@derec-alliance/react-native 0.0.5 → 0.0.7

package/cpp/StoreCallbacks.cpp

@@ -10,6 +10,7 @@
 
 #include "Convert.h"
 #include "Primitives.h"
+#include "UserSecretsJson.h"
 
 using namespace facebook;
 
@@ -24,9 +25,9 @@ namespace {
 
 static_assert(sizeof(ChannelStoreCallbacks) == 9 * sizeof(void*),
               "ChannelStoreCallbacks layout changed; update the bindings");
-static_assert(sizeof(SecretStoreCallbacks) == 5 * sizeof(void*),
+static_assert(sizeof(SecretStoreCallbacks) == 6 * sizeof(void*),
               "SecretStoreCallbacks layout changed; update the bindings");
-static_assert(sizeof(ShareStoreCallbacks) == 8 * sizeof(void*),
+static_assert(sizeof(ShareStoreCallbacks) == 10 * sizeof(void*),
               "ShareStoreCallbacks layout changed; update the bindings");
 static_assert(sizeof(UserSecretStoreCallbacks) == 5 * sizeof(void*),
               "UserSecretStoreCallbacks layout changed; update the bindings");
@@ -74,118 +75,6 @@ jsi::Value idVal(jsi::Runtime& rt, uint64_t id) {
   return jsi::Value(rt, jsi::String::createFromUtf8(rt, std::to_string(id)));
 }
 
-/// Build a genuine `Uint8Array` (not a bare `ArrayBuffer`) — every store
-/// interface types its byte payloads as `Uint8Array`, and application code
-/// is entitled to index or slice it directly.
-jsi::Value toUint8ArrayVal(jsi::Runtime& rt, const uint8_t* bytes, size_t len) {
-  jsi::Uint8Array arr(rt, len);
-  if (len > 0 && bytes != nullptr) {
-    jsi::ArrayBuffer buffer = arr.buffer(rt);
-    std::memcpy(buffer.data(rt), bytes, len);
-  }
-  return jsi::Value(rt, std::move(arr));
-}
-
-jsi::Value toUint8ArrayVal(jsi::Runtime& rt, const std::vector<uint8_t>& bytes) {
-  return toUint8ArrayVal(rt, bytes.data(), bytes.size());
-}
-
-// Minimal decoders for the wire's "bare JSON array/object of unsigned
-// integers" convention (`versions_json`, `channel_ids_json`, the `bytes`
-// field of a `ShareRecord` / `SecretValueRecord`). These are produced by
-// `serde_json`'s default compact, whitespace-free output over a fixed,
-// known shape, so a substring scan is sufficient and — critically — never
-// routes a `u64` through a JS `number`, which cannot represent every value
-// in that range exactly.
-
-/// Parse a bare `[n, n, ...]` array of unsigned decimal integers.
-std::vector<uint64_t> parseUnsignedJsonArray(const uint8_t* ptr, size_t len) {
-  std::vector<uint64_t> out;
-  size_t i = 0;
-  while (i < len && ptr[i] != '[') ++i;
-  if (i >= len) return out;
-  ++i;
-  while (i < len && ptr[i] != ']') {
-    if (ptr[i] < '0' || ptr[i] > '9') {
-      ++i;
-      continue;
-    }
-    uint64_t value = 0;
-    while (i < len && ptr[i] >= '0' && ptr[i] <= '9') {
-      value = value * 10 + static_cast<uint64_t>(ptr[i] - '0');
-      ++i;
-    }
-    out.push_back(value);
-  }
-  return out;
-}
-
-/// Offset just past `"key":` in a flat, compact JSON object, or
-/// `std::string::npos` if `key` is absent.
-size_t fieldValueOffset(const std::string& json, const char* key) {
-  std::string needle = std::string("\"") + key + "\":";
-  size_t pos = json.find(needle);
-  return pos == std::string::npos ? std::string::npos : pos + needle.size();
-}
-
-uint64_t parseUnsignedAt(const std::string& json, size_t pos) {
-  uint64_t value = 0;
-  while (pos < json.size() && json[pos] >= '0' && json[pos] <= '9') {
-    value = value * 10 + static_cast<uint64_t>(json[pos] - '0');
-    ++pos;
-  }
-  return value;
-}
-
-std::vector<uint8_t> parseByteArrayAt(const std::string& json, size_t pos) {
-  std::vector<uint8_t> out;
-  while (pos < json.size() && json[pos] != '[') ++pos;
-  if (pos >= json.size()) return out;
-  ++pos;
-  while (pos < json.size() && json[pos] != ']') {
-    if (json[pos] < '0' || json[pos] > '9') {
-      ++pos;
-      continue;
-    }
-    uint64_t value = 0;
-    while (pos < json.size() && json[pos] >= '0' && json[pos] <= '9') {
-      value = value * 10 + static_cast<uint64_t>(json[pos] - '0');
-      ++pos;
-    }
-    out.push_back(static_cast<uint8_t>(value));
-  }
-  return out;
-}
-
-/// `{"kind":<n>,"bytes":[<n>,...]}` — the wire shape `SecretStore.save`
-/// receives; `kind` is already carried as a separate FFI argument so only
-/// `bytes` needs to be read back out.
-std::vector<uint8_t> decodeSecretValueBytes(const uint8_t* ptr, size_t len) {
-  std::string json(reinterpret_cast<const char*>(ptr), len);
-  size_t pos = fieldValueOffset(json, "bytes");
-  if (pos == std::string::npos) return {};
-  return parseByteArrayAt(json, pos);
-}
-
-/// `{"secret_id":"...","version":<n>,"bytes":[<n>,...]}` — the wire shape
-/// `ShareStore.save` receives. `secret_id` duplicates the FFI's own
-/// `secret_id` argument, so only `version` and `bytes` are decoded.
-struct DecodedShare {
-  uint32_t version;
-  std::vector<uint8_t> bytes;
-};
-
-DecodedShare decodeShareRecord(const uint8_t* ptr, size_t len) {
-  std::string json(reinterpret_cast<const char*>(ptr), len);
-  size_t versionPos = fieldValueOffset(json, "version");
-  size_t bytesPos = fieldValueOffset(json, "bytes");
-  DecodedShare out{};
-  out.version =
-      versionPos == std::string::npos ? 0 : static_cast<uint32_t>(parseUnsignedAt(json, versionPos));
-  out.bytes = bytesPos == std::string::npos ? std::vector<uint8_t>{} : parseByteArrayAt(json, bytesPos);
-  return out;
-}
-
 /// True only for a non-empty run of ASCII decimal digits.
 ///
 /// Every `u64` id crosses this boundary as a decimal string, and the wire
@@ -376,6 +265,37 @@ ResultConverter makeSecretLoadResult(uint32_t kind) {
   };
 }
 
