kitcn 0.20.0 → 0.22.0

package/dist/solid/index.js

@@ -1,5 +1,5 @@
 import { getFunctionName } from "convex/server";
-import { Show, createComputed, createContext, createEffect, createMemo, createRenderEffect, createSignal, on, onCleanup, onMount, useContext } from "solid-js";
+import { Show, batch, createComputed, createContext, createEffect, createMemo, createRenderEffect, createSignal, on, onCleanup, onMount, useContext } from "solid-js";
 import { createComponent, memo } from "solid-js/web";
 import { createStore } from "solid-js/store";
 import { notifyManager, skipToken, useQueryClient } from "@tanstack/solid-query";
@@ -78,7 +78,8 @@ const defaultState = {
 	token: null,
 	expiresAt: null,
 	isLoading: true,
-	isAuthenticated: false
+	isAuthenticated: false,
+	authEpoch: 0
 };
 const AuthStoreContext = createContext(null);
 function useAuthStore() {
@@ -91,7 +92,14 @@ function useAuthStore() {
 	return ctx;
 }
 function useAuthValue(key) {
-	return useAuthStore().get(key);
+	const store = useAuthStore();
+	const bridgeAuth = useConvexAuthBridge();
+	if (!store.store && bridgeAuth) {
+		if (key === "authEpoch") return bridgeAuth.authEpoch;
+		if (key === "isAuthenticated") return bridgeAuth.isAuthenticated;
+		if (key === "isLoading") return bridgeAuth.isLoading;
+	}
+	return store.get(key);
 }
 function AuthProvider(props) {
 	const [state, setState] = createStore({
@@ -125,14 +133,17 @@ function useSafeConvexAuth() {
 	const authStore = useAuthStore();
 	const bridgeAuth = useConvexAuthBridge();
 	return {
+		get identity() {
+			return bridgeAuth?.identity ?? null;
+		},
 		get isAuthenticated() {
-			if (authStore.store) return authStore.get("isAuthenticated");
 			if (bridgeAuth !== null) return bridgeAuth.isAuthenticated;
+			if (authStore.store) return authStore.get("isAuthenticated");
 			return false;
 		},
 		get isLoading() {
-			if (authStore.store) return authStore.get("isLoading");
 			if (bridgeAuth !== null) return bridgeAuth.isLoading;
+			if (authStore.store) return authStore.get("isLoading");
 			return false;
 		}
 	};
@@ -144,6 +155,12 @@ function useSafeConvexAuth() {
 function ConvexAuthBridge(props) {
 	return createComponent(ConvexAuthBridgeContext.Provider, {
 		value: {
+			get authEpoch() {
+				return props.authEpoch ?? 0;
+			},
+			get identity() {
+				return props.identity ?? null;
+			},
 			get isLoading() {
 				return props.isLoading;
 			},
@@ -991,6 +1008,19 @@ function convexInfiniteQueryOptions(funcRef, args, opts = {}, meta) {
 /** Symbol key for attaching FunctionReference to options (non-serializable) */
 const FUNC_REF_SYMBOL = Symbol.for("convex.funcRef");
 
+//#endregion
+//#region src/internal/enabled.ts
+/**
+* Combine a computed gate with the caller's `enabled` option.
+* A predicate is preserved (never collapsed to a boolean) so TanStack Query
+* keeps evaluating it; `allowed: false` always wins.
