@derec-alliance/react-native 0.0.1

package/lib/binary.d.ts

@@ -0,0 +1,19 @@
+import type { SecretVersionEntry } from './types';
+/** Discovery secret list — see `library/src/interop/ffi/discovery.rs`. */
+export declare function encodeSecretList(entries: SecretVersionEntry[]): Uint8Array;
+export declare function decodeSecretList(buffer: Uint8Array | ArrayBuffer): SecretVersionEntry[];
+/**
+ * Recovery response set — see `library/src/interop/ffi/recovery.rs`. Each
+ * entry is a serialized `GetShareResponseMessage`, which the caller obtained
+ * from `extract_get_share_response`.
+ */
+export declare function encodeShareResponses(responses: Uint8Array[]): Uint8Array;
+/**
+ * Committed-share map — see `library/src/interop/ffi/sharing.rs`. Entries
+ * arrive sorted by channel id; the `Map` preserves that insertion order, so
+ * iterating the result is deterministic.
+ */
+export declare function decodeCommittedShareEntries(buffer: Uint8Array | ArrayBuffer): Array<{
+    channelId: bigint;
+    shareProto: Uint8Array;
+}>;

package/lib/binary.js

@@ -0,0 +1,164 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeSecretList = encodeSecretList;
+exports.decodeSecretList = decodeSecretList;
+exports.encodeShareResponses = encodeShareResponses;
+exports.decodeCommittedShareEntries = decodeCommittedShareEntries;
+/**
+ * The three FFI container formats.
+ *
+ * Most values cross this boundary as protobuf or JSON. Three do not: the C ABI
+ * ferries a set of items as a single hand-packed little-endian buffer, because
+ * a C signature cannot carry a variable-length array of variable-length items
+ * without one. Each format is specified in the module header of the Rust file
+ * that owns it, and the encoders below follow those specs exactly:
+ *
+ *   - the discovery secret list  (`library/src/interop/ffi/discovery.rs`)
+ *   - the recovery response set  (`library/src/interop/ffi/recovery.rs`)
+ *   - the committed-share map    (`library/src/interop/ffi/sharing.rs`)
+ *
+ * Everything here is representation, not protocol: no field is defaulted,
+ * reordered or interpreted.
+ */
+const codec_1 = require("./codec");
+class Writer {
+    constructor() {
+        this.chunks = [];
+    }
+    u32(value) {
+        const buffer = new Uint8Array(4);
+        new DataView(buffer.buffer).setUint32(0, value, true);
+        this.chunks.push(buffer);
+    }
+    u64(value) {
+        const buffer = new Uint8Array(8);
+        new DataView(buffer.buffer).setBigUint64(0, value, true);
+        this.chunks.push(buffer);
+    }
+    bytes(value) {
+        this.chunks.push(value);
+    }
+    finish() {
+        let length = 0;
+        for (const chunk of this.chunks) {
+            length += chunk.length;
+        }
+        const out = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of this.chunks) {
+            out.set(chunk, offset);
+            offset += chunk.length;
+        }
+        return out;
+    }
+}
+class Reader {
+    constructor(data) {
+        this.data = data;
+        this.offset = 0;
+        this.view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    }
+    require(count) {
+        if (this.offset + count > this.data.length) {
+            // A truncated container means the SDK and the library disagree about
+            // the format. Failing loudly beats returning a half-read set that a
+            // caller would take for the whole thing.
+            throw new Error(`DeRec: malformed FFI container — wanted ${count} bytes at offset ${this.offset}, have ${this.data.length - this.offset}`);
+        }
+    }
+    u32() {
+        this.require(4);
+        const value = this.view.getUint32(this.offset, true);
+        this.offset += 4;
+        return value;
+    }
+    u64() {
+        this.require(8);
+        const value = this.view.getBigUint64(this.offset, true);
+        this.offset += 8;
+        return value;
+    }
+    bytes(count) {
+        this.require(count);
+        const value = this.data.subarray(this.offset, this.offset + count);
+        this.offset += count;
+        return value;
+    }
+    atEnd() {
+        return this.offset === this.data.length;
+    }
+}
+function asBytes(buffer) {
+    return buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+}
+/** Discovery secret list — see `library/src/interop/ffi/discovery.rs`. */
+function encodeSecretList(entries) {
+    const writer = new Writer();
+    writer.u32(entries.length);
+    for (const entry of entries) {
+        writer.u64(entry.secret_id);
+        writer.u32(entry.versions.length);
+        for (const version of entry.versions) {
+            writer.u32(version.version);
+            const description = (0, codec_1.utf8Encode)(version.description);
+            writer.u32(description.length);
+            writer.bytes(description);
+        }
+    }
+    return writer.finish();
+}
+function decodeSecretList(buffer) {
+    const reader = new Reader(asBytes(buffer));
+    const count = reader.u32();
+    const entries = [];
+    for (let i = 0; i < count; i++) {
+        const secretId = reader.u64();
+        const versionCount = reader.u32();
+        const versions = [];
+        for (let v = 0; v < versionCount; v++) {
+            const version = reader.u32();
+            const descriptionLength = reader.u32();
+            versions.push({
+                version,
+                description: (0, codec_1.utf8Decode)(reader.bytes(descriptionLength)),
+            });
+        }
+        entries.push({ secret_id: secretId, versions });
+    }
+    return entries;
+}
+/**
+ * Recovery response set — see `library/src/interop/ffi/recovery.rs`. Each
+ * entry is a serialized `GetShareResponseMessage`, which the caller obtained
+ * from `extract_get_share_response`.
+ */
+function encodeShareResponses(responses) {
+    const writer = new Writer();
+    writer.u32(responses.length);
+    for (const response of responses) {
+        writer.u32(response.length);
+        writer.bytes(response);
+    }
+    return writer.finish();
+}
+/**
+ * Committed-share map — see `library/src/interop/ffi/sharing.rs`. Entries
+ * arrive sorted by channel id; the `Map` preserves that insertion order, so
+ * iterating the result is deterministic.
+ */
+function decodeCommittedShareEntries(buffer) {
+    const reader = new Reader(asBytes(buffer));
+    const count = reader.u32();
+    const entries = [];
+    for (let i = 0; i < count; i++) {
+        const channelId = reader.u64();
+        const shareLength = reader.u32();
+        entries.push({ channelId, shareProto: reader.bytes(shareLength) });
+    }
+    if (!reader.atEnd()) {
+        throw new Error('DeRec: trailing bytes after the committed-share map');
+    }
+    return entries;
+}

