kitcn 0.21.0 → 0.22.0

package/dist/auth/client/index.d.ts

@@ -1,5 +1,5 @@
 'use client';
-import { r as AuthStore } from "../../auth-store-47WTg13B.js";
+import { r as AuthStore } from "../../auth-store-DHEk0ARa.js";
 import { ConvexReactClient } from "convex/react";
 import { ReactNode } from "react";
 import * as react_jsx_runtime0 from "react/jsx-runtime";

package/dist/auth/client/index.js

@@ -1,5 +1,5 @@
 'use client';
-import { A as CRPCClientError, C as decodeJwtExp, D as readAuthSessionFallbackToken, E as readAuthSessionFallbackData, O as writeAuthSessionFallbackData, T as clearAuthSessionFallback, d as isSessionSyncGraceActive, g as useAuthValue, h as useAuthStore, j as defaultIsUnauthorized, n as AuthProvider, o as ConvexProviderWithAuth$1, s as FetchAccessTokenContext, t as AUTH_SESSION_SYNC_GRACE_MS } from "../../auth-store-BHk8eMnX.js";
+import { A as CRPCClientError, C as decodeJwtExp, D as readAuthSessionFallbackToken, E as readAuthSessionFallbackData, O as writeAuthSessionFallbackData, T as clearAuthSessionFallback, d as isSessionSyncGraceActive, g as useAuthValue, h as useAuthStore, j as defaultIsUnauthorized, n as AuthProvider, o as ConvexProviderWithAuth$1, s as FetchAccessTokenContext, t as AUTH_SESSION_SYNC_GRACE_MS } from "../../auth-store-BnsWs1xd.js";
 import { useConvexAuth } from "convex/react";
 import { useCallback, useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/{auth-store-BHk8eMnX.js → auth-store-BnsWs1xd.js}

@@ -216,7 +216,8 @@ const { AuthProvider, useAuthStore, useAuthState, useAuthValue } = createAtomSto
 	expiresAt: null,
 	isLoading: true,
 	isAuthenticated: false,
-	sessionSyncGraceUntil: null
+	sessionSyncGraceUntil: null,
+	authEpoch: 0
 }, {
 	name: "auth",
 	suppressWarnings: true

package/dist/{auth-store-47WTg13B.d.ts → auth-store-DHEk0ARa.d.ts}

@@ -49,6 +49,12 @@ type AuthStoreState = {
   isLoading: boolean; /** Auth state (synced from useConvexAuth for class methods) */
   isAuthenticated: boolean; /** Grace window for freshly seeded auth tokens while session sync catches up */
   sessionSyncGraceUntil: number | null;
+  /**
+   * Account generation, advanced on every identity transition. Client state
+   * that only makes sense inside one account's result set — paginated cursor
+   * chains — keys on it so it is rebuilt instead of reused across accounts.
+   */
+  authEpoch: number;
 };
 declare const AUTH_SESSION_SYNC_GRACE_MS = 10000;
 declare const isSessionSyncGraceActive: (sessionSyncGraceUntil: number | null) => boolean;
@@ -63,6 +69,7 @@ declare const AuthProvider: react.FC<jotai_x0.ProviderProps<{
     isLoading: boolean;
     isAuthenticated: boolean;
     sessionSyncGraceUntil: number | null;
+    authEpoch: number;
   }>>, useAuthStore: jotai_x0.UseStoreApi<AuthStoreState, object>, useAuthState: <K extends keyof AuthStoreState>(key: K, options?: string | jotai_x0.UseAtomOptions) => ({
     onMutationUnauthorized: jotai_x0.SimpleWritableAtom<() => void>;
     onQueryUnauthorized: jotai_x0.SimpleWritableAtom<(info: {
@@ -74,6 +81,7 @@ declare const AuthProvider: react.FC<jotai_x0.ProviderProps<{
     isLoading: jotai_x0.SimpleWritableAtom<boolean>;
     isAuthenticated: jotai_x0.SimpleWritableAtom<boolean>;
     sessionSyncGraceUntil: jotai_x0.SimpleWritableAtom<number | null>;
+    authEpoch: jotai_x0.SimpleWritableAtom<number>;
   } & object)[K] extends jotai_vanilla0.WritableAtom<infer V, infer A extends unknown[], infer R> ? [V, (...args: A) => R] : never, useAuthValue: <K extends keyof AuthStoreState, S = (({
     onMutationUnauthorized: jotai_x0.SimpleWritableAtom<() => void>;
     onQueryUnauthorized: jotai_x0.SimpleWritableAtom<(info: {
@@ -85,6 +93,7 @@ declare const AuthProvider: react.FC<jotai_x0.ProviderProps<{
     isLoading: jotai_x0.SimpleWritableAtom<boolean>;
     isAuthenticated: jotai_x0.SimpleWritableAtom<boolean>;
     sessionSyncGraceUntil: jotai_x0.SimpleWritableAtom<number | null>;
+    authEpoch: jotai_x0.SimpleWritableAtom<number>;
   } & object)[K] extends jotai_vanilla0.Atom<infer V> ? V : never)>(key: K, options?: ({
     selector?: ((v: ({
       onMutationUnauthorized: jotai_x0.SimpleWritableAtom<() => void>;
@@ -97,6 +106,7 @@ declare const AuthProvider: react.FC<jotai_x0.ProviderProps<{
       isLoading: jotai_x0.SimpleWritableAtom<boolean>;
       isAuthenticated: jotai_x0.SimpleWritableAtom<boolean>;
       sessionSyncGraceUntil: jotai_x0.SimpleWritableAtom<number | null>;
+      authEpoch: jotai_x0.SimpleWritableAtom<number>;
     } & object)[K] extends jotai_vanilla0.Atom<infer V_1> ? V_1 : never, prevSelectorOutput?: S | undefined) => S) | undefined;
     equalityFn?: ((prev: S, next: S) => boolean) | undefined;
   } & jotai_x0.UseAtomOptions) | undefined, deps?: unknown[]) => S;

package/dist/react/index.d.ts

@@ -1,5 +1,5 @@
 'use client';
-import { A as decodeJwtExp, C as useAuthValue, D as useIsAuth, E as useFetchAccessToken, O as useMaybeAuth, S as useAuthStore, T as useConvexAuthRecovery, _ as Unauthenticated, a as Authenticated, b as useAuthGuard, c as ConvexAuthRecoveryError, d as ConvexAuthRecoveryStatus, f as ConvexProviderWithAuth, g as MaybeUnauthenticated, h as MaybeAuthenticated, i as AuthStoreState, k as useSafeConvexAuth, l as ConvexAuthRecoveryErrorCode, m as FetchAccessTokenFn, n as AuthProvider, o as ConvexAuthBridge, p as FetchAccessTokenContext, r as AuthStore, s as ConvexAuthRecovery, t as AUTH_SESSION_SYNC_GRACE_MS, u as ConvexAuthRecoveryOptions, v as isSessionSyncGraceActive, w as useConvexAuthBridge, x as useAuthState, y as useAuth } from "../auth-store-47WTg13B.js";
+import { A as decodeJwtExp, C as useAuthValue, D as useIsAuth, E as useFetchAccessToken, O as useMaybeAuth, S as useAuthStore, T as useConvexAuthRecovery, _ as Unauthenticated, a as Authenticated, b as useAuthGuard, c as ConvexAuthRecoveryError, d as ConvexAuthRecoveryStatus, f as ConvexProviderWithAuth, g as MaybeUnauthenticated, h as MaybeAuthenticated, i as AuthStoreState, k as useSafeConvexAuth, l as ConvexAuthRecoveryErrorCode, m as FetchAccessTokenFn, n as AuthProvider, o as ConvexAuthBridge, p as FetchAccessTokenContext, r as AuthStore, s as ConvexAuthRecovery, t as AUTH_SESSION_SYNC_GRACE_MS, u as ConvexAuthRecoveryOptions, v as isSessionSyncGraceActive, w as useConvexAuthBridge, x as useAuthState, y as useAuth } from "../auth-store-DHEk0ARa.js";
 import { ConvexProvider, ConvexReactClient, ConvexReactClient as ConvexReactClient$1, ConvexReactClientOptions, Watch, WatchQueryOptions, useConvex } from "convex/react";
 import { ReactNode } from "react";
 import * as react_jsx_runtime0 from "react/jsx-runtime";
@@ -235,7 +235,6 @@ declare class ConvexQueryClient {
   private cancelPendingUnsubscribe;
   /** Unsubscribe a live Convex watch (if present) and remove it from the subscription map. */
   private unsubscribeQueryByHash;
-  private isAuthBoundQuery;
   private subscribeQuery;
   /** Update auth store (for HMR where jotai store may reset) */
   updateAuthStore(authStore?: AuthStore): void;
@@ -271,6 +270,12 @@ declare class ConvexQueryClient {
    * Call before logout to prevent UNAUTHORIZED errors during session invalidation.
    */
   unsubscribeAuthQueries(): void;
+  /**
+   * Advance the account generation published by the auth store.
+   * Client state that only makes sense inside one account's result set —
+   * paginated cursor chains — keys on it, so it is rebuilt instead of reused.
+   */
+  private bumpAuthEpoch;
   resetAuthQueries(): Promise<void>;
   /**
    * Batch update all subscriptions.

