@derec-alliance/react-native 0.0.5 → 0.0.6

package/cpp/ProtocolHost.cpp

@@ -26,7 +26,12 @@ namespace {
 /// failure.
 struct FfiFailure {
   explicit FfiFailure(DeRecError e) : error(e) {}
+  FfiFailure(DeRecError e, std::vector<uint8_t> channelIdsJson)
+      : error(e), conflictingChannelIdsJson(std::move(channelIdsJson)) {}
   DeRecError error;
+  /// `restore`'s JSON array of colliding channel ids, empty for every other
+  /// failure. Carried as raw bytes: parsing needs the runtime.
+  std::vector<uint8_t> conflictingChannelIdsJson;
 };
 
 constexpr const char* kReentrancyMessage =
@@ -170,10 +175,12 @@ jsi::Value ProtocolHost::runAsync(
               bool failed = false;
               bool unknownFailure = false;
               DeRecError capturedError{};
+              std::vector<uint8_t> capturedChannelIdsJson;
               try {
                 bytes = body();
-              } catch (const FfiFailure& failure) {
+              } catch (FfiFailure& failure) {
                 capturedError = failure.error;
+                capturedChannelIdsJson = std::move(failure.conflictingChannelIdsJson);
                 failed = true;
               } catch (...) {
                 // Anything other than `FfiFailure` — `std::bad_alloc` from
@@ -198,7 +205,9 @@ jsi::Value ProtocolHost::runAsync(
 
               invoker->invokeAsync([state, runtime, resolve, reject, convert,
                                     bytes = std::move(bytes), failed,
-                                    unknownFailure, capturedError]() mutable {
+                                    unknownFailure, capturedError,
+                                    capturedChannelIdsJson =
+                                        std::move(capturedChannelIdsJson)]() mutable {
                 if (state->runtimeInvalidated.load()) {
                   // Queued before the runtime was torn down, reached only
                   // afterwards. Every JSI call below — including the ones the
@@ -212,7 +221,7 @@ jsi::Value ProtocolHost::runAsync(
                     // Reuses the exact error shape every synchronous FFI
                     // wrapper throws, rather than inventing a second one for
                     // the asynchronous path.
-                    throwDeRecError(jsRt, capturedError);
+                    throwDeRecError(jsRt, capturedError, capturedChannelIdsJson);
                   }
                   if (unknownFailure) {
                     throw jsi::JSError(jsRt, "DeRec: an unexpected native error occurred");
@@ -269,9 +278,8 @@ jsi::Value ProtocolHost::get(jsi::Runtime& rt, const jsi::PropNameID& name) {
                size_t) -> jsi::Value { return hostSecretId(rt2, secretId_); });
   }
 
-  // `setCommunicationInfo` and `setOwnTransport` return a Promise, unlike
-  // `@derec-alliance/nodejs` where both are synchronous. They must not run on
-  // the JavaScript thread: `derec_protocol_set_*` takes the same handle mutex
+  // `setCommunicationInfo` and `setOwnTransports` return a Promise, as in
+  // `@derec-alliance/nodejs`. They must not run on the JavaScript thread: `derec_protocol_set_*` takes the same handle mutex
   // that `derec_protocol_process`/`start`/`restore` hold for the whole
   // duration of a flow, including across store callbacks that park the worker
   // waiting on the JavaScript thread. Calling the setter synchronously would
@@ -281,9 +289,7 @@ jsi::Value ProtocolHost::get(jsi::Runtime& rt, const jsi::PropNameID& name) {
   // callback into a backend failure. The nodejs SDK is WASM and
   // single-threaded, so the hazard cannot arise there. Queuing onto the
   // serial worker instead orders the setter behind any in-flight flow, and
-  // returning a Promise keeps a caller that ignores the result — which is how
-  // nodejs code calls these — source-compatible, while letting a failure
-  // surface as a rejection rather than being swallowed.
+  // a failure surfaces as a rejection rather than being swallowed.
   if (prop == "setCommunicationInfo") {
     return jsi::Function::createFromHostFunction(
         rt, name, 1,
@@ -309,38 +315,6 @@ jsi::Value ProtocolHost::get(jsi::Runtime& rt, const jsi::PropNameID& name) {
         });
   }
 
