@basictech/react 0.11.0-beta.1 → 0.11.0-beta.3

package/README.md

@@ -26,6 +26,80 @@ npm install @basictech/react @basictech/schema
 
 React is a peer dependency and must already be installed by your application.
 
+## Beta auth update guide
+
+After this auth update is published to the `beta` dist-tag, upgrade the packages you use together:
+
+```bash
+npm install @basictech/react@beta @basictech/schema@beta
+# If you import core directly, update that dependency too:
+npm install @basictech/core@beta
+```
+
+Keep the public packages on matching beta versions. No browser storage reset or persisted-profile
+migration is required. Check your lockfile for the resolved version; this guide does not imply
+that an older installed beta contains the update.
+
+### Update auth checks and editing controls
+
+- Replace `useAuth().status === 'reauth_required'` with `status === 'expired'`.
+  Core client snapshots likewise use `authStatus: 'expired'`; only low-level `AuthSession`
+  retains the legacy compatibility state.
+- Use `auth.canWrite` to disable mutation controls and `auth.readOnlyReason` for explanation.
+  It is account eligibility, not a guarantee of connectivity or permission to a particular source.
+  Catch imperative mutation errors too: auth can expire after the UI renders. Newly attempted
+  expired mutations reject with `BasicError.code === 'AUTH_EXPIRED'`.
+- Keep cached data visible when expired. Do not treat `!auth.isSignedIn` as instructions to
+  sign out, remove the account, or clear local storage. Expiry retains identity, cached records,
+  and already queued edits, but blocks new writes and pauses sync sends.
+- Offer `auth.signIn()` to reauthorize the same DID/issuer. For a different identity, add or switch
+  accounts first. Pending data must not be replayed into another account.
+
+```tsx
+// Uses the schema-bound basic instance from the quick start below.
+function AuthNotice() {
+  const auth = basic.useAuth()
+  if (auth.status !== 'expired') return null
+  return (
+    <aside role="status">
+      Session expired. Cached data is read-only; your pending edits are retained.
+      <button onClick={() => void auth.signIn()}>Sign in again</button>
+    </aside>
+  )
+}
+// In your editor: <button disabled={!auth.canWrite} ...>Save</button>
+```
+
+### Render per-account status
+
+`useAccounts().accounts` now returns `BasicAccount[]`, including anonymous and expired accounts.
+Each account adds `auth: { status, reason, checkedAt }` to the existing profile fields:
+
+| Account status | Meaning |
+| --- | --- |
+| `anon` | Local anonymous workspace; editable without credentials |
+| `checking` | Authorization has not been verified for this remembered account |
+| `authenticated` | Current runtime authentication succeeded |
+| `recovering` | Transient failure; ordinary offline queues remain writable |
+| `expired` | Interactive reauthorization required; retain data read-only |
+| `signed_out` | No usable active authorization |
+
+`checkedAt` is the local evaluation time in milliseconds since epoch, or null—not a guarantee
+from the server. Inactive accounts are not all refreshed: retained identity without credentials
+is expired; otherwise an unverified remembered account is checking. The active anonymous account
+has `auth.status: 'anon'`, while top-level `useAuth()` reports `status: 'signed_out'` and
+`isAnonymous: true`. REST exposes one remembered account, not a multi-account registry.
+
+Ordinary network loss is not expiry, and anonymous editing still works. `goOnline()` cannot
+bypass expired read-only enforcement. Reauthorization resumes retained queued work; already
+accepted server requests cannot be undone by client cancellation. REST has no offline cache.
+
+Verified session revocation and automatic account/data cleanup are deferred to a later update.
+Generic `invalid_grant` is not evidence that it is safe to erase local data. Browser storage
+remains unchanged: localStorage holds profiles/refresh credentials, sessionStorage holds tab
+selection/PKCE, access tokens live in memory, and Dexie wraps IndexedDB for replica data.
+The default browser adapter writes no auth cookies. Read-only does not encrypt cached data.