package/dist/react/index.js

@@ -1,5 +1,5 @@
 'use client';
-import { A as CRPCClientError, C as decodeJwtExp, M as isCRPCClientError, O as writeAuthSessionFallbackData, S as useSafeConvexAuth, T as clearAuthSessionFallback, _ as useConvexAuthBridge, a as ConvexAuthRecoveryError, b as useIsAuth, c as MaybeAuthenticated, d as isSessionSyncGraceActive, f as useAuth, g as useAuthValue, h as useAuthStore, i as ConvexAuthBridge, j as defaultIsUnauthorized, k as writeAuthSessionFallbackToken, l as MaybeUnauthenticated, m as useAuthState, n as AuthProvider, o as ConvexProviderWithAuth, p as useAuthGuard, r as Authenticated, s as FetchAccessTokenContext, t as AUTH_SESSION_SYNC_GRACE_MS, u as Unauthenticated, v as useConvexAuthRecovery, w as decodeJwtIdentity, x as useMaybeAuth, y as useFetchAccessToken } from "../auth-store-BHk8eMnX.js";
+import { A as CRPCClientError, C as decodeJwtExp, M as isCRPCClientError, O as writeAuthSessionFallbackData, S as useSafeConvexAuth, T as clearAuthSessionFallback, _ as useConvexAuthBridge, a as ConvexAuthRecoveryError, b as useIsAuth, c as MaybeAuthenticated, d as isSessionSyncGraceActive, f as useAuth, g as useAuthValue, h as useAuthStore, i as ConvexAuthBridge, j as defaultIsUnauthorized, k as writeAuthSessionFallbackToken, l as MaybeUnauthenticated, m as useAuthState, n as AuthProvider, o as ConvexProviderWithAuth, p as useAuthGuard, r as Authenticated, s as FetchAccessTokenContext, t as AUTH_SESSION_SYNC_GRACE_MS, u as Unauthenticated, v as useConvexAuthRecovery, w as decodeJwtIdentity, x as useMaybeAuth, y as useFetchAccessToken } from "../auth-store-BnsWs1xd.js";
 import { ConvexProvider, ConvexReactClient, ConvexReactClient as ConvexReactClient$1, useAction, useConvex, useMutation } from "convex/react";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
@@ -1647,7 +1647,6 @@ function createAuthMutations(authClient) {
 	});
 	const useSignInSocialMutationOptions = ((options) => {
 		const authStoreApi = useAuthStore();
-		const convexQueryClient = useConvexQueryClient();
 		return {
 			...options,
 			mutationFn: async (args) => {
@@ -1659,14 +1658,12 @@ function createAuthMutations(authClient) {
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
 				authStoreApi.set("isAuthenticated", true);
-				await convexQueryClient?.resetAuthQueries();
 				return res;
 			}
 		};
 	});
 	const useSignInMutationOptions = ((options) => {
 		const authStoreApi = useAuthStore();
-		const convexQueryClient = useConvexQueryClient();
 		const { signInMethod = "email", ...mutationOptions } = options ?? {};
 		return {
 			...mutationOptions,
@@ -1679,14 +1676,12 @@ function createAuthMutations(authClient) {
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
 				authStoreApi.set("isAuthenticated", true);
-				await convexQueryClient?.resetAuthQueries();
 				return res;
 			}
 		};
 	});
 	const useSignUpMutationOptions = ((options) => {
 		const authStoreApi = useAuthStore();
-		const convexQueryClient = useConvexQueryClient();
 		return {
 			...options,
 			mutationFn: async (args) => {
@@ -1698,7 +1693,6 @@ function createAuthMutations(authClient) {
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
 				authStoreApi.set("isAuthenticated", true);
-				await convexQueryClient?.resetAuthQueries();
 				return res;
 			}
 		};
@@ -1711,6 +1705,81 @@ function createAuthMutations(authClient) {
 	};
 }
 