-  if (prop == "setOwnTransport") {
-    return jsi::Function::createFromHostFunction(
-        rt, name, 2,
-        [this](jsi::Runtime& rt2, const jsi::Value&, const jsi::Value* args,
-               size_t count) -> jsi::Value {
-          requireArgs(rt2, "setOwnTransport", count, 2);
-          std::string uri = args[0].asString(rt2).utf8(rt2);
-          auto protocol = static_cast<int32_t>(args[1].asNumber());
-          DeRecProtocolHandle* handle = handle_;
-
-          auto body = [handle, uri, protocol]() -> std::vector<uint8_t> {
-// This binding *is* the deprecated single-endpoint path, so it calls the
-// deprecated export on purpose — the same reason the Rust side carries
-// `#[allow(deprecated)]` on its compatibility paths. Both go at 0.0.5.
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-            DeRecError error = derec_protocol_set_own_transport(
-                handle, reinterpret_cast<const uint8_t*>(uri.data()), uri.size(),
-                protocol);
-#pragma GCC diagnostic pop
-            if (error.code != DEREC_CODE_OK) {
-              throw FfiFailure(error);
-            }
-            return {};
-          };
-          auto convert = [](jsi::Runtime&, std::vector<uint8_t>&) {
-            return jsi::Value::undefined();
-          };
-          return runAsync(rt2, std::move(body), std::move(convert));
-        });
-  }
-
   // Takes the endpoint list already JSON-encoded, the same way
   // `setCommunicationInfo` takes its map: the FFI parses JSON on the other
   // side, so encoding in JavaScript keeps this bridge free of a shape it
@@ -599,12 +573,14 @@ jsi::Value ProtocolHost::get(jsi::Runtime& rt, const jsi::PropNameID& name) {
 
           auto body = [handle,
                       params = std::move(params)]() -> std::vector<uint8_t> {
-            DeRecProtocolEventsResult result =
+            DeRecProtocolRestoreResult result =
                 derec_protocol_restore(handle, params.data(), params.size());
-            if (result.error.code != DEREC_CODE_OK) {
-              throw FfiFailure(result.error);
+            RestoreOutcome outcome = takeRestoreResult(result);
+            if (outcome.error.code != DEREC_CODE_OK) {
+              throw FfiFailure(outcome.error,
+                               std::move(outcome.conflictingChannelIdsJson));
             }
-            return takeBuffer(result.events_json);
+            return std::move(outcome.events);
           };
           return runAsync(rt2, std::move(body), bytesToArrayBuffer);
         });
@@ -632,8 +608,7 @@ jsi::Value ProtocolHost::get(jsi::Runtime& rt, const jsi::PropNameID& name) {
 
 std::vector<jsi::PropNameID> ProtocolHost::getPropertyNames(jsi::Runtime& rt) {
   const char* names[] = {
-      "secretId",       "setCommunicationInfo",  "setOwnTransport",
-      "setOwnTransports",
+      "secretId",       "setCommunicationInfo",  "setOwnTransports",
       "createContact",  "start",                 "process",
       "tick",           "accept",                "reject",
       "getFingerprint", "verifyFingerprint",     "removeExpiredChannels",

package/cpp/StoreCallbacks.cpp

@@ -10,6 +10,7 @@
 
 #include "Convert.h"
 #include "Primitives.h"
+#include "UserSecretsJson.h"
 
 using namespace facebook;
 
@@ -24,7 +25,7 @@ namespace {
 
 static_assert(sizeof(ChannelStoreCallbacks) == 9 * sizeof(void*),
               "ChannelStoreCallbacks layout changed; update the bindings");
-static_assert(sizeof(SecretStoreCallbacks) == 5 * sizeof(void*),
+static_assert(sizeof(SecretStoreCallbacks) == 6 * sizeof(void*),
               "SecretStoreCallbacks layout changed; update the bindings");
 static_assert(sizeof(ShareStoreCallbacks) == 8 * sizeof(void*),
               "ShareStoreCallbacks layout changed; update the bindings");
@@ -74,118 +75,6 @@ jsi::Value idVal(jsi::Runtime& rt, uint64_t id) {
   return jsi::Value(rt, jsi::String::createFromUtf8(rt, std::to_string(id)));
 }
 