+*/
+function resolveEnabled(allowed, enabled) {
+	if (!allowed) return false;
+	if (typeof enabled === "function") return (query) => enabled(query) !== false;
+	return enabled ?? true;
+}
+
 //#endregion
 //#region src/solid/convex-solid.tsx
 /** @jsxImportSource solid-js */
@@ -1018,25 +1048,52 @@ function ConvexProvider(props) {
 }
 function ConvexProviderWithAuth(props) {
 	const client = props.client;
+	const [authEpoch, setAuthEpoch] = createSignal(0);
+	const [convexIdentity, setConvexIdentity] = createSignal(null);
 	const [isConvexLoading, setIsConvexLoading] = createSignal(true);
 	const [isConvexAuthenticated, setIsConvexAuthenticated] = createSignal(false);
-	createEffect(() => {
-		const auth = props.useAuth();
-		const loading = auth.isLoading;
-		const authenticated = auth.isAuthenticated;
-		if (loading) return;
-		if (!authenticated) {
-			client.clearAuth();
+	const settleAuth = (nextIdentity, isAuthenticated) => {
+		batch(() => {
+			setConvexIdentity(nextIdentity);
+			setAuthEpoch((epoch) => epoch + 1);
+			setIsConvexAuthenticated(isAuthenticated);
 			setIsConvexLoading(false);
-			setIsConvexAuthenticated(false);
+		});
+	};
+	const authSnapshot = createMemo(() => props.useAuth(), void 0, { equals: false });
+	const isAuthLoading = createMemo(() => authSnapshot().isLoading);
+	const isAuthenticated = createMemo(() => authSnapshot().isAuthenticated);
+	const fetchAccessToken = createMemo(() => authSnapshot().fetchAccessToken);
+	const identity = createMemo(() => {
+		const snapshot = authSnapshot();
+		return snapshot.identity === void 0 ? Symbol("legacy-auth-transition") : snapshot.identity;
+	});
+	let authBindingGeneration = 0;
+	createEffect(on([
+		isAuthLoading,
+		isAuthenticated,
+		fetchAccessToken,
+		identity
+	], () => {
+		const generation = ++authBindingGeneration;
+		if (isAuthLoading()) {
+			setIsConvexLoading(true);
 			return;
 		}
-		client.setAuth(auth.fetchAccessToken, (isAuth) => {
-			setIsConvexLoading(false);
-			setIsConvexAuthenticated(isAuth);
+		const nextIdentity = identity();
+		setIsConvexLoading(true);
+		if (!isAuthenticated()) {
+			client.clearAuth();
+			settleAuth(nextIdentity, false);
+			return;
+		}
+		client.setAuth(fetchAccessToken(), (isAuth) => {
+			if (generation !== authBindingGeneration) return;
+			settleAuth(nextIdentity, isAuth);
 		});
-	});
+	}));
 	onCleanup(() => {
+		authBindingGeneration += 1;
 		client.clearAuth();
 	});
 	return createComponent(ConvexContext.Provider, {
@@ -1045,6 +1102,12 @@ function ConvexProviderWithAuth(props) {
 		},
 		get children() {
 			return createComponent(ConvexAuthBridge, {
+				get authEpoch() {
+					return authEpoch();
+				},
+				get identity() {
+					return convexIdentity();
+				},
 				get isAuthenticated() {
 					return isConvexAuthenticated();
 				},
@@ -1110,14 +1173,15 @@ function useConvexQueryOptions(funcRef, args, options) {
 		skipUnauth: options?.skipUnauth
 	});
 	const baseOptions = convexQuery(funcRef, isSkipped ? {} : args);
-	const { skipUnauth: _, subscribe, ...queryOptions } = options ?? {};
+	const { enabled: userEnabled, skipUnauth, subscribe, ...queryOptions } = options ?? {};
 	return {
 		...baseOptions,
 		...queryOptions,
-		enabled: isSkipped ? false : !authSkip.shouldSkip,
+		enabled: resolveEnabled(!(isSkipped || authSkip.shouldSkip), userEnabled),
 		meta: {
 			...baseOptions.meta,
 			authType: authSkip.authType,
+			skipUnauth,
 			subscribe: subscribe !== false
 		}
 	};
@@ -1155,13 +1219,15 @@ function useConvexInfiniteQueryOptions(funcRef, args, opts) {
 		enabled: isSkipped ? false : enabledOpt,
 		skipUnauth: opts.skipUnauth
 	});
-	const enabled = isSkipped || authSkip.shouldSkip ? false : enabledOpt;
 	const baseOptions = convexInfiniteQueryOptions(funcRef, isSkipped ? {} : args, {
 		...opts,
-		enabled
+		enabled: void 0
 	}, meta);
 	return {
 		...baseOptions,
+		get enabled() {
+			return resolveEnabled(!(isSkipped || authSkip.shouldSkip), opts.enabled);
+		},
 		meta: {
 			...baseOptions.meta,
 			authType: authSkip.authType
@@ -1195,11 +1261,16 @@ function useConvexActionQueryOptions(action, args, options) {
 		skipUnauth: options?.skipUnauth
 	});
 	const baseOptions = convexAction(action, isSkipped ? {} : args);
-	const { skipUnauth: _, ...queryOptions } = options ?? {};
+	const { enabled: userEnabled, skipUnauth, ...queryOptions } = options ?? {};
