From ab2575afe3e51a4943636a5662aec457b7743e20 Mon Sep 17 00:00:00 2001
From: Max Bader <mbader@codehs.com>
Date: Thu, 16 Jul 2026 09:45:31 -0500
Subject: [PATCH] Release 0.2.0-next.5: auth fail-safe + regression test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The onAuthStateChange getUser-rejection fix already landed on main (#2), but
main is still at 0.1.1 so it hasn't shipped to the `next` (canary) channel
that sdk-canary apps pull. Bump to 0.2.0-next.5 to cut that release, add a
regression test that a rejecting /users/me session check still fires
SIGNED_OUT (rather than hanging <AuthGate> on a blank screen — the cause of
the empty project-card screenshots), and record it in the changelog.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 CHANGELOG.md       |  8 ++++++++
 package.json       |  2 +-
 src/client.test.ts | 15 +++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2ea8c8d..d396a46 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.0-next.5
+
+Fix: `onAuthStateChange` (and thus `<AuthGate>`) no longer hangs forever when
+the initial `/users/me` session check rejects (cross-origin/network failure —
+e.g. the sandbox-preview context used for project-card screenshots). A rejected
+check now fires `SIGNED_OUT` instead of leaving `loading` stuck, so the app
+renders its sign-in screen rather than a blank page. Adds a regression test.
+
 ## 0.1.1
 
 Publishing now goes through npm OIDC trusted publishing (no long-lived token).
diff --git a/package.json b/package.json
index b95438b..adf4e03 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "bool-sdk",
-  "version": "0.1.1",
+  "version": "0.2.0-next.5",
   "description": "Client SDK for apps built on Bool — gateway data access, end-user auth, and the React auth layer.",
   "type": "module",
   "main": "./dist/index.js",
diff --git a/src/client.test.ts b/src/client.test.ts
index 8df49d4..af86f3b 100644
--- a/src/client.test.ts
+++ b/src/client.test.ts
@@ -199,6 +199,21 @@ describe("end-user auth (gateway users plane)", () => {
     expect(events).toHaveLength(1);
   });
 
+  test("onAuthStateChange still fires SIGNED_OUT when the session check rejects (no hang)", async () => {
+    // A cross-origin / network failure makes the /users/me fetch reject. Without
+    // a .catch the callback never fires, `loading` never clears, and <AuthGate>
+    // hangs on a blank screen forever — which is what left project-card
+    // screenshots capturing an empty background. Treat a rejection as signed-out.
+    globalThis.fetch = (async () => {
+      throw new TypeError("Failed to fetch");
+    }) as unknown as typeof fetch;
+    const client = createBoolClient(CONFIG);
+    const events: unknown[][] = [];
+    client.auth.onAuthStateChange((event, user) => events.push([event, user]));
+    await tick();
+    expect(events).toEqual([["SIGNED_OUT", null]]);
+  });
+
   test("resetPasswordForEmail always resolves ok (no account probing), even on server error", async () => {
     respond = () => new Response("boom", { status: 500 });
     const client = createBoolClient(CONFIG);