-/// Build a genuine `Uint8Array` (not a bare `ArrayBuffer`) — every store
-/// interface types its byte payloads as `Uint8Array`, and application code
-/// is entitled to index or slice it directly.
-jsi::Value toUint8ArrayVal(jsi::Runtime& rt, const uint8_t* bytes, size_t len) {
-  jsi::Uint8Array arr(rt, len);
-  if (len > 0 && bytes != nullptr) {
-    jsi::ArrayBuffer buffer = arr.buffer(rt);
-    std::memcpy(buffer.data(rt), bytes, len);
-  }
-  return jsi::Value(rt, std::move(arr));
-}
-
-jsi::Value toUint8ArrayVal(jsi::Runtime& rt, const std::vector<uint8_t>& bytes) {
-  return toUint8ArrayVal(rt, bytes.data(), bytes.size());
-}
-
-// Minimal decoders for the wire's "bare JSON array/object of unsigned
-// integers" convention (`versions_json`, `channel_ids_json`, the `bytes`
-// field of a `ShareRecord` / `SecretValueRecord`). These are produced by
-// `serde_json`'s default compact, whitespace-free output over a fixed,
-// known shape, so a substring scan is sufficient and — critically — never
-// routes a `u64` through a JS `number`, which cannot represent every value
-// in that range exactly.
-
-/// Parse a bare `[n, n, ...]` array of unsigned decimal integers.
-std::vector<uint64_t> parseUnsignedJsonArray(const uint8_t* ptr, size_t len) {
-  std::vector<uint64_t> out;
-  size_t i = 0;
-  while (i < len && ptr[i] != '[') ++i;
-  if (i >= len) return out;
-  ++i;
-  while (i < len && ptr[i] != ']') {
-    if (ptr[i] < '0' || ptr[i] > '9') {
-      ++i;
-      continue;
-    }
-    uint64_t value = 0;
-    while (i < len && ptr[i] >= '0' && ptr[i] <= '9') {
-      value = value * 10 + static_cast<uint64_t>(ptr[i] - '0');
-      ++i;
-    }
-    out.push_back(value);
-  }
-  return out;
-}
-
-/// Offset just past `"key":` in a flat, compact JSON object, or
-/// `std::string::npos` if `key` is absent.
-size_t fieldValueOffset(const std::string& json, const char* key) {
-  std::string needle = std::string("\"") + key + "\":";
-  size_t pos = json.find(needle);
-  return pos == std::string::npos ? std::string::npos : pos + needle.size();
-}
-
-uint64_t parseUnsignedAt(const std::string& json, size_t pos) {
-  uint64_t value = 0;
-  while (pos < json.size() && json[pos] >= '0' && json[pos] <= '9') {
-    value = value * 10 + static_cast<uint64_t>(json[pos] - '0');
-    ++pos;
-  }
-  return value;
-}
-
-std::vector<uint8_t> parseByteArrayAt(const std::string& json, size_t pos) {
-  std::vector<uint8_t> out;
-  while (pos < json.size() && json[pos] != '[') ++pos;
-  if (pos >= json.size()) return out;
-  ++pos;
-  while (pos < json.size() && json[pos] != ']') {
-    if (json[pos] < '0' || json[pos] > '9') {
-      ++pos;
-      continue;
-    }
-    uint64_t value = 0;
-    while (pos < json.size() && json[pos] >= '0' && json[pos] <= '9') {
-      value = value * 10 + static_cast<uint64_t>(json[pos] - '0');
-      ++pos;
-    }
-    out.push_back(static_cast<uint8_t>(value));
-  }
-  return out;
-}
-
-/// `{"kind":<n>,"bytes":[<n>,...]}` — the wire shape `SecretStore.save`
-/// receives; `kind` is already carried as a separate FFI argument so only
-/// `bytes` needs to be read back out.
-std::vector<uint8_t> decodeSecretValueBytes(const uint8_t* ptr, size_t len) {
-  std::string json(reinterpret_cast<const char*>(ptr), len);
-  size_t pos = fieldValueOffset(json, "bytes");
-  if (pos == std::string::npos) return {};
-  return parseByteArrayAt(json, pos);
-}
-
-/// `{"secret_id":"...","version":<n>,"bytes":[<n>,...]}` — the wire shape
-/// `ShareStore.save` receives. `secret_id` duplicates the FFI's own
-/// `secret_id` argument, so only `version` and `bytes` are decoded.
-struct DecodedShare {
-  uint32_t version;
-  std::vector<uint8_t> bytes;
-};
-
-DecodedShare decodeShareRecord(const uint8_t* ptr, size_t len) {
-  std::string json(reinterpret_cast<const char*>(ptr), len);
-  size_t versionPos = fieldValueOffset(json, "version");
-  size_t bytesPos = fieldValueOffset(json, "bytes");
-  DecodedShare out{};
-  out.version =
-      versionPos == std::string::npos ? 0 : static_cast<uint32_t>(parseUnsignedAt(json, versionPos));
-  out.bytes = bytesPos == std::string::npos ? std::vector<uint8_t>{} : parseByteArrayAt(json, bytesPos);
-  return out;
-}
-
 /// True only for a non-empty run of ASCII decimal digits.
 ///
 /// Every `u64` id crosses this boundary as a decimal string, and the wire
@@ -376,6 +265,37 @@ ResultConverter makeSecretLoadResult(uint32_t kind) {
   };
 }
 
