openvibe-sdk 0.51.1: sso GET /auth/me signed out answers 200 { user: null } (a 401 showed in every signed-out visitor's console) (#60)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 59d65a5..7661a09 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -3,6 +3,12 @@
  All notable changes to `openvibe-sdk`. The package follows semver; while it is `0.x`, a minor
  release may change an API and says so here.
  
++## 0.51.1 (2026-10-17)
++
++- `openvibe-sdk/sso`: `GET /auth/me` for a signed-out visitor (or an expired, foreign or non-session token) answers
++  `200 { user: null }` instead of 401, as Blog, Community and Wiki do. The shared navbar treats both the same; the 401
++  showed as a failed request in every signed-out visitor's console.
++
  ## 0.51.0 (2026-10-17)
  
  - `openvibe-sdk/commerce`: subscription tiers priced by OpenVibe.Billing (openvibe-contracts 0.201.0). `createIntent`
ddiff --git a/STATUS.json b/STATUS.json
iindex 979ce12..8506aac 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.51.0",
++  "version": "0.51.1",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex e48d1b4..a46369f 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.51.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.51.1, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, registry, modules, realtime, media, community, bot, search, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -42,7 +42,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.51.0';
++const SDK_VERSION = '0.51.1';
  
  module.exports = {
      createClient,
ddiff --git a/package-lock.json b/package-lock.json
iindex ab5f465..2801faa 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.51.0",
++  "version": "0.51.1",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.51.0",
++      "version": "0.51.1",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex e287d71..7ce02cc 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.51.0",
++  "version": "0.51.1",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex eb170a1..151fe0a 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.51.0';
++const SDK_VERSION = '0.51.1';
  
  module.exports = {
      createClient,
ddiff --git a/src/sso/index.js b/src/sso/index.js
iindex 884c83a..458911b 100644
---- a/src/sso/index.js
++++ b/src/sso/index.js
@@@ -292,7 +292,9 @@ function createSsoClient(opts = {}) {
  
          async me(req, res) {
              const claims = await verify(extractToken(req));
--            if (!claims) return res.status(401).json({ error: 'Not signed in' });
++            // Signed out answers 200 with no user, as Blog, Community and Wiki do: the shared navbar reads this on every page,
++            // and a 401 showed as a failed request in every signed-out visitor's console.
++            if (!claims) return res.json({ user: null });
              return res.json({ user: claimsToUser(claims), expires_at: claims.exp ? claims.exp * 1000 : null });
          },
  
ddiff --git a/test/sso.test.js b/test/sso.test.js
iindex a65f94e..a3fc05b 100644
---- a/test/sso.test.js
++++ b/test/sso.test.js
@@@ -101,7 +101,7 @@ run([
          for (const [what, tok] of [['a FedCM assertion', session({ typ: 'fedcm', nonce: 'n' })], ['a service token', session({ sub: 'svc:live', actor_type: 'service' })], ['expired', session({ exp: now() - 600 })], ['another audience', session({ aud: ['openvibe.elsewhere'] })]]) {
              const r = fakeRes();
              await sso.handlers.me({ headers: { authorization: `Bearer ${tok}` } }, r);
--            assert.equal(r.statusCode, 401, what);
++            assert.deepEqual([r.statusCode, r.body.user], [200, null], `${what}: signed out answers 200 with no user`);
          }
          const req = { headers: { authorization: `Bearer ${session()}` } };
          await new Promise((done) => sso.optionalAuth()(req, {}, done));