@dittolive/ditto 4.0.3-alpha.linux-ble-fixes-2 → 4.1.0

package/node/ditto.cjs.js

@@ -84,7 +84,7 @@ class Observer {
      * method. Otherwise returns `false`.
      */
     get isStopped() {
-        return typeof this.token === 'undefined';
+        return this.observerManager.hasObserver(this.token);
     }
     /**
      * Stops the observation. Calling this method multiple times has no effect.
@@ -292,21 +292,16 @@ function ditto_add_multicast_transport(...args) { return ditto.ditto_add_multica
 function ditto_add_static_tcp_client(...args) { return ditto.ditto_add_static_tcp_client(...args) }
 function ditto_add_subscription(...args) { return ditto.ditto_add_subscription(...args) }
 function ditto_add_websocket_client(...args) { return ditto.ditto_add_websocket_client(...args) }
-function ditto_auth_client_free(...args) { return ditto.ditto_auth_client_free(...args) }
 function ditto_auth_client_get_site_id(...args) { return ditto.ditto_auth_client_get_site_id(...args) }
 function ditto_auth_client_is_web_valid(...args) { return ditto.ditto_auth_client_is_web_valid(...args) }
 function ditto_auth_client_is_x509_valid(...args) { return ditto.ditto_auth_client_is_x509_valid(...args) }
 function ditto_auth_client_login_with_credentials(...args) { return ditto.ditto_auth_client_login_with_credentials(...args) }
 function ditto_auth_client_login_with_token(...args) { return ditto.ditto_auth_client_login_with_token(...args) }
 function ditto_auth_client_logout(...args) { return ditto.ditto_auth_client_logout(...args) }
-function ditto_auth_client_make_anonymous_client(...args) { return ditto.ditto_auth_client_make_anonymous_client(...args) }
-function ditto_auth_client_make_for_development(...args) { return ditto.ditto_auth_client_make_for_development(...args) }
 function ditto_auth_client_make_login_provider(...args) { return ditto.ditto_auth_client_make_login_provider(...args) }
-function ditto_auth_client_make_with_shared_key(...args) { return ditto.ditto_auth_client_make_with_shared_key(...args) }
-function ditto_auth_client_make_with_static_x509(...args) { return ditto.ditto_auth_client_make_with_static_x509(...args) }
-function ditto_auth_client_make_with_web(...args) { return ditto.ditto_auth_client_make_with_web(...args) }
 function ditto_auth_client_set_validity_listener(...args) { return ditto.ditto_auth_client_set_validity_listener(...args) }
 function ditto_auth_client_user_id(...args) { return ditto.ditto_auth_client_user_id(...args) }
+function ditto_auth_set_login_provider(...args) { return ditto.ditto_auth_set_login_provider(...args) }
 function ditto_cancel_resolve_attachment(...args) { return ditto.ditto_cancel_resolve_attachment(...args) }
 function ditto_clear_presence_callback(...args) { return ditto.ditto_clear_presence_callback(...args) }
 function ditto_clear_presence_v3_callback(...args) { return ditto.ditto_clear_presence_v3_callback(...args) }
@@ -337,6 +332,11 @@ function ditto_free_attachment_handle(...args) { return ditto.ditto_free_attachm
 function ditto_get_collection_names(...args) { return ditto.ditto_get_collection_names(...args) }
 function ditto_get_complete_attachment_path(...args) { return ditto.ditto_get_complete_attachment_path(...args) }
 function ditto_get_sdk_version(...args) { return ditto.ditto_get_sdk_version(...args) }
+function ditto_identity_config_make_manual_v0(...args) { return ditto.ditto_identity_config_make_manual_v0(...args) }
+function ditto_identity_config_make_offline_playground(...args) { return ditto.ditto_identity_config_make_offline_playground(...args) }
+function ditto_identity_config_make_online_playground(...args) { return ditto.ditto_identity_config_make_online_playground(...args) }
+function ditto_identity_config_make_online_with_authentication(...args) { return ditto.ditto_identity_config_make_online_with_authentication(...args) }
+function ditto_identity_config_make_shared_key(...args) { return ditto.ditto_identity_config_make_shared_key(...args) }
 function ditto_init_sdk_version(...args) { return ditto.ditto_init_sdk_version(...args) }
 function ditto_live_query_register_str_detached(...args) { return ditto.ditto_live_query_register_str_detached(...args) }
 function ditto_live_query_signal_available_next(...args) { return ditto.ditto_live_query_signal_available_next(...args) }
@@ -370,6 +370,7 @@ function ditto_run_garbage_collection(...args) { return ditto.ditto_run_garbage_
 function ditto_set_connect_retry_interval(...args) { return ditto.ditto_set_connect_retry_interval(...args) }
 function ditto_set_device_name(...args) { return ditto.ditto_set_device_name(...args) }
 function ditto_set_sync_group(...args) { return ditto.ditto_set_sync_group(...args) }
+function ditto_shutdown(...args) { return ditto.ditto_shutdown(...args) }
 function ditto_start_http_server(...args) { return ditto.ditto_start_http_server(...args) }
 function ditto_start_tcp_server(...args) { return ditto.ditto_start_tcp_server(...args) }
 function ditto_stop_http_server(...args) { return ditto.ditto_stop_http_server(...args) }
@@ -537,7 +538,7 @@ async function collectionGet(ditto, collectionName, documentID, readTransaction)
     return document;
 }
 /** @internal */
-async function collectionInsertValue(ditto, collectionName, doc_cbor, doc_id, writeStrategy, writeTransaction) {
+async function collectionInsertValue(ditto, collectionName, doc_cbor, writeStrategy, writeTransaction) {
     ensureInitialized();
     // REFACTOR: add proper error handling.
     const collectionNameX = bytesFromString(collectionName);
@@ -555,7 +556,7 @@ async function collectionInsertValue(ditto, collectionName, doc_cbor, doc_id, wr
         default:
             throw new Error('Invalid write strategy provided');
     }
-    const { status_code: errorCode, id } = await ditto_collection_insert_value(ditto, collectionNameX, doc_cbor, doc_id, strategy, null, writeTransaction !== null && writeTransaction !== void 0 ? writeTransaction : null);
+    const { status_code: errorCode, id } = await ditto_collection_insert_value(ditto, collectionNameX, doc_cbor, strategy, null, writeTransaction !== null && writeTransaction !== void 0 ? writeTransaction : null);
     if (errorCode !== 0)
         throw new Error(errorMessage() || `ditto_collection_insert_value() failed with error code: ${errorCode}`);
     return boxCBytesIntoBuffer(id);
@@ -823,103 +824,94 @@ function log(level, message) {
 }
 // ----------------------------------------------------------- AuthClient ------
 /** @internal */
-function dittoAuthClientMakeAnonymousClient(path, appID, sharedToken, baseURL) {
+function dittoIdentityConfigMakeOnlinePlayground(appID, sharedToken, baseURL) {
     ensureInitialized();
-    const pathX = bytesFromString(path);
     const appIDX = bytesFromString(appID);
     const sharedTokenX = bytesFromString(sharedToken);
     const baseURLX = bytesFromString(baseURL);
-    const { status_code: errorCode, auth_client: authClient } = ditto_auth_client_make_anonymous_client(pathX, appIDX, sharedTokenX, baseURLX);
+    const { status_code: errorCode, identity_config: identityConfig } = ditto_identity_config_make_online_playground(appIDX, sharedTokenX, baseURLX);
     if (errorCode !== 0)
-        throw new Error(errorMessage() || `ditto_auth_client_make_anonymous_client() failed with error code: ${errorCode}`);
-    return authClient;
+        throw new Error(errorMessage() || `ditto_identity_config_make_online_playground() failed with error code: ${errorCode}`);
+    return identityConfig;
 }
 /** @internal */
-function dittoAuthClientMakeWithWeb(path, appID, baseURL, loginProvider) {
+function dittoIdentityConfigMakeOnlineWithAuthentication(appID, baseURL) {
     ensureInitialized();
-    const pathX = bytesFromString(path);
     const appIDX = bytesFromString(appID);
     const baseURLX = bytesFromString(baseURL);
-    const { status_code: errorCode, auth_client: authClient } = ditto_auth_client_make_with_web(pathX, appIDX, baseURLX, loginProvider);
+    const { status_code: errorCode, identity_config: identityConfig } = ditto_identity_config_make_online_with_authentication(appIDX, baseURLX);
     if (errorCode !== 0)
-        throw new Error(errorMessage() || `ditto_auth_client_make_with_web() failed with error code: ${errorCode}`);
-    return authClient;
+        throw new Error(errorMessage() || `ditto_identity_config_make_online_with_authentication() failed with error code: ${errorCode}`);
+    return identityConfig;
 }
 /** @internal */
-function dittoAuthClientMakeForDevelopment(path, appId, siteID) {
+function dittoIdentityConfigMakeOfflinePlayground(appId, siteID) {
     ensureInitialized();
-    const pathX = bytesFromString(path);
     const appIdX = bytesFromString(appId);
     const siteIDX = Number(siteID);
-    const { status_code: errorCode, auth_client: authClient } = ditto_auth_client_make_for_development(pathX, appIdX, siteIDX);
+    const { status_code: errorCode, identity_config: identityConfig } = ditto_identity_config_make_offline_playground(appIdX, siteIDX);
     if (errorCode !== 0)
-        throw new Error(errorMessage() || `ditto_auth_client_make_for_development() failed with error code: ${errorCode}`);
-    return authClient;
+        throw new Error(errorMessage() || `ditto_identity_config_make_offline_playground() failed with error code: ${errorCode}`);
+    return identityConfig;
 }
 /** @internal */
-function dittoAuthClientMakeWithSharedKey(path, appId, sharedKey, siteID) {
+function dittoIdentityConfigMakeSharedKey(appId, sharedKey, siteID) {
     ensureInitialized();
-    const pathX = bytesFromString(path);
     const appIdX = bytesFromString(appId);
     const sharedKeyX = bytesFromString(sharedKey);
     const siteIDX = Number(siteID);
-    const { status_code: errorCode, auth_client: authClient } = ditto_auth_client_make_with_shared_key(pathX, appIdX, sharedKeyX, siteIDX);
+    const { status_code: errorCode, identity_config: identityConfig } = ditto_identity_config_make_shared_key(appIdX, sharedKeyX, siteIDX);
     if (errorCode !== 0)
-        throw new Error(errorMessage() || `ditto_auth_client_make_with_shared_key() failed with error code: ${errorCode}`);
-    return authClient;
+        throw new Error(errorMessage() || `ditto_identity_config_make_shared_key() failed with error code: ${errorCode}`);
+    return identityConfig;
 }
 /** @internal */
-function dittoAuthClientMakeWithStaticX509(configCBORBase64) {
+function dittoIdentityConfigMakeManual(configCBORBase64) {
     ensureInitialized();
     const configCBORBase64X = bytesFromString(configCBORBase64);
-    const { status_code: errorCode, auth_client: authClient } = ditto_auth_client_make_with_static_x509(configCBORBase64X);
+    const { status_code: errorCode, identity_config: identityConfig } = ditto_identity_config_make_manual_v0(configCBORBase64X);
     if (errorCode !== 0)
-        throw new Error(errorMessage() || `ditto_auth_client_make_with_static_x509() failed with error code: ${errorCode}`);
-    return authClient;
+        throw new Error(errorMessage() || `ditto_identity_config_make_manual_v0() failed with error code: ${errorCode}`);
+    return identityConfig;
 }
 /** @internal */
-function dittoAuthClientGetSiteID(authClient) {
+function dittoAuthClientGetSiteID(ditto) {
     ensureInitialized();
-    return ditto_auth_client_get_site_id(authClient);
+    return ditto_auth_client_get_site_id(ditto);
 }
-/** @internal */
-function dittoAuthClientFree(authClient) {
-    ensureInitialized();
-    return ditto_auth_client_free(authClient);
-}
-function dittoAuthClientIsWebValid(authClient) {
+function dittoAuthClientIsWebValid(ditto) {
     ensureInitialized();
-    return ditto_auth_client_is_web_valid(authClient) !== 0;
+    return ditto_auth_client_is_web_valid(ditto) !== 0;
 }
-function dittoAuthClientUserID(authClient) {
+function dittoAuthClientUserID(ditto) {
     ensureInitialized();
-    const cStr = ditto_auth_client_user_id(authClient);
+    const cStr = ditto_auth_client_user_id(ditto);
     return boxCStringIntoString(cStr);
 }
-function dittoAuthClientIsX509Valid(authClient) {
+function dittoAuthClientIsX509Valid(ditto) {
     ensureInitialized();
-    return ditto_auth_client_is_x509_valid(authClient) !== 0;
+    return ditto_auth_client_is_x509_valid(ditto) !== 0;
 }
-async function dittoAuthClientLoginWithToken(authClient, token, provider) {
+async function dittoAuthClientLoginWithToken(ditto, token, provider) {
     ensureInitialized();
     const tokenBytes = bytesFromString(token);
     const providerBytes = bytesFromString(provider);
-    const errorCode = await ditto_auth_client_login_with_token(authClient, tokenBytes, providerBytes);
+    const errorCode = await ditto_auth_client_login_with_token(ditto, tokenBytes, providerBytes);
     if (errorCode !== 0)
         throw new Error(errorMessage() || `Ditto failed to authenticate (error code: ${errorCode}).`);
 }
-async function dittoAuthClientLoginWithUsernameAndPassword(authClient, username, password, provider) {
+async function dittoAuthClientLoginWithUsernameAndPassword(ditto, username, password, provider) {
     ensureInitialized();
     const usernameBytes = bytesFromString(username);
     const passwordBytes = bytesFromString(password);
     const providerBytes = bytesFromString(provider);
-    const errorCode = await ditto_auth_client_login_with_credentials(authClient, usernameBytes, passwordBytes, providerBytes);
+    const errorCode = await ditto_auth_client_login_with_credentials(ditto, usernameBytes, passwordBytes, providerBytes);
     if (errorCode !== 0)
         throw new Error(errorMessage() || `Ditto failed to authenticate (error code: ${errorCode}).`);
 }
-async function dittoAuthClientLogout(authClient) {
+async function dittoAuthClientLogout(ditto) {
     ensureInitialized();
-    const errorCode = await ditto_auth_client_logout(authClient);
+    const errorCode = await ditto_auth_client_logout(ditto);
     if (errorCode !== 0)
         throw new Error(errorMessage() || `Ditto failed to logout (error code: ${errorCode}).`);
 }
@@ -931,9 +923,9 @@ function uninitializedDittoMake(path) {
     return uninitialized_ditto_make(pathX);
 }
 /** @internal */
-function dittoMake(uninitializedDitto, authClient) {
+function dittoMake(uninitializedDitto, identityConfig) {
     ensureInitialized();
-    return ditto_make(uninitializedDitto, authClient, 'Disabled');
+    return ditto_make(uninitializedDitto, identityConfig, 'Disabled');
 }
 /** @internal */
 async function dittoGetCollectionNames(self) {
@@ -958,15 +950,15 @@ function dittoFree(self) {
 /** @internal */
 async function dittoRegisterPresenceV1Callback(self, cb) {
     ensureInitialized();
-    if (cb) {
-        ditto_register_presence_v1_callback(self, wrapBackgroundCbForFFI((err) => console.error(`The registered presence callback errored with ${err}`), (cJsonStr) => {
-            const jsonStr = refCStringToString(cJsonStr);
-            cb(jsonStr);
-        }));
-    }
-    else {
-        await ditto_clear_presence_callback(self);
-    }
+    ditto_register_presence_v1_callback(self, wrapBackgroundCbForFFI((err) => console.error(`The registered presence callback v1 errored with ${err}`), (cJsonStr) => {
+        const jsonStr = refCStringToString(cJsonStr);
+        cb(jsonStr);
+    }));
+}
+/** @internal */
+async function dittoClearPresenceCallback(self) {
+    ensureInitialized();
+    await ditto_clear_presence_callback(self);
 }
 /** @internal */
 async function dittoRegisterPresenceV3Callback(self, cb) {
@@ -982,11 +974,6 @@ async function dittoClearPresenceV3Callback(self) {
     ditto_clear_presence_v3_callback(self);
 }
 /** @internal */
-async function dittoClearPresenceCallback(self) {
-    ensureInitialized();
-    await ditto_clear_presence_callback(self);
-}
-/** @internal */
 function dittoRegisterTransportConditionChangedCallback(self, cb) {
     ensureInitialized();
     if (!cb) {
@@ -1100,6 +1087,11 @@ function dittoStopTCPServer(dittoPointer) {
     return ditto_stop_tcp_server(dittoPointer);
 }
 /** @internal */
+async function dittoShutdown(dittoPointer) {
+    ensureInitialized();
+    return await ditto_shutdown(dittoPointer);
+}
+/** @internal */
 function dittoAddMulticastTransport(dittoPointer) {
     ensureInitialized();
     return ditto_add_multicast_transport(dittoPointer);
@@ -1154,6 +1146,11 @@ function documentsHashMnemonic(documents) {
     return boxCStringIntoString(c_string);
 }
 /** @internal */
+async function dittoAuthSetLoginProvider(ditto, loginProvider) {
+    ensureInitialized();
+    return await ditto_auth_set_login_provider(ditto, loginProvider);
+}
+/** @internal */
 function dittoAuthClientMakeLoginProvider(expiringCb, 
 // Cb may be called in parallel at any point, so let's use an optional error handler
 onError) {
@@ -1161,14 +1158,14 @@ onError) {
     return ditto_auth_client_make_login_provider(wrapBackgroundCbForFFI(onError, expiringCb));
 }
 /** @internal */
-function dittoAuthClientSetValidityListener(authClient, validityUpdateCb, 
+function dittoAuthClientSetValidityListener(ditto, validityUpdateCb, 
 // Cb may be called in parallel at any point, so let's use an optional error handler
 onError) {
     ensureInitialized();
     const validityUpdateRawCb = wrapBackgroundCbForFFI(onError, function (isWebValidInt, isX509ValidInt) {
         return validityUpdateCb(isWebValidInt === 1, isX509ValidInt === 1);
     });
-    return ditto_auth_client_set_validity_listener(authClient, validityUpdateRawCb);
+    return ditto_auth_client_set_validity_listener(ditto, validityUpdateRawCb);
 }
 // ---------------------------------------------------------------- Other ------
 /** @internal */
@@ -1442,7 +1439,7 @@ function awdlDestroy(awdl) {
 
 // NOTE: this is patched up with the actual build version by Jake task
 // build:package and has to be a valid semantic version as defined here: https://semver.org.
-const fullBuildVersionString = '4.0.3-alpha.linux-ble-fixes-2';
+const fullBuildVersionString = '4.1.0';
 
