MNW SyncKit.

let client = SyncKitClient::new(SyncKitConfig {
    server_url: "https://makenot.work".into(),
    api_key: "your-api-key".into(),
});
let (user_id, app_id) = client.authenticate("user@example.com", "pass").await?;
client.setup_encryption_new("pass").await?;           // generates + wraps master key
let device = client.register_device("MacBook", "macos").await?;
let cursor = client.push(device.id, changes).await?;     // encrypted, retried, done

// Pull remote changes (auto-decrypted)
let (changes, new_cursor, has_more) = client.pull(device.id, cursor).await?;
for change in &changes {
    match change.op {
        ChangeOp::Insert => db.upsert(&change.table, &change.row_id, &change.data),
        ChangeOp::Update => db.upsert(&change.table, &change.row_id, &change.data),
        ChangeOp::Delete => db.delete(&change.table, &change.row_id),
    }
}

// Push local changes (auto-encrypted)
let local_changes = db.pending_changes_since(last_push);
let cursor = client.push(device.id, local_changes).await?;

// Upload: hash locally, request URL, upload encrypted, confirm
let resp = client.blob_upload_url(&hash, size).await?;
if !resp.already_exists {
    client.blob_upload(&resp.upload_url, data).await?;  // encrypted on wire
}
client.blob_confirm(&hash, size).await?;

// Download: request URL, download + decrypt
let url = client.blob_download_url(&hash).await?;
let plaintext = client.blob_download(&url).await?;

// Try keychain first (no password prompt needed)
if client.try_load_key_from_keychain().is_ok() {
    // Master key cached from previous session — ready to sync
} else if client.has_server_key().await? {
    // Existing account on new device — ask for password once
    client.setup_encryption_existing(&password).await?;
} else {
    // First device ever — generate master key, wrap with password
    client.setup_encryption_new(&password).await?;
}

// OAuth2 PKCE also supported (browser-based auth)
let url = client.build_authorize_url(port, state, challenge);
// ... redirect user, receive code ...
let (user_id, app_id) = client.authenticate_with_code(&code, &verifier, port).await?;