WASM

wasm/src/client.rs

@@ -0,0 +1,316 @@
+use std::cell::Cell;
+use std::rc::Rc;
+
+use wasm_bindgen::prelude::*;
+
+use mtp_codec::{
+    CommunicationType, CommunicationValue, DataType, DataValue, PROTOCOL_VERSION,
+};
+use mtp_type_map::{CommunicationTypeId, DataTypeId};
+
+use mtp_crypto::SignatureScheme;
+
+use crate::error::js_error;
+use crate::transport::WasmTransport;
+
+#[wasm_bindgen]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ConnectionState {
+    Disconnected = 0,
+    Connecting = 1,
+    Connected = 2,
+    Failed = 3,
+}
+
+#[wasm_bindgen]
+pub struct ConnectionConfig {
+    url: String,
+    server_certificate_hashes: Option<Vec<String>>,
+    client_id: u64,
+}
+
+#[wasm_bindgen]
+impl ConnectionConfig {
+    #[wasm_bindgen(constructor)]
+    pub fn new(url: String) -> Self {
+        Self { url, server_certificate_hashes: None, client_id: 0 }
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn url(&self) -> String { self.url.clone() }
+
+    #[wasm_bindgen(setter)]
+    pub fn set_client_id(&mut self, id: u64) { self.client_id = id; }
+
+    #[wasm_bindgen(getter)]
+    pub fn client_id(&self) -> u64 { self.client_id }
+
+    #[wasm_bindgen(setter)]
+    pub fn set_server_certificate_hashes(&mut self, hashes: Vec<String>) {
+        self.server_certificate_hashes = Some(hashes);
+    }
+}
+
+#[wasm_bindgen]
+pub struct WasmClient {
+    transport: Option<WasmTransport>,
+    state: Rc<Cell<ConnectionState>>,
+    on_state_change: js_sys::Function,
+    pub(crate) on_message: js_sys::Function,
+    pub(crate) on_error: js_sys::Function,
+}
+
+#[wasm_bindgen]
+impl WasmClient {
+    #[wasm_bindgen(constructor)]
+    pub fn new(
+        on_state_change: &js_sys::Function,
+        on_message: &js_sys::Function,
+        on_error: &js_sys::Function,
+    ) -> Self {
+        Self {
+            transport: None,
+            state: Rc::new(Cell::new(ConnectionState::Disconnected)),
+            on_state_change: on_state_change.clone(),
+            on_message: on_message.clone(),
+            on_error: on_error.clone(),
+        }
+    }
+
+    #[wasm_bindgen]
+    pub fn is_supported() -> bool {
+        js_sys::Reflect::has(&js_sys::global(), &JsValue::from_str("WebTransport"))
+            .unwrap_or(false)
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn state(&self) -> u8 { self.state.get() as u8 }
+
+    /// Unauthenticated connect (sends basic Identification, enables receive loop).
+    #[wasm_bindgen]
+    pub async fn connect(&mut self, config: &ConnectionConfig) -> Result<(), JsValue> {
+        self.set_state(ConnectionState::Connecting);
+        let transport = WasmTransport::connect(&config.url).await?;
+        let inner = transport.inner().clone();
+
+        let version_str = format!("{}", PROTOCOL_VERSION);
+        let ident = CommunicationValue::new(CommunicationType::Identification)
+            .add_typed_default(DataType::Version, DataValue::Str(version_str))
+            .add_typed_default(DataType::Id, DataValue::UnsignedNumber(config.client_id as u128));
+        transport.send_frame(&ident.to_bytes()).await?;
+
+        self.transport = Some(transport);
+        self.set_state(ConnectionState::Connected);
+
+        let state = self.state.clone();
+        let on_msg = self.on_message.clone();
+        let on_err = self.on_error.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            WasmTransport::from_inner(inner).receive_loop(on_msg, on_err).await;
+            state.set(ConnectionState::Disconnected);
+        });
+        Ok(())
+    }
+
+    /// Authenticated login with an existing client ID.
+    /// Exchanges Identification + signatures and verifies the host response.
+    ///
+    /// - `host_public_key_bytes`: serialized PublicKeyBundle from the server
+    /// - `keyring_bytes`: serialized Keyring of this client (must match `client_id`)
+    /// - `client_id`: previously assigned client ID
+    ///
+    /// Returns the confirmed (same) client ID on success.