 //
 /**
@@ -2220,19 +2217,111 @@ function validateDocumentIDCBOR(idCBOR) {
 const DEBUG_TYPE_NAMES = [];
 const DEBUG_ALL_TYPES = false;
 /**
- * For every object registered in a bridge, a {@link Meta} object is stored in
- * the bridge instance to help with debugging and testing.
+ * A handle serves as a safe wrapper around a pointer to a native object.
+ *
+ * A bridge keeps track of all handles that have been created on its
+ * {@link Bridge.handlesByAddress | `handlesByAddress`} property, which allows
+ * enumerating all objects that are currently managed by the bridge.
  *
  * @internal */
-class Meta {
-    /** @internal */
-    constructor(type, object, pointer) {
-        this.type = type;
-        this.object = object;
-        this.pointer = pointer;
+class Handle {
+    /**
+     * Warning: Do not call this constructor directly. Use
+     * {@link Bridge.handleFor | `Bridge.<type>.handleFor()`} instead.
+     *
+     * @internal */
+    constructor(bridge, object) {
+        this.isClosed = false;
+        this.bridge = bridge;
+        this.objectWeakRef = new WeakRef(object);
+    }
+    /** The type of this handle's bridge */
+    get type() {
+        return this.bridge.type;
+    }
+    /**
+     * Returns the pointer associated with this handle.
+     *
+     * @throws {Error} if the object has already been closed, garbage collected,
+     * or unregistered from the bridge.
+     */
+    deref() {
+        const object = this.objectWeakRef.deref();
+        if (object == null) {
+            throw new Error(`Bridging error: can't get pointer for an object that has been garbage collected.`);
+        }
+        if (this.isClosed) {
+            throw new Error(`Bridging error: can't get pointer for an object that has been closed.`);
+        }
+        // Instead of storing the pointer in the handle, we look it up in the
+        // bridge's pointer map to avoid storing the pointer twice.
+        const pointer = this.bridge.rawPointerFor(object);
+        if (pointer == null) {
+            throw new Error(`Bridging error: ${this.type.name} object is not currently registered in this bridge.`);
+        }
+        return pointer;
+    }
+    /**
+     * Returns the pointer associated with this handle or `null` if the object
+     * has been closed, garbage collected, or unregistered.
+     */
+    derefOrNull() {
+        const object = this.objectWeakRef.deref();
+        if (object == null) {
+            return null;
+        }
+        if (this.isClosed) {
+            return null;
+        }
+        const pointer = this.bridge.rawPointerFor(object);
+        return pointer !== null && pointer !== void 0 ? pointer : null;
+    }
+    /**
+     * Returns the object associated with this handle.
+     *
+     * @throws {Error} if the object has already been garbage collected,
+     * closed or unregistered.
+     */
+    object() {
+        const object = this.objectWeakRef.deref();
+        if (object == null) {
+            throw new Error(`Bridging error: ${this.bridge.type.name} object has already been garbage collected.`);
+        }
+        if (this.isClosed) {
+            throw new Error(`Bridging error: ${this.bridge.type.name} object has already been closed.`);
+        }
+        return object;
+    }
+    /**
+     * Returns the object associated with this handle or `null` if the object
+     * has already been garbage collected.
+     */
+    objectOrNull() {
+        var _b;
+        if (this.isClosed) {
+            throw new Error(`Bridging error: ${this.bridge.type.name} object has already been closed.`);
+        }
+        return (_b = this.objectWeakRef.deref()) !== null && _b !== void 0 ? _b : null;
     }
     toString() {
-        return `{ Meta | type: ${this.type.name}, object: ${this.object.deref()}, FFI address: ${this.pointer.addr}, FFI type: ${this.pointer.type} }`;
+        const pointer = this.derefOrNull();
+        return `{ Handle | type: ${this.bridge.type}, object: ${this.objectWeakRef.deref()}, FFI address: ${pointer === null || pointer === void 0 ? void 0 : pointer.addr}, FFI type: ${pointer === null || pointer === void 0 ? void 0 : pointer.type} }`;
+    }
+}
+/**
+ * Use this for passing arrays of pointers to the FFI.
+ */
+// REFACTOR: Use an iterator instead of an array to deref handles lazily.
+class Handles {
+    /**
+     * @throws {Error} if any of the objects are not registered in the bridge.
+     * @throws {Error} if any of the objects have already been garbage collected.
+     */
+    constructor(bridge, objects) {
+        this.handles = objects.map((object) => bridge.handleFor(object));
+    }
+    deref() {
+        return this.handles.map((handle) => handle.deref());
     }
 }
 /**
@@ -2254,9 +2343,9 @@ class Meta {
  * - {@link StaticTCPClient}: `Bridge.staticTCPClient`
  * - {@link WebsocketClient}: `Bridge.websocketClient`
  *
- * Use `Bridge.<type>.pointerFor()` to lookup the pointer for a given object and
- * `Bridge.<type>.bridge()` to get or create the matching object for a memory
- * address.
+ * Use `Bridge.<type>.handleFor()` to obtain a handle, which is a wrapper around
+ * the raw pointer, and `Bridge.<type>.bridge()` to get or create the matching
+ * object for a memory address.
  *
  * @internal */
 class Bridge {
@@ -2279,12 +2368,12 @@ class Bridge {
         /**
          * Look up a pointer given its object.
          *
-         * As `WeakMap` does not allow for enumeration, use `this.metasByAddress` to
+         * As `WeakMap` does not allow for enumeration, use `this.handlesByAddress` to
          * iterate over all pointers.
          */
         this.pointerByObject = new WeakMap();
         this.release = release;
-        this.metasByAddress = {};
+        this.handlesByAddress = {};
         this.finalizationRegistry = new FinalizationRegistry(this.finalize.bind(this));
         Bridge.all.push(new WeakRef(this));
     }
@@ -2314,20 +2403,32 @@ class Bridge {
         this.internalType = value;
     }
     /**
-     * Returns the FFI pointer for `object`.
+     * Returns the handle for a bridged object.
      *
-     * Throws an exception if object is currently not registered, which can be the
-     * case when object has never been registered or when it has already been
-     * unregistered.
+     * Use `handle.deref()` to get the pointer for the object at the time of use.
+     *
+     * @throws {Error} if the object is not registered.
      *
      * @internal
      */
-    pointerFor(object) {
-        const val = this.pointerByObject.get(object);
-        if (val == null) {
+    handleFor(object) {
+        const pointer = this.pointerByObject.get(object);
+        if (pointer == null) {
             throw new Error(`Bridging error: ${this.type.name} object is not currently registered in this bridge.`);
         }
-        return val;
+        const handle = this.handlesByAddress[pointer.addr];
+        if (handle == null) {
+            throw new Error(`Internal inconsistency, found a pointer for an object whose handle is undefined: ${pointer}`);
+        }
+        return handle;
+    }
+    /**
+     * Returns a `Handles` instance for an array of objects.
+     *
+     * @internal
+     */
+    handlesFor(objects) {
+        return new Handles(this, objects);
     }
     /**
      * Convenience method, returns the object for the FFI `pointer` if registered,
@@ -2337,15 +2438,14 @@ class Bridge {
      * @internal
      */
     objectFor(pointer) {
-        const meta = this.metasByAddress[pointer.addr];
-        if (!meta)
+        const handle = this.handlesByAddress[pointer.addr];
+        if (!handle)
             return undefined;
-        if (meta.type !== this.type)
-            throw new Error(`Can't return object for pointer, pointer is associated with an object of type ${meta.type} but this bridge is configured for ${this.type}`);
-        const object = meta.object.deref();
-        if (!object)
-            throw new Error(`Internal inconsistency, found a meta entry for an object whose object is undefined (garbage collected): ${pointer}`);
-        return object;
+        if (handle.type !== this.type)
+            throw new Error(`Can't return object for pointer, pointer is associated with an object of type ${handle.type} but this bridge is configured for ${this.type}`);
+        // This throws an error if the object has been garbage collected but the
+        // finalizer has not been called yet.
+        return handle.object();
     }
     /**
      * Returns the object for the FFI `pointer` if registered. Otherwise, calls
@@ -2356,6 +2456,7 @@ class Bridge {
      *
      * @param pointer reference to the FFi instance for the object
      * @param objectOrCreate can either be the JS object, or a function that returns the instance when called. If undefined, an object is created based on the Bridge type.
+     * @throws {Error} if `objectOrCreate` is a function that returns an object that is not an instance of the bridge's type.
      * @internal
      */
     bridge(pointer, objectOrCreate) {
@@ -2393,26 +2494,49 @@ class Bridge {
      * @private */
     register(object, pointer) {
         const objectType = object.constructor;
-        const bridgeType = this.type;
-        if (object.constructor !== this.type)
-            throw new Error(`Can't register, bridge is configured for type ${bridgeType.name} but passed in object is of type ${objectType.name}`);
+        if (objectType !== this.type)
+            throw new Error(`Can't register, bridge is configured for type ${this.type.name} but passed in object is of type ${objectType.name}`);
         const existingPointer = this.pointerByObject.get(object);
-        const existingMeta = this.metasByAddress[pointer.addr];
-        // Check that both pointer and meta are undefined at this point.
-        if (existingPointer != null && existingMeta != null)
-            throw new Error(`Can't register, an object for the passed in pointer has previously been registered: ${existingMeta.pointer}`);
-        if (existingPointer != null && existingMeta == null)
-            throw new Error(`Internal inconsistency, trying to register an object which has an associated pointer but no meta entry: ${objectType.name} at ${existingPointer.type} ${existingPointer.addr}`);
-        if (existingPointer == null && existingMeta != null)
-            throw new Error(`Internal inconsistency, trying to register an object which has a meta entry but no associated pointer: ${objectType.name} ${object}`);
-        const meta = new Meta(this.type, new WeakRef(object), pointer);
-        this.metasByAddress[meta.pointer.addr] = meta;
+        const existingHandle = this.handlesByAddress[pointer.addr];
+        // Check that both pointer and handle are undefined at this point.
+        if (existingPointer != null && existingHandle != null)
+            throw new Error(`Can't register, an object for the passed in pointer has previously been registered: ${existingHandle.object()}`);
+        if (existingPointer != null && existingHandle == null)
+            throw new Error(`Internal inconsistency, trying to register an object which has an associated pointer but no handle entry: ${objectType.name} at ${existingPointer.type} ${existingPointer.addr}`);
+        if (existingPointer == null && existingHandle != null)
+            throw new Error(`Internal inconsistency, trying to register an object which has a handle entry but no associated pointer: ${objectType.name} ${object}`);
+        const handle = new Handle(this, object);
+        this.handlesByAddress[pointer.addr] = handle;
         this.pointerByObject.set(object, pointer);
         this.finalizationRegistry.register(object, pointer, object);
         if (DEBUG_TYPE_NAMES.includes(this.type.name) || DEBUG_ALL_TYPES) {
-            console.log(`[VERBOSE] Bridge REGISTERED a new instance of ${this.type.name}, current count: ${Object.keys(this.metasByAddress).length}`);
+            console.log(`[VERBOSE] Bridge REGISTERED a new instance of ${this.type.name}, current count: ${Object.keys(this.handlesByAddress).length}`);
         }
     }
+    /**
+     * Marks the object as closed while still keeping it registered in the
+     * {@link FinalizationRegistry}, such that it still gets finalized by GC.
+     * Otherwise, the behavior is exactly as if the object would've been
+     * unregistered.
+     *
+     * @internal */
+    markAsClosed(object) {
+        const objectType = object.constructor;
+        const bridgeType = this.type;
+        if (objectType !== bridgeType)
+            throw new Error(`Can't unregister, bridge is configured for type ${bridgeType.name} but passed in object is of type ${objectType.name}`);
+        const pointer = this.pointerByObject.get(object);
+        if (pointer == null)
+            throw new Error(`Can't unregister, object that has not been registered before: ${object}`);
+        const handle = this.handlesByAddress[pointer.addr];
+        if (handle == null)
+            throw new Error(`Internal inconsistency, trying to unregister an object which has an associated pointer but no handle: ${object}`);
+        if (handle.type !== bridgeType)
+            throw new Error(`Internal inconsistency, trying to unregister an object that has a handle with a different type than that of the bridge: ${handle}`);
+        if (handle.objectOrNull() !== object)
+            throw new Error(`Internal inconsistency, trying to unregister an object whose associated handle holds a different object: ${handle}`);
+        handle['isClosed'] = true;
+    }
     /**
      * Removes an instance from this bridge's {@link FinalizationRegistry}.
      *
@@ -2429,20 +2553,18 @@ class Bridge {
         const pointer = this.pointerByObject.get(object);
         if (pointer == null)
             throw new Error(`Can't unregister, object that has not been registered before: ${object}`);
-        const meta = this.metasByAddress[pointer.addr];
-        if (meta == null)
-            throw new Error(`Internal inconsistency, trying to unregister an object which has an associated pointer but no meta entry: ${object}`);
-        if (meta.type !== bridgeType)
-            throw new Error(`Internal inconsistency, trying to unregister an object that has a meta entry with a different type than that of the bridge: ${meta}`);
-        if (meta.object.deref() == null)
-            throw new Error(`Internal inconsistency, trying to unregister an object that has a meta entry whose object is undfined (garbage collected): ${meta}`);
-        if (meta.object.deref() !== object)
-            throw new Error(`Internal inconsistency, trying to unregister an object that has a meta entry holding a different object: ${meta}`);
+        const handle = this.handlesByAddress[pointer.addr];
+        if (handle == null)
+            throw new Error(`Internal inconsistency, trying to unregister an object which has an associated pointer but no handle: ${object}`);
+        if (handle.type !== bridgeType)
+            throw new Error(`Internal inconsistency, trying to unregister an object that has a handle with a different type than that of the bridge: ${handle}`);
+        if (handle.objectOrNull() !== object)
+            throw new Error(`Internal inconsistency, trying to unregister an object whose associated handle holds a different object: ${handle}`);
         this.finalizationRegistry.unregister(object);
-        delete this.metasByAddress[pointer.addr];
+        delete this.handlesByAddress[pointer.addr];
         this.pointerByObject.delete(object);
         if (DEBUG_TYPE_NAMES.includes(this.type.name) || DEBUG_ALL_TYPES) {
-            console.log(`[VERBOSE] Bridge UNREGISTERED an instance of ${this.type.name}, current count: ${Object.keys(this.metasByAddress).length}`);
+            console.log(`[VERBOSE] Bridge UNREGISTERED an instance of ${this.type.name}, current count: ${Object.keys(this.handlesByAddress).length}`);
         }
     }
     /** @internal */
@@ -2450,8 +2572,8 @@ class Bridge {
         if (DEBUG_TYPE_NAMES.includes(this.type.name) || DEBUG_ALL_TYPES) {
             console.log(`[VERBOSE] Unregistering ALL bridged instances of type ${this.type.name}.`);
         }
-        for (const meta of Object.values(this.metasByAddress)) {
-            const object = meta.object.deref();
+        for (const handle of Object.values(this.handlesByAddress)) {
+            const object = handle.object();
             if (object) {
                 this.unregister(object);
             }
@@ -2459,16 +2581,20 @@ class Bridge {
     }
     /** @internal */
     get count() {
-        return Object.keys(this.metasByAddress).length;
+        return Object.keys(this.handlesByAddress).length;
+    }
+    /* @internal */
+    rawPointerFor(object) {
+        return this.pointerByObject.get(object);
     }
     finalize(pointer) {
-        const meta = this.metasByAddress[pointer.addr];
-        if (!meta)
-            throw new Error(`Internal inconsistency, tried to finalize an instance for a pointer, that has no meta entry: ${pointer}`);
-        delete this.metasByAddress[pointer.addr];
-        this.release(pointer);
+        const handle = this.handlesByAddress[pointer.addr];
+        if (!handle)
+            throw new Error(`Internal inconsistency, tried to finalize an instance for a pointer, that has no handle: ${pointer}`);
+        delete this.handlesByAddress[pointer.addr];
+        this.release(pointer, handle);
         if (DEBUG_TYPE_NAMES.includes(this.type.name) || DEBUG_ALL_TYPES) {
-            console.log(`[VERBOSE] Bridge FINALIZED an instance of ${this.type.name}, current count: ${Object.keys(this.metasByAddress).length}`);
+            console.log(`[VERBOSE] Bridge FINALIZED an instance of ${this.type.name}, current count: ${Object.keys(this.handlesByAddress).length}`);
         }
     }
 }
@@ -2490,11 +2616,14 @@ Bridge.staticTCPClient = new Bridge(staticTCPClientFreeHandle);
 /** @internal */
 Bridge.websocketClient = new Bridge(websocketClientFreeHandle);
 /** @internal */
-Bridge.ditto = new Bridge((dittoPointer) => {
+Bridge.ditto = new Bridge(async (dittoPointer, handle) => {
     // HACK: quick and dirty, clear all presence callbacks. This covers presence
     // v1 and v2 callbacks. v3 should be cleared properly by the `Presence`
     // class itself.
     dittoClearPresenceCallback(dittoPointer);
+    if (!handle.isClosed) {
+        await dittoShutdown(dittoPointer);
+    }
     dittoFree(dittoPointer);
 });
 