+//#endregion
+//#region src/internal/auth-reset.ts
+/**
+* Erase the cached result of every auth-bound query.
+*
+* `queryClient.resetQueries()` is not enough. It restores each query's
+* `initialState`, and query-core derives that from `initialData` when the query
+* is built, never re-deriving it once real data lands. An auth-bound entry
+* therefore comes back holding the previous account's rows marked `success`,
+* and nothing corrects it: Convex query options set `staleTime: Infinity` with
+* every refetch trigger off, and `resetQueries` only refetches entries that are
+* currently active.
+*
+* Every entry is removed so query-core forgets both its current state and its
+* private `initialState`. Mounted observers are rebound with `initialData`
+* removed, creating a pristine replacement query that future public resets
+* cannot use to resurrect the previous account's rows.
+*/
+async function clearAuthBoundQueries(cache, isAuthBound) {
+	const authQueries = cache.getAll().filter((query) => isAuthBound(query));
+	const restoreObservers = [];
+	await Promise.all(authQueries.map((query) => query.cancel({ silent: true })));
+	for (const query of authQueries) {
+		const observers = [...query.observers];
+		cache.remove(query);
+		for (const observer of observers) {
+			const previousOptions = observer.options;
+			observer.setOptions({
+				...observer.options,
+				enabled: false,
+				initialData: void 0,
+				placeholderData: void 0
+			});
+			const suspendedOptions = observer.options;
+			restoreObservers.push(() => {
+				const currentOptions = observer.options;
+				observer.setOptions({
+					...currentOptions,
+					enabled: observer.options === suspendedOptions ? previousOptions.enabled : currentOptions.enabled,
+					initialData: void 0,
+					placeholderData: void 0
+				});
+			});
+		}
+	}
+	return () => {
+		for (const restoreObserver of restoreObservers) restoreObserver();
+	};
+}
+
+//#endregion
+//#region src/internal/subscription-gate.ts
+/** Read kitcn's meta off a TanStack query. */
+function readConvexQueryMeta(query) {
+	return query.meta;
+}
+/**
+* Auth-bound queries are cleared and resubscribed on an identity transition so
+* one account never renders another account's cached rows.
+*/
+function isAuthBoundQuery(query) {
+	const authType = readConvexQueryMeta(query)?.authType;
+	return authType === "required" || authType === "optional";
+}
+/** Whether a Convex subscription may be opened for this query. */
+function canSubscribeQuery(query, opts) {
+	if (opts.isSubscribed) return false;
+	const meta = readConvexQueryMeta(query);
+	if (meta?.subscribe === false) return false;
+	if (query.getObserversCount() === 0) return false;
+	if (query.isDisabled()) return false;
+	if (opts.shouldSkipSubscription(meta?.authType)) return false;
+	return true;
+}
+
 //#endregion
 //#region src/react/client.ts
 /**
@@ -1882,17 +1951,11 @@ var ConvexQueryClient = class {
 		sub.unsubscribe();
 		delete this.subscriptions[queryHash];
 	}
-	isAuthBoundQuery(query) {
-		const meta = query.meta;
-		return meta?.authType === "required" || meta?.authType === "optional";
-	}
 	subscribeQuery(query) {
-		if (this.subscriptions[query.queryHash]) return;
-		const meta = query.meta;
-		if (meta?.subscribe === false) return;
-		if (query.getObserversCount() === 0) return;
-		if (query.isDisabled()) return;
-		if (this.shouldSkipSubscription(meta?.authType)) return;
+		if (!canSubscribeQuery(query, {
+			isSubscribed: !!this.subscriptions[query.queryHash],
+			shouldSkipSubscription: (authType) => this.shouldSkipSubscription(authType)
+		})) return;
 		const [, funcName, args] = query.queryKey;
 		const watch = this.convexClient.watchQuery(funcName, this.transformer.input.serialize(args));
 		const unsubscribe = watch.onUpdate(() => {
@@ -1986,14 +2049,29 @@ var ConvexQueryClient = class {
 			this.unsubscribeQueryByHash(queryHash);
 		}
 	}
+	/**
+	* Advance the account generation published by the auth store.
+	* Client state that only makes sense inside one account's result set —
+	* paginated cursor chains — keys on it, so it is rebuilt instead of reused.
+	*/
+	bumpAuthEpoch() {
+		if (!this.authStore) return;
+		this.authStore.set("authEpoch", this.authStore.get("authEpoch") + 1);
+	}
 	async resetAuthQueries() {
-		const authQueries = this.queryClient.getQueryCache().getAll().filter((query) => this.isAuthBoundQuery(query));
-		for (const query of authQueries) {
+		const queryCache = this.queryClient.getQueryCache();
+		for (const query of queryCache.getAll()) {
+			if (!isAuthBoundQuery(query)) continue;
 			this.cancelPendingUnsubscribe(query.queryHash);
 			this.unsubscribeQueryByHash(query.queryHash);
 		}
-		await this.queryClient.resetQueries({ predicate: (query) => this.isAuthBoundQuery(query) });
-		for (const query of this.queryClient.getQueryCache().getAll()) if (this.isAuthBoundQuery(query)) this.subscribeQuery(query);
+		this.bumpAuthEpoch();
+		(await clearAuthBoundQueries(queryCache, (query) => isAuthBoundQuery(query)))();
+		await this.queryClient.refetchQueries({
+			predicate: (query) => isAuthBoundQuery(query),
+			type: "active"
+		});
+		for (const query of queryCache.getAll()) if (isAuthBoundQuery(query)) this.subscribeQuery(query);
 	}
 	/**
 	* Batch update all subscriptions.
@@ -2270,15 +2348,8 @@ const shouldSplitPaginationPage = (page, initialNumItems) => Boolean(page.splitC
 //#region src/react/use-infinite-query.ts
 /** biome-ignore-all lint/suspicious/noExplicitAny: Convex query/mutation type compatibility */
 const PAGINATION_KEY_PREFIX = "__pagination__";
-const paginationIdStore = /* @__PURE__ */ new Map();
 let paginationIdCounter = 0;
-const getOrCreatePaginationId = (storeKey) => {
-	const existing = paginationIdStore.get(storeKey);
-	if (existing !== void 0) return existing;
-	const newId = ++paginationIdCounter;
-	paginationIdStore.set(storeKey, newId);
-	return newId;
-};
+const createPaginationId = () => ++paginationIdCounter;
 /** Build a unique key for recovery attempt detection */
 const buildRecoveryKey = (pageKeys, page0Cursor, page0UpdatedAt) => JSON.stringify({
 	pageKeys,
@@ -2360,12 +2431,13 @@ const useStaleCursorRecovery = ({ argsObject, combined, limit, setState, state }
 * Use `useInfiniteQuery` for the public API with auth handling.
 */
 const useInfiniteQueryInternal = (query, args, options) => {
-	const { limit, enabled, placeholderData, ...forwardedOptions } = options;
+	const { limit, authType, enabled, placeholderData, ...forwardedOptions } = options;
 	const queryOptions = useStableIdentity(forwardedOptions);
 	const { isLoading: isAuthLoading } = useSafeConvexAuth();
 	const meta = useMeta();
 	const queryClient = useQueryClient();
-	const prefetchedFirstPage = useMemo(() => {
+	const authEpoch = useAuthValue("authEpoch");
+	const skip = !useMemo(() => {
 		const serverQueryKey = [
 			"convexQuery",
 			getFunctionName(query),
@@ -2381,8 +2453,7 @@ const useInfiniteQueryInternal = (query, args, options) => {
 		JSON.stringify(args),
 		limit,
 		queryClient
-	]);
-	const skip = !prefetchedFirstPage && (isAuthLoading || enabled === false);
+	]) && (isAuthLoading || enabled === false);
 	const getPaginationState = useCallback((key) => {
 		const queryKey = [PAGINATION_KEY_PREFIX, key];
 		return queryClient.getQueryData(queryKey);
@@ -2394,10 +2465,16 @@ const useInfiniteQueryInternal = (query, args, options) => {
 	const argsObject = useMemo(() => skip ? {} : args, [skip, JSON.stringify(args)]);
 	const storeKey = useMemo(() => JSON.stringify({
 		query: getFunctionName(query),
-		args: argsObject
-	}), [query, argsObject]);
+		args: argsObject,
+		...authType ? { authEpoch } : {}
+	}), [
+		query,
+		argsObject,
+		authType,
+		authEpoch
+	]);
 	const createInitialState = useCallback(() => {
-		const id = getOrCreatePaginationId(storeKey);
+		const id = createPaginationId();
 		return {
 			id,
 			nextPageKey: 1,
@@ -2411,7 +2488,6 @@ const useInfiniteQueryInternal = (query, args, options) => {
 			version: 0
 		};
 	}, [
-		storeKey,
 		skip,
 		argsObject,
 		limit
@@ -2484,10 +2560,9 @@ const useInfiniteQueryInternal = (query, args, options) => {
 			const pageArgs = state.queries[key]?.args;
 			return {
 				...convexQuery(query, pageArgs ? (({ __paginationId, ...rest }) => rest)(pageArgs) : "skip", meta),
-				enabled: resolveEnabled(!skip && !!state.queries[key], enabled),
+				enabled: resolveEnabled(!skip && !!state.queries[key] && (!authType || !isAuthLoading), enabled),
 				structuralSharing: false,
 				...queryOptions ?? {},
-				...index === 0 && prefetchedFirstPage ? { initialData: prefetchedFirstPage } : {},
 				...index === 0 && placeholderData ? { placeholderData: {
 					page: placeholderData,
 					isDone: false,
@@ -2502,7 +2577,6 @@ const useInfiniteQueryInternal = (query, args, options) => {
 			enabled,
 			meta,
 			queryOptions,
-			prefetchedFirstPage,
 			placeholderData
 		]),
 		combine: useCallback((results) => {
@@ -2689,6 +2763,7 @@ function useInfiniteQuery(infiniteOptions) {
 	]);
 	const enabled = useMemo(() => resolveEnabled(!shouldSkip, factoryEnabled), [shouldSkip, factoryEnabled]);
 	const result = useInfiniteQueryInternal(query, args, {
+		authType,
 		limit,
 		...queryOptions,
 		enabled

