@basictech/react 0.8.0-beta.4 → 0.9.0-beta.1

package/dist/index.js

@@ -30,6 +30,16 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/react/context.ts
+var import_react, BasicClientContext;
+var init_context = __esm({
+  "src/react/context.ts"() {
+    "use strict";
+    import_react = require("react");
+    BasicClientContext = (0, import_react.createContext)(null);
+  }
+});
+
 // src/config.ts
 var log;
 var init_config = __esm({
@@ -46,242 +56,11 @@ var init_config = __esm({
   }
 });
 
-// src/sync/tokenRegistry.ts
-function setTokenGetter(url, fn) {
-  registry.set(url, fn);
-}
-function getTokenGetter(url) {
-  return registry.get(url);
-}
-var registry;
-var init_tokenRegistry = __esm({
-  "src/sync/tokenRegistry.ts"() {
-    "use strict";
-    registry = /* @__PURE__ */ new Map();
-  }
-});
-
-// src/sync/syncProtocol.js
-var syncProtocol_exports = {};
-__export(syncProtocol_exports, {
-  syncProtocol: () => syncProtocol
-});
-function decodeJwtExp(token) {
-  try {
-    var parts = token.split(".");
-    if (parts.length !== 3) return null;
-    var payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
-    return typeof payload.exp === "number" ? payload.exp : null;
-  } catch (_) {
-    return null;
-  }
-}
-var import_dexie, syncProtocol;
-var init_syncProtocol = __esm({
-  "src/sync/syncProtocol.js"() {
-    "use strict";
-    "use client";
-    import_dexie = require("dexie");
-    init_config();
-    init_tokenRegistry();
-    syncProtocol = function() {
-      log("Initializing syncProtocol");
-      var RECONNECT_DELAY = 5e3;
-      var TOKEN_REFRESH_BUFFER = 60;
-      import_dexie.Dexie.Syncable.registerSyncProtocol("websocket", {
-        sync: function(context, url, options, baseRevision, syncedRevision, changes, partial, applyRemoteChanges, onChangesAccepted, onSuccess, onError) {
-          var requestId = 0;
-          var acceptCallbacks = {};
-          var refreshTimer = null;
-          var pendingTokenUpdate = null;
-          log("Connecting to", url);
-          var ws = new WebSocket(url);
-          function sendChanges(changes2, baseRevision2, partial2, onChangesAccepted2) {
-            log("sendChanges", changes2.length, baseRevision2);
-            ++requestId;
-            acceptCallbacks[requestId.toString()] = onChangesAccepted2;
-            ws.send(
-              JSON.stringify({
-                type: "changes",
-                changes: changes2,
-                partial: partial2,
-                baseRevision: baseRevision2,
-                requestId
-              })
-            );
-          }
-          function clearRefreshTimer() {
-            if (refreshTimer) {
-              clearTimeout(refreshTimer);
-              refreshTimer = null;
-            }
-          }
-          function sendTokenUpdate(token) {
-            if (ws.readyState !== WebSocket.OPEN) return false;
-            pendingTokenUpdate = token;
-            ws.send(JSON.stringify({ type: "tokenUpdate", authToken: token }));
-            return true;
-          }
-          function resolveGetToken() {
-            var fn = getTokenGetter(url);
-            if (!fn) throw new Error("No token getter registered for " + url);
-            return fn;
-          }
-          function scheduleTokenRefresh(tokenStr) {
-            clearRefreshTimer();
-            var exp = decodeJwtExp(tokenStr);
-            if (!exp) return;
-            var msUntilRefresh = (exp - TOKEN_REFRESH_BUFFER) * 1e3 - Date.now();
-            if (msUntilRefresh <= 0) return;
-            log("Scheduling proactive token refresh in", Math.round(msUntilRefresh / 1e3), "s");
-            refreshTimer = setTimeout(async function() {
-              try {
-                var newToken = await resolveGetToken()({ forceRefresh: true });
-                if (sendTokenUpdate(newToken)) {
-                  log("Sending tokenUpdate on existing WebSocket");
-                }
-              } catch (err) {
-                log("Proactive token refresh failed (non-fatal):", err);
-              }
-            }, msUntilRefresh);
-          }
-          ws.onopen = async function(event) {
-            try {
-              var token = await resolveGetToken()();
-              log("Opening socket - sending clientIdentity", context.clientIdentity);
-              ws.send(
-                JSON.stringify({
-                  type: "clientIdentity",
-                  clientIdentity: context.clientIdentity || null,
-                  authToken: token,
-                  schema: options.schema
-                })
-              );
-              scheduleTokenRefresh(token);
-            } catch (err) {
-              log("Failed to get token for WebSocket:", err);
-              ws.close();
-              onError("Authentication failed: " + (err.message || err), RECONNECT_DELAY);
-            }
-          };
-          function handleVisibilityResume() {
-            if (document.visibilityState === "visible" && ws.readyState === WebSocket.OPEN) {
-              log("Page became visible - refreshing token for WebSocket");
-              resolveGetToken()({ forceRefresh: true }).then(function(newToken) {
-                sendTokenUpdate(newToken);
-              }).catch(function(err) {
-                log("Token refresh on visibility resume failed:", err);
-              });
-            }
-          }
-          if (typeof document !== "undefined") {
-            document.addEventListener("visibilitychange", handleVisibilityResume);
-          }
-          function cleanupVisibilityListener() {
-            if (typeof document !== "undefined") {
-              document.removeEventListener("visibilitychange", handleVisibilityResume);
-            }
-          }
-          ws.onerror = function(event) {
-            clearRefreshTimer();
-            cleanupVisibilityListener();
-            ws.close();
-            log("ws.onerror", event);
-            onError(event?.message, RECONNECT_DELAY);
-          };
-          ws.onclose = function(event) {
-            clearRefreshTimer();
-            cleanupVisibilityListener();
-            onError("Socket closed: " + event.reason, RECONNECT_DELAY);
-          };
-          var isFirstRound = true;
-          ws.onmessage = function(event) {
-            try {
-              var requestFromServer = JSON.parse(event.data);
-              log("requestFromServer", requestFromServer, { isFirstRound });
-              if (requestFromServer.type == "clientIdentity") {
-                context.clientIdentity = requestFromServer.clientIdentity;
-                context.save();
-                sendChanges(changes, baseRevision, partial, onChangesAccepted);
-                ws.send(
-                  JSON.stringify({
-                    type: "subscribe",
-                    syncedRevision
-                  })
-                );
-              } else if (requestFromServer.type == "changes") {
-                applyRemoteChanges(
-                  requestFromServer.changes,
-                  requestFromServer.currentRevision,
-                  requestFromServer.partial
-                );
-                if (isFirstRound && !requestFromServer.partial) {
-                  onSuccess({
-                    // Specify a react function that will react on additional client changes
-                    react: function(changes2, baseRevision2, partial2, onChangesAccepted2) {
-                      sendChanges(
-                        changes2,
-                        baseRevision2,
-                        partial2,
-                        onChangesAccepted2
-                      );
-                    },
-                    disconnect: function() {
-                      clearRefreshTimer();
-                      cleanupVisibilityListener();
-                      ws.close();
-                    }
-                  });
-                  isFirstRound = false;
-                }
-              } else if (requestFromServer.type == "tokenUpdateAck") {
-                if (requestFromServer.ok) {
-                  scheduleTokenRefresh(requestFromServer.authToken || pendingTokenUpdate);
-                  pendingTokenUpdate = null;
-                } else {
-                  log("tokenUpdate rejected by server:", requestFromServer.code || requestFromServer.message);
-                  pendingTokenUpdate = null;
-                  ws.close(4001, requestFromServer.code || "token_update_failed");
-                  onError(
-                    requestFromServer.message || "Authentication refresh failed",
-                    RECONNECT_DELAY
-                  );
-                }
-              } else if (requestFromServer.type == "ack") {
-                var requestId2 = requestFromServer.requestId;
-                var acceptCallback = acceptCallbacks[requestId2.toString()];
-                acceptCallback();
-                delete acceptCallbacks[requestId2.toString()];
-              } else if (requestFromServer.type == "error") {
-                ws.close();
-                if (requestFromServer.code === "TOKEN_EXPIRED" || requestFromServer.code === "UNAUTHORIZED") {
-                  log("Auth error from server, will reconnect with fresh token:", requestFromServer.message);
-                  onError(requestFromServer.message, RECONNECT_DELAY);
-                } else {
-                  onError(requestFromServer.message, Infinity);
-                }
-              } else {
-                log("unknown message", requestFromServer);
-                ws.close();
-                onError("unknown message", Infinity);
-              }
-            } catch (e) {
-              ws.close();
-              log("caught error", e);
-              onError(e, Infinity);
-            }
-          };
-        }
-      });
-    };
-  }
-});
-
 // package.json
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.8.0-beta.4";
+    version = "0.9.0-beta.1";
   }
 });
 
@@ -369,24 +148,6 @@ function cleanOAuthParamsFromUrl() {
     log("Cleaned OAuth parameters from URL");
   }
 }
-function getSyncStatus(statusCode) {
-  switch (statusCode) {
-    case -1:
-      return "ERROR";
-    case 0:
-      return "OFFLINE";
-    case 1:
-      return "CONNECTING";
-    case 2:
-      return "ONLINE";
-    case 3:
-      return "SYNCING";
-    case 4:
-      return "ERROR_WILL_RETRY";
-    default:
-      return "UNKNOWN";
-  }
-}
 var import_semver;
 var init_network = __esm({
   "src/utils/network.ts"() {
@@ -397,59 +158,185 @@ var init_network = __esm({
   }
 });
 
-// src/context.tsx
+// src/react/hooks.ts
+function useQuery(querier, deps = []) {
+  const client = (0, import_react2.useContext)(BasicClientContext);
+  const activeUserId = (0, import_react2.useSyncExternalStore)(
+    client ? client.subscribe : noopSubscribe,
+    () => client?.getSnapshot().activeUser?.id ?? null,
+    () => null
+  );
+  return (0, import_dexie_react_hooks.useLiveQuery)(async () => {
+    try {
+      return await querier();
+    } catch (err) {
+      if (err instanceof Error && err.name === "DatabaseClosedError") return void 0;
+      throw err;
+    }
+  }, [...deps, activeUserId]);
+}
+function useBasicClient() {
+  const client = (0, import_react2.useContext)(BasicClientContext);
+  if (!client) {
+    throw new Error("useBasic must be used within a <BasicProvider>");
+  }
+  return client;
+}
+function useClientSnapshot(client) {
+  return (0, import_react2.useSyncExternalStore)(client.subscribe, client.getSnapshot, client.getSnapshot);
+}
+function useAuth() {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  return (0, import_react2.useMemo)(
+    () => ({
+      isReady: snapshot.isReady,
+      isSignedIn: snapshot.isSignedIn,
+      isAnonymous: snapshot.isAnonymous,
+      status: snapshot.authStatus,
+      errorCode: snapshot.authErrorCode,
+      user: snapshot.user,
+      did: snapshot.did,
+      scope: snapshot.scope,
+      hasScope: (s) => client.auth.hasScope(s),
+      missingScopes: () => client.auth.missingScopes(),
+      signIn: (redirectUri) => client.auth.signIn(redirectUri),
+      signInWithHandle: (handle) => client.auth.signInWithHandle(handle),
+      signInWithCode: (code, state) => client.auth.signInWithCode(code, state),
+      signOut: () => client.signOut(),
+      getToken: (options) => client.auth.getToken(options),
+      getSignInUrl: (redirectUri) => client.auth.getSignInUrl(redirectUri)
+    }),
+    [client, snapshot]
+  );
+}
+function useDb() {
+  const client = useBasicClient();
+  return client.db;
+}
+function useSyncStatus() {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  return (0, import_react2.useMemo)(
+    () => ({
+      status: snapshot.syncStatus,
+      enabled: snapshot.syncEnabled,
+      pendingCount: snapshot.pendingCount,
+      listRejected: () => client.listRejected(),
+      clearRejected: () => client.clearRejected()
+    }),
+    [client, snapshot]
+  );
+}
+function useShares() {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  const [state, setState] = (0, import_react2.useState)({ granted: [], received: [], isLoading: false, error: null });
+  const isSignedIn = snapshot.isSignedIn && snapshot.authStatus === "authenticated";
+  const refresh = (0, import_react2.useMemo)(
+    () => async () => {
+      setState((s) => ({ ...s, isLoading: true, error: null }));
+      try {
+        const { granted, received } = await client.listShares();
+        setState({ granted, received, isLoading: false, error: null });
+      } catch (err) {
+        setState((s) => ({
+          ...s,
+          isLoading: false,
+          error: err instanceof Error ? err : new Error(String(err))
+        }));
+      }
+    },
+    [client]
+  );
+  const activeUserId = snapshot.activeUser?.id ?? null;
+  (0, import_react2.useEffect)(() => {
+    if (isSignedIn) void refresh();
+    else setState({ granted: [], received: [], isLoading: false, error: null });
+  }, [isSignedIn, refresh, activeUserId]);
+  return { ...state, refresh };
+}
+function useShare(shareId) {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  const [handle, setHandle] = (0, import_react2.useState)(null);
+  const [error, setError] = (0, import_react2.useState)(null);
+  const [revoked, setRevoked] = (0, import_react2.useState)(false);
+  const canMount = !!shareId && snapshot.isSignedIn && snapshot.authStatus !== "reauth_required";
+  const activeUserId = snapshot.activeUser?.id ?? null;
+  (0, import_react2.useEffect)(() => {
+    if (!canMount || !shareId) return;
+    let cancelled = false;
+    setError(null);
+    setRevoked(false);
+    client.mountShare(shareId).then((h) => {
+      if (!cancelled) setHandle(h);
+    }).catch((err) => {
+      if (!cancelled) setError(err instanceof Error ? err : new Error(String(err)));
+    });
+    const offSubError = client.engine?.on("suberror", ({ sub, code }) => {
+      if (sub === `share:${shareId}` && (code === "SHARE_REVOKED" || code === "CONNECTION_REVOKED")) {
+        setRevoked(true);
+        setHandle(null);
+      }
+    });
+    return () => {
+      cancelled = true;
+      offSubError?.();
+      setHandle(null);
+      void client.unmountShare(shareId).catch(() => {
+      });
+    };
+  }, [client, shareId, canMount, activeUserId]);
+  return {
+    db: handle?.db ?? null,
+    status: revoked ? "revoked" : error ? "error" : handle ? "mounted" : "mounting",
+    error
+  };
+}
+function useUsers() {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  return (0, import_react2.useMemo)(
+    () => ({
+      users: snapshot.users,
+      activeUser: snapshot.activeUser,
+      isAnonymous: snapshot.isAnonymous,
+      switchUser: (id) => client.switchUser(id),
+      addUser: () => client.addUser(),
+      removeUser: (id) => client.removeUser(id)
+    }),
+    [client, snapshot]
+  );
+}
 function useBasic() {
-  return (0, import_react.useContext)(BasicContext);
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  const auth = useAuth();
+  const sync = useSyncStatus();
+  return (0, import_react2.useMemo)(
+    () => ({
+      ...auth,
+      db: client.db,
+      sync,
+      users: snapshot.users,
+      activeUser: snapshot.activeUser,
+      devInfo: snapshot.devInfo,
+      refreshSchemaStatus: () => client.refreshSchemaStatus(),
+      client
+    }),
+    [client, snapshot, auth, sync]
+  );
 }
-var import_react, DBStatus, noDb, BasicContext;
-var init_context = __esm({
-  "src/context.tsx"() {
+var import_react2, import_dexie_react_hooks, noopSubscribe;
+var init_hooks = __esm({
+  "src/react/hooks.ts"() {
     "use strict";
-    import_react = require("react");
-    DBStatus = /* @__PURE__ */ ((DBStatus2) => {
-      DBStatus2["LOADING"] = "LOADING";
-      DBStatus2["OFFLINE"] = "OFFLINE";
-      DBStatus2["CONNECTING"] = "CONNECTING";
-      DBStatus2["ONLINE"] = "ONLINE";
-      DBStatus2["SYNCING"] = "SYNCING";
-      DBStatus2["ERROR"] = "ERROR";
-      DBStatus2["ERROR_WILL_RETRY"] = "ERROR_WILL_RETRY";
-      DBStatus2["ERROR_TOKEN_EXPIRED"] = "ERROR_TOKEN_EXPIRED";
-      return DBStatus2;
-    })(DBStatus || {});
-    noDb = {
-      collection: () => {
-        throw new Error("no basicdb found - initialization failed. double check your schema.");
-      }
+    import_react2 = require("react");
+    import_dexie_react_hooks = require("dexie-react-hooks");
+    init_context();
+    noopSubscribe = () => () => {
     };
-    BasicContext = (0, import_react.createContext)({
-      isReady: false,
-      isSignedIn: false,
-      authStatus: "bootstrapping",
-      authErrorCode: null,
-      user: null,
-      did: null,
-      scope: null,
-      hasScope: () => false,
-      missingScopes: () => [],
-      signIn: () => Promise.resolve(),
-      signInWithHandle: () => Promise.resolve(),
-      signOut: () => Promise.resolve(),
-      signInWithCode: () => Promise.resolve({ success: false }),
-      getToken: (_options) => Promise.reject(new Error("no token")),
-      getSignInUrl: () => Promise.resolve(""),
-      db: noDb,
-      dbStatus: "LOADING" /* LOADING */,
-      dbMode: "sync",
-      devInfo: null,
-      refreshSchemaStatus: async () => {
-      },
-      isAuthReady: false,
-      signin: () => Promise.resolve(),
-      signout: () => Promise.resolve(),
-      signinWithCode: () => Promise.resolve({ success: false }),
-      getSignInLink: () => Promise.resolve("")
-    });
   }
 });
 
@@ -463,11 +350,12 @@ function toneForAuth(isReady, isSignedIn) {
   if (isSignedIn) return "ok";
   return "warn";
 }
-function toneForDb(dbMode, dbStatus) {
-  if (dbMode === "remote") return dbStatus === "ONLINE" /* ONLINE */ ? "ok" : "warn";
-  if (dbStatus === "ONLINE" /* ONLINE */ || dbStatus === "SYNCING" /* SYNCING */) return "ok";
-  if (dbStatus === "CONNECTING" /* CONNECTING */ || dbStatus === "LOADING" /* LOADING */) return "warn";
-  if (dbStatus === "OFFLINE" /* OFFLINE */) return "muted";
+function toneForSync(mode, status) {
+  if (mode === "rest") return "muted";
+  if (status === "online") return "ok";
+  if (status === "connecting") return "warn";
+  if (status === "offline" || status === "idle" || status === "stopped" || status === "local")
+    return "muted";
   return "bad";
 }
 function toneForSchema(info) {
@@ -477,24 +365,24 @@ function toneForSchema(info) {
   if (info.status === "no_schema") return "muted";
   return "bad";
 }
-function dbStatusLabel(status) {
+function syncStatusLabel(status) {
   switch (status) {
