@rebasepro/client 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/websocket.d.ts

@@ -27,6 +27,17 @@ export declare class RebaseWebSocketClient {
     private channelHandlers;
     /** Set by `close()`. Blocks any later operation from silently redialling. */
     private closedByCaller;
+    /**
+     * Set when the backoff budget ran out, cleared by anything that earns a
+     * fresh one.
+     *
+     * Unlike {@link closedByCaller} this is not final — nobody *asked* for the
+     * socket to stay down. Five attempts with exponential backoff is about a
+     * minute, which a laptop lid, a wifi handover or a backend rollout all
+     * exceed routinely; treating that as permanent meant realtime silently
+     * stopped for the rest of the page's life, with a reload the only cure.
+     */
+    private gaveUp;
     /**
      * Whether a socket exists at all (open or still opening).
      *
@@ -68,6 +79,13 @@ export declare class RebaseWebSocketClient {
      * re-entrant, since the reconnect path has always called it.
      */
     ensureConnected(): void;
+    /**
+     * The browser says the network is back — the usual reason the budget ran
+     * out in the first place. Registered lazily so a Node client, or a page
+     * that never subscribes, adds no listener.
+     */
+    private installOnlineListener;
+    private onlineListener;
     /**
      * Authenticate the WebSocket connection
      */
@@ -97,6 +115,7 @@ export declare class RebaseWebSocketClient {
     private resubscribeAfterAuthRefresh;
     private handleWebSocketMessage;
     private ensureAuthenticated;
+    private runAuthentication;
     reauthenticate(): Promise<void>;
     /**
      * Public because `RebaseRealtimeChannel` sends channel frames through it.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/client",
   "type": "module",
-  "version": "0.12.1-canary.gf5f1d39",
+  "version": "0.13.0",
   "description": "HTTP SDK client for the Rebase custom backend",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -29,23 +29,23 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@rebasepro/common": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/types": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/utils": "0.12.1-canary.gf5f1d39"
+    "@rebasepro/common": "0.13.0",
+    "@rebasepro/utils": "0.13.0",
+    "@rebasepro/types": "0.13.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.1.2",
     "@types/ws": "^8.18.1",
     "cross-env": "^10.1.0",
     "fake-indexeddb": "^6.2.5",
     "jest": "^30.4.2",
-    "ts-jest": "^29.4.11",
+    "ts-jest": "^29.4.12",
     "tsd": "^0.33.0",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16",
-    "ws": "^8.21.0"
+    "vite": "^8.1.5",
+    "ws": "^8.21.1"
   },
   "files": [
     "dist",

package/src/auth.ts

@@ -4,11 +4,6 @@ import type { AuthChangeEvent, RebaseSession, AuthTokens, DeviceSession, User }
 // Re-export canonical types so `import { RebaseSession } from "@rebasepro/client"` keeps working
 export type { RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
 
-/** @deprecated Use `User` from `@rebasepro/types` instead. */
-export type RebaseUser = User;
-/** @deprecated Use `AuthTokens` from `@rebasepro/types` instead. */
-export type RebaseTokens = AuthTokens;
-
 /** Minimal, non-sensitive user profile returned by {@link findUserByEmail}. */
 export interface PublicUserProfile {
     uid: string;
@@ -268,6 +263,30 @@ export function createAuth(transport: Transport, options?: CreateAuthOptions) {
         refreshTimeout = setTimeout(() => { void attemptScheduledRefresh(0); }, delay);
     }
 