package/dist/solid/index.d.ts

@@ -210,11 +210,15 @@ declare const FetchAccessTokenContext: solid_js0.Context<FetchAccessTokenFn | nu
 /** Get fetchAccessToken from context (available immediately, no race condition) */
 declare const useFetchAccessToken: () => FetchAccessTokenFn | null;
 type ConvexAuthResult = {
+  identity: unknown;
   isAuthenticated: boolean;
   isLoading: boolean;
 };
+type ConvexAuthBridgeResult = ConvexAuthResult & {
+  authEpoch: number;
+};
 /** Get auth from bridge context (null if no bridge configured) */
-declare const useConvexAuthBridge: () => ConvexAuthResult | null;
+declare const useConvexAuthBridge: () => ConvexAuthBridgeResult | null;
 type AuthStoreState = {
   /** Callback when mutation/action called while unauthorized. Throws by default. */onMutationUnauthorized: () => void; /** Callback when query called while unauthorized. Noop by default. */
   onQueryUnauthorized: (info: {
@@ -225,6 +229,12 @@ type AuthStoreState = {
   expiresAt: number | null; /** Auth loading state (synced from useConvexAuth for class methods) */
   isLoading: boolean; /** Auth state (synced from useConvexAuth for class methods) */
   isAuthenticated: boolean;
+  /**
+   * Account generation, advanced on every identity transition. Client state
+   * that only makes sense inside one account's result set — paginated cursor
+   * chains — keys on it so it is rebuilt instead of reused across accounts.
+   */
+  authEpoch: number;
 };
 /** Decode JWT expiration (ms timestamp) from token */
 declare function decodeJwtExp(token: string): number | null;
@@ -258,6 +268,8 @@ declare function useSafeConvexAuth(): ConvexAuthResult;
  * @internal
  */
 declare function ConvexAuthBridge(props: ParentProps<{
+  authEpoch?: number;
+  identity?: unknown;
   isLoading: boolean;
   isAuthenticated: boolean;
 }>): JSX.Element;
@@ -369,6 +381,12 @@ declare class ConvexQueryClient {
   ssrQueryMode: 'consistent' | 'inconsistent';
   /** Auth store for checking auth state */
   private authStore?;
+  /** In-flight clear shared by overlapping account identity transitions. */
+  private authBarrierClear?;
+  /** Blocks auth-bound work created while Convex is changing identity. */
+  private authSettlementBarrier?;
+  /** Latest account transition allowed to restore and refetch observers. */
+  private authResetGeneration;
   /** Delay before unsubscribing when query has no observers */
   private unsubscribeDelay;
   /** Payload transformer used across request/response boundaries. */
@@ -381,6 +399,11 @@ declare class ConvexQueryClient {
   private cancelPendingUnsubscribe;
   /** Unsubscribe a live Convex subscription (if present) and remove it from the subscription map. */
   private unsubscribeQueryByHash;
+  /**
+   * Open a Convex subscription for a query, if the shared gate allows it.
+   * Single owner of the subscribe preconditions for every cache-event branch.
+   */
+  private subscribeQuery;
   /** Update auth store (for HMR where store may reset) */
   updateAuthStore(authStore?: AuthStore): void;
   /** Get current auth state from store */
@@ -390,6 +413,10 @@ declare class ConvexQueryClient {
    * Needed for useSuspenseQuery which ignores enabled: false.
    */
   private shouldSkipSubscription;
+  /** Hold new auth-bound requests until the latest Convex identity settles. */
+  private beginAuthSettlementBarrier;
+  /** Wait through overlapping barriers and stop canceled requests. */
+  private waitForAuthSettlement;
   /** Get QueryClient, throwing if not connected */
   get queryClient(): QueryClient;
   /**
@@ -414,6 +441,25 @@ declare class ConvexQueryClient {
    * Call before logout to prevent UNAUTHORIZED errors during session invalidation.
    */
   unsubscribeAuthQueries(): void;
+  /**
+   * Advance the account generation published by the auth store.
+   * Client state that only makes sense inside one account's result set —
+   * paginated cursor chains — keys on it, so it is rebuilt instead of reused.
+   */
+  private bumpAuthEpoch;
+  /** Drop auth-bound data without fetching while Convex changes identity. */
+  private clearAuthQueries;
+  /** Refetch and resubscribe auth-bound queries after Convex settles. */
+  private refetchAuthQueries;
+  /**
+   * Drop every auth-bound cache entry and resubscribe.
+   * Call after an identity transition when no separate settlement barrier owns
+   * the clear/refetch phases.
+   */
+  resetAuthQueries(options?: {
+    generation?: number;
+    refetch?: boolean;
+  }): Promise<number>;
   /**
    * Batch update all subscriptions.
    * Called internally when Convex client reconnects.
@@ -1271,6 +1317,7 @@ declare function ConvexProvider(props: ParentProps<{
 declare function ConvexProviderWithAuth(props: ParentProps<{
   client: ConvexClient;
   useAuth: () => {
+    /** Stable account/session identity. Token refreshes must keep this value. */identity?: string | null;
     isLoading: boolean;
     isAuthenticated: boolean;
     fetchAccessToken: AuthTokenFetcher;
@@ -1477,7 +1524,9 @@ declare function useConvexInfiniteQueryOptions<T extends FunctionReference<'quer
  */
 declare function useConvexActionQueryOptions<Action extends FunctionReference<'action'>>(action: Action, args: FunctionArgs<Action> | SkipToken, options?: {
   skipUnauth?: boolean;
-} & DistributiveOmit<SolidQueryOptions<FunctionReturnType<Action>, DefaultError>, ReservedQueryOptions>): ConvexActionOptions<Action>;
+} & DistributiveOmit<SolidQueryOptions<FunctionReturnType<Action>, DefaultError>, ReservedQueryOptions>): ConvexActionOptions<Action> & {
+  meta: ConvexQueryMeta;
+};
 /**
  * Hook that returns mutation options for use with useMutation.
  * Wraps the Convex mutation with auth guard logic.

package/dist/solid/index.js

@@ -1,5 +1,5 @@
 import { getFunctionName } from "convex/server";
-import { Show, createComputed, createContext, createEffect, createMemo, createRenderEffect, createSignal, on, onCleanup, onMount, useContext } from "solid-js";
+import { Show, batch, createComputed, createContext, createEffect, createMemo, createRenderEffect, createSignal, on, onCleanup, onMount, useContext } from "solid-js";
 import { createComponent, memo } from "solid-js/web";
 import { createStore } from "solid-js/store";
 import { notifyManager, skipToken, useQueryClient } from "@tanstack/solid-query";
@@ -78,7 +78,8 @@ const defaultState = {
 	token: null,
 	expiresAt: null,
 	isLoading: true,
-	isAuthenticated: false
+	isAuthenticated: false,
+	authEpoch: 0
 };
 const AuthStoreContext = createContext(null);
 function useAuthStore() {
@@ -91,7 +92,14 @@ function useAuthStore() {
 	return ctx;
 }
 function useAuthValue(key) {
-	return useAuthStore().get(key);
+	const store = useAuthStore();
+	const bridgeAuth = useConvexAuthBridge();
+	if (!store.store && bridgeAuth) {
+		if (key === "authEpoch") return bridgeAuth.authEpoch;
+		if (key === "isAuthenticated") return bridgeAuth.isAuthenticated;
+		if (key === "isLoading") return bridgeAuth.isLoading;
+	}
+	return store.get(key);
 }
 function AuthProvider(props) {
 	const [state, setState] = createStore({
@@ -125,14 +133,17 @@ function useSafeConvexAuth() {
 	const authStore = useAuthStore();
 	const bridgeAuth = useConvexAuthBridge();
 	return {
+		get identity() {
+			return bridgeAuth?.identity ?? null;
+		},
 		get isAuthenticated() {
-			if (authStore.store) return authStore.get("isAuthenticated");
 			if (bridgeAuth !== null) return bridgeAuth.isAuthenticated;
+			if (authStore.store) return authStore.get("isAuthenticated");
 			return false;
 		},
 		get isLoading() {
-			if (authStore.store) return authStore.get("isLoading");
 			if (bridgeAuth !== null) return bridgeAuth.isLoading;
+			if (authStore.store) return authStore.get("isLoading");
 			return false;
 		}
 	};
@@ -144,6 +155,12 @@ function useSafeConvexAuth() {
 function ConvexAuthBridge(props) {
 	return createComponent(ConvexAuthBridgeContext.Provider, {
 		value: {
+			get authEpoch() {
+				return props.authEpoch ?? 0;
+			},
+			get identity() {
+				return props.identity ?? null;
+			},
 			get isLoading() {
 				return props.isLoading;
 			},
@@ -991,6 +1008,19 @@ function convexInfiniteQueryOptions(funcRef, args, opts = {}, meta) {
 /** Symbol key for attaching FunctionReference to options (non-serializable) */
 const FUNC_REF_SYMBOL = Symbol.for("convex.funcRef");
 
