kitcn 0.12.8 → 0.12.10

package/dist/auth/client/index.js

@@ -52,6 +52,13 @@ function ConvexAuthProviderInner({ children, client, authClient }) {
 	const pendingTokenRef = useRef(null);
 	sessionRef.current = session;
 	isPendingRef.current = isPending;
+	const getCachedJwt = useCallback((minTimeRemainingMs = 0) => {
+		const cachedToken = authStore.get("token");
+		if (!cachedToken) return null;
+		const expiresAt = decodeJwtExp(cachedToken);
+		if (expiresAt === null || expiresAt <= Date.now() + minTimeRemainingMs) return null;
+		return cachedToken;
+	}, [authStore]);
 	useEffect(() => {
 		if (hasActiveSessionData(session)) {
 			authStore.set("sessionSyncGraceUntil", null);
@@ -86,11 +93,23 @@ function ConvexAuthProviderInner({ children, client, authClient }) {
 					authStore.set("sessionSyncGraceUntil", null);
 					return jwt;
 				}
+				const cachedJwt = getCachedJwt();
+				if (cachedJwt) {
+					authStore.set("expiresAt", decodeJwtExp(cachedJwt));
+					authStore.set("sessionSyncGraceUntil", null);
+					return cachedJwt;
+				}
 				authStore.set("token", null);
 				authStore.set("expiresAt", null);
 				authStore.set("sessionSyncGraceUntil", null);
 				return null;
 			}).catch((error) => {
+				const cachedJwt = getCachedJwt();
+				if (cachedJwt) {
+					authStore.set("expiresAt", decodeJwtExp(cachedJwt));
+					authStore.set("sessionSyncGraceUntil", null);
+					return cachedJwt;
+				}
 				authStore.set("token", null);
 				authStore.set("expiresAt", null);
 				authStore.set("sessionSyncGraceUntil", null);
@@ -102,9 +121,10 @@ function ConvexAuthProviderInner({ children, client, authClient }) {
 			return pendingTokenRef.current;
 		};
 		const fetchFreshTokenForced = async () => {
+			const cachedJwt = getCachedJwt();
 			if (pendingTokenRef.current) {
 				const token = await pendingTokenRef.current;
-				if (token) return token;
+				if (token && (!cachedJwt || token !== cachedJwt)) return token;
 			}
 			return fetchFreshToken();
 		};
@@ -114,16 +134,16 @@ function ConvexAuthProviderInner({ children, client, authClient }) {
 		const hasSessionSyncGrace = isSessionSyncGraceActive(authStore.get("sessionSyncGraceUntil"));
 		if (!hasSession) {
 			if (currentIsPending || hasSessionSyncGrace) {
-				const cachedToken = authStore.get("token");
+				const cachedJwt = getCachedJwt();
 				if (!forceRefreshToken) {
-					if (cachedToken && decodeJwtExp(cachedToken) !== null) return cachedToken;
+					if (cachedJwt) return cachedJwt;
 					return fetchFreshToken();
 				}
 				const freshToken = await fetchFreshTokenForced();
-				if (!freshToken && cachedToken && decodeJwtExp(cachedToken) !== null) {
-					authStore.set("token", cachedToken);
-					authStore.set("expiresAt", decodeJwtExp(cachedToken));
-					return cachedToken;
+				if (!freshToken && cachedJwt) {
+					authStore.set("token", cachedJwt);
+					authStore.set("expiresAt", decodeJwtExp(cachedJwt));
+					return cachedJwt;
 				}
 				return freshToken;
 			}
@@ -139,7 +159,11 @@ function ConvexAuthProviderInner({ children, client, authClient }) {
 		if (!forceRefreshToken && pendingTokenRef.current) return pendingTokenRef.current;
 		if (forceRefreshToken) return fetchFreshTokenForced();
 		return fetchFreshToken();
-	}, [authStore, authClient]);
+	}, [
+		authStore,
+		authClient,
+		getCachedJwt
+	]);
 	const useAuth = useCallback(function useConvexAuthHook() {
 		const token = authStore.get("token");
 		const hasSession = hasActiveSessionData(sessionRef.current);

package/dist/cli.mjs

@@ -1950,7 +1950,10 @@ const CONVEX_MANAGED_ENV_KEYS = new Set([
 	"NEXT_PUBLIC_CONVEX_URL",
 	"VITE_CONVEX_URL"
 ]);
-const defaultRunCommand = async (args, cwd) => runLocalConvexCommand(args, { cwd });
+const defaultRunCommand = async (args, cwd, env) => runLocalConvexCommand(args, {
+	cwd,
+	env
+});