package/lib/codec.d.ts

@@ -0,0 +1,16 @@
+/**
+ * UTF-8 byte <-> string codec, shared by every JSON payload that crosses the
+ * JSI boundary (config, flow params, the events array, the `ContactMessage`
+ * JSON the pairing codec entry points exchange). Those payloads travel as
+ * bytes, not a JS string — the host functions read `ArrayBuffer`/typed-array
+ * arguments and hand back `ArrayBuffer` results (see `ProtocolHost.cpp`'s
+ * `bytesToArrayBuffer`). `TextDecoder`/`TextEncoder` are not declared as
+ * ambient globals under this package's `lib: ["ES2020"]` (no DOM lib) and the
+ * installed `@types/node` exposes them only from `node:util`, which does not
+ * exist in the Hermes runtime this code actually ships on. A small
+ * dependency-free codec avoids both problems.
+ */
+export declare function utf8Encode(text: string): Uint8Array;
+export declare function utf8Decode(bytes: Uint8Array): string;
+export declare function jsonToBytes(value: unknown): Uint8Array;
+export declare function jsonFromBytes(buffer: ArrayBuffer): unknown;

package/lib/codec.js

@@ -0,0 +1,80 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf8Encode = utf8Encode;
+exports.utf8Decode = utf8Decode;
+exports.jsonToBytes = jsonToBytes;
+exports.jsonFromBytes = jsonFromBytes;
+/**
+ * UTF-8 byte <-> string codec, shared by every JSON payload that crosses the
+ * JSI boundary (config, flow params, the events array, the `ContactMessage`
+ * JSON the pairing codec entry points exchange). Those payloads travel as
+ * bytes, not a JS string — the host functions read `ArrayBuffer`/typed-array
+ * arguments and hand back `ArrayBuffer` results (see `ProtocolHost.cpp`'s
+ * `bytesToArrayBuffer`). `TextDecoder`/`TextEncoder` are not declared as
+ * ambient globals under this package's `lib: ["ES2020"]` (no DOM lib) and the
+ * installed `@types/node` exposes them only from `node:util`, which does not
+ * exist in the Hermes runtime this code actually ships on. A small
+ * dependency-free codec avoids both problems.
+ */
+function utf8Encode(text) {
+    const bytes = [];
+    for (let i = 0; i < text.length; i++) {
+        let code = text.charCodeAt(i);
+        if (code >= 0xd800 && code <= 0xdbff && i + 1 < text.length) {
+            const low = text.charCodeAt(i + 1);
+            if (low >= 0xdc00 && low <= 0xdfff) {
+                code = (code - 0xd800) * 0x400 + (low - 0xdc00) + 0x10000;
+                i++;
+            }
+        }
+        if (code < 0x80) {
+            bytes.push(code);
+        }
+        else if (code < 0x800) {
+            bytes.push(0xc0 | (code >> 6), 0x80 | (code & 0x3f));
+        }
+        else if (code < 0x10000) {
+            bytes.push(0xe0 | (code >> 12), 0x80 | ((code >> 6) & 0x3f), 0x80 | (code & 0x3f));
+        }
+        else {
+            bytes.push(0xf0 | (code >> 18), 0x80 | ((code >> 12) & 0x3f), 0x80 | ((code >> 6) & 0x3f), 0x80 | (code & 0x3f));
+        }
+    }
+    return new Uint8Array(bytes);
+}
+function utf8Decode(bytes) {
+    let result = '';
+    let i = 0;
+    while (i < bytes.length) {
+        const byte1 = bytes[i++];
+        if (byte1 < 0x80) {
+            result += String.fromCharCode(byte1);
+        }
+        else if (byte1 < 0xe0) {
+            const byte2 = bytes[i++];
+            result += String.fromCharCode(((byte1 & 0x1f) << 6) | (byte2 & 0x3f));
+        }
+        else if (byte1 < 0xf0) {
+            const byte2 = bytes[i++];
+            const byte3 = bytes[i++];
+            result += String.fromCharCode(((byte1 & 0x0f) << 12) | ((byte2 & 0x3f) << 6) | (byte3 & 0x3f));
+        }
+        else {
+            const byte2 = bytes[i++];
+            const byte3 = bytes[i++];
+            const byte4 = bytes[i++];
+            const code = (((byte1 & 0x07) << 18) | ((byte2 & 0x3f) << 12) | ((byte3 & 0x3f) << 6) | (byte4 & 0x3f)) -
+                0x10000;
+            result += String.fromCharCode(0xd800 + (code >> 10), 0xdc00 + (code & 0x3ff));
+        }
+    }
+    return result;
+}
+function jsonToBytes(value) {
+    return utf8Encode(JSON.stringify(value));
+}
+function jsonFromBytes(buffer) {
+    return JSON.parse(utf8Decode(new Uint8Array(buffer)));
+}