-    case "LOADING" /* LOADING */:
-      return "Initializing";
-    case "OFFLINE" /* OFFLINE */:
-      return "Offline";
-    case "CONNECTING" /* CONNECTING */:
+    case "idle":
+      return "Idle";
+    case "local":
+      return "Local only";
+    case "connecting":
       return "Connecting";
-    case "ONLINE" /* ONLINE */:
+    case "online":
       return "Connected";
-    case "SYNCING" /* SYNCING */:
-      return "Syncing";
-    case "ERROR" /* ERROR */:
-      return "Error";
-    case "ERROR_WILL_RETRY" /* ERROR_WILL_RETRY */:
-      return "Retrying";
-    case "ERROR_TOKEN_EXPIRED" /* ERROR_TOKEN_EXPIRED */:
-      return "Token refresh";
+    case "offline":
+      return "Offline";
+    case "auth_required":
+      return "Reauth required";
+    case "revoked":
+      return "Connection revoked";
+    case "stopped":
+      return "Stopped";
     default:
       return String(status);
   }
@@ -583,9 +471,9 @@ function CopyableRow({
   onCopied,
   children
 }) {
-  const [hover, setHover] = (0, import_react2.useState)(false);
+  const [hover, setHover] = (0, import_react3.useState)(false);
   const canCopy = copyText.length > 0;
-  const handleClick = (0, import_react2.useCallback)(
+  const handleClick = (0, import_react3.useCallback)(
     (e) => {
       e.stopPropagation();
       if (!canCopy) return;
@@ -659,25 +547,32 @@ function BasicDevToolbar({ enabled = true, debug }) {
   const {
     isReady,
     isSignedIn,
+    isAnonymous,
     user,
     did,
     scope,
     missingScopes,
-    dbMode,
-    dbStatus,
+    sync,
+    users,
+    activeUser,
     devInfo,
-    refreshSchemaStatus
+    refreshSchemaStatus,
+    client
   } = useBasic();
-  const [open, setOpen] = (0, import_react2.useState)(false);
-  const [refreshing, setRefreshing] = (0, import_react2.useState)(false);
-  const [copied, setCopied] = (0, import_react2.useState)(false);
-  const [rowCopied, setRowCopied] = (0, import_react2.useState)(null);
+  const dbMode = client.mode;
+  const syncStatus = sync.status;
+  const indexedDbName = dbMode === "sync" && client.projectId ? `basic-sync:${client.projectId}${activeUser?.keyspace ? `:${activeUser.keyspace}` : ""}` : null;
+  const activeUserLabel = activeUser ? `${isAnonymous ? "anonymous" : activeUser.email || activeUser.name || activeUser.did || "account"} (${activeUser.id.slice(0, 8)}\u2026)${users.length > 1 ? ` \xB7 ${users.length} users` : ""}` : "\u2014";
+  const [open, setOpen] = (0, import_react3.useState)(false);
+  const [refreshing, setRefreshing] = (0, import_react3.useState)(false);
+  const [copied, setCopied] = (0, import_react3.useState)(false);
+  const [rowCopied, setRowCopied] = (0, import_react3.useState)(null);
   const show = enabled && typeof window !== "undefined" && isDevelopment(debug);
   const authTone = toneForAuth(isReady, isSignedIn);
-  const dbTone = toneForDb(dbMode, dbStatus);
+  const dbTone = toneForSync(dbMode, syncStatus);
   const schemaTone = toneForSchema(devInfo);
-  const syncTone = dbMode === "remote" ? "muted" : dbTone === "ok" || dbStatus === "SYNCING" /* SYNCING */ ? "ok" : dbTone === "warn" ? "warn" : dbTone === "bad" ? "bad" : "muted";
-  const handleRefreshSchema = (0, import_react2.useCallback)(async () => {
+  const syncTone = dbTone;
+  const handleRefreshSchema = (0, import_react3.useCallback)(async () => {
     setRefreshing(true);
     try {
       await refreshSchemaStatus();
@@ -686,7 +581,7 @@ function BasicDevToolbar({ enabled = true, debug }) {
     }
   }, [refreshSchemaStatus]);
   const missingList = missingScopes();
-  const debugPayload = (0, import_react2.useMemo)(() => {
+  const debugPayload = (0, import_react3.useMemo)(() => {
     return {
       sdkVersion: version,
       isReady,
@@ -701,12 +596,15 @@ function BasicDevToolbar({ enabled = true, debug }) {
       scope,
       missingScopes: missingList,
       dbMode,
-      dbStatus,
-      indexedDbName: dbMode === "sync" ? INDEXED_DB_NAME : null,
+      syncStatus,
+      pendingOps: sync.pendingCount,
+      indexedDbName,
+      activeUser: activeUser ? { id: activeUser.id, kind: activeUser.kind, did: activeUser.did } : null,
+      userCount: users.length,
       schema: devInfo
     };
-  }, [isReady, isSignedIn, did, user, scope, dbMode, dbStatus, devInfo, missingList]);
-  const handleCopy = (0, import_react2.useCallback)(async () => {
+  }, [isReady, isSignedIn, did, user, scope, dbMode, syncStatus, sync.pendingCount, indexedDbName, activeUser, users.length, devInfo, missingList]);
+  const handleCopy = (0, import_react3.useCallback)(async () => {
     try {
       await navigator.clipboard.writeText(JSON.stringify(debugPayload, null, 2));
       setCopied(true);
@@ -714,7 +612,7 @@ function BasicDevToolbar({ enabled = true, debug }) {
     } catch {
     }
   }, [debugPayload]);
-  const onRowCopied = (0, import_react2.useCallback)((key) => {
+  const onRowCopied = (0, import_react3.useCallback)((key) => {
     setRowCopied(key);
     setTimeout(() => setRowCopied((k) => k === key ? null : k), 1500);
   }, []);
@@ -788,7 +686,7 @@ function BasicDevToolbar({ enabled = true, debug }) {
     minWidth: 300,
     maxWidth: "min(560px, calc(100vw - 24px))"
   };
-  const syncStatusText = dbStatusLabel(dbStatus);
+  const syncStatusText = dbMode === "rest" ? "REST mode" : `${syncStatusLabel(syncStatus)}${sync.pendingCount > 0 ? ` (${sync.pendingCount} pending)` : ""}`;
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: shell, children: [
     open && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: panel, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { marginBottom: 12 }, children: [
@@ -843,6 +741,17 @@ function BasicDevToolbar({ enabled = true, debug }) {
           children: user ? displayUserLine(user) : "\u2014"
         }
       ),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        CopyableRow,
+        {
+          rowKey: "activeProfile",
+          label: "Profile",
+          copyText: activeUser?.id ?? "",
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: activeUserLabel
+        }
+      ),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
         CopyableRow,
         {
@@ -883,10 +792,10 @@ function BasicDevToolbar({ enabled = true, debug }) {
         {
           rowKey: "indexedDb",
           label: "IndexedDB",
-          copyText: dbMode === "sync" ? INDEXED_DB_NAME : "",
+          copyText: indexedDbName ?? "",
           copiedKey: rowCopied,
           onCopied: onRowCopied,
-          children: dbMode === "sync" ? INDEXED_DB_NAME : "\u2014"
+          children: indexedDbName ?? "\u2014"
         }
       ),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
@@ -1066,17 +975,16 @@ function BasicDevToolbar({ enabled = true, debug }) {
     )
   ] });
 }
-var import_react2, import_jsx_runtime, INDEXED_DB_NAME, PANEL_PAD_X;
+var import_react3, import_jsx_runtime, PANEL_PAD_X;
 var init_BasicDevToolbar = __esm({
   "src/dev/BasicDevToolbar.tsx"() {
     "use strict";
     "use client";
-    import_react2 = require("react");
-    init_context();
+    import_react3 = require("react");
+    init_hooks();
     init_package();
     init_network();
     import_jsx_runtime = require("react/jsx-runtime");
-    INDEXED_DB_NAME = "basicdb";
     PANEL_PAD_X = 12;
   }
 });
@@ -1084,595 +992,136 @@ var init_BasicDevToolbar = __esm({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AuthManager: () => AuthManager,
+  BasicClient: () => BasicClient,
   BasicDevToolbar: () => BasicDevToolbar,
   BasicProvider: () => BasicProvider,
-  DBStatus: () => DBStatus,
+  DEFAULT_LIMITS: () => DEFAULT_LIMITS,
+  LocalStorageAdapter: () => LocalStorageAdapter,
   NotAuthenticatedError: () => NotAuthenticatedError,
-  RemoteCollection: () => RemoteCollection,
-  RemoteDB: () => RemoteDB,
-  RemoteDBError: () => RemoteDBError,
+  OWN_SUB: () => OWN_SUB,
+  PROTOCOL_VERSION: () => PROTOCOL_VERSION,
+  PrefixedStorage: () => PrefixedStorage,
+  RestClient: () => RestClient,
+  RestDb: () => RestDb,
+  RestError: () => RestError,
   STORAGE_KEYS: () => STORAGE_KEYS,
+  SyncConnection: () => SyncConnection,
+  SyncDb: () => SyncDb,
+  SyncEngine: () => SyncEngine,
+  SyncStore: () => SyncStore,
+  UserRegistry: () => UserRegistry,
+  applyOpToData: () => applyOpToData,
+  createBasicClient: () => createBasicClient,
+  isAuthError: () => isAuthError,
+  isRebootstrapError: () => isRebootstrapError,
+  isRevocationError: () => isRevocationError,
+  isTerminalOpError: () => isTerminalOpError,
+  mintOpId: () => mintOpId,
   resolveDid: () => resolveDid,
   resolveDidWebUrl: () => resolveDidWebUrl,
   resolveHandle: () => resolveHandle,
+  shareSubKey: () => shareSubKey,
+  useAuth: () => useAuth,
   useBasic: () => useBasic,
-  useQuery: () => import_dexie_react_hooks.useLiveQuery
+  useBasicClient: () => useBasicClient,
+  useDb: () => useDb,
+  useQuery: () => useQuery,
+  useShare: () => useShare,
+  useShares: () => useShares,
+  useSyncStatus: () => useSyncStatus,
+  useUsers: () => useUsers
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/AuthContext.tsx
-var import_react3 = require("react");
+// src/react/BasicProvider.tsx
+var import_react4 = require("react");
+init_context();
 
-// src/sync/index.ts
-var import_uuid = require("uuid");
-var import_dexie2 = require("dexie");
-init_config();
-var import_schema = require("@basictech/schema");
-init_tokenRegistry();
-var dexieExtensionsLoaded = false;
-var initPromise = null;
-async function initDexieExtensions() {
-  if (dexieExtensionsLoaded) return;
-  if (typeof window === "undefined") return;
-  if (initPromise) return initPromise;
-  initPromise = (async () => {
-    try {
-      await import("dexie-syncable");
-      await import("dexie-observable");
-      const { syncProtocol: syncProtocol2 } = await Promise.resolve().then(() => (init_syncProtocol(), syncProtocol_exports));
-      syncProtocol2();
-      dexieExtensionsLoaded = true;
-      log("Dexie extensions loaded successfully");
-    } catch (error) {
-      console.error("Failed to load Dexie extensions:", error);
-      throw error;
-    }
-  })();
-  return initPromise;
-}
-var BasicSync = class extends import_dexie2.Dexie {
-  basic_schema;
-  constructor(name, options) {
-    super(name, options);
-    this.basic_schema = options.schema;
-    this.version(1).stores(this._convertSchemaToDxSchema(this.basic_schema));
-    this.version(2).stores({});
-    this.Collection.prototype.get = this.Collection.prototype.toArray;
-  }
-  async connect({ getToken, ws_url }) {
-    const WS_URL = ws_url || "wss://pds.basic.id/ws";
-    log("Connecting to", WS_URL);
-    setTokenGetter(WS_URL, getToken);
-    await this.updateSyncNodes();
-    log("Starting connection...");
-    return this.syncable.connect("websocket", WS_URL, { schema: this.basic_schema });
-  }
-  async disconnect({ ws_url } = {}) {
-    const WS_URL = ws_url || "wss://pds.basic.id/ws";
-    return this.syncable.disconnect(WS_URL);
-  }
-  async updateSyncNodes() {
-    try {
-      const syncNodes = await this.table("_syncNodes").toArray();
-      const localSyncNodes = syncNodes.filter((node) => node.type === "local");
-      log("Local sync nodes:", localSyncNodes);
-      if (localSyncNodes.length > 1) {
-        const largestNodeId = Math.max(...localSyncNodes.map((node) => node.id));
-        const largestNode = localSyncNodes.find((node) => node.id === largestNodeId);
-        if (largestNode && largestNode.isMaster === 1) {
-          log("Largest node is already the master. No changes needed.");
-          return;
-        }
-        log("Largest node id:", largestNodeId);
-        log("HEISENBUG: More than one local sync node found.");
-        for (const node of localSyncNodes) {
-          log(`Local sync node keys:`, node.id, node.isMaster);
-          await this.table("_syncNodes").update(node.id, { isMaster: node.id === largestNodeId ? 1 : 0 });
-          log(`HEISENBUG: Setting ${node.id} to ${node.id === largestNodeId ? "master" : "0"}`);
-        }
-        await new Promise((resolve) => setTimeout(resolve, 1e3));
-        if (typeof window !== "undefined") {
-          window.location.reload();
-        }
-      }
-      log("Sync nodes updated");
-    } catch (error) {
-      console.error("Error updating _syncNodes table:", error);
-    }
-  }
-  handleStatusChange(fn) {
-    this.syncable.on("statusChanged", fn);
-  }
-  _convertSchemaToDxSchema(schema) {
-    const stores = Object.entries(schema.tables).map(([key, table]) => {
-      const indexedFields = Object.entries(table.fields).filter(([, field]) => field.indexed).map(([fieldKey]) => `,${fieldKey}`).join("");
-      return {
-        [key]: "id" + indexedFields
-      };
-    });
-    return Object.assign({}, ...stores);
+// src/core/auth/AuthManager.ts
+var import_jwt_decode = require("jwt-decode");
+
+// src/utils/storage.ts
+var LocalStorageAdapter = class {
+  async get(key) {
+    return localStorage.getItem(key);
   }
-  debugeroo() {
-    return this.syncable;
+  async set(key, value) {
+    localStorage.setItem(key, value);
   }
-  collection(name) {
-    if (this.basic_schema?.tables && !this.basic_schema.tables[name]) {
-      throw new Error(`Table "${name}" not found in schema`);
-    }
-    const table = this.table(name);
-    return {
-      /**
-       * Returns the underlying Dexie table
-       * @type {Dexie.Table}
-       */
-      ref: table,
-      // --- WRITE ---- // 
-      /**
-       * Add a new record - returns the full object with generated id
-       */
-      add: async (data) => {
-        const valid = (0, import_schema.validateData)(this.basic_schema, name, data);
-        if (!valid.valid) {
-          log("Invalid data", valid);
-          throw new Error(valid.message || "Data validation failed");
-        }
-        const id = (0, import_uuid.v7)();
-        const fullData = { id, ...data };
-        await table.add(fullData);
-        return fullData;
-      },
-      /**
-       * Put (upsert) a record - returns the full object
-       */
-      put: async (data) => {
-        if (!data.id) {
-          throw new Error("put() requires an id field");
-        }
-        const valid = (0, import_schema.validateData)(this.basic_schema, name, data);
-        if (!valid.valid) {
-          log("Invalid data", valid);
-          throw new Error(valid.message || "Data validation failed");
-        }
-        await table.put(data);
-        return data;
-      },
-      /**
-       * Update an existing record - returns updated object or null
-       */
-      update: async (id, data) => {
-        if (!id) {
-          throw new Error("update() requires an id");
-        }
-        const valid = (0, import_schema.validateData)(this.basic_schema, name, data, false);
-        if (!valid.valid) {
-          log("Invalid data", valid);
-          throw new Error(valid.message || "Data validation failed");
-        }
-        const updated = await table.update(id, data);
-        if (updated === 0) {
-          return null;
-        }
-        const record = await table.get(id);
-        return record || null;
-      },
-      /**
-       * Delete a record - returns true if deleted, false if not found
-       */
-      delete: async (id) => {
-        if (!id) {
-          throw new Error("delete() requires an id");
-        }
-        const exists = await table.get(id);
-        if (!exists) {
-          return false;
-        }
-        await table.delete(id);
-        return true;
-      },
-      // --- READ ---- // 
-      /**
-       * Get a single record by id - returns null if not found
-       */
-      get: async (id) => {
-        if (!id) {
-          throw new Error("get() requires an id");
-        }
-        const record = await table.get(id);
-        return record || null;
-      },
-      /**
-       * Get all records in the collection
-       */
-      getAll: async () => {
-        return table.toArray();
-      },
-      // --- QUERY ---- // 
-      /**
-       * Filter records using a predicate function
-       */
-      filter: async (fn) => {
-        return table.filter(fn).toArray();
-      },
-      /**
-       * Get the raw Dexie table for advanced queries
-       * @deprecated Use ref instead
-       */
-      query: () => table
-    };
+  async remove(key) {
+    localStorage.removeItem(key);
   }
 };
-
-// src/core/db/types.ts
-var RemoteDBError = class extends Error {
-  status;
-  response;
-  constructor(message, status, response) {
-    super(message);
-    this.name = "RemoteDBError";
-    this.status = status;
-    this.response = response;
-  }
+var STORAGE_KEYS = {
+  REFRESH_TOKEN: "basic_refresh_token",
+  USER_INFO: "basic_user_info",
+  AUTH_STATE: "basic_auth_state",
+  REDIRECT_URI: "basic_redirect_uri",
+  SERVER_URL: "basic_server_url",
+  PDS_ENDPOINTS: "basic_pds_endpoints",
+  LAST_CONNECT_REPORT: "basic_last_connect_report",
+  DEBUG: "basic_debug",
+  CODE_VERIFIER: "basic_code_verifier"
 };
 
-// src/core/db/RemoteCollection.ts
-var import_schema2 = require("@basictech/schema");
-var NotAuthenticatedError = class extends Error {
-  constructor(message = "Not authenticated") {
-    super(message);
-    this.name = "NotAuthenticatedError";
+// src/utils/normalizeClientId.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function normalizeClientId(projectId, adminHostname = "api.basic.tech") {
+  if (!projectId) return projectId;
+  if (projectId === "self") return projectId;
+  if (projectId.startsWith("did:")) return projectId;
+  if (UUID_RE.test(projectId)) {
+    const hex = projectId.replace(/-/g, "").toLowerCase();
+    return `did:web:${adminHostname}:projects:${hex}`;
   }
-};
-var RemoteCollection = class {
-  tableName;
-  config;
-  constructor(tableName, config) {
-    this.tableName = tableName;
-    this.config = config;
+  return projectId;
+}
+
+// src/utils/resolveDid.ts
+function resolveDidWebUrl(did) {
+  if (!did.startsWith("did:web:")) return null;
+  const rest = did.slice(8);
+  if (!rest) return null;
+  const parts = rest.split(":");
+  const hostname = parts[0].replace(/%3A/gi, ":");
+  if (parts.length === 1) {
+    return `https://${hostname}/.well-known/did.json`;
   }
-  log(...args) {
-    if (this.config.debug) {
-      console.log("[RemoteDB]", ...args);
-    }
+  const pathParts = parts.slice(1).map((p) => decodeURIComponent(p));
+  return `https://${hostname}/${pathParts.join("/")}/did.json`;
+}
+async function resolveFromDocument(did, didDocument) {
+  const services = didDocument.service;
+  const pdsService = services?.find(
+    (s) => s.id === "#basic_pds" || s.id === `${did}#basic_pds`
+  );
+  if (!pdsService) {
+    throw new Error(`DID document has no #basic_pds service entry`);
   }
-  /**
-   * Check if an error is a "not authenticated" error
-   */
-  isNotAuthenticatedError(error) {
-    if (error instanceof Error) {
-      const message = error.message.toLowerCase();
-      return message.includes("no token") || message.includes("not authenticated") || message.includes("please sign in");
-    }
-    return false;
+  const pdsUrl = pdsService.serviceEndpoint.replace(/\/+$/, "");
+  const oauthRes = await fetch(`${pdsUrl}/auth/.well-known/openid-configuration`);
+  if (!oauthRes.ok) {
+    throw new Error(`Failed to fetch OpenID configuration from ${pdsUrl}: ${oauthRes.status}`);
   }
-  /**
-   * Helper to make authenticated API requests