+    /**
+     * Stop the scheduled token refresh, leaving the session itself alone.
+     *
+     * This is teardown, not sign-out. `scheduleRefresh` arms an ordinary
+     * `setTimeout` up to a token lifetime away, and it is not `unref`'d — so on
+     * Node it holds the event loop open by itself. `client.close()` promised
+     * that "a script that does not call this will not exit on its own", which
+     * was true, while the converse it plainly implies was not: a signed-in
+     * client that closed its socket still hung, because this timer outlived it.
+     * Any script, cron handler or job that signs in hit that.
+     *
+     * Deliberately does NOT clear the session, touch storage, or emit
+     * SIGNED_OUT. Closing a client is not the user signing out — `signOut()`
+     * POSTs /logout and revokes the whole sign-in, which is the wrong hammer
+     * (see `abandonSessionLocally`) — and a persisted session must still be
+     * there for the next client to restore.
+     */
+    function stopAutoRefresh() {
+        if (refreshTimeout) {
+            clearTimeout(refreshTimeout);
+            refreshTimeout = null;
+        }
+    }
+
     function handleAuthResponse(data: { tokens: AuthTokens, user: Record<string, unknown> }, event?: AuthChangeEvent): RebaseSession {
         const user: User = mapRawUser(data.user);
         const session: RebaseSession = {
@@ -796,6 +815,7 @@ refreshToken: session.refreshToken };
         signInWithSlack,
         signInWithSpotify,
         signOut,
+        stopAutoRefresh,
         refreshSession,
         handleUnauthorized,
         getUser,
@@ -815,6 +835,11 @@ refreshToken: session.refreshToken };
         getAuthConfig,
         getSession,
         onAuthStateChange,
+        // A client that neither persists sessions nor uses cookie auth has
+        // nowhere to restore one from, so "no session in memory" is the final
+        // answer rather than a reason to ask the server. See the docblock on
+        // `AuthClient.canRestoreSession`.
+        canRestoreSession: () => persistSession || authFlowMode === "cookie",
         isInitialized: () => isInitialized
     };
 }

package/src/client-close.test.ts

@@ -0,0 +1,80 @@
+import { jest } from "@jest/globals";
+import { createRebaseClient } from "./index";
+
+/**
+ * `close()` has one job: leave nothing behind that can keep a process alive.
+ *
+ * The realtime socket is the obvious such handle and was the only one this
+ * method released. The scheduled token refresh is the other, and it is easy to
+ * miss because it only exists once somebody signs in: `scheduleRefresh` arms a
+ * plain `setTimeout` for roughly the access token's lifetime, and it is not
+ * `unref`'d. So a signed-in Node client — a seed script, a cron handler, a job,
+ * an SSR request — released its socket, called `close()` exactly as documented,
+ * and still hung until the token would have expired.
+ *
+ * Found by `e2e/tests/client-sdk-e2e.ts`, which reported every check green and
+ * then never exited. Pinned here rather than only there because that suite needs
+ * Docker and a real Postgres, and this costs nothing.
+ *
+ * The assertion is the pending timer count, not a spy on `stopAutoRefresh`:
+ * what matters is that no handle survives, not which internal call removed it.
+ */
+describe("client.close()", () => {
+    const realFetch = globalThis.fetch;
+
+    afterEach(() => {
+        globalThis.fetch = realFetch;
+        jest.useRealTimers();
+        jest.restoreAllMocks();
+    });
+
+    /** A login response shaped exactly as `handleAuthResponse` reads it. */
+    function loginResponse(accessTokenExpiresAt: number) {
+        return new Response(
+            JSON.stringify({
+                tokens: { accessToken: "access-token",
+refreshToken: "refresh-token",
+accessTokenExpiresAt },
+                user: { uid: "user-1",
+email: "user@example.test" }
+            }),
+            { status: 200,
+headers: { "content-type": "application/json" } }
+        );
+    }
+
+    it("clears the scheduled token refresh, so a signed-in script can exit", async () => {
+        jest.useFakeTimers();
+
+        // An hour out, so the refresh is scheduled rather than fired
+        // immediately — `scheduleRefresh` runs the refresh inline when the
+        // delay has already elapsed, which would arm no timer and let a broken
+        // `close()` pass this test.
+        const expiresAt = Date.now() + 60 * 60 * 1000;
+        globalThis.fetch = jest.fn(async () => loginResponse(expiresAt)) as unknown as typeof fetch;
+
+        // `realtime: false` so the socket cannot account for a pending handle:
+        // the only thing this test may observe is the refresh timer.
+        const client = createRebaseClient({ baseUrl: "http://localhost:9999",
+realtime: false });
+
+        await client.auth.signInWithEmail("user@example.test", "password");
+        expect(jest.getTimerCount()).toBeGreaterThan(0);
+
+        client.close();
+        expect(jest.getTimerCount()).toBe(0);
+    });
+
+    it("is safe on a client that never signed in, and safe to call twice", () => {
+        jest.useFakeTimers();
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:9999",
+realtime: false });
+
+        expect(() => {
+            client.close();
+            client.close();
+        }).not.toThrow();
+        expect(jest.getTimerCount()).toBe(0);
+    });
+});

package/src/collection.test.ts

@@ -236,18 +236,58 @@ hasMore: false }
         });
     });
 
