(feat): rename example-usage to just example

(feat): add the example's web-client dist folder to a gitignore
(fix): format issues
(fix): a lot of duplicate code

example/.cargo/config.toml

@@ -0,0 +1,2 @@
+[env]
+MTP_TYPE_MAPS = { value = "type-maps.yaml", relative = true }

example/.gitignore

@@ -0,0 +1,11 @@
+client_keys.json
+host_keys.json
+host_sig_pk.bin
+host_sig_pq_pk.bin
+host_enc_kem_pk.bin
+host_public_key_bundle.hex
+clients.json
+web-client/node_modules
+dev-cert/
+web-client/public/host_public_key_bundle.hex
+web-client/public/mtp_dev_cert_hash.txt

example/Cargo.toml

@@ -0,0 +1,6 @@
+[workspace]
+members = [
+    "server",
+    "client",
+]
+resolver = "3"

example/client/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "client"
+version = "0.1.0"
+edition = "2024"
+
+[[bin]]
+name = "client"
+path = "src/main.rs"
+
+[dependencies]
+mtp = { path = "../../", features = ["client", "crypto"] }
+tokio = { version = "1", features = ["full"] }
+serde_json = "1"
+hex = "0.4"

example/client/src/auth.rs

@@ -0,0 +1,52 @@
+use std::fs;
+
+use mtp::client::{ClientConfig, MTPClient, MTPConnection};
+use mtp::crypto::{Ed25519Signer, Keyring, MlDsaSigner, PublicKeyBundle};
+
+pub async fn connect_or_register(
+    mut config: ClientConfig,
+    host_public_key: PublicKeyBundle,
+    client_key_path: &str,
+) -> Result<(MTPConnection, Keyring), Box<dyn std::error::Error>> {
+    if let Ok(data) = fs::read_to_string(client_key_path) {
+        let json: serde_json::Value = serde_json::from_str(&data)?;
+        let client_id = json["client_id"].as_u64().expect("Invalid client_id");
+        let keyring = Keyring::from_bytes(&hex::decode(
+            json["keyring"].as_str().expect("Missing keyring"),
+        )?)?;
+
+        println!("Loaded client keys (ID: {})", client_id);
+
+        config.client_id = client_id;
+        let conn = MTPClient::auth_connect(config, &keyring, &host_public_key).await?;
+        println!("Authenticated (version {})", conn.version);
+        Ok((conn, keyring))
+    } else {
+        println!("No existing keys found: registering new client");
+
+        let (_ed_signer, sig_sk, sig_pk) = Ed25519Signer::generate();
+        let (_pq_signer, sig_pq_sk, sig_pq_pk) = MlDsaSigner::generate();
+        let keyring = Keyring::new(
+            mtp::crypto::KemPublicKey::new(vec![]),
+            mtp::crypto::KemPrivateKey::new(vec![]),
+            sig_pq_pk,
+            sig_pq_sk,
+            sig_pk,
+            sig_sk,
+        );
+
+        let keyring_bytes = keyring.to_bytes();
+        let conn = MTPClient::auth_register(config, &keyring, &host_public_key).await?;
+        println!("Registered with ID: {}", conn.client_id);
+
+        let json = serde_json::json!({
+            "client_id": conn.client_id,
+            "keyring": hex::encode(&keyring_bytes),
+        });
+        fs::write(client_key_path, serde_json::to_string_pretty(&json)?)?;
+        println!("Saved client keys -> {client_key_path}");
+
+        let keyring = Keyring::from_bytes(&keyring_bytes)?;
+        Ok((conn, keyring))
+    }
+}