+//#endregion
+//#region src/internal/enabled.ts
+/**
+* Combine a computed gate with the caller's `enabled` option.
+* A predicate is preserved (never collapsed to a boolean) so TanStack Query
+* keeps evaluating it; `allowed: false` always wins.
+*/
+function resolveEnabled(allowed, enabled) {
+	if (!allowed) return false;
+	if (typeof enabled === "function") return (query) => enabled(query) !== false;
+	return enabled ?? true;
+}
+
 //#endregion
 //#region src/solid/convex-solid.tsx
 /** @jsxImportSource solid-js */
@@ -1018,25 +1048,52 @@ function ConvexProvider(props) {
 }
 function ConvexProviderWithAuth(props) {
 	const client = props.client;
+	const [authEpoch, setAuthEpoch] = createSignal(0);
+	const [convexIdentity, setConvexIdentity] = createSignal(null);
 	const [isConvexLoading, setIsConvexLoading] = createSignal(true);
 	const [isConvexAuthenticated, setIsConvexAuthenticated] = createSignal(false);
-	createEffect(() => {
-		const auth = props.useAuth();
-		const loading = auth.isLoading;
-		const authenticated = auth.isAuthenticated;
-		if (loading) return;
-		if (!authenticated) {
-			client.clearAuth();
+	const settleAuth = (nextIdentity, isAuthenticated) => {
+		batch(() => {
+			setConvexIdentity(nextIdentity);
+			setAuthEpoch((epoch) => epoch + 1);
+			setIsConvexAuthenticated(isAuthenticated);
 			setIsConvexLoading(false);
-			setIsConvexAuthenticated(false);
+		});
+	};
+	const authSnapshot = createMemo(() => props.useAuth(), void 0, { equals: false });
+	const isAuthLoading = createMemo(() => authSnapshot().isLoading);
+	const isAuthenticated = createMemo(() => authSnapshot().isAuthenticated);
+	const fetchAccessToken = createMemo(() => authSnapshot().fetchAccessToken);
+	const identity = createMemo(() => {
+		const snapshot = authSnapshot();
+		return snapshot.identity === void 0 ? Symbol("legacy-auth-transition") : snapshot.identity;
+	});
+	let authBindingGeneration = 0;
+	createEffect(on([
+		isAuthLoading,
+		isAuthenticated,
+		fetchAccessToken,
+		identity
+	], () => {
+		const generation = ++authBindingGeneration;
+		if (isAuthLoading()) {
+			setIsConvexLoading(true);
 			return;
 		}
-		client.setAuth(auth.fetchAccessToken, (isAuth) => {
-			setIsConvexLoading(false);
-			setIsConvexAuthenticated(isAuth);
+		const nextIdentity = identity();
+		setIsConvexLoading(true);
+		if (!isAuthenticated()) {
+			client.clearAuth();
+			settleAuth(nextIdentity, false);
+			return;
+		}
+		client.setAuth(fetchAccessToken(), (isAuth) => {
+			if (generation !== authBindingGeneration) return;
+			settleAuth(nextIdentity, isAuth);
 		});
-	});
+	}));
 	onCleanup(() => {
+		authBindingGeneration += 1;
 		client.clearAuth();
 	});
 	return createComponent(ConvexContext.Provider, {
@@ -1045,6 +1102,12 @@ function ConvexProviderWithAuth(props) {
 		},
 		get children() {
 			return createComponent(ConvexAuthBridge, {
+				get authEpoch() {
+					return authEpoch();
+				},
+				get identity() {
+					return convexIdentity();
+				},
 				get isAuthenticated() {
 					return isConvexAuthenticated();
 				},
@@ -1110,14 +1173,15 @@ function useConvexQueryOptions(funcRef, args, options) {
 		skipUnauth: options?.skipUnauth
 	});
 	const baseOptions = convexQuery(funcRef, isSkipped ? {} : args);
-	const { skipUnauth: _, subscribe, ...queryOptions } = options ?? {};
+	const { enabled: userEnabled, skipUnauth, subscribe, ...queryOptions } = options ?? {};
 	return {
 		...baseOptions,
 		...queryOptions,
-		enabled: isSkipped ? false : !authSkip.shouldSkip,
+		enabled: resolveEnabled(!(isSkipped || authSkip.shouldSkip), userEnabled),
 		meta: {
 			...baseOptions.meta,
 			authType: authSkip.authType,
+			skipUnauth,
 			subscribe: subscribe !== false
 		}
 	};
@@ -1155,13 +1219,15 @@ function useConvexInfiniteQueryOptions(funcRef, args, opts) {
 		enabled: isSkipped ? false : enabledOpt,
 		skipUnauth: opts.skipUnauth
 	});
-	const enabled = isSkipped || authSkip.shouldSkip ? false : enabledOpt;
 	const baseOptions = convexInfiniteQueryOptions(funcRef, isSkipped ? {} : args, {
 		...opts,
-		enabled
+		enabled: void 0
 	}, meta);
 	return {
 		...baseOptions,
+		get enabled() {
+			return resolveEnabled(!(isSkipped || authSkip.shouldSkip), opts.enabled);
+		},
 		meta: {
 			...baseOptions.meta,
 			authType: authSkip.authType
@@ -1195,11 +1261,16 @@ function useConvexActionQueryOptions(action, args, options) {
 		skipUnauth: options?.skipUnauth
 	});
 	const baseOptions = convexAction(action, isSkipped ? {} : args);
-	const { skipUnauth: _, ...queryOptions } = options ?? {};
+	const { enabled: userEnabled, skipUnauth, ...queryOptions } = options ?? {};
 	return {
 		...baseOptions,
 		...queryOptions,
-		enabled: isSkipped ? false : !authSkip.shouldSkip
+		enabled: resolveEnabled(!(isSkipped || authSkip.shouldSkip), userEnabled),
+		meta: {
+			...baseOptions.meta,
+			authType: authSkip.authType,
+			skipUnauth
+		}
 	};
 }
 /**
@@ -1528,7 +1599,39 @@ function createCRPCContext(options) {
 	const HttpProxyContext = createContext(void 0);
 	function CRPCProvider(props) {
 		const authStore = useAuthStore();
+		const bridgeAuth = useConvexAuthBridge();
+		const safeAuth = useSafeConvexAuth();
+		const auth = bridgeAuth ?? safeAuth;
 		const fetchAccessToken = useFetchAccessToken();
+		props.convexQueryClient.updateAuthStore(authStore.store ? authStore : void 0);
+		let previousAuth;
+		let authGeneration = 0;
+		let transitionClear;
+		createEffect(() => {
+			const generation = ++authGeneration;
+			const currentAuth = {
+				identity: auth.identity,
+				isAuthenticated: auth.isAuthenticated,
+				isLoading: auth.isLoading
+			};
+			const previous = previousAuth;
+			previousAuth = currentAuth;
+			if (currentAuth.isLoading) {
+				if (!previous?.isLoading) transitionClear = props.convexQueryClient.resetAuthQueries({ refetch: false });
+				return;
+			}
+			if (previous?.isLoading) {
+				const pendingClear = transitionClear;
+				transitionClear = void 0;
+				(async () => {
+					const clientGeneration = await pendingClear;
+					if (generation !== authGeneration) return;
+					await props.convexQueryClient.resetAuthQueries({ generation: clientGeneration });
+				})();
+				return;
+			}
+			if (!previous || previous.identity !== currentAuth.identity || previous.isAuthenticated !== currentAuth.isAuthenticated) props.convexQueryClient.resetAuthQueries();
+		});
 		const proxy = createCRPCOptionsProxy(api, meta, options.transformer);
 		const vanillaClient = createVanillaCRPCProxy(api, meta, props.convexClient, options.transformer);
 		const httpProxy = (() => {
@@ -1770,6 +1873,56 @@ function createAuthMutations(authClient) {
 	};
 }
 
+//#endregion
+//#region src/internal/auth-reset.ts
+/**
+* Erase the cached result of every auth-bound query.
+*
+* `queryClient.resetQueries()` is not enough. It restores each query's
+* `initialState`, and query-core derives that from `initialData` when the query
+* is built, never re-deriving it once real data lands. An auth-bound entry
+* therefore comes back holding the previous account's rows marked `success`,
+* and nothing corrects it: Convex query options set `staleTime: Infinity` with
+* every refetch trigger off, and `resetQueries` only refetches entries that are
+* currently active.
+*
+* Every entry is removed so query-core forgets both its current state and its
+* private `initialState`. Mounted observers are rebound with `initialData`
+* removed, creating a pristine replacement query that future public resets
+* cannot use to resurrect the previous account's rows.
+*/
+async function clearAuthBoundQueries(cache, isAuthBound) {
+	const authQueries = cache.getAll().filter((query) => isAuthBound(query));
+	const restoreObservers = [];
+	await Promise.all(authQueries.map((query) => query.cancel({ silent: true })));
+	for (const query of authQueries) {
+		const observers = [...query.observers];
+		cache.remove(query);
+		for (const observer of observers) {
+			const previousOptions = observer.options;
+			observer.setOptions({
+				...observer.options,
+				enabled: false,
+				initialData: void 0,
+				placeholderData: void 0
+			});
+			const suspendedOptions = observer.options;
+			restoreObservers.push(() => {
+				const currentOptions = observer.options;
+				observer.setOptions({
+					...currentOptions,
+					enabled: observer.options === suspendedOptions ? previousOptions.enabled : currentOptions.enabled,
+					initialData: void 0,
+					placeholderData: void 0
+				});
+			});
+		}
+	}
+	return () => {
+		for (const restoreObserver of restoreObservers) restoreObserver();
+	};
+}
+
 //#endregion
 //#region src/internal/query-key.ts
 /**
@@ -1828,6 +1981,31 @@ function createHashFn(fallback = hashKey) {
 	};
 }
 