+    #[wasm_bindgen]
+    pub async fn auth_connect(
+        &mut self,
+        config: &ConnectionConfig,
+        _host_public_key_bytes: &[u8],
+        keyring_bytes: &[u8],
+        client_id: u64,
+    ) -> Result<u64, JsValue> {
+        self.set_state(ConnectionState::Connecting);
+
+        let keyring = mtp_crypto::Keyring::from_bytes(keyring_bytes)
+            .map_err(|e| js_error(&format!("invalid keyring: {}", e)))?;
+
+        let version_str = format!("{}", PROTOCOL_VERSION);
+        let mut nonce_bytes = [0u8; 16];
+        getrandom::fill(&mut nonce_bytes)
+            .map_err(|_| js_error("rng failed"))?;
+        let client_nonce = u128::from_be_bytes(nonce_bytes);
+
+        // Build signature payload: version || client_id || client_nonce
+        let mut sig_payload = Vec::new();
+        sig_payload.extend_from_slice(version_str.as_bytes());
+        sig_payload.extend_from_slice(&client_id.to_be_bytes());
+        sig_payload.extend_from_slice(&client_nonce.to_be_bytes());
+
+        let signer = mtp_crypto::Ed25519Signer::new(&keyring.sig_cl_secret_key)
+            .map_err(|e| js_error(&format!("signer creation failed: {}", e)))?;
+        let signature = signer.sign(&sig_payload)
+            .map_err(|e| js_error(&format!("signature failed: {}", e)))?;
+
+        let frame = CommunicationValue::new(CommunicationType::Identification)
+            .add_typed_default(DataType::Version, DataValue::Str(version_str))
+            .add_typed_default(DataType::Id, DataValue::UnsignedNumber(client_id as u128))
+            .add_typed_default(DataType::ClientNonce, DataValue::UnsignedNumber(client_nonce))
+            .add_typed_default(DataType::Signature, DataValue::Bytes(signature))
+            .to_bytes();
+
+        let transport = WasmTransport::connect(&config.url).await?;
+        let inner = transport.inner().clone();
+        transport.send_frame(&frame).await?;
+
+        // Read and verify the host's IdentificationResponse
+        let response = transport.read_one_frame().await?;
+        let resp_comm = CommunicationValue::from_bytes(&response)
+            .map_err(|e| js_error(&format!("parse response: {}", e)))?;
+
+        let resp_type = resp_comm.get_type();
+        let expected_type = CommunicationTypeId(16); // IdentificationResponse
+        if resp_type != expected_type {
+            return Err(js_error("unexpected response type"));
+        }
+
+        if resp_comm.get_data(DataTypeId(11)) != &DataValue::BoolTrue {
+            return Err(js_error("host rejected authentication"));
+        }
+
+        // Verify echoed nonce
+        let echo_nonce = resp_comm.get_data(DataTypeId(7));
+        if *echo_nonce != DataValue::UnsignedNumber(client_nonce) {
+            return Err(js_error("nonce mismatch"));
+        }
+
+        // Extract assigned ID
+        let assigned_id = match resp_comm.get_data(DataTypeId(6)) {
+            DataValue::UnsignedNumber(n) => *n as u64,
+            _ => return Err(js_error("missing assigned ID")),
+        };
+
+        self.transport = Some(transport);
+        self.set_state(ConnectionState::Connected);
+
+        let state = self.state.clone();
+        let on_msg = self.on_message.clone();
+        let on_err = self.on_error.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            WasmTransport::from_inner(inner).receive_loop(on_msg, on_err).await;
+            state.set(ConnectionState::Disconnected);
+        });
+
+        Ok(assigned_id)
+    }
+
+    /// Authenticated registration with a fresh keyring.
+    /// The server assigns a new client ID.
+    ///
+    /// - `host_public_key_bytes`: serialized PublicKeyBundle from the server
+    /// - `keyring_bytes`: serialized Keyring (must include ed25519 secret key)
+    ///
+    /// Returns the newly assigned client ID.
+    #[wasm_bindgen]
+    pub async fn auth_register(
+        &mut self,
+        config: &ConnectionConfig,
+        host_public_key_bytes: &[u8],
+        keyring_bytes: &[u8],
+    ) -> Result<u64, JsValue> {
+        self.set_state(ConnectionState::Connecting);
+
+        let _host_pk = mtp_crypto::PublicKeyBundle::from_bytes(host_public_key_bytes)
+            .map_err(|e| js_error(&format!("invalid host public key: {}", e)))?;
+        let keyring = mtp_crypto::Keyring::from_bytes(keyring_bytes)
+            .map_err(|e| js_error(&format!("invalid keyring: {}", e)))?;
+
+        let version_str = format!("{}", PROTOCOL_VERSION);
+        let mut nonce_bytes = [0u8; 16];
+        getrandom::fill(&mut nonce_bytes)
+            .map_err(|_| js_error("rng failed"))?;
+        let client_nonce = u128::from_be_bytes(nonce_bytes);
+
+        let pk_bytes = keyring.public_key_bundle().as_bytes();
+
+        // Build signature payload: version || client_nonce || pk_bytes