package/lib/errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Every category name `derec_error_category_name` can return, and no others.
+ *
+ * This is the authoritative list for this SDK, mirrored by a test against
+ * `bindings/test_fixture/enums.json` so it cannot drift from the Rust enum.
+ * It deliberately differs from `@derec-alliance/nodejs`'s union, which was
+ * the original source of this file: that union lists `"wasm"`, a category no
+ * C-ABI binding can ever emit, and omits `"ok"`, `"ffi"` and `"state_store"`,
+ * which are live arms of `library/src/interop/ffi/error_names.rs` and reachable here.
+ * The nodejs union is arguably wrong on its own terms too, but correcting it
+ * is a change to that package, not this one.
+ */
+export declare const DEREC_ERROR_CATEGORIES: readonly ["ok", "ffi", "pairing", "sharing", "recovery", "verification", "discovery", "unpairing", "derec_message", "secret_store", "channel_store", "share_store", "input", "protobuf", "invariant", "state_store"];
+export type DeRecErrorCategory = (typeof DEREC_ERROR_CATEGORIES)[number];
+export interface DeRecError {
+    category: DeRecErrorCategory;
+    code: string;
+    message: string;
+    status?: number;
+    memo?: string;
+    expected?: number;
+    got?: number;
+}

package/lib/errors.js

@@ -0,0 +1,35 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEREC_ERROR_CATEGORIES = void 0;
+/**
+ * Every category name `derec_error_category_name` can return, and no others.
+ *
+ * This is the authoritative list for this SDK, mirrored by a test against
+ * `bindings/test_fixture/enums.json` so it cannot drift from the Rust enum.
+ * It deliberately differs from `@derec-alliance/nodejs`'s union, which was
+ * the original source of this file: that union lists `"wasm"`, a category no
+ * C-ABI binding can ever emit, and omits `"ok"`, `"ffi"` and `"state_store"`,
+ * which are live arms of `library/src/interop/ffi/error_names.rs` and reachable here.
+ * The nodejs union is arguably wrong on its own terms too, but correcting it
+ * is a change to that package, not this one.
+ */
+exports.DEREC_ERROR_CATEGORIES = [
+    "ok",
+    "ffi",
+    "pairing",
+    "sharing",
+    "recovery",
+    "verification",
+    "discovery",
+    "unpairing",
+    "derec_message",
+    "secret_store",
+    "channel_store",
+    "share_store",
+    "input",
+    "protobuf",
+    "invariant",
+    "state_store",
+];

package/lib/index.d.ts

@@ -0,0 +1,4 @@
+export * from './types';
+export * from './errors';
+export { primitives, envelope } from './primitives';
+export { DeRecProtocol, DeRecProtocolBuilder } from './protocol';

package/lib/index.js

@@ -0,0 +1,27 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeRecProtocolBuilder = exports.DeRecProtocol = exports.envelope = exports.primitives = void 0;
+__exportStar(require("./types"), exports);
+__exportStar(require("./errors"), exports);
+var primitives_1 = require("./primitives");
+Object.defineProperty(exports, "primitives", { enumerable: true, get: function () { return primitives_1.primitives; } });
+Object.defineProperty(exports, "envelope", { enumerable: true, get: function () { return primitives_1.envelope; } });
+var protocol_1 = require("./protocol");
+Object.defineProperty(exports, "DeRecProtocol", { enumerable: true, get: function () { return protocol_1.DeRecProtocol; } });
+Object.defineProperty(exports, "DeRecProtocolBuilder", { enumerable: true, get: function () { return protocol_1.DeRecProtocolBuilder; } });