+//#endregion
+//#region src/internal/subscription-gate.ts
+/** Read kitcn's meta off a TanStack query. */
+function readConvexQueryMeta(query) {
+	return query.meta;
+}
+/**
+* Auth-bound queries are cleared and resubscribed on an identity transition so
+* one account never renders another account's cached rows.
+*/
+function isAuthBoundQuery(query) {
+	const authType = readConvexQueryMeta(query)?.authType;
+	return authType === "required" || authType === "optional";
+}
+/** Whether a Convex subscription may be opened for this query. */
+function canSubscribeQuery(query, opts) {
+	if (opts.isSubscribed) return false;
+	const meta = readConvexQueryMeta(query);
+	if (meta?.subscribe === false) return false;
+	if (query.getObserversCount() === 0) return false;
+	if (query.isDisabled()) return false;
+	if (opts.shouldSkipSubscription(meta?.authType)) return false;
+	return true;
+}
+
 //#endregion
 //#region src/solid/client.ts
 /**
@@ -1920,6 +2098,12 @@ var ConvexQueryClient = class {
 	ssrQueryMode;
 	/** Auth store for checking auth state */
 	authStore;
+	/** In-flight clear shared by overlapping account identity transitions. */
+	authBarrierClear;
+	/** Blocks auth-bound work created while Convex is changing identity. */
+	authSettlementBarrier;
+	/** Latest account transition allowed to restore and refetch observers. */
+	authResetGeneration = 0;
 	/** Delay before unsubscribing when query has no observers */
 	unsubscribeDelay;
 	/** Payload transformer used across request/response boundaries. */
@@ -1947,6 +2131,18 @@ var ConvexQueryClient = class {
 		sub.unsubscribe();
 		delete this.subscriptions[queryHash];
 	}
+	/**
+	* Open a Convex subscription for a query, if the shared gate allows it.
+	* Single owner of the subscribe preconditions for every cache-event branch.
+	*/
+	subscribeQuery(query) {
+		if (!canSubscribeQuery(query, {
+			isSubscribed: !!this.subscriptions[query.queryHash],
+			shouldSkipSubscription: (authType) => this.shouldSkipSubscription(authType)
+		})) return;
+		const [, funcName, args] = query.queryKey;
+		this.createSubscription(query.queryHash, funcName, args, query.queryKey);
+	}
 	/** Update auth store (for HMR where store may reset) */
 	updateAuthStore(authStore) {
 		this.authStore = authStore;
@@ -1966,12 +2162,30 @@ var ConvexQueryClient = class {
 	* Needed for useSuspenseQuery which ignores enabled: false.
 	*/
 	shouldSkipSubscription(authType) {
-		if (!authType || !this.authStore) return false;
+		if (!authType) return false;
+		if (this.authSettlementBarrier) return true;
+		if (!this.authStore) return false;
 		const authState = this.getAuthState();
 		if (authState?.isLoading) return true;
 		if (authType === "required" && !authState?.isAuthenticated) return true;
 		return false;
 	}
+	/** Hold new auth-bound requests until the latest Convex identity settles. */
+	beginAuthSettlementBarrier() {
+		if (this.authSettlementBarrier) return;
+		let resolve = () => {};
+		this.authSettlementBarrier = {
+			promise: new Promise((resolvePromise) => {
+				resolve = resolvePromise;
+			}),
+			resolve
+		};
+	}
+	/** Wait through overlapping barriers and stop canceled requests. */
+	async waitForAuthSettlement(signal) {
+		while (this.authSettlementBarrier) await this.authSettlementBarrier.promise;
+		signal?.throwIfAborted();
+	}
 	/** Get QueryClient, throwing if not connected */
 	get queryClient() {
 		if (!this._queryClient) throw new Error("ConvexQueryClient not connected to TanStack QueryClient.");
@@ -2034,6 +2248,62 @@ var ConvexQueryClient = class {
 		}
 	}
 	/**
+	* Advance the account generation published by the auth store.
+	* Client state that only makes sense inside one account's result set —
+	* paginated cursor chains — keys on it, so it is rebuilt instead of reused.
+	*/
+	bumpAuthEpoch() {
+		if (!this.authStore) return;
+		this.authStore.set("authEpoch", this.authStore.get("authEpoch") + 1);
+	}
+	/** Drop auth-bound data without fetching while Convex changes identity. */
+	async clearAuthQueries() {
+		const queryCache = this.queryClient.getQueryCache();
+		for (const query of queryCache.getAll()) {
+			if (!isAuthBoundQuery(query)) continue;
+			this.cancelPendingUnsubscribe(query.queryHash);
+			this.unsubscribeQueryByHash(query.queryHash);
+		}
+		this.bumpAuthEpoch();
+		return clearAuthBoundQueries(queryCache, (query) => isAuthBoundQuery(query));
+	}
+	/** Refetch and resubscribe auth-bound queries after Convex settles. */
+	async refetchAuthQueries(generation) {
+		const queryCache = this.queryClient.getQueryCache();
+		await this.queryClient.refetchQueries({
+			predicate: (query) => isAuthBoundQuery(query),
+			type: "active"
+		});
+		if (generation !== this.authResetGeneration) return;
+		for (const query of queryCache.getAll()) if (isAuthBoundQuery(query)) this.subscribeQuery(query);
+	}
+	/**
+	* Drop every auth-bound cache entry and resubscribe.
+	* Call after an identity transition when no separate settlement barrier owns
+	* the clear/refetch phases.
+	*/
+	async resetAuthQueries(options = {}) {
+		if (options.refetch === false) {
+			const generation = ++this.authResetGeneration;
+			this.beginAuthSettlementBarrier();
+			this.authBarrierClear ??= this.clearAuthQueries();
+			await this.authBarrierClear;
+			return generation;
+		}
+		const generation = options.generation ?? ++this.authResetGeneration;
+		if (generation !== this.authResetGeneration) return generation;
+		this.authBarrierClear ??= this.clearAuthQueries();
+		const restoreObservers = await this.authBarrierClear;
+		if (generation !== this.authResetGeneration) return generation;
+		this.authBarrierClear = void 0;
+		const settlementBarrier = this.authSettlementBarrier;
+		this.authSettlementBarrier = void 0;
+		settlementBarrier?.resolve();
+		restoreObservers();
+		await this.refetchAuthQueries(generation);
+		return generation;
+	}
+	/**
 	* Batch update all subscriptions.
 	* Called internally when Convex client reconnects.
 	*/
@@ -2107,26 +2377,13 @@ var ConvexQueryClient = class {
 					this.cancelPendingUnsubscribe(event.query.queryHash);
 					this.unsubscribeQueryByHash(event.query.queryHash);
 					break;
-				case "added": {
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (event.query.getObserversCount() === 0) break;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					this.createSubscription(event.query.queryHash, funcName, args, event.query.queryKey);
+				case "added":
+					this.subscribeQuery(event.query);
 					break;
-				}
-				case "observerAdded": {
+				case "observerAdded":
 					this.cancelPendingUnsubscribe(event.query.queryHash);
-					if (this.subscriptions[event.query.queryHash]) break;
-					if (event.query.options.enabled === false) break;
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					this.createSubscription(event.query.queryHash, funcName, args, event.query.queryKey);
+					this.subscribeQuery(event.query);
 					break;
-				}
 				case "observerRemoved":
 					if (event.query.getObserversCount() === 0 && this.subscriptions[event.query.queryHash]) {
 						const queryHash = event.query.queryHash;
@@ -2142,7 +2399,7 @@ var ConvexQueryClient = class {
 					if (event.action.type === "setState" && event.action.setStateOptions?.meta === "set by ConvexQueryClient") break;
 					break;
 				case "observerOptionsUpdated": {
-					const isDisabled = event.query.options.enabled === false;
+					const isDisabled = event.query.isDisabled();
 					const isSubscribed = !!this.subscriptions[event.query.queryHash];
 					if (isDisabled && isSubscribed) {
 						this.cancelPendingUnsubscribe(event.query.queryHash);
@@ -2150,11 +2407,7 @@ var ConvexQueryClient = class {
 						break;
 					}
 					if (isSubscribed || isDisabled) break;
-					const meta = event.query.meta;
-					if (meta?.subscribe === false) break;
-					const [, funcName, args] = event.query.queryKey;
-					if (this.shouldSkipSubscription(meta?.authType)) break;
-					this.createSubscription(event.query.queryHash, funcName, args, event.query.queryKey);
+					this.subscribeQuery(event.query);
 					break;
 				}
 			}
@@ -2197,6 +2450,7 @@ var ConvexQueryClient = class {
 		return async (context) => {
 			const { queryKey, meta: rawMeta } = context;
 			const meta = rawMeta;
+			if (!isServer && meta?.authType) await this.waitForAuthSettlement(context.signal);
 			if (isConvexSkipped(queryKey)) throw new Error("Skipped query should not actually run, should { enabled: false }");
 			if (isConvexQuery(queryKey)) {
 				const [, funcName, args] = queryKey;
@@ -2268,6 +2522,38 @@ function throwBecauseNotConvexQuery(context) {
 	throw new Error(`Query key is not for a Convex Query: ${context.queryKey}`);
 }
 