 const generateAuthSecret = () => randomBytes(32).toString("base64url");
 const defaultSecretGenerator = () => generateAuthSecret();
 const normalizeRelativePath = (cwd, filePath) => path.relative(cwd, filePath).replaceAll("\\", "/") || ".";
@@ -2015,8 +2018,8 @@ const ensureAuthSecret = (params) => {
 	if (!params.silent) logger.info("Generated BETTER_AUTH_SECRET in convex/.env");
 	return secret;
 };
-const runConvexCommand = async (runCommand, cwd, args) => {
-	const result = await runCommand(args, cwd);
+const runConvexCommand = async (runCommand, cwd, args, env) => {
+	const result = await runCommand(args, cwd, env);
 	if (result.exitCode !== 0) throw new Error(formatConvexCommandFailure(args, result));
 	return result;
 };
@@ -2069,6 +2072,7 @@ async function pushEnv(options = {}, deps = {}) {
 	const rotate = options.rotate ?? false;
 	const silent = options.silent ?? false;
 	const targetArgs = options.targetArgs ?? [];
+	const commandEnv = options.commandEnv;
 	const runCommand = deps.runCommand ?? defaultRunCommand;
 	const secretGenerator = deps.secretGenerator ?? defaultSecretGenerator;
 	const envPath = path.join(cwd, "convex", ".env");
@@ -2096,7 +2100,7 @@ async function pushEnv(options = {}, deps = {}) {
 				envFilePath: tempEnvPath,
 				force,
 				targetArgs
-			}));
+			}), commandEnv);
 			return true;
 		} finally {
 			fs.rmSync(tempDir, {
@@ -2144,14 +2148,14 @@ async function pushEnv(options = {}, deps = {}) {
 				"run",
 				AUTH_ROTATE_KEYS_FUNCTION,
 				...targetArgs
-			]);
+			], commandEnv);
 			if (!silent) logger.info("Rotated auth keys.");
 		}
 		nextVars.JWKS = parseConvexRunValue((await runConvexCommand(runCommand, cwd, [
 			"run",
 			AUTH_JWKS_FUNCTION,
 			...targetArgs
-		])).stdout);
+		], commandEnv)).stdout);
 		await finalizePush();
 		return;
 	}
@@ -2169,23 +2173,26 @@ async function pushEnv(options = {}, deps = {}) {
 			"run",
 			AUTH_ROTATE_KEYS_FUNCTION,
 			...targetArgs
-		]);
+		], commandEnv);
 		if (!silent) logger.info("Rotated auth keys.");
 	}
 	nextVars.JWKS = parseConvexRunValue((await runConvexCommand(runCommand, cwd, [
 		"run",
 		AUTH_JWKS_FUNCTION,
 		...targetArgs
-	])).stdout);
+	], commandEnv)).stdout);
 	await finalizePush();
 }
 async function pullEnv(options = {}, deps = {}) {
 	const cwd = process.cwd();
-	const result = await runConvexCommand(deps.runCommand ?? defaultRunCommand, cwd, [
+	const runCommand = deps.runCommand ?? defaultRunCommand;
+	const targetArgs = options.targetArgs ?? [];
+	const commandEnv = options.commandEnv;
+	const result = await runConvexCommand(runCommand, cwd, [
 		"env",
 		"list",
-		...options.targetArgs ?? []
-	]);
+		...targetArgs
+	], commandEnv);
 	if (options.outFilePath) {
 		const outputPath = path.resolve(cwd, options.outFilePath);
 		fs.mkdirSync(path.dirname(outputPath), { recursive: true });
@@ -9206,6 +9213,7 @@ const CONVEX_DEPLOYMENT_ENV_KEYS = [
 	"CONVEX_SELF_HOSTED_URL",
 	"CONVEX_SELF_HOSTED_ADMIN_KEY"
 ];
+const LOCAL_CONVEX_DEPLOYMENT_PREFIXES = ["local:", "anonymous:"];
 function createBackendCommandEnv(overrides) {
 	const clearedDeploymentEnv = Object.fromEntries(CONVEX_DEPLOYMENT_ENV_KEYS.map((key) => [key, void 0]));
 	return {
@@ -9214,6 +9222,26 @@ function createBackendCommandEnv(overrides) {
 		...overrides
 	};
 }
+function hasRemoteConvexDeploymentEnv(env) {
+	const deployment = env.CONVEX_DEPLOYMENT?.trim();
+	if (deployment && !LOCAL_CONVEX_DEPLOYMENT_PREFIXES.some((prefix) => deployment.startsWith(prefix))) return true;
+	return Boolean(env.CONVEX_DEPLOY_KEY?.trim() || env.CONVEX_SELF_HOSTED_URL?.trim() || env.CONVEX_SELF_HOSTED_ADMIN_KEY?.trim());
+}
+function readConvexTargetEnvFile(args, cwd = process.cwd()) {
+	const envFile = readOptionalCliFlagValue(args, "--env-file");
+	if (!envFile) return null;
+	const envFilePath = resolve(cwd, envFile);