+
 ## Quick start
 
 Define the schema and create `basic` once at module scope. The returned client, Provider, and hooks
@@ -151,8 +225,8 @@ client.
 | --- | --- | --- | --- |
 | `clientId` | `string` | Required | The application's client DID. Its Basic app metadata must register the redirect URI. |
 | `schema` | `S extends BasicSchema` | Required by `createBasic` | Pass the `defineSchema()` result used by this application. It is optional only in the lower-level `createBasicClient`. |
-| `identityOrigin` | `string` | `'https://basic.id'` | Use another Identity v1 origin for handle resolution and the shares management URL. |
-| `defaultPds` | `string` | `'https://pds.basic.id'` | Change the PDS discovered by no-argument `signIn()`. `signIn(handleOrDid)` discovers that identity's PDS instead. |
+| `identityOrigin` | `string` | `'https://basic.id'` | Use another Basic ID web origin for the shares management URL. |
+| `defaultPds` | `string` | `'https://pds.basic.id'` | Change the PDS used for handle resolution and no-argument `signIn()`. `signIn(handleOrDid)` discovers that identity's PDS after resolving handles here. |
 | `redirectUri` | `string` | `location.origin + location.pathname` | Set an explicit OAuth callback route. Outside a browser location, it is required. The URI must appear in the client metadata for `clientId`. |
 | `mode` | `'sync' \| 'rest'` | `'sync'` | Choose direct REST when offline replicas, anonymous mode, multi-account state, and `watch()` are not needed. |
 | `anonymous` | `boolean` | `true` in sync mode | Set `false` to require sign-in. REST mode always disables anonymous workspaces. |
@@ -170,6 +244,7 @@ client.
 | `currentUrl` | `() => string` | `location.href`, or `''` without `location` | Tell auth bootstrap where to read OAuth `code` and `state`. |
 | `replaceUrl` | `(url: string) => void` | `history.replaceState({}, '', url)` | Integrate removal of consumed OAuth query parameters with custom navigation. |
 | `createMessageChannel` | `(name: string) => AuthMessageChannel` | `BroadcastChannel` when available | Replace or disable cross-context auth notifications. The default token adapter also transfers access tokens transiently between tabs. |
+| `reconcileTrigger` | `(listener: () => void) => () => void` | `focus`, `online`, and `visibilitychange` listeners | Subscribe the client to host lifecycle signals so a suspended or backgrounded application reconciles credentials with its owner and mounted Sync sessions on resume. Return a cleanup function; the client calls it on `stop()`. |
 | `ownerCredential` | `OwnerCredentialAdapter` | None | First-party Basic ID/dev tooling can inject owner credentials for `client.drive()`, account-wide `client.storageInfo()`, and `client.shares.leave()`. Normal app credentials should use existing repos and `shares.manageUrl()`. |
 | `uploadTransport` | `UploadTransportAdapter` | Browser XHR, then the core fetch fallback | Supply a multipart transport. XHR is used by default because fetch has no upload-progress events. |
 | `warn` | `(message: string) => void` | `console.warn` for schema checks | Route schema-drift warnings into application logging. |
@@ -192,6 +267,10 @@ The defaults are selected from browser capabilities at client creation:
 - **Auth coordination:** token rotation and sign-out notifications use `BroadcastChannel` when
   available. Access tokens can cross that channel transiently but are not written by the default
   token store.
+- **Lifecycle recovery:** when a tab regains focus, comes back online, or becomes visible again,
+  the client reconciles fresh credentials with the owner and mounted Sync sessions. A browser that
+  suspended the page recovers without a reload, and transient refresh failures retry rather than
+  signing the profile out. Override `reconcileTrigger` to supply that signal in another host.
 - **Uploads:** browser multipart uploads use XHR for real `onProgress(loaded, total)` events. The
   fetch fallback reports only start and completion.
