapper never passed cookiePrefix — so every init.* (and now init-api.*) cookie the API issues was silently dropped and mobile users were signed out on every app restart.

The wrapper now passes the API's cookie prefix, since the generated mobile client targets apps/api (EXPO_PUBLIC_API_URL=http://localhost:3000). Callers can still override it via the options spread when pointing at a different backend.

Along the way the init-api prefix moved from an inline template literal in apps/api into AUTH_API_COOKIE_PREFIX in packages/auth/src/constants.ts, so both sites that must agree on it — the API's auth instance and the Expo client — read one constant.

Written by Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

[pullfrog]

Pullfrog stalled — likely cause: quota error

The agent stopped emitting events for 120s and was killed by the activity-timeout watchdog. 88 events were processed before the failure.

Recent agent stderr

timestamp=2026-08-23T16:20:45.846Z level=ERROR run=80ef9d06 message="stream error" providerID=opencode modelID=claude-opus-5 session.id=ses_fd0936035ffeSBoDC2yZi0QsBO small=false agent=build mode=primary error.error="AI_APICallError: Subscription quota exceeded. Retry in 7hr 40min."

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
init	Skipped		Aug 23, 2026 3:14pm
init-docs	Skipped		Aug 23, 2026 3:14pm