@derec-alliance/react-native 0.0.7 → 0.0.9

package/cpp/Primitives.cpp

@@ -3,7 +3,9 @@
 
 #include "Primitives.h"
 
+#include <cmath>
 #include <cstring>
+#include <limits>
 #include <string>
 #include <vector>
 
@@ -118,17 +120,79 @@ jsi::Value toUint8ArrayVal(jsi::Runtime& rt, const std::vector<uint8_t>& bytes)
 }
 
 uint64_t asU64(jsi::Runtime& rt, const jsi::Value& value) {
+  auto reject = [&]() -> uint64_t {
+    throw jsi::JSError(rt, "expected an integer in 0..=18446744073709551615");
+  };
   if (value.isBigInt()) {
-    return value.asBigInt(rt).asUint64(rt);
+    jsi::BigInt big = value.getBigInt(rt);
+    return big.isUint64(rt) ? big.getUint64(rt) : reject();
   }
-  return static_cast<uint64_t>(value.asNumber());
+  if (!value.isNumber()) {
+    return reject();
+  }
+  double number = value.getNumber();
+  // 18446744073709551616.0 is 2^64, the first double above `uint64_t`'s range.
+  if (!(number >= 0.0) || number >= 18446744073709551616.0 || std::trunc(number) != number) {
+    return reject();
+  }
+  return static_cast<uint64_t>(number);
 }
 
 namespace {
 
+/// Read an integer losslessly: a `bigint` or `number` holding an integer in
+/// `0..=max`. Anything else throws `<name> expects <expected>`, so a value is
+/// never truncated, rounded, or wrapped on its way to the core.
+uint64_t asBoundedInteger(jsi::Runtime& rt,
+                          const char* name,
+                          const jsi::Value& element,
+                          uint64_t max,
+                          const std::string& expected) {
+  auto reject = [&]() -> uint64_t {
+    throw jsi::JSError(rt, std::string(name) + " expects " + expected);
+  };
+  if (element.isBigInt()) {
+    jsi::BigInt big = element.getBigInt(rt);
+    if (!big.isUint64(rt)) {
+      return reject();
+    }
+    uint64_t number = big.getUint64(rt);
+    return number <= max ? number : reject();
+  }
+  if (!element.isNumber()) {
+    return reject();
+  }
+  double number = element.getNumber();
+  // 18446744073709551616.0 is 2^64, the first double above `uint64_t`'s range.
+  if (!(number >= 0.0) || number >= 18446744073709551616.0 || std::trunc(number) != number) {
+    return reject();
+  }
+  auto integer = static_cast<uint64_t>(number);
+  return integer <= max ? integer : reject();
+}
+
+/// Read one element of an integer array with `asBoundedInteger`.
+uint64_t asArrayInteger(jsi::Runtime& rt,
+                        const char* name,
+                        const jsi::Value& element,
+                        uint64_t max,
+                        const char* range) {
+  return asBoundedInteger(rt, name, element, max, std::string("an array of integers in ") + range);
+}
+
+/// Read the scalar argument `argument` with `asBoundedInteger`.
+uint64_t asScalarInteger(jsi::Runtime& rt,
+                         const char* name,
+                         const char* argument,
+                         const jsi::Value& value,
+                         uint64_t max) {
+  return asBoundedInteger(rt, name, value, max,
+                          std::string(argument) + " to be an integer in 0..=" + std::to_string(max));
+}
+
 /// Read a JS array of `bigint`/`number` elements as a `uint64_t` vector.
 /// Used for `protect_secret`'s `channels` argument.
-std::vector<uint64_t> asU64Array(jsi::Runtime& rt, const jsi::Value& value) {
+std::vector<uint64_t> asU64Array(jsi::Runtime& rt, const char* name, const jsi::Value& value) {
   std::vector<uint64_t> out;
   if (value.isNull() || value.isUndefined()) {
     return out;
@@ -137,14 +201,17 @@ std::vector<uint64_t> asU64Array(jsi::Runtime& rt, const jsi::Value& value) {
   size_t length = array.size(rt);
   out.reserve(length);
   for (size_t i = 0; i < length; ++i) {
-    out.push_back(asU64(rt, array.getValueAtIndex(rt, i)));
+    out.push_back(asArrayInteger(rt, name, array.getValueAtIndex(rt, i),
+                                 std::numeric_limits<uint64_t>::max(),
+                                 "0..=18446744073709551615"));
   }
   return out;
 }
 