-   * Automatically retries once on 401 (token expired) by refreshing the token
-   */
-  async request(method, path, body, isRetry = false) {
-    const token = await this.config.getToken();
-    const url = `${this.config.serverUrl}${path}`;
-    this.log(`${method} ${url}`, body ? JSON.stringify(body) : "");
-    const headers = {
-      "Authorization": `Bearer ${token}`
-    };
-    if (body) {
-      headers["Content-Type"] = "application/json";
-    }
-    const response = await fetch(url, {
-      method,
-      headers,
-      ...body ? { body: JSON.stringify(body) } : {}
-    });
-    const responseData = await response.json().catch(() => ({}));
-    if (!response.ok) {
-      if (response.status === 401 && !isRetry) {
-        this.log("Got 401, forcing token refresh and retrying...");
-        await this.config.getToken({ forceRefresh: true });
-        return this.request(method, path, body, true);
-      }
-      if (this.config.debug) {
-        console.error(`[RemoteDB] Error ${response.status}:`, responseData);
-      }
-      if (this.config.onAuthError) {
-        if (response.status === 401) {
-          this.config.onAuthError({
-            status: response.status,
-            message: "Authentication failed",
-            response: responseData,
-            errorType: "expired",
-            afterRetry: isRetry
-          });
-        } else if (response.status === 403) {
-          this.config.onAuthError({
-            status: response.status,
-            message: responseData.message || "Forbidden - insufficient permissions or missing scope",
-            response: responseData,
-            errorType: "forbidden",
-            afterRetry: isRetry
-          });
-        }
-      }
-      const errorMessage = responseData.message || responseData.error || responseData.detail || (typeof responseData === "string" ? responseData : `API request failed: ${response.status}`);
-      throw new RemoteDBError(errorMessage, response.status, responseData);
-    }
-    this.log("Response:", responseData);
-    return responseData;
+  const oauth = await oauthRes.json();
+  return {
+    did,
+    didDocument,
+    pdsUrl,
+    authorization_endpoint: oauth.authorization_endpoint,
+    token_endpoint: oauth.token_endpoint,
+    userinfo_endpoint: oauth.userinfo_endpoint
+  };
+}
+async function resolveDid(did) {
+  const url = resolveDidWebUrl(did);
+  if (!url) {
+    throw new Error(`Unsupported DID method: ${did}`);
   }
-  /**
-   * Validate data against schema if available
-   */
-  validateData(data, checkRequired = true) {
-    if (this.config.schema) {
-      const result = (0, import_schema2.validateData)(this.config.schema, this.tableName, data, checkRequired);
-      if (!result.valid) {
-        throw new Error(result.message || "Data validation failed");
-      }
-    }
-  }
-  /**
-   * Get the base path for this collection
-   */
-  get basePath() {
-    return `/account/${this.config.projectId}/db/${this.tableName}`;
-  }
-  /**
-   * Add a new record to the collection
-   * The server generates the ID
-   * Requires authentication - throws NotAuthenticatedError if not signed in
-   */
-  async add(data) {
-    this.validateData(data, true);
-    try {
-      const result = await this.request(
-        "POST",
-        this.basePath,
-        { value: data }
-      );
-      return result.data;
-    } catch (error) {
-      if (this.isNotAuthenticatedError(error)) {
-        throw new NotAuthenticatedError("Sign in required to add items");
-      }
-      throw error;
-    }
-  }
-  /**
-   * Put (upsert) a record - requires id
-   * Requires authentication - throws NotAuthenticatedError if not signed in
-   */
-  async put(data) {
-    if (!data.id) {
-      throw new Error("put() requires an id field");
-    }
-    const { id, ...rest } = data;
-    this.validateData(rest, true);
-    try {
-      const result = await this.request(
-        "PUT",
-        `${this.basePath}/${id}`,
-        { value: rest }
-      );
-      return result.data || data;
-    } catch (error) {
-      if (this.isNotAuthenticatedError(error)) {
-        throw new NotAuthenticatedError("Sign in required to update items");
-      }
-      throw error;
-    }
-  }
-  /**
-   * Update an existing record by id
-   * Requires authentication - throws NotAuthenticatedError if not signed in
-   */
-  async update(id, data) {
-    if (!id) {
-      throw new Error("update() requires an id");
-    }
-    this.validateData(data, false);
-    try {
-      const result = await this.request(
-        "PATCH",
-        `${this.basePath}/${id}`,
-        { value: data }
-      );
-      return result.data || null;
-    } catch (error) {
-      if (error instanceof RemoteDBError && error.status === 404) {
-        return null;
-      }
-      if (this.isNotAuthenticatedError(error)) {
-        throw new NotAuthenticatedError("Sign in required to update items");
-      }
-      throw error;
-    }
-  }
-  /**
-   * Delete a record by id
-   * Requires authentication - throws NotAuthenticatedError if not signed in
-   */
-  async delete(id) {
-    if (!id) {
-      throw new Error("delete() requires an id");
-    }
-    try {
-      await this.request(
-        "DELETE",
-        `${this.basePath}/${id}`
-      );
-      return true;
-    } catch (error) {
-      if (error instanceof RemoteDBError && error.status === 404) {
-        return false;
-      }
-      if (this.isNotAuthenticatedError(error)) {
-        throw new NotAuthenticatedError("Sign in required to delete items");
-      }
-      throw error;
-    }
-  }
-  /**
-   * Get a single record by id
-   * Returns null if not authenticated (graceful degradation for read operations)
-   */
-  async get(id) {
-    if (!id) {
-      throw new Error("get() requires an id");
-    }
-    try {
-      const result = await this.request(
-        "GET",
-        `${this.basePath}?id=${id}`
-      );
-      return result.data?.[0] || null;
-    } catch (error) {
-      if (this.isNotAuthenticatedError(error)) {
-        this.log("Not authenticated - returning null for get()");
-      }
-      return null;
-    }
-  }
-  /**
-   * Get all records in the collection
-   * Returns empty array if not authenticated (graceful degradation for read operations)
-   */
-  async getAll() {
-    try {
-      const result = await this.request(
-        "GET",
-        this.basePath
-      );
-      return result.data || [];
-    } catch (error) {
-      if (this.isNotAuthenticatedError(error)) {
-        this.log("Not authenticated - returning empty array for getAll()");
-        return [];
-      }
-      throw error;
-    }
-  }
-  /**
-   * Filter records using a predicate function
-   * Note: This fetches all records and filters client-side
-   * Returns empty array if not authenticated (graceful degradation for read operations)
-   */
-  async filter(fn) {
-    const all = await this.getAll();
-    return all.filter(fn);
-  }
-  /**
-   * ref is not available for remote collections
-   */
-  ref = void 0;
-};
-
-// src/core/db/RemoteDB.ts
-var RemoteDB = class {
-  config;
-  collections = /* @__PURE__ */ new Map();
-  constructor(config) {
-    this.config = config;
-  }
-  /**
-   * Get a collection by name
-   * Collections are cached for reuse
-   */
-  collection(name) {
-    if (this.collections.has(name)) {
-      return this.collections.get(name);
-    }
-    if (this.config.schema?.tables && !this.config.schema.tables[name]) {
-      throw new Error(`Table "${name}" not found in schema`);
-    }
-    const collection = new RemoteCollection(name, this.config);
-    this.collections.set(name, collection);
-    return collection;
-  }
-};
-
-// src/core/auth/AuthManager.ts
-var import_jwt_decode = require("jwt-decode");
-
-// src/utils/storage.ts
-var LocalStorageAdapter = class {
-  async get(key) {
-    return localStorage.getItem(key);
-  }
-  async set(key, value) {
-    localStorage.setItem(key, value);
-  }
-  async remove(key) {
-    localStorage.removeItem(key);
-  }
-};
-var STORAGE_KEYS = {
-  REFRESH_TOKEN: "basic_refresh_token",
-  USER_INFO: "basic_user_info",
-  AUTH_STATE: "basic_auth_state",
-  REDIRECT_URI: "basic_redirect_uri",
-  SERVER_URL: "basic_server_url",
-  PDS_ENDPOINTS: "basic_pds_endpoints",
-  LAST_CONNECT_REPORT: "basic_last_connect_report",
-  DEBUG: "basic_debug",
-  CODE_VERIFIER: "basic_code_verifier"
-};
-
-// src/utils/normalizeClientId.ts
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function normalizeClientId(projectId, adminHostname = "api.basic.tech") {
-  if (!projectId) return projectId;
-  if (projectId === "self") return projectId;
-  if (projectId.startsWith("did:")) return projectId;
-  if (UUID_RE.test(projectId)) {
-    const hex = projectId.replace(/-/g, "").toLowerCase();
-    return `did:web:${adminHostname}:projects:${hex}`;
-  }
-  return projectId;
-}
-
-// src/utils/resolveDid.ts
-function resolveDidWebUrl(did) {
-  if (!did.startsWith("did:web:")) return null;
-  const rest = did.slice(8);
-  if (!rest) return null;
-  const parts = rest.split(":");
-  const hostname = parts[0].replace(/%3A/gi, ":");
-  if (parts.length === 1) {
-    return `https://${hostname}/.well-known/did.json`;
-  }
-  const pathParts = parts.slice(1).map((p) => decodeURIComponent(p));
-  return `https://${hostname}/${pathParts.join("/")}/did.json`;
-}
-async function resolveFromDocument(did, didDocument) {
-  const services = didDocument.service;
-  const pdsService = services?.find(
-    (s) => s.id === "#basic_pds" || s.id === `${did}#basic_pds`
-  );
-  if (!pdsService) {
-    throw new Error(`DID document has no #basic_pds service entry`);
-  }
-  const pdsUrl = pdsService.serviceEndpoint.replace(/\/+$/, "");
-  const oauthRes = await fetch(`${pdsUrl}/auth/.well-known/openid-configuration`);
-  if (!oauthRes.ok) {
-    throw new Error(`Failed to fetch OpenID configuration from ${pdsUrl}: ${oauthRes.status}`);
-  }
-  const oauth = await oauthRes.json();
-  return {
-    did,
-    didDocument,
-    pdsUrl,
-    authorization_endpoint: oauth.authorization_endpoint,
-    token_endpoint: oauth.token_endpoint,
-    userinfo_endpoint: oauth.userinfo_endpoint
-  };
-}
-async function resolveDid(did) {
-  const url = resolveDidWebUrl(did);
-  if (!url) {
-    throw new Error(`Unsupported DID method: ${did}`);
-  }
-  const didRes = await fetch(url);
-  if (!didRes.ok) {
-    throw new Error(`Failed to fetch DID document at ${url}: ${didRes.status}`);
+  const didRes = await fetch(url);
+  if (!didRes.ok) {
+    throw new Error(`Failed to fetch DID document at ${url}: ${didRes.status}`);
   }
   const didDocument = await didRes.json();
   return resolveFromDocument(did, didDocument);
@@ -1768,11 +1217,15 @@ var AuthManager = class {
     this.requestedScopes = config.scopes;
     this.initCrossTabSync();
   }
+  get instanceKey() {
+    return this.config.instanceKey ?? "";
+  }
   initCrossTabSync() {
     if (typeof BroadcastChannel === "undefined") return;
     try {
       this.channel = new BroadcastChannel("basic-auth");
       this.channel.onmessage = (event) => {
+        if ((event.data?.userKey ?? "") !== this.instanceKey) return;
         if (event.data?.type === "token_refreshed") {
           log("Received token refresh from another tab");
           void this.handleExternalTokenRefresh(event.data);
@@ -1785,9 +1238,6 @@ var AuthManager = class {
           log("Received sign-out from another tab");
           this.resetAuthState("signed_out");
           this.notify();
-          if (typeof window !== "undefined") {
-            window.location.reload();
-          }
         }
         if (event.data?.type === "session_invalidated") {
           log("Received session invalidation from another tab");
@@ -1803,19 +1253,32 @@ var AuthManager = class {
   broadcastTokenRefresh() {
     this.channel?.postMessage({
       type: "token_refreshed",
+      userKey: this.instanceKey,
       accessToken: this.token?.access_token,
       did: this.did,
       tokenScope: this.tokenScope
     });
   }
   broadcastSignIn() {
-    this.channel?.postMessage({ type: "signed_in" });
+    this.channel?.postMessage({ type: "signed_in", userKey: this.instanceKey });
   }
   broadcastSignOut() {
-    this.channel?.postMessage({ type: "signed_out" });
+    this.channel?.postMessage({ type: "signed_out", userKey: this.instanceKey });
   }
   broadcastSessionInvalidated(code) {
-    this.channel?.postMessage({ type: "session_invalidated", code });
+    this.channel?.postMessage({
+      type: "session_invalidated",
+      userKey: this.instanceKey,
+      code
+    });
+  }
+  /** Release resources (cross-tab channel). Used when switching users. */
+  destroy() {
+    try {
+      this.channel?.close();
+    } catch {
+    }
+    this.channel = null;
   }
   // ------------------------------------------------------------------
   // Public API
@@ -2075,11 +1538,13 @@ var AuthManager = class {
     }
   }
   /**
-   * Clear auth state and storage. Does NOT handle sync/DB cleanup —
-   * the UI layer (BasicProvider) wraps this to add sync teardown.
+   * Sign out: revoke the session server-side (`POST /auth/logout`, best
+   * effort), then clear auth state and storage. Does NOT handle sync/DB
+   * cleanup — the client layer wraps this to add sync teardown.
    */
   async signOut() {
     log("signing out!");
+    await this.revokeSessionOnServer();
     this.resetAuthState("signed_out");
     await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
     await this.storage.remove(STORAGE_KEYS.LAST_CONNECT_REPORT);
@@ -2087,6 +1552,30 @@ var AuthManager = class {
     this.broadcastSignOut();
     this.notify();
   }
+  /**
+   * Best-effort server-side revocation of the current device/session and
+   * its refresh chain (Step 2 auth: logout is finally server-side).
+   * Never blocks or fails the local sign-out.
+   */
+  async revokeSessionOnServer() {
+    try {
+      let accessToken = null;
+      try {
+        accessToken = await this.getToken();
+      } catch {
+        accessToken = this.token?.access_token ?? null;
+      }
+      if (!accessToken) return;
+      const endpoints = await this.getActivePdsEndpoints();
+      await fetch(`${endpoints.pds_url}/auth/logout`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${accessToken}` }
+      });
+      log("Server-side logout succeeded");
+    } catch (error) {
+      log("Server-side logout failed (non-blocking):", error);
+    }
+  }
   async reconcileSession(reason = "manual", options) {
     if (this.authStatus === "signed_out" || this.authStatus === "reauth_required") {
       return;
@@ -2410,11 +1899,11 @@ var AuthManager = class {
           ...isRefreshToken ? { refresh_token: "[REDACTED]" } : { code: "[REDACTED]" },
           ...requestBody.code_verifier ? { code_verifier: "[REDACTED]" } : {}
         });
-        const token = await fetch(endpoints.token_endpoint, {
+        const response = await fetch(endpoints.token_endpoint, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify(requestBody)
-        }).then((response) => response.json()).catch((error) => {
+        }).catch((error) => {
           log("Network error fetching token:", error);
           if (!this.isOnline) {
             this.pendingRefresh = true;
@@ -2424,6 +1913,18 @@ var AuthManager = class {
           }
           throw new Error("Network error during token refresh");
         });
+        if (response.status === 429) {
+          log("Token endpoint rate limited (429) - will retry later");
+          this.pendingRefresh = true;
+          throw new Error(
+            "Token endpoint rate limited - refresh will be retried"
+          );
+        }
+        const token = await response.json().catch(() => {
+          throw new Error(
+            `Token endpoint returned invalid JSON (status ${response.status})`
+          );
+        });
         if (token.access_token) {
           try {
             const decoded = (0, import_jwt_decode.jwtDecode)(token.access_token);
@@ -2533,7 +2034,8 @@ var AuthManager = class {
   isNetworkError(error) {
     if (error instanceof TypeError) return true;
     if (error instanceof Error) {
-      return error.message.includes("offline") || error.message.includes("Network");
+      return error.message.includes("offline") || error.message.includes("Network") || // 429 on the token endpoint: transient, keep the session alive
+      error.message.includes("rate limited");
     }
     return false;
   }
@@ -2748,142 +2250,1720 @@ var AuthManager = class {
   }
 };
 
-// src/AuthContext.tsx
-init_config();
-init_package();
-
-// src/updater/versionUpdater.ts
-init_config();
-var VersionUpdater = class {
-  storage;
-  currentVersion;
-  migrations;
-  versionKey = "basic_app_version";
-  constructor(storage, currentVersion, migrations = []) {
-    this.storage = storage;
-    this.currentVersion = currentVersion;
-    this.migrations = migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+// src/core/http/RestClient.ts
+var RestError = class extends Error {
+  status;
+  code;
+  response;
+  constructor(message, status, code, response) {
+    super(message);
+    this.name = "RestError";
+    this.status = status;
+    this.code = code;
+    this.response = response;
+  }
+};
+var NotAuthenticatedError = class extends Error {
+  constructor(message = "Not authenticated") {
+    super(message);
+    this.name = "NotAuthenticatedError";
+  }
+};
+var RestClient = class {
+  opts;
+  constructor(opts) {
+    this.opts = { ...opts, baseUrl: opts.baseUrl.replace(/\/$/, "") };
+  }
+  get projectId() {
+    return this.opts.projectId;
+  }
+  // -------------------------------------------------------------------
+  // Sync surface
+  // -------------------------------------------------------------------
+  /** `GET /account/:project_id/db` — tables, enforced schema version, channel head. */
+  async getDbInfo() {
+    const res = await this.request("GET", `${this.dbPath}`);
+    return res.data;
+  }
+  /** Bootstrap snapshot (SPEC §5). `share` bootstraps a mount; `table` filters. */
+  async getSnapshot(options) {
+    const query = new URLSearchParams();
+    if (options?.share) query.set("share", options.share);
+    if (options?.table) query.set("table", options.table);
+    const qs = query.toString();
+    const res = await this.request(
+      "GET",
+      `${this.dbPath}/snapshot${qs ? `?${qs}` : ""}`
+    );
+    return res.data;
+  }
+  /** Pull ordered ops after a cursor — the non-WebSocket sync path. */
+  async getChanges(options) {
+    const query = new URLSearchParams({ cursor: String(options.cursor) });
+    if (options.limit) query.set("limit", String(options.limit));
+    if (options.share) query.set("share", options.share);
+    if (options.table) query.set("table", options.table);
+    const res = await this.request(
+      "GET",
+      `${this.dbPath}/changes?${query.toString()}`
+    );
+    return res.data;
   }
+  // -------------------------------------------------------------------
+  // Shares (multiplayer v1)
+  // -------------------------------------------------------------------
   /**
-   * Check current stored version and run migrations if needed
-   * Only compares major.minor versions, ignoring beta/prerelease parts
-   * Example: "0.7.0-beta.1" and "0.7.0" are treated as the same version
+   * Shares granted by and received by the caller. App tokens see only
+   * shares involving their own app (the ones they can mount).