+/// `SecretStore.loadMany(): Promise<Array<Uint8Array | null | undefined>>`.
+/// Encodes the resolved array element by element, in order, as the wire's
+/// `Vec<Option<SecretValueRecord>>` JSON: the record `load` builds, or `null`
+/// for a `null`/`undefined` entry. The library pairs entries with the
+/// requested ids and decides what a missing one means.
+///
+/// A non-array return is a backend failure, never an empty list.
+ResultConverter makeSecretLoadManyResult(uint32_t kind) {
+  return [kind](jsi::Runtime& rt, const jsi::Value& value) -> CallResult {
+    if (!value.isObject()) {
+      return CallResult{kBackendFailure, {}};
+    }
+    jsi::Array arr = value.asObject(rt).asArray(rt);
+    size_t n = arr.size(rt);
+    std::string text = "[";
+    for (size_t i = 0; i < n; ++i) {
+      if (i != 0) text += ',';
+      jsi::Value entry = arr.getValueAtIndex(rt, i);
+      if (entry.isNull() || entry.isUndefined()) {
+        text += "null";
+        continue;
+      }
+      ByteView bytes = asBytes(rt, entry);
+      std::vector<uint8_t> record = secretValueRecordJson(kind, bytes.ptr, bytes.len);
+      text.append(record.begin(), record.end());
+    }
+    text += ']';
+    return CallResult{0, std::vector<uint8_t>(text.begin(), text.end())};
+  };
+}
+
 /// `StateStore.loadAll(): Promise<Uint8Array[]>`. Each element is already
 /// the exact item-JSON blob the wire expects; splice the raw bytes into an
 /// array rather than re-parsing and re-serialising them.
@@ -400,43 +320,38 @@ CallResult toStateLoadAllResult(jsi::Runtime& rt, const jsi::Value& value) {
   return CallResult{0, std::vector<uint8_t>(text.begin(), text.end())};
 }
 
