@tribe-nest/forge 3.29.0 → 3.31.0

package/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@tribe-nest/forge",
-  "version": "3.29.0",
+  "version": "3.31.0",
   "publishConfig": {
     "access": "public"
   },
-  "description": "Forge \u2014 the headless React SDK for building custom TribeNest creator sites (the Hydrogen of TribeNest). Exposes the backend (memberships, commerce, gated content, ticketing, courses, booking, auth) as data + behavior primitives.",
+  "description": "Forge: the headless React SDK for building custom TribeNest creator sites (the Hydrogen of TribeNest). Exposes the backend (memberships, commerce, gated content, ticketing, courses, booking, auth) as data + behavior primitives.",
   "exports": {
     ".": "./src/index.ts",
     "./ui": "./src/ui/index.ts",
     "./ui/headless": "./src/ui/headless/index.ts",
-    "./server": "./src/server/index.ts"
+    "./server": "./src/server/index.ts",
+    "./media": "./src/ui/media/index.ts"
   },
   "files": [
     "src"
@@ -26,6 +27,8 @@
     "@stripe/react-stripe-js": "^3.8.0",
     "@stripe/stripe-js": "^7.6.1",
     "@tanstack/react-query": "^5.62.7",
+    "@tribe-nest/media-client": "^0.1.0",
+    "@tribe-nest/media-protocol": "^1.0.0",
     "axios": "^1.7.9",
     "lucide-react": "^0.510.0",
     "react-hook-form": "^7.60.0",