 	return {
 		...baseOptions,
 		...queryOptions,
-		enabled: isSkipped ? false : !authSkip.shouldSkip
+		enabled: resolveEnabled(!(isSkipped || authSkip.shouldSkip), userEnabled),
+		meta: {
+			...baseOptions.meta,
+			authType: authSkip.authType,
+			skipUnauth
+		}
 	};
 }
 /**
@@ -1528,7 +1599,39 @@ function createCRPCContext(options) {
 	const HttpProxyContext = createContext(void 0);
 	function CRPCProvider(props) {
 		const authStore = useAuthStore();
+		const bridgeAuth = useConvexAuthBridge();
+		const safeAuth = useSafeConvexAuth();
+		const auth = bridgeAuth ?? safeAuth;
 		const fetchAccessToken = useFetchAccessToken();
+		props.convexQueryClient.updateAuthStore(authStore.store ? authStore : void 0);
+		let previousAuth;
+		let authGeneration = 0;
+		let transitionClear;
+		createEffect(() => {
+			const generation = ++authGeneration;
+			const currentAuth = {
+				identity: auth.identity,
+				isAuthenticated: auth.isAuthenticated,
+				isLoading: auth.isLoading
+			};
+			const previous = previousAuth;
+			previousAuth = currentAuth;
+			if (currentAuth.isLoading) {
+				if (!previous?.isLoading) transitionClear = props.convexQueryClient.resetAuthQueries({ refetch: false });
+				return;
+			}
+			if (previous?.isLoading) {
+				const pendingClear = transitionClear;
+				transitionClear = void 0;
+				(async () => {
+					const clientGeneration = await pendingClear;
+					if (generation !== authGeneration) return;
+					await props.convexQueryClient.resetAuthQueries({ generation: clientGeneration });
+				})();
+				return;
+			}
+			if (!previous || previous.identity !== currentAuth.identity || previous.isAuthenticated !== currentAuth.isAuthenticated) props.convexQueryClient.resetAuthQueries();
+		});
 		const proxy = createCRPCOptionsProxy(api, meta, options.transformer);
 		const vanillaClient = createVanillaCRPCProxy(api, meta, props.convexClient, options.transformer);
 		const httpProxy = (() => {
@@ -1770,6 +1873,56 @@ function createAuthMutations(authClient) {
 	};
 }
 
+//#endregion
+//#region src/internal/auth-reset.ts
+/**
+* Erase the cached result of every auth-bound query.
+*
+* `queryClient.resetQueries()` is not enough. It restores each query's
+* `initialState`, and query-core derives that from `initialData` when the query
+* is built, never re-deriving it once real data lands. An auth-bound entry
+* therefore comes back holding the previous account's rows marked `success`,
+* and nothing corrects it: Convex query options set `staleTime: Infinity` with
+* every refetch trigger off, and `resetQueries` only refetches entries that are
+* currently active.
+*
+* Every entry is removed so query-core forgets both its current state and its
+* private `initialState`. Mounted observers are rebound with `initialData`
+* removed, creating a pristine replacement query that future public resets
+* cannot use to resurrect the previous account's rows.
+*/
+async function clearAuthBoundQueries(cache, isAuthBound) {
+	const authQueries = cache.getAll().filter((query) => isAuthBound(query));
+	const restoreObservers = [];
+	await Promise.all(authQueries.map((query) => query.cancel({ silent: true })));
+	for (const query of authQueries) {
+		const observers = [...query.observers];
+		cache.remove(query);
+		for (const observer of observers) {
+			const previousOptions = observer.options;
+			observer.setOptions({
+				...observer.options,
+				enabled: false,
+				initialData: void 0,
+				placeholderData: void 0
+			});
+			const suspendedOptions = observer.options;
+			restoreObservers.push(() => {
+				const currentOptions = observer.options;
+				observer.setOptions({
+					...currentOptions,
+					enabled: observer.options === suspendedOptions ? previousOptions.enabled : currentOptions.enabled,
+					initialData: void 0,
+					placeholderData: void 0
+				});
+			});
+		}
+	}
+	return () => {
+		for (const restoreObserver of restoreObservers) restoreObserver();
+	};
+}
+
 //#endregion
 //#region src/internal/query-key.ts
 /**
@@ -1828,6 +1981,31 @@ function createHashFn(fallback = hashKey) {
 	};
 }
 
+//#endregion
+//#region src/internal/subscription-gate.ts
+/** Read kitcn's meta off a TanStack query. */
+function readConvexQueryMeta(query) {
+	return query.meta;
+}
+/**
+* Auth-bound queries are cleared and resubscribed on an identity transition so
+* one account never renders another account's cached rows.
