@derec-alliance/react-native 0.0.1

package/android/src/main/jni/OnLoad.cpp

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+#include <fbjni/fbjni.h>
+#include <jni.h>
+#include <jsi/jsi.h>
+#include <ReactCommon/CallInvokerHolder.h>
+
+#include <memory>
+
+#include "DeRecInstaller.h"
+#include "RuntimeInvoker.h"
+
+extern "C" JNIEXPORT void JNICALL
+Java_org_derec_DeRecModule_nativeInstall(JNIEnv* env,
+                                         jobject /*thiz*/,
+                                         jlong runtimePtr,
+                                         jobject callInvokerHolder) {
+  auto* runtime = reinterpret_cast<facebook::jsi::Runtime*>(runtimePtr);
+  if (runtime == nullptr) {
+    return;
+  }
+  auto holder = facebook::jni::alias_ref<
+      facebook::react::CallInvokerHolder::javaobject>{
+      static_cast<facebook::react::CallInvokerHolder::javaobject>(
+          callInvokerHolder)};
+  auto invoker = std::make_shared<derec::RuntimeInvoker>(
+      holder->cthis()->getCallInvoker());
+  derec::install(*runtime, invoker);
+}
+
+extern "C" JNIEXPORT void JNICALL
+Java_org_derec_DeRecModule_nativeInvalidate(JNIEnv*, jobject) {
+  derec::invalidateAll();
+}
+
+extern "C" JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM* vm, void*) {
+  return facebook::jni::initialize(vm, [] {});
+}

package/cpp/Convert.cpp

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+#include "Convert.h"
+
+#include <cstdlib>
+#include <cstring>
+
+namespace derec {
+
+OwnedBytes allocBytes(size_t len) {
+  if (len == 0) {
+    return OwnedBytes{nullptr, 0};
+  }
+  auto* ptr = static_cast<uint8_t*>(std::malloc(len));
+  return OwnedBytes{ptr, ptr == nullptr ? 0 : len};
+}
+
+void freeBytes(uint8_t* ptr, size_t /*len*/) {
+  if (ptr != nullptr) {
+    std::free(ptr);
+  }
+}
+
+std::vector<uint8_t> takeBuffer(DeRecBuffer& buffer) {
+  std::vector<uint8_t> out;
+  if (buffer.ptr != nullptr && buffer.len > 0) {
+    out.assign(buffer.ptr, buffer.ptr + buffer.len);
+  }
+  derec_free_buffer(buffer.ptr, buffer.len);
+  buffer.ptr = nullptr;
+  buffer.len = 0;
+  return out;
+}
+
+std::string takeString(char* owned) {
+  if (owned == nullptr) {
+    return {};
+  }
+  std::string out(owned);
+  derec_free_string(owned);
+  return out;
+}
+
+std::pair<std::string, std::string> errorName(int32_t category, int32_t code) {
+  return {std::string(derec_error_category_name(category)),
+          std::string(derec_error_code_name(code))};
+}
+
+}  // namespace derec

package/cpp/Convert.h

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+extern "C" {
+#include "derec_ffi.h"
+}
+
+namespace derec {
+
+/// A byte buffer allocated by this binding. Ownership passes to Rust across a
+/// store callback out-parameter; Rust copies the contents and hands the
+/// pointer back through the callback struct's `free_buffer`.
+struct OwnedBytes {
+  uint8_t* ptr;
+  size_t len;
+};
+
+OwnedBytes allocBytes(size_t len);
+void freeBytes(uint8_t* ptr, size_t len);
+
+/// Copy `buffer` into a vector and release the Rust allocation.
+std::vector<uint8_t> takeBuffer(DeRecBuffer& buffer);
+
+/// Copy a Rust-owned C string and release it via `derec_free_string`.
+std::string takeString(char* owned);
+
+/// Resolve the `(category, code)` name pair from the crate's accessors.
+std::pair<std::string, std::string> errorName(int32_t category, int32_t code);
+
+}  // namespace derec

