Backends with real auth (session cookies) need credentials:'include' on the
editor's cross-origin fetches — ts-rest clients, project file bytes/upload,
drift keepalive, lib item GET/PUT, sync-stack resolve. Cookie-less setups are
unaffected (the thin identity headers still ride along and same-site Lax
cookies simply don't exist). CDN/static-gallery fetches stay credential-less
(wildcard CORS rejects credentialed requests). The example backend's CORS now
sends allow-credentials — origin reflection was already exact, so this only
lets browsers accept those responses.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016TxciQ5VkNYUZesgMSEMUr
840173c978