example/client/src/main.rs

@@ -0,0 +1,57 @@
+mod auth;
+mod messages;
+
+use std::fs;
+use std::path::Path;
+
+use mtp::client::ClientConfig;
+use mtp::crypto::{KemPublicKey, PublicKeyBundle, SignaturePqPublicKey, SignaturePublicKey};
+
+fn dev_cert_path() -> String {
+    std::env::var("MTP_DEV_CERT").unwrap_or_else(|_| {
+        if Path::new("example/dev-cert/cert.pem").exists() {
+            "example/dev-cert/cert.pem".to_string()
+        } else {
+            "dev-cert/cert.pem".to_string()
+        }
+    })
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let cert_path = dev_cert_path();
+    let cert_pem = fs::read(&cert_path).unwrap_or_else(|e| {
+        panic!(
+            "Missing TLS certificate at {cert_path}: enter the Nix shell first or run the server to generate it: {e}"
+        )
+    });
+    let host_public_key = PublicKeyBundle::new(
+        KemPublicKey::new(
+            fs::read("host_enc_kem_pk.bin")
+                .expect("Missing host_enc_kem_pk.bin: run server first"),
+        ),
+        SignaturePqPublicKey::new(
+            fs::read("host_sig_pq_pk.bin")
+                .expect("Missing host_sig_pq_pk.bin: run server first"),
+        ),
+        SignaturePublicKey::new(
+            fs::read("host_sig_pk.bin").expect("Missing host_sig_pk.bin: run server first"),
+        ),
+    );
+
+    println!("Connecting to 127.0.0.1:8080 ...");
+
+    let config = ClientConfig {
+        url: "https://127.0.0.1:8080".into(),
+        server_cert: Some(cert_pem),
+        client_id: 0,
+    };
+
+    let server_bundle = host_public_key.clone();
+    let (conn, keyring) =
+        auth::connect_or_register(config, host_public_key, "client_keys.json").await?;
+    messages::send_and_receive(&conn, &keyring, &server_bundle).await?;
+
+    println!("\nDone");
+    Ok(())
+}

example/client/src/messages.rs

@@ -0,0 +1,96 @@
+use mtp::client::MTPConnection;
+use mtp::codec::{CommunicationType, CommunicationValue, DataType, DataValue};
+use mtp::crypto::{Ed25519Signer, EncryptionType, Keyring, PublicKeyBundle, SigAlgorithm};
+use mtp::type_map::TypeMap;
+
+pub fn build_demo_message(
+    client_id: u64,
+    keyring: &Keyring,
+    server_bundle: &PublicKeyBundle,
+) -> CommunicationValue {
+    // Encrypt to the server's KEM public key; the server decrypts with its keyring.
+    let enc_type = EncryptionType::MlKemChaCha20Poly1305;
+    let signer = Ed25519Signer::new(&keyring.sig_cl_secret_key)
+        .expect("Ed25519 signer from keyring");
+
+    let tm = TypeMap::latest();
+
+    let inner_enc = DataValue::Container(vec![
+        (DataType::Version.to_id(&tm), DataValue::Str("secret inner data".into())),
+        (DataType::Id.to_id(&tm), DataValue::UnsignedNumber(42)),
+    ]);
+    let mut dv_enc = inner_enc;
+    dv_enc.encrypt_container(enc_type, server_bundle, b"demo-aad");
+
+    let inner_sig = DataValue::Container(vec![
+        (DataType::Version.to_id(&tm), DataValue::Str("signed by client".into())),
+        (DataType::Id.to_id(&tm), DataValue::UnsignedNumber(99)),
+    ]);
+    let mut dv_sig = inner_sig;
+    dv_sig.sign_container(SigAlgorithm::ED25519, &signer);
+
+    let inner_sec = DataValue::Container(vec![
+        (
+            DataType::Version.to_id(&tm),
+            DataValue::Str("signed+encrypted payload".into()),
+        ),
+        (DataType::Id.to_id(&tm), DataValue::UnsignedNumber(7)),
+    ]);
+    let mut dv_sec = inner_sec;
+    dv_sec.sign_and_encrypt_container(SigAlgorithm::ED25519, &signer, enc_type, server_bundle, b"demo-aad");
+
+    let timestamp = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+
+    let msg = CommunicationValue::new(CommunicationType::Ping)
+        .add_typed_default(
+            DataType::Description,
+            DataValue::Str("MTP Data Type Demo".into()),
+        )
+        .add_typed_default(
+            DataType::Timestamp,
+            DataValue::UnsignedNumber(timestamp as u128),
+        )
+        .add_typed_default(DataType::Data, DataValue::Str("Hello, MTP!".into()))
+        .add_typed_default(DataType::Flags, DataValue::BoolTrue)
+        .add_typed_default(DataType::Value, DataValue::Float(2, 12345))
+        .add_typed_default(
+            DataType::BinaryData,
+            DataValue::Bytes(vec![0xDE, 0xAD, 0xBE, 0xEF, 0x42]),
+        )
+        .add_typed_default(
+            DataType::Items,
+            DataValue::Array(vec![
+                DataValue::Str("alpha".into()),
+                DataValue::Str("beta".into()),
+                DataValue::Str("gamma".into()),
+            ]),
+        )
+        .add_typed_default(DataType::EncryptedPayload, dv_enc)
+        .add_typed_default(DataType::SignedPayload, dv_sig)
+        .add_typed_default(DataType::SecurePayload, dv_sec)
+        .with_sender(client_id);
+    msg
+}
+
+pub async fn send_and_receive(
+    conn: &MTPConnection,
+    keyring: &Keyring,
+    server_bundle: &PublicKeyBundle,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let msg = build_demo_message(conn.client_id, keyring, server_bundle);
+    println!("Sending: {msg}");
+    conn.sender.send(&msg).await?;
+
+    match conn.receiver.receive().await {
+        Ok(resp) => {
+            println!("Received: {resp}");
+        }
+        Err(e) => eprintln!("Receive error: {e}"),
+    }
+
+    conn.sender.close();
+    Ok(())
+}