+	if (!fs.existsSync(envFilePath)) return null;
+	return parse(fs.readFileSync(envFilePath, "utf8"));
+}
+function resolveRemoteConvexDeploymentKey(env) {
+	if (!hasRemoteConvexDeploymentEnv(env)) return null;
+	const deployment = env.CONVEX_DEPLOYMENT?.trim();
+	if (deployment) return `deployment-env:${deployment}`;
+	const selfHostedUrl = env.CONVEX_SELF_HOSTED_URL?.trim();
+	if (selfHostedUrl) return `self-hosted-env:${selfHostedUrl}`;
+	return "remote-env";
+}
 async function withLocalConvexEnv(sharedDir, fn) {
 	const { functionsDir } = getConvexConfig(sharedDir);
 	const envPath = join(functionsDir, "..", ".env");
@@ -10612,12 +10640,19 @@ function writeAggregateFingerprintState(statePath, state) {
 	fs.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
 	fs.renameSync(tmpPath, statePath);
 }
-function getAggregateBackfillDeploymentKey(args) {
+function getAggregateBackfillDeploymentKey(args, cwd = process.cwd(), env) {
 	if (args.includes("--prod")) return "prod";
 	const deploymentName = readOptionalCliFlagValue(args, "--deployment-name");
 	if (deploymentName) return `deployment:${deploymentName}`;
 	const previewName = readOptionalCliFlagValue(args, "--preview-name");
 	if (previewName) return `preview:${previewName}`;
+	const envKey = env ? resolveRemoteConvexDeploymentKey(env) : null;
+	if (envKey) return envKey;
+	const envFileVars = readConvexTargetEnvFile(args, cwd);
+	if (envFileVars) {
+		const envFileKey = resolveRemoteConvexDeploymentKey(envFileVars);
+		if (envFileKey) return envFileKey;
+	}
 	return "local";
 }
 function ensureConvexGitignoreEntry(cwd = process.cwd()) {
@@ -10825,9 +10860,6 @@ function buildCodegenBootstrapArgs(targetArgs) {
 function didConvexInitCreateConfiguration(output) {
 	return CONVEX_INIT_CREATED_CONFIG_RE.test(output);
 }
-function hasRemoteConvexInitTargetArgs(targetArgs) {
-	return targetArgs?.some((arg) => arg === "--prod" || arg === "--preview-name" || arg === "--deployment-name") ?? false;
-}
 async function runConvexInitIfNeeded(params) {
 	if (params.backendAdapter.publicName !== "convex") return {
 		created: false,
@@ -10835,7 +10867,7 @@ async function runConvexInitIfNeeded(params) {
 		stdout: "",
 		stderr: ""
 	};
-	const agentModeOverride = params.yes && !hasRemoteConvexInitTargetArgs(params.targetArgs) ? "anonymous" : params.env?.CONVEX_AGENT_MODE;
+	const agentModeOverride = params.yes && getAggregateBackfillDeploymentKey(params.targetArgs ?? [], process.cwd(), params.env) === "local" ? "anonymous" : params.env?.CONVEX_AGENT_MODE;
 	const result = normalizeConvexCommandResult(await params.execaFn(params.backendAdapter.command, [
 		...params.backendAdapter.argsPrefix,
 		"init",
@@ -11449,7 +11481,7 @@ async function runBackendFunction(execaFn, backendAdapter, functionName, args, t
 		JSON.stringify(args)
 	], {
 		cwd: process.cwd(),
-		env: createBackendCommandEnv(),
+		env: createBackendCommandEnv(options?.env),
 		reject: false,
 		stdio: "pipe"
 	});
@@ -11466,13 +11498,16 @@ async function runBackendFunction(execaFn, backendAdapter, functionName, args, t
 	};
 }
 async function runAggregateBackfillFlow(params) {
-	const { execaFn, backendAdapter, backfillConfig, mode, targetArgs, signal, context } = params;
+	const { execaFn, backendAdapter, backfillConfig, mode, targetArgs, env, signal, context } = params;
 	if (signal?.aborted) return 0;
 	if (backfillConfig.enabled === "off") return 0;
 	const kickoff = await runBackendFunction(execaFn, backendAdapter, "generated/server:aggregateBackfill", {
 		mode,
 		batchSize: backfillConfig.batchSize
-	}, targetArgs, { echoOutput: false });
+	}, targetArgs, {
+		echoOutput: false,
+		env
+	});
 	if (kickoff.exitCode !== 0) {
 		const combinedOutput = `${kickoff.stdout}\n${kickoff.stderr}`;
 		if (backfillConfig.enabled === "auto" && isMissingBackfillFunctionOutput(combinedOutput)) {