    */
-  async checkAndUpdate() {
-    const storedVersion = await this.getStoredVersion();
-    if (!storedVersion) {
-      await this.setStoredVersion(this.currentVersion);
-      return { updated: false, toVersion: this.currentVersion };
-    }
-    if (storedVersion === this.currentVersion) {
-      return { updated: false, toVersion: this.currentVersion };
+  async listShares() {
+    const res = await this.request(
+      "GET",
+      "/account/shares"
+    );
+    return res.data;
+  }
+  // -------------------------------------------------------------------
+  // CRUD on materialized state (REST-mode table API)
+  // -------------------------------------------------------------------
+  async list(table, query) {
+    const qs = query ? `?${new URLSearchParams(query).toString()}` : "";
+    const res = await this.request(
+      "GET",
+      `${this.dbPath}/${encodeURIComponent(table)}${qs}`
+    );
+    return res.data ?? [];
+  }
+  async getRecord(table, id) {
+    try {
+      const res = await this.request(
+        "GET",
+        `${this.dbPath}/${encodeURIComponent(table)}/${encodeURIComponent(id)}`
+      );
+      return res.data ?? null;
+    } catch (err) {
+      if (err instanceof RestError && err.status === 404) return null;
+      throw err;
     }
-    const migrationsToRun = this.getMigrationsToRun(storedVersion, this.currentVersion);
-    if (migrationsToRun.length === 0) {
-      await this.setStoredVersion(this.currentVersion);
-      return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+  }
+  /** `POST` — server mints the record id. */
+  async createRecord(table, value) {
+    const res = await this.request(
+      "POST",
+      `${this.dbPath}/${encodeURIComponent(table)}`,
+      { value }
+    );
+    return res.data;
+  }
+  /** `PUT` — full replace. REST semantics: 404 for missing records. */
+  async putRecord(table, id, value) {
+    try {
+      const res = await this.request(
+        "PUT",
+        `${this.dbPath}/${encodeURIComponent(table)}/${encodeURIComponent(id)}`,
+        { value }
+      );
+      return res.data ?? null;
+    } catch (err) {
+      if (err instanceof RestError && err.status === 404) return null;
+      throw err;
+    }
+  }
+  /** `PATCH` — partial merge. 404 → null. */
+  async patchRecord(table, id, value) {
+    try {
+      const res = await this.request(
+        "PATCH",
+        `${this.dbPath}/${encodeURIComponent(table)}/${encodeURIComponent(id)}`,
+        { value }
+      );
+      return res.data ?? null;
+    } catch (err) {
+      if (err instanceof RestError && err.status === 404) return null;
+      throw err;
+    }
+  }
+  /** `DELETE`. Returns false when the record did not exist. */
+  async deleteRecord(table, id) {
+    try {
+      await this.request(
+        "DELETE",
+        `${this.dbPath}/${encodeURIComponent(table)}/${encodeURIComponent(id)}`
+      );
+      return true;
+    } catch (err) {
+      if (err instanceof RestError && err.status === 404) return false;
+      throw err;
+    }
+  }
+  // -------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------
+  get dbPath() {
+    return `/account/${encodeURIComponent(this.opts.projectId)}/db`;
+  }
+  /** Authenticated request; retries once with a force-refreshed token on 401. */
+  async request(method, path, body, isRetry = false) {
+    let token;
+    try {
+      token = await this.opts.getToken(isRetry ? { forceRefresh: true } : void 0);
+    } catch (err) {
+      throw new NotAuthenticatedError(
+        err instanceof Error ? err.message : "could not get access token"
+      );
+    }
+    const url = `${this.opts.baseUrl}${path}`;
+    this.opts.log?.("[rest]", method, url);
+    const headers = { Authorization: `Bearer ${token}` };
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const response = await fetch(url, {
+      method,
+      headers,
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    const responseData = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      if (response.status === 401 && !isRetry) {
+        this.opts.log?.("[rest] 401 \u2014 refreshing token and retrying once");
+        return this.request(method, path, body, true);
+      }
+      const code = typeof responseData.error === "string" ? responseData.error : void 0;
+      const message = typeof responseData.message === "string" && responseData.message || code || `request failed: ${response.status}`;
+      throw new RestError(message, response.status, code, responseData);
+    }
+    return responseData;
+  }
+};
+
+// src/core/sync/SyncEngine.ts
+var import_schema = require("@basictech/schema");
+
+// src/core/sync/protocol.ts
+var PROTOCOL_VERSION = 1;
+var TERMINAL_OP_ERRORS = /* @__PURE__ */ new Set([
+  "SCHEMA_VALIDATION_FAILED",
+  "UNKNOWN_TABLE",
+  "RECORD_NOT_FOUND",
+  "PERMISSION_DENIED",
+  "PAYLOAD_TOO_LARGE",
+  "CHANNEL_FULL",
+  "BAD_MESSAGE"
+]);
+function isTerminalOpError(code, terminalFlag) {
+  if (terminalFlag !== void 0) return terminalFlag;
+  return code !== void 0 && TERMINAL_OP_ERRORS.has(code);
+}
+function isRebootstrapError(code) {
+  return code === "SNAPSHOT_REQUIRED" || code === "RESET_REQUIRED";
+}
+function isRevocationError(code) {
+  return code === "SHARE_REVOKED" || code === "CONNECTION_REVOKED";
+}
+function isAuthError(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_EXPIRED";
+}
+var DEFAULT_LIMITS = {
+  max_ops_per_push: 500,
+  max_op_bytes: 64 * 1024,
+  replay_limit: 1e3
+};
+function mintOpId() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  return "op-" + Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+function cloneData(value) {
+  return value === void 0 ? value : JSON.parse(JSON.stringify(value));
+}
+function applyOpToData(existing, op) {
+  switch (op.type) {
+    case "put":
+      return cloneData(op.data ?? {});
+    case "patch":
+      if (existing === void 0) return void 0;
+      return { ...existing, ...cloneData(op.data ?? {}) };
+    case "delete":
+      return void 0;
+  }
+}
+
+// src/core/sync/SyncConnection.ts
+var INITIAL_RECONNECT_DELAY_MS = 500;
+var MAX_RECONNECT_DELAY_MS = 3e4;
+var SyncConnection = class {
+  opts;
+  WS;
+  heartbeatMs;
+  ws = null;
+  _status = "idle";
+  stopped = true;
+  reconnectDelay = INITIAL_RECONNECT_DELAY_MS;
+  timers = /* @__PURE__ */ new Set();
+  heartbeatTimer = null;
+  /** One forced-refresh reconnect attempt per auth rejection. */
+  authRetryUsed = false;
+  removeOnlineListener = null;
+  constructor(opts) {
+    this.opts = opts;
+    this.WS = opts.WebSocketImpl ?? globalThis.WebSocket;
+    this.heartbeatMs = opts.heartbeatMs ?? 3e4;
+  }
+  get status() {
+    return this._status;
+  }
+  get isOnline() {
+    return this._status === "online" && this.ws?.readyState === 1;
+  }
+  start() {
+    if (!this.stopped && this.ws) return;
+    this.stopped = false;
+    this.authRetryUsed = false;
+    this.listenForNetwork();
+    this.open();
+  }
+  stop() {
+    this.stopped = true;
+    this.clearTimers();
+    this.removeOnlineListener?.();
+    this.removeOnlineListener = null;
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+    this.setStatus("stopped");
+  }
+  /** Send a message; returns false when the socket is not open. */
+  send(msg) {
+    if (this.ws?.readyState === 1) {
+      this.ws.send(JSON.stringify(msg));
+      return true;
+    }
+    return false;
+  }
+  /** Refresh auth on the live socket (no reconnect). */
+  async sendToken() {
+    if (!this.isOnline) return;
+    try {
+      const token = await this.opts.getToken();
+      this.send({ type: "token", token });
+    } catch {
+    }
+  }
+  /**
+   * The server rejected our token (`UNAUTHORIZED` / `TOKEN_EXPIRED` + close).
+   * Retry once with a force-refreshed token; give up (status `auth_failed`)
+   * when the refresh itself fails or a fresh token is rejected again.
+   */
+  handleAuthRejection() {
+    if (this.stopped) return;
+    if (this.authRetryUsed) {
+      this.log("fresh token rejected \u2014 giving up until reauth");
+      this.stopped = true;
+      this.clearTimers();
+      this.setStatus("auth_failed");
+      return;
+    }
+    this.authRetryUsed = true;
+    this.log("token rejected \u2014 force refreshing and reconnecting");
+    void (async () => {
+      try {
+        await this.opts.getToken({ forceRefresh: true });
+        this.scheduleReconnect(0);
+      } catch (err) {
+        this.log("token refresh failed after auth rejection:", err);
+        this.stopped = true;
+        this.setStatus("auth_failed");
+      }
+    })();
+  }
+  // -------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------
+  open() {
+    if (this.stopped) return;
+    if (this.ws && (this.ws.readyState === 0 || this.ws.readyState === 1)) return;
+    if (!this.WS) {
+      this.log("no WebSocket implementation available");
+      this.setStatus("offline");
+      return;
+    }
+    this.setStatus("connecting");
+    const ws = new this.WS(this.opts.wsUrl);
+    this.ws = ws;
+    ws.onopen = () => {
+      void (async () => {
+        try {
+          const token = await this.opts.getToken();
+          if (this.ws !== ws || ws.readyState !== 1) return;
+          const hello = { type: "hello", version: PROTOCOL_VERSION, token };
+          ws.send(JSON.stringify(hello));
+        } catch (err) {
+          this.log("could not get token for hello:", err);
+          try {
+            ws.close();
+          } catch {
+          }
+        }
+      })();
+    };
+    ws.onmessage = (event) => {
+      let msg;
+      try {
+        const text = typeof event.data === "string" ? event.data : new TextDecoder().decode(event.data);
+        msg = JSON.parse(text);
+      } catch {
+        return;
+      }
+      this.handleMessage(msg);
+    };
+    ws.onclose = () => {
+      if (this.ws !== ws) return;
+      this.ws = null;
+      this.stopHeartbeat();
+      if (this.stopped) return;
+      this.setStatus("offline");
+      this.scheduleReconnect();
+    };
+    ws.onerror = () => {
+    };
+  }
+  handleMessage(msg) {
+    if (msg.type === "welcome") {
+      this.reconnectDelay = INITIAL_RECONNECT_DELAY_MS;
+      this.authRetryUsed = false;
+      this.setStatus("online");
+      this.startHeartbeat();
+      this.opts.onWelcome(msg);
+      return;
+    }
+    if (msg.type === "error" && !("sub" in msg && msg.sub) && isAuthError(msg.code)) {
+      this.handleAuthRejection();
+      this.opts.onMessage(msg);
+      return;
+    }
+    this.opts.onMessage(msg);
+  }
+  startHeartbeat() {
+    this.stopHeartbeat();
+    const tick = () => {
+      if (this.stopped) return;
+      this.send({ type: "ping" });
+      this.heartbeatTimer = setTimeout(tick, this.heartbeatMs);
+      this.timers.add(this.heartbeatTimer);
+    };
+    this.heartbeatTimer = setTimeout(tick, this.heartbeatMs);
+    this.timers.add(this.heartbeatTimer);
+  }
+  stopHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearTimeout(this.heartbeatTimer);
+      this.timers.delete(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+  }
+  scheduleReconnect(delayOverride) {
+    if (this.stopped) return;
+    const delay = delayOverride ?? this.reconnectDelay;
+    this.reconnectDelay = Math.min(this.reconnectDelay * 2, MAX_RECONNECT_DELAY_MS);
+    this.log(`reconnecting in ${delay}ms`);
+    const timer = setTimeout(() => {
+      this.timers.delete(timer);
+      this.open();
+    }, delay);
+    this.timers.add(timer);
+  }
+  listenForNetwork() {
+    if (this.removeOnlineListener || typeof window === "undefined") return;
+    const handleOnline = () => {
+      if (this.stopped) return;
+      this.log("network online \u2014 reconnecting immediately");
+      this.reconnectDelay = INITIAL_RECONNECT_DELAY_MS;
+      this.open();
+    };
+    window.addEventListener("online", handleOnline);
+    this.removeOnlineListener = () => window.removeEventListener("online", handleOnline);
+  }
+  clearTimers() {
+    for (const t of this.timers) clearTimeout(t);
+    this.timers.clear();
+    this.heartbeatTimer = null;
+  }
+  setStatus(status) {
+    if (this._status === status) return;
+    this._status = status;
+    this.opts.onStatus(status);
+  }
+  log(...args) {
+    this.opts.log?.("[sync-connection]", ...args);
+  }
+};
+
+// src/core/sync/SyncStore.ts
+var import_dexie = __toESM(require("dexie"));
+var META_CURSOR = "cursor";
+var META_CHANNEL = "channel";
+var META_OWNER = "owner_did";
+var SyncStore = class {
+  db;
+  name;
+  tableNames;
+  constructor(name, schema) {
+    this.name = name;
+    this.tableNames = Object.keys(schema.tables);
+    this.db = new import_dexie.default(name);
+    const stores = {
+      _server: "[table+record_id], table",
+      _pending: "++idx, op_id",
+      _rejected: "++idx, op_id",
+      _meta: "key"
+    };
+    for (const [tableName, table] of Object.entries(schema.tables)) {
+      const indexed = Object.entries(table.fields).filter(([, f]) => f.indexed).map(([fieldName]) => `,${fieldName}`).join("");
+      stores[tableName] = "id" + indexed;
+    }
+    this.db.version(Math.max(schema.version ?? 1, 1)).stores(stores);
+  }
+  /** The Dexie view table for an app table (what liveQuery reads). */
+  view(table) {
+    return this.db.table(table);
+  }
+  hasTable(table) {
+    return this.tableNames.includes(table);
+  }
+  get tables() {
+    return [...this.tableNames];
+  }
+  get server() {
+    return this.db.table("_server");
+  }
+  get pending() {
+    return this.db.table("_pending");
+  }
+  get rejected() {
+    return this.db.table("_rejected");
+  }
+  get meta() {
+    return this.db.table("_meta");
+  }
+  get allStores() {
+    return ["_server", "_pending", "_rejected", "_meta", ...this.tableNames];
+  }
+  // -------------------------------------------------------------------
+  // Meta
+  // -------------------------------------------------------------------
+  async getCursor() {
+    const row = await this.meta.get(META_CURSOR);
+    return typeof row?.value === "number" ? row.value : null;
+  }
+  async getChannel() {
+    const row = await this.meta.get(META_CHANNEL);
+    return typeof row?.value === "string" ? row.value : null;
+  }
+  /**
+   * The account DID this keyspace's confirmed data belongs to. Absent for
+   * anonymous-era data (which may be merged into whichever account signs in).
+   */
+  async getOwner() {
+    const row = await this.meta.get(META_OWNER);
+    return typeof row?.value === "string" ? row.value : null;
+  }
+  async setOwner(did) {
+    await this.meta.put({ key: META_OWNER, value: did });
+  }
+  /**
+   * Clear everything (views, server state, pending, rejected, meta) without
+   * deleting the database — used when the keyspace changes owners.
+   */
+  async wipeAll() {
+    await this.db.transaction("rw", this.allStores, async () => {
+      await this.server.clear();
+      await this.pending.clear();
+      await this.rejected.clear();
+      await this.meta.clear();
+      for (const tableName of this.tableNames) {
+        await this.view(tableName).clear();
+      }
+    });
+  }
+  // -------------------------------------------------------------------
+  // Pending / rejected
+  // -------------------------------------------------------------------
+  /** All pending ops in creation order (used to warm the in-memory queue). */
+  async loadPending() {
+    return this.pending.orderBy("idx").toArray();
+  }
+  async listRejected() {
+    return this.rejected.orderBy("idx").toArray();
+  }
+  async clearRejected() {
+    await this.rejected.clear();
+  }
+  /** Record a server ack for a pending op (echo not yet seen). */
+  async markAcked(opId, seq) {
+    await this.pending.where("op_id").equals(opId).modify({ acked_seq: seq });
+  }
+  // -------------------------------------------------------------------
+  // Writes
+  // -------------------------------------------------------------------
+  /**
+   * Enqueue a local op and apply it optimistically to the view.
+   * Returns the resulting view record (null when the op deletes it).
+   */
+  async addPending(op) {
+    return this.db.transaction("rw", this.allStores, async () => {
+      await this.pending.add({ op_id: op.op_id, op: cloneData(op) });
+      return this.recomputeViewRecord(op.table, op.record_id);
+    });
+  }
+  /**
+   * Commit a batch of incoming server ops (already filtered/deduped by the
+   * engine): update `_server`, drop confirmed pending ops, advance the
+   * cursor, and rebase every affected view record — in one transaction.
+   */
+  async commitIncoming(params) {
+    const { applyOps, confirmedOpIds, cursor } = params;
+    await this.db.transaction("rw", this.allStores, async () => {
+      const affected = /* @__PURE__ */ new Set();
+      for (const op of applyOps) affected.add(`${op.table}\0${op.record_id}`);
+      for (const op of applyOps) {
+        await this.applyToServer(op);
+      }
+      if (confirmedOpIds.length > 0) {
+        const confirmedRows = await this.pending.where("op_id").anyOf(confirmedOpIds).toArray();
+        for (const row of confirmedRows) affected.add(`${row.op.table}\0${row.op.record_id}`);
+        await this.pending.where("op_id").anyOf(confirmedOpIds).delete();
+      }
+      await this.meta.put({ key: META_CURSOR, value: cursor });
+      for (const key of affected) {
+        const [table, recordId] = key.split("\0");
+        await this.recomputeViewRecord(table, recordId);
+      }
+    });
+  }
+  /** Persist a cursor advance with no ops (empty `ops` message / pushed cursor). */
+  async setCursor(cursor) {
+    await this.meta.put({ key: META_CURSOR, value: cursor });
+  }
+  /**
+   * Terminal rejection: remove from pending, park in the rejected store,
+   * roll the view record back to server state + remaining pending ops.
+   */
+  async rejectPending(opId, error, message) {
+    return this.db.transaction("rw", this.allStores, async () => {
+      const row = await this.pending.where("op_id").equals(opId).first();
+      if (!row) return null;
+      await this.pending.where("op_id").equals(opId).delete();
+      const rejectedRow = {
+        op_id: opId,
+        op: row.op,
+        error,
+        message,
+        rejected_at: Date.now()
+      };
+      await this.rejected.add(rejectedRow);
+      await this.recomputeViewRecord(row.op.table, row.op.record_id);
+      return rejectedRow;
+    });
+  }
+  // -------------------------------------------------------------------
+  // Bootstrap
+  // -------------------------------------------------------------------
+  /**
+   * Replace all server state from a snapshot (cold start or
+   * SNAPSHOT_REQUIRED/RESET_REQUIRED recovery). Pending ops survive and are
+   * re-applied on top of the fresh state.
+   */
+  async replaceFromSnapshot(params) {
+    const { channel, records, cursor } = params;
+    await this.db.transaction("rw", this.allStores, async () => {
+      await this.server.clear();
+      for (const tableName of this.tableNames) {
+        await this.view(tableName).clear();
+      }
+      for (const [tableName, tableRecords] of Object.entries(records)) {
+        if (!this.hasTable(tableName)) continue;
+        const serverRows = [];
+        const viewRows = [];
+        for (const [recordId, data] of Object.entries(tableRecords)) {
+          serverRows.push({ table: tableName, record_id: recordId, data: data ?? {} });
+          viewRows.push({ id: recordId, ...data ?? {} });
+        }
+        await this.server.bulkPut(serverRows);
+        await this.view(tableName).bulkPut(viewRows);
+      }
+      const pendingRows = await this.pending.orderBy("idx").toArray();
+      const affected = /* @__PURE__ */ new Set();
+      for (const row of pendingRows) affected.add(`${row.op.table}\0${row.op.record_id}`);
+      for (const key of affected) {
+        const [table, recordId] = key.split("\0");
+        if (this.hasTable(table)) await this.recomputeViewRecord(table, recordId);
+      }
+      await this.meta.put({ key: META_CURSOR, value: cursor });
+      await this.meta.put({ key: META_CHANNEL, value: channel });
+    });
+  }
+  // -------------------------------------------------------------------
+  // Reads
+  // -------------------------------------------------------------------
+  async getViewRecord(table, id) {
+    const record = await this.view(table).get(id);
+    return record ?? null;
+  }
+  async getViewRecords(table) {
+    return this.view(table).toArray();
+  }
+  // -------------------------------------------------------------------
+  // Lifecycle
+  // -------------------------------------------------------------------
+  close() {
+    this.db.close();
+  }
+  /** Delete the underlying IndexedDB database (sign-out / revoked mount). */
+  async destroy() {
+    this.db.close();
+    await import_dexie.default.delete(this.name);
+  }
+  // -------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------
+  async applyToServer(op) {
+    if (!this.hasTable(op.table)) return;
+    const existing = await this.server.get([op.table, op.record_id]);
+    const next = applyOpToData(existing?.data, op);
+    if (next === void 0) {
+      await this.server.delete([op.table, op.record_id]);
+    } else {
+      await this.server.put({ table: op.table, record_id: op.record_id, data: next });
+    }
+  }
+  /**
+   * Rebase one record: view = server data + pending ops for that record in
+   * creation order. Must run inside a transaction covering all stores.