example/server/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "server"
+version = "0.1.0"
+edition = "2024"
+
+[[bin]]
+name = "server"
+path = "src/main.rs"
+
+[dependencies]
+mtp = { path = "../../", features = ["crypto", "host"] }
+rcgen = "0.14"
+tokio = { version = "1", features = ["full"] }
+serde_json = { version = "1" }
+hex = "0.4"
+base64 = "0.22"

example/server/src/clients.rs

@@ -0,0 +1,25 @@
+use std::collections::HashMap;
+use std::fs;
+use std::sync::{Arc, Mutex};
+
+use mtp::crypto::PublicKeyBundle;
+
+pub fn load_client_db(
+    path: &str,
+) -> Result<(Arc<Mutex<HashMap<u64, PublicKeyBundle>>>, Arc<Mutex<u64>>), Box<dyn std::error::Error>>
+{
+    let clients_map = match fs::read_to_string(path) {
+        Ok(data) => match serde_json::from_str(&data) {
+            Ok(clients) => clients,
+            Err(e) => {
+                eprintln!("Failed to parse {path}; starting with empty client database: {e}");
+                HashMap::new()
+            }
+        },
+        Err(_) => HashMap::new(),
+    };
+    let clients: Arc<Mutex<HashMap<u64, PublicKeyBundle>>> = Arc::new(Mutex::new(clients_map));
+    let next_value = clients.lock().unwrap().keys().max().unwrap_or(&999) + 1;
+    let next_id = Arc::new(Mutex::new(next_value));
+    Ok((clients, next_id))
+}