+//#endregion
+//#region src/internal/jwt.ts
+const VOLATILE_JWT_CLAIMS = new Set([
+	"exp",
+	"iat",
+	"jti",
+	"nbf"
+]);
+const decodeJwtPayload = (token) => {
+	try {
+		const segment = token.split(".")[1];
+		if (!segment) return null;
+		const binary = atob(segment.replaceAll("-", "+").replaceAll("_", "/"));
+		const payload = JSON.parse(new TextDecoder().decode(Uint8Array.from(binary, (char) => char.charCodeAt(0))));
+		return typeof payload === "object" && payload !== null ? payload : null;
+	} catch {
+		return null;
+	}
+};
+const stableStringify = (value) => {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	return `{${Object.entries(value).filter(([, claim]) => claim !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, claim]) => `${JSON.stringify(key)}:${stableStringify(claim)}`).join(",")}}`;
+};
+const decodeJwtIdentity = (token) => {
+	const payload = decodeJwtPayload(token);
+	if (!payload) return null;
+	const claims = {};
+	for (const [key, claim] of Object.entries(payload)) if (!VOLATILE_JWT_CLAIMS.has(key)) claims[key] = claim;
+	return stableStringify(claims);
+};
+
 //#endregion
 //#region src/solid/convex-auth-provider.tsx
 /** @jsxImportSource solid-js */
@@ -2287,6 +2573,13 @@ const hasActiveSessionData = (session) => {
 	if (!session || typeof session !== "object") return false;
 	return Boolean(session.session);
 };
+const getSessionId = (sessionData) => {
+	if (!sessionData || typeof sessionData !== "object") return;
+	const session = sessionData.session;
+	if (!session || typeof session !== "object") return;
+	const id = session.id;
+	return typeof id === "string" ? id : void 0;
+};
 /**
 * Unified auth provider for Convex + Better Auth (SolidJS).
 * Handles token sync and auth callbacks.
@@ -2336,21 +2629,40 @@ function ConvexAuthProviderInner(props) {
 	const authStore = useAuthStore();
 	const sessionAccessor = props.authClient.useSession();
 	let pendingTokenPromise = null;
+	let pendingTokenSessionId;
+	let authIdentity = null;
+	let identityClaims = null;
+	let identityInitialized = false;
+	let identitySessionId;
+	let tokenSessionId;
+	let tokenSessionInitialized = false;
 	createEffect(() => {
 		const sessionState = sessionAccessor();
 		const session = sessionState.data;
 		const isPending = sessionState.isPending;
+		const sessionId = getSessionId(session);
 		if (!hasActiveSessionData(session) && !isPending) {
 			authStore.set("token", null);
 			authStore.set("expiresAt", null);
 			authStore.set("isAuthenticated", false);
+			tokenSessionId = void 0;
+			tokenSessionInitialized = false;
+		} else if (hasActiveSessionData(session)) {
+			if (!tokenSessionInitialized && authStore.get("token") !== null || tokenSessionInitialized && sessionId !== tokenSessionId) {
+				authStore.set("token", null);
+				authStore.set("expiresAt", null);
+			}
+			tokenSessionId = sessionId;
+			tokenSessionInitialized = true;
 		}
 	});
 	const fetchAccessToken = async ({ forceRefreshToken = false } = {}) => {
 		const sessionState = sessionAccessor();
 		const currentSession = sessionState.data;
 		const currentIsPending = sessionState.isPending;
-		if (!hasActiveSessionData(currentSession)) {
+		const hasSession = hasActiveSessionData(currentSession);
+		const currentSessionId = getSessionId(currentSession);
+		if (!hasSession) {
 			if (!currentIsPending) {
 				authStore.set("token", null);
 				authStore.set("expiresAt", null);
@@ -2360,11 +2672,17 @@ function ConvexAuthProviderInner(props) {
 		const cachedToken = authStore.get("token");
 		const expiresAt = authStore.get("expiresAt");
 		const timeRemaining = expiresAt ? expiresAt - Date.now() : 0;
-		if (!forceRefreshToken && cachedToken && expiresAt && timeRemaining >= 6e4) return cachedToken;
-		if (!forceRefreshToken && pendingTokenPromise) return pendingTokenPromise;
+		if (!forceRefreshToken && cachedToken && expiresAt && currentSessionId === tokenSessionId && timeRemaining >= 6e4) return cachedToken;
+		if (!forceRefreshToken && pendingTokenPromise && pendingTokenSessionId === currentSessionId) return pendingTokenPromise;
 		const fetchOptions = { throw: false };
-		if (cachedToken && decodeJwtExp(cachedToken) === null) fetchOptions.headers = { Authorization: `Bearer ${cachedToken}` };
-		pendingTokenPromise = props.authClient.convex.token({ fetchOptions }).then((result) => {
+		if (cachedToken && currentSessionId === tokenSessionId && decodeJwtExp(cachedToken) === null) fetchOptions.headers = { Authorization: `Bearer ${cachedToken}` };
+		const sessionStillOwnsRequest = () => {
+			const latestSession = sessionAccessor().data;
+			return hasActiveSessionData(latestSession) && getSessionId(latestSession) === currentSessionId;
+		};
+		let tokenPromise;
+		tokenPromise = props.authClient.convex.token({ fetchOptions }).then((result) => {
+			if (!sessionStillOwnsRequest()) return null;
 			const jwt = result.data?.token || null;
 			if (jwt) {
 				const exp = decodeJwtExp(jwt);
@@ -2376,21 +2694,47 @@ function ConvexAuthProviderInner(props) {
 			authStore.set("expiresAt", null);
 			return null;
 		}).catch((error) => {
+			if (!sessionStillOwnsRequest()) return null;
 			authStore.set("token", null);
 			authStore.set("expiresAt", null);
 			console.error("[fetchAccessToken] error", error);
 			return null;
 		}).finally(() => {
-			pendingTokenPromise = null;
+			if (pendingTokenPromise === tokenPromise) {
+				pendingTokenPromise = null;
+				pendingTokenSessionId = void 0;
+			}
 		});
-		return pendingTokenPromise;
+		pendingTokenPromise = tokenPromise;
+		pendingTokenSessionId = currentSessionId;
+		return tokenPromise;
 	};
 	const useAuth = () => {
 		const sessionState = sessionAccessor();
 		const hasSession = hasActiveSessionData(sessionState.data);
 		const sessionMissing = !hasSession && !sessionState.isPending;
 		const token = authStore.get("token");
+		const sessionId = getSessionId(sessionState.data);
+		const claims = token && tokenSessionInitialized && sessionId === tokenSessionId ? decodeJwtIdentity(token) : null;
+		const sessionChanged = identityInitialized && sessionId !== identitySessionId;
+		if (!identityInitialized || sessionChanged) {
+			identityInitialized = true;
+			identitySessionId = sessionId;
+			identityClaims = sessionChanged ? null : claims;
+			authIdentity = !sessionChanged && claims ? JSON.stringify({
+				claims,
+				sessionId: sessionId ?? null
+			}) : sessionId ?? null;
+		} else if (claims && identityClaims === null) identityClaims = claims;
+		else if (claims && claims !== identityClaims) {
+			identityClaims = claims;
+			authIdentity = JSON.stringify({
+				claims,
+				sessionId: sessionId ?? null
+			});
+		}
 		return {