@@ -11499,7 +11534,10 @@ async function runAggregateBackfillFlow(params) {
 	const deadline = Date.now() + backfillConfig.timeoutMs;
 	let lastProgress = "";
 	while (!signal?.aborted) {
-		const statusResult = await runBackendFunction(execaFn, backendAdapter, "generated/server:aggregateBackfillStatus", {}, targetArgs, { echoOutput: false });
+		const statusResult = await runBackendFunction(execaFn, backendAdapter, "generated/server:aggregateBackfillStatus", {}, targetArgs, {
+			echoOutput: false,
+			env
+		});
 		if (statusResult.exitCode !== 0) return statusResult.exitCode;
 		const statuses = parseBackendRunJson(statusResult.stdout);
 		const failed = statuses.find((entry) => Boolean(entry.lastError));
@@ -11634,7 +11672,7 @@ export const migration = defineMigration({
 	logger.info(`manifest: ${manifestFile}`);
 }
 async function runMigrationFlow(params) {
-	const { execaFn, backendAdapter, migrationConfig, targetArgs, signal, context, direction, steps, to } = params;
+	const { execaFn, backendAdapter, migrationConfig, targetArgs, env, signal, context, direction, steps, to } = params;
 	if (signal?.aborted || migrationConfig.enabled === "off") return 0;
 	const kickoff = await runBackendFunction(execaFn, backendAdapter, "generated/server:migrationRun", {
 		direction,
@@ -11642,7 +11680,10 @@ async function runMigrationFlow(params) {
 		allowDrift: migrationConfig.allowDrift,
 		...steps !== void 0 ? { steps } : {},
 		...to !== void 0 ? { to } : {}
-	}, targetArgs, { echoOutput: false });
+	}, targetArgs, {
+		echoOutput: false,
+		env
+	});
 	if (kickoff.exitCode !== 0) {
 		const combinedOutput = `${kickoff.stdout}\n${kickoff.stderr}`;
 		if (migrationConfig.enabled === "auto" && isMissingBackfillFunctionOutput(combinedOutput)) {
@@ -11677,7 +11718,10 @@ async function runMigrationFlow(params) {
 	const deadline = Date.now() + migrationConfig.timeoutMs;
 	let lastStatusLine = "";
 	while (!signal?.aborted) {
-		const statusResult = await runBackendFunction(execaFn, backendAdapter, "generated/server:migrationStatus", { runId }, targetArgs, { echoOutput: false });
+		const statusResult = await runBackendFunction(execaFn, backendAdapter, "generated/server:migrationStatus", { runId }, targetArgs, {
+			echoOutput: false,
+			env
+		});
 		if (statusResult.exitCode !== 0) return statusResult.exitCode;
 		const statusPayload = parseBackendRunJson(statusResult.stdout);
 		const runStatus = typeof statusPayload === "object" && statusPayload !== null && !Array.isArray(statusPayload) ? statusPayload.activeRun?.status ?? statusPayload.runs?.[0]?.status ?? "unknown" : "unknown";
@@ -11712,10 +11756,10 @@ async function runMigrationFlow(params) {
 	return 0;
 }
 async function runDevSchemaBackfillIfNeeded(params) {
-	const { execaFn, backendAdapter, backfillConfig, functionsDir, targetArgs, signal } = params;
+	const { execaFn, backendAdapter, backfillConfig, functionsDir, targetArgs, env, signal } = params;
 	const fingerprint = await computeAggregateIndexFingerprint(functionsDir);
 	if (!fingerprint) return 0;
-	const deploymentKey = getAggregateBackfillDeploymentKey(targetArgs);
+	const deploymentKey = getAggregateBackfillDeploymentKey(targetArgs, process.cwd(), env);
 	const statePath = getDevAggregateBackfillStatePath();
 	const state = readAggregateFingerprintState(statePath);
 	if (state.entries[deploymentKey]?.fingerprint === fingerprint) return 0;
@@ -11729,6 +11773,7 @@ async function runDevSchemaBackfillIfNeeded(params) {
 		},
 		mode: "resume",
 		targetArgs,
+		env,
 		signal,
 		context: "dev"
 	});
@@ -12087,6 +12132,59 @@ function resolveConcaveLocalSiteUrl(cwd = process.cwd()) {
 	const parsed = parseEnv(fs.readFileSync(envLocalPath, "utf8"));
 	return parsed.NEXT_PUBLIC_SITE_URL ?? parsed.VITE_SITE_URL ?? "http://localhost:3000";
 }
