Release 0.2.0-next.5: auth fail-safe + regression test

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.0-next.5
+
+Fix: `onAuthStateChange` (and thus `<AuthGate>`) no longer hangs forever when
+the initial `/users/me` session check rejects (cross-origin/network failure —
+e.g. the sandbox-preview context used for project-card screenshots). A rejected
+check now fires `SIGNED_OUT` instead of leaving `loading` stuck, so the app
+renders its sign-in screen rather than a blank page. Adds a regression test.
+
 ## 0.1.1
 
 Publishing now goes through npm OIDC trusted publishing (no long-lived token).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "bool-sdk",
-  "version": "0.1.1",
+  "version": "0.2.0-next.5",
   "description": "Client SDK for apps built on Bool — gateway data access, end-user auth, and the React auth layer.",
   "type": "module",
   "main": "./dist/index.js",

src/client.test.ts

@@ -199,6 +199,21 @@ describe("end-user auth (gateway users plane)", () => {
     expect(events).toHaveLength(1);
   });
 
+  test("onAuthStateChange still fires SIGNED_OUT when the session check rejects (no hang)", async () => {
+    // A cross-origin / network failure makes the /users/me fetch reject. Without
+    // a .catch the callback never fires, `loading` never clears, and <AuthGate>
+    // hangs on a blank screen forever — which is what left project-card
+    // screenshots capturing an empty background. Treat a rejection as signed-out.
+    globalThis.fetch = (async () => {
+      throw new TypeError("Failed to fetch");
+    }) as unknown as typeof fetch;
+    const client = createBoolClient(CONFIG);
+    const events: unknown[][] = [];
+    client.auth.onAuthStateChange((event, user) => events.push([event, user]));
+    await tick();
+    expect(events).toEqual([["SIGNED_OUT", null]]);
+  });
+
   test("resetPasswordForEmail always resolves ok (no account probing), even on server error", async () => {
     respond = () => new Response("boom", { status: 500 });
     const client = createBoolClient(CONFIG);