-// `UserSecrets` JSON <-> JS object conversion. Unlike the flat integer-only
-// records above, `UserSecrets` carries application-controlled `name` /
-// `description` strings, so building or reading its wire JSON goes through
-// the runtime's own `JSON.parse` / `JSON.stringify` rather than a hand-rolled
-// scanner — the only place in this file that needs real string escaping.
-
-jsi::Value jsonParseUtf8(jsi::Runtime& rt, const uint8_t* bytes, size_t len) {
-  jsi::Object json = rt.global().getPropertyAsObject(rt, "JSON");
-  jsi::Function parse = json.getPropertyAsFunction(rt, "parse");
-  std::string text(reinterpret_cast<const char*>(bytes), len);
-  return parse.call(rt, jsi::Value(rt, jsi::String::createFromUtf8(rt, text)));
-}
-
-std::vector<uint8_t> jsonStringifyToUtf8(jsi::Runtime& rt, const jsi::Value& value) {
-  jsi::Object json = rt.global().getPropertyAsObject(rt, "JSON");
-  jsi::Function stringify = json.getPropertyAsFunction(rt, "stringify");
-  jsi::Value result = stringify.call(rt, value);
-  std::string text = result.asString(rt).utf8(rt);
-  return std::vector<uint8_t>(text.begin(), text.end());
-}
-
-jsi::Array bytesToNumberArray(jsi::Runtime& rt, ByteView view) {
-  jsi::Array arr(rt, view.len);
-  for (size_t i = 0; i < view.len; ++i) {
-    arr.setValueAtIndex(rt, i, jsi::Value(static_cast<int>(view.ptr[i])));
+/// `ShareStore.keepList(): Promise<number[] | null | undefined>`. Encodes the
+/// resolved value as the wire's `Option<Vec<u32>>` JSON: `null` for
+/// `null`/`undefined`, otherwise the array of versions.
+///
+/// Anything else, or an entry that is not an integer in `0..=4294967295`, is
+/// a backend failure: reading it as `null` would silently send an empty
+/// keepList, so helpers would keep every version instead of the list the
+/// application meant to send.
+CallResult toKeepListResult(jsi::Runtime& rt, const jsi::Value& value) {
+  if (value.isNull() || value.isUndefined()) {
+    return CallResult{0, {'n', 'u', 'l', 'l'}};
   }
-  return arr;
-}
-
-std::vector<uint8_t> numberArrayToBytes(jsi::Runtime& rt, jsi::Array arr) {
+  if (!value.isObject() || !value.asObject(rt).isArray(rt)) {
+    return CallResult{kBackendFailure, {}};
+  }
+  jsi::Array arr = value.asObject(rt).asArray(rt);
   size_t n = arr.size(rt);
-  std::vector<uint8_t> out;
-  out.reserve(n);
+  std::string text = "[";
   for (size_t i = 0; i < n; ++i) {
-    out.push_back(static_cast<uint8_t>(arr.getValueAtIndex(rt, i).asNumber()));
+    jsi::Value entry = arr.getValueAtIndex(rt, i);
+    if (!entry.isNumber()) {
+      return CallResult{kBackendFailure, {}};
+    }
+    double version = entry.asNumber();
+    if (!(version >= 0 && version <= 4294967295.0) || version != static_cast<double>(static_cast<uint32_t>(version))) {
+      return CallResult{kBackendFailure, {}};
+    }
+    if (i != 0) text += ',';
+    text += std::to_string(static_cast<uint32_t>(version));
   }
-  return out;
+  text += ']';
+  return CallResult{0, std::vector<uint8_t>(text.begin(), text.end())};
 }
 