package/src/_tests/publishedResolvability.spec.ts

@@ -0,0 +1,184 @@
+import { describe, expect, it } from "vitest";
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+
+/**
+ * Can a creator site actually INSTALL what this package imports?
+ *
+ * Forge is unusual twice over. It publishes RAW SOURCE (`"files": ["src"]`, an
+ * exports map pointing at `./src/...`, no build step), so every import in this
+ * tree is resolved by the CONSUMER'S bundler against the CONSUMER'S
+ * `node_modules` - not by anything in this repo. And a creator site is a
+ * site-starter fork whose `package.json` lists `@tribe-nest/forge` and nothing
+ * else, so the only packages present are Forge's own declared dependencies.
+ *
+ * Inside the monorepo none of that is visible: npm workspaces symlink every
+ * package in `packages/` into `node_modules`, so an import resolves whether or
+ * not it was ever declared, and whether or not the package it names is
+ * publishable at all. Every spec in this package, and every `check-types` run,
+ * passes under those symlinks.
+ *
+ * The failure this exists for actually shipped. `./media` - the entry point that
+ * holds `BookingCallProvider`, the ONLY surface that can enter a coaching video
+ * room - imports the two media packages, both of which were `"private": true`
+ * (so npm would never publish them) and declared only as OPTIONAL peer
+ * dependencies (so npm would never install them). `./media` is registered in
+ * `ENTRY_SUBPATHS` in
+ * `apps/backend/src/utils/forgeManifest.ts` precisely so the code agent learns
+ * it exists and writes `import { BookingCallProvider } from
+ * "@tribe-nest/forge/media"` - an import that failed at install on every real
+ * creator site, while the whole suite stayed green and the starter's release
+ * notes announced the feature.
+ *
+ * So there are two properties here and they are separate:
+ *
+ *  1. every bare import in the published tree names a package the consumer's
+ *     install will actually produce (a dependency, or a peer that npm installs
+ *     because it is NOT marked optional), and
+ *  2. every workspace package Forge depends on is one npm will publish.
+ *
+ * Specs are excluded: they never ship (`files` is `["src"]`, but a consumer
+ * never imports a `.spec` file), and they legitimately reach for vitest, jsdom
+ * and node builtins.
+ */
+
+const FORGE_ROOT = join(__dirname, "..", "..");
+const PACKAGES_ROOT = join(FORGE_ROOT, "..");
+
+type PackageJson = {
+  name: string;
+  private?: boolean;
+  files?: string[];
+  exports?: Record<string, unknown>;
+  dependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+  peerDependenciesMeta?: Record<string, { optional?: boolean }>;
+};
+
+const readPackage = (dir: string): PackageJson =>
+  JSON.parse(readFileSync(join(dir, "package.json"), "utf-8")) as PackageJson;
+
+const forge = readPackage(FORGE_ROOT);
+
+/**
+ * Provided by the runtime, never installed: `node:` builtins, and the
+ * `cloudflare:` virtual modules workerd resolves itself (Forge's server half
+ * runs on Workers).
+ */
+const isBuiltin = (specifier: string) => specifier.startsWith("node:") || specifier.startsWith("cloudflare:");
+
+const isRelative = (specifier: string) => specifier.startsWith(".") || specifier.startsWith("/");
+
+/** `@scope/name/deep/path` and `name/deep/path` both resolve to the PACKAGE. */
+const packageNameOf = (specifier: string): string => {
+  const parts = specifier.split("/");
+  return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0]!;
+};
+
+const isSpecFile = (path: string) => path.includes(`${"/"}_tests${"/"}`) || /\.(spec|test)\.[cm]?[jt]sx?$/.test(path);
+
+const sourceFiles = (dir: string, found: string[] = []): string[] => {
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    if (statSync(full).isDirectory()) {
+      sourceFiles(full, found);
+      continue;
+    }
+    if (!/\.[cm]?[jt]sx?$/.test(full)) continue;
+    if (isSpecFile(full)) continue;
+    found.push(full);
+  }
+  return found;
+};
+
+/**
+ * The module specifiers, and only those.
+ *
+ * Anchored at a statement start and unable to cross a `;`, because a bare
+ * `/from ["']/` also matches ordinary prose in a string literal - this package
+ * has several ("gone for the next few minutes"), and each one would arrive here
+ * looking like an undeclared dependency.
+ */
+const IMPORT_PATTERNS = [
+  // `import … from "x"` / `export … from "x"`, including the multi-line form.
+  /(?:^|\n)[ \t]*(?:import|export)\s[^;]*?\bfrom\s*["']([^"']+)["']/g,
+  // Side-effect import: `import "x";`
+  /(?:^|\n)[ \t]*import\s*["']([^"']+)["']/g,
+  // `import("x")` and `require("x")`.
+  /\b(?:import|require)\s*\(\s*["']([^"']+)["']\s*\)/g,
+];
+
+const specifiersIn = (contents: string): string[] =>
+  IMPORT_PATTERNS.flatMap((pattern) => [...contents.matchAll(pattern)].map((match) => match[1]!));
+
+const importedPackages = (): Map<string, string[]> => {
+  const byPackage = new Map<string, string[]>();
+  for (const file of sourceFiles(join(FORGE_ROOT, "src"))) {
+    const contents = readFileSync(file, "utf-8");
+    for (const specifier of specifiersIn(contents)) {
+      if (isRelative(specifier) || isBuiltin(specifier)) continue;
+      const name = packageNameOf(specifier);
+      // `@tribe-nest/forge` importing itself only ever happens in a spec, but
+      // guard it anyway: a self-reference resolves through the exports map.
+      if (name === forge.name) continue;
+      const files = byPackage.get(name) ?? [];
+      files.push(file.slice(FORGE_ROOT.length + 1));
+      byPackage.set(name, files);
+    }
+  }
+  return byPackage;
+};
+
+describe("what a creator site's install has to produce", () => {
+  it("declares every package the published tree imports", () => {
+    const declared = new Set([
+      ...Object.keys(forge.dependencies ?? {}),
+      // A peer npm INSTALLS. An optional one is exactly the hole this closes:
+      // npm skips it, and the import it serves is unresolved on every site.
+      ...Object.keys(forge.peerDependencies ?? {}).filter((name) => !forge.peerDependenciesMeta?.[name]?.optional),
+    ]);
+
+    const undeclared = [...importedPackages()]
+      .filter(([name]) => !declared.has(name))
+      .map(([name, files]) => `${name} (imported by ${files[0]})`);
+
+    expect(undeclared).toEqual([]);
+  });
+
+  it("depends only on workspace packages npm will publish", () => {
+    const workspaceDeps = Object.keys(forge.dependencies ?? {}).filter((name) => name.startsWith("@tribe-nest/"));
+    // Not a vacuous pass: `./media` puts two of these in the tree, and a
+    // regression that removed them would be caught by the test above instead.
+    expect(workspaceDeps.length).toBeGreaterThan(0);
+
+    for (const name of workspaceDeps) {
+      const dir = join(PACKAGES_ROOT, name.replace("@tribe-nest/", ""));
+      expect(existsSync(dir), `${name} is not a package in packages/`).toBe(true);
+
+      const dependency = readPackage(dir);
+      // `"private": true` makes `npm publish` refuse outright, so the consumer's
+      // install 404s on a package that looks perfectly declared here.
+      expect(dependency.private, `${name} is private and can never be installed`).not.toBe(true);
+      // Its published artifact has to carry whatever its exports map points at.
+      expect(dependency.files ?? [], `${name} publishes no files`).not.toEqual([]);
+    }
+  });
+
+  it("points every entry subpath at a file that exists", () => {
+    for (const [subpath, target] of Object.entries(forge.exports ?? {})) {
+      expect(typeof target, `${subpath} has a non-string target`).toBe("string");
+      expect(existsSync(join(FORGE_ROOT, target as string)), `${subpath} -> ${target}`).toBe(true);
+    }
+  });
+
+  /**
+   * `./media` is the entry the code agent is TOLD about: it is registered in
+   * `ENTRY_SUBPATHS` in `apps/backend/src/utils/forgeManifest.ts`, so the agent
+   * writes imports against it. Dropping it from the exports map here would make
+   * every one of those imports unresolvable while the manifest went on
+   * advertising them.
+   */
+  it("still exports the media entry the Forge manifest advertises", () => {
+    expect(forge.exports?.["./media"]).toBe("./src/ui/media/index.ts");
+  });
+});