-    describe("count() is defined", () => {
-        it("should have count as a defined function on the accessor", () => {
-            const client = createCollectionClient(transport, "products");
-            expect(typeof client.count).toBe("function");
-            expect(client.count).toBeDefined();
+    /**
+     * `listen()` branches on `client.count` being present, and consumers such
+     * as EntitiesCount do the same. Asserting `typeof client.count ===
+     * "function"` on an object literal the factory just built cannot fail;
+     * what can regress is the branch downstream of it — whether the
+     * authoritative total actually reaches the subscriber, or whether the
+     * heuristic row count silently stands in for it.
+     */
+    describe("listen() total comes from count()", () => {
+        /** A WS double that hands the collection callback one page of rows. */
+        function wsDeliveringRows(rows: Record<string, unknown>[]) {
+            let emit: ((rows: Record<string, unknown>[]) => void) | undefined;
+            const ws = {
+                listenCollection: jest.fn((_params: unknown, onUpdate: any) => {
+                    emit = onUpdate;
+                    return () => undefined;
+                })
+            };
+            return { ws: ws as any,
+deliver: () => emit!(rows) };
+        }
+
+        it("reports the authoritative count, not the number of rows delivered", async () => {
+            (transport.request as ReturnType<typeof jest.fn>).mockResolvedValue({ count: 137 });
+            const { ws, deliver } = wsDeliveringRows([{ id: "1" }, { id: "2" }]);
+
+            const client = createCollectionClient(transport, "products", ws);
+            const updates: any[] = [];
+            client.listen!({ limit: 2 }, (res) => { updates.push(res); });
+            deliver();
+            await new Promise(r => setImmediate(r));
+
+            expect(updates).toHaveLength(1);
+            expect(updates[0].meta.total).toBe(137);
+            // 0 + 2 < 137, so the page is not the end of the collection.
+            expect(updates[0].meta.hasMore).toBe(true);
         });
 
-        it("should pass the accessor.count truthiness check (used by EntitiesCount component)", () => {
-            const client = createCollectionClient(transport, "products");
-            // The EntitiesCount component does `if (accessor.count) { ... }`
-            // This verifies that check would pass
-            expect(!!client.count).toBe(true);
+        it("falls back to the row count when the count request fails", async () => {
+            (transport.request as ReturnType<typeof jest.fn>).mockRejectedValue(new Error("boom"));
+            const { ws, deliver } = wsDeliveringRows([{ id: "1" }, { id: "2" }]);
+
+            const client = createCollectionClient(transport, "products", ws);
+            const updates: any[] = [];
+            client.listen!({ limit: 2 }, (res) => { updates.push(res); });
+            deliver();
+            await new Promise(r => setImmediate(r));
+
+            expect(updates).toHaveLength(1);
+            expect(updates[0].meta.total).toBe(2);
+            // A full page with no authoritative total: assume there is more.
+            expect(updates[0].meta.hasMore).toBe(true);
         });
     });
 });

package/src/collection.ts

@@ -189,7 +189,13 @@ export function createCollectionClient<M extends Record<string, unknown> = Recor
             const countParams: FindParams<M> = {
                 ...params,
                 limit: undefined,
-                offset: undefined
+                offset: undefined,
+                // A count reads no relation data, so `include` can only add
+                // joins — and a join that does not match drops rows, which
+                // would make the total disagree with the `find()` it describes.
+                // Same reasoning as limit/offset: parameters that cannot affect
+                // the answer are not forwarded.
+                include: undefined
             };
             const qs = buildQueryString(countParams);
             const raw = await transport.request<{ count: number }>(basePath + "/count" + qs, { method: "GET" });

package/src/data-proxy.test.ts

@@ -32,12 +32,28 @@ describe("client.data proxy — strict mode (collections dictionary provided)",
         expect(typeof accessor.create).toBe("function");
     });
 