+        let mut sig_payload = Vec::new();
+        sig_payload.extend_from_slice(version_str.as_bytes());
+        sig_payload.extend_from_slice(&client_nonce.to_be_bytes());
+        sig_payload.extend_from_slice(&pk_bytes);
+
+        let signer = mtp_crypto::Ed25519Signer::new(&keyring.sig_cl_secret_key)
+            .map_err(|e| js_error(&format!("signer creation failed: {}", e)))?;
+        let signature = signer.sign(&sig_payload)
+            .map_err(|e| js_error(&format!("signature failed: {}", e)))?;
+
+        let frame = CommunicationValue::new(CommunicationType::Register)
+            .add_typed_default(DataType::Version, DataValue::Str(version_str))
+            .add_typed_default(DataType::ClientNonce, DataValue::UnsignedNumber(client_nonce))
+            .add_typed_default(DataType::PublicKeys, DataValue::Bytes(pk_bytes))
+            .add_typed_default(DataType::Signature, DataValue::Bytes(signature))
+            .to_bytes();
+
+        let transport = WasmTransport::connect(&config.url).await?;
+        let inner = transport.inner().clone();
+        transport.send_frame(&frame).await?;
+
+        let response = transport.read_one_frame().await?;
+        let resp_comm = CommunicationValue::from_bytes(&response)
+            .map_err(|e| js_error(&format!("parse response: {}", e)))?;
+
+        let resp_type = resp_comm.get_type();
+        let expected_type = CommunicationTypeId(18); // RegisterResponse
+        if resp_type != expected_type {
+            return Err(js_error("unexpected response type"));
+        }
+
+        if resp_comm.get_data(DataTypeId(11)) != &DataValue::BoolTrue {
+            return Err(js_error("host rejected registration"));
+        }
+
+        let echo = resp_comm.get_data(DataTypeId(7));
+        if *echo != DataValue::UnsignedNumber(client_nonce) {
+            return Err(js_error("nonce mismatch"));
+        }
+
+        let assigned_id = match resp_comm.get_data(DataTypeId(6)) {
+            DataValue::UnsignedNumber(n) => *n as u64,
+            _ => return Err(js_error("missing assigned ID")),
+        };
+
+        self.transport = Some(transport);
+        self.set_state(ConnectionState::Connected);
+
+        let state = self.state.clone();
+        let on_msg = self.on_message.clone();
+        let on_err = self.on_error.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            WasmTransport::from_inner(inner).receive_loop(on_msg, on_err).await;
+            state.set(ConnectionState::Disconnected);
+        });
+
+        Ok(assigned_id)
+    }
+
+    #[wasm_bindgen]
+    pub async fn send(&self, frame: Vec<u8>) -> Result<(), JsValue> {
+        match &self.transport {
+            Some(t) => t.send_frame(&frame).await,
+            None => Err(js_error("not connected")),
+        }
+    }
+
+    #[wasm_bindgen]
+    pub fn disconnect(&mut self) {
+        if let Some(t) = &self.transport { t.close(); }
+        self.transport = None;
+        self.set_state(ConnectionState::Disconnected);
+    }
+
+    fn set_state(&self, new_state: ConnectionState) {
+        self.state.set(new_state);
+        let _ = self.on_state_change.call1(
+            &JsValue::NULL,
+            &JsValue::from(new_state as u8),
+        );
+    }
+}

wasm/src/crypto.rs

@@ -0,0 +1,263 @@
+use wasm_bindgen::prelude::*;
+
+use mtp_crypto::{
+    AeadDecrypt, AeadEncrypt, Ed25519Signer, KemPrivateKey, KemPublicKey, Keyring,
+    PublicKeyBundle, SignaturePqPrivateKey, SignaturePqPublicKey, SignaturePrivateKey,
+    SignaturePublicKey, SignatureScheme, ChaCha20Poly1305, sha256, sha256_double,
+};
+
+use crate::error::js_error;
+
+// ===========================================================================
+// Keyring
+// ===========================================================================
+
+#[wasm_bindgen]
+pub struct WasmKeyring {
+    inner: Keyring,
+}
+
+#[wasm_bindgen]
+impl WasmKeyring {
+    /// Serialise the keyring to bytes.
+    #[wasm_bindgen]
+    pub fn to_bytes(&self) -> Vec<u8> {
+        self.inner.to_bytes()
+    }
+
+    /// Deserialise a keyring from bytes.
+    #[wasm_bindgen]
+    pub fn from_bytes(bytes: &[u8]) -> Result<WasmKeyring, JsValue> {
+        let inner =
+            Keyring::from_bytes(bytes).map_err(|e| js_error(&format!("Keyring::from_bytes: {}", e)))?;
+        Ok(Self { inner })
+    }
+
+    /// Return the public half of this keyring as a bundle.
+    #[wasm_bindgen]
+    pub fn public_key_bundle(&self) -> WasmPublicKeyBundle {
+        WasmPublicKeyBundle {
+            inner: self.inner.public_key_bundle(),
+        }
+    }
+}
+
+/// Build a [`Keyring`] containing only an Ed25519 keypair (no KEM, no ML-DSA).
+///
+/// Takes the Ed25519 secret key and public key, each 32 bytes.
+/// Returns the serialised keyring bytes, suitable for passing to `WasmClient.auth_register`.
