@derec-alliance/react-native 0.0.1

package/lib/types.js

@@ -0,0 +1,63 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FlowKind = exports.ContactMode = exports.SenderKind = void 0;
+var SenderKind;
+(function (SenderKind) {
+    SenderKind[SenderKind["Owner"] = 0] = "Owner";
+    SenderKind[SenderKind["Helper"] = 1] = "Helper";
+    SenderKind[SenderKind["ReplicaSource"] = 3] = "ReplicaSource";
+    SenderKind[SenderKind["ReplicaDestination"] = 4] = "ReplicaDestination";
+})(SenderKind || (exports.SenderKind = SenderKind = {}));
+/**
+ * Selects how the initiator's public encryption material is delivered in a
+ * `ContactMessage`.
+ *
+ * - `InlineKeys` (default): keys are embedded in the contact itself.
+ * - `HashedKeys`: only a SHA-384 commitment to the keys is in the contact;
+ *   the scanner must fetch the actual keys over the wire via the `PrePair`
+ *   round-trip and verify them against the commitment before pairing.
+ * - `NoKeys`: no key material and no commitment. The contact carries only
+ *   `channel_id`, `nonce`, and `transport_protocol` — small enough to be
+ *   hand-typed or dictated. Keys are generated on the fly by the contact
+ *   creator when the `PrePairRequest` arrives; the scanner accepts them
+ *   without cryptographic verification. Trust rests entirely on the OOB
+ *   delivery channel being fully trusted (e.g. a verified email from an
+ *   already-KYC-authenticated institution). Applications MUST rate-limit
+ *   inbound `PrePairRequest`s per channel and expire outstanding NoKeys
+ *   contacts on a short timer.
+ *
+ *   Because nothing binds the published keys to the contact, the channel is
+ *   held `Pending` until `verifyFingerprint` succeeds on both sides: it is
+ *   not a publish target, not a recovery source, and inbound messages on it
+ *   are ignored. A man-in-the-middle on the plaintext `PrePair` leg leaves
+ *   the two sides with different shared keys and so different fingerprints,
+ *   which is what the comparison catches — the role `contact_binding_hash`
+ *   plays for `HashedKeys`.
+ */
+var ContactMode;
+(function (ContactMode) {
+    ContactMode[ContactMode["InlineKeys"] = 0] = "InlineKeys";
+    ContactMode[ContactMode["HashedKeys"] = 1] = "HashedKeys";
+    ContactMode[ContactMode["NoKeys"] = 2] = "NoKeys";
+})(ContactMode || (exports.ContactMode = ContactMode = {}));
+var FlowKind;
+(function (FlowKind) {
+    FlowKind[FlowKind["Pairing"] = 0] = "Pairing";
+    FlowKind[FlowKind["Discovery"] = 1] = "Discovery";
+    FlowKind[FlowKind["ProtectSecret"] = 2] = "ProtectSecret";
+    FlowKind[FlowKind["VerifyShares"] = 3] = "VerifyShares";
+    FlowKind[FlowKind["RecoverSecret"] = 4] = "RecoverSecret";
+    FlowKind[FlowKind["Unpair"] = 5] = "Unpair";
+    FlowKind[FlowKind["UpdateChannelInfo"] = 6] = "UpdateChannelInfo";
+    /** Ask the replica group whether this device is behind, and catch up if it
+     *  is. Replica-only, and takes no parameters — the group and this device's
+     *  own version both come from the stores. */
+    FlowKind[FlowKind["SyncCheck"] = 7] = "SyncCheck";
+    /** Remove a member from the replica group. Replica-only. Naming this device
+     *  is a voluntary departure; naming another is an eviction. Params:
+     *  `{ replica_id: string; memo?: string }` — `replica_id` is a decimal
+     *  string so ids above 2^53 survive JS number handling. */
+    FlowKind[FlowKind["RemoveReplica"] = 8] = "RemoveReplica";
+})(FlowKind || (exports.FlowKind = FlowKind = {}));