 
@@ -271,7 +350,9 @@ unknown table names and infer fields in reads, writes, and queries.
 | `isReady` | `boolean` | Auth bootstrap has left `bootstrapping` |
 | `isSignedIn` | `boolean` | Status is `authenticated` or `recovering` |
 | `isAnonymous` | `boolean` | The active sync profile is anonymous and not signed in |
-| `status` | `'bootstrapping' \| 'signed_out' \| 'authenticated' \| 'recovering' \| 'reauth_required'` | Current auth lifecycle |
+| `status` | `'bootstrapping' \| 'signed_out' \| 'authenticated' \| 'recovering' \| 'expired'` | Current public auth lifecycle |
+| `canWrite` | `boolean` | Active-account write eligibility; source permissions still apply |
+| `readOnlyReason` | `string \| null` | For example `AUTH_EXPIRED` when reauthorization is needed |
 | `error` | `BasicError \| null` | Stable auth bootstrap/refresh error code when available |
 | `user` | `AuthUser \| null` | OIDC user info (`sub`, `pds_url`, and optional `email`, `name`, `picture`, `handle`) |
 | `did` | `string \| null` | Signed-in account DID |
@@ -288,6 +369,9 @@ export function AuthPanel() {
   const auth = basic.useAuth()
 
   if (!auth.isReady) return <p>Starting Basic…</p>
+  if (auth.status === 'expired') {
+    return <p>Session expired. Cached data is read-only. <button onClick={() => void auth.signIn()}>Sign in again</button></p>
+  }
   if (auth.isSignedIn) {
     return (
       <p>
@@ -317,8 +401,8 @@ replicas and returns to another local profile or a fresh anonymous one when enab
 
 `useAccounts()` returns `{ accounts, active, switchAccount, addAccount, removeAccount }`:
 
-- `accounts: BasicProfile[]` lists local profiles.
-- `active: BasicProfile | null` is this tab's selected profile.
+- `accounts: BasicAccount[]` lists local profiles with per-account auth summaries.
+- `active: BasicAccount | null` is this tab's selected profile and auth summary.
 - `switchAccount(id): Promise<void>` changes the active profile in this tab.
 - `addAccount(): Promise<BasicProfile>` creates and activates a new anonymous profile from which to
   start another sign-in.
@@ -745,6 +829,7 @@ Shares v2 is capability-gated and requires sign-in. `useOutgoingShares()` return
   get(id: string): Promise<OutgoingShareInfo>
   cancel(id: string): Promise<OutgoingShareInfo>
   revoke(id: string): Promise<OutgoingShareInfo>
+  getContactHandle(did: string): Promise<string | null>
   manageUrl(): string
 }
 ```
@@ -754,7 +839,7 @@ Shares v2 is capability-gated and requires sign-in. `useOutgoingShares()` return
 | Field | Type | Meaning |
 | --- | --- | --- |
 | `repo` | `'default' \| { repoId: string }` | Origin repo |
-| recipient | Exactly one of `recipientHandle: string` or `recipientDid: string` | A handle is trimmed, lowercased, and resolved through `identityOrigin`; a canonical DID skips handle resolution. |
+| recipient | Exactly one of `recipientHandle: string` or `recipientDid: string` | A handle is trimmed, lowercased, and resolved through `defaultPds`; a canonical DID skips handle resolution. |
 | `role` | `'viewer' \| 'editor'` | Collaborator role |
 | `scope` | `Array<{ table: string } \| { table: string; recordIds: string[] }>` | Whole-table clauses or static record sets |
 | `acceptBy` | `string` | Optional acceptance deadline passed to Shares v2 |
@@ -807,6 +892,10 @@ export function OutgoingShares() {
 `deliveryState`, and created, accepted, and ended timestamps/reasons. Revocation prevents future
 access but cannot retract data a recipient already downloaded.
 
+After a handle-based share is created successfully, the SDK stores a profile-local contact entry
+containing `{ did, handle }` in browser local storage. Use `getContactHandle(recipientDid)` to show
+the remembered handle; it returns `null` for DIDs that were shared directly or are not cached.
+
 `manageUrl()` returns the Basic ID `/shares` handoff. Invite acceptance and ordinary mount
 management belong there. `client.shares.leave()` is intentionally owner-only and throws
 `OWNER_CREDENTIAL_REQUIRED` without an explicit owner adapter.