 /// Read a JS array of `number` elements as a `uint32_t` vector. Used for
-/// `produce_store_share_request_message`'s `keep_list` argument.
-std::vector<uint32_t> asU32Array(jsi::Runtime& rt, const jsi::Value& value) {
+/// `protect_secret`'s `weights` and
+/// `produce_store_share_request_message`'s `keep_list` arguments.
+std::vector<uint32_t> asU32Array(jsi::Runtime& rt, const char* name, const jsi::Value& value) {
   std::vector<uint32_t> out;
   if (value.isNull() || value.isUndefined()) {
     return out;
@@ -153,7 +220,9 @@ std::vector<uint32_t> asU32Array(jsi::Runtime& rt, const jsi::Value& value) {
   size_t length = array.size(rt);
   out.reserve(length);
   for (size_t i = 0; i < length; ++i) {
-    out.push_back(static_cast<uint32_t>(array.getValueAtIndex(rt, i).asNumber()));
+    out.push_back(static_cast<uint32_t>(
+        asArrayInteger(rt, name, array.getValueAtIndex(rt, i),
+                       std::numeric_limits<uint32_t>::max(), "0..=4294967295")));
   }
   return out;
 }
@@ -336,9 +405,11 @@ jsi::Value createContactMessage(jsi::Runtime& rt,
                                 size_t count) {
   requireArgs(rt, "create_contact_message", count, 5);
   uint64_t channelId = asU64(rt, args[0]);
-  auto contactMode = static_cast<int32_t>(args[1].asNumber());
+  auto contactMode = static_cast<int32_t>(asScalarInteger(
+      rt, "create_contact_message", "contact_mode", args[1], std::numeric_limits<int32_t>::max()));
   ByteView transportProtocols = asBytes(rt, args[2]);
-  auto hasNonce = static_cast<uint32_t>(args[3].asNumber());
+  auto hasNonce = static_cast<uint32_t>(asScalarInteger(
+      rt, "create_contact_message", "has_nonce", args[3], std::numeric_limits<uint32_t>::max()));
   uint64_t nonce = asU64(rt, args[4]);
   CreateContactMessageResult result = create_contact_message(
       channelId, contactMode, transportProtocols.ptr, transportProtocols.len,
@@ -412,7 +483,8 @@ jsi::Value decodeMessageJson(jsi::Runtime& rt,
                              const jsi::Value* args,
                              size_t count) {
   requireArgs(rt, "decode_message_json", count, 2);
-  auto kind = static_cast<int32_t>(args[0].asNumber());
+  auto kind = static_cast<int32_t>(asScalarInteger(
+      rt, "decode_message_json", "kind", args[0], std::numeric_limits<int32_t>::max()));
   ByteView proto = asBytes(rt, args[1]);
   DeRecMessageJsonResult result =
       derec_decode_message_json(kind, proto.ptr, proto.len);
@@ -432,7 +504,8 @@ jsi::Value encodeMessageJson(jsi::Runtime& rt,
                              const jsi::Value* args,
                              size_t count) {
   requireArgs(rt, "encode_message_json", count, 2);
-  auto kind = static_cast<int32_t>(args[0].asNumber());
+  auto kind = static_cast<int32_t>(asScalarInteger(
+      rt, "encode_message_json", "kind", args[0], std::numeric_limits<int32_t>::max()));
   ByteView json = asBytes(rt, args[1]);
   DeRecMessageJsonResult result =
       derec_encode_message_json(kind, json.ptr, json.len);
@@ -453,7 +526,8 @@ jsi::Value producePairRequestMessage(jsi::Runtime& rt,
                                      const jsi::Value* args,
                                      size_t count) {
   requireArgs(rt, "produce_pair_request_message", count, 5);
-  auto senderKind = static_cast<int32_t>(args[0].asNumber());
+  auto senderKind = static_cast<int32_t>(asScalarInteger(
+      rt, "produce_pair_request_message", "sender_kind", args[0], std::numeric_limits<int32_t>::max()));
   ByteView transportProtocols = asBytes(rt, args[1]);
   ByteView contactMessage = asBytes(rt, args[2]);
   ByteView communicationInfo = asBytes(rt, args[3]);
@@ -796,7 +870,8 @@ jsi::Value produceGetShareRequestMessage(jsi::Runtime& rt,
   requireArgs(rt, "produce_get_share_request_message", count, 5);
   uint64_t channelId = asU64(rt, args[0]);
   uint64_t secretId = asU64(rt, args[1]);
-  auto version = static_cast<uint32_t>(args[2].asNumber());
+  auto version = static_cast<uint32_t>(asScalarInteger(
+      rt, "produce_get_share_request_message", "version", args[2], std::numeric_limits<uint32_t>::max()));
   ByteView sharedKey = asBytes(rt, args[3]);
   ByteView replyTo = asBytes(rt, args[4]);
   ProduceGetShareRequestMessageResult result = produce_get_share_request_message(
@@ -886,7 +961,8 @@ jsi::Value recoverFromShareResponses(jsi::Runtime& rt,
   requireArgs(rt, "recover_from_share_responses", count, 3);
   ByteView responses = asBytes(rt, args[0]);
   uint64_t secretId = asU64(rt, args[1]);
-  auto version = static_cast<uint32_t>(args[2].asNumber());
+  auto version = static_cast<uint32_t>(asScalarInteger(
+      rt, "recover_from_share_responses", "version", args[2], std::numeric_limits<uint32_t>::max()));
   RecoverFromShareResponsesResult result = recover_from_share_responses(
       responses.ptr, responses.len, secretId, version);
   if (result.error.code != 0) {
@@ -897,20 +973,29 @@ jsi::Value recoverFromShareResponses(jsi::Runtime& rt,
 }
 