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@derec-alliance/react-native",
+  "version": "0.0.1",
+  "description": "React Native bindings for derec-library, the Rust SDK for the DeRec protocol.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/derecalliance/lib-derec"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib",
+    "src",
+    "cpp",
+    "ios",
+    "android",
+    "!android/build",
+    "!android/.cxx",
+    "!cpp/tests",
+    "DeRec.podspec",
+    "react-native.config.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json",
+    "test": "jest",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "react": ">=18.2.0",
+    "react-native": ">=0.76.0"
+  },
+  "devDependencies": {
+    "@types/jest": "^30.0.0",
+    "@types/node": "^26.3.0",
+    "jest": "^30.4.2",
+    "react-native": "^0.87.0",
+    "ts-jest": "^29.4.12",
+    "typescript": "^5.9.3"
+  },
+  "keywords": [
+    "derec",
+    "decentralized",
+    "recovery",
+    "secret-sharing",
+    "sdk",
+    "react-native",
+    "ios",
+    "android",
+    "typescript",
+    "jsi"
+  ]
+}

package/react-native.config.js

@@ -0,0 +1,19 @@
+// Autolinking configuration.
+//
+// `sourceDir` must be RELATIVE to the package root: the CLI does
+// `path.join(root, sourceDir)` (`cli-config-android/build/config/index.js`),
+// so an absolute path is appended to the package root and resolves to a
+// directory that does not exist. The Android config then returns null and the
+// module is dropped from the generated `PackageList` — silently, with no build
+// error and no autolinking warning.
+//
+// iOS needs no entry at all: CocoaPods discovers `DeRec.podspec` at the package
+// root by convention, and naming it explicitly under `dependency.platforms.ios`
+// fails the CLI's config schema ("podspecPath is not allowed").
+module.exports = {
+  dependency: {
+    platforms: {
+      android: { sourceDir: 'android' },
+    },
+  },
+};