@@ -2551,13 +2680,16 @@ class Attachment {
      * Returns the attachment's data.
      */
     getData() {
-        {
-            const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-            const attachmentHandlePointer = Bridge.attachment.pointerFor(this);
-            const attachmentPath = dittoGetCompleteAttachmentPath(dittoPointer, attachmentHandlePointer);
-            const fs = require('fs/promises');
-            return fs.readFile(attachmentPath);
-        }
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return this.ditto.deferCloseAsync(async () => {
+            {
+                const attachmentHandle = Bridge.attachment.handleFor(this);
+                const attachmentPath = dittoGetCompleteAttachmentPath(dittoHandle.deref(), attachmentHandle.deref());
+                const fs = require('fs/promises');
+                return await fs.readFile(attachmentPath);
+            }
+        });
     }
     /**
      * Copies the attachment to the specified file path. Node-only,
@@ -2566,15 +2698,18 @@ class Attachment {
      * @param path The path that the attachment should be copied to.
      */
     copyToPath(path) {
-        {
-            const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-            const attachmentHandlePointer = Bridge.attachment.pointerFor(this);
-            const attachmentPath = dittoGetCompleteAttachmentPath(dittoPointer, attachmentHandlePointer);
-            const fs = require('fs/promises');
-            // If the file already exists, we fail. This is the same behavior as
-            // for the Swift/ObjC SDK.
-            return fs.copyFile(attachmentPath, path, fs.COPYFILE_EXCL);
-        }
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return this.ditto.deferCloseAsync(async () => {
+            {
+                const attachmentHandle = Bridge.attachment.handleFor(this);
+                const attachmentPath = dittoGetCompleteAttachmentPath(dittoHandle.deref(), attachmentHandle.deref());
+                const fs = require('fs/promises');
+                // If the file already exists, we fail. This is the same behavior as
+                // for the Swift/ObjC SDK.
+                return await fs.copyFile(attachmentPath, path, fs.COPYFILE_EXCL);
+            }
+        });
     }
     /** @internal */
     constructor(ditto, token) {
@@ -2719,7 +2854,10 @@ function validateQuery(query, options = {}) {
     return validatedQuery;
 }
 // -------------------------------------------------------------- Helpers ------
-/** @internal */
+/**
+ * Generate a random hex-encoded token using the WebCrypto API.
+ *
+ * @internal */
 function generateEphemeralToken() {
     let webcrypto = undefined;
     {
@@ -2738,9 +2876,9 @@ function sleep(milliseconds) {
     });
 }
 /** @internal use this to asyncify chunks of code. */
-async function step(block) {
+async function step(closure) {
     await sleep(0);
-    return block();
+    return closure();
 }
 /** @internal */
 // WORKAROUND: the corresponding FFI function(s) is not async at the
@@ -2999,8 +3137,8 @@ class DocumentPath {
     underlyingValueForPathType(pathType) {
         const path = this.path;
         const document = this.document;
-        const documentX = Bridge.document.pointerFor(document);
-        const cborPathResult = documentGetCBORWithPathType(documentX, path, pathType);
+        const documentHandle = Bridge.document.handleFor(document);
+        const cborPathResult = documentGetCBORWithPathType(documentHandle.deref(), path, pathType);
         return cborPathResult.cbor !== null ? CBOR.decode(cborPathResult.cbor) : undefined;
     }
 }
@@ -3103,8 +3241,8 @@ class MutableDocumentPath {
     underlyingValueForPathType(pathType) {
         const path = this.path;
         const document = this.mutableDocument;
-        const documentX = Bridge.mutableDocument.pointerFor(document);
-        const cborPathResult = documentGetCBORWithPathType(documentX, path, pathType);
+        const documentHandle = Bridge.mutableDocument.handleFor(document);
+        const cborPathResult = documentGetCBORWithPathType(documentHandle.deref(), path, pathType);
         return cborPathResult.cbor !== null ? CBOR.decode(cborPathResult.cbor) : undefined;
     }
     /** @internal */
@@ -3112,21 +3250,21 @@ class MutableDocumentPath {
         // REFACTOR: this body should probably move to
         // `MutableCounter.incrementBy()`. Keeping as-is for now until we implement
         // more explicit CRDT types.
-        const documentPointer = Bridge.mutableDocument.pointerFor(this.mutableDocument);
-        documentIncrementCounter(documentPointer, this.path, amount);
+        const documentHandle = Bridge.mutableDocument.handleFor(this.mutableDocument);
+        documentIncrementCounter(documentHandle.deref(), this.path, amount);
         const updateResult = UpdateResult.incremented(this.mutableDocument.id, this.path, amount);
         this.recordUpdateResult(updateResult);
     }
     /** @internal */
     '@ditto.set'(value, isDefault) {
-        const documentX = Bridge.mutableDocument.pointerFor(this.mutableDocument);
+        const documentHandle = Bridge.mutableDocument.handleFor(this.mutableDocument);
         const valueJSON = desugarJSObject(value, false);
         const valueCBOR = CBOR.encode(valueJSON);
         if (isDefault) {
-            documentSetCBORWithTimestamp(documentX, this.path, valueCBOR, 0);
+            documentSetCBORWithTimestamp(documentHandle.deref(), this.path, valueCBOR, 0);
         }
         else {
-            documentSetCBOR(documentX, this.path, valueCBOR);
+            documentSetCBOR(documentHandle.deref(), this.path, valueCBOR);
         }
         // HACK: we need a copy of value because the original value can be mutated
         // later on and an update result needs the state of the value at this
@@ -3139,8 +3277,8 @@ class MutableDocumentPath {
     }
     /** @internal */
     '@ditto.remove'() {
-        const documentPointer = Bridge.mutableDocument.pointerFor(this.mutableDocument);
-        documentRemove(documentPointer, this.path);
+        const documentHandle = Bridge.mutableDocument.handleFor(this.mutableDocument);
+        documentRemove(documentHandle.deref(), this.path);
         this.updateInMemory((container, lastPathComponent) => {
             if (Array.isArray(container) && typeof lastPathComponent === 'number') {
                 container.splice(lastPathComponent, 1);
@@ -3178,8 +3316,8 @@ class Document {
      */
     static hash(documentOrMany) {
         const documents = documentsFrom(documentOrMany);
-        const documentPointers = documents.map((doc) => Bridge.document.pointerFor(doc));
-        return documentsHash(documentPointers);
+        const documentHandles = documents.map((doc) => Bridge.document.handleFor(doc));
+        return documentsHash(documentHandles.map((handle) => handle.deref()));
     }
     /**
      * Returns a pattern of words that together create a mnemonic, which
@@ -3187,8 +3325,8 @@ class Document {
      */
     static hashMnemonic(documentOrMany) {
         const documents = documentsFrom(documentOrMany);
-        const documentPointers = documents.map((doc) => Bridge.document.pointerFor(doc));
-        return documentsHashMnemonic(documentPointers);
+        const documentHandles = Bridge.document.handlesFor(documents);
+        return documentsHashMnemonic(documentHandles.deref());
     }
     /**
      * Returns the document ID.
@@ -3196,8 +3334,8 @@ class Document {
     get id() {
         let id = this['@ditto.id'];
         if (typeof id === 'undefined') {
-            const documentX = Bridge.document.pointerFor(this);
-            const documentIDCBOR = documentID(documentX);
+            const documentHandle = Bridge.document.handleFor(this);
+            const documentIDCBOR = documentID(documentHandle.deref());
             id = new DocumentID(documentIDCBOR, true);
             this['@ditto.id'] = id;
         }
@@ -3233,8 +3371,8 @@ class Document {
     // TEMPORARY: helpers to deal with non-canonical IDs.
     /** @internal */
     static idCBOR(document) {
-        const documentX = Bridge.document.pointerFor(document);
-        return documentID(documentX);
+        const documentHandle = Bridge.document.handleFor(document);
+        return documentID(documentHandle.deref());
     }
     /** @internal */
     static canonicalizedIDCBOR(idCBOR) {
@@ -3269,8 +3407,8 @@ class MutableDocument {
     get id() {
         let id = this['@ditto.id'];
         if (typeof id === 'undefined') {
-            const documentX = Bridge.mutableDocument.pointerFor(this);
-            const documentIDCBOR = documentID(documentX);
+            const documentHandle = Bridge.mutableDocument.handleFor(this);
+            const documentIDCBOR = documentID(documentHandle.deref());
             id = new DocumentID(documentIDCBOR, true);
             this['@ditto.id'] = id;
         }
@@ -3302,8 +3440,8 @@ class MutableDocument {
     // TEMPORARY: helpers to deal with non-canonical IDs.
     /** @internal */
     static idCBOR(mutableDocument) {
-        const documentX = Bridge.mutableDocument.pointerFor(mutableDocument);
-        return documentID(documentX);
+        const documentHandle = Bridge.mutableDocument.handleFor(mutableDocument);
+        return documentID(documentHandle.deref());
     }
 }
 /** @internal */
@@ -3454,13 +3592,16 @@ class BasePendingCursorOperation {
      * the query generated by the preceding function chaining.
      */
     async exec() {
-        const query = this.query;
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            return await collectionExecQueryStr(dittoX, this.collection.name, null, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
-        });
-        return documentsX.map((documentX) => {
-            return Bridge.document.bridge(documentX);
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const query = this.query;
+            const documentPointers = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                return await collectionExecQueryStr(dittoHandle.deref(), this.collection.name, null, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
+            });
+            return documentPointers.map((documentPointer) => {
+                return Bridge.document.bridge(documentPointer);
+            });
         });
     }
     // ----------------------------------------------------------- Internal ------
@@ -3479,37 +3620,40 @@ class BasePendingCursorOperation {
      * @internal
      */
     async updateWithTransaction(closure, writeTransactionX) {
-        return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            const query = this.query;
-            const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-            const documentsX = await collectionExecQueryStr(dittoX, this.collection.name, writeTransactionX, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
-            const mutableDocuments = documentsX.map((documentX) => {
-                return Bridge.mutableDocument.bridge(documentX, () => new MutableDocument());
-            });
-            closure(mutableDocuments);
-            const updateResultsDocumentIDs = [];
-            const updateResultsByDocumentIDString = {};
-            for (const mutableDocument of mutableDocuments) {
-                const documentID = mutableDocument.id;
-                const documentIDString = documentID.toString();
-                const updateResults = mutableDocument['@ditto.updateResults'];
-                if (updateResultsByDocumentIDString[documentIDString]) {
-                    // HACK: in theory, 2 different document IDs can have the exact
-                    // same string representation at the time of this writing. There is
-                    // already a REFACTOR comment in `UpdateResultsMap` to implement a
-                    // proper and correct data structure for holding these update results.
-                    // Until then, we'll leave this check here to see how often we hit
-                    // this edge case.
-                    throw new Error(`Internal inconsistency, update results for document ID as string already exist: ${documentIDString}`);
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                const query = this.query;
+                const documentsX = await collectionExecQueryStr(dittoHandle.deref(), this.collection.name, writeTransactionX, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
+                const mutableDocuments = documentsX.map((documentX) => {
+                    return Bridge.mutableDocument.bridge(documentX, () => new MutableDocument());
+                });
+                closure(mutableDocuments);
+                const updateResultsDocumentIDs = [];
+                const updateResultsByDocumentIDString = {};
+                for (const mutableDocument of mutableDocuments) {
+                    const documentID = mutableDocument.id;
+                    const documentIDString = documentID.toString();
+                    const updateResults = mutableDocument['@ditto.updateResults'];
+                    if (updateResultsByDocumentIDString[documentIDString]) {
+                        // HACK: in theory, 2 different document IDs can have the exact
+                        // same string representation at the time of this writing. There is
+                        // already a REFACTOR comment in `UpdateResultsMap` to implement a
+                        // proper and correct data structure for holding these update results.
+                        // Until then, we'll leave this check here to see how often we hit
+                        // this edge case.
+                        throw new Error(`Internal inconsistency, update results for document ID as string already exist: ${documentIDString}`);
+                    }
+                    updateResultsDocumentIDs.push(documentID);
+                    updateResultsByDocumentIDString[documentIDString] = updateResults;
+                    Bridge.mutableDocument.unregister(mutableDocument);
                 }
-                updateResultsDocumentIDs.push(documentID);
-                updateResultsByDocumentIDString[documentIDString] = updateResults;
-                Bridge.mutableDocument.unregister(mutableDocument);
-            }
-            // NOTE: ownership of documentsX (and contained documents)
-            // is transferred to Rust at this point.
-            await collectionUpdateMultiple(dittoX, this.collection.name, writeTransactionX, documentsX);
-            return new UpdateResultsMap(updateResultsDocumentIDs, updateResultsByDocumentIDString);
+                // NOTE: ownership of documentsX (and contained documents)
+                // is transferred to Rust at this point.
+                await collectionUpdateMultiple(dittoHandle.deref(), this.collection.name, writeTransactionX, documentsX);
+                return new UpdateResultsMap(updateResultsDocumentIDs, updateResultsByDocumentIDString);
+            });
         });
     }
     /** @internal */
@@ -3551,15 +3695,18 @@ class BasePendingIDSpecificOperation {
      * not found.
      */
     async exec() {
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            const readTransactionX = await readTransaction(dittoX);
-            const documentX = await collectionGet(dittoX, this.collection.name, this.documentIDCBOR, readTransactionX);
-            let document = undefined;
-            if (documentX)
-                document = Bridge.document.bridge(documentX);
-            readTransactionFree(readTransactionX);
-            return document;
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                const readTransactionX = await readTransaction(dittoHandle.deref());
+                const documentX = await collectionGet(dittoHandle.deref(), this.collection.name, this.documentIDCBOR, readTransactionX);
+                let document = undefined;
+                if (documentX)
+                    document = Bridge.document.bridge(documentX);
+                readTransactionFree(readTransactionX);
+                return document;
+            });
         });
     }
     // ----------------------------------------------------------- Internal ------
@@ -3591,6 +3738,7 @@ class ObserverManager {
         const process = (_d = options.process) !== null && _d !== void 0 ? _d : null;
         this.id = id;
         this.keepAlive = keepAlive;
+        this.isClosed = false;
         this.isRegistered = false;
         this.callbacksByToken = {};
         if (register !== null) {
@@ -3606,6 +3754,11 @@ class ObserverManager {
     /** @internal */
     addObserver(callback) {
         var _a;
+        if (this.isClosed) {
+            // REFACTOR: throw a catchable error here, such that calling code
+            // can be more specific when forwarding it to the user.
+            throw new Error(`Internal inconsistency, can't add '${this.id}' observer, observer mananger close()-ed.`);
+        }
         this.registerIfNeeded();
         const token = generateEphemeralToken();
         this.callbacksByToken[token] = callback;
@@ -3615,18 +3768,45 @@ class ObserverManager {
     /** @internal */
     removeObserver(token) {
         var _a;
-        delete this.callbacksByToken[token];
+        const callback = this.callbacksByToken[token];
+        if (typeof callback === 'undefined') {
+            throw new Error(`Can't remove '${this.id}' observer, token '${token}' has never been registered before.`);
+        }
+        if (callback === null) {
+            // Observer has already been removed, no-op.
+            return;
+        }
+        // REFACTOR: not deleting the token here will keep eating up
+        // memory over long periods of time. We actually need to track
+        // the observer objects themselves and remove it from the table
+        // as soon as the observer object is garbage collected.
+        this.callbacksByToken[token] = null;
         (_a = this.keepAlive) === null || _a === void 0 ? void 0 : _a.release(`${this.id}.${token}`);
         this.unregisterIfNeeded();
     }
+    hasObserver(token) {
+        return typeof this.callbacksByToken[token] != 'undefined';
+    }
     /** @internal */
     notify(...args) {
+        if (this.isClosed) {
+            // NOTE: we don't notify observers after closing and just swallow
+            // the event.
+            return;
+        }
         const processedArgs = this.process(...args);
         for (const token in this.callbacksByToken) {
             const callback = this.callbacksByToken[token];
             callback(...processedArgs);
         }
     }
+    /** @internal */
+    close() {
+        this.isClosed = true;
+        for (const token in this.callbacksByToken) {
+            this.removeObserver(token);
+        }
+    }
     /**
      * Can be injected and replaced via constructor options.
      *
@@ -3676,9 +3856,6 @@ class ObserverManager {
             this.unregister();
         }
     }
-    async finalize(token) {
-        await this.removeObserver(token);
-    }
 }
 
 //
@@ -3748,39 +3925,65 @@ class Authenticator {
     '@ditto.authClientValidityChanged'(isWebValid, isX509Valid) {
         throw new Error(`Authenticator['@ditto.authClientValidityChanged']() is abstract and must be implemented by subclasses.`);
     }
+    /** @internal */
+    close() {
+        this.observerManager.close();
+    }
 }
 // -----------------------------------------------------------------------------
 /** @internal */
 class OnlineAuthenticator extends Authenticator {
     async loginWithToken(token, provider) {
-        await dittoAuthClientLoginWithToken(this.authClientPointer, token, provider);
+        const ditto = this.ditto.deref();
+        if (!ditto) {
+            return;
+        }
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        const dittoPointer = dittoHandle.derefOrNull();
+        if (!dittoPointer) {
+            return;
+        }
+        return ditto.deferCloseAsync(async () => {
+            await dittoAuthClientLoginWithToken(dittoPointer, token, provider);
+        });
     }
     async loginWithUsernameAndPassword(username, password, provider) {
-        await dittoAuthClientLoginWithUsernameAndPassword(this.authClientPointer, username, password, provider);
+        const ditto = this.ditto.deref();
+        if (!ditto) {
+            return;
+        }
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        const dittoPointer = dittoHandle.derefOrNull();
+        if (!dittoPointer) {
+            return;
+        }
+        return ditto.deferCloseAsync(async () => {
+            await dittoAuthClientLoginWithUsernameAndPassword(dittoPointer, username, password, provider);
+        });
     }
     async logout(cleanupFn) {
         const ditto = this.ditto.deref();
-        if (ditto) {
-            await dittoAuthClientLogout(this.authClientPointer);
-            ditto.stopSync();
-            cleanupFn === null || cleanupFn === void 0 ? void 0 : cleanupFn(this.ditto);
+        if (!ditto) {
+            return;
         }
-        else {
-            Logger.warning('Unable to logout, related Ditto object does not exist anymore.');
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        const dittoPointer = dittoHandle.derefOrNull();
+        if (!dittoPointer) {
+            return;
         }
+        return ditto.deferCloseAsync(async () => {
+            await dittoAuthClientLogout(dittoPointer);
+            ditto.stopSync();
+            cleanupFn === null || cleanupFn === void 0 ? void 0 : cleanupFn(this.ditto);
+        });
     }
-    constructor(keepAlive, authClientPointer, ditto, authenticationHandler) {
+    constructor(keepAlive, ditto, authenticationHandler) {
         super(keepAlive);
         this['loginSupported'] = true;
         this['status'] = { isAuthenticated: false, userID: null };
-        this.authClientPointer = authClientPointer;
         this.ditto = new WeakRef(ditto);
         this.authenticationHandler = authenticationHandler;
         this.updateAndNotify(false);
-        // NOTE: The ownership of the auth client is transferred to us (from Ditto),
-        // so we have to free the auth client once this instance is garbage
-        // collected.
-        OnlineAuthenticator.finalizationRegistry.register(this, authClientPointer);
     }
     '@ditto.authenticationExpiring'(secondsRemaining) {
         const authenticationHandler = this.authenticationHandler;
@@ -3796,10 +3999,21 @@ class OnlineAuthenticator extends Authenticator {
     }
     updateAndNotify(shouldNotify) {
         var _a;
+        const ditto = this.ditto.deref();
+        if (!ditto) {
+            Logger.debug('Unable to update auth status and notify, related Ditto object does not exist anymore.');
+            return;
+        }
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        const dittoPointer = dittoHandle.derefOrNull();
+        if (!dittoPointer) {
+            Logger.debug('Unable to update auth status and notify, related Ditto object does not exist anymore.');
+            return;
+        }
         const wasAuthenticated = this.status.isAuthenticated;
         const previousUserID = this.status.userID;
-        const isAuthenticated = dittoAuthClientIsWebValid(this.authClientPointer);
-        const userID = dittoAuthClientUserID(this.authClientPointer);
+        const isAuthenticated = dittoAuthClientIsWebValid(dittoPointer);
+        const userID = dittoAuthClientUserID(dittoPointer);
         const status = { isAuthenticated, userID };
         this['status'] = status;
         if (shouldNotify) {
@@ -3810,11 +4024,7 @@ class OnlineAuthenticator extends Authenticator {
             }
         }
     }
-    static finalize(authClientPointer) {
-        dittoAuthClientFree(authClientPointer);
-    }
 }
-OnlineAuthenticator.finalizationRegistry = new FinalizationRegistry(OnlineAuthenticator.finalize);
 // -----------------------------------------------------------------------------
 /** @internal */
 class NotAvailableAuthenticator extends Authenticator {
@@ -3980,94 +4190,6 @@ class TransportConfig {
     }
 }
 
-//
-/**
- * These objects are returned by calls to
- * {@link Collection.fetchAttachment | fetchAttachment()} on {@link Collection}
- * and allow you to stop an in-flight attachment fetch.
- */
-class AttachmentFetcher {
-    /**
-     * Stops fetching the associated attachment and cleans up any associated
-     * resources.
-     *
-     * Note that you are not required to call `stop()` once your attachment fetch
-     * operation has finished. The method primarily exists to allow you to cancel
-     * an attachment fetch request while it is ongoing if you no longer wish for
-     * the attachment to be made available locally to the device.
-     */
-    stop() {
-        AttachmentFetcher.stopWithContextInfo({
-            ditto: this.ditto,
-            attachmentTokenID: this.token.id,
-            cancelTokenPromise: this.cancelTokenPromise,
-        });
-    }
-    /** @internal */
-    then(onfulfilled, onrejected) {
-        return this.attachment.then(onfulfilled, onrejected);
-    }
-    /** @internal */
-    constructor(ditto, token, eventHandler) {
-        this.ditto = ditto;
-        this.token = token;
-        this.eventHandler = eventHandler || null;
-        this.cancelTokenPromise = null;
-        const eventHandlerOrNoOp = eventHandler || function () { };
-        this.attachment = new Promise((resolve, reject) => {
-            const dittoPointer = Bridge.ditto.pointerFor(ditto);
-            // not awaited yet; only needs to be fully resolved (and `await`ed over)
-            // when using the actual `cancelTokenPromise`, which only happens in `stop()`.
-            this.cancelTokenPromise = dittoResolveAttachment(dittoPointer, token.id, {
-                onComplete: (attachmentHandlePointer) => {
-                    this['eventHandler'] = null;
-                    this['cancelTokenPromise'] = null;
-                    const attachment = new Attachment(this.ditto, this.token);
-                    Bridge.attachment.bridge(attachmentHandlePointer, () => attachment);
-                    eventHandlerOrNoOp({ type: 'Completed', attachment });
-                    resolve(attachment);
-                },
-                onProgress: (downloaded, toDownload) => {
-                    eventHandlerOrNoOp({ type: 'Progress', totalBytes: toDownload, downloadedBytes: downloaded });
-                },
-                onDelete: () => {
-                    this['eventHandler'] = null;
-                    this['cancelTokenPromise'] = null;
-                    eventHandlerOrNoOp({ type: 'Deleted' });
-                    resolve(null);
-                },
-            }, 
-            /* onError: */ (err) => {
-                this['eventHandler'] = null;
-                this['cancelTokenPromise'] = null;
-                // REFACTOR: We simply throw this error at the moment. Maybe we should
-                // bubble it up?
-                reject(err);
-            });
-        });
-        const contextInfo = {
-            ditto: ditto,
-            attachmentTokenID: token.id,
-            cancelTokenPromise: this.cancelTokenPromise,
-        };
-        AttachmentFetcher.finalizationRegistry.register(this, contextInfo, contextInfo);
-    }
-    static stopWithContextInfo(contextInfo) {
-        // No need for synchronicity, here: we let the "stop promise", float / run
-        // in a detached fashion since there is no point in awaiting the
-        // "stop signaling" itself.
-        step(async () => {
-            // await the initial resolution of `FFI.dittoResolveAttachment` below.
-            const cancelToken = await contextInfo.cancelTokenPromise;
-            if (cancelToken) {
-                const dittoPointer = Bridge.ditto.pointerFor(contextInfo.ditto);
-                dittoCancelResolveAttachment(dittoPointer, contextInfo.attachmentTokenID, cancelToken);
-            }
-        });
-    }
-}
-AttachmentFetcher.finalizationRegistry = new FinalizationRegistry(AttachmentFetcher.stopWithContextInfo);
-
 //
 /**
  * Used to subscribe to receive updates from remote peers about matching
@@ -4090,7 +4212,7 @@ class Subscription {
     cancel() {
         if (!this.isCancelled) {
             this['isCancelled'] = true;
-            Subscription.remove(this, this.contextInfo);
+            this.manager.remove(this);
         }
     }
     // ----------------------------------------------------------- Internal ------
@@ -4106,7 +4228,7 @@ class Subscription {
         this.queryArgsCBOR = queryArgsCBOR;
         this.collection = collection;
         this.contextInfo = {
-            ditto: collection.store.ditto,
+            id: generateEphemeralToken(),
             collectionName: collection.name,
             query,
             queryArgsCBOR,
@@ -4114,23 +4236,10 @@ class Subscription {
             limit,
             offset,
         };
-        Subscription.add(this, this.contextInfo);
-    }
-    static add(subscription, contextInfo) {
-        const dittoX = Bridge.ditto.pointerFor(contextInfo.ditto);
-        addSubscription(dittoX, contextInfo.collectionName, contextInfo.query, contextInfo.queryArgsCBOR, contextInfo.orderBys, contextInfo.limit, contextInfo.offset);
-        this.finalizationRegistry.register(subscription, contextInfo, contextInfo);
+        this.manager = collection.store.ditto.subscriptionManager;
+        this.manager.add(this);
     }
-    static remove(subscription, contextInfo) {
-        const dittoX = Bridge.ditto.pointerFor(contextInfo.ditto);
-        removeSubscription(dittoX, contextInfo.collectionName, contextInfo.query, contextInfo.queryArgsCBOR, contextInfo.orderBys, contextInfo.limit, contextInfo.offset);
-        if (subscription)
-            this.finalizationRegistry.unregister(contextInfo);
-    }
-}
-Subscription.finalizationRegistry = new FinalizationRegistry((contextInfo) => {
-    Subscription.remove(null, contextInfo);
-});
+}
 