+			identity: authIdentity,
 			isLoading: sessionState.isPending && !token,
 			isAuthenticated: sessionMissing ? false : hasSession || token !== null,
 			fetchAccessToken
@@ -2543,15 +2887,8 @@ function createQueriesResults(queries) {
 //#endregion
 //#region src/solid/use-infinite-query.ts
 const PAGINATION_KEY_PREFIX = "__pagination__";
-const paginationIdStore = /* @__PURE__ */ new Map();
 let paginationIdCounter = 0;
-const getOrCreatePaginationId = (storeKey) => {
-	const existing = paginationIdStore.get(storeKey);
-	if (existing !== void 0) return existing;
-	const newId = ++paginationIdCounter;
-	paginationIdStore.set(storeKey, newId);
-	return newId;
-};
+const createPaginationId = () => ++paginationIdCounter;
 /** Read the identity of a Convex document, tolerating `id` and `_id` shapes */
 const getItemId = (item) => {
 	const doc = item;
@@ -2682,8 +3019,9 @@ const useStaleCursorRecovery = ({ argsObject, combined, limit, pageResults, setS
 * Use `useInfiniteQuery` for the public API with auth handling.
 */
 const useInfiniteQueryInternal = (query, args, options) => {
-	const { limit, enabled, placeholderData, ...queryOptions } = options;
+	const { limit, authType, enabled, placeholderData, ...queryOptions } = options;
 	const safeAuth = useSafeConvexAuth();
+	const authEpoch = () => useAuthValue("authEpoch");
 	const meta = useMeta();
 	const queryClient = useQueryClient();
 	const prefetchedFirstPage = createMemo(() => {
@@ -2698,7 +3036,7 @@ const useInfiniteQueryInternal = (query, args, options) => {
 		];
 		return queryClient.getQueryData(serverQueryKey) ?? null;
 	});
-	const skip = createMemo(() => !prefetchedFirstPage() && (safeAuth.isLoading || enabled === false));
+	const skip = createMemo(() => !prefetchedFirstPage() && (safeAuth.isLoading || enabled?.() === false));
 	const getPaginationState = (key) => {
 		const queryKey = [PAGINATION_KEY_PREFIX, key];
 		return queryClient.getQueryData(queryKey);
@@ -2710,10 +3048,11 @@ const useInfiniteQueryInternal = (query, args, options) => {
 	const argsObject = createMemo(() => skip() ? {} : args);
 	const storeKey = createMemo(() => JSON.stringify({
 		query: getFunctionName(query),
-		args: argsObject()
+		args: argsObject(),
+		...authType ? { authEpoch: authEpoch() } : {}
 	}));
 	const createInitialState = () => {
-		const id = getOrCreatePaginationId(storeKey());
+		const id = createPaginationId();
 		return {
 			id,
 			nextPageKey: 1,
@@ -2790,10 +3129,9 @@ const useInfiniteQueryInternal = (query, args, options) => {
 		const pageArgs = state().queries[key]?.args;
 		return {
 			...convexQuery(query, pageArgs ? (({ __paginationId, ...rest }) => rest)(pageArgs) : "skip", meta),
-			enabled: !skip() && !!state().queries[key],
+			enabled: resolveEnabled(!skip() && !!state().queries[key] && (!authType || !safeAuth.isLoading), enabled?.()),
 			structuralSharing: false,
 			...queryOptions ?? {},
-			...index === 0 && prefetchedFirstPage() ? { initialData: prefetchedFirstPage() } : {},
 			...index === 0 && placeholderData ? { placeholderData: {
 				page: placeholderData,
 				isDone: false,
@@ -2941,34 +3279,36 @@ function useInfiniteQuery(infiniteOptions) {
 	const query = infiniteOptions[FUNC_REF_SYMBOL];
 	const onQueryUnauthorized = useAuthValue("onQueryUnauthorized");
 	const safeAuth = useSafeConvexAuth();
-	const { queryKey: _queryKey, staleTime: _staleTime, refetchInterval: _refetchInterval, refetchOnMount: _refetchOnMount, refetchOnReconnect: _refetchOnReconnect, refetchOnWindowFocus: _refetchOnWindowFocus, enabled: factoryEnabled, meta, ...queryOptions } = infiniteOptions;
+	const { queryKey: _queryKey, staleTime: _staleTime, refetchInterval: _refetchInterval, refetchOnMount: _refetchOnMount, refetchOnReconnect: _refetchOnReconnect, refetchOnWindowFocus: _refetchOnWindowFocus, enabled: _enabled, meta, ...queryOptions } = infiniteOptions;
 	const { queryName, args, limit, authType, skipUnauth } = meta;
 	const skipUnauthFinal = skipUnauth ?? false;
-	const isUnauthorized = authType === "required" && !safeAuth.isLoading && !safeAuth.isAuthenticated;
-	const shouldSkip = factoryEnabled === false || authType === "required" && safeAuth.isLoading || authType === "required" && !safeAuth.isAuthenticated;
+	const factoryEnabled = () => infiniteOptions.enabled;
+	const isUnauthorized = createMemo(() => authType === "required" && !safeAuth.isLoading && !safeAuth.isAuthenticated);
+	const shouldSkip = createMemo(() => factoryEnabled() === false || authType === "required" && safeAuth.isLoading || authType === "required" && !safeAuth.isAuthenticated);
 	const authError = createMemo(() => {
-		if (isUnauthorized && !skipUnauthFinal) return new CRPCClientError({
+		if (isUnauthorized() && !skipUnauthFinal) return new CRPCClientError({
 			code: "UNAUTHORIZED",
 			functionName: queryName
 		});
 		return null;
 	});
 	createEffect(() => {
-		if (isUnauthorized && !skipUnauthFinal) onQueryUnauthorized({ queryName });
+		if (isUnauthorized() && !skipUnauthFinal) onQueryUnauthorized({ queryName });
 	});
 	const result = useInfiniteQueryInternal(query, args, {
+		authType,
 		limit,
 		...queryOptions,
-		enabled: !shouldSkip
+		enabled: () => resolveEnabled(!shouldSkip(), factoryEnabled())
 	});
 	const authLoadingApplies = authType === "optional" || authType === "required";
-	const isSkippedUnauth = isUnauthorized && skipUnauthFinal;
+	const isSkippedUnauth = createMemo(() => isUnauthorized() && skipUnauthFinal);
 	return {
 		get data() {
-			return isSkippedUnauth ? [] : result.data;
+			return isSkippedUnauth() ? [] : result.data;
 		},
 		get pages() {
-			return isSkippedUnauth ? [] : result.pages;
+			return isSkippedUnauth() ? [] : result.pages;
 		},
 		get error() {
 			return authError() ?? result.error;
@@ -2977,12 +3317,12 @@ function useInfiniteQuery(infiniteOptions) {
 			return authError() ? true : result.isError;
 		},
 		get isPlaceholderData() {
-			return isSkippedUnauth ? false : result.isPlaceholderData;
+			return isSkippedUnauth() ? false : result.isPlaceholderData;
 		},
 		get isLoading() {
 			const ae = authError();
 			const isClientError = isCRPCClientError(result.error);
-			return authLoadingApplies && safeAuth.isLoading || !isClientError && !ae && !isSkippedUnauth && result.isLoading;
+			return authLoadingApplies && safeAuth.isLoading || !isClientError && !ae && !isSkippedUnauth() && result.isLoading;
 		},
 		get isFetching() {
 			return result.isFetching;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kitcn",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "kitcn - React Query integration and CLI tools for Convex",
   "keywords": [
     "convex",