+function resolveImplicitConvexRemoteDeploymentEnv(cwd = process.cwd()) {
+	const envLocalPath = join(cwd, ".env.local");
+	if (!fs.existsSync(envLocalPath)) return null;
+	const parsed = parseEnv(fs.readFileSync(envLocalPath, "utf8"));
+	if (!hasRemoteConvexDeploymentEnv(parsed)) return null;
+	return {
+		CONVEX_DEPLOYMENT: parsed.CONVEX_DEPLOYMENT,
+		CONVEX_DEPLOY_KEY: parsed.CONVEX_DEPLOY_KEY,
+		CONVEX_SELF_HOSTED_URL: parsed.CONVEX_SELF_HOSTED_URL,
+		CONVEX_SELF_HOSTED_ADMIN_KEY: parsed.CONVEX_SELF_HOSTED_ADMIN_KEY
+	};
+}
+function resolveConvexEnvFileCommandEnv(args, cwd = process.cwd()) {
+	let envFilePath = null;
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i];
+		if (arg === "--env-file") {
+			envFilePath = args[i + 1] ?? null;
+			break;
+		}
+		if (arg.startsWith("--env-file=")) {
+			envFilePath = arg.slice(11) || null;
+			break;
+		}
+	}
+	if (!envFilePath) return null;
+	const resolvedPath = resolve(cwd, envFilePath);
+	if (!fs.existsSync(resolvedPath)) return null;
+	const parsed = parseEnv(fs.readFileSync(resolvedPath, "utf8"));
+	return {
+		CONVEX_DEPLOYMENT: parsed.CONVEX_DEPLOYMENT,
+		CONVEX_DEPLOY_KEY: parsed.CONVEX_DEPLOY_KEY,
+		CONVEX_SELF_HOSTED_URL: parsed.CONVEX_SELF_HOSTED_URL,
+		CONVEX_SELF_HOSTED_ADMIN_KEY: parsed.CONVEX_SELF_HOSTED_ADMIN_KEY
+	};
+}
+function stripConvexEnvFileTargetArgs(args) {
+	const nextArgs = [];
+	let skipNext = false;
+	for (const arg of args) {
+		if (skipNext) {
+			skipNext = false;
+			continue;
+		}
+		if (arg === "--env-file") {
+			skipNext = true;
+			continue;
+		}
+		if (arg.startsWith("--env-file=")) continue;
+		nextArgs.push(arg);
+	}
+	return nextArgs;
+}
 const resolveWatcherCommand = (currentFilename = __filename$1, currentDir = __dirname) => {
 	const isTs = currentFilename.endsWith(".ts");
 	return {
@@ -12265,6 +12363,10 @@ const handleDevCommand = async (argv, deps) => {
 	const debug = parsed.debug || config.dev.debug;
 	assertNoRemovedDevPreRunFlag(config.dev.args);
 	const { bootstrap, remainingArgs: convexDevArgs } = extractDevBootstrapCliFlag([...config.dev.args, ...devCommandArgs]);
+	const explicitConvexTargetArgs = extractBackendRunTargetArgs("convex", convexDevArgs);
+	const explicitConvexCommandEnv = resolveConvexEnvFileCommandEnv(convexDevArgs);
+	const implicitConvexCommandEnv = backend === "convex" && explicitConvexTargetArgs.length === 0 && explicitConvexCommandEnv === null ? resolveImplicitConvexRemoteDeploymentEnv() : null;
+	const effectiveConvexCommandEnv = explicitConvexCommandEnv ?? implicitConvexCommandEnv;
 	const preRunFunction = config.dev.preRun;
 	if (bootstrap && backend !== "convex") throw new Error("`kitcn dev --bootstrap` is only supported for backend convex.");
 	if (preRunFunction && backend === "concave") throw new Error("`dev.preRun` is only supported for backend convex. Concave dev has no equivalent `--run` flow.");
@@ -12281,10 +12383,10 @@ const handleDevCommand = async (argv, deps) => {
 	const concaveLocalDevContract = backend === "concave" ? resolveConcaveLocalDevContract(convexDevArgs, (deps?.resolveConcaveLocalSiteUrl ?? resolveConcaveLocalSiteUrl)(process.cwd())) : null;
 	const backendDevArgs = concaveLocalDevContract?.backendArgs ?? applyConvexDevPreRunArgs(convexDevArgs, preRunFunction);
 	const backendOutputMode = debug || backend === "convex" && !hasDevArg(backendDevArgs, "--once") ? "raw" : "filtered";
-	const targetArgs = concaveLocalDevContract?.targetArgs ?? extractBackendRunTargetArgs(backend, convexDevArgs);
+	const targetArgs = concaveLocalDevContract?.targetArgs ?? stripConvexEnvFileTargetArgs(extractBackendRunTargetArgs(backend, convexDevArgs));
 	const trimSegments = resolveCodegenTrimSegments(config);
 	const localNodeEnvOverrides = backend === "convex" ? await resolveSupportedLocalNodeEnvOverridesFn({ execaFn }) : {};