+#[wasm_bindgen]
+pub fn keyring_from_ed25519(secret_key: &[u8], public_key: &[u8]) -> Result<Vec<u8>, JsValue> {
+    if secret_key.len() != 32 {
+        return Err(js_error("ed25519 secret key must be 32 bytes"));
+    }
+    if public_key.len() != 32 {
+        return Err(js_error("ed25519 public key must be 32 bytes"));
+    }
+    let keyring = Keyring::new(
+        KemPublicKey::new(vec![]),
+        KemPrivateKey::new(vec![]),
+        SignaturePqPublicKey::new(vec![]),
+        SignaturePqPrivateKey::new(vec![]),
+        SignaturePublicKey::new(public_key.to_vec()),
+        SignaturePrivateKey::new(secret_key.to_vec()),
+    );
+    Ok(keyring.to_bytes())
+}
+
+// ===========================================================================
+// PublicKeyBundle
+// ===========================================================================
+
+#[wasm_bindgen]
+pub struct WasmPublicKeyBundle {
+    inner: PublicKeyBundle,
+}
+
+#[wasm_bindgen]
+impl WasmPublicKeyBundle {
+    #[wasm_bindgen(getter)]
+    pub fn kem_public_key(&self) -> Vec<u8> {
+        self.inner.kem_public_key.as_bytes().to_vec()
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn sig_cl_public_key(&self) -> Vec<u8> {
+        self.inner.sig_cl_public_key.as_bytes().to_vec()
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn sig_pq_public_key(&self) -> Vec<u8> {
+        self.inner.sig_pq_public_key.as_bytes().to_vec()
+    }
+
+    #[wasm_bindgen]
+    pub fn to_bytes(&self) -> Vec<u8> {
+        self.inner.as_bytes()
+    }
+
+    #[wasm_bindgen]
+    pub fn from_bytes(bytes: &[u8]) -> Result<WasmPublicKeyBundle, JsValue> {
+        let inner = PublicKeyBundle::from_bytes(bytes)
+            .map_err(|e| js_error(&format!("PublicKeyBundle::from_bytes: {}", e)))?;
+        Ok(Self { inner })
+    }
+}
+
+// ===========================================================================
+// ChaCha20-Poly1305 AEAD
+// ===========================================================================
+
+#[wasm_bindgen]
+pub struct WasmChaCha20Poly1305 {
+    inner: ChaCha20Poly1305,
+}
+
+#[wasm_bindgen]
+impl WasmChaCha20Poly1305 {
+    /// Create a new cipher with a 32-byte key.
+    #[wasm_bindgen(constructor)]
+    pub fn new(key: Vec<u8>) -> Result<WasmChaCha20Poly1305, JsValue> {
+        if key.len() != 32 {
+            return Err(js_error("ChaCha20Poly1305 key must be 32 bytes"));
+        }
+        let mut k = [0u8; 32];
+        k.copy_from_slice(&key);
+        Ok(Self {
+            inner: ChaCha20Poly1305::new(k),
+        })
+    }
+
+    /// Encrypt `plaintext` with `aad`.
+    /// Returns `nonce || ciphertext`.
+    #[wasm_bindgen]
+    pub fn encrypt(&self, plaintext: &[u8], aad: &[u8]) -> Result<Vec<u8>, JsValue> {
+        self.inner
+            .encrypt(plaintext, aad)
+            .map_err(|e| js_error(&format!("encrypt failed: {}", e)))
+    }
+
+    /// Decrypt `nonce || ciphertext` with `aad`.
+    #[wasm_bindgen]
+    pub fn decrypt(&self, ciphertext: &[u8], aad: &[u8]) -> Result<Vec<u8>, JsValue> {
+        self.inner
+            .decrypt(ciphertext, aad)
+            .map_err(|e| js_error(&format!("decrypt failed: {}", e)))
+    }
+}
+
+// ===========================================================================
+// Ed25519 signatures
+// ===========================================================================
+
+#[wasm_bindgen]
+pub struct WasmEd25519Signer {
+    inner: Ed25519Signer,
+}
+
+#[wasm_bindgen]
+impl WasmEd25519Signer {
+    /// Load a signer from its 32-byte secret key.
+    #[wasm_bindgen(constructor)]
+    pub fn new(secret_key: Vec<u8>) -> Result<WasmEd25519Signer, JsValue> {
+        let sk = SignaturePrivateKey::new(secret_key);
+        let inner =
+            Ed25519Signer::new(&sk).map_err(|e| js_error(&format!("Ed25519Signer::new: {}", e)))?;
+        Ok(Self { inner })
+    }
+
+    /// Sign `message` and return the signature bytes.
+    #[wasm_bindgen]
+    pub fn sign(&self, message: &[u8]) -> Result<Vec<u8>, JsValue> {
+        self.inner
+            .sign(message)
+            .map_err(|e| js_error(&format!("sign failed: {}", e)))
+    }
+
+    /// Verify `signature` against `message`.
+    #[wasm_bindgen]
+    pub fn verify(&self, message: &[u8], signature: &[u8]) -> Result<(), JsValue> {
+        self.inner
+            .verify(message, signature)
+            .map_err(|e| js_error(&format!("verify failed: {}", e)))
+    }
+}
+
+// ===========================================================================
+// Ed25519 key generation helper
+// ===========================================================================
+
+/// Generate a fresh Ed25519 keypair.
+///
+/// Returns `{ signer: WasmEd25519Signer, secretKey: Uint8Array, publicKey: Uint8Array }`.
+#[wasm_bindgen]
+pub fn ed25519_generate() -> Result<JsValue, JsValue> {
+    let (_signer, sk, pk) = Ed25519Signer::generate();
+    let obj = js_sys::Object::new();
+    js_sys::Reflect::set(
+        &obj,
+        &JsValue::from_str("signer"),
+        &WasmEd25519Signer::new(sk.as_bytes().to_vec())?.into(),
+    )
+    .map_err(|_| js_error("failed to set signer"))?;
+    js_sys::Reflect::set(
+        &obj,
+        &JsValue::from_str("secretKey"),
+        &js_sys::Uint8Array::from(sk.as_bytes()),
+    )
+    .map_err(|_| js_error("failed to set secretKey"))?;
+    js_sys::Reflect::set(
+        &obj,
+        &JsValue::from_str("publicKey"),
+        &js_sys::Uint8Array::from(pk.as_bytes()),
+    )
+    .map_err(|_| js_error("failed to set publicKey"))?;
+    Ok(obj.into())
+}
+
+/// Standalone Ed25519 signature verification.