+/// `SecretStore.loadMany(): Promise<Array<Uint8Array | null | undefined>>`.
+/// Encodes the resolved array element by element, in order, as the wire's
+/// `Vec<Option<SecretValueRecord>>` JSON: the record `load` builds, or `null`
+/// for a `null`/`undefined` entry. The library pairs entries with the
+/// requested ids and decides what a missing one means.
+///
+/// A non-array return is a backend failure, never an empty list.
+ResultConverter makeSecretLoadManyResult(uint32_t kind) {
+  return [kind](jsi::Runtime& rt, const jsi::Value& value) -> CallResult {
+    if (!value.isObject()) {
+      return CallResult{kBackendFailure, {}};
+    }
+    jsi::Array arr = value.asObject(rt).asArray(rt);
+    size_t n = arr.size(rt);
+    std::string text = "[";
+    for (size_t i = 0; i < n; ++i) {
+      if (i != 0) text += ',';
+      jsi::Value entry = arr.getValueAtIndex(rt, i);
+      if (entry.isNull() || entry.isUndefined()) {
+        text += "null";
+        continue;
+      }
+      ByteView bytes = asBytes(rt, entry);
+      std::vector<uint8_t> record = secretValueRecordJson(kind, bytes.ptr, bytes.len);
+      text.append(record.begin(), record.end());
+    }
+    text += ']';
+    return CallResult{0, std::vector<uint8_t>(text.begin(), text.end())};
+  };
+}
+
 /// `StateStore.loadAll(): Promise<Uint8Array[]>`. Each element is already
 /// the exact item-JSON blob the wire expects; splice the raw bytes into an
 /// array rather than re-parsing and re-serialising them.
@@ -400,105 +320,12 @@ CallResult toStateLoadAllResult(jsi::Runtime& rt, const jsi::Value& value) {
   return CallResult{0, std::vector<uint8_t>(text.begin(), text.end())};
 }
 