+*/
+function isAuthBoundQuery(query) {
+	const authType = readConvexQueryMeta(query)?.authType;
+	return authType === "required" || authType === "optional";
+}
+/** Whether a Convex subscription may be opened for this query. */
+function canSubscribeQuery(query, opts) {
+	if (opts.isSubscribed) return false;
+	const meta = readConvexQueryMeta(query);
+	if (meta?.subscribe === false) return false;
+	if (query.getObserversCount() === 0) return false;
+	if (query.isDisabled()) return false;
+	if (opts.shouldSkipSubscription(meta?.authType)) return false;
+	return true;
+}
+
 //#endregion
 //#region src/solid/client.ts
 /**
@@ -1920,6 +2098,12 @@ var ConvexQueryClient = class {
 	ssrQueryMode;
 	/** Auth store for checking auth state */
 	authStore;
+	/** In-flight clear shared by overlapping account identity transitions. */
+	authBarrierClear;
+	/** Blocks auth-bound work created while Convex is changing identity. */
+	authSettlementBarrier;
+	/** Latest account transition allowed to restore and refetch observers. */
+	authResetGeneration = 0;
 	/** Delay before unsubscribing when query has no observers */
 	unsubscribeDelay;
 	/** Payload transformer used across request/response boundaries. */
@@ -1947,6 +2131,18 @@ var ConvexQueryClient = class {
 		sub.unsubscribe();
 		delete this.subscriptions[queryHash];
 	}
+	/**
+	* Open a Convex subscription for a query, if the shared gate allows it.
+	* Single owner of the subscribe preconditions for every cache-event branch.
+	*/
+	subscribeQuery(query) {
+		if (!canSubscribeQuery(query, {
+			isSubscribed: !!this.subscriptions[query.queryHash],
+			shouldSkipSubscription: (authType) => this.shouldSkipSubscription(authType)
+		})) return;
+		const [, funcName, args] = query.queryKey;
+		this.createSubscription(query.queryHash, funcName, args, query.queryKey);
+	}
 	/** Update auth store (for HMR where store may reset) */
 	updateAuthStore(authStore) {
 		this.authStore = authStore;
@@ -1966,12 +2162,30 @@ var ConvexQueryClient = class {
 	* Needed for useSuspenseQuery which ignores enabled: false.
 	*/
 	shouldSkipSubscription(authType) {
-		if (!authType || !this.authStore) return false;
+		if (!authType) return false;
+		if (this.authSettlementBarrier) return true;
+		if (!this.authStore) return false;
 		const authState = this.getAuthState();
 		if (authState?.isLoading) return true;
 		if (authType === "required" && !authState?.isAuthenticated) return true;
 		return false;
 	}
+	/** Hold new auth-bound requests until the latest Convex identity settles. */
+	beginAuthSettlementBarrier() {
+		if (this.authSettlementBarrier) return;
+		let resolve = () => {};
+		this.authSettlementBarrier = {
+			promise: new Promise((resolvePromise) => {
+				resolve = resolvePromise;
+			}),
+			resolve
+		};
+	}
+	/** Wait through overlapping barriers and stop canceled requests. */
+	async waitForAuthSettlement(signal) {
+		while (this.authSettlementBarrier) await this.authSettlementBarrier.promise;
+		signal?.throwIfAborted();
+	}
 	/** Get QueryClient, throwing if not connected */
 	get queryClient() {
 		if (!this._queryClient) throw new Error("ConvexQueryClient not connected to TanStack QueryClient.");
@@ -2034,6 +2248,62 @@ var ConvexQueryClient = class {
 		}
 	}
 	/**
+	* Advance the account generation published by the auth store.
+	* Client state that only makes sense inside one account's result set —
+	* paginated cursor chains — keys on it, so it is rebuilt instead of reused.
+	*/
+	bumpAuthEpoch() {
+		if (!this.authStore) return;
+		this.authStore.set("authEpoch", this.authStore.get("authEpoch") + 1);
+	}
+	/** Drop auth-bound data without fetching while Convex changes identity. */
+	async clearAuthQueries() {
+		const queryCache = this.queryClient.getQueryCache();
+		for (const query of queryCache.getAll()) {
+			if (!isAuthBoundQuery(query)) continue;
+			this.cancelPendingUnsubscribe(query.queryHash);
+			this.unsubscribeQueryByHash(query.queryHash);
+		}
+		this.bumpAuthEpoch();
+		return clearAuthBoundQueries(queryCache, (query) => isAuthBoundQuery(query));
+	}
+	/** Refetch and resubscribe auth-bound queries after Convex settles. */
+	async refetchAuthQueries(generation) {
+		const queryCache = this.queryClient.getQueryCache();
+		await this.queryClient.refetchQueries({
+			predicate: (query) => isAuthBoundQuery(query),
+			type: "active"
+		});
+		if (generation !== this.authResetGeneration) return;
+		for (const query of queryCache.getAll()) if (isAuthBoundQuery(query)) this.subscribeQuery(query);
+	}
+	/**
+	* Drop every auth-bound cache entry and resubscribe.
+	* Call after an identity transition when no separate settlement barrier owns
+	* the clear/refetch phases.