 /// `protect_secret(secretId: bigint, secretData: ArrayBuffer, channels:
-///   (bigint|number)[], threshold: number, version: number) -> ArrayBuffer`
+///   (bigint|number)[], weights: number[], threshold: number, version:
+///   number) -> ArrayBuffer`
 jsi::Value protectSecret(jsi::Runtime& rt,
                          const jsi::Value&,
                          const jsi::Value* args,
                          size_t count) {
-  requireArgs(rt, "protect_secret", count, 5);
+  requireArgs(rt, "protect_secret", count, 6);
   uint64_t secretId = asU64(rt, args[0]);
   ByteView secretData = asBytes(rt, args[1]);
-  std::vector<uint64_t> channels = asU64Array(rt, args[2]);
-  auto threshold = static_cast<size_t>(args[3].asNumber());
-  auto version = static_cast<uint32_t>(args[4].asNumber());
+  std::vector<uint64_t> channels = asU64Array(rt, "protect_secret", args[2]);
+  std::vector<uint32_t> weights = asU32Array(rt, "protect_secret", args[3]);
+  if (channels.size() != weights.size()) {
+    throw jsi::JSError(rt,
+                       "protect_secret: channels and weights must have "
+                       "the same length");
+  }
+  auto threshold = static_cast<size_t>(asScalarInteger(
+      rt, "protect_secret", "threshold", args[4], std::numeric_limits<size_t>::max()));
+  auto version = static_cast<uint32_t>(asScalarInteger(
+      rt, "protect_secret", "version", args[5], std::numeric_limits<uint32_t>::max()));
   ProtectSecretResult result = protect_secret(
       secretId, secretData.ptr, secretData.len, channels.data(),
-      channels.size(), threshold, version);
+      weights.data(), channels.size(), threshold, version);
   if (result.error.code != 0) {
     throwDeRecError(rt, result.error);
   }
@@ -928,10 +1013,11 @@ jsi::Value produceStoreShareRequestMessage(jsi::Runtime& rt,
                                           size_t count) {
   requireArgs(rt, "produce_store_share_request_message", count, 8);
   uint64_t channelId = asU64(rt, args[0]);
-  auto version = static_cast<uint32_t>(args[1].asNumber());
+  auto version = static_cast<uint32_t>(asScalarInteger(
+      rt, "produce_store_share_request_message", "version", args[1], std::numeric_limits<uint32_t>::max()));
   uint64_t secretId = asU64(rt, args[2]);
   ByteView committedShare = asBytes(rt, args[3]);
-  std::vector<uint32_t> keepList = asU32Array(rt, args[4]);
+  std::vector<uint32_t> keepList = asU32Array(rt, "produce_store_share_request_message", args[4]);
   ByteView description = asBytes(rt, args[5]);
   ByteView sharedKey = asBytes(rt, args[6]);
   ByteView replyTo = asBytes(rt, args[7]);
@@ -1035,7 +1121,8 @@ jsi::Value processStoreShareResponseMessage(jsi::Runtime& rt,
                                            const jsi::Value* args,
                                            size_t count) {
   requireArgs(rt, "process_store_share_response_message", count, 2);
-  auto version = static_cast<uint32_t>(args[0].asNumber());
+  auto version = static_cast<uint32_t>(asScalarInteger(
+      rt, "process_store_share_response_message", "version", args[0], std::numeric_limits<uint32_t>::max()));
   ByteView responseProto = asBytes(rt, args[1]);
   ProcessStoreShareResponseMessageResult result =
       process_store_share_response_message(version, responseProto.ptr,
@@ -1159,7 +1246,8 @@ jsi::Value produceVerifyShareRequestMessage(jsi::Runtime& rt,
   requireArgs(rt, "produce_verify_share_request_message", count, 5);
   uint64_t channelId = asU64(rt, args[0]);
   uint64_t secretId = asU64(rt, args[1]);
-  auto version = static_cast<uint32_t>(args[2].asNumber());
+  auto version = static_cast<uint32_t>(asScalarInteger(
+      rt, "produce_verify_share_request_message", "version", args[2], std::numeric_limits<uint32_t>::max()));
   ByteView sharedKey = asBytes(rt, args[3]);
   ByteView replyTo = asBytes(rt, args[4]);
   ProduceVerifyShareRequestMessageResult result =
@@ -1321,7 +1409,7 @@ void installPrimitives(jsi::Runtime& rt, jsi::Object& host) {
        produceGetShareResponseMessage);
   bind(rt, host, "extract_get_share_response", 2, extractGetShareResponse);
   bind(rt, host, "recover_from_share_responses", 3, recoverFromShareResponses);
-  bind(rt, host, "protect_secret", 5, protectSecret);
+  bind(rt, host, "protect_secret", 6, protectSecret);
   bind(rt, host, "produce_store_share_request_message", 8,
        produceStoreShareRequestMessage);
   bind(rt, host, "extract_store_share_request", 2, extractStoreShareRequest);