-// `UserSecrets` JSON <-> JS object conversion. Unlike the flat integer-only
-// records above, `UserSecrets` carries application-controlled `name` /
-// `description` strings, so building or reading its wire JSON goes through
-// the runtime's own `JSON.parse` / `JSON.stringify` rather than a hand-rolled
-// scanner — the only place in this file that needs real string escaping.
-
-jsi::Value jsonParseUtf8(jsi::Runtime& rt, const uint8_t* bytes, size_t len) {
-  jsi::Object json = rt.global().getPropertyAsObject(rt, "JSON");
-  jsi::Function parse = json.getPropertyAsFunction(rt, "parse");
-  std::string text(reinterpret_cast<const char*>(bytes), len);
-  return parse.call(rt, jsi::Value(rt, jsi::String::createFromUtf8(rt, text)));
-}
-
-std::vector<uint8_t> jsonStringifyToUtf8(jsi::Runtime& rt, const jsi::Value& value) {
-  jsi::Object json = rt.global().getPropertyAsObject(rt, "JSON");
-  jsi::Function stringify = json.getPropertyAsFunction(rt, "stringify");
-  jsi::Value result = stringify.call(rt, value);
-  std::string text = result.asString(rt).utf8(rt);
-  return std::vector<uint8_t>(text.begin(), text.end());
-}
-
-jsi::Array bytesToNumberArray(jsi::Runtime& rt, ByteView view) {
-  jsi::Array arr(rt, view.len);
-  for (size_t i = 0; i < view.len; ++i) {
-    arr.setValueAtIndex(rt, i, jsi::Value(static_cast<int>(view.ptr[i])));
-  }
-  return arr;
-}
-
-std::vector<uint8_t> numberArrayToBytes(jsi::Runtime& rt, jsi::Array arr) {
-  size_t n = arr.size(rt);
-  std::vector<uint8_t> out;
-  out.reserve(n);
-  for (size_t i = 0; i < n; ++i) {
-    out.push_back(static_cast<uint8_t>(arr.getValueAtIndex(rt, i).asNumber()));
-  }
-  return out;
-}
-
 /// `UserSecretStore.loadLatest(): Promise<UserSecrets | null | undefined>`.
 CallResult toUserSecretsResult(jsi::Runtime& rt, const jsi::Value& value) {
   if (value.isNull() || value.isUndefined()) {
     return CallResult{1, {}};
   }
-  jsi::Object src = value.asObject(rt);
-  jsi::Object wire(rt);
-  wire.setProperty(rt, "version", jsi::Value(rt, src.getProperty(rt, "version")));
-  jsi::Array srcSecrets = src.getProperty(rt, "secrets").asObject(rt).asArray(rt);
-  size_t n = srcSecrets.size(rt);
-  jsi::Array wireSecrets(rt, n);
-  for (size_t i = 0; i < n; ++i) {
-    jsi::Object entry = srcSecrets.getValueAtIndex(rt, i).asObject(rt);
-    jsi::Object wireEntry(rt);
-    wireEntry.setProperty(rt, "id", jsi::Value(rt, bytesToNumberArray(rt, asBytes(rt, entry.getProperty(rt, "id")))));
-    wireEntry.setProperty(rt, "name", jsi::Value(rt, entry.getProperty(rt, "name")));
-    wireEntry.setProperty(
-        rt, "data", jsi::Value(rt, bytesToNumberArray(rt, asBytes(rt, entry.getProperty(rt, "data")))));
-    wireSecrets.setValueAtIndex(rt, i, jsi::Value(rt, wireEntry));
-  }
-  wire.setProperty(rt, "secrets", jsi::Value(rt, wireSecrets));
-  if (src.hasProperty(rt, "description")) {
-    jsi::Value description = src.getProperty(rt, "description");
-    if (!description.isUndefined()) {
-      wire.setProperty(rt, "description", description);
-    }
-  }
-  return CallResult{0, jsonStringifyToUtf8(rt, jsi::Value(rt, wire))};
-}
-
-/// Decode `UserSecretStore.saveLatest`'s incoming wire JSON into the JS
-/// `UserSecrets` shape `src/types.ts` declares.
-jsi::Value buildUserSecretsFromWire(jsi::Runtime& rt, const uint8_t* ptr, size_t len) {
-  jsi::Value parsed = jsonParseUtf8(rt, ptr, len);
-  jsi::Object src = parsed.asObject(rt);
-  jsi::Object out(rt);
-  out.setProperty(rt, "version", jsi::Value(rt, src.getProperty(rt, "version")));
-  jsi::Array srcSecrets = src.getProperty(rt, "secrets").asObject(rt).asArray(rt);
-  size_t n = srcSecrets.size(rt);
-  jsi::Array outSecrets(rt, n);
-  for (size_t i = 0; i < n; ++i) {
-    jsi::Object entry = srcSecrets.getValueAtIndex(rt, i).asObject(rt);
-    jsi::Object outEntry(rt);
-    std::vector<uint8_t> idBytes =
-        numberArrayToBytes(rt, entry.getProperty(rt, "id").asObject(rt).asArray(rt));
-    std::vector<uint8_t> dataBytes =
-        numberArrayToBytes(rt, entry.getProperty(rt, "data").asObject(rt).asArray(rt));
-    outEntry.setProperty(rt, "id", toUint8ArrayVal(rt, idBytes));
-    outEntry.setProperty(rt, "name", jsi::Value(rt, entry.getProperty(rt, "name")));
-    outEntry.setProperty(rt, "data", toUint8ArrayVal(rt, dataBytes));
-    outSecrets.setValueAtIndex(rt, i, jsi::Value(rt, outEntry));
-  }
-  out.setProperty(rt, "secrets", jsi::Value(rt, outSecrets));
-  if (src.hasProperty(rt, "description")) {
-    jsi::Value description = src.getProperty(rt, "description");
-    if (!description.isUndefined()) {
-      out.setProperty(rt, "description", description);
-    }
-  }
-  return jsi::Value(rt, out);
+  return CallResult{0, userSecretsToWire(rt, value.asObject(rt))};
 }
 