package/lib/messages.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Selects which message the JSON codec operates on.
+ *
+ * Mirrors `MessageKind` in `bindings/test_fixture/enums.json`, which
+ * `library/src/interop/ffi/message_json.rs` asserts against — so a message
+ * added in Rust cannot reach this SDK as a silently unhandled value.
+ */
+export declare enum MessageKind {
+    PairRequest = 0,
+    PairResponse = 1,
+    PrePairRequest = 2,
+    PrePairResponse = 3,
+    GetSecretIdsVersionsRequest = 4,
+    GetSecretIdsVersionsResponse = 5,
+    GetShareRequest = 6,
+    GetShareResponse = 7,
+    StoreShareRequest = 8,
+    StoreShareResponse = 9,
+    UnpairRequest = 10,
+    UnpairResponse = 11,
+    VerifyShareRequest = 12,
+    VerifyShareResponse = 13,
+    TransportProtocol = 14,
+    CommunicationInfo = 15,
+    ParameterRange = 16,
+    CommittedDeRecShare = 17
+}
+/** JSON as it arrives from Rust, turned into the typed surface. */
+export declare function reviveMessage(value: unknown): unknown;
+/** Inverse of {@link reviveMessage}. */
+export declare function plainMessage(value: unknown): unknown;
+/** Protobuf wire bytes -> the typed message. */
+export declare function decodeMessage<T>(kind: MessageKind, proto: Uint8Array | ArrayBuffer): T;
+/** The typed message -> protobuf wire bytes. */
+export declare function encodeMessage(kind: MessageKind, value: unknown): Uint8Array;
+/**
+ * Encodes an optional message argument. The C ABI reads a zero-length buffer
+ * as "absent" for every optional message parameter, so `null`/`undefined`
+ * becomes an empty array rather than a decision made here.
+ */
+export declare function encodeOptionalMessage(kind: MessageKind, value: unknown | null | undefined): Uint8Array;