package/src/binary.ts

@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+/**
+ * The three FFI container formats.
+ *
+ * Most values cross this boundary as protobuf or JSON. Three do not: the C ABI
+ * ferries a set of items as a single hand-packed little-endian buffer, because
+ * a C signature cannot carry a variable-length array of variable-length items
+ * without one. Each format is specified in the module header of the Rust file
+ * that owns it, and the encoders below follow those specs exactly:
+ *
+ *   - the discovery secret list  (`library/src/interop/ffi/discovery.rs`)
+ *   - the recovery response set  (`library/src/interop/ffi/recovery.rs`)
+ *   - the committed-share map    (`library/src/interop/ffi/sharing.rs`)
+ *
+ * Everything here is representation, not protocol: no field is defaulted,
+ * reordered or interpreted.
+ */
+
+import { utf8Decode, utf8Encode } from './codec';
+import type { SecretVersionEntry, VersionEntry } from './types';
+
+class Writer {
+  private readonly chunks: Uint8Array[] = [];
+
+  u32(value: number): void {
+    const buffer = new Uint8Array(4);
+    new DataView(buffer.buffer).setUint32(0, value, true);
+    this.chunks.push(buffer);
+  }
+
+  u64(value: bigint): void {
+    const buffer = new Uint8Array(8);
+    new DataView(buffer.buffer).setBigUint64(0, value, true);
+    this.chunks.push(buffer);
+  }
+
+  bytes(value: Uint8Array): void {
+    this.chunks.push(value);
+  }
+
+  finish(): Uint8Array {
+    let length = 0;
+    for (const chunk of this.chunks) {
+      length += chunk.length;
+    }
+    const out = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of this.chunks) {
+      out.set(chunk, offset);
+      offset += chunk.length;
+    }
+    return out;
+  }
+}
+
+class Reader {
+  private offset = 0;
+  private readonly view: DataView;
+
+  constructor(private readonly data: Uint8Array) {
+    this.view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  }
+
+  private require(count: number): void {
+    if (this.offset + count > this.data.length) {
+      // A truncated container means the SDK and the library disagree about
+      // the format. Failing loudly beats returning a half-read set that a
+      // caller would take for the whole thing.
+      throw new Error(
+        `DeRec: malformed FFI container — wanted ${count} bytes at offset ${this.offset}, have ${
+          this.data.length - this.offset
+        }`,
+      );
+    }
+  }
+
+  u32(): number {
+    this.require(4);
+    const value = this.view.getUint32(this.offset, true);
+    this.offset += 4;
+    return value;
+  }
+
+  u64(): bigint {
+    this.require(8);
+    const value = this.view.getBigUint64(this.offset, true);
+    this.offset += 8;
+    return value;
+  }
+
+  bytes(count: number): Uint8Array {
+    this.require(count);
+    const value = this.data.subarray(this.offset, this.offset + count);
+    this.offset += count;
+    return value;
+  }
+
+  atEnd(): boolean {
+    return this.offset === this.data.length;
+  }
+}
+
+function asBytes(buffer: Uint8Array | ArrayBuffer): Uint8Array {
+  return buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+}
+
+/** Discovery secret list — see `library/src/interop/ffi/discovery.rs`. */
+export function encodeSecretList(entries: SecretVersionEntry[]): Uint8Array {
+  const writer = new Writer();
+  writer.u32(entries.length);
+  for (const entry of entries) {
+    writer.u64(entry.secret_id);
+    writer.u32(entry.versions.length);
+    for (const version of entry.versions) {
+      writer.u32(version.version);
+      const description = utf8Encode(version.description);
+      writer.u32(description.length);
+      writer.bytes(description);
+    }
+  }
+  return writer.finish();
+}
+
+export function decodeSecretList(buffer: Uint8Array | ArrayBuffer): SecretVersionEntry[] {
+  const reader = new Reader(asBytes(buffer));
+  const count = reader.u32();
+  const entries: SecretVersionEntry[] = [];
+  for (let i = 0; i < count; i++) {
+    const secretId = reader.u64();
+    const versionCount = reader.u32();
+    const versions: VersionEntry[] = [];
+    for (let v = 0; v < versionCount; v++) {
+      const version = reader.u32();
+      const descriptionLength = reader.u32();
+      versions.push({
+        version,
+        description: utf8Decode(reader.bytes(descriptionLength)),
+      });
+    }
+    entries.push({ secret_id: secretId, versions });
+  }
+  return entries;
+}
+
+/**
+ * Recovery response set — see `library/src/interop/ffi/recovery.rs`. Each
+ * entry is a serialized `GetShareResponseMessage`, which the caller obtained
+ * from `extract_get_share_response`.
+ */
+export function encodeShareResponses(responses: Uint8Array[]): Uint8Array {
+  const writer = new Writer();
+  writer.u32(responses.length);
+  for (const response of responses) {
+    writer.u32(response.length);
+    writer.bytes(response);
+  }
+  return writer.finish();
+}
+
+/**
+ * Committed-share map — see `library/src/interop/ffi/sharing.rs`. Entries
+ * arrive sorted by channel id; the `Map` preserves that insertion order, so
+ * iterating the result is deterministic.
+ */
+export function decodeCommittedShareEntries(
+  buffer: Uint8Array | ArrayBuffer,
+): Array<{ channelId: bigint; shareProto: Uint8Array }> {
+  const reader = new Reader(asBytes(buffer));
+  const count = reader.u32();
+  const entries: Array<{ channelId: bigint; shareProto: Uint8Array }> = [];
+  for (let i = 0; i < count; i++) {
+    const channelId = reader.u64();
+    const shareLength = reader.u32();
+    entries.push({ channelId, shareProto: reader.bytes(shareLength) });
+  }
+  if (!reader.atEnd()) {
+    throw new Error('DeRec: trailing bytes after the committed-share map');
+  }
+  return entries;
+}