 /// Releases a buffer this binding handed to Rust through an out-parameter.
@@ -654,7 +481,7 @@ extern "C" int32_t channelStoreListReplicas(void* userData, uint64_t secretId, c
   return result.code;
 }
 
-/// `ChannelStore.linkChannel(secretId, channelId, linkedChannelId) -> void`
+/// `ChannelStore.linkChannel(secretId, a, b) -> void`
 extern "C" int32_t channelStoreLinkChannel(void* userData, uint64_t secretId, uint64_t a, uint64_t b) {
   auto* self = static_cast<StoreBindings*>(userData);
   // Kept alive past this call so the lambda handed to `callSync` — which the
@@ -728,6 +555,39 @@ extern "C" int32_t secretStoreLoad(void* userData, uint64_t secretId, uint64_t c
   return result.code;
 }
 
+/// `SecretStore.loadMany(secretId, channelIds, kind) -> Array<Uint8Array | null>`
+extern "C" int32_t secretStoreLoadMany(void* userData, uint64_t secretId, const uint8_t* channelIdsJsonPtr,
+                                        size_t channelIdsJsonLen, uint32_t kind, uint8_t** outPtr,
+                                        size_t* outLen) {
+  auto* self = static_cast<StoreBindings*>(userData);
+  // Kept alive past this call so the lambda handed to `callSync` — which the
+  // JavaScript CallInvoker's queue may still be holding after this object's
+  // owner has released its own reference — has somewhere safe to run.
+  auto keepAlive = self->shared_from_this();
+  std::vector<uint64_t> channelIds = parseUnsignedJsonArray(channelIdsJsonPtr, channelIdsJsonLen);
+  CallResult result = keepAlive->bridge().callSync(
+      [keepAlive, secretId, channelIds, kind](std::function<void(CallResult)> settle) {
+        jsi::Runtime& rt = keepAlive->runtime();
+        auto store = keepAlive->secretStore();
+        auto method = store->getPropertyAsFunction(rt, "loadMany");
+        jsi::Value promise =
+            method.callWithThis(rt, *store, idVal(rt, secretId),
+                                 jsi::Value(rt, u64VectorToJsStringArray(rt, channelIds)),
+                                 jsi::Value(static_cast<int>(kind)));
+        keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle),
+                                     makeSecretLoadManyResult(kind));
+      });
+  if (result.code == 0) {
+    if (!writeOut(result.bytes, outPtr, outLen)) {
+      return kBackendFailure;
+    }
+  } else {
+    *outPtr = nullptr;
+    *outLen = 0;
+  }
+  return result.code;
+}
+
 /// `SecretStore.save(secretId, channelId, kind, value) -> void`
 extern "C" int32_t secretStoreSave(void* userData, uint64_t secretId, uint64_t channelId, uint32_t kind,
                                     const uint8_t* bytes, size_t len) {
@@ -899,14 +759,22 @@ extern "C" int32_t shareStoreSave(void* userData, uint64_t secretId, uint64_t ch
   // JavaScript CallInvoker's queue may still be holding after this object's
   // owner has released its own reference — has somewhere safe to run.
   auto keepAlive = self->shared_from_this();
-  DecodedShare decoded = decodeShareRecord(shareJsonPtr, shareJsonLen);
+  std::optional<DecodedShare> parsed = decodeShareRecord(shareJsonPtr, shareJsonLen);
+  if (!parsed) {
+    return kBackendFailure;
+  }
+  // `share.secretId` is the record's own `secret_id`, not the partition
+  // `secretId`: on a helper the share carries the owner's secret id, which is
+  // what tells apart several secrets held in one partition.
+  DecodedShare decoded = std::move(*parsed);
   CallResult result = keepAlive->bridge().callSync([keepAlive, secretId, channelId,
                                                 decoded](std::function<void(CallResult)> settle) {
     jsi::Runtime& rt = keepAlive->runtime();
     auto store = keepAlive->shareStore();
     auto method = store->getPropertyAsFunction(rt, "save");
     jsi::Object shareObj(rt);
-    shareObj.setProperty(rt, "secretId", idVal(rt, secretId));
+    shareObj.setProperty(rt, "secretId",
+                         jsi::Value(rt, jsi::String::createFromUtf8(rt, decoded.secretId)));
     shareObj.setProperty(rt, "version", jsi::Value(static_cast<int>(decoded.version)));
     shareObj.setProperty(rt, "bytes", toUint8ArrayVal(rt, decoded.bytes));
     jsi::Value promise = method.callWithThis(rt, *store, idVal(rt, secretId), idVal(rt, channelId),
@@ -973,7 +841,7 @@ extern "C" int32_t userSecretStoreSaveLatest(void* userData, uint64_t secretId,
     jsi::Runtime& rt = keepAlive->runtime();
     auto store = keepAlive->userSecretStore();
     auto method = store->getPropertyAsFunction(rt, "saveLatest");
-    jsi::Value userSecrets = buildUserSecretsFromWire(rt, payload.data(), payload.size());
+    jsi::Value userSecrets = userSecretsFromWire(rt, payload.data(), payload.size());
     jsi::Value promise = method.callWithThis(rt, *store, idVal(rt, secretId), std::move(userSecrets));
     keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle), toVoidResult);
   });
@@ -1092,64 +960,6 @@ extern "C" int32_t stateStoreLoadAll(void* userData, uint64_t secretId, uint32_t
   return result.code;
 }
 