package/cpp/StoreCallbacks.cpp

@@ -27,7 +27,7 @@ static_assert(sizeof(ChannelStoreCallbacks) == 9 * sizeof(void*),
               "ChannelStoreCallbacks layout changed; update the bindings");
 static_assert(sizeof(SecretStoreCallbacks) == 6 * sizeof(void*),
               "SecretStoreCallbacks layout changed; update the bindings");
-static_assert(sizeof(ShareStoreCallbacks) == 10 * sizeof(void*),
+static_assert(sizeof(ShareStoreCallbacks) == 11 * sizeof(void*),
               "ShareStoreCallbacks layout changed; update the bindings");
 static_assert(sizeof(UserSecretStoreCallbacks) == 5 * sizeof(void*),
               "UserSecretStoreCallbacks layout changed; update the bindings");
@@ -245,6 +245,21 @@ CallResult toShareListResult(jsi::Runtime& rt, const jsi::Value& value) {
     text += "{\"secret_id\":\"" + secretIdStr + "\",\"version\":" + std::to_string(version) +
             ",\"bytes\":";
     appendByteArrayJson(text, bytes.ptr, bytes.len);
+    // `subshares` and `threshold`: `null`/`undefined` is none and is omitted,
+    // as Rust omits it; anything else must be a `u32` to cross as one.
+    for (const char* field : {"subshares", "threshold"}) {
+      jsi::Value value = entry.getProperty(rt, field);
+      if (value.isNull() || value.isUndefined()) continue;
+      if (!value.isNumber()) {
+        return CallResult{kBackendFailure, {}};
+      }
+      double number = value.asNumber();
+      if (!(number >= 0 && number <= 4294967295.0) ||
+          number != static_cast<double>(static_cast<uint32_t>(number))) {
+        return CallResult{kBackendFailure, {}};
+      }
+      text += std::string(",\"") + field + "\":" + std::to_string(static_cast<uint32_t>(number));
+    }
     text += '}';
   }
   text += ']';
@@ -354,6 +369,38 @@ CallResult toKeepListResult(jsi::Runtime& rt, const jsi::Value& value) {
   return CallResult{0, std::vector<uint8_t>(text.begin(), text.end())};
 }
 
+/// Reads the `refusal` property a `ShareStore.save`/`recordVerification`
+/// throws, or rejects its promise with, to refuse the call — see
+/// `shareStoreRefusal` in `src/types.ts`. Maps the wire string to the FFI
+/// return code `library/src/interop/ffi/error.rs` names
+/// `DEREC_SHARE_STORE_REFUSED_*`; a missing or unknown property is an
+/// ordinary backend failure, never any other interpretation.
+int32_t shareRefusalCode(jsi::Runtime& rt, const jsi::Value& value) {
+  if (!value.isObject()) {
+    return kBackendFailure;
+  }
+  jsi::Object obj = value.asObject(rt);
+  if (!obj.hasProperty(rt, "refusal")) {
+    return kBackendFailure;