+   */
+  async recomputeViewRecord(table, recordId) {
+    if (!this.hasTable(table)) return null;
+    const serverRow = await this.server.get([table, recordId]);
+    let data = serverRow ? cloneData(serverRow.data) : void 0;
+    const pendingRows = await this.pending.orderBy("idx").toArray();
+    for (const row of pendingRows) {
+      if (row.op.table === table && row.op.record_id === recordId) {
+        data = applyOpToData(data, row.op);
+      }
+    }
+    if (data === void 0) {
+      await this.view(table).delete(recordId);
+      return null;
+    }
+    const viewRecord = { id: recordId, ...data };
+    await this.view(table).put(viewRecord);
+    return viewRecord;
+  }
+};
+
+// src/core/sync/SyncEngine.ts
+var OWN_SUB = "own";
+function shareSubKey(shareId) {
+  return `share:${shareId}`;
+}
+var BoundedSet = class {
+  constructor(cap = 2048) {
+    this.cap = cap;
+  }
+  set = /* @__PURE__ */ new Set();
+  order = [];
+  has(value) {
+    return this.set.has(value);
+  }
+  add(value) {
+    if (this.set.has(value)) return;
+    this.set.add(value);
+    this.order.push(value);
+    if (this.order.length > this.cap) {
+      const evicted = this.order.shift();
+      if (evicted !== void 0) this.set.delete(evicted);
+    }
+  }
+  clear() {
+    this.set.clear();
+    this.order = [];
+  }
+};
+var RETRY_FLUSH_DELAY_MS = 1200;
+var SyncEngine = class {
+  projectId;
+  schema;
+  opts;
+  connection;
+  subs = /* @__PURE__ */ new Map();
+  limits = { ...DEFAULT_LIMITS };
+  actor = null;
+  /** Own-sub store is open (local reads/writes work). */
+  storesOpen = false;
+  /** A live connection is wanted (vs. local-only / paused). */
+  connectIntended = false;
+  openingLocal = null;
+  revokedInfo = null;
+  connectionStatus = "idle";
+  _status = "idle";
+  listeners = /* @__PURE__ */ new Map();
+  timers = /* @__PURE__ */ new Set();
+  constructor(opts) {
+    this.opts = opts;
+    this.projectId = opts.projectId;
+    this.schema = opts.schema;
+    this.connection = new SyncConnection({
+      wsUrl: opts.wsUrl,
+      getToken: opts.getToken,
+      WebSocketImpl: opts.WebSocketImpl,
+      heartbeatMs: opts.heartbeatMs,
+      onWelcome: (msg) => this.handleWelcome(msg),
+      onMessage: (msg) => this.handleMessage(msg),
+      onStatus: (status) => this.handleConnectionStatus(status),
+      log: opts.log
+    });
+  }
+  // -------------------------------------------------------------------
+  // Events
+  // -------------------------------------------------------------------
+  on(event, fn) {
+    if (!this.listeners.has(event)) this.listeners.set(event, /* @__PURE__ */ new Set());
+    const set = this.listeners.get(event);
+    set.add(fn);
+    return () => set.delete(fn);
+  }
+  emit(event, data) {
+    const set = this.listeners.get(event);
+    if (!set) return;
+    for (const fn of set) {
+      try {
+        fn(data);
+      } catch (err) {
+        this.log("listener error:", err);
+      }
+    }
+  }
+  // -------------------------------------------------------------------
+  // Public state
+  // -------------------------------------------------------------------
+  get status() {
+    return this._status;
+  }
+  get syncLimits() {
+    return { ...this.limits };
+  }
+  get serverActor() {
+    return this.actor;
+  }
+  getSubscription(key) {
+    return this.subs.get(key);
+  }
+  get own() {
+    return this.subs.get(OWN_SUB);
+  }
+  get pendingCount() {
+    let n = 0;
+    for (const sub of this.subs.values()) n += sub.pending.length;
+    return n;
+  }
+  async listRejected(subKey = OWN_SUB) {
+    const sub = this.subs.get(subKey);
+    if (!sub) return [];
+    return sub.store.listRejected();
+  }
+  async clearRejected(subKey = OWN_SUB) {
+    await this.subs.get(subKey)?.store.clearRejected();
+  }
+  // -------------------------------------------------------------------
+  // Lifecycle
+  // -------------------------------------------------------------------
+  /**
+   * Open the own-channel keyspace for local reads/writes — no connection,
+   * no token needed. This is the anonymous / offline-cold-start entry point.
+   * Idempotent.
+   */
+  async openLocal() {
+    if (this.subs.has(OWN_SUB)) {
+      this.storesOpen = true;
+      this.recomputeStatus();
+      return;
+    }
+    if (!this.openingLocal) {
+      this.openingLocal = (async () => {
+        const sub = await this.openSub(OWN_SUB, null);
+        this.subs.set(OWN_SUB, sub);
+        this.storesOpen = true;
+      })().finally(() => {
+        this.openingLocal = null;
+      });
+    }
+    await this.openingLocal;
+    this.recomputeStatus();
+  }
+  /**
+   * Open the keyspace (if needed) and start syncing. Idempotent.
+   * Note: a `CONNECTION_REVOKED` latch is NOT cleared here — reconnecting a
+   * revoked app connection requires a fresh consent flow. Call
+   * {@link clearRevoked} (or rebind the engine) after re-authorization.
+   */
+  async connect() {
+    await this.openLocal();
+    if (this.revokedInfo) {
+      this.log("connect() ignored: app connection is revoked");
+      return;
+    }
+    this.connectIntended = true;
+    this.connection.start();
+    this.recomputeStatus();
+  }
+  /** Clear the revocation latch (after the user re-authorized the app). */
+  clearRevoked() {
+    this.revokedInfo = null;
+    this.recomputeStatus();
+  }
+  /** @deprecated alias of {@link connect} */
+  async start() {
+    return this.connect();
+  }
+  /**
+   * Disconnect but keep stores open: local reads/writes keep working and
+   * ops queue for the next connect. Used on reauth_required.
+   */
+  pause() {
+    this.connectIntended = false;
+    this.connection.stop();
+    for (const t of this.timers) clearTimeout(t);
+    this.timers.clear();
+    for (const sub of this.subs.values()) {
+      sub.active = false;
+      for (const p of sub.pending) {
+        p.sent = false;
+        p.ackedSeq = void 0;
+      }
+    }
+    this.recomputeStatus();
+  }
+  /** Close the socket and stores; local data is kept. */
+  stop() {
+    this.connectIntended = false;
+    this.storesOpen = false;
+    this.connection.stop();
+    for (const t of this.timers) clearTimeout(t);
+    this.timers.clear();
+    for (const sub of this.subs.values()) {
+      sub.active = false;
+      sub.store.close();
+    }
+    this.subs.clear();
+    this.recomputeStatus();
+  }
+  /**
+   * Stop and delete every local database for this project (sign-out).
+   * Best-effort discovery of mount keyspaces from previous sessions.
+   */
+  async destroyLocal() {
+    const open = [...this.subs.values()];
+    this.stop();
+    for (const sub of open) {
+      try {
+        await sub.store.destroy();
+      } catch (err) {
+        this.log("failed deleting local db:", err);
+      }
+    }
+    try {
+      const idb = globalThis.indexedDB;
+      if (idb && typeof idb.databases === "function") {
+        const base = this.baseDbName;
+        const dbs = await idb.databases();
+        for (const info of dbs) {
+          if (info.name && (info.name === base || info.name.startsWith(`${base}:share:`))) {
+            await new Promise((resolve) => {
+              const req = idb.deleteDatabase(info.name);
+              req.onsuccess = req.onerror = req.onblocked = () => resolve();
+            });
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  // -------------------------------------------------------------------
+  // Shares (mounts)
+  // -------------------------------------------------------------------
+  /**
+   * Mount a share: separate keyspace `(project, share)` with its own cursor
+   * and pending queue. Bootstraps + subscribes when the socket is online.
+   */
+  async mountShare(shareId) {
+    const key = shareSubKey(shareId);
+    const existing = this.subs.get(key);
+    if (existing) return existing;
+    const sub = await this.openSub(key, shareId);
+    this.subs.set(key, sub);
+    if (this.connection.isOnline) {
+      this.enqueue(sub, () => this.activateSub(sub));
+    }
+    return sub;
+  }
+  /** Unsubscribe a mount. Local cache is kept unless `purge` is set. */
+  async unmountShare(shareId, options) {
+    const key = shareSubKey(shareId);
+    const sub = this.subs.get(key);
+    if (!sub) return;
+    if (sub.active) {
+      this.connection.send({ type: "unsubscribe", sub: key });
+    }
+    this.subs.delete(key);
+    if (options?.purge) {
+      await sub.store.destroy();
+    } else {
+      sub.store.close();
+    }
+  }
+  // -------------------------------------------------------------------
+  // Writes (responsibility 2 + 6: pending queue + optimistic rebase)
+  // -------------------------------------------------------------------
+  /**
+   * Queue a local op, apply it optimistically, and push when online.
+   * Returns the resulting view record (null when deleted).
+   * Throws on local validation failure (fail fast — the server would
+   * terminally reject it anyway).
+   */
+  async apply(subKey, partial) {
+    const sub = this.subs.get(subKey);
+    if (!sub) throw new Error(`unknown subscription '${subKey}' \u2014 is the engine started?`);
+    if (!sub.store.hasTable(partial.table)) {
+      throw new Error(`table "${partial.table}" not found in schema`);
+    }
+    if (this.opts.validateWrites !== false && partial.type !== "delete") {
+      const result = (0, import_schema.validateData)(
+        this.schema,
+        partial.table,
+        partial.data ?? {},
+        partial.type === "put"
+      );
+      if (!result.valid) {
+        throw new Error(result.message || "data validation failed");
+      }
+    }
+    const op = {
+      op_id: mintOpId(),
+      type: partial.type,
+      table: partial.table,
+      record_id: partial.record_id,
+      ...partial.type !== "delete" ? { data: partial.data ?? {} } : {},
+      base_seq: Math.max(sub.cursor, 0)
+    };
+    const bytes = JSON.stringify(op).length;
+    if (bytes > this.limits.max_op_bytes) {
+      throw new Error(
+        `op exceeds max_op_bytes (${bytes} > ${this.limits.max_op_bytes}) \u2014 PAYLOAD_TOO_LARGE`
+      );
+    }
+    let view = null;
+    await this.enqueue(sub, async () => {
+      view = await sub.store.addPending(op);
+      sub.pending.push({ op, sent: false });
+    });
+    this.emit("change", { sub: sub.key, tables: [op.table] });
+    this.flush(sub);
+    return view;
+  }
+  // -------------------------------------------------------------------
+  // Connection handling
+  // -------------------------------------------------------------------
+  handleConnectionStatus(status) {
+    this.connectionStatus = status;
+    if (status === "offline" || status === "connecting" || status === "auth_failed" || status === "stopped") {
+      for (const sub of this.subs.values()) {
+        sub.active = false;
+        for (const p of sub.pending) {
+          p.sent = false;
+          p.ackedSeq = void 0;
+        }
+      }
+    }
+    this.recomputeStatus();
+  }
+  handleWelcome(msg) {
+    this.actor = msg.actor;
+    if (msg.limits) this.limits = { ...this.limits, ...msg.limits };
+    for (const sub of this.subs.values()) {
+      if (sub.status === "revoked") continue;
+      this.enqueue(sub, () => this.activateSub(sub));
+    }
+  }
+  handleMessage(msg) {
+    switch (msg.type) {
+      case "subscribed":
+        this.handleSubscribed(msg);
+        return;
+      case "ops": {
+        const sub = this.subs.get(msg.sub);
+        if (sub) this.enqueue(sub, () => this.processOps(sub, msg));
+        return;
+      }
+      case "pushed": {
+        const sub = this.subs.get(msg.sub);
+        if (sub) this.enqueue(sub, () => this.processPushed(sub, msg));
+        return;
+      }
+      case "error":
+        this.handleError(msg);
+        return;
+      case "pong":
+      case "token_ok":
+      case "unsubscribed":
+      case "welcome":
+        return;
+      default:
+        return;
+    }
+  }
+  handleSubscribed(msg) {
+    const sub = this.subs.get(msg.sub);
+    if (!sub) return;
+    sub.active = true;
+    sub.status = "live";
+    sub.schemaVersion = msg.schema_version;
+    this.log(`subscribed '${sub.key}' channel=${msg.channel} cursor=${msg.cursor} head=${msg.head}`);
+    this.flush(sub);
+  }
+  handleError(msg) {
+    const subKey = msg.sub;
+    this.log(`server error${subKey ? ` (sub ${subKey})` : ""}: ${msg.code} \u2014 ${msg.message ?? ""}`);
+    if (subKey) {
+      const sub = this.subs.get(subKey);
+      if (!sub) return;
+      this.emit("suberror", { sub: subKey, code: msg.code, message: msg.message });
+      if (isRebootstrapError(msg.code)) {
+        sub.active = false;
+        sub.bootstrapped = false;
+        for (const p of sub.pending) {
+          p.sent = false;
+          p.ackedSeq = void 0;
+        }
+        this.enqueue(sub, async () => {
+          await this.activateSub(sub);
+        });
+        return;
+      }
+      if (msg.code === "SHARE_REVOKED" || msg.code === "CONNECTION_REVOKED") {
+        sub.active = false;
+        sub.status = "revoked";
+        sub.revokedCode = msg.code;
+        this.subs.delete(subKey);
+        void sub.store.destroy().catch(() => {
+        });
+        return;
+      }
+      return;
+    }
+    switch (msg.code) {
+      case "CONNECTION_REVOKED":
+        this.revokedInfo = { code: msg.code, message: msg.message };
+        this.connectIntended = false;
+        this.connection.stop();
+        this.recomputeStatus();
+        this.emit("revoked", { code: msg.code, message: msg.message });
+        return;
+      case "UNSUPPORTED_VERSION":
+        this.connectIntended = false;
+        this.connection.stop();
+        this.recomputeStatus();
+        return;
+      case "TOO_MANY_OPS":
+      case "RATE_LIMITED": {
+        for (const sub of this.subs.values()) {
+          for (const p of sub.pending) {
+            if (p.ackedSeq === void 0) p.sent = false;
+          }
+        }
+        this.timer(() => {
+          for (const sub of this.subs.values()) this.flush(sub);
+        }, RETRY_FLUSH_DELAY_MS);
+        return;
+      }
+      case "UNAUTHORIZED":
+      case "TOKEN_EXPIRED":
+        return;
+      case "SNAPSHOT_REQUIRED":
+      case "RESET_REQUIRED":
+        for (const sub of this.subs.values()) {
+          sub.active = false;
+          sub.bootstrapped = false;
+          this.enqueue(sub, () => this.activateSub(sub));
+        }
+        return;
+      default:
+        return;
+    }
+  }
+  // -------------------------------------------------------------------
+  // Subscription state machine (serialized per sub via `chain`)
+  // -------------------------------------------------------------------
+  async openSub(key, shareId) {
+    const name = shareId ? `${this.baseDbName}:share:${shareId}` : this.baseDbName;
+    const store = new SyncStore(name, this.schema);
+    const [cursor, pendingRows] = await Promise.all([store.getCursor(), store.loadPending()]);
+    return {
+      key,
+      shareId,
+      store,
+      cursor: cursor ?? -1,
+      // -1 = never bootstrapped
+      pending: pendingRows.map((row) => ({ op: row.op, sent: false })),
+      active: false,
+      bootstrapped: cursor !== null,
+      status: "initializing",
+      appliedOpIds: new BoundedSet(),
+      chain: Promise.resolve(),
+      schemaVersion: null
+    };
+  }
+  /** Bootstrap if needed, then bind the stream on the current socket. */
+  async activateSub(sub) {
+    if (!this.connection.isOnline) return;
+    if (sub.bootstrapped && !sub.shareId && this.opts.getOwnerDid) {
+      try {
+        const did = await this.opts.getOwnerDid() ?? null;
+        if (did) {
+          const stamped = await sub.store.getOwner();
+          if (stamped && stamped !== did) sub.bootstrapped = false;
+        }
+      } catch {
+      }
+    }
+    if (!sub.bootstrapped || sub.cursor < 0) {
+      try {
+        await this.bootstrapSub(sub);
+      } catch (err) {
+        this.log(`bootstrap failed for '${sub.key}':`, err);
+        sub.status = "error";
+        return;
+      }
+    }
+    this.connection.send({
+      type: "subscribe",
+      sub: sub.key,
+      cursor: sub.cursor,
+      ...sub.shareId ? { share: sub.shareId } : this.opts.appName ? { app: this.opts.appName } : {}
+    });
+  }
+  /** Cold start = snapshot + tail; never log replay (§5). Pending survives. */
+  async bootstrapSub(sub) {
+    let ownerDid = null;
+    if (!sub.shareId && this.opts.getOwnerDid) {
+      try {
+        ownerDid = await this.opts.getOwnerDid() ?? null;
+      } catch {
+        ownerDid = null;
+      }
+      if (ownerDid) {
+        const stamped = await sub.store.getOwner();
+        if (stamped && stamped !== ownerDid) {
+          this.log(
+            `keyspace owned by ${stamped} but session is ${ownerDid} \u2014 wiping local data before bootstrap`
+          );
+          await sub.store.wipeAll();
+          sub.pending = [];
+          sub.appliedOpIds.clear();
+          sub.cursor = -1;
+        }
+      }
+    }
+    const snapshot = await this.opts.fetchSnapshot(
+      sub.shareId ? { share: sub.shareId } : void 0
+    );
+    await sub.store.replaceFromSnapshot({
+      channel: snapshot.channel,
+      records: snapshot.records ?? {},
+      cursor: snapshot.cursor ?? 0
+    });
+    if (!sub.shareId && ownerDid) {
+      await sub.store.setOwner(ownerDid);
+    }
+    sub.cursor = snapshot.cursor ?? 0;
+    sub.bootstrapped = true;
+    sub.appliedOpIds.clear();
+    this.log(`bootstrapped '${sub.key}' cursor=${sub.cursor}`);
+    this.emit("change", { sub: sub.key, tables: sub.store.tables });
+  }
+  /**
+   * Responsibilities 3+4+5: ordered apply, cursor advance, dedupe/confirm.
+   * Runs inside the sub's serial chain.
+   */
+  async processOps(sub, msg) {
+    const applyOps = [];
+    const confirmedOpIds = [];
+    for (const op of msg.ops) {
+      if (typeof op.seq !== "number" || op.seq <= sub.cursor) continue;
+      sub.cursor = op.seq;
+      if (sub.appliedOpIds.has(op.op_id)) continue;
+      const idx = sub.pending.findIndex((p) => p.op.op_id === op.op_id);
+      if (idx >= 0) {
+        sub.pending.splice(idx, 1);
+        confirmedOpIds.push(op.op_id);
+      }
+      if (!sub.store.hasTable(op.table)) {
+        sub.appliedOpIds.add(op.op_id);
+        continue;
+      }
+      applyOps.push(op);
+      sub.appliedOpIds.add(op.op_id);
+    }
+    if (typeof msg.cursor === "number" && msg.cursor > sub.cursor) {
+      sub.cursor = msg.cursor;
+    }
+    if (applyOps.length > 0 || confirmedOpIds.length > 0) {
+      await sub.store.commitIncoming({ applyOps, confirmedOpIds, cursor: sub.cursor });
+      const tables = [...new Set(applyOps.map((op) => op.table))];
+      this.emit("change", { sub: sub.key, tables });
+    } else {
+      await sub.store.setCursor(sub.cursor);
+    }
+  }
+  /**
+   * Push verdicts (§6.5, §8, §9). Success acks are recorded but the op stays
+   * pending until its echo arrives in seq order — this preserves strict
+   * ordered apply even when `pushed` races ahead of intermediate remote ops.
+   * Terminal errors apply the poison-op rule; retryables back off.