+#[wasm_bindgen]
+pub fn ed25519_verify(public_key: Vec<u8>, message: &[u8], signature: &[u8]) -> Result<(), JsValue> {
+    let pk = SignaturePublicKey::new(public_key);
+    mtp_crypto::verify_ed25519(&pk, message, signature)
+        .map_err(|e| js_error(&format!("verify_ed25519 failed: {}", e)))
+}
+
+// ===========================================================================
+// Hashing
+// ===========================================================================
+
+/// SHA-256 digest.
+#[wasm_bindgen]
+pub fn wasm_sha256(data: &[u8]) -> Vec<u8> {
+    sha256(data).to_vec()
+}
+
+/// Double SHA-256 (SHA-256 applied twice).
+#[wasm_bindgen]
+pub fn wasm_sha256_double(data: &[u8]) -> Vec<u8> {
+    sha256_double(data).to_vec()
+}
+
+// ===========================================================================
+// KDF
+// ===========================================================================
+
+/// HKDF-expand: derive `len` bytes from `ikm` with `salt` and `info`.
+#[wasm_bindgen]
+pub fn wasm_hkdf_expand(ikm: &[u8], salt: &[u8], info: &[u8], len: usize) -> Result<Vec<u8>, JsValue> {
+    mtp_crypto::hkdf_expand(ikm, salt, info, len)
+        .map_err(|e| js_error(&format!("hkdf_expand failed: {}", e)))
+}
+
+/// Derive a 32-byte encryption key from `ikm` with `salt` and `context`.
+#[wasm_bindgen]
+pub fn wasm_derive_encryption_key(
+    ikm: &[u8],
+    salt: &[u8],
+    context: &[u8],
+) -> Result<Vec<u8>, JsValue> {
+    mtp_crypto::derive_encryption_key(ikm, salt, context)
+        .map(|key| key.to_vec())
+        .map_err(|e| js_error(&format!("derive_encryption_key failed: {}", e)))
+}

wasm/src/error.rs

@@ -0,0 +1,17 @@
+use wasm_bindgen::JsValue;
+
+pub fn js_error(msg: impl Into<String>) -> JsValue {
+    JsValue::from_str(&msg.into())
+}
+
+pub fn from_codec_error(e: mtp_common::CodecError) -> JsValue {
+    js_error(e.to_string())
+}
+
+pub fn from_communication_error(e: mtp_common::CommunicationError) -> JsValue {
+    js_error(e.to_string())
+}
+
+pub fn from_crypto_error(e: mtp_crypto::CryptoError) -> JsValue {
+    js_error(e.to_string())
+}

wasm/src/lib.rs

@@ -0,0 +1,13 @@
+pub mod error;
+pub mod transport;
+pub mod client;
+pub mod crypto;
+pub mod message;
+
+use wasm_bindgen::prelude::*;
+
+#[wasm_bindgen(start)]
+pub fn main() {
+    console_error_panic_hook::set_once();
+    web_sys::console::log_1(&"mtp-wasm: module loaded".into());
+}

wasm/src/message.rs

@@ -0,0 +1,135 @@
+use wasm_bindgen::prelude::*;
+
+use mtp_codec::{
+    CommunicationType, CommunicationValue, DataType, DataTypeId, DataValue,
+};
+use mtp_crypto::{
+    ChaCha20Poly1305, Ed25519Signer, Keyring, SigAlgorithm,
+    derive_encryption_key,
+};
+
+use crate::error::js_error;
+
+/// Build a simple Ping frame with description, timestamp, and optional data.
+#[wasm_bindgen]
+pub fn build_ping_frame(
+    client_id: u64,
+    description: &str,
+    timestamp: u64,
+    data: &[u8],
+) -> Vec<u8> {
+    let mut msg = CommunicationValue::new(CommunicationType::Ping)
+        .add_typed_default(DataType::Description, DataValue::Str(description.to_string()))
+        .add_typed_default(DataType::Timestamp, DataValue::UnsignedNumber(timestamp as u128))
+        .with_sender(client_id);
+
+    if !data.is_empty() {
+        msg = msg.add_typed_default(DataType::Id, DataValue::Bytes(data.to_vec()));
+    }
+
+    msg.to_bytes()
+}
+
+/// Build a demo Ping frame with encrypted and signed containers
+/// (mirrors the Rust client example but uses only reserved data types).
