feat(auth): cookie pivot — drop bootstrap-pat.txt, add /api/auth/local-init#830

Merged

buremba merged 6 commits into

mainfrom

feat/auth-cookie-pivot

May 17, 2026

Commits on May 17, 2026

feat(auth): cookie pivot — drop bootstrap-pat.txt, add /api/auth/local-init
buremba
committed
fix(auth): mount local-init outside /api/auth/* so Better Auth's catch-all doesn't shadow it
buremba
committed
fix(auth): require X-Lobu-Client header on /api/local-init (CSRF gate)
buremba
committed
feat(auth): /api/local-init also mints worker-scoped PAT
buremba
committed
fix(auth): close LAN-exposure of /api/local-init (pi review)
buremba
committed
chore: bump owletto submodule to include cookie-pivot Mac + Chrome wiring (lobu-ai/owletto#159)
buremba
committed