@@ -1037,6 +1126,8 @@ Common application-facing codes include:
 | Code | Typical cause |
 | --- | --- |
 | `AUTHORIZATION_REQUIRED` | A signed-in token/session is required |
+| `AUTH_EXPIRED` | Session needs reauthorization; cached data and pending edits are retained |
+| `ACCOUNT_CHANGED` | The account changed while an operation was in flight; do not blindly retry into the new account |
 | `UNKNOWN_SOURCE` | The repo is not in the catalog or the mount has not been listed/opened |
 | `RECORD_NOT_FOUND`, `RECORD_EXISTS`, `RECORD_NOT_DELETED` | Record lifecycle precondition failed |
 | `INVALID_PATCH`, `INVALID_RECORD_ID`, `INVALID_IDEMPOTENCY_KEY` | Invalid local mutation input |
@@ -1093,8 +1184,8 @@ for the lower-level model.
   Client Components should import `@basictech/react` directly.
 - Migrating from 0.10 requires deliberate call-site changes; there is no compatibility layer. Read
   [Migrating to Basic SDK 0.11](https://github.com/basicdb/basic-server/blob/dev/docs/MIGRATING_TO_0.11.md).
-- `0.11.0-beta.0` is a beta API. Check the installed version rather than assuming the repository
-  workspace has already been published.
+- 0.11 is a beta API, published to npm under the `beta` dist-tag. Check the installed version
+  rather than assuming it matches the repository workspace.
 
 ## License
 

package/dist/index.d.mts

@@ -1,14 +1,14 @@
 import * as react from 'react';
 import { ReactNode, ReactElement } from 'react';
-import { BasicSchema, BasicConfig, BasicClient, BasicProfile, AuthStatus, BasicError, AuthUser, BasicSyncStatus, BasicRejection, BasicConflict, SourceRef, SchemaStatus, BasicDb, Repo, FileRecord, MountFileInfo, StorageInfo, FileListQuery, MountInfo, MountHandle, OutgoingShareInfo, CreateOutgoingShareInput, MountsQuery, JsonObject, BasicRecord, Query, MountViewerFiles, OwnerFiles, TableNames, Collection, InferValue, KeyValueStorage, TokenStore, AuthMessageChannel, ReplicaStoreFactory, StoragePartition, ReplicaStore, UploadTransportAdapter } from '@basictech/core';
+import { BasicSchema, BasicConfig, BasicClient, BasicAccount, BasicProfile, AuthStatus, BasicError, AuthUser, BasicSyncStatus, BasicRejection, BasicConflict, SourceRef, SchemaStatus, BasicDb, Repo, FileRecord, MountFileInfo, StorageInfo, FileListQuery, MountInfo, MountHandle, OutgoingShareInfo, CreateOutgoingShareInput, MountsQuery, JsonObject, BasicRecord, Query, MountViewerFiles, OwnerFiles, TableNames, Collection, InferValue, KeyValueStorage, TokenStore, AuthMessageChannel, ReplicaStoreFactory, StoragePartition, ReplicaStore, UploadTransportAdapter } from '@basictech/core';
 
 type BrowserBasicConfig<S extends BasicSchema = BasicSchema> = BasicConfig<S>;
 /** Create a core client with the complete browser adapter set installed. */
 declare function createBasicClient<S extends BasicSchema>(config: BrowserBasicConfig<S>): BasicClient<S>;
 
 interface UseAccountsResult {
-    accounts: BasicProfile[];
-    active: BasicProfile | null;
+    accounts: BasicAccount[];
+    active: BasicAccount | null;
     switchAccount(id: string): Promise<void>;
     addAccount(): Promise<BasicProfile>;
     removeAccount(id: string): Promise<void>;
@@ -19,6 +19,8 @@ interface UseAuthResult {
     isReady: boolean;
     isSignedIn: boolean;
     isAnonymous: boolean;
+    canWrite: boolean;
+    readOnlyReason: string | null;
     status: AuthStatus;
     error: BasicError | null;
     user: AuthUser | null;
@@ -87,6 +89,7 @@ interface UseOutgoingSharesResult {
     get(id: string): Promise<OutgoingShareInfo>;
     cancel(id: string): Promise<OutgoingShareInfo>;
     revoke(id: string): Promise<OutgoingShareInfo>;
+    getContactHandle(did: string): Promise<string | null>;
     manageUrl(): string;
 }
 declare function useOutgoingShares(): UseOutgoingSharesResult;