+#[wasm_bindgen]
+pub fn build_demo_message(client_id: u64, keyring_bytes: &[u8]) -> Result<Vec<u8>, JsValue> {
+    let keyring = Keyring::from_bytes(keyring_bytes)
+        .map_err(|e| js_error(&format!("invalid keyring: {}", e)))?;
+
+    let enc_key = derive_encryption_key(
+        b"MTP-demo-shared-secret",
+        b"MTP-demo-salt",
+        b"encrypted-container-demo",
+    )
+    .map_err(|e| js_error(&format!("key derivation failed: {}", e)))?;
+
+    let cipher = ChaCha20Poly1305::new(enc_key);
+    let signer = Ed25519Signer::new(&keyring.sig_cl_secret_key)
+        .map_err(|e| js_error(&format!("signer creation failed: {}", e)))?;
+
+    // Encrypted container (DataTypeId 1 = arbitrary custom)
+    let inner_enc = DataValue::Container(vec![
+        (DataTypeId(1), DataValue::Str("secret inner data".into())),
+        (DataTypeId(2), DataValue::UnsignedNumber(42)),
+    ]);
+    let mut dv_enc = inner_enc;
+    dv_enc.encrypt_container(&cipher, b"demo-aad")
+        .ok_or_else(|| js_error("encryption failed"))?;
+
+    // Signed container
+    let inner_sig = DataValue::Container(vec![
+        (DataTypeId(1), DataValue::Str("signed by client".into())),
+        (DataTypeId(2), DataValue::UnsignedNumber(99)),
+    ]);
+    let mut dv_sig = inner_sig;
+    dv_sig.sign_container(SigAlgorithm::ED25519, &signer)
+        .ok_or_else(|| js_error("signing failed"))?;
+
+    // Signed + encrypted container
+    let inner_sec = DataValue::Container(vec![
+        (DataTypeId(1), DataValue::Str("signed+encrypted payload".into())),
+        (DataTypeId(2), DataValue::UnsignedNumber(7)),
+    ]);
+    let mut dv_sec = inner_sec;
+    dv_sec.sign_and_encrypt_container(SigAlgorithm::ED25519, &signer, &cipher, b"demo-aad")
+        .ok_or_else(|| js_error("sign+encrypt failed"))?;
+
+    let timestamp = js_sys::Date::now() as u64;
+
+    let msg = CommunicationValue::new(CommunicationType::Ping)
+        .add_typed_default(DataType::Description, DataValue::Str("MTP WASM Demo".into()))
+        .add_typed_default(DataType::Timestamp, DataValue::UnsignedNumber(timestamp as u128))
+        .add_typed_default(DataType::Version, DataValue::Str("demo-wasm".into()))
+        .with_sender(client_id);
+
+    Ok(msg.to_bytes())
+}
+
+/// Parse an auth response frame into a JS object.
+#[wasm_bindgen]
+pub fn parse_auth_response(response: &[u8]) -> Result<JsValue, JsValue> {
+    let comm = CommunicationValue::from_bytes(response)
+        .map_err(|e| js_error(&format!("parse failed: {}", e)))?;
+
+    let connected = matches!(comm.get_data(DataTypeId(11)), DataValue::BoolTrue);
+
+    let client_nonce = match comm.get_data(DataTypeId(7)) {
+        DataValue::UnsignedNumber(n) => Some(*n),
+        _ => None,
+    };
+
+    let assigned_id = match comm.get_data(DataTypeId(6)) {
+        DataValue::UnsignedNumber(n) => Some(*n as u64),
+        _ => None,
+    };
+
+    let timestamp = match comm.get_data(DataTypeId(5)) {
+        DataValue::UnsignedNumber(n) => Some(*n),
+        _ => None,
+    };
+
+    let signature = match comm.get_data(DataTypeId(10)) {
+        DataValue::Bytes(b) => Some(b.clone()),
+        _ => None,
+    };
+
+    let obj = js_sys::Object::new();
+    js_sys::Reflect::set(&obj, &"connected".into(), &JsValue::from(connected)).ok();
+    if let Some(n) = client_nonce {
+        let arr = js_sys::Uint8Array::from(&n.to_be_bytes()[..]);
+        js_sys::Reflect::set(&obj, &"clientNonce".into(), &arr).ok();
+    }
+    if let Some(id) = assigned_id {
+        js_sys::Reflect::set(&obj, &"assignedId".into(), &JsValue::from(id as f64)).ok();
+    }
+    if let Some(ts) = timestamp {
+        js_sys::Reflect::set(&obj, &"timestamp".into(), &JsValue::from(ts as f64)).ok();
+    }
+    if let Some(sig) = signature {
+        let arr = js_sys::Uint8Array::from(&sig[..]);
+        js_sys::Reflect::set(&obj, &"signature".into(), &arr).ok();
+    }
+
+    Ok(obj.into())
+}

wasm/src/transport.rs

@@ -0,0 +1,274 @@
+use wasm_bindgen::prelude::*;
+use wasm_bindgen::JsCast;
+use wasm_bindgen_futures::JsFuture;
+use web_sys::WebTransport;
+
+use crate::error::js_error;
+
+#[derive(Clone)]
+pub struct WasmTransport {
+    inner: WebTransport,
+}
+
+impl WasmTransport {
+    pub async fn connect(url: &str) -> Result<Self, JsValue> {
+        let transport = WebTransport::new(url)?;
+        JsFuture::from(transport.ready()).await
+            .map_err(|e| js_error(&format!("WebTransport ready failed: {:?}", e)))?;
+        Ok(Self { inner: transport })
+    }
+
+    pub fn inner(&self) -> &WebTransport {
+        &self.inner
+    }
+
+    pub fn from_inner(inner: WebTransport) -> Self {
+        Self { inner }
+    }
+
+    pub async fn send_frame(&self, frame: &[u8]) -> Result<(), JsValue> {
+        let stream_promise = self.inner.create_unidirectional_stream();
+        let stream = JsFuture::from(stream_promise).await?;
+
+        let writable = js_sys::Reflect::get(&stream, &JsValue::from_str("writable"))
+            .map_err(|_| js_error("missing writable"))?;
+
+        let writer_val = js_sys::Reflect::get(&writable, &JsValue::from_str("getWriter"))
+            .map_err(|_| js_error("missing getWriter"))?