package/src/_tests/specsRunWorkspaceSource.spec.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it } from "vitest";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+
+import { WORKSPACE_SOURCE_ALIASES } from "./workspaceAliases";
+
+/**
+ * Which ARTIFACT do these specs run?
+ *
+ * `@tribe-nest/media-client` and `@tribe-nest/media-protocol` publish an
+ * exports map whose conditions are `{ types, module, default }`, and under
+ * vitest the `default` branch wins: every spec in this package was importing
+ * `media-client/build/react/index.js`, the previous COMPILATION of the very
+ * file a change to the call UI is editing. `build/` is gitignored, so the code
+ * under test was whatever that machine last compiled.
+ *
+ * It is not theoretical. Reintroducing the historical
+ * `[...room.localPublications]` selector into `src/react/index.tsx` - the exact
+ * mutation `ui/media/_tests/CallStage.spec.tsx`'s anti-loop guard exists to
+ * catch - left all 14 of its tests green. Applying it to `build/react/index.js`
+ * turned all 14 red. The guard the whole file is built around was guarding a
+ * stale copy.
+ *
+ * A root `turbo run test` builds first (`dependsOn: ["^build"]`), so CI never
+ * saw it. The per-package `npm run test` and the watch loop - where the
+ * iteration actually happens - did.
+ *
+ * So: every workspace package this one depends on whose exports point at
+ * `build/` must be aliased to its SOURCE in `vitest.config.mts`. This test is
+ * what makes adding the next such dependency fail loudly rather than silently
+ * testing yesterday's compilation of it.
+ */
+
+const FORGE_ROOT = join(__dirname, "..", "..");
+const PACKAGES_ROOT = join(FORGE_ROOT, "..");
+
+type ExportTarget = string | Record<string, string>;
+type PackageJson = {
+  name: string;
+  exports?: Record<string, ExportTarget>;
+  dependencies?: Record<string, string>;
+};
+
+const readPackage = (dir: string): PackageJson =>
+  JSON.parse(readFileSync(join(dir, "package.json"), "utf-8")) as PackageJson;
+
+const forge = readPackage(FORGE_ROOT);
+
+/** The array `vitest.config.mts` hands to `resolve.alias`, not a copy of it. */
+const aliases = () => WORKSPACE_SOURCE_ALIASES;
+
+const matches = (find: RegExp | string, specifier: string): boolean =>
+  typeof find === "string" ? specifier.startsWith(find) : find.test(specifier);
+
+/** Every subpath a package publishes, as the specifier a spec would import. */
+const subpathSpecifiers = (pkg: PackageJson): { specifier: string; target: ExportTarget }[] =>
+  Object.entries(pkg.exports ?? {}).map(([subpath, target]) => ({
+    specifier: subpath === "." ? pkg.name : `${pkg.name}/${subpath.replace(/^\.\//, "")}`,
+    target,
+  }));
+
+/** Does resolving this entry land in a compiled artifact rather than in `src`? */
+const resolvesToBuild = (target: ExportTarget): boolean => {
+  const candidate = typeof target === "string" ? target : target.default;
+  return typeof candidate === "string" && candidate.includes("build/");
+};
+
+describe("the specs in this package run the source, not a stale build", () => {
+  const workspaceDeps = Object.keys(forge.dependencies ?? {}).filter((name) => name.startsWith("@tribe-nest/"));
+
+  it("has workspace dependencies to check, so this is not vacuous", () => {
+    expect(workspaceDeps.length).toBeGreaterThan(0);
+  });
+
+  it("is the list the runner actually uses", () => {
+    // Read as TEXT because `tsc` refuses an import path ending in `.mts`. The
+    // point is that the array asserted below is the one wired into
+    // `resolve.alias`, and not a module the config stopped importing.
+    const config = readFileSync(join(FORGE_ROOT, "vitest.config.mts"), "utf-8");
+    expect(config).toContain("WORKSPACE_SOURCE_ALIASES");
+    expect(config).toMatch(/resolve:\s*{\s*alias:\s*WORKSPACE_SOURCE_ALIASES/);
+  });
+
+  it("aliases every build-first workspace entry point to its source", () => {
+    const unaliased: string[] = [];
+
+    for (const name of workspaceDeps) {
+      const dir = join(PACKAGES_ROOT, name.replace("@tribe-nest/", ""));
+      if (!existsSync(dir)) continue;
+
+      for (const { specifier, target } of subpathSpecifiers(readPackage(dir))) {
+        if (!resolvesToBuild(target)) continue;
+        if (!aliases().some((alias) => matches(alias.find, specifier))) unaliased.push(specifier);
+      }
+    }
+
+    expect(unaliased).toEqual([]);
+  });
+
+  it("points every alias at a file that exists", () => {
+    for (const alias of aliases()) {
+      expect(existsSync(alias.replacement), `${String(alias.find)} -> ${alias.replacement}`).toBe(true);
+      expect(alias.replacement, `${String(alias.find)} is aliased to a build artifact`).not.toContain("/build/");
+    }
+  });
+
+  it("does not let the bare package alias swallow its own subpaths", () => {
+    // `{ find: "@tribe-nest/media-client" }` as a plain string is a PREFIX
+    // match, so it would rewrite `@tribe-nest/media-client/react` to
+    // `.../src/index.ts/react`. Anchored patterns are what keep the subpaths
+    // reachable, and this is the mistake that silently un-does the fix above.
+    const bare = aliases().find((alias) => matches(alias.find, "@tribe-nest/media-client"));
+    expect(bare, "media-client has no alias at all").toBeDefined();
+    expect(matches(bare!.find, "@tribe-nest/media-client/react")).toBe(false);
+  });
+});