-    it("resolves a known camelCase key (blogPosts) via dictionary", () => {
-        // Should not throw — blogPosts is in the dictionary
-        const products = (client.data as Record<string, unknown>)["products"];
-        expect(products).toBeDefined();
-        const blogPosts = (client.data as Record<string, unknown>)["blogPosts"];
-        expect(blogPosts).toBeDefined();
+    it("resolves a known camelCase key (blogPosts) to the dictionary's slug", async () => {
+        // The accessor is always "defined"; the whole job of the dictionary is
+        // that `blogPosts` addresses `blog-posts` on the wire — and NOT the
+        // `blog_posts` that the untyped snake_case fallback would produce.
+        // A client of its own: the shared one above captured `globalThis.fetch`
+        // when this file was collected, which is before `beforeAll` swaps it.
+        const fetchMock = jest.fn<typeof fetch>(async () => new Response("{}"));
+        const wired = createRebaseClient({
+            baseUrl: "http://localhost:3000",
+            fetch: fetchMock as typeof fetch,
+            collections: { ...COLLECTIONS }
+        });
+
+        const products = (wired.data as Record<string, any>)["products"];
+        await products.find();
+        expect(String(fetchMock.mock.calls[0][0])).toContain("/data/products");
+
+        const blogPosts = (wired.data as Record<string, any>)["blogPosts"];
+        await blogPosts.find();
+        const url = String(fetchMock.mock.calls[1][0]);
+        expect(url).toContain("/data/blog-posts");
+        expect(url).not.toContain("blog_posts");
     });
 
     it("throws RebaseClientError on unknown key with suggestion", () => {

package/src/functions.ts

@@ -55,7 +55,15 @@ export function createFunctionsClient(transport: Transport): FunctionsClient {
             options?: FunctionInvokeOptions
         ): Promise<T> {
             const method = options?.method ?? "POST";
-            const subPath = options?.path ? `/${options.path.replace(/^\//, "")}` : "";
+            // A `path` that starts the query or fragment is appended as-is. Only a
+            // real sub-path gets a separator: inserting one before `?days=30` asks
+            // for `/functions/dashboard-stats/?days=30`, and the trailing slash
+            // misses the route, so a function that exists answers 404 — and the
+            // caller sees it as the backend being down rather than as a bad URL.
+            const rawPath = options?.path;
+            const subPath = rawPath
+                ? (/^[?#]/.test(rawPath) ? rawPath : `/${rawPath.replace(/^\//, "")}`)
+                : "";
             const routePath = `/functions/${encodeURIComponent(name)}${subPath}`;
 
             const init: RequestInit = { method };

package/src/index.ts

@@ -60,9 +60,10 @@ export { QueryBuilder, or, and, cond } from "@rebasepro/common";
 // Auth: session/token types, config, and the pluggable storage strategies.
 export { createCookieStorage, createMemoryStorage } from "./auth";
 export type { AuthConfig, AuthStorage, CookieStorageOptions, CreateAuthOptions } from "./auth";
-export type { RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
-/** @deprecated Import `User` / `AuthTokens` from `@rebasepro/types` instead. */
-export type { RebaseUser, RebaseTokens } from "./auth";
+// `User` is re-exported alongside the session types because `client.auth` hands
+// one back and a browser app installs `@rebasepro/client` only — `@rebasepro/types`
+// is a transitive dependency there, not something a consumer can import from.
+export type { User, RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
 
 // Control-plane client option/DTO types (the client instance exposes the impls).
 export type { CreateAdminOptions } from "./admin";
@@ -208,11 +209,17 @@ export type CreateRebaseClientResult<DB = Record<string, unknown>> = Omit<Rebase
         channel: (name: string, options?: ChannelOptions) => RebaseRealtimeChannel;
     };
     /**
-     * Release the realtime socket and its reconnect timer.
+     * Release everything this client holds that can keep a process alive: the
+     * realtime socket and its reconnect timer, channel presence heartbeats, the
+     * offline manager, and the scheduled token refresh.
      *
-     * An open socket keeps the Node event loop alive, so a script that does not
-     * call this will not exit on its own. Safe when realtime was never started
-     * (`realtime: false`), and safe to call twice.
+     * Each of those keeps the Node event loop alive on its own, so a script
+     * that does not call this will not exit — and, until the refresh timer was
+     * included, one that *did* call it still would not if it had signed in.
+     *
+     * Safe when realtime was never started (`realtime: false`), safe when
+     * signed out, and safe to call twice. It does not sign the user out: a
+     * persisted session survives for the next client to restore.
      */
     close: () => void;
     storage: StorageSource;
@@ -547,11 +554,11 @@ export function createRebaseClient<DB = Record<string, unknown>>(options: Create
             }
         },
         /**
-         * Release the realtime socket and its reconnect timer.
+         * Release every handle that can keep a process alive — see the
+         * `close` docblock on the client interface.
          *
-         * Until this returns, the open socket keeps the Node event loop alive
-         * and the process will not exit on its own. Safe to call when realtime
-         * was never started, and safe to call twice.
+         * Safe to call when realtime was never started, safe when signed out,
+         * and safe to call twice.
          */
         close: () => {
             // Channels hold presence heartbeat timers, which would otherwise
@@ -565,12 +572,19 @@ export function createRebaseClient<DB = Record<string, unknown>>(options: Create
             // The offline retry timer is unref'd but the `online` listener is
             // not, and neither should outlive the client.
             offlineManager?.dispose();
+            // The scheduled token refresh is a plain setTimeout up to a token
+            // lifetime away, and not unref'd — so on Node it holds the event
+            // loop open all by itself. Without this, closing a SIGNED-IN client
+            // released the socket and the process still never exited, which is
+            // the opposite of what this method exists to guarantee.
+            auth.stopAutoRefresh();
         },
         setToken: transport.setToken,
         setAuthTokenGetter: transport.setAuthTokenGetter,
         setOnUnauthorized: transport.setOnUnauthorized,
         resolveToken: transport.resolveToken,
         baseUrl: transport.baseUrl,
+        apiPath: transport.apiPath,
         collection,
         call: async <T = unknown>(endpoint: string, payload?: unknown): Promise<T> => {
             const prefix = endpoint.startsWith("/") ? "" : "/";