+	*/
+	async resetAuthQueries(options = {}) {
+		if (options.refetch === false) {
+			const generation = ++this.authResetGeneration;
+			this.beginAuthSettlementBarrier();
+			this.authBarrierClear ??= this.clearAuthQueries();
+			await this.authBarrierClear;
+			return generation;
+		}
+		const generation = options.generation ?? ++this.authResetGeneration;
+		if (generation !== this.authResetGeneration) return generation;
+		this.authBarrierClear ??= this.clearAuthQueries();
+		const restoreObservers = await this.authBarrierClear;
+		if (generation !== this.authResetGeneration) return generation;
+		this.authBarrierClear = void 0;
+		const settlementBarrier = this.authSettlementBarrier;
+		this.authSettlementBarrier = void 0;
+		settlementBarrier?.resolve();
+		restoreObservers();
+		await this.refetchAuthQueries(generation);
+		return generation;
+	}
+	/**
 	* Batch update all subscriptions.
 	* Called internally when Convex client reconnects.
 	*/
@@ -2107,26 +2377,13 @@ var ConvexQueryClient = class {
 					this.cancelPendingUnsubscribe(event.query.queryHash);
 					this.unsubscribeQueryByHash(event.query.queryHash);
 					break;
-				case "added": {
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (event.query.getObserversCount() === 0) break;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					this.createSubscription(event.query.queryHash, funcName, args, event.query.queryKey);
+				case "added":
+					this.subscribeQuery(event.query);
 					break;
-				}
-				case "observerAdded": {
+				case "observerAdded":
 					this.cancelPendingUnsubscribe(event.query.queryHash);
-					if (this.subscriptions[event.query.queryHash]) break;
-					if (event.query.options.enabled === false) break;
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					this.createSubscription(event.query.queryHash, funcName, args, event.query.queryKey);
+					this.subscribeQuery(event.query);
 					break;
-				}
 				case "observerRemoved":
 					if (event.query.getObserversCount() === 0 && this.subscriptions[event.query.queryHash]) {
 						const queryHash = event.query.queryHash;
@@ -2142,7 +2399,7 @@ var ConvexQueryClient = class {
 					if (event.action.type === "setState" && event.action.setStateOptions?.meta === "set by ConvexQueryClient") break;
 					break;
 				case "observerOptionsUpdated": {
-					const isDisabled = event.query.options.enabled === false;
+					const isDisabled = event.query.isDisabled();
 					const isSubscribed = !!this.subscriptions[event.query.queryHash];
 					if (isDisabled && isSubscribed) {
 						this.cancelPendingUnsubscribe(event.query.queryHash);
@@ -2150,11 +2407,7 @@ var ConvexQueryClient = class {
 						break;
 					}
 					if (isSubscribed || isDisabled) break;
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					this.createSubscription(event.query.queryHash, funcName, args, event.query.queryKey);
+					this.subscribeQuery(event.query);
 					break;
 				}
 			}
@@ -2197,6 +2450,7 @@ var ConvexQueryClient = class {
 		return async (context) => {
 			const { queryKey, meta: rawMeta } = context;
 			const meta = rawMeta;
+			if (!isServer && meta?.authType) await this.waitForAuthSettlement(context.signal);
 			if (isConvexSkipped(queryKey)) throw new Error("Skipped query should not actually run, should { enabled: false }");
 			if (isConvexQuery(queryKey)) {
 				const [, funcName, args] = queryKey;
@@ -2268,6 +2522,38 @@ function throwBecauseNotConvexQuery(context) {
 	throw new Error(`Query key is not for a Convex Query: ${context.queryKey}`);
 }
 
+//#endregion
+//#region src/internal/jwt.ts
+const VOLATILE_JWT_CLAIMS = new Set([
+	"exp",
+	"iat",
+	"jti",
+	"nbf"
+]);
+const decodeJwtPayload = (token) => {
+	try {
+		const segment = token.split(".")[1];
+		if (!segment) return null;
+		const binary = atob(segment.replaceAll("-", "+").replaceAll("_", "/"));
+		const payload = JSON.parse(new TextDecoder().decode(Uint8Array.from(binary, (char) => char.charCodeAt(0))));
+		return typeof payload === "object" && payload !== null ? payload : null;
+	} catch {
+		return null;
+	}
+};
+const stableStringify = (value) => {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	return `{${Object.entries(value).filter(([, claim]) => claim !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, claim]) => `${JSON.stringify(key)}:${stableStringify(claim)}`).join(",")}}`;
+};
+const decodeJwtIdentity = (token) => {
+	const payload = decodeJwtPayload(token);
+	if (!payload) return null;
+	const claims = {};
+	for (const [key, claim] of Object.entries(payload)) if (!VOLATILE_JWT_CLAIMS.has(key)) claims[key] = claim;
+	return stableStringify(claims);
+};
+
 //#endregion
 //#region src/solid/convex-auth-provider.tsx
 /** @jsxImportSource solid-js */
@@ -2287,6 +2573,13 @@ const hasActiveSessionData = (session) => {
 	if (!session || typeof session !== "object") return false;
 	return Boolean(session.session);
 };
+const getSessionId = (sessionData) => {
+	if (!sessionData || typeof sessionData !== "object") return;
+	const session = sessionData.session;
+	if (!session || typeof session !== "object") return;
+	const id = session.id;
+	return typeof id === "string" ? id : void 0;
+};
 /**
 * Unified auth provider for Convex + Better Auth (SolidJS).