-	if (!bootstrap && backend === "convex" && !debug) logger.info("Bootstrapping local Convex...");
+	if (!bootstrap && backend === "convex" && !debug && getAggregateBackfillDeploymentKey(targetArgs, process.cwd(), effectiveConvexCommandEnv ?? void 0) === "local") logger.info("Bootstrapping local Convex...");
 	if (bootstrap) return runLocalConvexBootstrap({
 		authSyncMode: "complete",
 		config,
@@ -12307,7 +12409,10 @@ const handleDevCommand = async (argv, deps) => {
 		execaFn,
 		backendAdapter,
 		echoOutput: false,
-		env: localNodeEnvOverrides,
+		env: {
+			...localNodeEnvOverrides,
+			...effectiveConvexCommandEnv
+		},
 		targetArgs
 	});
 	if (convexInitResult.exitCode !== 0) return convexInitResult.exitCode;
@@ -12318,6 +12423,7 @@ const handleDevCommand = async (argv, deps) => {
 	});
 	if (backend === "convex" && (fs.existsSync(localConvexEnvPath) || authEnvState.installed)) await syncEnvFn({
 		authSyncMode: authEnvState.installed ? "prepare" : "skip",
+		commandEnv: effectiveConvexCommandEnv ?? void 0,
 		force: true,
 		sharedDir,
 		silent: true,
@@ -12353,6 +12459,7 @@ const handleDevCommand = async (argv, deps) => {
 		cwd: process.cwd(),
 		env: createBackendCommandEnv({
 			...localNodeEnvOverrides,
+			...effectiveConvexCommandEnv,
 			...concaveLocalDevContract?.backendEnv
 		}),
 		reject: false
@@ -12366,6 +12473,7 @@ const handleDevCommand = async (argv, deps) => {
 			signal: backfillAbortController.signal,
 			runTask: () => syncEnvFn({
 				authSyncMode: "complete",
+				commandEnv: effectiveConvexCommandEnv ?? void 0,
 				force: true,
 				sharedDir,
 				silent: true,
@@ -12388,6 +12496,7 @@ const handleDevCommand = async (argv, deps) => {
 				backendAdapter,
 				backfillConfig: devBackfillConfig,
 				functionsDir,
+				env: effectiveConvexCommandEnv ?? void 0,
 				targetArgs,
 				signal: backfillAbortController.signal
 			}) !== 0 && !backfillAbortController.signal.aborted) logger.warn("⚠️  aggregateBackfill on schema update failed in dev (continuing without blocking).");
@@ -12415,6 +12524,7 @@ const handleDevCommand = async (argv, deps) => {
 			await authEnvSyncPromise;
 			await syncEnvFn({
 				authSyncMode: "auto",
+				commandEnv: effectiveConvexCommandEnv ?? void 0,
 				force: true,
 				sharedDir,
 				silent: true,
@@ -12442,6 +12552,7 @@ const handleDevCommand = async (argv, deps) => {
 				runTask: () => runMigrationFlow({
 					execaFn,
 					backendAdapter,
+					env: effectiveConvexCommandEnv ?? void 0,
 					migrationConfig: devMigrationConfig,
 					targetArgs,
 					signal: backfillAbortController.signal,
@@ -12464,6 +12575,7 @@ const handleDevCommand = async (argv, deps) => {
 					execaFn,
 					backendAdapter,
 					backfillConfig: devBackfillConfig,
+					env: effectiveConvexCommandEnv ?? void 0,
 					mode: "resume",
 					targetArgs,
 					signal: backfillAbortController.signal,

package/dist/react/index.d.ts

@@ -350,7 +350,7 @@ declare class ConvexQueryClient {
   subscriptions: Record<string, {
     watch: Watch<unknown>;
     unsubscribe: () => void;
-    queryKey: ['convexQuery', string, Record<string, unknown>];
+    queryKey: QueryKey;
   }>;
   /** Cleanup function for QueryCache subscription */
   unsubscribe: (() => void) | undefined;
@@ -377,6 +377,9 @@ declare class ConvexQueryClient {
   private cancelPendingUnsubscribe;
   /** Unsubscribe a live Convex watch (if present) and remove it from the subscription map. */
   private unsubscribeQueryByHash;
+  private isAuthBoundQuery;
+  private isQueryDisabled;
+  private subscribeQuery;
   /** Update auth store (for HMR where jotai store may reset) */
   updateAuthStore(authStore?: AuthStore): void;
   /** Get current auth state from store */
@@ -411,6 +414,7 @@ declare class ConvexQueryClient {
    * Call before logout to prevent UNAUTHORIZED errors during session invalidation.