-/// Maps the wire's `derec_proto::Protocol` discriminant to the string
-/// `Transport.send`'s endpoint carries. Only `HTTPS = 0` is defined today;
-/// the protocol is explicitly extensible, so an unrecognised discriminant
-/// is reported rather than guessed at.
-std::string protocolToString(int32_t protocol) { return protocol == 0 ? "https" : "unknown"; }
-
-/// Minimal reader for an encoded `TransportProtocol`: field 1 is the URI
-/// (length-delimited string), field 2 the protocol discriminant (varint).
-/// Hand-rolled rather than linking a protobuf runtime into the JSI layer for
-/// two fields; unknown fields are skipped so a newer library stays readable.
-static std::optional<std::pair<std::string, int32_t>> decodeTransportProtocol(
-    const uint8_t* data, size_t len) {
-  std::string uri;
-  int32_t protocol = 0;
-  size_t i = 0;
-
-  auto readVarint = [&](uint64_t& out) -> bool {
-    out = 0;
-    int shift = 0;
-    while (i < len) {
-      uint8_t b = data[i++];
-      out |= static_cast<uint64_t>(b & 0x7F) << shift;
-      if ((b & 0x80) == 0) return true;
-      shift += 7;
-      if (shift > 63) return false;
-    }
-    return false;
-  };
-
-  while (i < len) {
-    uint64_t tag = 0;
-    if (!readVarint(tag)) return std::nullopt;
-    uint32_t field = static_cast<uint32_t>(tag >> 3);
-    uint32_t wire = static_cast<uint32_t>(tag & 0x7);
-
-    if (field == 1 && wire == 2) {
-      uint64_t size = 0;
-      if (!readVarint(size) || i + size > len) return std::nullopt;
-      uri.assign(reinterpret_cast<const char*>(data + i), size);
-      i += size;
-    } else if (field == 2 && wire == 0) {
-      uint64_t value = 0;
-      if (!readVarint(value)) return std::nullopt;
-      protocol = static_cast<int32_t>(value);
-    } else if (wire == 0) {
-      uint64_t skip = 0;
-      if (!readVarint(skip)) return std::nullopt;
-    } else if (wire == 2) {
-      uint64_t size = 0;
-      if (!readVarint(size) || i + size > len) return std::nullopt;
-      i += size;
-    } else {
-      return std::nullopt;
-    }
-  }
-  return std::make_pair(uri, protocol);
-}
-
 /// `Transport.send(endpoints, message) -> void`
 ///
 /// `endpoints` is every address the peer advertised, in the peer's order,
@@ -1164,44 +974,25 @@ extern "C" int32_t transportSend(void* userData, const uint8_t* endpointsPtr, si
   // owner has released its own reference — has somewhere safe to run.
   auto keepAlive = self->shared_from_this();
 