package/dist/index.d.ts

@@ -1,14 +1,14 @@
 import * as react from 'react';
 import { ReactNode, ReactElement } from 'react';
-import { BasicSchema, BasicConfig, BasicClient, BasicProfile, AuthStatus, BasicError, AuthUser, BasicSyncStatus, BasicRejection, BasicConflict, SourceRef, SchemaStatus, BasicDb, Repo, FileRecord, MountFileInfo, StorageInfo, FileListQuery, MountInfo, MountHandle, OutgoingShareInfo, CreateOutgoingShareInput, MountsQuery, JsonObject, BasicRecord, Query, MountViewerFiles, OwnerFiles, TableNames, Collection, InferValue, KeyValueStorage, TokenStore, AuthMessageChannel, ReplicaStoreFactory, StoragePartition, ReplicaStore, UploadTransportAdapter } from '@basictech/core';
+import { BasicSchema, BasicConfig, BasicClient, BasicAccount, BasicProfile, AuthStatus, BasicError, AuthUser, BasicSyncStatus, BasicRejection, BasicConflict, SourceRef, SchemaStatus, BasicDb, Repo, FileRecord, MountFileInfo, StorageInfo, FileListQuery, MountInfo, MountHandle, OutgoingShareInfo, CreateOutgoingShareInput, MountsQuery, JsonObject, BasicRecord, Query, MountViewerFiles, OwnerFiles, TableNames, Collection, InferValue, KeyValueStorage, TokenStore, AuthMessageChannel, ReplicaStoreFactory, StoragePartition, ReplicaStore, UploadTransportAdapter } from '@basictech/core';
 
 type BrowserBasicConfig<S extends BasicSchema = BasicSchema> = BasicConfig<S>;
 /** Create a core client with the complete browser adapter set installed. */
 declare function createBasicClient<S extends BasicSchema>(config: BrowserBasicConfig<S>): BasicClient<S>;
 
 interface UseAccountsResult {
-    accounts: BasicProfile[];
-    active: BasicProfile | null;
+    accounts: BasicAccount[];
+    active: BasicAccount | null;
     switchAccount(id: string): Promise<void>;
     addAccount(): Promise<BasicProfile>;
     removeAccount(id: string): Promise<void>;
@@ -19,6 +19,8 @@ interface UseAuthResult {
     isReady: boolean;
     isSignedIn: boolean;
     isAnonymous: boolean;
+    canWrite: boolean;
+    readOnlyReason: string | null;
     status: AuthStatus;
     error: BasicError | null;
     user: AuthUser | null;
@@ -87,6 +89,7 @@ interface UseOutgoingSharesResult {
     get(id: string): Promise<OutgoingShareInfo>;
     cancel(id: string): Promise<OutgoingShareInfo>;
     revoke(id: string): Promise<OutgoingShareInfo>;
+    getContactHandle(did: string): Promise<string | null>;
     manageUrl(): string;
 }
 declare function useOutgoingShares(): UseOutgoingSharesResult;

package/dist/index.js

@@ -60,7 +60,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/create-client.ts
-var import_core5 = require("@basictech/core");
+var import_core4 = require("@basictech/core");
 
 // src/adapters/broadcast-channel.ts
 function createBrowserMessageChannel(name) {
@@ -444,7 +444,6 @@ function browserStorage(name) {
 }
 
 // src/adapters/token-store.ts
-var import_core3 = require("@basictech/core");
 var ACCESS_TOKEN_ADOPTION_TIMEOUT_MS = 100;
 function parseTokens(value) {
   if (!value) return null;
@@ -521,7 +520,7 @@ var BrowserTokenStore = class {
     else this.accessWaiters.delete(key);
   }
   waitForAccessToken(key, refreshToken) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve) => {
       let timer;
       const waiter = {
         refreshToken,
@@ -537,17 +536,14 @@ var BrowserTokenStore = class {
         const remaining = (this.accessWaiters.get(key) ?? []).filter((candidate) => candidate !== waiter);
         if (remaining.length) this.accessWaiters.set(key, remaining);
         else this.accessWaiters.delete(key);
-        reject(new import_core3.BasicError(
-          "ACCESS_TOKEN_ADOPTION_TIMEOUT",
-          "timed out waiting for the access token matching persisted refresh material"
-        ));
+        resolve(null);