 /// `UserSecretStore.loadLatest(): Promise<UserSecrets | null | undefined>`.
@@ -444,61 +359,7 @@ CallResult toUserSecretsResult(jsi::Runtime& rt, const jsi::Value& value) {
   if (value.isNull() || value.isUndefined()) {
     return CallResult{1, {}};
   }
-  jsi::Object src = value.asObject(rt);
-  jsi::Object wire(rt);
-  wire.setProperty(rt, "version", jsi::Value(rt, src.getProperty(rt, "version")));
-  jsi::Array srcSecrets = src.getProperty(rt, "secrets").asObject(rt).asArray(rt);
-  size_t n = srcSecrets.size(rt);
-  jsi::Array wireSecrets(rt, n);
-  for (size_t i = 0; i < n; ++i) {
-    jsi::Object entry = srcSecrets.getValueAtIndex(rt, i).asObject(rt);
-    jsi::Object wireEntry(rt);
-    wireEntry.setProperty(rt, "id", jsi::Value(rt, bytesToNumberArray(rt, asBytes(rt, entry.getProperty(rt, "id")))));
-    wireEntry.setProperty(rt, "name", jsi::Value(rt, entry.getProperty(rt, "name")));
-    wireEntry.setProperty(
-        rt, "data", jsi::Value(rt, bytesToNumberArray(rt, asBytes(rt, entry.getProperty(rt, "data")))));
-    wireSecrets.setValueAtIndex(rt, i, jsi::Value(rt, wireEntry));
-  }
-  wire.setProperty(rt, "secrets", jsi::Value(rt, wireSecrets));
-  if (src.hasProperty(rt, "description")) {
-    jsi::Value description = src.getProperty(rt, "description");
-    if (!description.isUndefined()) {
-      wire.setProperty(rt, "description", description);
-    }
-  }
-  return CallResult{0, jsonStringifyToUtf8(rt, jsi::Value(rt, wire))};
-}
-
-/// Decode `UserSecretStore.saveLatest`'s incoming wire JSON into the JS
-/// `UserSecrets` shape `src/types.ts` declares.
-jsi::Value buildUserSecretsFromWire(jsi::Runtime& rt, const uint8_t* ptr, size_t len) {
-  jsi::Value parsed = jsonParseUtf8(rt, ptr, len);
-  jsi::Object src = parsed.asObject(rt);
-  jsi::Object out(rt);
-  out.setProperty(rt, "version", jsi::Value(rt, src.getProperty(rt, "version")));
-  jsi::Array srcSecrets = src.getProperty(rt, "secrets").asObject(rt).asArray(rt);
-  size_t n = srcSecrets.size(rt);
-  jsi::Array outSecrets(rt, n);
-  for (size_t i = 0; i < n; ++i) {
-    jsi::Object entry = srcSecrets.getValueAtIndex(rt, i).asObject(rt);
-    jsi::Object outEntry(rt);
-    std::vector<uint8_t> idBytes =
-        numberArrayToBytes(rt, entry.getProperty(rt, "id").asObject(rt).asArray(rt));
-    std::vector<uint8_t> dataBytes =
-        numberArrayToBytes(rt, entry.getProperty(rt, "data").asObject(rt).asArray(rt));
-    outEntry.setProperty(rt, "id", toUint8ArrayVal(rt, idBytes));
-    outEntry.setProperty(rt, "name", jsi::Value(rt, entry.getProperty(rt, "name")));
-    outEntry.setProperty(rt, "data", toUint8ArrayVal(rt, dataBytes));
-    outSecrets.setValueAtIndex(rt, i, jsi::Value(rt, outEntry));
-  }
-  out.setProperty(rt, "secrets", jsi::Value(rt, outSecrets));
-  if (src.hasProperty(rt, "description")) {
-    jsi::Value description = src.getProperty(rt, "description");
-    if (!description.isUndefined()) {
-      out.setProperty(rt, "description", description);
-    }
-  }
-  return jsi::Value(rt, out);
+  return CallResult{0, userSecretsToWire(rt, value.asObject(rt))};
 }
 
 /// Releases a buffer this binding handed to Rust through an out-parameter.
@@ -654,7 +515,7 @@ extern "C" int32_t channelStoreListReplicas(void* userData, uint64_t secretId, c
   return result.code;
 }
 