+   */
+  async processPushed(sub, msg) {
+    let needsRetry = false;
+    const changedTables = /* @__PURE__ */ new Set();
+    for (const result of msg.results) {
+      const idx = sub.pending.findIndex((p) => p.op.op_id === result.op_id);
+      if ("seq" in result && typeof result.seq === "number") {
+        if (idx >= 0) {
+          if (result.seq <= sub.cursor) {
+            const [entry] = sub.pending.splice(idx, 1);
+            await sub.store.commitIncoming({
+              applyOps: [],
+              confirmedOpIds: [entry.op.op_id],
+              cursor: sub.cursor
+            });
+            changedTables.add(entry.op.table);
+          } else {
+            sub.pending[idx].ackedSeq = result.seq;
+            await sub.store.markAcked(result.op_id, result.seq);
+          }
+        }
+        continue;
+      }
+      if ("error" in result) {
+        if (isTerminalOpError(result.error, result.terminal)) {
+          if (idx >= 0) sub.pending.splice(idx, 1);
+          const rejection = await sub.store.rejectPending(
+            result.op_id,
+            result.error,
+            result.message
+          );
+          if (rejection) {
+            changedTables.add(rejection.op.table);
+            this.emit("rejected", { sub: sub.key, rejection });
+            this.log(
+              `op rejected (${result.error}): ${rejection.op.type} ${rejection.op.table}/${rejection.op.record_id}`
+            );
+          }
+        } else if (idx >= 0) {
+          sub.pending[idx].sent = false;
+          needsRetry = true;
+        }
+      }
+    }
+    if (changedTables.size > 0) {
+      this.emit("change", { sub: sub.key, tables: [...changedTables] });
+    }
+    if (needsRetry) {
+      this.timer(() => this.flush(sub), RETRY_FLUSH_DELAY_MS);
+    }
+  }
+  /** Push unsent pending ops, chunked to `limits.max_ops_per_push`. */
+  flush(sub) {
+    if (!this.connection.isOnline || !sub.active) return;
+    const unsent = sub.pending.filter((p) => !p.sent && p.ackedSeq === void 0);
+    if (unsent.length === 0) return;
+    const chunkSize = Math.max(1, this.limits.max_ops_per_push);
+    for (let i = 0; i < unsent.length; i += chunkSize) {
+      const chunk = unsent.slice(i, i + chunkSize);
+      for (const p of chunk) p.sent = true;
+      const ok = this.connection.send({
+        type: "push",
+        sub: sub.key,
+        ops: chunk.map((p) => p.op)
+      });
+      if (!ok) {
+        for (const p of chunk) p.sent = false;
+        return;
+      }
+    }
+    this.log(`pushed ${unsent.length} op(s) on '${sub.key}'`);
+  }
+  // -------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------
+  get dbPrefix() {
+    return this.opts.dbNamePrefix ?? "basic-sync";
+  }
+  /** Base database name for this keyspace (multi-user: includes the user id). */
+  get baseDbName() {
+    const base = `${this.dbPrefix}:${this.projectId}`;
+    return this.opts.keyspaceId ? `${base}:${this.opts.keyspaceId}` : base;
+  }
+  enqueue(sub, task) {
+    sub.chain = sub.chain.then(task).catch((err) => {
+      this.log(`task failed on '${sub.key}':`, err);
+    });
+    return sub.chain;
+  }
+  timer(fn, ms) {
+    const t = setTimeout(() => {
+      this.timers.delete(t);
+      fn();
+    }, ms);
+    this.timers.add(t);
+  }
+  recomputeStatus() {
+    let status;
+    if (this.revokedInfo) status = "revoked";
+    else if (this.connectionStatus === "auth_failed") status = "auth_required";
+    else if (!this.storesOpen) status = this.connectionStatus === "stopped" ? "stopped" : "idle";
+    else if (!this.connectIntended) status = "local";
+    else if (this.connectionStatus === "online") status = "online";
+    else if (this.connectionStatus === "connecting") status = "connecting";
+    else if (this.connectionStatus === "idle") status = "connecting";
+    else if (this.connectionStatus === "stopped") status = "local";
+    else status = "offline";
+    if (status !== this._status) {
+      this._status = status;
+      this.emit("status", status);
+    }
+  }
+  log(...args) {
+    this.opts.log?.("[sync-engine]", ...args);
+  }
+};
+
+// src/core/db.ts
+function mintRecordId() {
+  return mintOpId();
+}
+var SyncTable = class {
+  constructor(engine, subKey, name) {
+    this.engine = engine;
+    this.subKey = subKey;
+    this.name = name;
+  }
+  get store() {
+    const sub = this.engine.getSubscription(this.subKey);
+    if (!sub) {
+      throw new Error(
+        `subscription '${this.subKey}' is not open \u2014 wait for the client to be ready (isReady) before using the db`
+      );
+    }
+    return sub.store;
+  }
+  get ref() {
+    return this.store.view(this.name);
+  }
+  async create(data) {
+    const id = mintRecordId();
+    const view = await this.engine.apply(this.subKey, {
+      type: "put",
+      table: this.name,
+      record_id: id,
+      data
+    });
+    return view ?? { id, ...data };
+  }
+  async put(id, data) {
+    if (!id) throw new Error("put() requires an id");
+    const view = await this.engine.apply(this.subKey, {
+      type: "put",
+      table: this.name,
+      record_id: id,
+      data
+    });
+    return view ?? { id, ...data };
+  }
+  async patch(id, data) {
+    if (!id) throw new Error("patch() requires an id");
+    const existing = await this.store.getViewRecord(this.name, id);
+    if (!existing) return null;
+    const view = await this.engine.apply(this.subKey, {
+      type: "patch",
+      table: this.name,
+      record_id: id,
+      data
+    });
+    return view;
+  }
+  async delete(id) {
+    if (!id) throw new Error("delete() requires an id");
+    await this.engine.apply(this.subKey, {
+      type: "delete",
+      table: this.name,
+      record_id: id
+    });
+  }
+  async get(id) {
+    return await this.store.getViewRecord(this.name, id);
+  }
+  async getAll() {
+    return await this.store.getViewRecords(this.name);
+  }
+  async find(predicate) {
+    const all = await this.getAll();
+    return all.filter(predicate);
+  }
+};
+var SyncDb = class {
+  constructor(engine, subKey = OWN_SUB) {
+    this.engine = engine;
+    this.subKey = subKey;
+  }
+  kind = "sync";
+  tables = /* @__PURE__ */ new Map();
+  table(name) {
+    if (!this.engine.schema.tables[name]) {
+      throw new Error(`table "${name}" not found in schema`);
     }
-    for (const migration of migrationsToRun) {
-      try {
-        log(`Running migration from ${migration.fromVersion} to ${migration.toVersion}`);
-        await migration.migrate(this.storage);
-      } catch (error) {
-        console.error(`Migration failed from ${migration.fromVersion} to ${migration.toVersion}:`, error);
-        throw new Error(`Migration failed: ${error}`);
-      }
+    if (!this.tables.has(name)) {
+      this.tables.set(name, new SyncTable(this.engine, this.subKey, name));
     }
-    await this.setStoredVersion(this.currentVersion);
-    return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+    return this.tables.get(name);
   }
-  async getStoredVersion() {
+};
+var RestTable = class {
+  constructor(rest, name) {
+    this.rest = rest;
+    this.name = name;
+  }
+  async create(data) {
+    const record = await this.rest.createRecord(this.name, data);
+    return record;
+  }
+  async put(id, data) {
+    if (!id) throw new Error("put() requires an id");
+    const record = await this.rest.putRecord(this.name, id, data);
+    if (!record) throw new Error(`record ${this.name}/${id} not found (REST put is replace-only)`);
+    return record;
+  }
+  async patch(id, data) {
+    if (!id) throw new Error("patch() requires an id");
+    const record = await this.rest.patchRecord(this.name, id, data);
+    return record;
+  }
+  async delete(id) {
+    if (!id) throw new Error("delete() requires an id");
+    await this.rest.deleteRecord(this.name, id);
+  }
+  async get(id) {
+    const record = await this.rest.getRecord(this.name, id);
+    return record;
+  }
+  async getAll() {
+    return await this.rest.list(this.name);
+  }
+  async find(predicate) {
+    const all = await this.getAll();
+    return all.filter(predicate);
+  }
+};
+var RestDb = class {
+  constructor(rest, schema) {
+    this.rest = rest;
+    this.schema = schema;
+  }
+  kind = "rest";
+  tables = /* @__PURE__ */ new Map();
+  table(name) {
+    if (this.schema?.tables && !this.schema.tables[name]) {
+      throw new Error(`table "${name}" not found in schema`);
+    }
+    if (!this.tables.has(name)) {
+      this.tables.set(name, new RestTable(this.rest, name));
+    }
+    return this.tables.get(name);
+  }
+};
+
+// src/core/users.ts
+init_config();
+var PrefixedStorage = class {
+  constructor(inner, prefix) {
+    this.inner = inner;
+    this.prefix = prefix;
+  }
+  get(key) {
+    return this.inner.get(this.prefix + key);
+  }
+  set(key, value) {
+    return this.inner.set(this.prefix + key, value);
+  }
+  remove(key) {
+    return this.inner.remove(this.prefix + key);
+  }
+};
+function registryKey(projectId) {
+  return `basic_users:${projectId}`;
+}
+function activeUserSessionKey(projectId) {
+  return `basic_active_user:${projectId}`;
+}
+var UserRegistry = class {
+  constructor(storage, projectId) {
+    this.storage = storage;
+    this.projectId = projectId;
+  }
+  // -------------------------------------------------------------------
+  // Registry CRUD
+  // -------------------------------------------------------------------
+  async list() {
+    const raw = await this.storage.get(registryKey(this.projectId));
+    if (!raw) return [];
     try {
-      const versionData = await this.storage.get(this.versionKey);
-      if (!versionData) return null;
-      const versionInfo = JSON.parse(versionData);
-      return versionInfo.version;
-    } catch (error) {
-      console.warn("Failed to get stored version:", error);
-      return null;
+      const parsed = JSON.parse(raw);
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
     }
   }
-  async setStoredVersion(version2) {
-    const versionInfo = {
-      version: version2,
-      lastUpdated: Date.now()
+  async save(users) {
+    await this.storage.set(registryKey(this.projectId), JSON.stringify(users));
+  }
+  async get(id) {
+    const users = await this.list();
+    return users.find((u) => u.id === id) ?? null;
+  }
+  async createAnon() {
+    const id = mintOpId();
+    const now = Date.now();
+    const profile = {
+      id,
+      kind: "anon",
+      keyspace: id,
+      storagePrefix: `u:${id}:`,
+      createdAt: now,
+      lastActiveAt: now
     };
-    await this.storage.set(this.versionKey, JSON.stringify(versionInfo));
+    const users = await this.list();
+    users.push(profile);
+    await this.save(users);
+    log(`created anonymous user ${id}`);
+    return profile;
   }
-  getMigrationsToRun(fromVersion, toVersion) {
-    return this.migrations.filter((migration) => {
-      const storedLessThanMigrationTo = this.compareVersions(fromVersion, migration.toVersion) < 0;
-      const currentGreaterThanOrEqualMigrationTo = this.compareVersions(toVersion, migration.toVersion) >= 0;
-      const shouldRun = storedLessThanMigrationTo && currentGreaterThanOrEqualMigrationTo;
-      log(`Migration ${migration.fromVersion} \u2192 ${migration.toVersion}: shouldRun=${shouldRun}`);
-      return shouldRun;
-    });
+  async update(id, patch) {
+    const users = await this.list();
+    const idx = users.findIndex((u) => u.id === id);
+    if (idx < 0) return null;
+    users[idx] = { ...users[idx], ...patch };
+    await this.save(users);
+    return users[idx];
   }
-  /**
-   * Simple semantic version comparison (major.minor only, ignoring beta/prerelease)
-   * Returns: -1 if a < b, 0 if a === b, 1 if a > b
-   */
-  compareVersions(a, b) {
-    const aMajorMinor = this.extractMajorMinor(a);
-    const bMajorMinor = this.extractMajorMinor(b);
-    if (aMajorMinor.major !== bMajorMinor.major) {
-      return aMajorMinor.major - bMajorMinor.major;
+  async remove(id) {
+    const users = await this.list();
+    await this.save(users.filter((u) => u.id !== id));
+    if (this.getActiveIdRaw() === id) this.clearActiveId();
+  }
+  /** The profile (if any) already bound to an account DID. */
+  async findByDid(did) {
+    const users = await this.list();
+    return users.find((u) => u.did === did) ?? null;
+  }
+  // -------------------------------------------------------------------
+  // Active user (per-tab)
+  // -------------------------------------------------------------------
+  getActiveIdRaw() {
+    try {
+      return sessionStorage.getItem(activeUserSessionKey(this.projectId));
+    } catch {
+      return null;
+    }
+  }
+  setActiveId(id) {
+    try {
+      sessionStorage.setItem(activeUserSessionKey(this.projectId), id);
+    } catch {
+    }
+  }
+  clearActiveId() {
+    try {
+      sessionStorage.removeItem(activeUserSessionKey(this.projectId));
+    } catch {
     }
-    return aMajorMinor.minor - bMajorMinor.minor;
   }
   /**
-   * Extract major.minor from version string, ignoring beta/prerelease
-   * Examples: "0.7.0-beta.1" -> {major: 0, minor: 7}
-   *           "1.2.3" -> {major: 1, minor: 2}
+   * Resolve the active profile for this tab: sessionStorage choice if it
+   * still exists, else the most recently active profile, else null.
    */
-  extractMajorMinor(version2) {
-    const cleanVersion = version2.split("-")[0]?.split("+")[0] || version2;
-    const parts = cleanVersion.split(".").map(Number);
-    return {
-      major: parts[0] || 0,
-      minor: parts[1] || 0
-    };
+  async resolveActive() {
+    const users = await this.list();
+    const activeId = this.getActiveIdRaw();
+    if (activeId) {
+      const match = users.find((u) => u.id === activeId);
+      if (match) return match;
+    }
+    if (users.length === 0) return null;
+    const recent = [...users].sort((a, b) => b.lastActiveAt - a.lastActiveAt)[0];
+    this.setActiveId(recent.id);
+    return recent;
   }
+  async touch(id) {
+    await this.update(id, { lastActiveAt: Date.now() });
+  }
+  // -------------------------------------------------------------------
+  // Legacy adoption
+  // -------------------------------------------------------------------
   /**
-   * Add a migration to the updater
+   * Adopt a pre-multi-user session as the first profile. Idempotent: runs
+   * only when the registry is empty and a bare refresh token exists. The
+   * adopted profile keeps the unprefixed storage keys and the legacy
+   * keyspace name, so nothing needs to move.