package/src/offline-idb-store.test.ts

@@ -189,9 +189,28 @@ async function clearOfflineQueue(): Promise<void> {
 describe("two tabs over one database", () => {
     beforeEach(clearOfflineQueue);
 
-    /** BroadcastChannel delivery is asynchronous; give it a macrotask or two. */
-    const settle = async () => {
-        for (let i = 0; i < 3; i++) await new Promise((resolve) => setTimeout(resolve, 0));
+    /**
+     * Wait until the other tab has caught up.
+     *
+     * BroadcastChannel delivery is asynchronous and the receiving tab then does
+     * its own IndexedDB work, so there is no fixed number of turns that is
+     * both enough and not wasteful. Draining three macrotasks was enough on an
+     * idle machine and not enough when the other package suites run alongside
+     * this one — which is how this file failed under `pnpm -r test` while
+     * passing every time on its own.
+     *
+     * Polling a condition is what the test actually means, and it costs one
+     * turn in the common case rather than three.
+     */
+    const settleUntil = async (done: () => boolean | Promise<boolean>, deadlineMs = 5_000) => {
+        const started = Date.now();
+        for (;;) {
+            if (await done()) return;
+            if (Date.now() - started > deadlineMs) {
+                throw new Error(`condition never held within ${deadlineMs}ms`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 5));
+        }
     };
 
     function createServer() {
@@ -252,7 +271,7 @@ describe("two tabs over one database", () => {
 
         server.state.online = false;
         await postsA.create({ title: "from tab A" }, "xt1");
-        await settle();
+        await settleUntil(async () => (await postsB.find()).data.some((r) => r.id === "xt1"));
 
         // Without cross-tab propagation this tab would be showing a list that
         // is already wrong, and would keep showing it until a refetch.