package/cpp/DeRecInstaller.cpp

@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+#include "DeRecInstaller.h"
+
+#include <memory>
+#include <mutex>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "Convert.h"
+#include "JsCallbackBridge.h"
+#include "Primitives.h"
+#include "ProtocolHost.h"
+#include "StoreCallbacks.h"
+
+using namespace facebook;
+
+namespace derec {
+
+namespace {
+
+std::mutex& registryMutex() {
+  static std::mutex m;
+  return m;
+}
+
+std::vector<std::weak_ptr<InstanceState>>& registry() {
+  static std::vector<std::weak_ptr<InstanceState>> instances;
+  return instances;
+}
+
+void requireArgs(jsi::Runtime& rt, const char* name, size_t count, size_t required) {
+  if (count < required) {
+    throw jsi::JSError(rt, std::string(name) + " expects " +
+                                std::to_string(required) + " arguments");
+  }
+}
+
+/// `secret_id` travels through `configJson` as a quoted decimal string (the
+/// same field `DeRecProtocolBuilder.build()` always writes first).
+/// `derec_protocol_new`'s result carries only the opaque handle, not the id,
+/// so `ProtocolHost::secretId()` — which has no FFI accessor of its own —
+/// needs this recovered independently. `JSON.stringify` emits no internal
+/// whitespace, so a direct scan for the field is sufficient; this mirrors
+/// the bare-JSON-integer scanning `StoreCallbacks.cpp` already relies on for
+/// the wire's other compact JSON payloads.
+uint64_t parseSecretIdFromConfigJson(const std::string& json) {
+  static const std::string needle = "\"secret_id\":\"";
+  size_t pos = json.find(needle);
+  if (pos == std::string::npos) {
+    return 0;
+  }
+  pos += needle.size();
+  uint64_t value = 0;
+  while (pos < json.size() && json[pos] >= '0' && json[pos] <= '9') {
+    value = value * 10 + static_cast<uint64_t>(json[pos] - '0');
+    ++pos;
+  }
+  return value;
+}
+
+/// `protocol_new(configJson: string, communicationInfo: ArrayBuffer, stores:
+/// object) -> HostObject`. The one place that constructs a `ProtocolHost`:
+/// builds the per-instance `InstanceState` and `JsCallbackBridge`, resolves
+/// the six store/transport callback structs via `StoreBindings::create`, and
+/// hands them to `derec_protocol_new` in the FFI's own declared parameter
+/// order — channel, secret, share, user_secret, state, transport, which is
+/// neither alphabetical nor the order the six `with*Store` builder methods
+/// appear in (see `library/src/interop/ffi/protocol/handle/mod.rs`'s
+/// `derec_protocol_new` declaration).
+jsi::Value protocolNew(jsi::Runtime& rt,
+                       const std::shared_ptr<Invoker>& invoker,
+                       const jsi::Value&,
+                       const jsi::Value* args,
+                       size_t count) {
+  requireArgs(rt, "protocol_new", count, 3);
+  std::string configJson = args[0].asString(rt).utf8(rt);
+  ByteView info = asBytes(rt, args[1]);
+  jsi::Object storesObj = args[2].asObject(rt);
+
+  auto state = std::make_shared<InstanceState>();
+  auto bridge = std::make_shared<JsCallbackBridge>(*invoker, state);
+  std::shared_ptr<StoreBindings> stores = StoreBindings::create(rt, storesObj, *bridge, state);
+
+  DeRecProtocolNewResult result = derec_protocol_new(
+      reinterpret_cast<const uint8_t*>(configJson.data()), configJson.size(), info.ptr, info.len,
+      stores->channel(), stores->secret(), stores->share(), stores->userSecret(), stores->state(),
+      stores->transport());
+  if (result.error.code != DEREC_CODE_OK) {
+    throwDeRecError(rt, result.error);
+  }
+
+  uint64_t secretId = parseSecretIdFromConfigJson(configJson);
+
+  // Ownership: `stores` (a `StoreBindings`) holds `bridge`'s referent as a
+  // plain `JsCallbackBridge&` (see `StoreBindings.h`), not a `shared_ptr` —
+  // and a store-callback trampoline can keep `StoreBindings` alive via