+  }
+  jsi::Value refusal = obj.getProperty(rt, "refusal");
+  if (!refusal.isString()) {
+    return kBackendFailure;
+  }
+  std::string reason = refusal.asString(rt).utf8(rt);
+  if (reason == "too_frequent") return DEREC_SHARE_STORE_REFUSED_TOO_FREQUENT;
+  if (reason == "size_limit_exceeded") return DEREC_SHARE_STORE_REFUSED_SIZE_LIMIT_EXCEEDED;
+  if (reason == "rejected") return DEREC_SHARE_STORE_REFUSED_REJECTED;
+  return kBackendFailure;
+}
+
+/// `ResultConverter` form of `shareRefusalCode`, passed as `ShareStore.save`/
+/// `recordVerification`'s `settleFromPromise` error converter and used
+/// directly on a synchronous throw.
+CallResult toShareRefusalResult(jsi::Runtime& rt, const jsi::Value& value) {
+  return CallResult{shareRefusalCode(rt, value), {}};
+}
+
 /// `UserSecretStore.loadLatest(): Promise<UserSecrets | null | undefined>`.
 CallResult toUserSecretsResult(jsi::Runtime& rt, const jsi::Value& value) {
   if (value.isNull() || value.isUndefined()) {
@@ -811,13 +858,59 @@ extern "C" int32_t shareStoreSave(void* userData, uint64_t secretId, uint64_t ch
                          jsi::Value(rt, jsi::String::createFromUtf8(rt, decoded.secretId)));
     shareObj.setProperty(rt, "version", jsi::Value(static_cast<int>(decoded.version)));
     shareObj.setProperty(rt, "bytes", toUint8ArrayVal(rt, decoded.bytes));
-    jsi::Value promise = method.callWithThis(rt, *store, idVal(rt, secretId), idVal(rt, channelId),
-                                              jsi::Value(rt, shareObj));
-    keepAlive->settleFromPromise(rt, std::move(promise), std::move(settle), toVoidResult);
+    if (decoded.subshares) {
+      shareObj.setProperty(rt, "subshares", jsi::Value(static_cast<double>(*decoded.subshares)));
+    }
+    if (decoded.threshold) {
+      shareObj.setProperty(rt, "threshold", jsi::Value(static_cast<double>(*decoded.threshold)));
+    }
+    // A refusal thrown synchronously (rather than via a rejected promise)
+    // never reaches `settleFromPromise`'s `onErr`, so it is read here,
+    // before it would otherwise fall into `JsCallbackBridge::callSync`'s
+    // generic backend-failure catch.
+    try {
+      jsi::Value promise = method.callWithThis(rt, *store, idVal(rt, secretId), idVal(rt, channelId),
+                                                jsi::Value(rt, shareObj));
+      keepAlive->settleFromPromise(rt, std::move(promise), settle, toVoidResult, toShareRefusalResult);
+    } catch (jsi::JSError& e) {
+      settle(toShareRefusalResult(rt, e.value()));
+    }
   });
   return result.code;
 }
 