package/src/_tests/workspaceAliases.ts

@@ -0,0 +1,40 @@
+import { fileURLToPath } from "node:url";
+
+/**
+ * Which ARTIFACT the specs in this package run.
+ *
+ * `@tribe-nest/media-client` and `@tribe-nest/media-protocol` publish an
+ * exports map whose conditions are `{ types, module, default }`, and under
+ * vitest the `default` branch wins: every spec here was importing
+ * `media-client/build/react/index.js`, the previous COMPILATION of the very
+ * file a change to the call UI edits. `build/` is gitignored, so the code under
+ * test was whatever that machine last compiled.
+ *
+ * It is not theoretical. Reintroducing the historical
+ * `[...room.localPublications]` selector into `media-client/src/react/index.tsx`
+ * - the exact mutation `ui/media/_tests/CallStage.spec.tsx`'s anti-loop guard
+ * exists to catch - left all 14 of its tests green. Applying the same edit to
+ * `build/react/index.js` turned all 14 red.
+ *
+ * A root `turbo run test` builds first (`dependsOn: ["^build"]`), so CI never
+ * saw it; the per-package `npm run test` and the watch loop, where the
+ * iteration actually happens, did.
+ *
+ * Lives in `src/` rather than beside the config because `vitest.config.mts`
+ * cannot be imported from a spec (`tsc` refuses a `.mts` import path), and
+ * `specsRunWorkspaceSource.spec.ts` has to read the same list the runner uses
+ * or it is checking its own copy.
+ */
+
+/** Exact-match patterns, so the bare package does not swallow its subpaths. */
+export const WORKSPACE_SOURCE_ALIASES: { find: RegExp; replacement: string }[] = [
+  ["@tribe-nest/media-client", "../../../media-client/src/index.ts"],
+  ["@tribe-nest/media-client/react", "../../../media-client/src/react/index.tsx"],
+  ["@tribe-nest/media-client/core", "../../../media-client/src/core/index.ts"],
+  ["@tribe-nest/media-client/protocol", "../../../media-client/src/protocol.ts"],
+  ["@tribe-nest/media-protocol", "../../../media-protocol/src/index.ts"],
+  ["@tribe-nest/media-protocol/token", "../../../media-protocol/src/token.ts"],
+].map(([specifier, path]) => ({
+  find: new RegExp(`^${specifier!.replace(/[/\\^$*+?.()|[\]{}]/g, "\\$&")}$`),
+  replacement: fileURLToPath(new URL(path!, import.meta.url)),
+}));