 * Handles token sync and auth callbacks.
@@ -2336,21 +2629,40 @@ function ConvexAuthProviderInner(props) {
 	const authStore = useAuthStore();
 	const sessionAccessor = props.authClient.useSession();
 	let pendingTokenPromise = null;
+	let pendingTokenSessionId;
+	let authIdentity = null;
+	let identityClaims = null;
+	let identityInitialized = false;
+	let identitySessionId;
+	let tokenSessionId;
+	let tokenSessionInitialized = false;
 	createEffect(() => {
 		const sessionState = sessionAccessor();
 		const session = sessionState.data;
 		const isPending = sessionState.isPending;
+		const sessionId = getSessionId(session);
 		if (!hasActiveSessionData(session) && !isPending) {
 			authStore.set("token", null);
 			authStore.set("expiresAt", null);
 			authStore.set("isAuthenticated", false);
+			tokenSessionId = void 0;
+			tokenSessionInitialized = false;
+		} else if (hasActiveSessionData(session)) {
+			if (!tokenSessionInitialized && authStore.get("token") !== null || tokenSessionInitialized && sessionId !== tokenSessionId) {
+				authStore.set("token", null);
+				authStore.set("expiresAt", null);
+			}
+			tokenSessionId = sessionId;
+			tokenSessionInitialized = true;
 		}
 	});
 	const fetchAccessToken = async ({ forceRefreshToken = false } = {}) => {
 		const sessionState = sessionAccessor();
 		const currentSession = sessionState.data;
 		const currentIsPending = sessionState.isPending;
-		if (!hasActiveSessionData(currentSession)) {
+		const hasSession = hasActiveSessionData(currentSession);
+		const currentSessionId = getSessionId(currentSession);
+		if (!hasSession) {
 			if (!currentIsPending) {
 				authStore.set("token", null);
 				authStore.set("expiresAt", null);
@@ -2360,11 +2672,17 @@ function ConvexAuthProviderInner(props) {
 		const cachedToken = authStore.get("token");
 		const expiresAt = authStore.get("expiresAt");
 		const timeRemaining = expiresAt ? expiresAt - Date.now() : 0;
-		if (!forceRefreshToken && cachedToken && expiresAt && timeRemaining >= 6e4) return cachedToken;
-		if (!forceRefreshToken && pendingTokenPromise) return pendingTokenPromise;
+		if (!forceRefreshToken && cachedToken && expiresAt && currentSessionId === tokenSessionId && timeRemaining >= 6e4) return cachedToken;
+		if (!forceRefreshToken && pendingTokenPromise && pendingTokenSessionId === currentSessionId) return pendingTokenPromise;
 		const fetchOptions = { throw: false };
-		if (cachedToken && decodeJwtExp(cachedToken) === null) fetchOptions.headers = { Authorization: `Bearer ${cachedToken}` };
-		pendingTokenPromise = props.authClient.convex.token({ fetchOptions }).then((result) => {
+		if (cachedToken && currentSessionId === tokenSessionId && decodeJwtExp(cachedToken) === null) fetchOptions.headers = { Authorization: `Bearer ${cachedToken}` };
+		const sessionStillOwnsRequest = () => {
+			const latestSession = sessionAccessor().data;
+			return hasActiveSessionData(latestSession) && getSessionId(latestSession) === currentSessionId;
+		};
+		let tokenPromise;
+		tokenPromise = props.authClient.convex.token({ fetchOptions }).then((result) => {
+			if (!sessionStillOwnsRequest()) return null;
 			const jwt = result.data?.token || null;
 			if (jwt) {
 				const exp = decodeJwtExp(jwt);
@@ -2376,21 +2694,47 @@ function ConvexAuthProviderInner(props) {
 			authStore.set("expiresAt", null);
 			return null;
 		}).catch((error) => {
+			if (!sessionStillOwnsRequest()) return null;
 			authStore.set("token", null);
 			authStore.set("expiresAt", null);
 			console.error("[fetchAccessToken] error", error);
 			return null;
 		}).finally(() => {
-			pendingTokenPromise = null;
+			if (pendingTokenPromise === tokenPromise) {
+				pendingTokenPromise = null;
+				pendingTokenSessionId = void 0;
+			}
 		});
-		return pendingTokenPromise;