+/// `ShareStore.recordVerification(secretId, channelId, version) -> void`
+///
+/// Called once per accepted verification challenge, after the challenged
+/// share is found and before the helper answers — see
+/// `DeRecShareStore::record_verification` on the Rust side. A refusal
+/// (thrown, or a rejected promise, tagged with `shareStoreRefusal`'s
+/// `refusal` property) maps to the matching FFI return code exactly as
+/// `ShareStore.save` does; any other failure is an ordinary backend failure.
+extern "C" int32_t shareStoreRecordVerification(void* userData, uint64_t secretId, uint64_t channelId,
+                                                 uint32_t version) {
+  auto* self = static_cast<StoreBindings*>(userData);
+  // Kept alive past this call so the lambda handed to `callSync` — which the
+  // JavaScript CallInvoker's queue may still be holding after this object's
+  // owner has released its own reference — has somewhere safe to run.
+  auto keepAlive = self->shared_from_this();
+  CallResult result = keepAlive->bridge().callSync(
+      [keepAlive, secretId, channelId, version](std::function<void(CallResult)> settle) {
+        jsi::Runtime& rt = keepAlive->runtime();
+        auto store = keepAlive->shareStore();
+        auto method = store->getPropertyAsFunction(rt, "recordVerification");
+        try {
+          jsi::Value promise = method.callWithThis(rt, *store, idVal(rt, secretId), idVal(rt, channelId),
+                                                    jsi::Value(static_cast<double>(version)));
+          keepAlive->settleFromPromise(rt, std::move(promise), settle, toVoidResult,
+                                       toShareRefusalResult);
+        } catch (jsi::JSError& e) {
+          settle(toShareRefusalResult(rt, e.value()));
+        }
+      });
+  return result.code;
+}
+
 /// `ShareStore.removeChannel(secretId, channelId) -> void`
 extern "C" int32_t shareStoreRemoveChannel(void* userData, uint64_t secretId, uint64_t channelId) {
   auto* self = static_cast<StoreBindings*>(userData);
@@ -1110,7 +1203,7 @@ StoreBindings::StoreBindings(jsi::Runtime& rt, JsCallbackBridge& bridge,
 
 void StoreBindings::settleFromPromise(jsi::Runtime& rt, jsi::Value value,
                                        std::function<void(CallResult)> settle,
-                                       ResultConverter convert) {
+                                       ResultConverter convert, ResultConverter convertError) {
   // A store may legitimately return a plain value; only route through
   // `then` when the result actually is a thenable.
   if (!value.isObject()) {
@@ -1150,13 +1243,16 @@ void StoreBindings::settleFromPromise(jsi::Runtime& rt, jsi::Value value,
 