package/src/contexts/PublicAuthContext.tsx

@@ -245,9 +245,35 @@ function PublicAuthProvider({ children }: AuthProviderProps) {
     await client.post("/public/sessions/resend-code", { email, profileId });
   };
 
+  /**
+   * Re-read the signed-in member from the PUBLIC lane.
+   *
+   * ## `/public/accounts/me`, never `/accounts/me`
+   *
+   * This used to call the dashboard endpoint, which signed a fan out every time
+   * it ran. A fan session is minted by `mintAssociationSession` and its JWT
+   * carries an `associationId`; `requireAuthentication` rejects any token
+   * carrying one outright, by design, because honouring it on the admin surface
+   * would hand the caller that account's full dashboard permissions. So the
+   * call could only ever 401, the catch below read that as "not signed in", and
+   * the member was thrown back to the login page while a perfectly good token
+   * sat in localStorage. It bit hardest right after joining a membership, where
+   * the account page refetches on arrival.
+   *
+   * The 401 was also charged twice: the axios refresh interceptor treated it as
+   * an expired access token, spent a refresh-token rotation on it, and retried
+   * into the same 401.
+   *
+   * ## A failed refetch is not a logout
+   *
+   * Only an authentication failure clears the session now. A network blip or a
+   * 500 leaves the member exactly as they were, because dropping someone's
+   * session over a flaky response is a worse answer than showing them slightly
+   * stale details.
+   */
   const refetchUser = async () => {
     try {
-      const response = await client.get("/accounts/me", {
+      const response = await client.get("/public/accounts/me", {
         params: {
           profileId: profileId,
         },
@@ -258,10 +284,13 @@ function PublicAuthProvider({ children }: AuthProviderProps) {
       });
     } catch (error: unknown) {
       console.error(error);
-      dispatch({
-        type: Types.Initial,
-        payload: { isAuthenticated: false, user: null },
-      });
+      const status = (error as { response?: { status?: number } })?.response?.status;
+      if (status === 401 || status === 403) {
+        dispatch({
+          type: Types.Initial,
+          payload: { isAuthenticated: false, user: null },
+        });
+      }
     }
   };
 