    */
-  addMigration(migration) {
-    this.migrations.push(migration);
-    this.migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
-  }
-};
-function createVersionUpdater(storage, currentVersion, migrations = []) {
-  return new VersionUpdater(storage, currentVersion, migrations);
-}
-
-// src/updater/updateMigrations.ts
-init_config();
-var addMigrationTimestamp = {
-  fromVersion: "0.6.0",
-  toVersion: "0.7.0",
-  async migrate(storage) {
-    log("Running migration 0.6.0 \u2192 0.7.0");
-    storage.set("test_migration", "true");
+  async adoptLegacySession() {
+    const users = await this.list();
+    if (users.length > 0) return null;
+    const legacyRefresh = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+    if (!legacyRefresh) return null;
+    let cachedUser = null;
+    try {
+      const raw = await this.storage.get(STORAGE_KEYS.USER_INFO);
+      if (raw) cachedUser = JSON.parse(raw);
+    } catch {
+    }
+    const now = Date.now();
+    const profile = {
+      id: mintOpId(),
+      kind: "account",
+      did: cachedUser?.sub ?? null,
+      email: cachedUser?.email ?? null,
+      name: cachedUser?.name ?? null,
+      picture: cachedUser?.picture ?? null,
+      keyspace: "",
+      // legacy `basic-sync:{projectId}` database
+      storagePrefix: "",
+      // legacy unprefixed auth keys
+      createdAt: now,
+      lastActiveAt: now
+    };
+    await this.save([profile]);
+    log("adopted legacy single-user session as profile", profile.id);
+    return profile;
   }
 };
-function getMigrations() {
-  return [
-    addMigrationTimestamp
-  ];
-}
-
-// src/AuthContext.tsx
-init_network();
 
 // src/utils/schema.ts
-var import_schema3 = require("@basictech/schema");
+var import_schema2 = require("@basictech/schema");
 init_config();
 async function getSchemaStatus(schema) {
   const projectId = schema.project_id;
-  const valid = (0, import_schema3.validateSchema)(schema);
+  const valid = (0, import_schema2.validateSchema)(schema);
   if (!valid.valid) {
     console.warn("BasicDB Error: your local schema is invalid. Please fix errors and try again - sync is disabled");
     return {
@@ -2921,7 +4001,7 @@ async function getSchemaStatus(schema) {
       latest: latestSchema
     };
   } else if (latestSchema.version === schema.version) {
-    const changes = (0, import_schema3.compareSchemas)(schema, latestSchema);
+    const changes = (0, import_schema2.compareSchemas)(schema, latestSchema);
     if (changes.valid) {
       return {
         valid: true,
@@ -2945,7 +4025,7 @@ async function getSchemaStatus(schema) {
   }
 }
 async function validateAndCheckSchema(schema) {
-  const valid = (0, import_schema3.validateSchema)(schema);
+  const valid = (0, import_schema2.validateSchema)(schema);
   if (!valid.valid) {
     log("Basic Schema is invalid!", valid.errors);
     console.group("Schema Errors");
@@ -2962,452 +4042,845 @@ async function validateAndCheckSchema(schema) {
       errors: valid.errors
     };
   }
-  let schemaStatus = { valid: false };
-  if (schema.version !== 0) {
-    schemaStatus = await getSchemaStatus(schema);
-    log("schemaStatus", schemaStatus);
-  } else {
-    schemaStatus = { valid: false, status: "unpublished" };
-    log("schema not published - at version 0");
+  let schemaStatus = { valid: false };
+  if (schema.version !== 0) {
+    schemaStatus = await getSchemaStatus(schema);
+    log("schemaStatus", schemaStatus);
+  } else {
+    schemaStatus = { valid: false, status: "unpublished" };
+    log("schema not published - at version 0");
+  }
+  return {
+    isValid: true,
+    schemaStatus
+  };
+}
+
+// src/updater/versionUpdater.ts
+init_config();
+var VersionUpdater = class {
+  storage;
+  currentVersion;
+  migrations;
+  versionKey = "basic_app_version";
+  constructor(storage, currentVersion, migrations = []) {
+    this.storage = storage;
+    this.currentVersion = currentVersion;
+    this.migrations = migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+  }
+  /**
+   * Check current stored version and run migrations if needed
+   * Only compares major.minor versions, ignoring beta/prerelease parts
+   * Example: "0.7.0-beta.1" and "0.7.0" are treated as the same version
+   */
+  async checkAndUpdate() {
+    const storedVersion = await this.getStoredVersion();
+    if (!storedVersion) {
+      await this.setStoredVersion(this.currentVersion);
+      return { updated: false, toVersion: this.currentVersion };
+    }
+    if (storedVersion === this.currentVersion) {
+      return { updated: false, toVersion: this.currentVersion };
+    }
+    const migrationsToRun = this.getMigrationsToRun(storedVersion, this.currentVersion);
+    if (migrationsToRun.length === 0) {
+      await this.setStoredVersion(this.currentVersion);
+      return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+    }
+    for (const migration of migrationsToRun) {
+      try {
+        log(`Running migration from ${migration.fromVersion} to ${migration.toVersion}`);
+        await migration.migrate(this.storage);
+      } catch (error) {
+        console.error(`Migration failed from ${migration.fromVersion} to ${migration.toVersion}:`, error);
+        throw new Error(`Migration failed: ${error}`);
+      }
+    }
+    await this.setStoredVersion(this.currentVersion);
+    return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+  }
+  async getStoredVersion() {
+    try {
+      const versionData = await this.storage.get(this.versionKey);
+      if (!versionData) return null;
+      const versionInfo = JSON.parse(versionData);
+      return versionInfo.version;
+    } catch (error) {
+      console.warn("Failed to get stored version:", error);
+      return null;
+    }
+  }
+  async setStoredVersion(version2) {
+    const versionInfo = {
+      version: version2,
+      lastUpdated: Date.now()
+    };
+    await this.storage.set(this.versionKey, JSON.stringify(versionInfo));
+  }
+  getMigrationsToRun(fromVersion, toVersion) {
+    return this.migrations.filter((migration) => {
+      const storedLessThanMigrationTo = this.compareVersions(fromVersion, migration.toVersion) < 0;
+      const currentGreaterThanOrEqualMigrationTo = this.compareVersions(toVersion, migration.toVersion) >= 0;
+      const shouldRun = storedLessThanMigrationTo && currentGreaterThanOrEqualMigrationTo;
+      log(`Migration ${migration.fromVersion} \u2192 ${migration.toVersion}: shouldRun=${shouldRun}`);
+      return shouldRun;
+    });
+  }
+  /**
+   * Simple semantic version comparison (major.minor only, ignoring beta/prerelease)
+   * Returns: -1 if a < b, 0 if a === b, 1 if a > b
+   */
+  compareVersions(a, b) {
+    const aMajorMinor = this.extractMajorMinor(a);
+    const bMajorMinor = this.extractMajorMinor(b);
+    if (aMajorMinor.major !== bMajorMinor.major) {
+      return aMajorMinor.major - bMajorMinor.major;
+    }
+    return aMajorMinor.minor - bMajorMinor.minor;
+  }
+  /**
+   * Extract major.minor from version string, ignoring beta/prerelease
+   * Examples: "0.7.0-beta.1" -> {major: 0, minor: 7}
+   *           "1.2.3" -> {major: 1, minor: 2}
+   */
+  extractMajorMinor(version2) {
+    const cleanVersion = version2.split("-")[0]?.split("+")[0] || version2;
+    const parts = cleanVersion.split(".").map(Number);
+    return {
+      major: parts[0] || 0,
+      minor: parts[1] || 0
+    };
+  }
+  /**
+   * Add a migration to the updater
+   */
+  addMigration(migration) {
+    this.migrations.push(migration);
+    this.migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+  }
+};
+function createVersionUpdater(storage, currentVersion, migrations = []) {
+  return new VersionUpdater(storage, currentVersion, migrations);
+}
+
+// src/updater/updateMigrations.ts
+init_config();
+var addMigrationTimestamp = {
+  fromVersion: "0.6.0",
+  toVersion: "0.7.0",
+  async migrate(storage) {
+    log("Running migration 0.6.0 \u2192 0.7.0");
+    storage.set("test_migration", "true");
+  }
+};
+var dropLegacySyncDb = {
+  fromVersion: "0.8.0",
+  toVersion: "0.9.0",
+  async migrate() {
+    log("Running migration 0.8.0 \u2192 0.9.0: deleting legacy basicdb");
+    try {
+      const idb = globalThis.indexedDB;
+      if (!idb) return;
+      await new Promise((resolve) => {
+        const req = idb.deleteDatabase("basicdb");
+        req.onsuccess = req.onerror = req.onblocked = () => resolve();
+      });
+    } catch {
+    }
   }
-  return {
-    isValid: true,
-    schemaStatus
-  };
+};
+function getMigrations() {
+  return [
+    addMigrationTimestamp,
+    dropLegacySyncDb
+  ];
 }
 
-// src/AuthContext.tsx
-init_context();
-init_context();
-var import_jsx_runtime2 = require("react/jsx-runtime");
-var BasicDevToolbar2 = (0, import_react3.lazy)(
-  () => Promise.resolve().then(() => (init_BasicDevToolbar(), BasicDevToolbar_exports)).then((m) => ({ default: m.BasicDevToolbar }))
-);
-var DEFAULT_AUTH_CONFIG = {
+// src/core/BasicClient.ts
+init_config();
+init_package();
+var DEFAULTS = {
   scopes: "profile,email,app:admin",
   pds_url: "https://pds.basic.id",
-  admin_url: "https://api.basic.tech",
-  ws_url: "wss://pds.basic.id/ws"
+  admin_url: "https://api.basic.tech"
 };
-function snapshotAuth(mgr) {
+function deriveSyncUrl(pdsUrl) {
+  return pdsUrl.replace(/^http/, "ws").replace(/\/$/, "") + "/sync/";
+}
+function ephemeralLegacyProfile() {
+  const now = Date.now();
   return {
-    isSignedIn: mgr.isSignedIn,
-    hasToken: !!mgr.token,
-    isAuthReady: mgr.isAuthReady,
-    authStatus: mgr.authStatus,
-    authErrorCode: mgr.authErrorCode,
-    user: mgr.user,
-    did: mgr.did,
-    tokenScope: mgr.tokenScope
+    id: "default",
+    kind: "anon",
+    keyspace: "",
+    storagePrefix: "",
+    createdAt: now,
+    lastActiveAt: now
   };
 }
-function BasicProvider({
-  children,
-  project_id: project_id_prop,
-  schema,
-  debug = false,
-  storage,
-  auth,
-  dbMode = "sync",
-  devToolbar = false
-}) {
-  const project_id = schema?.project_id || project_id_prop;
-  if (auth?.server_url && !auth?.pds_url) {
-    log("Warning: auth.server_url is deprecated, use auth.pds_url instead");
-  }
-  const authConfig = {
-    scopes: auth?.scopes || DEFAULT_AUTH_CONFIG.scopes,
-    pds_url: auth?.pds_url || auth?.server_url || DEFAULT_AUTH_CONFIG.pds_url,
-    admin_url: auth?.admin_url || DEFAULT_AUTH_CONFIG.admin_url,
-    ws_url: auth?.ws_url || DEFAULT_AUTH_CONFIG.ws_url
+var BasicClient = class {
+  rest;
+  mode;
+  config;
+  projectId;
+  users;
+  rawStorage;
+  restDb;
+  debug;
+  anonymousEnabled;
+  authConfig;
+  syncUrl;
+  binding;
+  usersCache = [];
+  devInfo = null;
+  syncEnabled = false;
+  schemaChecked = false;
+  started = false;
+  signOutInProgress = false;
+  /** Serializes profile transitions (switch, dispose, sign-out fallthrough). */
+  profileOps = Promise.resolve();
+  mounts = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  snapshot;
+  constructor(config) {
+    this.config = config;
+    this.debug = config.debug ?? false;
+    this.mode = config.mode ?? "sync";
+    this.projectId = config.schema?.project_id || config.project_id;
+    this.anonymousEnabled = this.mode === "sync" && (config.anonymous ?? true);
+    this.authConfig = {
+      scopes: Array.isArray(config.auth?.scopes) ? config.auth.scopes.join(" ") : config.auth?.scopes || DEFAULTS.scopes,
+      pds_url: config.auth?.pds_url || DEFAULTS.pds_url,
+      admin_url: config.auth?.admin_url || DEFAULTS.admin_url
+    };
+    this.syncUrl = config.auth?.sync_url || deriveSyncUrl(this.authConfig.pds_url);
+    this.rawStorage = config.storage || new LocalStorageAdapter();
+    this.users = this.mode === "sync" && this.projectId ? new UserRegistry(this.rawStorage, this.projectId) : null;
+    this.rest = new RestClient({
+      baseUrl: this.authConfig.pds_url,
+      projectId: this.projectId ?? "",
+      getToken: (opts) => this.auth.getToken(opts),
+      log: this.debug ? log : void 0
+    });
+    this.restDb = new RestDb(this.rest, this.config.schema);
+    this.binding = this.createBinding(ephemeralLegacyProfile());
+    this.snapshot = this.buildSnapshot();
+  }
+  // -------------------------------------------------------------------
+  // Public surface
+  // -------------------------------------------------------------------
+  get auth() {
+    return this.binding.auth;
+  }
+  get engine() {
+    return this.binding.engine;
+  }
+  /** The database handle for the active user. Identity changes on switch. */
+  get db() {
+    if (this.mode === "sync" && this.binding.syncDb) return this.binding.syncDb;
+    return this.restDb;
+  }
+  get activeUser() {
+    return this.users ? this.binding.profile : null;
+  }
+  /** Bootstrap: version migrations, profile resolution, schema check, auth init. */
+  async start() {
+    if (this.started) return;
+    this.started = true;
+    try {
+      const updater = createVersionUpdater(this.rawStorage, version, getMigrations());
+      const result = await updater.checkAndUpdate();
+      if (result.updated) log(`SDK storage migrated ${result.fromVersion} \u2192 ${result.toVersion}`);
+    } catch (err) {
+      log("version updater failed:", err);
+    }
+    void this.checkSchema().then(() => this.syncLifecycle());
+    await this.queueProfileOp(async () => {
+      let profile = null;
+      if (this.users) {
+        await this.users.adoptLegacySession();
+        profile = await this.users.resolveActive();
+        if (!profile && this.anonymousEnabled) {
+          profile = await this.users.createAnon();
+        }
+        if (profile) this.users.setActiveId(profile.id);
+      }
+      await this.activateProfile(profile ?? ephemeralLegacyProfile(), { initial: true });
+      await this.refreshUsers();
+    });
+  }
+  /**
+   * Sign out the active user: server-side revoke, wipe the profile's local
+   * data, drop the profile, and fall through to the next (or a fresh
+   * anonymous) user.
+   */
+  async signOut() {
+    await this.queueProfileOp(async () => {
+      const { profile, auth, engine } = this.binding;
+      this.signOutInProgress = true;
+      try {
+        await auth.signOut();
+      } finally {
+        this.signOutInProgress = false;
+      }
+      this.mounts.clear();
+      try {
+        await engine?.destroyLocal();
+      } catch (err) {
+        log("local data teardown failed:", err);
+      }
+      if (this.users && profile.id !== "default") {
+        await this.users.remove(profile.id);
+      }
+      await this.activateNextProfileLocked();
+      await this.refreshUsers();
+    });
+  }
+  // ---------------- multi-user ----------------
+  /** Switch this tab to another local user. */
+  async switchUser(id) {
+    await this.queueProfileOp(async () => {
+      if (!this.users) throw new Error("multiple users require sync mode with a project id");
+      if (this.binding.profile.id === id) return;
+      const target = await this.users.get(id);
+      if (!target) throw new Error(`unknown user '${id}'`);
+      this.users.setActiveId(id);
+      await this.users.touch(id);
+      await this.activateProfile(target);
+      await this.refreshUsers();
+    });
+  }
+  /** Create a fresh anonymous user and switch to it. */
+  async addUser() {
+    let created = null;
+    await this.queueProfileOp(async () => {
+      if (!this.users) throw new Error("multiple users require sync mode with a project id");
+      created = await this.users.createAnon();
+      this.users.setActiveId(created.id);
+      await this.activateProfile(created);
+      await this.refreshUsers();
+    });
+    return created;
+  }
+  /**
+   * Remove a local user: best-effort server-side revoke, wipe its keyspace
+   * and auth storage, drop the profile. Removing the active user signs out.
+   */
+  async removeUser(id) {
+    if (this.binding.profile.id === id) {
+      return this.signOut();
+    }
+    await this.queueProfileOp(async () => {
+      if (!this.users) return;
+      const profile = await this.users.get(id);
+      if (!profile) return;
+      await this.disposeProfileData(profile);
+      await this.users.remove(id);
+      await this.refreshUsers();
+    });
+  }
+  /** Stop connections and listeners; local data is kept. */
+  stop() {
+    this.started = false;
+    this.binding.engine?.stop();
+    for (const fn of this.binding.sessionCleanup) {
+      try {
+        fn();
+      } catch {
+      }
+    }
+    this.binding.sessionCleanup = [];
+  }
+  /** Re-run the remote schema status check (dev toolbar). */
+  async refreshSchemaStatus() {
+    this.schemaChecked = false;
+    await this.checkSchema();
+    this.syncLifecycle();
+  }
+  async listRejected() {
+    return this.engine?.listRejected() ?? [];
+  }
+  async clearRejected() {
+    await this.engine?.clearRejected();
+    this.publish();
+  }
+  // ---------------- shares ----------------
+  /** Shares granted by / received by this user for this app. */
+  async listShares() {
+    return this.rest.listShares();
+  }
+  /** Mount a share: separate local keyspace + subscription. */
+  async mountShare(shareId) {
+    const engine = this.engine;
+    if (!engine) throw new Error("shares require sync mode");
+    const existing = this.mounts.get(shareId);
+    if (existing) return existing;
+    await engine.mountShare(shareId);
+    const handle = {
+      shareId,
+      db: new SyncDb(engine, shareSubKey(shareId))
+    };
+    this.mounts.set(shareId, handle);
+    this.publish();
+    return handle;
+  }
+  async unmountShare(shareId, options) {
+    if (!this.engine) return;
+    await this.engine.unmountShare(shareId, options);
+    this.mounts.delete(shareId);
+    this.publish();
+  }
+  getMountedShare(shareId) {
+    return this.mounts.get(shareId);
+  }
+  // ---------------- React subscription surface ----------------
+  subscribe = (listener) => {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
   };
-  const scopesString = Array.isArray(authConfig.scopes) ? authConfig.scopes.join(" ") : authConfig.scopes;
-  const storageRef = (0, import_react3.useRef)(storage || new LocalStorageAdapter());
-  const storageAdapter = storageRef.current;
-  const schemaRef = (0, import_react3.useRef)(schema);
-  schemaRef.current = schema;
-  const [authState, setAuthState] = (0, import_react3.useState)({
-    isSignedIn: false,
-    hasToken: false,
-    isAuthReady: false,
-    authStatus: "bootstrapping",
-    authErrorCode: null,
-    user: null,
-    did: null,
-    tokenScope: null
-  });
-  const authRef = (0, import_react3.useRef)(null);
-  if (!authRef.current) {
-    authRef.current = new AuthManager(
+  getSnapshot = () => {
+    return this.snapshot;
+  };
+  // -------------------------------------------------------------------
+  // Profile binding & transitions
+  // -------------------------------------------------------------------
+  createBinding(profile) {
+    const storage = profile.storagePrefix ? new PrefixedStorage(this.rawStorage, profile.storagePrefix) : this.rawStorage;
+    const binding = { profile, cleanup: [], sessionCleanup: [] };
+    const auth = new AuthManager(
       {
-        projectId: project_id,
-        scopes: scopesString,
-        pdsUrl: authConfig.pds_url,
-        adminUrl: authConfig.admin_url,
-        debug
+        projectId: this.projectId,
+        scopes: this.authConfig.scopes,
+        pdsUrl: this.authConfig.pds_url,
+        adminUrl: this.authConfig.admin_url,
+        debug: this.debug,
+        instanceKey: profile.storagePrefix
       },
-      storageAdapter,
-      () => setAuthState(snapshotAuth(authRef.current))
+      storage,
+      () => {
+        if (this.binding === binding) this.handleAuthChange();
+      }
     );
-  }
-  const syncRef = (0, import_react3.useRef)(null);
-  const remoteDbRef = (0, import_react3.useRef)(null);
-  const [shouldConnect, setShouldConnect] = (0, import_react3.useState)(false);
-  const [dbStatus, setDbStatus] = (0, import_react3.useState)("OFFLINE" /* OFFLINE */);
-  const [isDbReady, setIsDbReady] = (0, import_react3.useState)(false);
-  const [error, setError] = (0, import_react3.useState)(null);
-  const [schemaDevInfo, setSchemaDevInfo] = (0, import_react3.useState)(
-    null
-  );
-  const isDevMode = () => isDevelopment(debug);
-  const refreshSchemaStatus = (0, import_react3.useCallback)(async () => {
-    const s = schemaRef.current;
-    if (!s) {
-      setSchemaDevInfo(
-        project_id ? {
-          projectId: project_id,
-          localVersion: void 0,
-          status: "no_schema",
-          valid: false,
-          lastCheckedAt: Date.now()
-        } : null
+    binding.auth = auth;
+    if (this.mode === "sync" && this.projectId && this.config.schema?.tables) {
+      const engine = new SyncEngine({
+        projectId: this.projectId,
+        schema: this.config.schema,
+        wsUrl: this.syncUrl,
+        getToken: (opts) => auth.getToken(opts),
+        fetchSnapshot: (opts) => this.rest.getSnapshot(opts),
+        WebSocketImpl: this.config.WebSocketImpl,
+        keyspaceId: profile.keyspace,
+        getOwnerDid: () => auth.did,
+        log
+      });
+      binding.engine = engine;
+      binding.syncDb = new SyncDb(engine, OWN_SUB);
+      binding.cleanup.push(
+        engine.on("status", () => this.publish()),
+        engine.on("change", () => this.publish()),
+        engine.on("rejected", ({ rejection }) => {
+          log("op rejected:", rejection.error, rejection.op);
+          this.publish();
+        }),
+        engine.on("revoked", ({ code, message }) => {
+          log("connection revoked:", code, message);
+          void auth.reconcileSession("connection revoked", { forceRefresh: true, throttleMs: 0 }).catch(() => {
+          });
+          this.publish();
+        })
       );
-      return;
+    } else {
+      binding.engine = null;
+      binding.syncDb = null;
     }
-    const result = await validateAndCheckSchema(s);
-    if (!result.isValid) {
-      const errText = result.errors?.map((e) => e.message || "").join("; ") || "invalid";
-      setSchemaDevInfo({
-        projectId: s.project_id ?? null,
-        localVersion: s.version,
-        status: "invalid",
-        valid: false,
-        lastCheckedAt: Date.now(),
-        error: errText
-      });
-      return;
+    return binding;
+  }
+  /**
+   * Bind and boot a profile. Publishes the new binding first so React
+   * subscriptions re-attach to the new db, then tears the old binding down
+   * on the next tick (avoids in-flight live queries hitting a closed store).
+   */
+  async activateProfile(profile, options) {
+    let old = null;
+    if (options?.initial && this.bindingMatches(profile)) {
+      this.binding.profile = profile;
+    } else {
+      old = this.binding;
+      this.binding = this.createBinding(profile);
+      if (options?.initial) {
+        for (const fn of [...old.cleanup, ...old.sessionCleanup]) fn();
+        old.engine?.stop();
+        old.auth.destroy();
+        old = null;
+      }
     }
-    setSchemaDevInfo({
-      projectId: s.project_id ?? null,
-      localVersion: s.version,
-      status: result.schemaStatus.status ?? "unknown",
-      valid: result.schemaStatus.valid,
-      lastCheckedAt: Date.now()
-    });
-  }, [project_id]);
-  (0, import_react3.useEffect)(() => {
-    const runVersionUpdater = async () => {
-      try {
-        const versionUpdater = createVersionUpdater(
-          storageAdapter,
-          version,
-          getMigrations()
-        );
-        const updateResult = await versionUpdater.checkAndUpdate();
-        if (updateResult.updated) {
-          log(
-            `App updated from ${updateResult.fromVersion} to ${updateResult.toVersion}`
-          );
-        } else {
-          log(`App version ${updateResult.toVersion} is current`);
+    await this.binding.auth.initialize();
+    this.binding.sessionCleanup.push(this.binding.auth.setupNetworkListeners());
+    this.mounts.clear();
+    this.syncLifecycle();
+    this.publish();
+    if (old) {
+      setTimeout(() => {
+        try {
+          for (const fn of [...old.cleanup, ...old.sessionCleanup]) fn();
+          old.engine?.stop();
+          old.auth.destroy();
+        } catch {
         }
-      } catch (error2) {
-        log("Version update failed:", error2);
+      }, 50);
+    }
+  }
+  bindingMatches(profile) {
+    return this.binding.profile.storagePrefix === profile.storagePrefix && this.binding.profile.keyspace === profile.keyspace;
+  }
+  /** After sign-out/disposal: resume on the next profile or a fresh anon one. */
+  async activateNextProfileLocked() {
+    let next = null;
+    if (this.users) {
+      next = await this.users.resolveActive();
+      if (!next && this.anonymousEnabled) {
+        next = await this.users.createAnon();
       }
-    };
-    runVersionUpdater();
-    authRef.current.initialize();
-    return authRef.current.setupNetworkListeners();
-  }, []);
-  (0, import_react3.useEffect)(() => {
-    async function initSyncDb(options) {
-      if (!syncRef.current) {
-        log("Initializing Basic Sync DB");
-        await initDexieExtensions();
-        syncRef.current = new BasicSync("basicdb", { schema });
-        syncRef.current.syncable.on("statusChanged", (status) => {
-          const newStatus = getSyncStatus(status);
-          setDbStatus(newStatus);
-          if (newStatus === "ERROR_WILL_RETRY" /* ERROR_WILL_RETRY */) {
-            log(
-              "Sync entered ERROR_WILL_RETRY - reconciling auth session before retry"
-            );
-            authRef.current.reconcileSession("sync retry", {
-              forceRefresh: true,
-              throttleMs: 0
-            }).catch(() => {
-            });
-          }
+      if (next) this.users.setActiveId(next.id);
+    }
+    await this.activateProfile(next ?? ephemeralLegacyProfile());
+  }
+  /** Wipe a (non-active) profile's local footprint: keyspace dbs + auth keys. */
+  async disposeProfileData(profile) {
+    const storage = profile.storagePrefix ? new PrefixedStorage(this.rawStorage, profile.storagePrefix) : this.rawStorage;
+    try {
+      const refreshToken = await storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+      if (refreshToken) {
+        await fetch(`${this.authConfig.pds_url}/auth/revoke`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ token: refreshToken, token_type_hint: "refresh_token" })
         });
-        if (options.shouldConnect) {
-          setShouldConnect(true);
-        } else {
-          log("Sync is disabled");
-        }
-        setIsDbReady(true);
       }
+    } catch {
     }
-    function initRemoteDb() {
-      if (!remoteDbRef.current) {
-        if (!project_id) {
-          setError({
-            code: "missing_project_id",
-            title: "Project ID Required",
-            message: "Remote mode requires a project_id. Provide it via schema.project_id or the project_id prop."