+  // `shared_from_this()` on the JavaScript `CallInvoker`'s queue after this
+  // `ProtocolHost` itself has been fully destroyed. `bridge` therefore must
+  // not be scoped to die *with* `ProtocolHost` in the ordinary sense of "a
+  // member that is destroyed inside its owner's destructor" — it must
+  // outlive `ProtocolHost`'s own destruction, not merely coincide with it.
+  //
+  // The custom deleter below achieves that without adding a member to
+  // `ProtocolHost` (its constructor is fixed): it ties `bridge`'s release to
+  // the *same* `shared_ptr` control block that owns the `ProtocolHost`
+  // object, but strictly *after* that control block's normal deletion step.
+  // A `shared_ptr`'s custom deleter call (`delete p`, which runs
+  // `~ProtocolHost` to completion — invalidate, drain the worker, free the
+  // handle) always finishes before the control block releases whatever the
+  // deleter closure itself captured. So `bridge` is released only once
+  // `ProtocolHost`'s entire teardown has already run, which is later than
+  // any point at which a worker-thread trampoline could still call
+  // `StoreBindings::bridge()` — that call only ever happens synchronously,
+  // from inside a `derec_protocol_*` call on the worker thread, and
+  // `drainAndJoin` (part of that same teardown) does not return until every
+  // such call has finished.
+  std::shared_ptr<ProtocolHost> host(
+      new ProtocolHost(result.handle, secretId, invoker, state, std::move(stores)),
+      [bridge](ProtocolHost* p) mutable {
+        delete p;
+        // `bridge` (captured by value) is released only after the `delete`
+        // above returns, i.e. only after `~ProtocolHost` has fully run.
+      });
+
+  return jsi::Object::createFromHostObject(rt, std::move(host));
+}
+
+}  // namespace
+
+void registerInstance(const std::shared_ptr<InstanceState>& state) {
+  std::lock_guard<std::mutex> lock(registryMutex());
+  registry().push_back(state);
+}
+
+void invalidateAll() {
+  std::lock_guard<std::mutex> lock(registryMutex());
+  for (auto& weak : registry()) {
+    if (auto state = weak.lock()) {
+      // The runtime itself is going away, not just one protocol instance:
+      // work already queued onto the JavaScript thread must be abandoned
+      // rather than run, and the JavaScript values it retains must be leaked
+      // rather than released.
+      state->invalidateRuntime();
+    }
+  }
+  registry().clear();
+}
+
+void install(jsi::Runtime& rt, std::shared_ptr<Invoker> invoker) {
+  // `install` runs on the JavaScript thread by construction, so this is the
+  // one place that can record which thread that is. `JsCallbackBridge::
+  // callSync` asserts against it in debug builds.
+  noteJsThread();
+
+  auto host = jsi::Object(rt);
+
+  host.setProperty(
+      rt, "version",
+      jsi::Function::createFromHostFunction(
+          rt, jsi::PropNameID::forAscii(rt, "version"), 0,
+          [](jsi::Runtime& rt, const jsi::Value&, const jsi::Value*, size_t)
+              -> jsi::Value {
+            DeRecProtocolVersion version = derec_protocol_version();
+            std::string text = std::to_string(version.major) + "." +
+                               std::to_string(version.minor);
+            return jsi::String::createFromUtf8(rt, text);
+          }));
+
+  installPrimitives(rt, host);
+
+  host.setProperty(
+      rt, "protocol_new",
+      jsi::Function::createFromHostFunction(
+          rt, jsi::PropNameID::forAscii(rt, "protocol_new"), 3,
+          [invoker](jsi::Runtime& rt2, const jsi::Value& thisVal, const jsi::Value* args,
+                    size_t count) -> jsi::Value {
+            return protocolNew(rt2, invoker, thisVal, args, count);
+          }));
+
+  rt.global().setProperty(rt, "__DeRec", std::move(host));
+}
+
+}  // namespace derec