-/// `ChannelStore.linkChannel(secretId, channelId, linkedChannelId) -> void`
+/// `ChannelStore.linkChannel(secretId, a, b) -> void`
 extern "C" int32_t channelStoreLinkChannel(void* userData, uint64_t secretId, uint64_t a, uint64_t b) {
   auto* self = static_cast<StoreBindings*>(userData);
   // Kept alive past this call so the lambda handed to `callSync` — which the
@@ -728,6 +589,39 @@ extern "C" int32_t secretStoreLoad(void* userData, uint64_t secretId, uint64_t c
   return result.code;
 }
 
+/// `SecretStore.loadMany(secretId, channelIds, kind) -> Array<Uint8Array | null>`
+extern "C" int32_t secretStoreLoadMany(void* userData, uint64_t secretId, const uint8_t* channelIdsJsonPtr,
+                                        size_t channelIdsJsonLen, uint32_t kind, uint8_t** outPtr,
+                                        size_t* outLen) {
+  auto* self = static_cast<StoreBindings*>(userData);
+  // Kept alive past this call so the lambda handed to `callSync` — which the
+  // JavaScript CallInvoker's queue may still be holding after this object's
+  // owner has released its own reference — has somewhere safe to run.
+  auto keepAlive = self->shared_from_this();
+  std::vector<uint64_t> channelIds = parseUnsignedJsonArray(channelIdsJsonPtr, channelIdsJsonLen);
+  CallResult result = keepAlive->bridge().callSync(
+      [keepAlive, secretId, channelIds, kind](std::function<void(CallResult)> settle) {
+        jsi::Runtime& rt = keepAlive->runtime();
+        auto store = keepAlive->secretStore();
+        auto method = store->getPropertyAsFunction(rt, "loadMany");
+        jsi::Value promise =
+            method.callWithThis(rt, *store, idVal(rt, secretId),
+                                 jsi::Value(rt, u64VectorToJsStringArray(rt, channelIds)),
+                                 jsi::Value(static_cast<int>(kind)));
+        keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle),
+                                     makeSecretLoadManyResult(kind));
+      });
+  if (result.code == 0) {
+    if (!writeOut(result.bytes, outPtr, outLen)) {
+      return kBackendFailure;
+    }
+  } else {
+    *outPtr = nullptr;
+    *outLen = 0;
+  }
+  return result.code;
+}
+
 /// `SecretStore.save(secretId, channelId, kind, value) -> void`
 extern "C" int32_t secretStoreSave(void* userData, uint64_t secretId, uint64_t channelId, uint32_t kind,
                                     const uint8_t* bytes, size_t len) {
@@ -899,14 +793,22 @@ extern "C" int32_t shareStoreSave(void* userData, uint64_t secretId, uint64_t ch
   // JavaScript CallInvoker's queue may still be holding after this object's
   // owner has released its own reference — has somewhere safe to run.
   auto keepAlive = self->shared_from_this();
-  DecodedShare decoded = decodeShareRecord(shareJsonPtr, shareJsonLen);
+  std::optional<DecodedShare> parsed = decodeShareRecord(shareJsonPtr, shareJsonLen);
+  if (!parsed) {
+    return kBackendFailure;
+  }
+  // `share.secretId` is the record's own `secret_id`, not the partition
+  // `secretId`: on a helper the share carries the owner's secret id, which is
+  // what tells apart several secrets held in one partition.
+  DecodedShare decoded = std::move(*parsed);
   CallResult result = keepAlive->bridge().callSync([keepAlive, secretId, channelId,
                                                 decoded](std::function<void(CallResult)> settle) {
     jsi::Runtime& rt = keepAlive->runtime();
     auto store = keepAlive->shareStore();
     auto method = store->getPropertyAsFunction(rt, "save");
     jsi::Object shareObj(rt);
-    shareObj.setProperty(rt, "secretId", idVal(rt, secretId));
+    shareObj.setProperty(rt, "secretId",
+                         jsi::Value(rt, jsi::String::createFromUtf8(rt, decoded.secretId)));
     shareObj.setProperty(rt, "version", jsi::Value(static_cast<int>(decoded.version)));
     shareObj.setProperty(rt, "bytes", toUint8ArrayVal(rt, decoded.bytes));
     jsi::Value promise = method.callWithThis(rt, *store, idVal(rt, secretId), idVal(rt, channelId),
@@ -934,6 +836,53 @@ extern "C" int32_t shareStoreRemoveChannel(void* userData, uint64_t secretId, ui
   return result.code;
 }
 