   auto onErr = jsi::Function::createFromHostFunction(
       rt, jsi::PropNameID::forAscii(rt, "onErr"), 1,
-      [shared](jsi::Runtime&, const jsi::Value&, const jsi::Value*, size_t) -> jsi::Value {
+      [shared, convertError](jsi::Runtime& rt, const jsi::Value&, const jsi::Value* args,
+                              size_t count) -> jsi::Value {
         try {
-          (*shared)(CallResult{kBackendFailure, {}});
+          CallResult result = convertError != nullptr
+                                   ? (count > 0 ? convertError(rt, args[0])
+                                                : convertError(rt, jsi::Value::undefined()))
+                                   : CallResult{kBackendFailure, {}};
+          (*shared)(std::move(result));
         } catch (...) {
-          // `settle` on an already-resolved slot is a documented no-op, but
-          // guard uniformly with `onOk` in case a future `settle`
-          // implementation grows a fallible step.
+          (*shared)(CallResult{kBackendFailure, {}});
         }
         return jsi::Value::undefined();
       });
@@ -1198,16 +1294,17 @@ std::shared_ptr<StoreBindings> StoreBindings::create(jsi::Runtime& rt, jsi::Obje
       storeFreeBuffer,     // free_buffer
   };
   bindings->shareCallbacks_ = ShareStoreCallbacks{
-      self,                    // user_data
-      shareStoreLoad,          // load
-      shareStoreLoadMany,      // load_many
-      shareStoreLoadAll,       // load_all
-      shareStoreLatestVersion, // latest_version
-      shareStoreSave,          // save
-      shareStoreRemoveChannel,  // remove_channel
-      shareStoreRemoveVersions, // remove_versions
-      shareStoreKeepList,       // keep_list
-      storeFreeBuffer,          // free_buffer
+      self,                        // user_data
+      shareStoreLoad,               // load
+      shareStoreLoadMany,           // load_many
+      shareStoreLoadAll,            // load_all
+      shareStoreLatestVersion,      // latest_version
+      shareStoreSave,               // save
+      shareStoreRemoveChannel,      // remove_channel
+      shareStoreRemoveVersions,     // remove_versions
+      shareStoreKeepList,           // keep_list
+      shareStoreRecordVerification, // record_verification
+      storeFreeBuffer,              // free_buffer
   };
   bindings->userSecretCallbacks_ = UserSecretStoreCallbacks{
       self,                       // user_data
@@ -1255,6 +1352,8 @@ std::shared_ptr<StoreBindings> StoreBindings::create(jsi::Runtime& rt, jsi::Obje
   requireField(rt, bindings->shareCallbacks_.remove_channel, "ShareStoreCallbacks.remove_channel");
   requireField(rt, bindings->shareCallbacks_.remove_versions, "ShareStoreCallbacks.remove_versions");
   requireField(rt, bindings->shareCallbacks_.keep_list, "ShareStoreCallbacks.keep_list");
+  requireField(rt, bindings->shareCallbacks_.record_verification,
+               "ShareStoreCallbacks.record_verification");
   requireField(rt, bindings->shareCallbacks_.free_buffer, "ShareStoreCallbacks.free_buffer");
 
   requireField(rt, bindings->userSecretCallbacks_.user_data, "UserSecretStoreCallbacks.user_data");

package/cpp/StoreCallbacks.h

@@ -82,8 +82,15 @@ class StoreBindings : public std::enable_shared_from_this<StoreBindings> {
   /// through `convert`, dispatching via `then` only when the value is
   /// actually thenable. `convert` runs on the JavaScript thread, with `rt`
   /// live, before `settle` is invoked — never after.
+  ///
+  /// `convertError`, when non-null, replaces the default "any rejection is a
+  /// backend failure" handling: it runs on the rejected value instead, so a
+  /// caller that needs to read something off that value (e.g.
+  /// `ShareStore.save`'s `refusal` tag) can. Left null, a rejection settles
+  /// with `kBackendFailure` exactly as before.
   void settleFromPromise(facebook::jsi::Runtime& rt, facebook::jsi::Value value,
-                          std::function<void(CallResult)> settle, ResultConverter convert);
+                          std::function<void(CallResult)> settle, ResultConverter convert,
+                          ResultConverter convertError = nullptr);
 
  private:
   StoreBindings(facebook::jsi::Runtime& rt, JsCallbackBridge& bridge,