 //
 // -----------------------------------------------------------------------------
@@ -4150,14 +4259,16 @@ class LiveQueryEventInitial {
      * Returns a hash that represents the set of matching documents.
      */
     hash(documents) {
-        return documentsHash(documents.map((doc) => Bridge.document.pointerFor(doc)));
+        const documentHandles = Bridge.document.handlesFor(documents);
+        return documentsHash(documentHandles.deref());
     }
     /**
      * Returns a pattern of words that together create a mnemonic, which
      * represents the set of matching documents.
      */
     hashMnemonic(documents) {
-        return documentsHashMnemonic(documents.map((doc) => Bridge.document.pointerFor(doc)));
+        const documentHandles = Bridge.document.handlesFor(documents);
+        return documentsHashMnemonic(documentHandles.deref());
     }
 }
 // -----------------------------------------------------------------------------
@@ -4170,14 +4281,16 @@ class LiveQueryEventUpdate {
      * Returns a hash that represents the set of matching documents.
      */
     hash(documents) {
-        return documentsHash(documents.map((doc) => Bridge.document.pointerFor(doc)));
+        const documentHandles = Bridge.document.handlesFor(documents);
+        return documentsHash(documentHandles.deref());
     }
     /**
      * Returns a pattern of words that together create a mnemonic, which
      * represents the set of matching documents.
      */
     hashMnemonic(documents) {
-        return documentsHashMnemonic(documents.map((doc) => Bridge.document.pointerFor(doc)));
+        const documentHandles = Bridge.document.handlesFor(documents);
+        return documentsHashMnemonic(documentHandles.deref());
     }
     /** @internal */
     constructor(params) {
@@ -4203,14 +4316,16 @@ class SingleDocumentLiveQueryEvent {
      * Returns a hash that represents the set of matching documents.
      */
     hash(document) {
-        return documentsHash(document === null ? [] : [Bridge.document.pointerFor(document)]);
+        const documentHandles = Bridge.document.handlesFor(document == null ? [] : [document]);
+        return documentsHash(documentHandles.deref());
     }
     /**
      * Returns a pattern of words that together create a mnemonic, which
      * represents the set of matching documents.
      */
     hashMnemonic(document) {
-        return documentsHashMnemonic(document === null ? [] : [Bridge.document.pointerFor(document)]);
+        const documentHandles = Bridge.document.handlesFor(document == null ? [] : [document]);
+        return documentsHashMnemonic(documentHandles.deref());
     }
     /** @internal */
     constructor(isInitial, oldDocument) {
@@ -4241,24 +4356,18 @@ class LiveQuery {
     }
     /** Returns true if the receiver has been stopped. */
     get isStopped() {
-        return this.liveQueryID === null;
+        return !this.liveQueryManager;
     }
     /**
      * Stop the live query from delivering updates.
      */
     stop() {
-        var _a;
-        const liveQueryID = this.liveQueryID;
-        if (liveQueryID !== null) {
-            this.collection.store.ditto.keepAlive.release(`LiveQuery.${liveQueryID}`);
-            this.liveQueryID = null;
-            const dittoPointer = Bridge.ditto.pointerFor(this.collection.store.ditto);
-            (_a = this.subscription) === null || _a === void 0 ? void 0 : _a.cancel();
-            liveQueryStop(dittoPointer, liveQueryID);
+        if (!this.isStopped) {
+            this.liveQueryManager.stopLiveQuery(this);
         }
     }
     /** @internal */
-    constructor(query, queryArgs, queryArgsCBOR, orderBys, limit, offset, collection, subscription, handler) {
+    constructor(query, queryArgs, queryArgsCBOR, orderBys, limit, offset, collection, handler) {
         // Query should be validated at this point.
         this.query = query;
         this.queryArgs = queryArgs ? Object.freeze({ ...queryArgs }) : null;
@@ -4268,52 +4377,59 @@ class LiveQuery {
         this.offset = offset;
         this.collection = collection;
         this.handler = handler;
-        if (subscription) {
-            this.subscription = subscription;
-        }
+        this.liveQueryManager = null;
         const collectionName = collection.name;
         const weakDitto = new WeakRef(collection.store.ditto);
         let liveQueryID = undefined;
         const signalNext = async () => {
             const ditto = weakDitto.deref();
-            if (ditto) {
-                const dittoPointer = Bridge.ditto.pointerFor(ditto);
+            if (!ditto)
+                return;
+            const dittoHandle = Bridge.ditto.handleFor(ditto);
+            const dittoPointer = dittoHandle.derefOrNull();
+            if (!dittoPointer)
+                return;
+            return ditto.deferCloseAsync(async () => {
                 await liveQuerySignalAvailableNext(dittoPointer, liveQueryID);
-            }
+            });
         };
-        const dittoPointer = Bridge.ditto.pointerFor(collection.store.ditto);
-        liveQueryID = liveQueryRegister(dittoPointer, collectionName, query, queryArgsCBOR, this.orderBys, limit, offset, (cCBParams) => {
-            const documents = cCBParams.documents.map((ptr) => Bridge.document.bridge(ptr));
-            let event;
-            if (cCBParams.is_initial) {
-                event = new LiveQueryEventInitial();
-            }
-            else {
-                event = new LiveQueryEventUpdate({
-                    oldDocuments: cCBParams.old_documents.map((ptr) => Bridge.document.bridge(ptr)),
-                    insertions: cCBParams.insertions,
-                    deletions: cCBParams.deletions,
-                    updates: cCBParams.updates,
-                    moves: cCBParams.moves.map((move) => ({ from: move[0], to: move[1] })),
-                });
+        const ditto = collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            liveQueryID = liveQueryRegister(dittoHandle.deref(), collectionName, query, queryArgsCBOR, this.orderBys, limit, offset, (cCBParams) => {
+                const documents = cCBParams.documents.map((ptr) => Bridge.document.bridge(ptr));
+                let event;
+                if (cCBParams.is_initial) {
+                    event = new LiveQueryEventInitial();
+                }
+                else {
+                    event = new LiveQueryEventUpdate({
+                        oldDocuments: cCBParams.old_documents.map((ptr) => Bridge.document.bridge(ptr)),
+                        insertions: cCBParams.insertions,
+                        deletions: cCBParams.deletions,
+                        updates: cCBParams.updates,
+                        moves: cCBParams.moves.map((move) => ({ from: move[0], to: move[1] })),
+                    });
+                }
+                handler(documents, event, signalNext);
+            });
+            if (!liveQueryID) {
+                throw new Error("Internal inconsistency, couldn't create a valid live query ID.");
             }
-            handler(documents, event, signalNext);
+            this['liveQueryID'] = liveQueryID;
         });
-        if (!liveQueryID) {
-            throw new Error("Internal inconsistency, couldn't create a valid live query ID.");
-        }
-        this.liveQueryID = liveQueryID;
-        // not awaited on purpose; let the invocation of the initial observation
-        // happen in a "fire-and-forget" / detached / escaping fashion, to be
-        // consistent with the subsequent invocations.
-        step(async () => await liveQueryStart(dittoPointer, liveQueryID));
-        collection.store.ditto.keepAlive.retain(`LiveQuery.${liveQueryID}`);
     }
     /** @internal */
     async signalNext() {
         // IDEA: make this public?
-        const dittoPointer = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        await liveQuerySignalAvailableNext(dittoPointer, this.liveQueryID);
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        const dittoPointer = dittoHandle.derefOrNull();
+        if (!dittoPointer)
+            return;
+        return ditto.deferCloseAsync(async () => {
+            await liveQuerySignalAvailableNext(dittoHandle.deref(), this.liveQueryID);
+        });
     }
 }
 
@@ -4355,40 +4471,48 @@ class PendingCursorOperation extends BasePendingCursorOperation {
         return super.limit(limit);
     }
     async remove() {
-        const query = this.query;
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            const writeTransactionX = await writeTransaction(dittoX);
-            const results = await collectionRemoveQueryStr(dittoX, this.collection.name, writeTransactionX, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
-            await writeTransactionCommit(dittoX, writeTransactionX);
-            return results;
-        });
-        return documentsX.map((idCBOR) => {
-            return new DocumentID(idCBOR, true);
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const query = this.query;
+            const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                const writeTransactionX = await writeTransaction(dittoHandle.deref());
+                const results = await collectionRemoveQueryStr(dittoHandle.deref(), this.collection.name, writeTransactionX, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
+                await writeTransactionCommit(dittoHandle.deref(), writeTransactionX);
+                return results;
+            });
+            return documentsX.map((idCBOR) => {
+                return new DocumentID(idCBOR, true);
+            });
         });
     }
     async evict() {
-        const query = this.query;
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            const writeTransactionX = await writeTransaction(dittoX);
-            const results = await collectionEvictQueryStr(dittoX, this.collection.name, writeTransactionX, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
-            await writeTransactionCommit(dittoX, writeTransactionX);
-            return results;
-        });
-        return documentsX.map((idCBOR) => {
-            return new DocumentID(idCBOR, true);
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const query = this.query;
+            const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                const writeTransactionX = await writeTransaction(dittoHandle.deref());
+                const results = await collectionEvictQueryStr(dittoHandle.deref(), this.collection.name, writeTransactionX, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
+                await writeTransactionCommit(dittoHandle.deref(), writeTransactionX);
+                return results;
+            });
+            return documentsX.map((idCBOR) => {
+                return new DocumentID(idCBOR, true);
+            });
         });
     }
     async update(closure) {
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const results = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            const writeTransactionX = await writeTransaction(dittoX);
-            const results = await super.updateWithTransaction(closure, writeTransactionX);
-            await writeTransactionCommit(dittoX, writeTransactionX);
-            return results;
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                const writeTransactionX = await writeTransaction(dittoHandle.deref());
+                const results = await super.updateWithTransaction(closure, writeTransactionX);
+                await writeTransactionCommit(dittoHandle.deref(), writeTransactionX);
+                return results;
+            });
         });
-        return results;
     }
     /**
      * Enables you to subscribe to changes that occur in a collection remotely.
@@ -4406,7 +4530,9 @@ class PendingCursorOperation extends BasePendingCursorOperation {
      * query specified in the preceding chain.
      */
     subscribe() {
-        return new Subscription(this.collection, this.query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
+        const subscription = new Subscription(this.collection, this.query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset);
+        this.collection.store.ditto.subscriptionManager.add(subscription);
+        return subscription;
     }
     /**
      * Enables you to listen for changes that occur in a collection locally.
@@ -4433,7 +4559,7 @@ class PendingCursorOperation extends BasePendingCursorOperation {
      * as you want to keep receiving updates.
      */
     observeLocal(handler) {
-        return this._observe(handler, false, false);
+        return this._observe(handler, false);
     }
     /**
      * Enables you to listen for changes that occur in a collection locally and
@@ -4462,7 +4588,7 @@ class PendingCursorOperation extends BasePendingCursorOperation {
      * as you want to keep receiving updates.
      */
     observeLocalWithNextSignal(handler) {
-        return this._observe(handler, false, true);
+        return this._observe(handler, true);
     }
     // ----------------------------------------------------------- Internal ------
     /** @internal */
@@ -4470,8 +4596,7 @@ class PendingCursorOperation extends BasePendingCursorOperation {
         super(query, queryArgs, collection);
     }
     /** @internal */
-    _observe(handler, createSubscription, waitForNextSignal) {
-        const subscription = createSubscription ? this.subscribe() : null;
+    _observe(handler, waitForNextSignal) {
         function wrappedHandler(documents, event, nextSignal) {
             try {
                 return handler.call(this, documents, event);
@@ -4481,7 +4606,9 @@ class PendingCursorOperation extends BasePendingCursorOperation {
             }
         }
         const handlerOrWrapped = waitForNextSignal ? handler : wrappedHandler;
-        return new LiveQuery(this.query, this.queryArgs, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset, this.collection, subscription, handlerOrWrapped);
+        const liveQuery = new LiveQuery(this.query, this.queryArgs, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset, this.collection, handlerOrWrapped);
+        this.collection.store.ditto.liveQueryManager.startLiveQuery(liveQuery);
+        return liveQuery;
     }
 }
 
@@ -4509,39 +4636,48 @@ class PendingCursorOperation extends BasePendingCursorOperation {
  */
 class PendingIDSpecificOperation extends BasePendingIDSpecificOperation {
     async remove() {
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            const writeTransactionX = await writeTransaction(dittoX);
-            const didRemove = await collectionRemove(dittoX, this.collection.name, writeTransactionX, this.documentIDCBOR);
-            await writeTransactionCommit(dittoX, writeTransactionX);
-            return didRemove;
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                const writeTransactionX = await writeTransaction(dittoHandle.deref());
+                const didRemove = await collectionRemove(dittoHandle.deref(), this.collection.name, writeTransactionX, this.documentIDCBOR);
+                await writeTransactionCommit(dittoHandle.deref(), writeTransactionX);
+                return didRemove;
+            });
         });
     }
     async evict() {
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            const writeTransactionX = await writeTransaction(dittoX);
-            const didEvict = await collectionEvict(dittoX, this.collection.name, writeTransactionX, this.documentIDCBOR);
-            await writeTransactionCommit(dittoX, writeTransactionX);
-            return didEvict;
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            return await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                const writeTransactionX = await writeTransaction(dittoHandle.deref());
+                const didEvict = await collectionEvict(dittoHandle.deref(), this.collection.name, writeTransactionX, this.documentIDCBOR);
+                await writeTransactionCommit(dittoHandle.deref(), writeTransactionX);
+                return didEvict;
+            });
         });
     }
     async update(closure) {
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const readTransactionX = await readTransaction(dittoX);
-        const documentX = await collectionGet(dittoX, this.collection.name, this.documentIDCBOR, readTransactionX);
-        readTransactionFree(readTransactionX);
-        if (!documentX)
-            throw new Error(`Can't update, document with ID '${this.documentID.toString()}' not found in collection named '${this.collection.name}'`);
-        const mutableDocument = Bridge.mutableDocument.bridge(documentX, () => new MutableDocument());
-        closure(mutableDocument);
-        // Ownership is transferred back to the FFI layer via collectionUpdate(),
-        // we therefore need to explicitly unregister the instance.
-        Bridge.mutableDocument.unregister(mutableDocument);
-        const writeTransactionX = await writeTransaction(dittoX);
-        await collectionUpdate(dittoX, this.collection.name, writeTransactionX, documentX);
-        await writeTransactionCommit(dittoX, writeTransactionX);
-        return mutableDocument['@ditto.updateResults'].slice();
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const readTransactionX = await readTransaction(dittoHandle.deref());
+            const documentX = await collectionGet(dittoHandle.deref(), this.collection.name, this.documentIDCBOR, readTransactionX);
+            readTransactionFree(readTransactionX);
+            if (!documentX)
+                throw new Error(`Can't update, document with ID '${this.documentID.toString()}' not found in collection named '${this.collection.name}'`);
+            const mutableDocument = Bridge.mutableDocument.bridge(documentX, () => new MutableDocument());
+            closure(mutableDocument);
+            // Ownership is transferred back to the FFI layer via collectionUpdate(),
+            // we therefore need to explicitly unregister the instance.
+            Bridge.mutableDocument.unregister(mutableDocument);
+            const writeTransactionX = await writeTransaction(dittoHandle.deref());
+            await collectionUpdate(dittoHandle.deref(), this.collection.name, writeTransactionX, documentX);
+            await writeTransactionCommit(dittoHandle.deref(), writeTransactionX);
+            return mutableDocument['@ditto.updateResults'].slice();
+        });
     }
     /**
      * Enables you to subscribe to changes that occur in relation to a document
@@ -4558,7 +4694,9 @@ class PendingIDSpecificOperation extends BasePendingIDSpecificOperation {
      * long as you want to keep receiving updates for the document.
      */
     subscribe() {
-        return new Subscription(this.collection, this.query, null, [], -1, 0);
+        const subscription = new Subscription(this.collection, this.query, null, [], -1, 0);
+        this.collection.store.ditto.subscriptionManager.add(subscription);
+        return subscription;
     }
     /**
      * Enables you to listen for changes that occur in relation to a document
@@ -4583,7 +4721,7 @@ class PendingIDSpecificOperation extends BasePendingIDSpecificOperation {
      * as you want to keep receiving updates.
      */
     observeLocal(handler) {
-        return this._observe(handler, false, false);
+        return this._observe(handler, false);
     }
     /**
      * Enables you to listen for changes that occur in relation to a document
@@ -4609,16 +4747,15 @@ class PendingIDSpecificOperation extends BasePendingIDSpecificOperation {
      * as you want to keep receiving updates.
      */
     observeLocalWithNextSignal(handler) {
-        return this._observe(handler, false, true);
+        return this._observe(handler, true);
     }
     /** @internal */
     constructor(documentID, collection) {
         super(documentID, collection);
     }
     /** @internal */
-    _observe(handler, createSubscription, waitForNextSignal) {
-        const subscription = createSubscription ? this.subscribe() : null;
-        return new LiveQuery(this.query, null, null, [], -1, 0, this.collection, subscription, (documents, event, signalNext) => {
+    _observe(handler, waitForNextSignal) {
+        const liveQuery = new LiveQuery(this.query, null, null, [], -1, 0, this.collection, (documents, event, signalNext) => {
             if (documents.length > 1) {
                 const documentIDsAsBase64Strings = documents.map((document) => document.id.toBase64String());
                 throw new Error(`Internal inconsistency, single document live query returned more than one document. Query: ${this.query}, documentIDs: ${documentIDsAsBase64Strings.join(', ')}.`);
@@ -4653,6 +4790,8 @@ class PendingIDSpecificOperation extends BasePendingIDSpecificOperation {
                 }
             }
         });
+        this.collection.store.ditto.liveQueryManager.startLiveQuery(liveQuery);
+        return liveQuery;
     }
 }
 