+/// `ShareStore.removeVersions(secretId, channelId, versions) -> void`
+extern "C" int32_t shareStoreRemoveVersions(void* userData, uint64_t secretId, uint64_t channelId,
+                                             const uint8_t* versionsJsonPtr, size_t versionsJsonLen) {
+  auto* self = static_cast<StoreBindings*>(userData);
+  // Kept alive past this call so the lambda handed to `callSync` — which the
+  // JavaScript CallInvoker's queue may still be holding after this object's
+  // owner has released its own reference — has somewhere safe to run.
+  auto keepAlive = self->shared_from_this();
+  std::vector<uint64_t> raw = parseUnsignedJsonArray(versionsJsonPtr, versionsJsonLen);
+  std::vector<uint32_t> versions(raw.begin(), raw.end());
+  CallResult result = keepAlive->bridge().callSync(
+      [keepAlive, secretId, channelId, versions](std::function<void(CallResult)> settle) {
+        jsi::Runtime& rt = keepAlive->runtime();
+        auto store = keepAlive->shareStore();
+        auto method = store->getPropertyAsFunction(rt, "removeVersions");
+        jsi::Value promise = method.callWithThis(rt, *store, idVal(rt, secretId), idVal(rt, channelId),
+                                                  jsi::Value(rt, u32VectorToJsArray(rt, versions)));
+        keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle), toVoidResult);
+      });
+  return result.code;
+}
+
+/// `ShareStore.keepList(secretId, version) -> number[] | null`
+extern "C" int32_t shareStoreKeepList(void* userData, uint64_t secretId, uint32_t version, uint8_t** outPtr,
+                                       size_t* outLen) {
+  auto* self = static_cast<StoreBindings*>(userData);
+  auto keepAlive = self->shared_from_this();
+  CallResult result =
+      keepAlive->bridge().callSync([keepAlive, secretId, version](std::function<void(CallResult)> settle) {
+        jsi::Runtime& rt = keepAlive->runtime();
+        auto store = keepAlive->shareStore();
+        auto method = store->getPropertyAsFunction(rt, "keepList");
+        jsi::Value promise =
+            method.callWithThis(rt, *store, idVal(rt, secretId), jsi::Value(static_cast<double>(version)));
+        keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle), toKeepListResult);
+      });
+  if (result.code == 0) {
+    if (!writeOut(result.bytes, outPtr, outLen)) {
+      return kBackendFailure;
+    }
+  } else {
+    *outPtr = nullptr;
+    *outLen = 0;
+  }
+  return result.code;
+}
+
 /// `UserSecretStore.loadLatest(secretId) -> UserSecrets | null`
 extern "C" int32_t userSecretStoreLoadLatest(void* userData, uint64_t secretId, uint8_t** outPtr,
                                               size_t* outLen) {
@@ -973,7 +922,7 @@ extern "C" int32_t userSecretStoreSaveLatest(void* userData, uint64_t secretId,
     jsi::Runtime& rt = keepAlive->runtime();
     auto store = keepAlive->userSecretStore();
     auto method = store->getPropertyAsFunction(rt, "saveLatest");
-    jsi::Value userSecrets = buildUserSecretsFromWire(rt, payload.data(), payload.size());
+    jsi::Value userSecrets = userSecretsFromWire(rt, payload.data(), payload.size());
     jsi::Value promise = method.callWithThis(rt, *store, idVal(rt, secretId), std::move(userSecrets));
     keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle), toVoidResult);
   });
@@ -1092,64 +1041,6 @@ extern "C" int32_t stateStoreLoadAll(void* userData, uint64_t secretId, uint32_t
   return result.code;
 }
 