package/src/codec.ts

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+/**
+ * UTF-8 byte <-> string codec, shared by every JSON payload that crosses the
+ * JSI boundary (config, flow params, the events array, the `ContactMessage`
+ * JSON the pairing codec entry points exchange). Those payloads travel as
+ * bytes, not a JS string — the host functions read `ArrayBuffer`/typed-array
+ * arguments and hand back `ArrayBuffer` results (see `ProtocolHost.cpp`'s
+ * `bytesToArrayBuffer`). `TextDecoder`/`TextEncoder` are not declared as
+ * ambient globals under this package's `lib: ["ES2020"]` (no DOM lib) and the
+ * installed `@types/node` exposes them only from `node:util`, which does not
+ * exist in the Hermes runtime this code actually ships on. A small
+ * dependency-free codec avoids both problems.
+ */
+
+export function utf8Encode(text: string): Uint8Array {
+  const bytes: number[] = [];
+  for (let i = 0; i < text.length; i++) {
+    let code = text.charCodeAt(i);
+    if (code >= 0xd800 && code <= 0xdbff && i + 1 < text.length) {
+      const low = text.charCodeAt(i + 1);
+      if (low >= 0xdc00 && low <= 0xdfff) {
+        code = (code - 0xd800) * 0x400 + (low - 0xdc00) + 0x10000;
+        i++;
+      }
+    }
+    if (code < 0x80) {
+      bytes.push(code);
+    } else if (code < 0x800) {
+      bytes.push(0xc0 | (code >> 6), 0x80 | (code & 0x3f));
+    } else if (code < 0x10000) {
+      bytes.push(0xe0 | (code >> 12), 0x80 | ((code >> 6) & 0x3f), 0x80 | (code & 0x3f));
+    } else {
+      bytes.push(
+        0xf0 | (code >> 18),
+        0x80 | ((code >> 12) & 0x3f),
+        0x80 | ((code >> 6) & 0x3f),
+        0x80 | (code & 0x3f),
+      );
+    }
+  }
+  return new Uint8Array(bytes);
+}
+
+export function utf8Decode(bytes: Uint8Array): string {
+  let result = '';
+  let i = 0;
+  while (i < bytes.length) {
+    const byte1 = bytes[i++];
+    if (byte1 < 0x80) {
+      result += String.fromCharCode(byte1);
+    } else if (byte1 < 0xe0) {
+      const byte2 = bytes[i++];
+      result += String.fromCharCode(((byte1 & 0x1f) << 6) | (byte2 & 0x3f));
+    } else if (byte1 < 0xf0) {
+      const byte2 = bytes[i++];
+      const byte3 = bytes[i++];
+      result += String.fromCharCode(((byte1 & 0x0f) << 12) | ((byte2 & 0x3f) << 6) | (byte3 & 0x3f));
+    } else {
+      const byte2 = bytes[i++];
+      const byte3 = bytes[i++];
+      const byte4 = bytes[i++];
+      const code =
+        (((byte1 & 0x07) << 18) | ((byte2 & 0x3f) << 12) | ((byte3 & 0x3f) << 6) | (byte4 & 0x3f)) -
+        0x10000;
+      result += String.fromCharCode(0xd800 + (code >> 10), 0xdc00 + (code & 0x3ff));
+    }
+  }
+  return result;
+}
+
+export function jsonToBytes(value: unknown): Uint8Array {
+  return utf8Encode(JSON.stringify(value));
+}
+
+export function jsonFromBytes(buffer: ArrayBuffer): unknown {
+  return JSON.parse(utf8Decode(new Uint8Array(buffer)));
+}

package/src/errors.ts

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+/**
+ * Every category name `derec_error_category_name` can return, and no others.
+ *
+ * This is the authoritative list for this SDK, mirrored by a test against
+ * `bindings/test_fixture/enums.json` so it cannot drift from the Rust enum.
+ * It deliberately differs from `@derec-alliance/nodejs`'s union, which was
+ * the original source of this file: that union lists `"wasm"`, a category no
+ * C-ABI binding can ever emit, and omits `"ok"`, `"ffi"` and `"state_store"`,
+ * which are live arms of `library/src/interop/ffi/error_names.rs` and reachable here.
+ * The nodejs union is arguably wrong on its own terms too, but correcting it
+ * is a change to that package, not this one.
+ */
+export const DEREC_ERROR_CATEGORIES = [
+  "ok",
+  "ffi",
+  "pairing",
+  "sharing",
+  "recovery",
+  "verification",
+  "discovery",
+  "unpairing",
+  "derec_message",
+  "secret_store",
+  "channel_store",
+  "share_store",
+  "input",
+  "protobuf",
+  "invariant",
+  "state_store",
+] as const;
+
+export type DeRecErrorCategory = (typeof DEREC_ERROR_CATEGORIES)[number];
+
+export interface DeRecError {
+  category: DeRecErrorCategory;
+  code: string;
+  message: string;
+  status?: number;
+  memo?: string;
+  expected?: number;
+  got?: number;
+}