+		pendingTokenPromise = tokenPromise;
+		pendingTokenSessionId = currentSessionId;
+		return tokenPromise;
 	};
 	const useAuth = () => {
 		const sessionState = sessionAccessor();
 		const hasSession = hasActiveSessionData(sessionState.data);
 		const sessionMissing = !hasSession && !sessionState.isPending;
 		const token = authStore.get("token");
+		const sessionId = getSessionId(sessionState.data);
+		const claims = token && tokenSessionInitialized && sessionId === tokenSessionId ? decodeJwtIdentity(token) : null;
+		const sessionChanged = identityInitialized && sessionId !== identitySessionId;
+		if (!identityInitialized || sessionChanged) {
+			identityInitialized = true;
+			identitySessionId = sessionId;
+			identityClaims = sessionChanged ? null : claims;
+			authIdentity = !sessionChanged && claims ? JSON.stringify({
+				claims,
+				sessionId: sessionId ?? null
+			}) : sessionId ?? null;
+		} else if (claims && identityClaims === null) identityClaims = claims;
+		else if (claims && claims !== identityClaims) {
+			identityClaims = claims;
+			authIdentity = JSON.stringify({
+				claims,
+				sessionId: sessionId ?? null
+			});
+		}
 		return {
+			identity: authIdentity,
 			isLoading: sessionState.isPending && !token,
 			isAuthenticated: sessionMissing ? false : hasSession || token !== null,
 			fetchAccessToken
@@ -2543,15 +2887,8 @@ function createQueriesResults(queries) {
 //#endregion
 //#region src/solid/use-infinite-query.ts
 const PAGINATION_KEY_PREFIX = "__pagination__";
-const paginationIdStore = /* @__PURE__ */ new Map();
 let paginationIdCounter = 0;
-const getOrCreatePaginationId = (storeKey) => {
-	const existing = paginationIdStore.get(storeKey);
-	if (existing !== void 0) return existing;
-	const newId = ++paginationIdCounter;
-	paginationIdStore.set(storeKey, newId);
-	return newId;
-};
+const createPaginationId = () => ++paginationIdCounter;
 /** Read the identity of a Convex document, tolerating `id` and `_id` shapes */
 const getItemId = (item) => {
 	const doc = item;
@@ -2682,8 +3019,9 @@ const useStaleCursorRecovery = ({ argsObject, combined, limit, pageResults, setS
 * Use `useInfiniteQuery` for the public API with auth handling.
 */
 const useInfiniteQueryInternal = (query, args, options) => {
-	const { limit, enabled, placeholderData, ...queryOptions } = options;
+	const { limit, authType, enabled, placeholderData, ...queryOptions } = options;
 	const safeAuth = useSafeConvexAuth();
+	const authEpoch = () => useAuthValue("authEpoch");
 	const meta = useMeta();
 	const queryClient = useQueryClient();
 	const prefetchedFirstPage = createMemo(() => {
@@ -2698,7 +3036,7 @@ const useInfiniteQueryInternal = (query, args, options) => {
 		];
 		return queryClient.getQueryData(serverQueryKey) ?? null;
 	});
-	const skip = createMemo(() => !prefetchedFirstPage() && (safeAuth.isLoading || enabled === false));
+	const skip = createMemo(() => !prefetchedFirstPage() && (safeAuth.isLoading || enabled?.() === false));
 	const getPaginationState = (key) => {
 		const queryKey = [PAGINATION_KEY_PREFIX, key];
 		return queryClient.getQueryData(queryKey);
@@ -2710,10 +3048,11 @@ const useInfiniteQueryInternal = (query, args, options) => {
 	const argsObject = createMemo(() => skip() ? {} : args);
 	const storeKey = createMemo(() => JSON.stringify({
 		query: getFunctionName(query),
-		args: argsObject()
+		args: argsObject(),
+		...authType ? { authEpoch: authEpoch() } : {}
 	}));
 	const createInitialState = () => {
-		const id = getOrCreatePaginationId(storeKey());
+		const id = createPaginationId();
 		return {
 			id,
 			nextPageKey: 1,
@@ -2790,10 +3129,9 @@ const useInfiniteQueryInternal = (query, args, options) => {
 		const pageArgs = state().queries[key]?.args;
 		return {
 			...convexQuery(query, pageArgs ? (({ __paginationId, ...rest }) => rest)(pageArgs) : "skip", meta),