@@ -4712,28 +4851,18 @@ class Collection {
         return new PendingIDSpecificOperation(documentID, this);
     }
     async upsert(value, options = {}) {
-        var _a;
-        const writeStrategy = (_a = options.writeStrategy) !== null && _a !== void 0 ? _a : 'merge';
         const ditto = this.store.ditto;
-        const dittoPointer = Bridge.ditto.pointerFor(ditto);
-        const id = value._id;
-        let documentID;
-        if (typeof id === 'undefined') {
-            documentID = undefined;
-        }
-        else if (id instanceof DocumentID) {
-            documentID = id;
-        }
-        else {
-            documentID = new DocumentID(id);
-        }
-        const documentIDCBOR = typeof documentID === 'undefined' ? null : documentID.toCBOR();
-        const documentValueJSON = desugarJSObject(value, true);
-        const documentValueCBOR = CBOR.encode(documentValueJSON);
-        const idCBOR = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            return await collectionInsertValue(dittoPointer, this.name, documentValueCBOR, documentIDCBOR, writeStrategy, undefined);
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            var _a;
+            const writeStrategy = (_a = options.writeStrategy) !== null && _a !== void 0 ? _a : 'merge';
+            const documentValueJSON = desugarJSObject(value, true);
+            const documentValueCBOR = CBOR.encode(documentValueJSON);
+            const idCBOR = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                return await collectionInsertValue(dittoHandle.deref(), this.name, documentValueCBOR, writeStrategy, undefined);
+            });
+            return new DocumentID(idCBOR, true);
         });
-        return new DocumentID(idCBOR, true);
     }
     /**
      * Creates a new {@link Attachment} object, which can then be inserted into a
@@ -4763,23 +4892,25 @@ class Collection {
      */
     async newAttachment(pathOrData, metadata = {}) {
         const ditto = this.store.ditto;
-        const dittoPointer = Bridge.ditto.pointerFor(ditto);
-        const { id, len, handle } = await (async () => {
-            if (typeof pathOrData === 'string') {
-                {
-                    return dittoNewAttachmentFromFile(dittoPointer, pathOrData, 'Copy');
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const { id, len, handle } = await (async () => {
+                if (typeof pathOrData === 'string') {
+                    {
+                        return dittoNewAttachmentFromFile(dittoHandle.deref(), pathOrData, 'Copy');
+                    }
                 }
-            }
-            if (pathOrData instanceof Uint8Array) {
-                return await dittoNewAttachmentFromBytes(dittoPointer, pathOrData);
-            }
-            throw new Error(`Can't create new attachment, only file path as string or raw data as Uint8Array are supported, but got: ${typeof pathOrData}, ${pathOrData}`);
-        })();
-        const attachmentTokenJSON = { _id: id, _len: len, _meta: { ...metadata } };
-        attachmentTokenJSON[DittoCRDTTypeKey] = DittoCRDTType.attachment;
-        const attachmentToken = new AttachmentToken(attachmentTokenJSON);
-        const attachment = new Attachment(ditto, attachmentToken);
-        return Bridge.attachment.bridge(handle, () => attachment);
+                if (pathOrData instanceof Uint8Array) {
+                    return await dittoNewAttachmentFromBytes(dittoHandle.deref(), pathOrData);
+                }
+                throw new Error(`Can't create new attachment, only file path as string or raw data as Uint8Array are supported, but got: ${typeof pathOrData}, ${pathOrData}`);
+            })();
+            const attachmentTokenJSON = { _id: id, _len: len, _meta: { ...metadata } };
+            attachmentTokenJSON[DittoCRDTTypeKey] = DittoCRDTType.attachment;
+            const attachmentToken = new AttachmentToken(attachmentTokenJSON);
+            const attachment = new Attachment(ditto, attachmentToken);
+            return Bridge.attachment.bridge(handle, () => attachment);
+        });
     }
     /**
      * Trigger an attachment to be downloaded locally to the device and observe
@@ -4806,8 +4937,13 @@ class Collection {
      * fetch status changes.
      */
     fetchAttachment(token, eventHandler) {
+        if (token == null || !(token instanceof AttachmentToken)) {
+            throw new Error(`Invalid attachment token: ${token}`);
+        }
         const ditto = this.store.ditto;
-        return new AttachmentFetcher(ditto, token, eventHandler);
+        return ditto.deferClose(() => {
+            return ditto.attachmentFetcherManager.startAttachmentFetcher(token, eventHandler);
+        });
     }
     /** @internal */
     constructor(name, store) {
@@ -4959,7 +5095,7 @@ class PendingCollectionsOperation {
      * as you want to keep receiving updates.
      */
     observeLocal(handler) {
-        return this._observe(handler, false, false);
+        return this._observe(handler, false);
     }
     /**
      * Enables you to listen for changes that occur in relation to the collections
@@ -4980,7 +5116,7 @@ class PendingCollectionsOperation {
      * as you want to keep receiving updates.
      */
     observeLocalWithNextSignal(handler) {
-        return this._observe(handler, false, true);
+        return this._observe(handler, true);
     }
     /**
      * Return the list of collections requested based on the preceding function
@@ -5004,7 +5140,7 @@ class PendingCollectionsOperation {
     }
     // ----------------------------------------------------------- Internal ------
     /** @internal */
-    _observe(handler, createSubscription, waitForNextSignal) {
+    _observe(handler, waitForNextSignal) {
         const weakStore = new WeakRef(this.store);
         const collectionsObservationHandler = function (documents, event, nextSignal) {
             const strongStore = weakStore.deref();
@@ -5035,7 +5171,7 @@ class PendingCollectionsOperation {
                 handler(collEvent);
             }
         };
-        return this.pendingCursorOperation._observe(collectionsObservationHandler, createSubscription, waitForNextSignal);
+        return this.pendingCursorOperation._observe(collectionsObservationHandler, waitForNextSignal);
     }
 }
 /** @private */
@@ -5076,16 +5212,23 @@ class ExperimentalStore {
      * @returns a promise for an array of Ditto documents matching the query
      **/
     async execute(query) {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        // A one-off query execution uses a transaction internally but a transaction
-        // API is not implemented yet.
-        const writeTransaction = null;
-        // Not implemented yet.
-        const queryParameters = null;
-        const documentPointers = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            return await experimentalExecQueryStr(dittoPointer, writeTransaction, query, queryParameters);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            // A one-off query execution uses a transaction internally but a
+            // transaction API is not implemented yet.
+            const writeTransaction = null;
+            // Not implemented yet.
+            const queryParameters = null;
+            const documentPointers = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                return await experimentalExecQueryStr(dittoHandle.deref(), writeTransaction, query, queryParameters);
+            });
+            return documentPointers.map((documentPointer) => Bridge.document.bridge(documentPointer));
         });
-        return documentPointers.map((documentPointer) => Bridge.document.bridge(documentPointer));
+    }
+    /** @internal */
+    close() {
+        // Nothing to do yet.
     }
 }
 
@@ -5115,30 +5258,36 @@ class WriteTransactionPendingCursorOperation extends BasePendingCursorOperation
         return super.limit(limit);
     }
     async remove() {
-        const query = this.query;
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const transaction = this.collection.writeTransaction;
-        const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => collectionRemoveQueryStr(dittoX, this.collection.name, transaction.writeTransactionPointer, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset));
-        const results = documentsX.map((idCBOR) => {
-            return new DocumentID(idCBOR, true);
-        });
-        results.forEach((documentId) => {
-            transaction.addResult('removed', documentId, this.collection.name);
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const query = this.query;
+            const transaction = this.collection.writeTransaction;
+            const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => collectionRemoveQueryStr(dittoHandle.deref(), this.collection.name, transaction.writeTransactionPointer, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset));
+            const results = documentsX.map((idCBOR) => {
+                return new DocumentID(idCBOR, true);
+            });
+            results.forEach((documentId) => {
+                transaction.addResult('removed', documentId, this.collection.name);
+            });
+            return results;
         });
-        return results;
     }
     async evict() {
-        const query = this.query;
-        const dittoX = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const transaction = this.collection.writeTransaction;
-        const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => collectionEvictQueryStr(dittoX, this.collection.name, transaction.writeTransactionPointer, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset));
-        const results = documentsX.map((idCBOR) => {
-            return new DocumentID(idCBOR, true);
-        });
-        results.forEach((documentId) => {
-            transaction.addResult('evicted', documentId, this.collection.name);
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const query = this.query;
+            const transaction = this.collection.writeTransaction;
+            const documentsX = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => collectionEvictQueryStr(dittoHandle.deref(), this.collection.name, transaction.writeTransactionPointer, query, this.queryArgsCBOR, this.orderBys, this.currentLimit, this.currentOffset));
+            const results = documentsX.map((idCBOR) => {
+                return new DocumentID(idCBOR, true);
+            });
+            results.forEach((documentId) => {
+                transaction.addResult('evicted', documentId, this.collection.name);
+            });
+            return results;
         });
-        return results;
     }
     async update(closure) {
         const transaction = this.collection.writeTransaction;
@@ -5158,35 +5307,44 @@ class WriteTransactionPendingCursorOperation extends BasePendingCursorOperation
 //
 class WriteTransactionPendingIDSpecificOperation extends BasePendingIDSpecificOperation {
     async remove() {
-        const dittoPointer = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const transaction = this.collection.writeTransaction;
-        const result = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => collectionRemove(dittoPointer, this.collection.name, transaction.writeTransactionPointer, this.documentIDCBOR));
-        transaction.addResult('removed', this.documentID, this.collection.name);
-        return result;
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const transaction = this.collection.writeTransaction;
+            const result = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => collectionRemove(dittoHandle.deref(), this.collection.name, transaction.writeTransactionPointer, this.documentIDCBOR));
+            transaction.addResult('removed', this.documentID, this.collection.name);
+            return result;
+        });
     }
     async evict() {
-        const dittoPointer = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const transaction = this.collection.writeTransaction;
-        const result = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => await collectionEvict(dittoPointer, this.collection.name, transaction.writeTransactionPointer, this.documentIDCBOR));
-        transaction.addResult('evicted', this.documentID, this.collection.name);
-        return result;
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const transaction = this.collection.writeTransaction;
+            const result = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => await collectionEvict(dittoHandle.deref(), this.collection.name, transaction.writeTransactionPointer, this.documentIDCBOR));
+            transaction.addResult('evicted', this.documentID, this.collection.name);
+            return result;
+        });
     }
     async update(closure) {
-        const dittoPointer = Bridge.ditto.pointerFor(this.collection.store.ditto);
-        const transaction = this.collection.writeTransaction;
-        const readTransactionX = await readTransaction(dittoPointer);
-        const documentX = await collectionGet(dittoPointer, this.collection.name, this.documentIDCBOR, readTransactionX);
-        readTransactionFree(readTransactionX);
-        if (!documentX)
-            throw new Error(`Can't update, document with ID '${this.documentID.toString()}' not found in collection named '${this.collection.name}'`);
-        const mutableDocument = Bridge.mutableDocument.bridge(documentX, () => new MutableDocument());
-        closure(mutableDocument);
-        // Ownership is transferred back to the FFI layer via collectionUpdate(),
-        // we therefore need to explicitly unregister the instance.
-        Bridge.mutableDocument.unregister(mutableDocument);
-        await collectionUpdate(dittoPointer, this.collection.name, transaction.writeTransactionPointer, documentX);
-        transaction.addResult('updated', this.documentID, this.collection.name);
-        return mutableDocument['@ditto.updateResults'].slice();
+        const ditto = this.collection.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const transaction = this.collection.writeTransaction;
+            const readTransactionX = await readTransaction(dittoHandle.deref());
+            const documentX = await collectionGet(dittoHandle.deref(), this.collection.name, this.documentIDCBOR, readTransactionX);
+            readTransactionFree(readTransactionX);
+            if (!documentX)
+                throw new Error(`Can't update, document with ID '${this.documentID.toString()}' not found in collection named '${this.collection.name}'`);
+            const mutableDocument = Bridge.mutableDocument.bridge(documentX, () => new MutableDocument());
+            closure(mutableDocument);
+            // Ownership is transferred back to the FFI layer via collectionUpdate(),
+            // we therefore need to explicitly unregister the instance.
+            Bridge.mutableDocument.unregister(mutableDocument);
+            await collectionUpdate(dittoHandle.deref(), this.collection.name, transaction.writeTransactionPointer, documentX);
+            transaction.addResult('updated', this.documentID, this.collection.name);
+            return mutableDocument['@ditto.updateResults'].slice();
+        });
     }
     // ----------------------------------------------------------- Internal ------
     /** @internal */
@@ -5241,30 +5399,20 @@ class WriteTransactionCollection {
         return new WriteTransactionPendingIDSpecificOperation(documentID, this);
     }
     async upsert(value, options = {}) {
-        var _a;
-        const writeStrategy = (_a = options.writeStrategy) !== null && _a !== void 0 ? _a : 'merge';
-        const dittoPointer = Bridge.ditto.pointerFor(this.store.ditto);
-        const id = value._id;
-        let documentID;
-        if (typeof id === 'undefined') {
-            documentID = undefined;
-        }
-        else if (id instanceof DocumentID) {
-            documentID = id;
-        }
-        else {
-            documentID = new DocumentID(id);
-        }
-        const documentIDCBOR = typeof documentID === 'undefined' ? null : documentID.toCBOR();
-        const documentValueJSON = desugarJSObject(value, true);
-        const documentValueCBOR = CBOR.encode(documentValueJSON);
-        const idCBOR = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
-            // @ts-ignore
-            return await collectionInsertValue(dittoPointer, this.name, documentValueCBOR, documentIDCBOR, writeStrategy, this.writeTransaction.writeTransactionPointer);
+        const ditto = this.store.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            var _a;
+            const writeStrategy = (_a = options.writeStrategy) !== null && _a !== void 0 ? _a : 'merge';
+            const documentValueJSON = desugarJSObject(value, true);
+            const documentValueCBOR = CBOR.encode(documentValueJSON);
+            const idCBOR = await performAsyncToWorkaroundNonAsyncFFIAPI(async () => {
+                return await collectionInsertValue(dittoHandle.deref(), this.name, documentValueCBOR, writeStrategy, this.writeTransaction.writeTransactionPointer);
+            });
+            const insertedDocumentId = new DocumentID(idCBOR, true);
+            this.writeTransaction.addResult('inserted', insertedDocumentId, this.name);
+            return new DocumentID(idCBOR, true);
         });
-        const insertedDocumentId = new DocumentID(idCBOR, true);
-        this.writeTransaction.addResult('inserted', insertedDocumentId, this.name);
-        return new DocumentID(idCBOR, true);
     }
     /**
      * See comment in {@link CollectionInterface.findByIDCBOR()}
@@ -5303,9 +5451,11 @@ class WriteTransaction {
      * @internal
      */
     static async init(ditto) {
-        const dittoPointer = Bridge.ditto.pointerFor(ditto);
-        const writeTransactionPointer = await writeTransaction(dittoPointer);
-        return new WriteTransaction(ditto, writeTransactionPointer);
+        return ditto.deferCloseAsync(async () => {
+            const dittoHandle = Bridge.ditto.handleFor(ditto);
+            const writeTransactionPointer = await writeTransaction(dittoHandle.deref());
+            return new WriteTransaction(ditto, writeTransactionPointer);
+        });
     }
     /**
      * Creates a transaction-specific
@@ -5324,13 +5474,19 @@ class WriteTransaction {
     // ----------------------------------------------------------- Internal ------
     /** @internal */
     async commit() {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        return writeTransactionCommit(dittoPointer, this.writeTransactionPointer);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            return writeTransactionCommit(dittoHandle.deref(), this.writeTransactionPointer);
+        });
     }
     /** @internal */
     async rollback() {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        return writeTransactionRollback(dittoPointer, this.writeTransactionPointer);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            return writeTransactionRollback(dittoHandle.deref(), this.writeTransactionPointer);
+        });
     }
     /**
      * Adds an entry to the list of results that is returned at the end of a
@@ -5377,14 +5533,18 @@ class Store {
      * fetch or observe the collections in the store
      */
     collections() {
-        return new PendingCollectionsOperation(this.ditto.store);
+        return new PendingCollectionsOperation(this);
     }
     /**
      * Returns the names of all available collections in the store of the
      * related {@link Ditto} instance.
      */
     collectionNames() {
-        return dittoGetCollectionNames(Bridge.ditto.pointerFor(this.ditto));
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferClose(() => {
+            return dittoGetCollectionNames(dittoHandle.deref());
+        });
     }
     /**
      * Initiate a write transaction in a callback.
@@ -5395,26 +5555,20 @@ class Store {
      * @returns a list of `WriteTransactionResult`s. There is a result for each operation performed as part of the write transaction.
      */
     async write(callback) {
-        const transaction = await WriteTransaction.init(this.ditto);
         // Run caller's callback, rolling back if needed.
-        try {
-            await callback(transaction);
-        }
-        catch (error) {
-            await transaction.rollback();
-            Logger.warning(`Transaction rolled back due to an error: ${error === null || error === void 0 ? void 0 : error.message}`);
-            throw error;
-        }
-        // Commit transaction, rolling back if needed.
-        try {
+        return this.ditto.deferCloseAsync(async () => {
+            const transaction = await WriteTransaction.init(this.ditto);
+            try {
+                await callback(transaction);
+            }
+            catch (error) {
+                await transaction.rollback();
+                Logger.warning(`Transaction rolled back due to an error: ${error === null || error === void 0 ? void 0 : error.message}`);
+                throw error;
+            }
             await transaction.commit();
-        }
-        catch (error) {
-            await transaction.rollback();
-            Logger.warning(`Transaction rolled back due to an error: ${error === null || error === void 0 ? void 0 : error.message}`);
-            throw error;
-        }
-        return transaction.results;
+            return transaction.results;
+        });
     }
     // ----------------------------------------------------------- Internal ------
     /** @internal */
@@ -5422,14 +5576,24 @@ class Store {
         this.ditto = ditto;
         this.experimental = new ExperimentalStore(ditto);
     }
+    /** @internal */
+    close() {
+        this.experimental.close();
+        // NOTE: live query webhook is taken care of by the FFI's
+        // `ditto_shutdown()`, no need to unregister it here.
+    }
     /**
      * Private method, used only by the Portal https://github.com/getditto/ditto/pull/3652
      * @internal
      */
     async registerLiveQueryWebhook(collectionName, query, url) {
-        const validatedQuery = validateQuery(query);
-        const idCBOR = await liveQueryWebhookRegister(Bridge.ditto.pointerFor(this.ditto), collectionName, validatedQuery, [], 0, 0, url);
-        return new DocumentID(idCBOR, true);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferCloseAsync(async () => {
+            const validatedQuery = validateQuery(query);
+            const idCBOR = await liveQueryWebhookRegister(dittoHandle.deref(), collectionName, validatedQuery, [], 0, 0, url);
+            return new DocumentID(idCBOR, true);
+        });
     }
 }
 
@@ -5457,9 +5621,12 @@ class Presence {
      * connections between them.
      */
     get graph() {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        const graphJSONString = dittoPresenceV3(dittoPointer);
-        return JSON.parse(graphJSONString);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferClose(() => {
+            const graphJSONString = dittoPresenceV3(dittoHandle.deref());
+            return JSON.parse(graphJSONString);
+        });
     }
     /**
      * Request information about Ditto peers in range of this device.
@@ -5486,12 +5653,18 @@ class Presence {
         this.observerManager = new ObserverManager('PresenceObservation', {
             keepAlive: ditto.keepAlive,
             register: (callback) => {
-                const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-                dittoRegisterPresenceV3Callback(dittoPointer, callback);
+                const ditto = this.ditto;
+                const dittoHandle = Bridge.ditto.handleFor(ditto);
+                ditto.deferClose(() => {
+                    dittoRegisterPresenceV3Callback(dittoHandle.deref(), callback);
+                });
             },
             unregister: () => {
-                const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-                dittoClearPresenceV3Callback(dittoPointer);
+                const ditto = this.ditto;
+                const dittoHandle = Bridge.ditto.handleFor(ditto);
+                ditto.deferClose(() => {
+                    dittoClearPresenceV3Callback(dittoHandle.deref());
+                });
             },
             process: (presenceGraphJSONString) => {
                 const presenceGraph = JSON.parse(presenceGraphJSONString);
@@ -5499,22 +5672,114 @@ class Presence {
             },
         });
     }
+    /** @internal */
+    close() {
+        this.observerManager.close();
+    }
+}
+
+//
+/** @internal */
+class LiveQueryManager {
+    /** @internal */
+    constructor(ditto, keepAlive) {
+        this.finalizationRegistry = new FinalizationRegistry(this.finalize);
+        this.ditto = ditto;
+        this.keepAlive = keepAlive;
+        this.liveQueriesByID = {};
+    }
+    /** @internal */
+    startLiveQuery(liveQuery) {
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        // REFACTOR: the starting closure runs detached from here which is a smell.
+        // Can we make this whole starting mechanism non-async? The culprit is
+        // the workaround for a zalgo with `ditto_live_query_start()` FFI function:
+        // It immediately triggers the live query handler making it run "in-line"
+        // when creating a live query, while subsequent invocations are async
+        // (by definition). This is a classic zalgo case. Fix by making
+        // `ditto_live_query_start()` trigger the first live query callback `async`,
+        // just like the subsequent ones.
+        ditto.deferCloseAsync(async () => {
+            const liveQueryID = liveQuery.liveQueryID;
+            if (!liveQueryID) {
+                throw new Error("Internal inconsistency, tried to add a live query that doesn't have a live query ID (probably stopped).");
+            }
+            const existingLiveQuery = this.liveQueriesByID[liveQueryID];
+            if (existingLiveQuery) {
+                throw new Error('Internal inconsistency, tried to add a live query with an ID that has already been added.');
+            }
+            const weakLiveQuery = new WeakRef(liveQuery);
+            this.liveQueriesByID[liveQueryID] = weakLiveQuery;
+            this.finalizationRegistry.register(liveQuery, liveQueryID, this.finalize);
+            liveQuery.liveQueryManager = this;
+            ditto.keepAlive.retain(`LiveQuery.${liveQueryID}`);
+            return new Promise((resolve, reject) => {
+                // not awaited on purpose; let the invocation of the initial observation
+                // happen in a "fire-and-forget" / detached / escaping fashion, to be
+                // consistent with the subsequent invocations.
+                step(async () => {
+                    await liveQueryStart(dittoHandle.deref(), liveQueryID);
+                    // @ts-ignore
+                    resolve();
+                });
+            });
+        });
+    }
+    /** @internal */
+    stopLiveQuery(liveQuery) {
+        this.finalizationRegistry.unregister(liveQuery);
+        const liveQueryID = liveQuery.liveQueryID;
+        if (!liveQueryID) {
+            throw new Error("Internal inconsistency, tried to remove a live query that doesn't have a live query ID (probably stopped).");
+        }
+        liveQuery.liveQueryManager = null;
+        this.stopLiveQueryWithID(liveQueryID);
+    }
+    /** @internal */
+    close() {
+        for (const liveQueryID in this.liveQueriesByID) {
+            const weakLiveQuery = this.liveQueriesByID[liveQueryID];
+            const liveQuery = weakLiveQuery.deref();
+            if (liveQuery) {
+                this.stopLiveQuery(liveQuery);
+            }
+        }
+    }
+    stopLiveQueryWithID(liveQueryID) {
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            liveQueryStop(dittoHandle.deref(), liveQueryID);
+            this.keepAlive.release(`LiveQuery.${liveQueryID}`);
+            delete this.liveQueriesByID[liveQueryID];
+        });
+    }
+    finalize(liveQueryID) {
+        this.stopLiveQueryWithID(liveQueryID);
+    }
 }
 