package/lib/messages.js

@@ -0,0 +1,192 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageKind = void 0;
+exports.reviveMessage = reviveMessage;
+exports.plainMessage = plainMessage;
+exports.decodeMessage = decodeMessage;
+exports.encodeMessage = encodeMessage;
+exports.encodeOptionalMessage = encodeOptionalMessage;
+/**
+ * Message marshalling.
+ *
+ * Every `extract_*` entry point in the C ABI hands back protobuf wire bytes,
+ * and every `produce_*` / `process_*` that takes a message takes the same.
+ * Go and .NET decode those with generated protobuf bindings; this SDK has
+ * none, so it goes through `derec_decode_message_json` /
+ * `derec_encode_message_json` instead (`library/src/interop/ffi/message_json.rs`),
+ * which re-emits each message as the JSON mirror the WASM SDKs already
+ * surface. The wire format therefore stays a single Rust-side decision — this
+ * file only changes representation.
+ *
+ * Two representation changes are needed to reach the exact JavaScript shape
+ * `@derec-alliance/nodejs` exposes, where `serde-wasm-bindgen` produces it
+ * natively:
+ *
+ *   - Wide numerics cross the JSON seam as decimal strings and are `bigint`
+ *     in the typed surface. `serde_json` would otherwise emit them as JSON
+ *     numbers, and `JSON.parse` silently rounds anything above 2^53 — the
+ *     corruption only appears once a real id happens to be large.
+ *   - Byte fields cross as arrays of decimal byte values (`serde_json` draws
+ *     no distinction for `serde_bytes`) and are `Uint8Array` in the typed
+ *     surface.
+ *
+ * Both conversions are keyed by field name, matching the lists in
+ * `message_json.rs`. A name-keyed walk is deliberate: `keep_list` is a
+ * genuine `number[]` and must stay one, so a structural "array of numbers is
+ * bytes" rule would corrupt it.
+ */
+const codec_1 = require("./codec");
+const native_1 = require("./native");
+/**
+ * Selects which message the JSON codec operates on.
+ *
+ * Mirrors `MessageKind` in `bindings/test_fixture/enums.json`, which
+ * `library/src/interop/ffi/message_json.rs` asserts against — so a message
+ * added in Rust cannot reach this SDK as a silently unhandled value.
+ */
+var MessageKind;
+(function (MessageKind) {
+    MessageKind[MessageKind["PairRequest"] = 0] = "PairRequest";
+    MessageKind[MessageKind["PairResponse"] = 1] = "PairResponse";
+    MessageKind[MessageKind["PrePairRequest"] = 2] = "PrePairRequest";
+    MessageKind[MessageKind["PrePairResponse"] = 3] = "PrePairResponse";
+    MessageKind[MessageKind["GetSecretIdsVersionsRequest"] = 4] = "GetSecretIdsVersionsRequest";
+    MessageKind[MessageKind["GetSecretIdsVersionsResponse"] = 5] = "GetSecretIdsVersionsResponse";
+    MessageKind[MessageKind["GetShareRequest"] = 6] = "GetShareRequest";
+    MessageKind[MessageKind["GetShareResponse"] = 7] = "GetShareResponse";
+    MessageKind[MessageKind["StoreShareRequest"] = 8] = "StoreShareRequest";
+    MessageKind[MessageKind["StoreShareResponse"] = 9] = "StoreShareResponse";
+    MessageKind[MessageKind["UnpairRequest"] = 10] = "UnpairRequest";
+    MessageKind[MessageKind["UnpairResponse"] = 11] = "UnpairResponse";
+    MessageKind[MessageKind["VerifyShareRequest"] = 12] = "VerifyShareRequest";
+    MessageKind[MessageKind["VerifyShareResponse"] = 13] = "VerifyShareResponse";
+    MessageKind[MessageKind["TransportProtocol"] = 14] = "TransportProtocol";
+    MessageKind[MessageKind["CommunicationInfo"] = 15] = "CommunicationInfo";
+    MessageKind[MessageKind["ParameterRange"] = 16] = "ParameterRange";
+    MessageKind[MessageKind["CommittedDeRecShare"] = 17] = "CommittedDeRecShare";
+})(MessageKind || (exports.MessageKind = MessageKind = {}));
+/** Fields the codec widens to decimal strings; `bigint` on this side. */
+const BIGINT_STRING_FIELDS = new Set([
+    'channel_id',
+    'nonce',
+    'secret_id',
+    'replica_id',
+    'min_share_size',
+    'max_share_size',
+    'min_time_between_verifications',