example/server/src/handlers.rs

@@ -0,0 +1,135 @@
+use mtp::codec::{CommunicationType, CommunicationValue, DataType, DataTypeId, DataValue, TypeMap};
+use mtp::crypto::{
+    CryptoError, Keyring, SignaturePublicKey, SignatureScheme, verify_ed25519,
+};
+
+struct Ed25519Verifier(SignaturePublicKey);
+
+impl SignatureScheme for Ed25519Verifier {
+    fn sign(&self, _msg: &[u8]) -> Result<Vec<u8>, CryptoError> {
+        Err(CryptoError::SigningFailed)
+    }
+    fn verify(&self, msg: &[u8], signature: &[u8]) -> Result<(), CryptoError> {
+        verify_ed25519(&self.0, msg, signature)
+    }
+}
+
+pub fn process_and_respond(
+    msg: &CommunicationValue,
+    tm: &TypeMap,
+    client_pk: Option<&mtp::crypto::PublicKeyBundle>,
+    host_keyring: &Keyring,
+) -> CommunicationValue {
+    let desc_id = DataTypeId(tm.data_id_enum(DataType::Description).unwrap());
+    let ts_id = DataTypeId(tm.data_id_enum(DataType::Timestamp).unwrap());
+    let data_id = DataTypeId(tm.data_id_enum(DataType::Data).unwrap());
+    let flags_id = DataTypeId(tm.data_id_enum(DataType::Flags).unwrap());
+    let value_id = DataTypeId(tm.data_id_enum(DataType::Value).unwrap());
+    let bin_id = DataTypeId(tm.data_id_enum(DataType::BinaryData).unwrap());
+    let items_id = DataTypeId(tm.data_id_enum(DataType::Items).unwrap());
+    let enc_id = DataTypeId(tm.data_id_enum(DataType::EncryptedPayload).unwrap());
+    let sig_id = DataTypeId(tm.data_id_enum(DataType::SignedPayload).unwrap());
+    let secure_id = DataTypeId(tm.data_id_enum(DataType::SecurePayload).unwrap());
+
+    let description = msg.get_data(desc_id);
+    let timestamp = msg.get_data(ts_id);
+    let data = msg.get_data(data_id);
+    let flags = msg.get_data(flags_id);
+    let value = msg.get_data(value_id);
+    let binary = msg.get_data(bin_id);
+    let items = msg.get_data(items_id);
+
+    println!(
+        "  Description: {}",
+        description.as_str().unwrap_or("(missing)")
+    );
+    println!("  Timestamp: {:?}", timestamp.as_unsigned_number());
+    println!("  Data: {}", data.as_str().unwrap_or("(missing)"));
+    println!("  Flags: {:?}", flags.as_bool());
+    println!("  Value: {:?}", value.as_float());
+    println!("  Binary: {:?}", binary.as_bytes());
+    println!("  Items: {:?}", items.as_array());
+
+    let mut enc_status = String::from("EncryptedPayload: not present");
+    let mut sig_status = String::from("SignedPayload: not present");
+    let mut secure_status = String::from("SecurePayload: not present");
+
+    let enc = msg.get_data(enc_id);
+    if matches!(enc, DataValue::EncryptedContainer(_)) {
+        let mut dv = enc.clone();
+        if dv.decrypt_into_container(host_keyring, b"demo-aad").is_some() {
+            if let Some(entries) = dv.as_container() {
+                println!("  Decrypted EncryptedPayload: {:?}", entries);
+                enc_status = format!("EncryptedPayload decrypted OK ({} entries)", entries.len());
+            }
+        } else {
+            eprintln!("  EncryptedPayload decryption failed");
+            enc_status = String::from("EncryptedPayload: decryption FAILED");
+        }
+    }
+
+    let sig = msg.get_data(sig_id);
+    if matches!(sig, DataValue::SignedContainer(_)) {
+        if let Some(pk_bundle) = client_pk {
+            let verifier = Ed25519Verifier(pk_bundle.sig_cl_public_key.clone());
+            let mut dv = sig.clone();
+            if dv.verify_into_container(&verifier).is_some() {
+                if let Some(entries) = dv.as_container() {
+                    println!("  Verified SignedPayload: {:?}", entries);
+                    sig_status = format!("SignedPayload verified OK ({} entries)", entries.len());
+                }
+            } else {
+                eprintln!("  SignedPayload verification failed");
+                sig_status = String::from("SignedPayload: verification FAILED");
+            }
+        } else {
+            eprintln!("  SignedPayload cannot be verified; no client public key available");
+            sig_status = String::from("SignedPayload: no client public key available");
+        }
+    }
+
+    let secure = msg.get_data(secure_id);
+    if matches!(secure, DataValue::SignedEncryptedContainer(_)) {
+        if let Some(pk_bundle) = client_pk {
+            let verifier = Ed25519Verifier(pk_bundle.sig_cl_public_key.clone());
+            let mut dv = secure.clone();
+            if dv.decrypt_signed_encrypted_container(host_keyring, b"demo-aad").is_some()
+                && dv.verify_into_container(&verifier).is_some()
+            {
+                if let Some(entries) = dv.as_container() {
+                    println!("  Verified SecurePayload: {:?}", entries);
+                    secure_status = format!(
+                        "SecurePayload decrypted+verified OK ({} entries)",
+                        entries.len()
+                    );
+                }
+            } else {
+                eprintln!("  SecurePayload decryption/verification failed");
+                secure_status = String::from("SecurePayload: decryption/verification FAILED");
+            }
+        } else {
+            eprintln!("  SecurePayload cannot be verified; no client public key available");
+            secure_status = String::from("SecurePayload: no client public key available");
+        }
+    }
+
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+
+    CommunicationValue::from_comm(CommunicationType::Pong, tm)
+        .add_data(desc_id, description.clone())
+        .add_data(ts_id, DataValue::UnsignedNumber(now as u128))
+        .add_data(
+            data_id,
+            DataValue::Str(format!(
+                "{}. {}. {}.",
+                enc_status, sig_status, secure_status
+            )),
+        )
+        .add_data(flags_id, flags.clone())
+        .add_data(value_id, value.clone())
+        .add_data(bin_id, binary.clone())
+        .add_data(items_id, items.clone())
+}