package/src/index.ts

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+export * from './types';
+export * from './errors';
+export { primitives, envelope } from './primitives';
+export { DeRecProtocol, DeRecProtocolBuilder } from './protocol';

package/src/messages.ts

@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+/**
+ * Message marshalling.
+ *
+ * Every `extract_*` entry point in the C ABI hands back protobuf wire bytes,
+ * and every `produce_*` / `process_*` that takes a message takes the same.
+ * Go and .NET decode those with generated protobuf bindings; this SDK has
+ * none, so it goes through `derec_decode_message_json` /
+ * `derec_encode_message_json` instead (`library/src/interop/ffi/message_json.rs`),
+ * which re-emits each message as the JSON mirror the WASM SDKs already
+ * surface. The wire format therefore stays a single Rust-side decision — this
+ * file only changes representation.
+ *
+ * Two representation changes are needed to reach the exact JavaScript shape
+ * `@derec-alliance/nodejs` exposes, where `serde-wasm-bindgen` produces it
+ * natively:
+ *
+ *   - Wide numerics cross the JSON seam as decimal strings and are `bigint`
+ *     in the typed surface. `serde_json` would otherwise emit them as JSON
+ *     numbers, and `JSON.parse` silently rounds anything above 2^53 — the
+ *     corruption only appears once a real id happens to be large.
+ *   - Byte fields cross as arrays of decimal byte values (`serde_json` draws
+ *     no distinction for `serde_bytes`) and are `Uint8Array` in the typed
+ *     surface.
+ *
+ * Both conversions are keyed by field name, matching the lists in
+ * `message_json.rs`. A name-keyed walk is deliberate: `keep_list` is a
+ * genuine `number[]` and must stay one, so a structural "array of numbers is
+ * bytes" rule would corrupt it.
+ */
+
+import { jsonFromBytes, jsonToBytes } from './codec';
+import { getNative } from './native';
+
+/**
+ * Selects which message the JSON codec operates on.
+ *
+ * Mirrors `MessageKind` in `bindings/test_fixture/enums.json`, which
+ * `library/src/interop/ffi/message_json.rs` asserts against — so a message
+ * added in Rust cannot reach this SDK as a silently unhandled value.
+ */
+export enum MessageKind {
+  PairRequest = 0,
+  PairResponse = 1,
+  PrePairRequest = 2,
+  PrePairResponse = 3,
+  GetSecretIdsVersionsRequest = 4,
+  GetSecretIdsVersionsResponse = 5,
+  GetShareRequest = 6,
+  GetShareResponse = 7,
+  StoreShareRequest = 8,
+  StoreShareResponse = 9,
+  UnpairRequest = 10,
+  UnpairResponse = 11,
+  VerifyShareRequest = 12,
+  VerifyShareResponse = 13,
+  TransportProtocol = 14,
+  CommunicationInfo = 15,
+  ParameterRange = 16,
+  CommittedDeRecShare = 17,
+}
+
+/** Fields the codec widens to decimal strings; `bigint` on this side. */
+const BIGINT_STRING_FIELDS = new Set([
+  'channel_id',
+  'nonce',
+  'secret_id',
+  'replica_id',
+  'min_share_size',
+  'max_share_size',
+  'min_time_between_verifications',
+  'max_time_between_verifications',
+  'min_time_between_share_updates',
+  'max_time_between_share_updates',
+  'min_unresponsive_deletion_timeout',
+  'max_unresponsive_deletion_timeout',
+  'min_unresponsive_deactivation_timeout',
+  'max_unresponsive_deactivation_timeout',
+]);
+
+/**
+ * `Timestamp.seconds` is an `i64` holding a Unix seconds value. It stays a
+ * JSON number — no realistic timestamp approaches 2^53 — but the typed
+ * surface declares it `bigint`, matching `@derec-alliance/nodejs`.
+ */