    */
   unsubscribeAuthQueries(): void;
+  resetAuthQueries(): Promise<void>;
   /**
    * Batch update all subscriptions.
    * Called internally when Convex client reconnects.

package/dist/react/index.js

@@ -1185,7 +1185,24 @@ function createCRPCContext(options) {
 	/** Inner provider */
 	function CRPCProviderInner({ children, convexClient, convexQueryClient }) {
 		const authStore = useAuthStore();
+		const token = useAuthValue("token");
+		const isAuthenticated = useAuthValue("isAuthenticated");
+		const previousAuthRef = useRef(null);
 		const fetchAccessToken = useFetchAccessToken();
+		useEffect(() => {
+			const previous = previousAuthRef.current;
+			const tokenReady = token === null || decodeJwtExp(token) !== null;
+			previousAuthRef.current = {
+				isAuthenticated,
+				token
+			};
+			if (!previous) return;
+			if (tokenReady && (previous.token !== token || previous.isAuthenticated !== isAuthenticated)) convexQueryClient.resetAuthQueries();
+		}, [
+			convexQueryClient,
+			isAuthenticated,
+			token
+		]);
 		const httpProxy = useMemo(() => {
 			if (!httpOptions.convexSiteUrl || !meta._http) return;
 			return createHttpProxy({
@@ -1438,12 +1455,14 @@ function createAuthMutations(authClient) {
 				authStoreApi.set("token", null);
 				authStoreApi.set("expiresAt", null);
 				authStoreApi.set("sessionSyncGraceUntil", null);
+				await convexQueryClient?.resetAuthQueries();
 				return res;
 			}
 		};
 	});
 	const useSignInSocialMutationOptions = ((options) => {
 		const authStoreApi = useAuthStore();
+		const convexQueryClient = useConvexQueryClient();
 		return {
 			...options,
 			mutationFn: async (args) => {
@@ -1452,12 +1471,15 @@ function createAuthMutations(authClient) {
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
+				authStoreApi.set("isAuthenticated", true);
+				await convexQueryClient?.resetAuthQueries();
 				return res;
 			}
 		};
 	});
 	const useSignInMutationOptions = ((options) => {
 		const authStoreApi = useAuthStore();
+		const convexQueryClient = useConvexQueryClient();
 		return {
 			...options,
 			mutationFn: async (args) => {
@@ -1466,12 +1488,15 @@ function createAuthMutations(authClient) {
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
+				authStoreApi.set("isAuthenticated", true);
+				await convexQueryClient?.resetAuthQueries();
 				return res;
 			}
 		};
 	});
 	const useSignUpMutationOptions = ((options) => {
 		const authStoreApi = useAuthStore();
+		const convexQueryClient = useConvexQueryClient();
 		return {
 			...options,
 			mutationFn: async (args) => {
@@ -1480,6 +1505,8 @@ function createAuthMutations(authClient) {
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
+				authStoreApi.set("isAuthenticated", true);
+				await convexQueryClient?.resetAuthQueries();
 				return res;
 			}
 		};
@@ -1701,6 +1728,31 @@ var ConvexQueryClient = class {
 		sub.unsubscribe();
 		delete this.subscriptions[queryHash];
 	}
+	isAuthBoundQuery(query) {
+		const meta = query.meta;
+		return meta?.authType === "required" || meta?.authType === "optional";
+	}
+	isQueryDisabled(query) {
+		return query.isDisabled();
+	}
+	subscribeQuery(query) {
+		if (this.subscriptions[query.queryHash]) return;
+		const meta = query.meta;
+		if (meta?.subscribe === false) return;
+		if (query.getObserversCount() === 0) return;
+		if (this.isQueryDisabled(query)) return;
+		if (this.shouldSkipSubscription(meta?.authType)) return;
+		const [, funcName, args] = query.queryKey;
+		const watch = this.convexClient.watchQuery(funcName, this.transformer.input.serialize(args));
+		const unsubscribe = watch.onUpdate(() => {
+			this.onUpdateQueryKeyHash(query.queryHash);
+		});
+		this.subscriptions[query.queryHash] = {
+			queryKey: query.queryKey,
+			watch,
+			unsubscribe
+		};
+	}