       }, ACCESS_TOKEN_ADOPTION_TIMEOUT_MS);
     });
   }
 };
 
 // src/adapters/upload.ts
-var import_core4 = require("@basictech/core");
+var import_core3 = require("@basictech/core");
 function responseHeaders(xhr) {
   const headers = new Headers();
   for (const line of xhr.getAllResponseHeaders().trim().split(/[\r\n]+/)) {
@@ -560,7 +556,7 @@ function responseHeaders(xhr) {
 var browserUploadTransport = {
   upload(request) {
     if (typeof XMLHttpRequest === "undefined") {
-      return Promise.reject(new import_core4.BasicError("XHR_UNAVAILABLE"));
+      return Promise.reject(new import_core3.BasicError("XHR_UNAVAILABLE"));
     }
     return new Promise((resolve, reject) => {
       const xhr = new XMLHttpRequest();
@@ -592,9 +588,9 @@ var browserUploadTransport = {
         statusText: xhr.statusText,
         headers: responseHeaders(xhr)
       })));
-      xhr.onerror = () => finish(() => reject(new import_core4.BasicError("NETWORK_ERROR", "the upload could not reach the server")));
+      xhr.onerror = () => finish(() => reject(new import_core3.BasicError("NETWORK_ERROR", "the upload could not reach the server")));
       xhr.onabort = () => finish(() => reject(request.signal?.reason ?? new DOMException("Aborted", "AbortError")));
-      xhr.ontimeout = () => finish(() => reject(new import_core4.BasicError("NETWORK_ERROR", "the upload timed out")));
+      xhr.ontimeout = () => finish(() => reject(new import_core3.BasicError("NETWORK_ERROR", "the upload timed out")));
       const form = new FormData();
       form.append("path", request.path);
       if (request.name !== void 0) form.append("name", request.name);
@@ -606,21 +602,37 @@ var browserUploadTransport = {
 };
 
 // src/create-client.ts
+function browserReconcileTrigger(listener) {
+  if (typeof window === "undefined" || typeof document === "undefined") return () => {
+  };
+  const onVisible = () => {
+    if (document.visibilityState === "visible") listener();
+  };
+  window.addEventListener("focus", listener);
+  window.addEventListener("online", listener);
+  document.addEventListener("visibilitychange", onVisible);
+  return () => {
+    window.removeEventListener("focus", listener);
+    window.removeEventListener("online", listener);
+    document.removeEventListener("visibilitychange", onVisible);
+  };
+}
 function createBasicClient(config) {
-  const local = browserStorage("localStorage") ?? new import_core5.MemoryKeyValueStorage();
-  const session = browserStorage("sessionStorage") ?? new import_core5.MemoryKeyValueStorage();
+  const local = browserStorage("localStorage") ?? new import_core4.MemoryKeyValueStorage();
+  const session = browserStorage("sessionStorage") ?? new import_core4.MemoryKeyValueStorage();
   const defaultTokenStore = config.tokenStore ? null : new BrowserTokenStore(local);
   const canBroadcast = typeof BroadcastChannel !== "undefined";
   const canPersistReplica = typeof indexedDB !== "undefined";
-  return (0, import_core5.createBasicClient)({
+  return (0, import_core4.createBasicClient)({
     ...config,
     kv: config.kv ?? local,
     tokenStore: config.tokenStore ?? defaultTokenStore,
     sessionStorage: config.sessionStorage ?? session,
-    replicaStore: config.replicaStore ?? (canPersistReplica ? new PersistenceStore(config.clientId) : new import_core5.MemoryReplicaStoreFactory()),
+    replicaStore: config.replicaStore ?? (canPersistReplica ? new PersistenceStore(config.clientId) : new import_core4.MemoryReplicaStoreFactory()),
     navigate: config.navigate ?? browserNavigate,
     currentUrl: config.currentUrl ?? browserCurrentUrl,
     replaceUrl: config.replaceUrl ?? browserReplaceUrl,
+    reconcileTrigger: config.reconcileTrigger ?? browserReconcileTrigger,