-  // Length-delimited TransportProtocol sequence: each entry preceded by its
-  // protobuf varint byte length.
-  std::vector<std::pair<std::string, int32_t>> endpoints;
-  size_t offset = 0;
-  while (offset < endpointsLen) {
-    uint64_t size = 0;
-    int shift = 0;
-    while (offset < endpointsLen) {
-      uint8_t b = endpointsPtr[offset++];
-      size |= static_cast<uint64_t>(b & 0x7F) << shift;
-      if ((b & 0x80) == 0) break;
-      shift += 7;
-    }
-    if (offset + size > endpointsLen) return -1;
-    auto parsed = decodeTransportProtocol(endpointsPtr + offset, size);
-    if (!parsed) return -1;
-    endpoints.push_back(*parsed);
-    offset += size;
+  // The crate decodes its own endpoint framing, names each protocol, and
+  // fails the send on a discriminant it cannot name; this layer only parses
+  // the JSON array `Transport.send` receives.
+  DeRecMessageJsonResult decoded = derec_transport_endpoints_json(endpointsPtr, endpointsLen);
+  if (decoded.error.code != 0) {
+    derec_free_error(&decoded.error);
+    return -1;
   }
+  std::vector<uint8_t> endpointsJson = takeBuffer(decoded.bytes);
 
   std::vector<uint8_t> message(bytes, bytes + len);
-  CallResult result = keepAlive->bridge().callSync([keepAlive, endpoints,
+  CallResult result = keepAlive->bridge().callSync([keepAlive, endpointsJson,
                                                 message](std::function<void(CallResult)> settle) {
     jsi::Runtime& rt = keepAlive->runtime();
     auto store = keepAlive->transportStore();
     auto method = store->getPropertyAsFunction(rt, "send");
-    jsi::Array endpointsJs(rt, endpoints.size());
-    for (size_t i = 0; i < endpoints.size(); ++i) {
-      jsi::Object endpoint(rt);
-      endpoint.setProperty(rt, "protocol",
-                            jsi::Value(rt, jsi::String::createFromUtf8(
-                                               rt, protocolToString(endpoints[i].second))));
-      endpoint.setProperty(rt, "uri",
-                            jsi::Value(rt, jsi::String::createFromUtf8(rt, endpoints[i].first)));
-      endpointsJs.setValueAtIndex(rt, i, endpoint);
-    }
+    jsi::Value endpointsJs = jsonParseUtf8(rt, endpointsJson.data(), endpointsJson.size());
     jsi::Value promise =
-        method.callWithThis(rt, *store, jsi::Value(rt, endpointsJs), toUint8ArrayVal(rt, message));
+        method.callWithThis(rt, *store, endpointsJs, toUint8ArrayVal(rt, message));
     keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle), toVoidResult);
   });
   return result.code;
@@ -1318,11 +1109,12 @@ std::shared_ptr<StoreBindings> StoreBindings::create(jsi::Runtime& rt, jsi::Obje
       storeFreeBuffer,             // free_buffer
   };
   bindings->secretCallbacks_ = SecretStoreCallbacks{
-      self,              // user_data
-      secretStoreLoad,   // load
-      secretStoreSave,   // save
-      secretStoreRemove, // remove
-      storeFreeBuffer,   // free_buffer
+      self,                // user_data
+      secretStoreLoad,     // load
+      secretStoreLoadMany, // load_many
+      secretStoreSave,     // save
+      secretStoreRemove,   // remove
+      storeFreeBuffer,     // free_buffer
   };
   bindings->shareCallbacks_ = ShareStoreCallbacks{
       self,                    // user_data
@@ -1366,6 +1158,7 @@ std::shared_ptr<StoreBindings> StoreBindings::create(jsi::Runtime& rt, jsi::Obje
 
   requireField(rt, bindings->secretCallbacks_.user_data, "SecretStoreCallbacks.user_data");
   requireField(rt, bindings->secretCallbacks_.load, "SecretStoreCallbacks.load");
+  requireField(rt, bindings->secretCallbacks_.load_many, "SecretStoreCallbacks.load_many");
   requireField(rt, bindings->secretCallbacks_.save, "SecretStoreCallbacks.save");
   requireField(rt, bindings->secretCallbacks_.remove, "SecretStoreCallbacks.remove");
   requireField(rt, bindings->secretCallbacks_.free_buffer, "SecretStoreCallbacks.free_buffer");