 //
 /**
-  @internal
-  @deprecated Replaced by `Presence`.
-  */
+ * @internal
+ * @deprecated Replaced by `Presence`.
+ */
 class PresenceManager {
     constructor(ditto) {
         this.ditto = ditto;
+        this.isClosed = false;
         this.isRegistered = false;
         this.currentRemotePeers = [];
         this.callbacksByPresenceToken = {};
     }
     /** @internal */
     addObserver(callback) {
+        if (this.isClosed) {
+            // REFACTOR: throw a catchable error here, such that calling code
+            // can be more specific when forwarding it to the user.
+            throw new Error(`Internal inconsistency, can't add presence observer, observer mananger close()-ed.`);
+        }
         this.registerIfNeeded();
         const token = generateEphemeralToken();
         this.callbacksByPresenceToken[token] = callback;
@@ -5529,31 +5794,62 @@ class PresenceManager {
     }
     /** @internal */
     removeObserver(token) {
-        this.ditto.keepAlive.release(`PresenceObservation.${token}`);
-        delete this.callbacksByPresenceToken[token];
-        this.unregisterIfNeeded();
+        const callback = this.callbacksByPresenceToken[token];
+        if (typeof callback === 'undefined') {
+            throw new Error(`Can't remove presence observer, token '${token}' has never been registered before.`);
+        }
+        if (callback === null) {
+            // Observer has already been removed, no-op.
+            return;
+        }
+        if (typeof this.callbacksByPresenceToken[token] != 'undefined') {
+            this.ditto.keepAlive.release(`PresenceObservation.${token}`);
+            // REFACTOR: not deleting the token here will keep eating up
+            // memory over long periods of time. We actually need to track
+            // the observer objects themselves and remove it from the table
+            // as soon as the observer object is garbage collected.
+            this.callbacksByPresenceToken[token] = null;
+            this.unregisterIfNeeded();
+        }
+    }
+    /** @internal */
+    hasObserver(token) {
+        return typeof this.callbacksByPresenceToken[token] != 'undefined';
+    }
+    /** @internal */
+    close() {
+        this.isClosed = true;
+        for (const token in this.callbacksByPresenceToken) {
+            this.removeObserver(token);
+        }
     }
     hasObservers() {
         return Object.keys(this.callbacksByPresenceToken).length > 0;
     }
     registerIfNeeded() {
-        const needsToRegister = !this.isRegistered;
-        if (needsToRegister) {
-            this.isRegistered = true;
-            const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-            const remotePeersJSONString = dittoPresenceV1(dittoPointer);
-            this.currentRemotePeers = this.decode(remotePeersJSONString).sort(this.compareRemotePeers);
-            dittoRegisterPresenceV1Callback(dittoPointer, this.handlePresenceV1Callback.bind(this));
-        }
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(this.ditto);
+        ditto.deferClose(() => {
+            const needsToRegister = !this.isRegistered;
+            if (needsToRegister) {
+                this.isRegistered = true;
+                const remotePeersJSONString = dittoPresenceV1(dittoHandle.deref());
+                this.currentRemotePeers = this.decode(remotePeersJSONString).sort(this.compareRemotePeers);
+                dittoRegisterPresenceV1Callback(dittoHandle.deref(), this.handlePresenceV1Callback.bind(this));
+            }
+        });
     }
     unregisterIfNeeded() {
-        const needsToUnregister = !this.hasObservers() && this.isRegistered;
-        if (needsToUnregister) {
-            this.isRegistered = false;
-            const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-            dittoRegisterPresenceV1Callback(dittoPointer, null);
-            this.currentRemotePeers = [];
-        }
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            const needsToUnregister = !this.hasObservers() && this.isRegistered;
+            if (needsToUnregister) {
+                this.isRegistered = false;
+                dittoClearPresenceCallback(dittoHandle.deref());
+                this.currentRemotePeers = [];
+            }
+        });
     }
     handlePresenceV1Callback(remotePeersJSONString) {
         const remotePeers = this.decode(remotePeersJSONString).sort(this.compareRemotePeers);
@@ -5561,6 +5857,10 @@ class PresenceManager {
         this.notify();
     }
     notify() {
+        if (this.isClosed) {
+            // NOTE: we don't notify observers after closing.
+            return;
+        }
         for (const token in this.callbacksByPresenceToken) {
             const callback = this.callbacksByPresenceToken[token];
             callback(this.currentRemotePeers);
@@ -5579,9 +5879,6 @@ class PresenceManager {
             };
         });
     }
-    finalize(token) {
-        this.removeObserver(token);
-    }
     compareRemotePeers(left, right) {
         // NOTE: we use the exact same sort order here as in the ObjC version.
         if (left.connections.length === 0 && right.connections.length > 0)
@@ -5605,12 +5902,18 @@ class TransportConditionsManager extends ObserverManager {
         this.ditto = ditto;
     }
     register(callback) {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        return dittoRegisterTransportConditionChangedCallback(dittoPointer, callback);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferClose(() => {
+            return dittoRegisterTransportConditionChangedCallback(dittoHandle.deref(), callback);
+        });
     }
     unregister() {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        return dittoRegisterTransportConditionChangedCallback(dittoPointer, null);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        return ditto.deferClose(() => {
+            return dittoRegisterTransportConditionChangedCallback(dittoHandle.deref(), null);
+        });
     }
     process(conditionSource, transportCondition) {
         /* eslint-disable */
@@ -5717,277 +6020,582 @@ class Sync {
         this.updateConnectRetryInterval(stateOld, stateNew);
         this.state = stateNew;
     }
+    /** @internal */
+    close() {
+        if (this.parameters.isSyncActive) {
+            throw new Error(`Internal inconsistency, can't close sync object while sync is active, please 'stopSync()' first.`);
+        }
+        // Nothing to do, when sync is stopped, this object should be
+        // already be cleaned up properly.
+    }
     updatePeerToPeerBluetoothLE(stateOld, stateNew) {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        const bluetoothLEOld = stateOld.effectiveTransportConfig.peerToPeer.bluetoothLE;
-        const bluetoothLENew = stateNew.effectiveTransportConfig.peerToPeer.bluetoothLE;
-        const shouldStart = !bluetoothLEOld.isEnabled && bluetoothLENew.isEnabled;
-        const shouldStop = bluetoothLEOld.isEnabled && !bluetoothLENew.isEnabled;
-        if (shouldStart && this.bluetoothLETransportPointer)
-            throw new Error(`Internal inconsistency, when starting BLE transport, no BLE transport pointer should exist.`);
-        if (shouldStop && !this.bluetoothLETransportPointer)
-            throw new Error(`Internal inconsistency, when stopping BLE transport, a BLE transport pointer should exist.`);
-        {
-            // HACK: quick & dirty Linux & Windows hack. A proper implementation
-            // should encapsulate everything behind the transports module. To undo,
-            // remove the whole if block.
-            if (process.platform === 'linux' || process.platform === 'win32') {
-                if (shouldStart) {
-                    const clientTransport = dittoAddInternalBLEClientTransport(dittoPointer);
-                    const serverTransport = dittoAddInternalBLEServerTransport(dittoPointer);
-                    const blePlatform = { clientTransport, serverTransport };
-                    this.bluetoothLETransportPointer = blePlatform;
-                }
-                if (shouldStop) {
-                    const blePlatform = this.bluetoothLETransportPointer;
-                    const { clientTransport, serverTransport } = blePlatform;
-                    bleServerFreeHandle(serverTransport);
-                    bleClientFreeHandle(clientTransport);
-                    this.bluetoothLETransportPointer = null;
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            const bluetoothLEOld = stateOld.effectiveTransportConfig.peerToPeer.bluetoothLE;
+            const bluetoothLENew = stateNew.effectiveTransportConfig.peerToPeer.bluetoothLE;
+            const shouldStart = !bluetoothLEOld.isEnabled && bluetoothLENew.isEnabled;
+            const shouldStop = bluetoothLEOld.isEnabled && !bluetoothLENew.isEnabled;
+            if (shouldStart && this.bluetoothLETransportPointer)
+                throw new Error(`Internal inconsistency, when starting BLE transport, no BLE transport pointer should exist.`);
+            if (shouldStop && !this.bluetoothLETransportPointer)
+                throw new Error(`Internal inconsistency, when stopping BLE transport, a BLE transport pointer should exist.`);
+            {
+                // HACK: quick & dirty Linux & Windows hack. A proper implementation
+                // should encapsulate everything behind the transports module. To undo,
+                // remove the whole if block.
+                if (process.platform === 'linux' || process.platform === 'win32') {
+                    if (shouldStart) {
+                        const clientTransport = dittoAddInternalBLEClientTransport(dittoHandle.deref());
+                        const serverTransport = dittoAddInternalBLEServerTransport(dittoHandle.deref());
+                        const blePlatform = { clientTransport, serverTransport };
+                        this.bluetoothLETransportPointer = blePlatform;
+                    }
+                    if (shouldStop) {
+                        const blePlatform = this.bluetoothLETransportPointer;
+                        const { clientTransport, serverTransport } = blePlatform;
+                        bleServerFreeHandle(serverTransport);
+                        bleClientFreeHandle(clientTransport);
+                        this.bluetoothLETransportPointer = null;
+                    }
+                    return;
                 }
-                return;
             }
-        }
-        if (shouldStart) {
-            this.bluetoothLETransportPointer = bleCreate(dittoPointer);
-        }
-        if (shouldStop) {
-            bleDestroy(this.bluetoothLETransportPointer);
-            delete this.bluetoothLETransportPointer;
-        }
+            if (shouldStart) {
+                this.bluetoothLETransportPointer = bleCreate(dittoHandle.deref());
+            }
+            if (shouldStop) {
+                bleDestroy(this.bluetoothLETransportPointer);
+                delete this.bluetoothLETransportPointer;
+            }
+        });
     }
     updatePeerToPeerAWDL(stateOld, stateNew) {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        const awdlOld = stateOld.effectiveTransportConfig.peerToPeer.awdl;
-        const awdlNew = stateNew.effectiveTransportConfig.peerToPeer.awdl;
-        const shouldStart = !awdlOld.isEnabled && awdlNew.isEnabled;
-        const shouldStop = awdlOld.isEnabled && !awdlNew.isEnabled;
-        if (shouldStart && this.awdlTransportPointer)
-            throw new Error(`Internal inconsistency, when starting AWDL transport, no AWDL transport pointer should exist.`);
-        if (shouldStop && !this.awdlTransportPointer)
-            throw new Error(`Internal inconsistency, when stopping AWDL transport, an AWDL transport pointer should exist.`);
-        if (shouldStart) {
-            this.awdlTransportPointer = awdlCreate(dittoPointer);
-        }
-        if (shouldStop) {
-            awdlDestroy(this.awdlTransportPointer);
-            this.awdlTransportPointer = null;
-        }
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            const awdlOld = stateOld.effectiveTransportConfig.peerToPeer.awdl;
+            const awdlNew = stateNew.effectiveTransportConfig.peerToPeer.awdl;
+            const shouldStart = !awdlOld.isEnabled && awdlNew.isEnabled;
+            const shouldStop = awdlOld.isEnabled && !awdlNew.isEnabled;
+            if (shouldStart && this.awdlTransportPointer)
+                throw new Error(`Internal inconsistency, when starting AWDL transport, no AWDL transport pointer should exist.`);
+            if (shouldStop && !this.awdlTransportPointer)
+                throw new Error(`Internal inconsistency, when stopping AWDL transport, an AWDL transport pointer should exist.`);
+            if (shouldStart) {
+                this.awdlTransportPointer = awdlCreate(dittoHandle.deref());
+            }
+            if (shouldStop) {
+                awdlDestroy(this.awdlTransportPointer);
+                this.awdlTransportPointer = null;
+            }
+        });
     }
     updatePeerToPeerLAN(stateOld, stateNew) {
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        const lanOld = stateOld.effectiveTransportConfig.peerToPeer.lan;
-        const lanNew = stateNew.effectiveTransportConfig.peerToPeer.lan;
-        {
-            // HACK: quick & dirty Linux & Windows hack. A proper implementation
-            // should encapsulate everything behind the transports module. To undo,
-            // remove the whole if block.
-            if (process.platform === 'win32' || process.platform === 'linux') {
-                if (lanOld.isEnabled) {
-                    if (lanOld.isMdnsEnabled) {
-                        mdnsClientFreeHandle(this.mdnsClientTransportPointer);
-                        this.mdnsClientTransportPointer = null;
-                        mdnsServerFreeHandle(this.mdnsServerAdvertiserPointer);
-                        this.mdnsServerAdvertiserPointer = null;
-                    }
-                    if (lanOld.isMulticastEnabled) {
-                        dittoRemoveMulticastTransport(dittoPointer);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            const lanOld = stateOld.effectiveTransportConfig.peerToPeer.lan;
+            const lanNew = stateNew.effectiveTransportConfig.peerToPeer.lan;
+            {
+                // HACK: quick & dirty Linux & Windows hack. A proper implementation
+                // should encapsulate everything behind the transports module. To undo,
+                // remove the whole if block.
+                if (process.platform === 'win32' || process.platform === 'linux') {
+                    if (lanOld.isEnabled) {
+                        if (lanOld.isMdnsEnabled) {
+                            mdnsClientFreeHandle(this.mdnsClientTransportPointer);
+                            this.mdnsClientTransportPointer = null;
+                            mdnsServerFreeHandle(this.mdnsServerAdvertiserPointer);
+                            this.mdnsServerAdvertiserPointer = null;
+                        }
+                        if (lanOld.isMulticastEnabled) {
+                            dittoRemoveMulticastTransport(dittoHandle.deref());
+                        }
                     }
-                }
-                if (lanNew.isEnabled) {
-                    if (lanNew.isMdnsEnabled) {
-                        this.mdnsClientTransportPointer = dittoAddInternalMdnsTransport(dittoPointer);
-                        this.mdnsServerAdvertiserPointer = dittoAddInternalMdnsAdvertiser(dittoPointer);
-                    }
-                    if (lanNew.isMulticastEnabled) {
-                        dittoAddMulticastTransport(dittoPointer);
+                    if (lanNew.isEnabled) {
+                        if (lanNew.isMdnsEnabled) {
+                            this.mdnsClientTransportPointer = dittoAddInternalMdnsTransport(dittoHandle.deref());
+                            this.mdnsServerAdvertiserPointer = dittoAddInternalMdnsAdvertiser(dittoHandle.deref());
+                        }
+                        if (lanNew.isMulticastEnabled) {
+                            dittoAddMulticastTransport(dittoHandle.deref());
+                        }
                     }
+                    return;
                 }
-                return;
-            }
-        }
-        // IDEA: move the logic for this dance into stateFrom() signal
-        // via some additional state signaling the actions here.
-        if (lanOld.isEnabled) {
-            if (lanOld.isMdnsEnabled) {
-                lanDestroy(this.lanTransportPointer);
-                delete this.lanTransportPointer;
             }
-            if (lanOld.isMulticastEnabled) {
-                dittoRemoveMulticastTransport(dittoPointer);
-            }
-        }
-        if (lanNew.isEnabled) {
-            if (lanNew.isMdnsEnabled) {
-                this.lanTransportPointer = lanCreate(dittoPointer);
+            // IDEA: move the logic for this dance into stateFrom() signal
+            // via some additional state signaling the actions here.
+            if (lanOld.isEnabled) {
+                if (lanOld.isMdnsEnabled) {
+                    lanDestroy(this.lanTransportPointer);
+                    delete this.lanTransportPointer;
+                }
+                if (lanOld.isMulticastEnabled) {
+                    dittoRemoveMulticastTransport(dittoHandle.deref());
+                }
             }
-            if (lanNew.isMulticastEnabled) {
-                dittoAddMulticastTransport(dittoPointer);
+            if (lanNew.isEnabled) {
+                if (lanNew.isMdnsEnabled) {
+                    this.lanTransportPointer = lanCreate(dittoHandle.deref());
+                }
+                if (lanNew.isMulticastEnabled) {
+                    dittoAddMulticastTransport(dittoHandle.deref());
+                }
             }
-        }
+        });
     }
     updateListenTCP(stateOld, stateNew) {
-        const tcpOld = stateOld.effectiveTransportConfig.listen.tcp;
-        const tcpNew = stateNew.effectiveTransportConfig.listen.tcp;
-        if (TransportConfig.areListenTCPsEqual(tcpNew, tcpOld))
-            return;
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        if (tcpOld.isEnabled)
-            dittoStopTCPServer(dittoPointer);
-        if (tcpNew.isEnabled)
-            dittoStartTCPServer(dittoPointer, `${tcpNew.interfaceIP}:${tcpNew.port}`);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            const tcpOld = stateOld.effectiveTransportConfig.listen.tcp;
+            const tcpNew = stateNew.effectiveTransportConfig.listen.tcp;
+            if (TransportConfig.areListenTCPsEqual(tcpNew, tcpOld))
+                return;
+            if (tcpOld.isEnabled)
+                dittoStopTCPServer(dittoHandle.deref());
+            if (tcpNew.isEnabled)
+                dittoStartTCPServer(dittoHandle.deref(), `${tcpNew.interfaceIP}:${tcpNew.port}`);
+        });
     }
     updateListenHTTP(stateOld, stateNew) {
-        const httpOld = stateOld.effectiveTransportConfig.listen.http;
-        const httpNew = stateNew.effectiveTransportConfig.listen.http;
-        if (TransportConfig.areListenHTTPsEqual(httpOld, httpNew))
-            return;
-        const dittoPointer = Bridge.ditto.pointerFor(this.ditto);
-        if (httpOld.isEnabled)
-            dittoStopHTTPServer(dittoPointer);
-        /* eslint-disable */
-        if (httpNew.isEnabled) {
-            dittoStartHTTPServer(dittoPointer, `${httpNew.interfaceIP}:${httpNew.port}`, httpNew.staticContentPath || null, httpNew.websocketSync ? 'Enabled' : 'Disabled', httpNew.tlsCertificatePath || null, httpNew.tlsKeyPath || null);
-        }
-        /* eslint-enable */
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            const httpOld = stateOld.effectiveTransportConfig.listen.http;
+            const httpNew = stateNew.effectiveTransportConfig.listen.http;
+            if (TransportConfig.areListenHTTPsEqual(httpOld, httpNew))
+                return;
+            if (httpOld.isEnabled)
+                dittoStopHTTPServer(dittoHandle.deref());
+            /* eslint-disable */
+            if (httpNew.isEnabled) {
+                dittoStartHTTPServer(dittoHandle.deref(), `${httpNew.interfaceIP}:${httpNew.port}`, httpNew.staticContentPath || null, httpNew.websocketSync ? 'Enabled' : 'Disabled', httpNew.tlsCertificatePath || null, httpNew.tlsKeyPath || null);
+            }
+            /* eslint-enable */
+        });
     }
     updateConnectTCPServers(stateOld, stateNew) {
-        // REFACTOR: same "algorithm" as for Websockets below, DRY up.
-        const currentTCPServers = Object.getOwnPropertyNames(this.staticTCPClientsByAddress);
-        const desiredTCPServers = stateNew.effectiveTransportConfig.connect.tcpServers;
-        const tcpServersToConnectToSet = new Set(desiredTCPServers);
-        for (const tcpServer of currentTCPServers)
-            tcpServersToConnectToSet.delete(tcpServer);
-        const tcpServersToDisconnectFromSet = new Set(currentTCPServers);
-        for (const tcpServer of desiredTCPServers)
-            tcpServersToDisconnectFromSet.delete(tcpServer);
-        const tcpServersToConnectTo = tcpServersToConnectToSet.values();
-        const tcpServersToDisconnectFrom = tcpServersToDisconnectFromSet.values();
-        for (const tcpServer of tcpServersToConnectTo) {
-            const staticTCPClientPointer = addStaticTCPClient(Bridge.ditto.pointerFor(this.ditto), tcpServer);
-            const staticTCPClient = Bridge.staticTCPClient.bridge(staticTCPClientPointer);
-            this.staticTCPClientsByAddress[tcpServer] = staticTCPClient;
-        }
-        for (const tcpServer of tcpServersToDisconnectFrom) {
-            // REFACTOR: we have to make sure freeing the tcpServer handle is done
-            // BEFORE the Ditto instance itself is freed.
-            const staticTCPClient = this.staticTCPClientsByAddress[tcpServer];
-            if (!staticTCPClient)
-                throw new Error(`Internal inconsistency, can't disconnect from TCP address '${tcpServer}', no staticTCPClient found.`);
-            const staticTCPClientPointer = Bridge.staticTCPClient.pointerFor(staticTCPClient);
-            // Unregister to avoid double-free for this pointer, then free manually:
-            Bridge.staticTCPClient.unregister(staticTCPClient);
-            staticTCPClientFreeHandle(staticTCPClientPointer);
-            delete this.staticTCPClientsByAddress[tcpServer];
-        }
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            // REFACTOR: same "algorithm" as for Websockets below, DRY up.
+            const currentTCPServers = Object.getOwnPropertyNames(this.staticTCPClientsByAddress);
+            const desiredTCPServers = stateNew.effectiveTransportConfig.connect.tcpServers;
+            const tcpServersToConnectToSet = new Set(desiredTCPServers);
+            for (const tcpServer of currentTCPServers)
+                tcpServersToConnectToSet.delete(tcpServer);
+            const tcpServersToDisconnectFromSet = new Set(currentTCPServers);
+            for (const tcpServer of desiredTCPServers)
+                tcpServersToDisconnectFromSet.delete(tcpServer);
+            const tcpServersToConnectTo = tcpServersToConnectToSet.values();
+            const tcpServersToDisconnectFrom = tcpServersToDisconnectFromSet.values();
+            for (const tcpServer of tcpServersToConnectTo) {
+                const staticTCPClientPointer = addStaticTCPClient(dittoHandle.deref(), tcpServer);
+                const staticTCPClient = Bridge.staticTCPClient.bridge(staticTCPClientPointer);
+                this.staticTCPClientsByAddress[tcpServer] = staticTCPClient;
+            }
+            for (const tcpServer of tcpServersToDisconnectFrom) {
+                // REFACTOR: we have to make sure freeing the tcpServer handle is done
+                // BEFORE the Ditto instance itself is freed.
+                const staticTCPClient = this.staticTCPClientsByAddress[tcpServer];
+                if (!staticTCPClient)
+                    throw new Error(`Internal inconsistency, can't disconnect from TCP address '${tcpServer}', no staticTCPClient found.`);