+    'max_time_between_verifications',
+    'min_time_between_share_updates',
+    'max_time_between_share_updates',
+    'min_unresponsive_deletion_timeout',
+    'max_unresponsive_deletion_timeout',
+    'min_unresponsive_deactivation_timeout',
+    'max_unresponsive_deactivation_timeout',
+]);
+/**
+ * `Timestamp.seconds` is an `i64` holding a Unix seconds value. It stays a
+ * JSON number — no realistic timestamp approaches 2^53 — but the typed
+ * surface declares it `bigint`, matching `@derec-alliance/nodejs`.
+ */
+const BIGINT_NUMBER_FIELDS = new Set(['seconds']);
+/** Fields carrying `Vec<u8>`; `Uint8Array` on this side. */
+const BYTE_FIELDS = new Set([
+    'mlkem_ciphertext',
+    'mlkem_encapsulation_key',
+    'ecies_public_key',
+    'contact_binding_hash',
+    'bytes_value',
+    'share',
+    'committed_de_rec_share',
+    'de_rec_share',
+    'commitment',
+    'hash',
+]);
+/** JSON as it arrives from Rust, turned into the typed surface. */
+function reviveMessage(value) {
+    if (Array.isArray(value)) {
+        return value.map(reviveMessage);
+    }
+    if (value === null || typeof value !== 'object') {
+        return value;
+    }
+    const out = {};
+    for (const [key, field] of Object.entries(value)) {
+        if (field === null || field === undefined) {
+            // A `null` from an absent `Option` reads as `undefined` in the typed
+            // surface, matching what `serde-wasm-bindgen` produces.
+            out[key] = undefined;
+        }
+        else if (BIGINT_STRING_FIELDS.has(key) && typeof field === 'string') {
+            out[key] = BigInt(field);
+        }
+        else if (BIGINT_NUMBER_FIELDS.has(key) && typeof field === 'number') {
+            out[key] = BigInt(field);
+        }
+        else if (BYTE_FIELDS.has(key) && Array.isArray(field)) {
+            out[key] = Uint8Array.from(field);
+        }
+        else {
+            out[key] = reviveMessage(field);
+        }
+    }
+    return out;
+}
+/** Inverse of {@link reviveMessage}. */
+function plainMessage(value) {
+    if (Array.isArray(value)) {
+        return value.map(plainMessage);
+    }
+    if (value instanceof Uint8Array) {
+        return Array.from(value);
+    }
+    if (typeof value === 'bigint') {
+        return value.toString();
+    }
+    if (value === null || typeof value !== 'object') {
+        return value;
+    }
+    const out = {};
+    for (const [key, field] of Object.entries(value)) {
+        if (field === undefined) {
+            // Left out entirely rather than sent as `null`: serde reads a missing
+            // `Option` field as `None`, and an explicit `null` for a field the DTO
+            // does not declare optional would fail to deserialize.
+            continue;
+        }
+        if (BIGINT_NUMBER_FIELDS.has(key) && typeof field === 'bigint') {
+            out[key] = Number(field);
+        }
+        else if (field instanceof Uint8Array) {
+            out[key] = Array.from(field);
+        }
+        else {
+            out[key] = plainMessage(field);
+        }
+    }
+    return out;
+}
+function host() {
+    return (0, native_1.getNative)();
+}
+/** Protobuf wire bytes -> the typed message. */
+function decodeMessage(kind, proto) {
+    const buffer = host().decode_message_json(kind, proto);
+    return reviveMessage((0, codec_1.jsonFromBytes)(buffer));
+}
+/** The typed message -> protobuf wire bytes. */
+function encodeMessage(kind, value) {
+    const json = (0, codec_1.jsonToBytes)(plainMessage(value));
+    return new Uint8Array(host().encode_message_json(kind, json));
+}
+/**
+ * Encodes an optional message argument. The C ABI reads a zero-length buffer
+ * as "absent" for every optional message parameter, so `null`/`undefined`
+ * becomes an empty array rather than a decision made here.
+ */
+function encodeOptionalMessage(kind, value) {
+    return value === null || value === undefined
+        ? new Uint8Array(0)
+        : encodeMessage(kind, value);
+}