package/src/contexts/_tests/PublicAuthRefetch.spec.tsx

@@ -0,0 +1,147 @@
+// @vitest-environment jsdom
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { act, renderHook, waitFor } from "@testing-library/react";
+import axios, { type AxiosAdapter, type InternalAxiosRequestConfig } from "axios";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { ReactNode } from "react";
+import { ForgeClientProvider } from "../../provider/ForgeProvider";
+import { PublicAuthProvider, usePublicAuth, PUBLIC_ACCESS_TOKEN_KEY } from "../PublicAuthContext";
+
+/**
+ * `refetchUser`, which used to sign the member out every time it ran.
+ *
+ * A fan session is minted by the public surface and its JWT carries an
+ * `associationId`. `requireAuthentication` refuses any token carrying one, on
+ * purpose: honouring it on the admin surface would hand the caller that
+ * account's whole dashboard. So `GET /accounts/me` could only ever answer 401
+ * for a fan, and `refetchUser`'s catch read that as "not signed in".
+ *
+ * It bit hardest immediately after joining a membership, because the account
+ * page refetches the member on arrival: finish signup, land on the account
+ * page, get bounced to login with a perfectly good token still in localStorage.
+ *
+ * The adapter is swapped rather than the module mocked, so the assertion is on
+ * the URL that actually went out.
+ */
+
+const PROFILE_ID = "profile-1";
+
+const member = {
+  id: "account-1",
+  email: "fan@example.com",
+  firstName: "Fan",
+  lastName: "Person",
+  kind: "fan",
+  status: "active",
+  createdAt: "2026-01-01T00:00:00.000Z",
+  updatedAt: "2026-01-01T00:00:00.000Z",
+  membership: { id: "m-1", membershipTierId: "tier-1", status: "active" },
+};
+
+let requested: string[] = [];
+let realAdapter: AxiosAdapter | undefined;
+
+/**
+ * Answers the member on the PUBLIC endpoint and refuses the admin one exactly
+ * as the backend does, so a spec cannot pass by calling the wrong one.
+ *
+ * `refetchStatus` applies from the SECOND `/public/accounts/me` onwards: the
+ * first is the provider's own `initialize`, and failing that would sign the
+ * member out before `refetchUser` was ever reached, which is a different test.
+ */
+function installAdapter(opts: { refetchStatus?: number } = {}) {
+  requested = [];
+  let meCalls = 0;
+  const adapter: AxiosAdapter = async (config: InternalAxiosRequestConfig) => {
+    const url = config.url ?? "";
+    requested.push(url);
+    const ok = (data: unknown) =>
+      Promise.resolve({ data, status: 200, statusText: "OK", headers: {}, config } as never);
+    const fail = (status: number) =>
+      Promise.reject(
+        Object.assign(new Error(`Request failed with status code ${status}`), {
+          response: { status, data: { message: "nope" }, headers: {}, config },
+          config,
+          isAxiosError: true,
+        }),
+      );
+
+    if (url.includes("/public/accounts/me")) {
+      meCalls += 1;
+      return opts.refetchStatus && meCalls > 1 ? fail(opts.refetchStatus) : ok(member);
+    }
+    // The dashboard lane. A fan token is rejected here by design.
+    if (url.includes("/accounts/me")) return fail(401);
+    if (url.includes("/public/currencies")) {
+      return ok({ supportedCurrencies: ["USD"], userCurrency: "USD", exchangeRates: {} });
+    }
+    return ok({});
+  };
+  realAdapter = axios.defaults.adapter as AxiosAdapter | undefined;
+  axios.defaults.adapter = adapter;
+}
+
+const wrapper = ({ children }: { children: ReactNode }) => (
+  <QueryClientProvider client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}>
+    <ForgeClientProvider apiUrl="http://api.test" profileId={PROFILE_ID}>
+      <PublicAuthProvider>{children}</PublicAuthProvider>
+    </ForgeClientProvider>
+  </QueryClientProvider>
+);
+
+beforeEach(() => {
+  localStorage.clear();
+  localStorage.setItem(PUBLIC_ACCESS_TOKEN_KEY, "fan-access-token");
+});
+
+afterEach(() => {
+  if (realAdapter) axios.defaults.adapter = realAdapter;
+  localStorage.clear();
+});
+
+describe("refetchUser", () => {
+  it("REGRESSION: re-reads the member from the public lane and keeps them signed in", async () => {
+    installAdapter();
+    const { result } = renderHook(() => usePublicAuth(), { wrapper });
+
+    await waitFor(() => expect(result.current.isInitialized).toBe(true));
+    await act(async () => {
+      await result.current.refetchUser();
+    });
+
+    expect(requested.some((url) => url.includes("/public/accounts/me"))).toBe(true);
+    // The dashboard endpoint is never touched: it 401s a fan token by design,
+    // which is exactly how this became a logout.
+    expect(requested.some((url) => url === "/accounts/me")).toBe(false);
+    expect(result.current.isAuthenticated).toBe(true);
+    expect(result.current.user?.email).toBe("fan@example.com");
+  });
+
+  it("keeps the member signed in when the refetch fails for a reason that is not auth", async () => {
+    // A 500 or a dropped connection is not evidence that anyone is signed out.
+    // Showing slightly stale details beats throwing someone back to the login
+    // page because one request wobbled.
+    installAdapter({ refetchStatus: 500 });
+    const { result } = renderHook(() => usePublicAuth(), { wrapper });
+
+    await waitFor(() => expect(result.current.isInitialized).toBe(true));
+    await act(async () => {
+      await result.current.refetchUser();
+    });
+
+    expect(result.current.isAuthenticated).toBe(true);
+  });
+
+  it("does sign the member out when the server actually rejects the token", async () => {
+    installAdapter({ refetchStatus: 401 });
+    const { result } = renderHook(() => usePublicAuth(), { wrapper });
+
+    await waitFor(() => expect(result.current.isInitialized).toBe(true));
+    await act(async () => {
+      await result.current.refetchUser();
+    });
+
+    expect(result.current.isAuthenticated).toBe(false);
+    expect(result.current.user).toBeNull();
+  });
+});