package/cpp/DeRecInstaller.h

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+#pragma once
+
+#include <jsi/jsi.h>
+
+#include <memory>
+
+#include "Invoker.h"
+#include "JsCallbackBridge.h"
+
+namespace derec {
+
+/// Install the `__DeRec` host object into `rt`.
+///
+/// `invoker` must schedule work on the same JavaScript thread that owns `rt`.
+void install(facebook::jsi::Runtime& rt, std::shared_ptr<Invoker> invoker);
+
+/// Signal that the JavaScript runtime is going away. Wakes every protocol
+/// instance blocked in a store callback so their workers can unwind instead
+/// of hanging.
+void invalidateAll();
+
+/// Track a protocol instance so `invalidateAll` can reach it at teardown.
+void registerInstance(const std::shared_ptr<InstanceState>& state);
+
+}  // namespace derec

package/cpp/Invoker.h

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+#pragma once
+
+#include <functional>
+
+namespace derec {
+
+/// Abstraction over React Native's `CallInvoker`. Declared as an interface so
+/// the callback bridge can be exercised on the host with no JSI runtime.
+class Invoker {
+ public:
+  virtual ~Invoker() = default;
+
+  /// Schedule `work` to run on the JavaScript thread. Must not block.
+  virtual void invokeAsync(std::function<void()> work) = 0;
+};
+
+}  // namespace derec

package/cpp/JsCallbackBridge.cpp

@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+#include "JsCallbackBridge.h"
+
+#include <cassert>
+#include <mutex>
+#include <utility>
+
+namespace derec {
+
+namespace {
+
+/// One in-flight callback. Heap-allocated and shared so a settlement arriving
+/// after a timeout writes into live memory rather than a dead stack frame.
+///
+/// Both fields are guarded by the owning `InstanceState`'s mutex; the slot
+/// carries no lock of its own so that a waiter and `InstanceState::invalidate`
+/// synchronise on the same condition variable.
+struct CallSlot {
+  bool done = false;
+  CallResult result{kBackendFailure, {}};
+};
+
+/// Written once, from `noteJsThread`, and published by the release store to
+/// `jsThreadKnown` below; readers acquire it. Not a `thread::id` atomic
+/// because `std::thread::id` is not guaranteed lock-free.
+std::thread::id& jsThreadId() {
+  static std::thread::id id;
+  return id;
+}
+
+std::atomic<bool>& jsThreadKnown() {
+  static std::atomic<bool> known{false};
+  return known;
+}
+
+int& storeCallbackDepth() {
+  static thread_local int depth = 0;
+  return depth;
+}
+
+}  // namespace
+
+void InstanceState::invalidate() {
+  {
+    std::lock_guard<std::mutex> lock(m);
+    invalidated.store(true);
+  }
+  cv.notify_all();
+}
+
+void InstanceState::invalidateRuntime() {
+  {
+    std::lock_guard<std::mutex> lock(m);
+    runtimeInvalidated.store(true);
+    invalidated.store(true);
+  }
+  cv.notify_all();
+}
+
+void noteJsThread() {
+  jsThreadId() = std::this_thread::get_id();
+  jsThreadKnown().store(true, std::memory_order_release);
+}
+