-          });
-          setIsDbReady(true);
-          return;
-        }
-        log("Initializing Basic Remote DB");
-        remoteDbRef.current = new RemoteDB({
-          serverUrl: authConfig.pds_url,
-          projectId: project_id,
-          getToken: (opts) => authRef.current.getToken(opts),
-          schema,
-          debug,
-          onAuthError: (error2) => {
-            log("RemoteDB auth error:", error2);
-            if (error2.errorType === "forbidden") {
-              log("403 Forbidden - user lacks required scope, not signing out");
-              return;
-            }
-            authRef.current.reconcileSession(`remote db ${error2.errorType}`, {
-              forceRefresh: error2.errorType !== "network",
-              throttleMs: 0
-            }).catch((reconcileError) => {
-              log("RemoteDB auth recovery failed:", reconcileError);
-            });
-          }
-        });
-        setDbStatus("ONLINE" /* ONLINE */);
-        setIsDbReady(true);
+    for (const key of Object.values(STORAGE_KEYS)) {
+      try {
+        await storage.remove(key);
+      } catch {
       }
     }
-    async function checkSchema() {
-      const result = await validateAndCheckSchema(schema);
-      if (!result.isValid) {
-        let errorMessage = "";
-        if (result.errors) {
-          result.errors.forEach((err, index) => {
-            errorMessage += `${index + 1}: ${err.message} - at ${err.instancePath}
-`;
-          });
+    await this.deleteKeyspaceDatabases(profile.keyspace);
+  }
+  async deleteKeyspaceDatabases(keyspace) {
+    if (!this.projectId) return;
+    const base = keyspace ? `basic-sync:${this.projectId}:${keyspace}` : `basic-sync:${this.projectId}`;
+    try {
+      const idb = globalThis.indexedDB;
+      if (!idb) return;
+      const names = [base];
+      if (typeof idb.databases === "function") {
+        const dbs = await idb.databases();
+        for (const info of dbs) {
+          if (info.name && info.name.startsWith(`${base}:share:`)) names.push(info.name);
         }
-        setSchemaDevInfo({
-          projectId: schema?.project_id ?? null,
-          localVersion: schema?.version,
-          status: "invalid",
-          valid: false,
-          lastCheckedAt: Date.now(),
-          error: errorMessage.trim() || void 0
-        });
-        setError({
-          code: "schema_invalid",
-          title: "Basic Schema is invalid!",
-          message: errorMessage
+      }
+      for (const name of names) {
+        await new Promise((resolve) => {
+          const req = idb.deleteDatabase(name);
+          req.onsuccess = req.onerror = req.onblocked = () => resolve();
         });
-        setIsDbReady(true);
-        return null;
-      }
-      setSchemaDevInfo({
-        projectId: schema?.project_id ?? null,
-        localVersion: schema?.version,
-        status: result.schemaStatus.status ?? "unknown",
-        valid: result.schemaStatus.valid,
-        lastCheckedAt: Date.now()
-      });
-      if (dbMode === "remote") {
-        initRemoteDb();
-      } else {
-        if (result.schemaStatus.valid) {
-          await initSyncDb({ shouldConnect: true });
-        } else {
-          if (result.schemaStatus.status === "unpublished") {
-            log(
-              "Schema not published yet (version 0) - sync is disabled. Publish your schema to enable sync."
-            );
-          } else {
-            log("Schema is invalid!", result.schemaStatus);
-          }
-          await initSyncDb({ shouldConnect: false });
-        }
       }
-      checkForNewVersion();
+    } catch {
     }
-    if (schema) {
-      checkSchema();
-    } else {
-      setSchemaDevInfo(
-        project_id ? {
-          projectId: project_id,
-          localVersion: void 0,
-          status: "no_schema",
-          valid: false,
-          lastCheckedAt: Date.now()
-        } : null
-      );
-      if (dbMode === "remote" && project_id) {
-        initRemoteDb();
-      } else {
-        setIsDbReady(true);
-      }
+  }
+  // -------------------------------------------------------------------
+  // Orchestration
+  // -------------------------------------------------------------------
+  /** Previous auth status, for transition detection (revoked-latch clearing). */
+  lastAuthStatus = null;
+  handleAuthChange() {
+    const status = this.auth.authStatus;
+    if (status === "authenticated" && this.lastAuthStatus !== "authenticated" && this.engine?.status === "revoked") {
+      this.engine.clearRevoked();
     }
-  }, []);
-  (0, import_react3.useEffect)(() => {
-    if (authState.hasToken && syncRef.current && authState.isSignedIn && authState.authStatus !== "reauth_required" && shouldConnect) {
-      log("connecting to db...");
-      syncRef.current?.connect({
-        getToken: (opts) => authRef.current.getToken(opts),
-        ws_url: authConfig.ws_url
-      }).catch((e) => {
-        log("error connecting to db", e);
-      });
+    this.lastAuthStatus = status;
+    if (status === "signed_out" && !this.signOutInProgress && this.started) {
+      const profile = this.binding.profile;
+      if (this.users && profile.kind === "account") {
+        void this.queueProfileOp(async () => {
+          if (this.binding.profile.id !== profile.id) return;
+          if (this.binding.auth.authStatus !== "signed_out") return;
+          this.mounts.clear();
+          try {
+            await this.binding.engine?.destroyLocal();
+          } catch {
+          }
+          await this.users.remove(profile.id);
+          await this.activateNextProfileLocked();
+          await this.refreshUsers();
+        });
+        return;
+      }
     }
-  }, [
-    authState.authStatus,
-    authState.isSignedIn,
-    authState.hasToken,
-    shouldConnect
-  ]);
-  (0, import_react3.useEffect)(() => {
-    if (authState.authStatus !== "reauth_required" || !syncRef.current) {
+    this.syncLifecycle();
+    void this.maybeUpgradeProfile();
+    this.publish();
+  }
+  /**
+   * Drive the engine from auth + schema state:
+   * - local keyspace opens with no token (anonymous mode / offline cold start)
+   * - connect when a session exists (recovering counts — the connection
+   *   retries token acquisition itself)
+   * - reauth_required pauses the connection, keeps local data usable
+   */
+  syncLifecycle() {
+    const { engine, auth, profile } = this.binding;
+    if (!engine || !this.started) return;
+    const status = auth.authStatus;
+    if (status === "reauth_required") {
+      engine.pause();
       return;
     }
-    log("Auth requires reauthentication - disconnecting sync without deleting local DB");
-    setDbStatus("ERROR_TOKEN_EXPIRED" /* ERROR_TOKEN_EXPIRED */);
-    syncRef.current.disconnect({ ws_url: authConfig.ws_url }).catch((disconnectError) => {
-      log("Error disconnecting sync after auth invalidation:", disconnectError);
-    });
-  }, [authConfig.ws_url, authState.authStatus]);
-  const handleSignOut = async () => {
-    await authRef.current.signOut();
-    if (syncRef.current) {
-      try {
-        await syncRef.current.close();
-        await syncRef.current.delete({ disableAutoOpen: false });
-        syncRef.current = null;
-      } catch (error2) {
-        console.error("Error during database cleanup:", error2);
+    const localAllowed = this.anonymousEnabled || auth.isSignedIn || profile.kind === "account";
+    if (!localAllowed) return;
+    const schemaLocallyUsable = this.devInfo === null || this.devInfo.status !== "invalid";
+    if (!schemaLocallyUsable) return;
+    void engine.openLocal().then(() => {
+      if (this.binding.engine !== engine) return;
+      if (this.syncEnabled && auth.isSignedIn && auth.authStatus !== "reauth_required") {
+        return engine.connect();
+      }
+    }).catch((err) => log("sync lifecycle failed:", err));
+  }
+  /**
+   * After sign-in: bind the account identity to the active profile
+   * (anonymous → account upgrade) and dedupe against an existing profile
+   * for the same DID.
+   */
+  async maybeUpgradeProfile() {
+    const { profile, auth } = this.binding;
+    if (!this.users || auth.authStatus !== "authenticated" || !auth.did) return;
+    if (profile.id === "default") return;
+    const did = auth.did;
+    const user = auth.user;
+    const needsUpdate = profile.did !== did || profile.kind !== "account" || profile.email !== (user?.email ?? profile.email) || profile.name !== (user?.name ?? profile.name);
+    if (!needsUpdate) return;
+    await this.queueProfileOp(async () => {
+      if (this.binding.profile.id !== profile.id) return;
+      if (!this.users) return;
+      const existing = await this.users.findByDid(did);
+      if (existing && existing.id !== profile.id) {
+        log(`deduping user profiles for ${did}: dropping ${existing.id}`);
+        await this.disposeProfileData(existing);
+        await this.users.remove(existing.id);
+      }
+      const updated = await this.users.update(profile.id, {
+        kind: "account",
+        did,
+        email: user?.email ?? profile.email ?? null,
+        name: user?.name ?? profile.name ?? null,
+        picture: user?.picture ?? profile.picture ?? null,
+        lastActiveAt: Date.now()
+      });
+      if (updated) {
+        this.binding.profile = updated;
       }
+      await this.refreshUsers();
+    });
+  }
+  async refreshUsers() {
+    if (this.users) {
+      this.usersCache = await this.users.list();
     }
-    if (typeof window !== "undefined") {
-      window.location.reload();
+    this.publish();
+  }
+  queueProfileOp(task) {
+    this.profileOps = this.profileOps.then(task).catch((err) => {
+      log("profile operation failed:", err);
+    });
+    return this.profileOps;
+  }
+  async checkSchema() {
+    if (this.schemaChecked) return;
+    const schema = this.config.schema;
+    if (!schema) {
+      this.devInfo = this.projectId ? {
+        projectId: this.projectId,
+        localVersion: void 0,
+        status: "no_schema",
+        valid: false,
+        lastCheckedAt: Date.now()
+      } : null;
+      this.syncEnabled = false;
+      this.publish();
+      return;
     }
-  };
-  const handleSignIn = async () => {
     try {
-      await authRef.current.signIn();
-    } catch (error2) {
-      if (isDevMode()) {
-        setError({
-          code: "signin_error",
-          title: "Sign-in Failed",
-          message: error2.message || "An error occurred during sign-in. Please try again."
-        });
+      const result = await validateAndCheckSchema(schema);
+      if (!result.isValid) {
+        const errText = result.errors?.map((e) => e.message || "").join("; ") || "invalid";
+        this.devInfo = {
+          projectId: schema.project_id ?? null,
+          localVersion: schema.version,
+          status: "invalid",
+          valid: false,
+          lastCheckedAt: Date.now(),
+          error: errText
+        };
+        this.syncEnabled = false;
+      } else {
+        const status = result.schemaStatus.status ?? "unknown";
+        this.devInfo = {
+          projectId: schema.project_id ?? null,
+          localVersion: schema.version,
+          status,
+          valid: result.schemaStatus.valid,
+          lastCheckedAt: Date.now()
+        };
+        const locallyPublishable = typeof schema.version === "number" && schema.version > 0;
+        const remoteCheckInconclusive = status === "error" || status === "unknown";
+        this.syncEnabled = result.schemaStatus.valid || remoteCheckInconclusive && locallyPublishable;
+        if (!result.schemaStatus.valid) {
+          if (status === "unpublished") {
+            log("Schema not published (version 0) \u2014 sync is disabled, local-only mode.");
+          } else if (remoteCheckInconclusive && locallyPublishable) {
+            log("Schema registry check failed \u2014 proceeding with the local schema (offline-first).");
+          }
+        }
       }
-      throw error2;
+    } catch (err) {
+      log("schema check failed:", err);
+      this.syncEnabled = !!schema.version && schema.version > 0;
+      this.devInfo = {
+        projectId: schema.project_id ?? null,
+        localVersion: schema.version,
+        status: "unknown",
+        valid: this.syncEnabled,
+        lastCheckedAt: Date.now()
+      };
     }
-  };
-  const handleSignInWithHandle = async (handle) => {
-    try {
-      await authRef.current.signInWithHandle(handle);
-    } catch (error2) {
-      if (isDevMode()) {
-        setError({
-          code: "signin_error",
-          title: "Sign-in Failed",
-          message: error2.message || "An error occurred during sign-in. Please try again."
-        });
+    this.schemaChecked = true;
+    this.publish();
+  }
+  buildSnapshot() {
+    const { auth, engine, profile } = this.binding;
+    return {
+      isReady: auth.isAuthReady,
+      isSignedIn: auth.isSignedIn,
+      authStatus: auth.authStatus,
+      authErrorCode: auth.authErrorCode,
+      user: auth.user,
+      did: auth.did,
+      scope: auth.tokenScope,
+      syncStatus: engine?.status ?? "idle",
+      pendingCount: engine?.pendingCount ?? 0,
+      syncEnabled: this.syncEnabled,
+      devInfo: this.devInfo,
+      mode: this.mode,
+      users: this.usersCache,
+      activeUser: this.users ? profile : null,
+      isAnonymous: this.users ? profile.kind === "anon" && !auth.isSignedIn : false
+    };
+  }
+  publish() {
+    this.snapshot = this.buildSnapshot();
+    for (const listener of this.listeners) {
+      try {
+        listener();
+      } catch {
       }
-      throw error2;
     }
-  };
-  const getCurrentDb = () => {
-    if (dbMode === "remote") {
-      return remoteDbRef.current || noDb;
-    }
-    return syncRef.current || noDb;
-  };
-  const contextValue = {
-    isReady: authState.isAuthReady,
-    isSignedIn: authState.isSignedIn,
-    authStatus: authState.authStatus,
-    authErrorCode: authState.authErrorCode,
-    user: authState.user,
-    did: authState.did,
-    scope: authState.tokenScope,
-    hasScope: (s) => authRef.current.hasScope(s),
-    missingScopes: () => authRef.current.missingScopes(),
-    signIn: handleSignIn,
-    signInWithHandle: handleSignInWithHandle,
-    signOut: handleSignOut,
-    signInWithCode: (code, state) => authRef.current.signInWithCode(code, state),
-    getToken: (opts) => authRef.current.getToken(opts),
-    getSignInUrl: (redirectUri) => authRef.current.getSignInUrl(redirectUri),
-    db: getCurrentDb(),
-    dbStatus,
-    dbMode,
-    devInfo: schemaDevInfo,
-    refreshSchemaStatus,
-    isAuthReady: authState.isAuthReady,
-    signin: handleSignIn,
-    signout: handleSignOut,
-    signinWithCode: (code, state) => authRef.current.signInWithCode(code, state),
-    getSignInLink: (redirectUri) => authRef.current.getSignInUrl(redirectUri)
-  };
-  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(BasicContext.Provider, { value: contextValue, children: [
-    error && isDevMode() && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(ErrorDisplay, { error }),
-    devToolbar && isDevMode() && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_react3.Suspense, { fallback: null, children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(BasicDevToolbar2, { debug }) }),
-    isDbReady && authState.isAuthReady && children
-  ] });
+  }
+};
+function createBasicClient(config) {
+  return new BasicClient(config);
 }
-function ErrorDisplay({ error }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(
-    "div",
-    {
-      style: {
-        position: "absolute",
-        top: 20,
-        left: 20,
-        color: "black",
-        backgroundColor: "#f8d7da",
-        border: "1px solid #f5c6cb",
-        borderRadius: "4px",
-        padding: "20px",
-        maxWidth: "400px",
-        margin: "20px auto",
-        boxShadow: "0 2px 4px rgba(0, 0, 0, 0.1)",
-        fontFamily: "monospace"
-      },
-      children: [
-        /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("h3", { style: { fontSize: "0.8rem", opacity: 0.8 }, children: [
-          "code: ",
-          error.code
-        ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h1", { style: { fontSize: "1.2rem", lineHeight: 1.5 }, children: error.title }),
-        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { children: error.message })
-      ]
-    }
-  );
+
+// src/react/BasicProvider.tsx
+init_network();
+var import_jsx_runtime2 = require("react/jsx-runtime");
+var BasicDevToolbar2 = (0, import_react4.lazy)(
+  () => Promise.resolve().then(() => (init_BasicDevToolbar(), BasicDevToolbar_exports)).then((m) => ({ default: m.BasicDevToolbar }))
+);
+function BasicProvider({
+  children,
+  schema,
+  project_id,
+  auth,
+  storage,
+  debug = false,
+  mode = "sync",
+  anonymous = true,
+  devToolbar = false,
+  renderWhileLoading = false
+}) {
+  const clientRef = (0, import_react4.useRef)(null);
+  if (!clientRef.current) {
+    clientRef.current = new BasicClient({
+      schema,
+      project_id,
+      auth,
+      storage,
+      debug,
+      mode,
+      anonymous
+    });
+  }
+  const client = clientRef.current;
+  (0, import_react4.useEffect)(() => {
+    void client.start();
+    void checkForNewVersion();
+    return () => client.stop();
+  }, []);
+  const snapshot = (0, import_react4.useSyncExternalStore)(client.subscribe, client.getSnapshot, client.getSnapshot);
+  const showDevTools = devToolbar && isDevelopment(debug);
+  const ready = snapshot.isReady;
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(BasicClientContext.Provider, { value: client, children: [
+    showDevTools && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_react4.Suspense, { fallback: null, children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(BasicDevToolbar2, { debug }) }),
+    (ready || renderWhileLoading) && children
+  ] });
 }
 
 // src/index.ts
-var import_dexie_react_hooks = require("dexie-react-hooks");
+init_hooks();
 init_BasicDevToolbar();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AuthManager,
+  BasicClient,
   BasicDevToolbar,
   BasicProvider,
-  DBStatus,
+  DEFAULT_LIMITS,
+  LocalStorageAdapter,
   NotAuthenticatedError,
-  RemoteCollection,
-  RemoteDB,
-  RemoteDBError,
+  OWN_SUB,
+  PROTOCOL_VERSION,
+  PrefixedStorage,
+  RestClient,
+  RestDb,
+  RestError,
   STORAGE_KEYS,
+  SyncConnection,
+  SyncDb,
+  SyncEngine,
+  SyncStore,
+  UserRegistry,
+  applyOpToData,
+  createBasicClient,
+  isAuthError,
+  isRebootstrapError,
+  isRevocationError,
+  isTerminalOpError,
+  mintOpId,
   resolveDid,
   resolveDidWebUrl,
   resolveHandle,
+  shareSubKey,
+  useAuth,
   useBasic,
-  useQuery
+  useBasicClient,
+  useDb,
+  useQuery,
+  useShare,
+  useShares,
+  useSyncStatus,
+  useUsers
 });
 //# sourceMappingURL=index.js.map