package/src/realtime-concurrent-subscribe.test.ts

@@ -0,0 +1,102 @@
+import { jest } from "@jest/globals";
+
+/**
+ * A socket that opens on the next tick and answers `AUTHENTICATE` the way the
+ * server does: one `AUTH_SUCCESS` carrying the frame's own `requestId`.
+ */
+function fakeSocket() {
+    const sent: Record<string, unknown>[] = [];
+
+    class FakeWS {
+        static readonly OPEN = 1;
+        readyState = 1;
+        onopen: (() => void) | null = null;
+        onclose: (() => void) | null = null;
+        onerror: (() => void) | null = null;
+        onmessage: ((event: { data: string }) => void) | null = null;
+
+        constructor(public url: string) {
+            setTimeout(() => this.onopen?.(), 0);
+        }
+
+        send(raw: string) {
+            const message = JSON.parse(raw) as Record<string, unknown>;
+            sent.push(message);
+            if (message.type === "AUTHENTICATE") {
+                setTimeout(() => this.onmessage?.({
+                    data: JSON.stringify({ type: "AUTH_SUCCESS",
+requestId: message.requestId })
+                }), 0);
+            }
+        }
+
+        close() { /* noop */ }
+    }
+
+    return { FakeWS: FakeWS as unknown as typeof WebSocket,
+sent };
+}
+
+describe("concurrent subscriptions on a cold socket", () => {
+
+    beforeEach(() => jest.useFakeTimers());
+    afterEach(() => jest.useRealTimers());
+
+    it("sends every subscribe when several are queued before authentication", async () => {
+        // The Kanban board's shape: one subscription per column, all created in
+        // the same tick, all queued because the socket is still connecting.
+        //
+        // `ensureAuthenticated` read its in-flight guard, then awaited
+        // `getAuthToken()` before publishing it — so every caller that arrived
+        // during that gap saw no attempt in progress and started one of its
+        // own. Each attempt registered under `auth_${Date.now()}`, with no
+        // random suffix, so within a millisecond they collided in the
+        // `pendingRequests` map and only the last registration was ever
+        // settled. The rest awaited forever, and the `subscribe_collection`
+        // frames behind them were never sent: the board's columns reported
+        // "Subscription timed out" thirty seconds later.
+        const { RebaseWebSocketClient } = await import("./websocket");
+        const { FakeWS, sent } = fakeSocket();
+
+        // The socket authenticates itself on open, which would settle auth
+        // before anything queued got a chance to race. In a real page load the
+        // auth controller is still restoring the session at that point, so the
+        // first read yields nothing and the queued frames are what end up
+        // driving authentication — each of them separately.
+        let firstRead = true;
+        const getAuthToken = async () => {
+            if (firstRead) {
+                firstRead = false;
+                return null;
+            }
+            // Reading a token is asynchronous — this is the window during
+            // which concurrent callers used to each start their own attempt.
+            await new Promise(resolve => setTimeout(resolve, 5));
+            return "token";
+        };
+
+        const client = new RebaseWebSocketClient({
+            websocketUrl: "ws://localhost:1234",
+            WebSocket: FakeWS,
+            getAuthToken
+        });
+
+        const columns = ["open", "in_progress", "waiting", "resolved", "closed"];
+        for (const column of columns) {
+            client.listenCollection(
+                { path: "tickets",
+filter: { status: ["==", column] } } as never,
+                () => undefined,
+                () => undefined
+            );
+        }
+
+        await jest.advanceTimersByTimeAsync(50);
+
+        const subscribed = sent.filter(m => m.type === "subscribe_collection");
+        expect(subscribed).toHaveLength(columns.length);
+
+        // And exactly one authentication for all of them.
+        expect(sent.filter(m => m.type === "AUTHENTICATE")).toHaveLength(1);
+    });
+});

package/src/realtime-optout.test.ts

@@ -213,17 +213,51 @@ describe("realtime opt-out", () => {
         expect(opened).toHaveLength(0);
     });
 
-    it("signing in does not by itself open a socket", () => {
+    it("signing in does not by itself open a socket", async () => {
         // Authenticating is not a request for realtime. If it dialled, every
         // app with a login would lose lazy connect at the moment of login.
+        // Merely registering a listener does not show that: the SIGNED_IN
+        // branch that could dial is only reached by an actual sign-in.
         const { FakeWebSocket, opened } = trackingWebSocket();
         globalThis.WebSocket = FakeWebSocket;
 
-        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
-        // Drive the auth-state path the way a sign-in would.
-        client.auth.onAuthStateChange(() => { /* noop */ });
+        const loginBody = {
+            tokens: {
+                accessToken: "jwt",
+                refreshToken: "refresh",
+                accessTokenExpiresAt: Date.now() + 3600_000
+            },
+            user: { uid: "usr_1",
+email: "u@example.com",
+displayName: "U",
+photoURL: null,
+roles: ["user"],
+providerId: "local",
+isAnonymous: false }
+        };
+        const fetchMock = jest.fn(async () => ({
+            ok: true,
+            status: 200,
+            text: async () => JSON.stringify(loginBody),
+            json: async () => loginBody,
+            headers: new Headers()
+        })) as unknown as typeof globalThis.fetch;
+
+        const client = createRebaseClient({
+            baseUrl: "http://localhost:3000/api",
+            fetch: fetchMock
+        });
 
+        const events: string[] = [];
+        client.auth.onAuthStateChange((event) => { events.push(event); });
+
+        const result = await client.auth.signInWithEmail("u@example.com", "pw");
+
+        expect(result.user.uid).toBe("usr_1");
+        expect(events).toEqual(["SIGNED_IN"]);
         expect(opened).toHaveLength(0);
+
+        client.close();
     });
 
     it("leaves listen() absent so callers can feature-detect, and says why via the query builder", () => {