-			enabled: !skip() && !!state().queries[key],
+			enabled: resolveEnabled(!skip() && !!state().queries[key] && (!authType || !safeAuth.isLoading), enabled?.()),
 			structuralSharing: false,
 			...queryOptions ?? {},
-			...index === 0 && prefetchedFirstPage() ? { initialData: prefetchedFirstPage() } : {},
 			...index === 0 && placeholderData ? { placeholderData: {
 				page: placeholderData,
 				isDone: false,
@@ -2941,34 +3279,36 @@ function useInfiniteQuery(infiniteOptions) {
 	const query = infiniteOptions[FUNC_REF_SYMBOL];
 	const onQueryUnauthorized = useAuthValue("onQueryUnauthorized");
 	const safeAuth = useSafeConvexAuth();
-	const { queryKey: _queryKey, staleTime: _staleTime, refetchInterval: _refetchInterval, refetchOnMount: _refetchOnMount, refetchOnReconnect: _refetchOnReconnect, refetchOnWindowFocus: _refetchOnWindowFocus, enabled: factoryEnabled, meta, ...queryOptions } = infiniteOptions;
+	const { queryKey: _queryKey, staleTime: _staleTime, refetchInterval: _refetchInterval, refetchOnMount: _refetchOnMount, refetchOnReconnect: _refetchOnReconnect, refetchOnWindowFocus: _refetchOnWindowFocus, enabled: _enabled, meta, ...queryOptions } = infiniteOptions;
 	const { queryName, args, limit, authType, skipUnauth } = meta;
 	const skipUnauthFinal = skipUnauth ?? false;
-	const isUnauthorized = authType === "required" && !safeAuth.isLoading && !safeAuth.isAuthenticated;
-	const shouldSkip = factoryEnabled === false || authType === "required" && safeAuth.isLoading || authType === "required" && !safeAuth.isAuthenticated;
+	const factoryEnabled = () => infiniteOptions.enabled;
+	const isUnauthorized = createMemo(() => authType === "required" && !safeAuth.isLoading && !safeAuth.isAuthenticated);
+	const shouldSkip = createMemo(() => factoryEnabled() === false || authType === "required" && safeAuth.isLoading || authType === "required" && !safeAuth.isAuthenticated);
 	const authError = createMemo(() => {
-		if (isUnauthorized && !skipUnauthFinal) return new CRPCClientError({
+		if (isUnauthorized() && !skipUnauthFinal) return new CRPCClientError({
 			code: "UNAUTHORIZED",
 			functionName: queryName
 		});
 		return null;
 	});
 	createEffect(() => {
-		if (isUnauthorized && !skipUnauthFinal) onQueryUnauthorized({ queryName });
+		if (isUnauthorized() && !skipUnauthFinal) onQueryUnauthorized({ queryName });
 	});
 	const result = useInfiniteQueryInternal(query, args, {
+		authType,
 		limit,
 		...queryOptions,
-		enabled: !shouldSkip
+		enabled: () => resolveEnabled(!shouldSkip(), factoryEnabled())
 	});
 	const authLoadingApplies = authType === "optional" || authType === "required";
-	const isSkippedUnauth = isUnauthorized && skipUnauthFinal;
+	const isSkippedUnauth = createMemo(() => isUnauthorized() && skipUnauthFinal);
 	return {
 		get data() {
-			return isSkippedUnauth ? [] : result.data;
+			return isSkippedUnauth() ? [] : result.data;
 		},
 		get pages() {
-			return isSkippedUnauth ? [] : result.pages;
+			return isSkippedUnauth() ? [] : result.pages;
 		},
 		get error() {
 			return authError() ?? result.error;
@@ -2977,12 +3317,12 @@ function useInfiniteQuery(infiniteOptions) {
 			return authError() ? true : result.isError;
 		},
 		get isPlaceholderData() {
-			return isSkippedUnauth ? false : result.isPlaceholderData;
+			return isSkippedUnauth() ? false : result.isPlaceholderData;
 		},
 		get isLoading() {
 			const ae = authError();
 			const isClientError = isCRPCClientError(result.error);
-			return authLoadingApplies && safeAuth.isLoading || !isClientError && !ae && !isSkippedUnauth && result.isLoading;
+			return authLoadingApplies && safeAuth.isLoading || !isClientError && !ae && !isSkippedUnauth() && result.isLoading;
 		},
 		get isFetching() {
 			return result.isFetching;