-/// Maps the wire's `derec_proto::Protocol` discriminant to the string
-/// `Transport.send`'s endpoint carries. Only `HTTPS = 0` is defined today;
-/// the protocol is explicitly extensible, so an unrecognised discriminant
-/// is reported rather than guessed at.
-std::string protocolToString(int32_t protocol) { return protocol == 0 ? "https" : "unknown"; }
-
-/// Minimal reader for an encoded `TransportProtocol`: field 1 is the URI
-/// (length-delimited string), field 2 the protocol discriminant (varint).
-/// Hand-rolled rather than linking a protobuf runtime into the JSI layer for
-/// two fields; unknown fields are skipped so a newer library stays readable.
-static std::optional<std::pair<std::string, int32_t>> decodeTransportProtocol(
-    const uint8_t* data, size_t len) {
-  std::string uri;
-  int32_t protocol = 0;
-  size_t i = 0;
-
-  auto readVarint = [&](uint64_t& out) -> bool {
-    out = 0;
-    int shift = 0;
-    while (i < len) {
-      uint8_t b = data[i++];
-      out |= static_cast<uint64_t>(b & 0x7F) << shift;
-      if ((b & 0x80) == 0) return true;
-      shift += 7;
-      if (shift > 63) return false;
-    }
-    return false;
-  };
-
-  while (i < len) {
-    uint64_t tag = 0;
-    if (!readVarint(tag)) return std::nullopt;
-    uint32_t field = static_cast<uint32_t>(tag >> 3);
-    uint32_t wire = static_cast<uint32_t>(tag & 0x7);
-
-    if (field == 1 && wire == 2) {
-      uint64_t size = 0;
-      if (!readVarint(size) || i + size > len) return std::nullopt;
-      uri.assign(reinterpret_cast<const char*>(data + i), size);
-      i += size;
-    } else if (field == 2 && wire == 0) {
-      uint64_t value = 0;
-      if (!readVarint(value)) return std::nullopt;
-      protocol = static_cast<int32_t>(value);
-    } else if (wire == 0) {
-      uint64_t skip = 0;
-      if (!readVarint(skip)) return std::nullopt;
-    } else if (wire == 2) {
-      uint64_t size = 0;
-      if (!readVarint(size) || i + size > len) return std::nullopt;
-      i += size;
-    } else {
-      return std::nullopt;
-    }
-  }
-  return std::make_pair(uri, protocol);
-}
-
 /// `Transport.send(endpoints, message) -> void`
 ///
 /// `endpoints` is every address the peer advertised, in the peer's order,
@@ -1164,44 +1055,25 @@ extern "C" int32_t transportSend(void* userData, const uint8_t* endpointsPtr, si
   // owner has released its own reference — has somewhere safe to run.
   auto keepAlive = self->shared_from_this();
 
-  // Length-delimited TransportProtocol sequence: each entry preceded by its
-  // protobuf varint byte length.
-  std::vector<std::pair<std::string, int32_t>> endpoints;
-  size_t offset = 0;
-  while (offset < endpointsLen) {
-    uint64_t size = 0;
-    int shift = 0;
-    while (offset < endpointsLen) {
-      uint8_t b = endpointsPtr[offset++];
-      size |= static_cast<uint64_t>(b & 0x7F) << shift;
-      if ((b & 0x80) == 0) break;
-      shift += 7;
-    }
-    if (offset + size > endpointsLen) return -1;
-    auto parsed = decodeTransportProtocol(endpointsPtr + offset, size);
-    if (!parsed) return -1;
-    endpoints.push_back(*parsed);
-    offset += size;
+  // The crate decodes its own endpoint framing, names each protocol, and
+  // fails the send on a discriminant it cannot name; this layer only parses
+  // the JSON array `Transport.send` receives.
+  DeRecMessageJsonResult decoded = derec_transport_endpoints_json(endpointsPtr, endpointsLen);
+  if (decoded.error.code != 0) {
+    derec_free_error(&decoded.error);
+    return -1;
   }
+  std::vector<uint8_t> endpointsJson = takeBuffer(decoded.bytes);
 