+bool isJsThread() {
+  if (!jsThreadKnown().load(std::memory_order_acquire)) {
+    return false;
+  }
+  return std::this_thread::get_id() == jsThreadId();
+}
+
+bool isInsideStoreCallback() { return storeCallbackDepth() > 0; }
+
+StoreCallbackScope::StoreCallbackScope() { ++storeCallbackDepth(); }
+
+StoreCallbackScope::~StoreCallbackScope() { --storeCallbackDepth(); }
+
+JsCallbackBridge::JsCallbackBridge(Invoker& invoker,
+                                   std::shared_ptr<InstanceState> state,
+                                   std::chrono::milliseconds timeout)
+    : invoker_(invoker), state_(std::move(state)), timeout_(timeout) {}
+
+CallResult JsCallbackBridge::callSync(
+    std::function<void(std::function<void(CallResult)>)> body) {
+  // Blocking here on the JavaScript thread would wait for a settlement that
+  // only the JavaScript thread can produce. Debug-only: a release build must
+  // not pay for the check, and there is no correct recovery anyway.
+  assert(!isJsThread() &&
+         "JsCallbackBridge::callSync must not run on the JavaScript thread");
+
+  if (state_->invalidated.load()) {
+    return CallResult{kBackendFailure, {}};
+  }
+
+  auto slot = std::make_shared<CallSlot>();
+  // The scheduled work owns a reference to the instance state: it must be able
+  // to take the mutex even if the bridge and its owner are already gone.
+  auto state = state_;
+
+  invoker_.invokeAsync([slot, state, body = std::move(body)]() mutable {
+    auto settle = [slot, state](CallResult result) {
+      {
+        std::lock_guard<std::mutex> lock(state->m);
+        if (slot->done) {
+          return;  // a timeout or an invalidation already resolved this slot
+        }
+        slot->result = std::move(result);
+        slot->done = true;
+      }
+      state->cv.notify_all();
+    };
+
+    // A JavaScript store that throws synchronously must not escape into the
+    // runtime's dispatch loop; report it as a backend failure instead.
+    try {
+      // Marks exactly the window in which a protocol call made from this
+      // thread would be genuinely re-entrant: the store body's own execution.
+      // It ends when `body` returns, even though the worker stays parked
+      // until the Promise the store handed back settles.
+      StoreCallbackScope scope;
+      body(settle);
+    } catch (...) {
+      settle(CallResult{kBackendFailure, {}});
+    }
+  });
+
+  std::unique_lock<std::mutex> lock(state_->m);
+  state_->cv.wait_for(lock, timeout_, [this, &slot] {
+    return slot->done || state_->invalidated.load();
+  });
+
+  if (!slot->done) {
+    // Timed out or invalidated. Mark the slot resolved under the same lock so
+    // a late settlement becomes a no-op, and report a backend failure — never
+    // `1`, which would tell the protocol a stored share is absent.
+    slot->done = true;
+    return CallResult{kBackendFailure, {}};
+  }
+  return std::move(slot->result);
+}
+
+}  // namespace derec