 	/** Update auth store (for HMR where jotai store may reset) */
 	updateAuthStore(authStore) {
 		this.authStore = authStore;
@@ -1783,6 +1835,15 @@ var ConvexQueryClient = class {
 			this.unsubscribeQueryByHash(queryHash);
 		}
 	}
+	async resetAuthQueries() {
+		const authQueries = this.queryClient.getQueryCache().getAll().filter((query) => this.isAuthBoundQuery(query));
+		for (const query of authQueries) {
+			this.cancelPendingUnsubscribe(query.queryHash);
+			this.unsubscribeQueryByHash(query.queryHash);
+		}
+		await this.queryClient.resetQueries({ predicate: (query) => this.isAuthBoundQuery(query) });
+		for (const query of this.queryClient.getQueryCache().getAll()) if (this.isAuthBoundQuery(query)) this.subscribeQuery(query);
+	}
 	/**
 	* Batch update all subscriptions.
 	* Called internally when Convex client reconnects.
@@ -1860,42 +1921,13 @@ var ConvexQueryClient = class {
 					this.cancelPendingUnsubscribe(event.query.queryHash);
 					this.unsubscribeQueryByHash(event.query.queryHash);
 					break;
-				case "added": {
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (event.query.getObserversCount() === 0) break;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					const watch = this.convexClient.watchQuery(funcName, this.transformer.input.serialize(args));
-					const unsubscribe = watch.onUpdate(() => {
-						this.onUpdateQueryKeyHash(event.query.queryHash);
-					});
-					this.subscriptions[event.query.queryHash] = {
-						queryKey: event.query.queryKey,
-						watch,
-						unsubscribe
-					};
+				case "added":
+					this.subscribeQuery(event.query);
 					break;
-				}
-				case "observerAdded": {
+				case "observerAdded":
 					this.cancelPendingUnsubscribe(event.query.queryHash);
-					if (this.subscriptions[event.query.queryHash]) break;
-					if (event.query.options.enabled === false) break;
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					const watch = this.convexClient.watchQuery(funcName, this.transformer.input.serialize(args));
-					const unsubscribe = watch.onUpdate(() => {
-						this.onUpdateQueryKeyHash(event.query.queryHash);
-					});
-					this.subscriptions[event.query.queryHash] = {
-						queryKey: event.query.queryKey,
-						watch,
-						unsubscribe
-					};
+					this.subscribeQuery(event.query);
 					break;
-				}
 				case "observerRemoved":
 					if (event.query.getObserversCount() === 0 && this.subscriptions[event.query.queryHash]) {
 						const queryHash = event.query.queryHash;
@@ -1911,7 +1943,7 @@ var ConvexQueryClient = class {
 					if (event.action.type === "setState" && event.action.setStateOptions?.meta === "set by ConvexQueryClient") break;
 					break;
 				case "observerOptionsUpdated": {
-					const isDisabled = event.query.options.enabled === false;
+					const isDisabled = this.isQueryDisabled(event.query);
 					const isSubscribed = !!this.subscriptions[event.query.queryHash];
 					if (isDisabled && isSubscribed) {
 						this.cancelPendingUnsubscribe(event.query.queryHash);
@@ -1919,19 +1951,7 @@ var ConvexQueryClient = class {
 						break;
 					}
 					if (isSubscribed || isDisabled) break;
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					const watch = this.convexClient.watchQuery(funcName, this.transformer.input.serialize(args));
-					const unsubscribe = watch.onUpdate(() => {
-						this.onUpdateQueryKeyHash(event.query.queryHash);
-					});
-					this.subscriptions[event.query.queryHash] = {
-						queryKey: event.query.queryKey,
-						watch,
-						unsubscribe
-					};
+					this.subscribeQuery(event.query);
 					break;
 				}
 			}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kitcn",
-  "version": "0.12.8",
+  "version": "0.12.10",
   "description": "kitcn - React Query integration and CLI tools for Convex",
   "keywords": [
     "convex",