+                const staticTCPClientPointer = Bridge.staticTCPClient.handleFor(staticTCPClient).deref();
+                // Unregister to avoid double-free for this pointer, then free manually:
+                Bridge.staticTCPClient.unregister(staticTCPClient);
+                staticTCPClientFreeHandle(staticTCPClientPointer);
+                delete this.staticTCPClientsByAddress[tcpServer];
+            }
+        });
     }
     updateConnectWebsocketURLs(stateOld, stateNew) {
-        // REFACTOR: same "algorithm" as for TCP servers above, DRY up.
-        // IDEA: normalize URLs so that we don't connect to the same URL twice?
-        const currentWebsocketURLs = Object.getOwnPropertyNames(this.websocketClientsByURL);
-        const desiredWebsocketURLs = stateNew.effectiveTransportConfig.connect.websocketURLs.slice();
-        const websocketURLsToConnectToSet = new Set(desiredWebsocketURLs);
-        for (const websocketURL of currentWebsocketURLs)
-            websocketURLsToConnectToSet.delete(websocketURL);
-        const websocketURLsToDisconnectFromSet = new Set(currentWebsocketURLs);
-        for (const websocketURL of desiredWebsocketURLs)
-            websocketURLsToDisconnectFromSet.delete(websocketURL);
-        const websocketURLsToConnectTo = websocketURLsToConnectToSet.values();
-        const websocketURLsToDisconnectFrom = websocketURLsToDisconnectFromSet.values();
-        const routingHint = stateNew.effectiveTransportConfig.global.routingHint;
-        for (const websocketURL of websocketURLsToConnectTo) {
-            const websocketClientPointer = addWebsocketClient(Bridge.ditto.pointerFor(this.ditto), websocketURL, routingHint);
-            const websocketClient = Bridge.websocketClient.bridge(websocketClientPointer);
-            this.websocketClientsByURL[websocketURL] = websocketClient;
-        }
-        for (const websocketURL of websocketURLsToDisconnectFrom) {
-            // REFACTOR: we have to make sure freeing the websocket handle is done
-            // BEFORE the Ditto instance itself is freed.
-            const websocketClient = this.websocketClientsByURL[websocketURL];
-            if (!websocketClient)
-                throw new Error(`Internal inconsistency, can't disconnect from websocket URL '${websocketURL}', no websocketClient found.`);
-            const websocketClientPointer = Bridge.websocketClient.pointerFor(websocketClient);
-            // Unregister to avoid double-free for this pointer, then free manually:
-            Bridge.websocketClient.unregister(websocketClient);
-            websocketClientFreeHandle(websocketClientPointer);
-            delete this.websocketClientsByURL[websocketURL];
-        }
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            // REFACTOR: same "algorithm" as for TCP servers above, DRY up.
+            // IDEA: normalize URLs so that we don't connect to the same URL twice?
+            const currentWebsocketURLs = Object.getOwnPropertyNames(this.websocketClientsByURL);
+            const desiredWebsocketURLs = stateNew.effectiveTransportConfig.connect.websocketURLs.slice();
+            const websocketURLsToConnectToSet = new Set(desiredWebsocketURLs);
+            for (const websocketURL of currentWebsocketURLs)
+                websocketURLsToConnectToSet.delete(websocketURL);
+            const websocketURLsToDisconnectFromSet = new Set(currentWebsocketURLs);
+            for (const websocketURL of desiredWebsocketURLs)
+                websocketURLsToDisconnectFromSet.delete(websocketURL);
+            const websocketURLsToConnectTo = websocketURLsToConnectToSet.values();
+            const websocketURLsToDisconnectFrom = websocketURLsToDisconnectFromSet.values();
+            const routingHint = stateNew.effectiveTransportConfig.global.routingHint;
+            for (const websocketURL of websocketURLsToConnectTo) {
+                const websocketClientPointer = addWebsocketClient(dittoHandle.deref(), websocketURL, routingHint);
+                const websocketClient = Bridge.websocketClient.bridge(websocketClientPointer);
+                this.websocketClientsByURL[websocketURL] = websocketClient;
+            }
+            for (const websocketURL of websocketURLsToDisconnectFrom) {
+                // REFACTOR: we have to make sure freeing the websocket handle is done
+                // BEFORE the Ditto instance itself is freed.
+                const websocketClient = this.websocketClientsByURL[websocketURL];
+                if (!websocketClient)
+                    throw new Error(`Internal inconsistency, can't disconnect from websocket URL '${websocketURL}', no websocketClient found.`);
+                const websocketClientPointer = Bridge.websocketClient.handleFor(websocketClient).deref();
+                // Unregister to avoid double-free for this pointer, then free manually:
+                Bridge.websocketClient.unregister(websocketClient);
+                websocketClientFreeHandle(websocketClientPointer);
+                delete this.websocketClientsByURL[websocketURL];
+            }
+        });
     }
     updateGlobal(stateOld, stateNew) {
-        if (stateOld.effectiveTransportConfig.global.syncGroup !== stateNew.effectiveTransportConfig.global.syncGroup) {
-            dittoSetSyncGroup(Bridge.ditto.pointerFor(this.ditto), stateNew.effectiveTransportConfig.global.syncGroup);
-        }
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            if (stateOld.effectiveTransportConfig.global.syncGroup !== stateNew.effectiveTransportConfig.global.syncGroup) {
+                dittoSetSyncGroup(dittoHandle.deref(), stateNew.effectiveTransportConfig.global.syncGroup);
+            }
+        });
     }
     updateConnectRetryInterval(stateOld, stateNew) {
-        dittoSetConnectRetryInterval(Bridge.ditto.pointerFor(this.ditto), stateNew.effectiveTransportConfig.connect.retryInterval);
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            dittoSetConnectRetryInterval(dittoHandle.deref(), stateNew.effectiveTransportConfig.connect.retryInterval);
+        });
     }
 }
 /**
  * @private
  */
 function stateFrom(parameters) {
-    // IMPORTANT: this function maps a set of sync parameters to an effective
-    // transport config plus some extra state where need be. Make sure
-    // to keep this function free of side-effects.
-    var _a;
-    const transportConfig = parameters.transportConfig.copy();
-    const identity = parameters.identity;
     const ditto = parameters.ditto;
-    const isSyncActive = parameters.isSyncActive;
-    const isX509Valid = parameters.isX509Valid;
-    const isWebValid = parameters.isWebValid;
-    transportConfig.connect.tcpServers;
-    transportConfig.connect.websocketURLs;
-    let appID;
-    let customDittoCloudURL;
-    let isDittoCloudSyncEnabled = false;
-    if (identity.type === 'onlinePlayground' || identity.type === 'onlineWithAuthentication') {
-        // NOTE: enableDittoCloudSync is true by default for any online identity.
-        appID = identity.appID;
-        customDittoCloudURL = (_a = identity.customDittoCloudURL) !== null && _a !== void 0 ? _a : null;
-        isDittoCloudSyncEnabled = identity.hasOwnProperty('enableDittoCloudSync') ? identity.enableDittoCloudSync : true;
-    }
-    const dittoPointer = Bridge.ditto.pointerFor(ditto);
-    // Not all P2P transports are always supported.
-    const unavailableButEnabledP2PTransports = [];
-    const isBLEAvailable = bleIsAvailable(dittoPointer);
-    const isAWDLAvailable = awdlIsAvailable(dittoPointer);
-    const isLANAvailable = lanIsAvailable(dittoPointer);
-    if (transportConfig.peerToPeer.bluetoothLE.isEnabled && !isBLEAvailable) {
-        unavailableButEnabledP2PTransports.push('BluetoothLE');
-    }
-    if (transportConfig.peerToPeer.awdl.isEnabled && !isAWDLAvailable) {
-        unavailableButEnabledP2PTransports.push('AWDL');
-    }
-    if (transportConfig.peerToPeer.lan.isEnabled && !isLANAvailable) {
-        unavailableButEnabledP2PTransports.push('LAN');
-    }
-    if (unavailableButEnabledP2PTransports.length > 0) {
-        throw new Error(`The following P2P transports are enabled in the transport config but are not supported in the current environment: ${unavailableButEnabledP2PTransports.join(', ')}`);
-    }
-    if (!isSyncActive || !isX509Valid) {
-        transportConfig.peerToPeer.bluetoothLE.isEnabled = false;
-        transportConfig.peerToPeer.awdl.isEnabled = false;
-        transportConfig.peerToPeer.lan.isEnabled = false;
-        transportConfig.listen.tcp.isEnabled = false;
-        transportConfig.connect.tcpServers = [];
-    }
-    if (!isSyncActive || !isWebValid) {
-        transportConfig.connect.websocketURLs = [];
-    }
-    if (!isSyncActive) {
-        transportConfig.listen.http.isEnabled = false;
-    }
-    // NOTE: we have to smuggle in an additional Ditto Cloud websocket URL to
-    // connect to if cloud sync is enabled.
-    if (isSyncActive && isWebValid && isDittoCloudSyncEnabled) {
-        const dittoCloudURL = customDittoCloudURL !== null && customDittoCloudURL !== void 0 ? customDittoCloudURL : defaultDittoCloudURL(appID);
-        transportConfig.connect.websocketURLs.push(dittoCloudURL);
-    }
-    return {
-        underlyingSyncParameters: parameters,
-        effectiveTransportConfig: transportConfig.freeze(),
-    };
+    const dittoHandle = Bridge.ditto.handleFor(ditto);
+    return ditto.deferClose(() => {
+        // IMPORTANT: this function maps a set of sync parameters to an effective
+        // transport config plus some extra state where need be. Make sure
+        // to keep this function free of side-effects.
+        var _a;
+        const transportConfig = parameters.transportConfig.copy();
+        const identity = parameters.identity;
+        const isSyncActive = parameters.isSyncActive;
+        const isX509Valid = parameters.isX509Valid;
+        const isWebValid = parameters.isWebValid;
+        transportConfig.connect.tcpServers;
+        transportConfig.connect.websocketURLs;
+        let appID;
+        let customDittoCloudURL;
+        let isDittoCloudSyncEnabled = false;
+        if (identity.type === 'onlinePlayground' || identity.type === 'onlineWithAuthentication') {
+            // NOTE: enableDittoCloudSync is true by default for any online identity.
+            appID = identity.appID;
+            customDittoCloudURL = (_a = identity.customDittoCloudURL) !== null && _a !== void 0 ? _a : null;
+            isDittoCloudSyncEnabled = identity.hasOwnProperty('enableDittoCloudSync') ? identity.enableDittoCloudSync : true;
+        }
+        // Not all P2P transports are always supported.
+        const unavailableButEnabledP2PTransports = [];
+        const isBLEAvailable = bleIsAvailable(dittoHandle.deref());
+        const isAWDLAvailable = awdlIsAvailable(dittoHandle.deref());
+        const isLANAvailable = lanIsAvailable(dittoHandle.deref());
+        if (transportConfig.peerToPeer.bluetoothLE.isEnabled && !isBLEAvailable) {
+            unavailableButEnabledP2PTransports.push('BluetoothLE');
+        }
+        if (transportConfig.peerToPeer.awdl.isEnabled && !isAWDLAvailable) {
+            unavailableButEnabledP2PTransports.push('AWDL');
+        }
+        if (transportConfig.peerToPeer.lan.isEnabled && !isLANAvailable) {
+            unavailableButEnabledP2PTransports.push('LAN');
+        }
+        if (unavailableButEnabledP2PTransports.length > 0) {
+            throw new Error(`The following P2P transports are enabled in the transport config but are not supported in the current environment: ${unavailableButEnabledP2PTransports.join(', ')}`);
+        }
+        if (!isSyncActive || !isX509Valid) {
+            transportConfig.peerToPeer.bluetoothLE.isEnabled = false;
+            transportConfig.peerToPeer.awdl.isEnabled = false;
+            transportConfig.peerToPeer.lan.isEnabled = false;
+            transportConfig.listen.tcp.isEnabled = false;
+            transportConfig.connect.tcpServers = [];
+        }
+        if (!isSyncActive || !isWebValid) {
+            transportConfig.connect.websocketURLs = [];
+        }
+        if (!isSyncActive) {
+            transportConfig.listen.http.isEnabled = false;
+        }
+        // NOTE: we have to smuggle in an additional Ditto Cloud websocket URL to
+        // connect to if cloud sync is enabled.
+        if (isSyncActive && isWebValid && isDittoCloudSyncEnabled) {
+            const dittoCloudURL = customDittoCloudURL !== null && customDittoCloudURL !== void 0 ? customDittoCloudURL : defaultDittoCloudURL(appID);
+            transportConfig.connect.websocketURLs.push(dittoCloudURL);
+        }
+        return {
+            underlyingSyncParameters: parameters,
+            effectiveTransportConfig: transportConfig.freeze(),
+        };
+    });
+}
+
+//
+/**
+ * Tracks `Subscription` instances in order to remove them when Ditto is
+ * closed.
+ *
+ * @internal
+ */
+class SubscriptionManager {
+    /** @internal */
+    constructor(ditto) {
+        this.ditto = ditto;
+        this.subscriptions = {};
+        this.finalizationRegistry = new FinalizationRegistry(this.removeWithContextinfo.bind(this));
+    }
+    /**
+     * Begin tracking a subscription instance and start it.
+     *
+     * @internal */
+    add(subscription) {
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        const contextInfo = subscription.contextInfo;
+        ditto.deferClose(async () => {
+            this.subscriptions[contextInfo.id] = new WeakRef(subscription);
+            this.finalizationRegistry.register(subscription, subscription.contextInfo, subscription);
+            addSubscription(dittoHandle.deref(), contextInfo.collectionName, contextInfo.query, contextInfo.queryArgsCBOR, contextInfo.orderBys, contextInfo.limit, contextInfo.offset);
+        });
+    }
+    /**
+     * Stop tracking a subscription instance and cancel it.
+     *
+     * @internal */
+    remove(subscription) {
+        if (this.subscriptions[subscription.contextInfo.id] == null) {
+            throw new Error(`Internal inconsistency, tried to remove a subscription that is not tracked: ${subscription.contextInfo.id}`);
+        }
+        this.finalizationRegistry.unregister(subscription);
+        this.removeWithContextinfo(subscription.contextInfo);
+    }
+    /**
+     * Stop tracking all subscriptions and cancel them.
+     *
+     * @internal */
+    close() {
+        this.ditto.deferClose(async () => {
+            for (const subscriptionID in this.subscriptions) {
+                const subscription = this.subscriptions[subscriptionID].deref();
+                if (subscription != null) {
+                    // This doesn't call `Subscription.cancel()` because that is not
+                    // async and we want to wait for all subscriptions to be removed.
+                    this.remove(subscription);
+                }
+            }
+        });
+    }
+    /**
+     * Remove tracked subscription without unregistering from finalization
+     * registry.
+     *
+     * @internal */
+    removeWithContextinfo(contextInfo) {
+        const ditto = this.ditto;
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        ditto.deferClose(() => {
+            delete this.subscriptions[contextInfo.id];
+            removeSubscription(dittoHandle.deref(), contextInfo.collectionName, contextInfo.query, contextInfo.queryArgsCBOR, contextInfo.orderBys, contextInfo.limit, contextInfo.offset);
+        });
+    }
+}
+
+//
+/**
+ * These objects are returned by calls to
+ * {@link Collection.fetchAttachment | fetchAttachment()} on {@link Collection}
+ * and allow you to stop an in-flight attachment fetch.
+ */
+class AttachmentFetcher {
+    /**
+     * Stops fetching the associated attachment and cleans up any associated
+     * resources.
+     *
+     * Note that you are not required to call `stop()` once your attachment fetch
+     * operation has finished. The method primarily exists to allow you to cancel
+     * an attachment fetch request while it is ongoing if you no longer wish for
+     * the attachment to be made available locally to the device.
+     */
+    stop() {
+        // No need for synchronicity here: we let the "stop promise" float / run in
+        // a detached fashion since there is no point in awaiting the "stop
+        // signaling" itself.
+        step(async () => {
+            await this.manager.stopAttachmentFetcher(this);
+            if (this.rejectPendingFetch != null) {
+                this.rejectPendingFetch();
+            }
+        });
+    }
+    /** @internal */
+    then(onfulfilled, onrejected) {
+        return this.attachment.then(onfulfilled, onrejected);
+    }
+    /** @internal */
+    constructor(ditto, token, manager, eventHandler) {
+        // --------------------------------------- Internal ------------------------
+        /** @internal */
+        this.cancelTokenPromise = null;
+        /**
+         * This function is defined while a fetch is in progress and is used to reject
+         * the promise `this.attachment` when the fetch is canceled.
+         *
+         * @internal
+         */
+        this.rejectPendingFetch = null;
+        this.ditto = ditto;
+        this.token = token;
+        this.manager = manager;
+        this.id = generateEphemeralToken();
+        const eventHandlerOrNoOp = eventHandler || function () { };
+        const dittoHandle = Bridge.ditto.handleFor(ditto);
+        this.attachment = new Promise((resolve, reject) => {
+            // REFACTOR: The callbacks hold quite a bunch of objects with most
+            // probably lead to retain cycles and therefore memory leaks. This needs
+            // to be
+            // fixed.
+            const onComplete = (attachmentHandlePointer) => {
+                const attachment = new Attachment(this.ditto, this.token);
+                Bridge.attachment.bridge(attachmentHandlePointer, () => attachment);
+                eventHandlerOrNoOp({ type: 'Completed', attachment });
+                this.rejectPendingFetch = null;
+                resolve(attachment);
+            };
+            const onProgress = (downloaded, toDownload) => {
+                eventHandlerOrNoOp({ type: 'Progress', totalBytes: toDownload, downloadedBytes: downloaded });
+            };
+            const onDelete = () => {
+                eventHandlerOrNoOp({ type: 'Deleted' });
+                this.rejectPendingFetch = null;
+                resolve(null);
+            };
+            const onError = () => {
+            };
+            // The core doesn't call any of the handlers defined above when a fetch is
+            // cancelled through `this.stop()` so we use this function to reject the
+            // promise from the outside.
+            this.rejectPendingFetch = () => {
+                reject(new Error('Attachment fetch was canceled'));
+            };
+            // Not awaited yet; only needs to be fully resolved (and `await`ed over)
+            // when using the actual `cancelTokenPromise`, which only happens in
+            // `AttachmentFetcherManager.stopWithContextInfo()`.
+            // @ts-expect-error setting readonly property
+            this.cancelTokenPromise = dittoResolveAttachment(dittoHandle.deref(), token.id, { onComplete, onProgress, onDelete }, onError);
+        });
+    }
+}
+
+//
+/**
+ * Manages attachment fetchers to make sure we free all resources when the
+ * fetcher is garbage collected and to allow us to wait for freeing of
+ * ressources to be finished before the ditto instance is closed.
+ *
+ * @internal */
+class AttachmentFetcherManager {
+    /** @internal */
+    constructor(ditto) {
+        // --- Private ---
+        this.contextInfoByID = {};
+        this.finalizationRegistry = new FinalizationRegistry(this.stopWithContextInfo);
+        this.ditto = ditto;
+    }
+    /**
+     * Start an attachment fetcher.
+     *
+     * @internal */
+    startAttachmentFetcher(token, eventHandler) {
+        return this.ditto.deferClose(() => {
+            const attachmentFetcher = new AttachmentFetcher(this.ditto, token, this, eventHandler);
+            // Register in finalization registry.
+            const contextInfo = {
+                id: attachmentFetcher.id,
+                attachmentTokenID: token.id,
+                cancelTokenPromise: attachmentFetcher.cancelTokenPromise,
+                attachmentFetcher: new WeakRef(attachmentFetcher),
+            };
+            this.finalizationRegistry.register(attachmentFetcher, contextInfo, attachmentFetcher);
+            // Keep a reference to the context info so that we can stop the fetcher.
+            this.contextInfoByID[attachmentFetcher.id] = contextInfo;
+            // Prevent cancellation of the fetch once it was fulfilled or rejected.
+            const resetCancelToken = () => {
+                if (this.contextInfoByID[attachmentFetcher.id] != null) {
+                    this.contextInfoByID[attachmentFetcher.id].cancelTokenPromise = null;
+                }
+            };
+            attachmentFetcher.attachment.then((value) => {
+                resetCancelToken();
+                return value;
+            }, (reason) => {
+                resetCancelToken();
+                return reason;
+            });
+            // Keep the attachment fetcher alive until it is stopped.
+            this.ditto.keepAlive.retain(`AttachmentFetcher.${attachmentFetcher.id})`);
+            return attachmentFetcher;
+        });
+    }
+    /**
+     * Stop an attachment fetcher and wait for it to be stopped.
+     *
+     * @internal */
+    async stopAttachmentFetcher(attachmentFetcher) {
+        this.finalizationRegistry.unregister(attachmentFetcher);
+        const contextInfo = this.contextInfoByID[attachmentFetcher.id];
+        if (contextInfo == null) {
+            throw new Error(`Internal inconsistency: cannot stop attachment fetcher ${attachmentFetcher.id}, which is not registered.`);
+        }
+        await this.stopWithContextInfo(contextInfo);
+    }
+    /**
+     * Closing the manager will cancel all attachment fetchers.
+     *
+     * @internal
+     */
+    close() {
+        // REFACTOR: the closing closure runs detached from here which is a smell.
+        // Can we make this whole closing mechanism non-async? The culprit is
+        // the cancelTokenPromise that _have to_ `await` on close. The reason
+        // for this is that the FFI function `ditto_resolve_attachment()` is
+        // async but should be non-async. Refactor and make that non-async, then
+        // de-async-ify the closing mechanism.
+        this.ditto.deferCloseAsync(async () => {
+            const contextInfos = Object.values(this.contextInfoByID);
+            const stopped = contextInfos.map(async (contextInfo) => {
+                const attachmentFetcher = contextInfo.attachmentFetcher.deref();
+                if (attachmentFetcher != null) {
+                    await this.stopAttachmentFetcher(attachmentFetcher);
+                }
+            });
+            await Promise.all(stopped);
+        });
+    }
+    /**
+     * Stop the attachment fetcher without unregistering it from the finalization
+     * registry.
+     */
+    stopWithContextInfo(contextInfo) {
+        const dittoHandle = Bridge.ditto.handleFor(this.ditto);
+        return this.ditto.deferCloseAsync(async () => {
+            // Remove the manager's own record of the context info.
+            if (this.contextInfoByID[contextInfo.id] == null) {
+                throw new Error(`Internal inconsistency: attachment fetcher ${contextInfo.id} not found in active attachment fetchers.`);
+            }
+            delete this.contextInfoByID[contextInfo.id];
+            // Release the keep-alive.
+            this.ditto.keepAlive.release(`AttachmentFetcher.${contextInfo.id})`);
+            // Cancel the fetcher if it is still running.
+            const cancelToken = await contextInfo.cancelTokenPromise;
+            if (cancelToken) {
+                dittoCancelResolveAttachment(dittoHandle.deref(), contextInfo.attachmentTokenID, cancelToken);
+            }
+        });
+    }
 }
 