+            .dyn_into::<js_sys::Function>()
+            .map_err(|_| js_error("getWriter not a function"))?
+            .call0(&writable)
+            .map_err(|_| js_error("getWriter call failed"))?;
+
+        let len = frame.len() as u32;
+        let mut wire = Vec::with_capacity(4 + frame.len());
+        wire.extend_from_slice(&len.to_be_bytes());
+        wire.extend_from_slice(frame);
+
+        let chunk = js_sys::Uint8Array::from(&wire[..]);
+
+        let write_fn = js_sys::Reflect::get(&writer_val, &JsValue::from_str("write"))
+            .map_err(|_| js_error("missing write"))?
+            .dyn_into::<js_sys::Function>()
+            .map_err(|_| js_error("write not a function"))?;
+        let write_promise = write_fn.call1(&writer_val, &chunk)
+            .map_err(|e| js_error(&format!("write failed: {:?}", e)))?;
+        JsFuture::from(write_promise.unchecked_into::<js_sys::Promise>()).await?;
+
+        let close_fn = js_sys::Reflect::get(&writer_val, &JsValue::from_str("close"))
+            .map_err(|_| js_error("missing close"))?
+            .dyn_into::<js_sys::Function>()
+            .map_err(|_| js_error("close not a function"))?;
+        let close_promise = close_fn.call0(&writer_val)
+            .map_err(|e| js_error(&format!("close failed: {:?}", e)))?;
+        JsFuture::from(close_promise.unchecked_into::<js_sys::Promise>()).await?;
+
+        Ok(())
+    }
+
+    /// Read exactly one frame from incoming uni streams, then release the reader
+    /// so `receive_loop` can pick up from where we left off.
+    pub async fn read_one_frame(&self) -> Result<Vec<u8>, JsValue> {
+        let incoming = self.inner.incoming_unidirectional_streams();
+
+        let reader_fn = js_sys::Reflect::get(&incoming, &JsValue::from_str("getReader"))
+            .map_err(|_| js_error("missing getReader"))?
+            .dyn_into::<js_sys::Function>()
+            .map_err(|_| js_error("getReader not a function"))?;
+        let reader_val = reader_fn.call0(&incoming)
+            .map_err(|_| js_error("getReader call failed"))?;
+
+        let read_fn = js_sys::Reflect::get(&reader_val, &JsValue::from_str("read"))
+            .map_err(|_| js_error("missing read"))?
+            .dyn_into::<js_sys::Function>()
+            .map_err(|_| js_error("read not a function"))?;
+        let result_promise = read_fn.call0(&reader_val)
+            .map_err(|_| js_error("read call failed"))?;
+        let result = JsFuture::from(result_promise.unchecked_into::<js_sys::Promise>()).await
+            .map_err(|e| js_error(&format!("read failed: {:?}", e)))?;
+
+        // Release the reader lock so receive_loop can create its own reader
+        if let Some(release_fn) = js_sys::Reflect::get(&reader_val, &JsValue::from_str("releaseLock"))
+            .ok().and_then(|f| f.dyn_into::<js_sys::Function>().ok())
+        {
+            let _ = release_fn.call0(&reader_val);
+        }
+
+        let done = js_sys::Reflect::get(&result, &JsValue::from_str("done"))
+            .ok().and_then(|v| v.as_bool()).unwrap_or(false);
+        if done {
+            return Err(js_error("stream ended before frame"));
+        }
+
+        let recv_stream = js_sys::Reflect::get(&result, &JsValue::from_str("value"))
+            .map_err(|_| js_error("missing value"))?;
+
+        let readable = js_sys::Reflect::get(&recv_stream, &JsValue::from_str("readable"))
+            .map_err(|_| js_error("missing readable"))?;
+
+        let stream_reader_fn = js_sys::Reflect::get(&readable, &JsValue::from_str("getReader"))
+            .map_err(|_| js_error("missing stream getReader"))?