+const BIGINT_NUMBER_FIELDS = new Set(['seconds']);
+
+/** Fields carrying `Vec<u8>`; `Uint8Array` on this side. */
+const BYTE_FIELDS = new Set([
+  'mlkem_ciphertext',
+  'mlkem_encapsulation_key',
+  'ecies_public_key',
+  'contact_binding_hash',
+  'bytes_value',
+  'share',
+  'committed_de_rec_share',
+  'de_rec_share',
+  'commitment',
+  'hash',
+]);
+
+/** JSON as it arrives from Rust, turned into the typed surface. */
+export function reviveMessage(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(reviveMessage);
+  }
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  const out: Record<string, unknown> = {};
+  for (const [key, field] of Object.entries(value as Record<string, unknown>)) {
+    if (field === null || field === undefined) {
+      // A `null` from an absent `Option` reads as `undefined` in the typed
+      // surface, matching what `serde-wasm-bindgen` produces.
+      out[key] = undefined;
+    } else if (BIGINT_STRING_FIELDS.has(key) && typeof field === 'string') {
+      out[key] = BigInt(field);
+    } else if (BIGINT_NUMBER_FIELDS.has(key) && typeof field === 'number') {
+      out[key] = BigInt(field);
+    } else if (BYTE_FIELDS.has(key) && Array.isArray(field)) {
+      out[key] = Uint8Array.from(field as number[]);
+    } else {
+      out[key] = reviveMessage(field);
+    }
+  }
+  return out;
+}
+
+/** Inverse of {@link reviveMessage}. */
+export function plainMessage(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(plainMessage);
+  }
+  if (value instanceof Uint8Array) {
+    return Array.from(value);
+  }
+  if (typeof value === 'bigint') {
+    return value.toString();
+  }
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  const out: Record<string, unknown> = {};
+  for (const [key, field] of Object.entries(value as Record<string, unknown>)) {
+    if (field === undefined) {
+      // Left out entirely rather than sent as `null`: serde reads a missing
+      // `Option` field as `None`, and an explicit `null` for a field the DTO
+      // does not declare optional would fail to deserialize.
+      continue;
+    }
+    if (BIGINT_NUMBER_FIELDS.has(key) && typeof field === 'bigint') {
+      out[key] = Number(field);
+    } else if (field instanceof Uint8Array) {
+      out[key] = Array.from(field);
+    } else {
+      out[key] = plainMessage(field);
+    }
+  }
+  return out;
+}
+
+function host(): Record<string, (...args: unknown[]) => unknown> {
+  return getNative() as never as Record<string, (...args: unknown[]) => unknown>;
+}
+
+/** Protobuf wire bytes -> the typed message. */
+export function decodeMessage<T>(kind: MessageKind, proto: Uint8Array | ArrayBuffer): T {
+  const buffer = host().decode_message_json(kind, proto) as ArrayBuffer;
+  return reviveMessage(jsonFromBytes(buffer)) as T;
+}
+
+/** The typed message -> protobuf wire bytes. */
+export function encodeMessage(kind: MessageKind, value: unknown): Uint8Array {
+  const json = jsonToBytes(plainMessage(value));
+  return new Uint8Array(host().encode_message_json(kind, json) as ArrayBuffer);
+}
+
+/**
+ * Encodes an optional message argument. The C ABI reads a zero-length buffer
+ * as "absent" for every optional message parameter, so `null`/`undefined`
+ * becomes an empty array rather than a decision made here.
+ */
+export function encodeOptionalMessage(
+  kind: MessageKind,
+  value: unknown | null | undefined,
+): Uint8Array {
+  return value === null || value === undefined
+    ? new Uint8Array(0)
+    : encodeMessage(kind, value);
+}