   std::vector<uint8_t> message(bytes, bytes + len);
-  CallResult result = keepAlive->bridge().callSync([keepAlive, endpoints,
+  CallResult result = keepAlive->bridge().callSync([keepAlive, endpointsJson,
                                                 message](std::function<void(CallResult)> settle) {
     jsi::Runtime& rt = keepAlive->runtime();
     auto store = keepAlive->transportStore();
     auto method = store->getPropertyAsFunction(rt, "send");
-    jsi::Array endpointsJs(rt, endpoints.size());
-    for (size_t i = 0; i < endpoints.size(); ++i) {
-      jsi::Object endpoint(rt);
-      endpoint.setProperty(rt, "protocol",
-                            jsi::Value(rt, jsi::String::createFromUtf8(
-                                               rt, protocolToString(endpoints[i].second))));
-      endpoint.setProperty(rt, "uri",
-                            jsi::Value(rt, jsi::String::createFromUtf8(rt, endpoints[i].first)));
-      endpointsJs.setValueAtIndex(rt, i, endpoint);
-    }
+    jsi::Value endpointsJs = jsonParseUtf8(rt, endpointsJson.data(), endpointsJson.size());
     jsi::Value promise =
-        method.callWithThis(rt, *store, jsi::Value(rt, endpointsJs), toUint8ArrayVal(rt, message));
+        method.callWithThis(rt, *store, endpointsJs, toUint8ArrayVal(rt, message));
     keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle), toVoidResult);
   });
   return result.code;
@@ -1318,11 +1190,12 @@ std::shared_ptr<StoreBindings> StoreBindings::create(jsi::Runtime& rt, jsi::Obje
       storeFreeBuffer,             // free_buffer
   };
   bindings->secretCallbacks_ = SecretStoreCallbacks{
-      self,              // user_data
-      secretStoreLoad,   // load
-      secretStoreSave,   // save
-      secretStoreRemove, // remove
-      storeFreeBuffer,   // free_buffer
+      self,                // user_data
+      secretStoreLoad,     // load
+      secretStoreLoadMany, // load_many
+      secretStoreSave,     // save
+      secretStoreRemove,   // remove
+      storeFreeBuffer,     // free_buffer
   };
   bindings->shareCallbacks_ = ShareStoreCallbacks{
       self,                    // user_data
@@ -1331,8 +1204,10 @@ std::shared_ptr<StoreBindings> StoreBindings::create(jsi::Runtime& rt, jsi::Obje
       shareStoreLoadAll,       // load_all
       shareStoreLatestVersion, // latest_version
       shareStoreSave,          // save
-      shareStoreRemoveChannel, // remove_channel
-      storeFreeBuffer,         // free_buffer
+      shareStoreRemoveChannel,  // remove_channel
+      shareStoreRemoveVersions, // remove_versions
+      shareStoreKeepList,       // keep_list
+      storeFreeBuffer,          // free_buffer
   };
   bindings->userSecretCallbacks_ = UserSecretStoreCallbacks{
       self,                       // user_data
@@ -1366,6 +1241,7 @@ std::shared_ptr<StoreBindings> StoreBindings::create(jsi::Runtime& rt, jsi::Obje
 
   requireField(rt, bindings->secretCallbacks_.user_data, "SecretStoreCallbacks.user_data");
   requireField(rt, bindings->secretCallbacks_.load, "SecretStoreCallbacks.load");
+  requireField(rt, bindings->secretCallbacks_.load_many, "SecretStoreCallbacks.load_many");
   requireField(rt, bindings->secretCallbacks_.save, "SecretStoreCallbacks.save");
   requireField(rt, bindings->secretCallbacks_.remove, "SecretStoreCallbacks.remove");
   requireField(rt, bindings->secretCallbacks_.free_buffer, "SecretStoreCallbacks.free_buffer");
@@ -1377,6 +1253,8 @@ std::shared_ptr<StoreBindings> StoreBindings::create(jsi::Runtime& rt, jsi::Obje
   requireField(rt, bindings->shareCallbacks_.latest_version, "ShareStoreCallbacks.latest_version");
   requireField(rt, bindings->shareCallbacks_.save, "ShareStoreCallbacks.save");
   requireField(rt, bindings->shareCallbacks_.remove_channel, "ShareStoreCallbacks.remove_channel");
+  requireField(rt, bindings->shareCallbacks_.remove_versions, "ShareStoreCallbacks.remove_versions");
+  requireField(rt, bindings->shareCallbacks_.keep_list, "ShareStoreCallbacks.keep_list");
   requireField(rt, bindings->shareCallbacks_.free_buffer, "ShareStoreCallbacks.free_buffer");
 
   requireField(rt, bindings->userSecretCallbacks_.user_data, "UserSecretStoreCallbacks.user_data");