+            .dyn_into::<js_sys::Function>()
+            .map_err(|_| js_error("stream getReader not a function"))?;
+        let stream_reader = stream_reader_fn.call0(&readable)
+            .map_err(|_| js_error("stream getReader call failed"))?;
+
+        let mut chunks: Vec<Vec<u8>> = Vec::new();
+        loop {
+            let stream_read_fn = match js_sys::Reflect::get(&stream_reader, &JsValue::from_str("read"))
+                .ok().and_then(|f| f.dyn_into::<js_sys::Function>().ok())
+            {
+                Some(f) => f,
+                None => break,
+            };
+            let chunk_promise = match stream_read_fn.call0(&stream_reader) {
+                Ok(p) => p,
+                Err(_) => break,
+            };
+            let chunk_result = match JsFuture::from(chunk_promise.unchecked_into::<js_sys::Promise>()).await {
+                Ok(v) => v,
+                Err(_) => break,
+            };
+
+            let chunk_done = js_sys::Reflect::get(&chunk_result, &JsValue::from_str("done"))
+                .ok().and_then(|v| v.as_bool()).unwrap_or(true);
+            if chunk_done {
+                break;
+            }
+
+            if let Ok(chunk_val) = js_sys::Reflect::get(&chunk_result, &JsValue::from_str("value")) {
+                let arr = js_sys::Uint8Array::new(&chunk_val).to_vec();
+                if !arr.is_empty() {
+                    chunks.push(arr);
+                }
+            }
+        }
+
+        if chunks.is_empty() {
+            return Err(js_error("empty stream"));
+        }
+
+        let total: usize = chunks.iter().map(|c| c.len()).sum();
+        let mut buf = Vec::with_capacity(total);
+        for c in &chunks {
+            buf.extend_from_slice(c);
+        }
+
+        if buf.len() < 4 {
+            return Err(js_error("frame too short"));
+        }
+        let frame_len = u32::from_be_bytes([buf[0], buf[1], buf[2], buf[3]]) as usize;
+        if 4 + frame_len > buf.len() {
+            return Err(js_error("frame truncated"));
+        }
+
+        Ok(buf[4..4 + frame_len].to_vec())
+    }
+
+    pub async fn receive_loop(
+        &self,
+        on_message: js_sys::Function,
+        on_error: js_sys::Function,
+    ) {
+        let incoming = self.inner.incoming_unidirectional_streams();
+
+        let reader_fn = match js_sys::Reflect::get(&incoming, &JsValue::from_str("getReader")) {
+            Ok(f) => f.dyn_into::<js_sys::Function>().unwrap(),
+            Err(_) => return,
+        };
+        let reader_val = match reader_fn.call0(&incoming) {
+            Ok(v) => v,
+            Err(_) => return,
+        };
+
+        loop {
+            let read_fn = match js_sys::Reflect::get(&reader_val, &JsValue::from_str("read")) {
+                Ok(f) => f.dyn_into::<js_sys::Function>().unwrap(),
+                Err(_) => break,
+            };
+            let result = match read_fn.call0(&reader_val) {
+                Ok(p) => match JsFuture::from(p.unchecked_into::<js_sys::Promise>()).await {
+                    Ok(v) => v,
+                    Err(e) => {
+                        let _ = on_error.call1(&JsValue::NULL, &JsValue::from_str(
+                            &format!("read stream failed: {:?}", e)
+                        ));
+                        break;
+                    }
+                },
+                Err(_) => break,
+            };
+
+            let done = js_sys::Reflect::get(&result, &JsValue::from_str("done"))
+                .ok().and_then(|v| v.as_bool()).unwrap_or(false);
+            if done { break; }
+
+            let recv_stream = match js_sys::Reflect::get(&result, &JsValue::from_str("value")) {
+                Ok(v) => v,
+                Err(_) => continue,
+            };
+
+            let readable = match js_sys::Reflect::get(&recv_stream, &JsValue::from_str("readable")) {
+                Ok(v) => v,
+                Err(_) => continue,
+            };
+
+            let stream_reader_fn = match js_sys::Reflect::get(&readable, &JsValue::from_str("getReader")) {
+                Ok(f) => f.dyn_into::<js_sys::Function>().unwrap(),
+                Err(_) => continue,
+            };
+            let stream_reader = match stream_reader_fn.call0(&readable) {
+                Ok(v) => v,
+                Err(_) => continue,
+            };
+
+            let mut chunks: Vec<Vec<u8>> = Vec::new();
+            loop {
+                let stream_read_fn = match js_sys::Reflect::get(&stream_reader, &JsValue::from_str("read")) {
+                    Ok(f) => f.dyn_into::<js_sys::Function>().unwrap(),
+                    Err(_) => break,
+                };
+                let chunk_result = match stream_read_fn.call0(&stream_reader) {
+                    Ok(p) => match JsFuture::from(p.unchecked_into::<js_sys::Promise>()).await {
+                        Ok(v) => v,
+                        Err(_) => break,
+                    },
+                    Err(_) => break,
+                };
+
+                let chunk_done = js_sys::Reflect::get(&chunk_result, &JsValue::from_str("done"))
+                    .ok().and_then(|v| v.as_bool()).unwrap_or(true);
+                if chunk_done { break; }
+
+                if let Ok(chunk_val) = js_sys::Reflect::get(&chunk_result, &JsValue::from_str("value")) {
+                    let arr = js_sys::Uint8Array::new(&chunk_val).to_vec();
+                    if !arr.is_empty() { chunks.push(arr); }
+                }
+            }
+
+            if chunks.is_empty() { continue; }
+
+            let total: usize = chunks.iter().map(|c| c.len()).sum();
+            let mut buf = Vec::with_capacity(total);
+            for c in &chunks { buf.extend_from_slice(c); }
+
+            if buf.len() < 4 {
+                let _ = on_error.call1(&JsValue::NULL, &JsValue::from_str("frame too short"));
+                continue;
+            }
+            let frame_len = u32::from_be_bytes([buf[0], buf[1], buf[2], buf[3]]) as usize;
+            if 4 + frame_len > buf.len() {
+                let _ = on_error.call1(&JsValue::NULL, &JsValue::from_str("frame truncated"));
+                continue;
+            }
+            let frame = buf[4..4 + frame_len].to_vec();
+            let arr = js_sys::Uint8Array::from(&frame[..]);
+            let _ = on_message.call1(&JsValue::NULL, &arr);
+        }
+    }
+
+    pub fn close(&self) {
+        let info = web_sys::WebTransportCloseInfo::new();
+        let _ = self.inner.close_with_close_info(&info);
+    }
+}