package/lib/native.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Accessor for the JSI host object installed by the native module.
+ *
+ * The host object is installed directly into the runtime's global scope
+ * rather than exposed through React Native's codegen, because the data
+ * surface passes `ArrayBuffer`s that TurboModule specs cannot express.
+ */
+export interface DeRecNative {
+    version(): string;
+}
+export declare function getNative(): DeRecNative;

package/lib/native.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getNative = getNative;
+/**
+ * Asks the native module to install the host object.
+ *
+ * iOS needs this only as a fallback: the module implements
+ * `RCTTurboModuleWithJSIBindings`, so the platform installs the host object
+ * before any JavaScript runs. Android has no equivalent hook for a module that
+ * is not code-generated, so the install has to be triggered from here — a
+ * blocking synchronous `@ReactMethod`, which is why the host object is present
+ * by the time this returns.
+ *
+ * Everything is behind a lazy `require` and a `try`: this module is imported by
+ * unit tests running under plain Node, where `react-native` cannot resolve, and
+ * a missing native module must still surface as the explanatory error below
+ * rather than a resolution failure from a dependency the caller never named.
+ */
+function requestInstall() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const { NativeModules } = require('react-native');
+        NativeModules.DeRec?.install?.();
+    }
+    catch {
+        // Left to the caller: the check below reports the actionable message.
+    }
+}
+function getNative() {
+    let installed = globalThis.__DeRec;
+    if (installed === undefined || installed === null) {
+        requestInstall();
+        installed = globalThis.__DeRec;
+    }
+    if (installed === undefined || installed === null) {
+        throw new Error('DeRec native module is not installed. Rebuild the app after adding ' +
+            '@derec-alliance/react-native (pod install on iOS, Gradle sync on Android).');
+    }
+    return installed;
+}