package/cpp/JsCallbackBridge.h

@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 DeRec Alliance. All rights reserved.
+
+#pragma once
+
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <mutex>
+#include <thread>
+#include <vector>
+
+#include "Invoker.h"
+
+namespace derec {
+
+/// Store-callback return code for a backend failure. `0` means success and
+/// `1` means "not found" (load-family only); every other value is a backend
+/// failure, so any value >= 2 is equivalent here.
+constexpr int32_t kBackendFailure = 2;
+
+/// Liveness backstop for a JavaScript store that never settles. Generous
+/// enough for disk and keychain access. Not application-configurable: it is a
+/// binding-level guard, not a protocol parameter.
+constexpr std::chrono::seconds kStoreTimeout{30};
+
+struct CallResult {
+  int32_t code;
+  std::vector<uint8_t> bytes;
+};
+
+/// Shared per-protocol-instance liveness flag. Set when the JavaScript
+/// runtime goes away so blocked workers can unwind instead of hanging.
+///
+/// The instance also owns the synchronisation primitives that every in-flight
+/// callback for that instance waits on. Keeping the mutex and condition
+/// variable here — rather than on the individual call — is what lets
+/// `invalidate` wake a worker that is blocked inside `JsCallbackBridge::
+/// callSync`: a waiter and the invalidator must share one condition variable
+/// for the notification to reach the waiter at all.
+///
+/// Held by `shared_ptr` because a settlement scheduled onto the JavaScript
+/// thread may arrive after the bridge that started it is gone, and that
+/// settlement still needs the mutex.
+struct InstanceState {
+  std::atomic<bool> invalidated{false};
+
+  /// Set only when the JavaScript runtime itself is going away (the React
+  /// Native reload / bridge-invalidate path), never by an ordinary
+  /// `free()`/destructor teardown of a single protocol instance.
+  ///
+  /// The distinction matters because the two cases demand opposite
+  /// behaviour from work already scheduled onto the JavaScript thread. After
+  /// a plain instance teardown the runtime is still alive, so a settlement
+  /// that is already queued must still run — otherwise the Promise a caller
+  /// is awaiting never settles. Once the runtime is gone, that same
+  /// settlement must not run at all, and the JavaScript values it retains
+  /// must not be released either, because both would call back into a
+  /// runtime that is being torn down.
+  std::atomic<bool> runtimeInvalidated{false};
+
+  std::mutex m;
+  std::condition_variable cv;
+
+  /// Mark the instance dead and wake every blocked waiter. The flag is set
+  /// under `m` so a waiter cannot evaluate its predicate between the store and
+  /// the notification and then sleep through the wake-up.
+  void invalidate();
+
+  /// `invalidate`, plus the stronger statement that the JavaScript runtime is
+  /// going away. Both flags are set under `m` in one critical section so a
+  /// waiter that wakes on `invalidated` can never observe it without also
+  /// observing `runtimeInvalidated`.
+  void invalidateRuntime();
+};
+
+/// Record the calling thread as the JavaScript thread. Called once from
+/// `install`, which by construction runs on it.
+void noteJsThread();
+
+/// True when the calling thread is the one `noteJsThread` recorded. False
+/// until `install` has run, so a caller must treat it as advisory.
+bool isJsThread();
+
+/// True while this thread is executing the synchronous body of a store
+/// callback — that is, the JavaScript call into an application store, up to
+/// the point that call returns (typically a pending Promise).
+///
+/// This is deliberately narrower than "the worker is parked in a callback".
+/// A protocol call issued from ordinary JavaScript-thread work that merely
+/// happens to overlap a parked worker is safe: the serial worker runs it
+/// after the current call finishes. Only a call issued from inside the store
+/// body itself can deadlock, because that body's own completion is what the
+/// worker is waiting for.
+bool isInsideStoreCallback();
+
+/// Raises `isInsideStoreCallback` for the calling thread over its lifetime.
+/// Nests, so a store body that legitimately drives another one is counted
+/// correctly.
+class StoreCallbackScope {
+ public:
+  StoreCallbackScope();
+  ~StoreCallbackScope();
+
+  StoreCallbackScope(const StoreCallbackScope&) = delete;
+  StoreCallbackScope& operator=(const StoreCallbackScope&) = delete;
+};
+
+/// Adapts Rust's synchronous store/transport callbacks to the SDK's
+/// asynchronous JavaScript store interfaces.
+///
+/// Called from the protocol worker thread, never from the JavaScript thread —
+/// blocking the JavaScript thread here would deadlock, since the settlement
+/// that unblocks the wait is itself scheduled onto that thread. `callSync`
+/// asserts this in debug builds against the thread `noteJsThread` recorded.
+class JsCallbackBridge {
+ public:
+  JsCallbackBridge(Invoker& invoker,
+                   std::shared_ptr<InstanceState> state,
+                   std::chrono::milliseconds timeout =
+                       std::chrono::duration_cast<std::chrono::milliseconds>(kStoreTimeout));
+
+  /// Run `body` on the JavaScript thread and block until it settles.
+  ///
+  /// `body` receives a settle function it must invoke exactly once, from any
+  /// thread. Returns a backend failure if the instance is invalidated or the
+  /// timeout elapses — never `1`, because a fabricated "not found" would make
+  /// a stored share look absent and corrupt a recovery outcome.
+  ///
+  /// `body` must capture everything it touches by value or by `shared_ptr`,
+  /// never by reference to the caller's stack. Giving up on a call does not
+  /// cancel it: on timeout or invalidation `callSync` returns while `body` is
+  /// still queued on the JavaScript thread, so `body` and its captures must
+  /// stay valid after `callSync` has returned and the caller's frame is gone.
+  /// The same applies to the settle function, which may be invoked after the
+  /// return; a late settlement is discarded, but it still runs.
+  CallResult callSync(std::function<void(std::function<void(CallResult)>)> body);
+
+ private:
+  Invoker& invoker_;
+  std::shared_ptr<InstanceState> state_;
+  std::chrono::milliseconds timeout_;
+};
+
+}  // namespace derec