     createMessageChannel: config.createMessageChannel ?? (canBroadcast && defaultTokenStore ? createBrowserAuthChannelFactory(config.clientId, defaultTokenStore) : void 0),
     uploadTransport: config.uploadTransport ?? (typeof XMLHttpRequest === "undefined" ? void 0 : browserUploadTransport)
   });
@@ -706,7 +718,7 @@ var import_react4 = require("react");
 
 // src/hooks/client.ts
 var import_react3 = require("react");
-var import_core6 = require("@basictech/core");
+var import_core5 = require("@basictech/core");
 function useRequiredClient() {
   const client = (0, import_react3.useContext)(BasicClientContext);
   if (!client) throw new Error("Basic hooks must be used within a <BasicProvider>");
@@ -716,8 +728,8 @@ function useClientSnapshot(client) {
   return (0, import_react3.useSyncExternalStore)(client.subscribe, client.getSnapshot, client.getSnapshot);
 }
 function toBasicError(error, fallback = "UNKNOWN_ERROR") {
-  if (error instanceof import_core6.BasicError) return error;
-  return new import_core6.BasicError(fallback, error instanceof Error ? error.message : String(error));
+  if (error instanceof import_core5.BasicError) return error;
+  return new import_core5.BasicError(fallback, error instanceof Error ? error.message : String(error));
 }
 function useAsyncResult(load, initialData, enabled, settled, dependencies) {
   const loadRef = (0, import_react3.useRef)(load);
@@ -766,12 +778,12 @@ function useAccountsFor(client) {
   const addAccount = (0, import_react4.useCallback)(() => client.addAccount(), [client]);
   const removeAccount = (0, import_react4.useCallback)((id) => client.removeAccount(id), [client]);
   return (0, import_react4.useMemo)(() => ({
-    accounts: snapshot.profiles,
+    accounts: snapshot.accounts,
     active: snapshot.activeProfile,
     switchAccount,
     addAccount,
     removeAccount
-  }), [snapshot.profiles, snapshot.activeProfile, switchAccount, addAccount, removeAccount]);
+  }), [snapshot.accounts, snapshot.activeProfile, switchAccount, addAccount, removeAccount]);
 }
 function useAccounts() {
   return useAccountsFor(useRequiredClient());
@@ -779,7 +791,7 @@ function useAccounts() {
 
 // src/hooks/auth.ts
 var import_react5 = require("react");
-var import_core7 = require("@basictech/core");
+var import_core6 = require("@basictech/core");
 function useAuthFor(client) {
   const snapshot = useClientSnapshot(client);
   const signIn = (0, import_react5.useCallback)((input) => client.signIn(input), [client]);
@@ -789,8 +801,10 @@ function useAuthFor(client) {
     isReady: snapshot.isReady,
     isSignedIn: snapshot.isSignedIn,
     isAnonymous: snapshot.isAnonymous,
+    canWrite: snapshot.canWrite,
+    readOnlyReason: snapshot.readOnlyReason,
     status: snapshot.authStatus,
-    error: snapshot.authErrorCode ? new import_core7.BasicError(snapshot.authErrorCode) : null,
+    error: snapshot.authErrorCode ? new import_core6.BasicError(snapshot.authErrorCode) : null,
     user: snapshot.user,
     did: snapshot.did,
     handle: snapshot.handle,
@@ -979,6 +993,7 @@ function useOutgoingSharesFor(client) {
   const get = (0, import_react9.useCallback)((id) => client.shares.getOutgoing(id), [client]);
   const cancel = (0, import_react9.useCallback)((id) => client.shares.cancel(id), [client]);
   const revoke = (0, import_react9.useCallback)((id) => client.shares.revoke(id), [client]);
+  const getContactHandle = (0, import_react9.useCallback)((did) => client.shares.getContactHandle(did), [client]);
   const manageUrl = (0, import_react9.useCallback)(() => client.shares.manageUrl(), [client]);
   const { data: outgoingShares, ...state } = result;
   return {
@@ -989,6 +1004,7 @@ function useOutgoingSharesFor(client) {
     get,
     cancel,
     revoke,
+    getContactHandle,
     manageUrl
   };
 }