 //
@@ -5998,8 +6606,10 @@ function stateFrom(parameters) {
 class Ditto {
     /** Returns a string identifying the version of the Ditto SDK. */
     get sdkVersion() {
-        const dittoPointer = Bridge.ditto.pointerFor(this);
-        return dittoGetSDKVersion(dittoPointer);
+        const dittoHandle = Bridge.ditto.handleFor(this);
+        return this.deferClose(() => {
+            return dittoGetSDKVersion(dittoHandle.deref());
+        });
     }
     /**
      * Initializes a new `Ditto` instance.
@@ -6020,8 +6630,16 @@ class Ditto {
      * @see {@link Ditto.path}
      */
     constructor(identity, path) {
+        /**
+         * `true` once {@link close | Ditto.close()} has been called, otherwise
+         * `false`.
+         */
+        this.isClosed = false;
+        this.deferCloseAllowed = true;
         this.isWebValid = false;
         this.isX509Valid = false;
+        /** Set of pending operations that need to complete before the Ditto instance can be closed in a safe manner. */
+        this.pendingOperations = new Set();
         if (!Ditto.isEnvironmentSupported()) {
             throw new Error('Ditto does not support this JavaScript environment. Please consult the Ditto JavaScript documentation for a list of supported environments and browsers. You can use `Ditto.isEnvironmentSupported()` to run this check anytime.');
         }
@@ -6056,50 +6674,35 @@ class Ditto {
         // it after all pieces are in place.
         let secondsRemainingUntilAuthenticationExpires = null;
         const weakThis = new WeakRef(this);
-        const authClientX = (() => {
+        const identityConfig = (() => {
             var _a, _b, _c;
             if (validIdentity.type === 'offlinePlayground') {
-                return dittoAuthClientMakeForDevelopment(pathOrDefault, validIdentity.appID, (_a = validIdentity.siteID) !== null && _a !== void 0 ? _a : 0);
+                return dittoIdentityConfigMakeOfflinePlayground(validIdentity.appID, (_a = validIdentity.siteID) !== null && _a !== void 0 ? _a : 0);
             }
             if (validIdentity.type === 'manual') {
-                return dittoAuthClientMakeWithStaticX509(validIdentity.certificate);
+                return dittoIdentityConfigMakeManual(validIdentity.certificate);
             }
             if (validIdentity.type === 'sharedKey') {
-                return dittoAuthClientMakeWithSharedKey(pathOrDefault, validIdentity.appID, validIdentity.sharedKey, validIdentity.siteID);
+                return dittoIdentityConfigMakeSharedKey(validIdentity.appID, validIdentity.sharedKey, validIdentity.siteID);
             }
             if (validIdentity.type === 'onlinePlayground') {
                 const authURL = (_b = validIdentity.customAuthURL) !== null && _b !== void 0 ? _b : defaultAuthURL(validIdentity.appID);
-                return dittoAuthClientMakeAnonymousClient(pathOrDefault, validIdentity.appID, validIdentity.token, authURL);
+                return dittoIdentityConfigMakeOnlinePlayground(validIdentity.appID, validIdentity.token, authURL);
             }
             if (validIdentity.type === 'onlineWithAuthentication') {
                 const authURL = (_c = validIdentity.customAuthURL) !== null && _c !== void 0 ? _c : defaultAuthURL(validIdentity.appID);
-                const loginProviderX = dittoAuthClientMakeLoginProvider(function (secondsRemaining) {
-                    const strongThis = weakThis.deref();
-                    if (!strongThis) {
-                        Logger.warning(`Internal inconsistency, LoginProvider callback fired after the corresponding Ditto instance has been deallocated.`);
-                        return;
-                    }
-                    if (strongThis.auth) {
-                        strongThis.auth['@ditto.authenticationExpiring'](secondsRemaining);
-                    }
-                    else {
-                        // WORKAROUND: see description above where the
-                        // secondsRemainingUntilAuthenticationExpires variable is declared.
-                        secondsRemainingUntilAuthenticationExpires = secondsRemaining;
-                    }
-                });
-                return dittoAuthClientMakeWithWeb(pathOrDefault, validIdentity.appID, authURL, loginProviderX);
+                return dittoIdentityConfigMakeOnlineWithAuthentication(validIdentity.appID, authURL);
             }
             throw new Error(`Can't create Ditto, unsupported identity type: ${validIdentity}`);
         })();
-        dittoAuthClientSetValidityListener(authClientX, function (...args) {
+        const dittoPointer = dittoMake(uninitializedDittoX, identityConfig);
+        dittoAuthClientSetValidityListener(dittoPointer, function (...args) {
             var _a;
             (_a = weakThis.deref()) === null || _a === void 0 ? void 0 : _a.authClientValidityChanged(...args);
         });
-        const isWebValid = dittoAuthClientIsWebValid(authClientX);
-        const isX509Valid = dittoAuthClientIsX509Valid(authClientX);
-        const siteID = dittoAuthClientGetSiteID(authClientX);
-        const dittoPointer = dittoMake(uninitializedDittoX, authClientX);
+        const isWebValid = dittoAuthClientIsWebValid(dittoPointer);
+        const isX509Valid = dittoAuthClientIsX509Valid(dittoPointer);
+        const siteID = dittoAuthClientGetSiteID(dittoPointer);
         Bridge.ditto.bridge(dittoPointer, this);
         // IMPORTANT: Keeping the auth client around accumulates run-times and
         // resources which becomes a problem specifically in tests (where we use one
@@ -6107,10 +6710,30 @@ class Ditto {
         // _only_ for the onlineWithAuthentication and online identities and
         // transfer ownership of it to the authenticator.
         if (validIdentity.type === 'onlineWithAuthentication') {
-            this.auth = new OnlineAuthenticator(this.keepAlive, authClientX, this, validIdentity.authHandler);
+            this.auth = new OnlineAuthenticator(this.keepAlive, this, validIdentity.authHandler);
+            const loginProviderX = dittoAuthClientMakeLoginProvider(function (secondsRemaining) {
+                const strongThis = weakThis.deref();
+                if (!strongThis) {
+                    Logger.warning(`Internal inconsistency, LoginProvider callback fired after the corresponding Ditto instance has been deallocated.`);
+                    return;
+                }
+                if (strongThis.auth) {
+                    strongThis.auth['@ditto.authenticationExpiring'](secondsRemaining);
+                }
+                else {
+                    // WORKAROUND: see description above where the
+                    // secondsRemainingUntilAuthenticationExpires variable is declared.
+                    secondsRemainingUntilAuthenticationExpires = secondsRemaining;
+                }
+            });
+            // We don't need to worry about awaiting the result of this call because
+            // auth all happens in the background and so there are no guarantees we
+            // need to uphold by making sure things are in a certain state before the
+            // constructor finishes
+            dittoAuthSetLoginProvider(dittoPointer, loginProviderX);
         }
         else if (validIdentity.type === 'onlinePlayground') {
-            this.auth = new OnlineAuthenticator(this.keepAlive, authClientX, this, {
+            this.auth = new OnlineAuthenticator(this.keepAlive, this, {
                 authenticationRequired: function (authenticator) {
                     // No-op.
                 },
@@ -6120,7 +6743,6 @@ class Ditto {
             });
         }
         else {
-            dittoAuthClientFree(authClientX);
             this.auth = new NotAvailableAuthenticator(this.keepAlive);
         }
         const transportConfig = this.makeDefaultTransportConfig();
@@ -6136,7 +6758,10 @@ class Ditto {
         this.store = new Store(this);
         this.presence = new Presence(this);
         this.presenceManager = new PresenceManager(this);
+        this.liveQueryManager = new LiveQueryManager(this, this.keepAlive);
+        this.attachmentFetcherManager = new AttachmentFetcherManager(this);
         this.transportConditionsManager = new TransportConditionsManager(this);
+        this.subscriptionManager = new SubscriptionManager(this);
         // WORKAROUND: see description above where the
         // secondsRemainingUntilAuthenticationExpires variable is declared.
         if (secondsRemainingUntilAuthenticationExpires !== null) {
@@ -6305,8 +6930,10 @@ class Ditto {
      * Only available in Node environments at the moment, no-op in the browser.
      */
     runGarbageCollection() {
-        const dittoPointer = Bridge.ditto.pointerFor(this);
-        dittoRunGarbageCollection(dittoPointer);
+        const dittoHandle = Bridge.ditto.handleFor(this);
+        return this.deferClose(() => {
+            dittoRunGarbageCollection(dittoHandle.deref());
+        });
     }
     /**
      * Explicitly opt-in to disabling the ability to sync with Ditto peers running
@@ -6318,8 +6945,99 @@ class Ditto {
      * or has (transitively) had disabled, syncing with v3 SDK peers.
      */
     disableSyncWithV3() {
-        const dittoPointer = Bridge.ditto.pointerFor(this);
-        dittoDisableSyncWithV3(dittoPointer);
+        const dittoHandle = Bridge.ditto.handleFor(this);
+        return this.deferClose(() => {
+            dittoDisableSyncWithV3(dittoHandle.deref());
+        });
+    }
+    /**
+     * Shut down Ditto and release all resources.
+     *
+     * Must be called before recreating a Ditto instance that uses the same
+     * persistence directory.
+     */
+    async close() {
+        if (this.isClosed) {
+            return;
+        }
+        this['isClosed'] = true;
+        this.stopSync();
+        this.store.close();
+        this.presence.close();
+        this.auth.close();
+        this.sync.close();
+        this.presenceManager.close();
+        this.liveQueryManager.close();
+        this.attachmentFetcherManager.close();
+        this.transportConditionsManager.close();
+        this.subscriptionManager.close();
+        if (this.keepAlive.isActive) {
+            throw new Error('Internal inconsistency, still kept alive after the Ditto object has been close()-ed. ');
+        }
+        // Await all pending operations before closing. Rejected promises are
+        // ignored because they are handled at the original call site.
+        do {
+            await Promise.allSettled(this.pendingOperations);
+            // REFACTOR: in theory, we could end up in an endless loop here if for
+            // some reason a resolved or rejected promise isn't removed from
+            // `pendingOperations`. AFAICS, this is not possible atm due to the
+            // way `deferClose` and `deferCloseAsync` is implemented. Would be
+            // great to rework this and make it more solid if possible.
+        } while (this.pendingOperations.size > 0);
+        this.deferCloseAllowed = false;
+        const dittoHandle = Bridge.ditto.handleFor(this);
+        await dittoShutdown(dittoHandle.deref());
+        Bridge.ditto.markAsClosed(this);
+    }
+    /**
+     * The number of operations pending before the Ditto instance can be closed.
+     *
+     * For testing purposes only.
+     * @internal */
+    get numPendingOperations() {
+        return this.pendingOperations.size;
+    }
+    /**
+     * Makes sure that the closure is executed only if the Ditto instance hasn't
+     * been closed yet.
+     *
+     * @param closure the synchronous closure to execute.
+     * @returns the result of the closure.
+     * @throws if the Ditto instance was closed before calling this method.
+     * @internal */
+    deferClose(closure) {
+        if (!this.deferCloseAllowed) {
+            throw new Error(`Can't perform operation using a Ditto instance that has been closed.`);
+        }
+        return closure();
+    }
+    /**
+     * Makes sure that the closure is executed to completion before the Ditto
+     * instance is closed.
+     *
+     * Any calls to {@link close | `Ditto.close()`} will wait until the closure
+     * has completed before closing the Ditto instance.
+     *
+     * @param closure the asynchronous closure to execute.
+     * @returns the result of the closure.
+     * @throws if the Ditto instance was closed before calling this method.
+     * @internal */
+    async deferCloseAsync(closure) {
+        if (!this.deferCloseAllowed) {
+            throw new Error(`Can't perform operation using a Ditto instance that has been closed.`);
+        }
+        const pendingOperation = closure();
+        this.pendingOperations.add(pendingOperation);
+        let result;
+        try {
+            result = await pendingOperation;
+        }
+        finally {
+            // Remove the promise from the set of pending operations even if it
+            // rejected.
+            this.pendingOperations.delete(pendingOperation);
+        }
+        return result;
     }
     authClientValidityChanged(isWebValid, isX509Valid) {
         const transportConfig = this.transportConfig;
@@ -6370,49 +7088,41 @@ class Ditto {
         return validIdentity;
     }
     setSyncActive(flag) {
-        if (flag && IdentityTypesRequiringOfflineLicenseToken.includes(this.identity.type) && !this.isActivated) {
-            throw new Error('Sync could not be started because Ditto has not yet been activated. This can be achieved with a successful call to `setOfflineOnlyLicenseToken`. If you need to obtain a license token then please visit https://portal.ditto.live.');
-        }
-        if (!this.isSyncActive && flag) {
-            this.keepAlive.retain('sync');
-        }
-        if (this.isSyncActive && !flag) {
-            this.keepAlive.release('sync');
-        }
-        const dittoPointer = Bridge.ditto.pointerFor(this);
-        this['isSyncActive'] = flag;
-        const isWebValid = this.isWebValid;
-        const isX509Valid = this.isX509Valid;
-        const identity = this.identity;
-        const transportConfig = this.transportConfig;
-        dittoSetDeviceName(dittoPointer, this.deviceName);
-        this.sync.update({ identity, transportConfig, isWebValid, isX509Valid, isSyncActive: !!flag, ditto: this });
+        const dittoHandle = Bridge.ditto.handleFor(this);
+        this.deferClose(() => {
+            if (flag && IdentityTypesRequiringOfflineLicenseToken.includes(this.identity.type) && !this.isActivated) {
+                throw new Error('Sync could not be started because Ditto has not yet been activated. This can be achieved with a successful call to `setOfflineOnlyLicenseToken`. If you need to obtain a license token then please visit https://portal.ditto.live.');
+            }
+            if (!this.isSyncActive && flag) {
+                this.keepAlive.retain('sync');
+            }
+            if (this.isSyncActive && !flag) {
+                this.keepAlive.release('sync');
+            }
+            this['isSyncActive'] = flag;
+            const isWebValid = this.isWebValid;
+            const isX509Valid = this.isX509Valid;
+            const identity = this.identity;
+            const transportConfig = this.transportConfig;
+            dittoSetDeviceName(dittoHandle.deref(), this.deviceName);
+            this.sync.update({ identity, transportConfig, isWebValid, isX509Valid, isSyncActive: !!flag, ditto: this });
+        });
     }
     makeDefaultTransportConfig() {
-        const dittoPointer = Bridge.ditto.pointerFor(this);
-        const transportConfig = new TransportConfig();
-        if (bleIsAvailable(dittoPointer)) {
-            transportConfig.peerToPeer.bluetoothLE.isEnabled = true;
-        }
-        if (awdlIsAvailable(dittoPointer)) {
-            transportConfig.peerToPeer.awdl.isEnabled = true;
-        }
-        if (lanIsAvailable(dittoPointer)) {
-            transportConfig.peerToPeer.lan.isEnabled = true;
-        }
-        // WORKAROUND: the Linux implementation panics if no BLE hardware is
-        // available but should report `NoBleHardware` via transport condition
-        // observation instead. Until this is fixed, we'll disable the BLE transport
-        // by default on Linux. To undo, remove the following block of code.
-        //
-        // See issue #5686 for details:
-        // https://github.com/getditto/ditto/pull/5608
-        {
-            if (process.platform === 'linux') {
-                transportConfig.peerToPeer.bluetoothLE.isEnabled = false;
+        const dittoHandle = Bridge.ditto.handleFor(this);
+        return this.deferClose(() => {
+            const transportConfig = new TransportConfig();
+            if (bleIsAvailable(dittoHandle.deref())) {
+                transportConfig.peerToPeer.bluetoothLE.isEnabled = true;
             }
-        }
-        return transportConfig.freeze();
+            if (awdlIsAvailable(dittoHandle.deref())) {
+                transportConfig.peerToPeer.awdl.isEnabled = true;
+            }
+            if (lanIsAvailable(dittoHandle.deref())) {
+                transportConfig.peerToPeer.lan.isEnabled = true;
+            }
+            return transportConfig.freeze();
+        });
     }
 }
 /** @internal */