example/server/src/keys.rs

@@ -0,0 +1,50 @@
+use std::fs;
+
+use mtp::crypto::kem::HybridKem;
+use mtp::crypto::{Ed25519Signer, Keyring, MlDsaSigner};
+
+pub fn load_or_generate_host_keys(
+    path: &str,
+) -> Result<(u64, Keyring), Box<dyn std::error::Error>> {
+    if let Ok(data) = fs::read_to_string(path) {
+        let json: serde_json::Value = serde_json::from_str(&data)?;
+        let hid = json["host_id"].as_u64().unwrap_or(1);
+        let keyring = Keyring::from_bytes(&hex::decode(json["keyring"].as_str().unwrap())?)?;
+        println!("Loaded host keys (ID: {})", hid);
+        return Ok((hid, keyring));
+    }
+
+    let (_ed_signer, sig_sk, sig_pk) = Ed25519Signer::generate();
+    let (_pq_signer, sig_pq_sk, sig_pq_pk) = MlDsaSigner::generate();
+    let (kem_sk, kem_pk) = HybridKem::generate_keypair();
+    let keyring = Keyring::new(kem_pk, kem_sk, sig_pq_pk, sig_pq_sk, sig_pk, sig_sk);
+
+    let json = serde_json::json!({
+        "host_id": 1,
+        "keyring": hex::encode(keyring.to_bytes()),
+    });
+    fs::write(path, serde_json::to_string_pretty(&json)?)?;
+    println!("Generated host keys -> {path}");
+    Ok((1u64, keyring))
+}
+
+pub fn export_host_public_keys(host_keyring: &Keyring) -> Result<(), Box<dyn std::error::Error>> {
+    let public_key_bundle_hex = hex::encode(host_keyring.public_key_bundle().as_bytes());
+
+    fs::write("host_public_key_bundle.hex", &public_key_bundle_hex)?;
+    fs::create_dir_all("web-client/public")?;
+    fs::write(
+        "web-client/public/host_public_key_bundle.hex",
+        &public_key_bundle_hex,
+    )?;
+    fs::write(
+        "host_enc_kem_pk.bin",
+        host_keyring.kem_public_key.as_bytes(),
+    )?;
+    fs::write("host_sig_pk.bin", host_keyring.sig_cl_public_key.as_bytes())?;
+    fs::write(
+        "host_sig_pq_pk.bin",
+        host_keyring.sig_pq_public_key.as_bytes(),
+    )?;
+    Ok(())
+}

example/server/src/main.rs

@@ -0,0 +1,125 @@
+mod clients;
+mod handlers;
+mod keys;
+mod tls;
+
+use mtp::host::{HostConfig, MTPHost};
+use mtp::type_map::TypeMap;
+use std::path::Path;
+
+fn dev_cert_paths() -> (String, String) {
+    let cert = std::env::var("MTP_DEV_CERT").unwrap_or_else(|_| {
+        if Path::new("example/dev-cert/cert.pem").exists() {
+            "example/dev-cert/cert.pem".to_string()
+        } else {
+            "dev-cert/cert.pem".to_string()
+        }
+    });
+    let key = std::env::var("MTP_DEV_KEY").unwrap_or_else(|_| {
+        if Path::new("example/dev-cert/key.pem").exists() {
+            "example/dev-cert/key.pem".to_string()
+        } else {
+            "dev-cert/key.pem".to_string()
+        }
+    });
+    (cert, key)
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let (cert_path, key_path) = dev_cert_paths();
+    let (cert_pem, key_pem) = tls::load_or_generate_tls(&cert_path, &key_path)?;
+    let cert_hash = tls::certificate_sha256_hex(&cert_pem)?;
+    tls::export_webtransport_cert_hash(&cert_hash)?;
+    println!("WebTransport certificate sha256: {cert_hash}");
+
+    let (host_id, host_keyring) = keys::load_or_generate_host_keys("host_keys.json")?;
+    keys::export_host_public_keys(&host_keyring)?;
+
+    // The keyring is moved into the host config; keep a copy for decrypting the
+    // demo payloads clients encrypt to our KEM public key.
+    let decrypt_keyring = mtp::crypto::Keyring::from_bytes(&host_keyring.to_bytes())
+        .expect("re-load host keyring for decryption");
+
+    let (clients, next_id) = clients::load_client_db("clients.json")?;
+
+    let clients_for_get = clients.clone();
+    let get_existing_user = Box::new(move |id: u64| -> Option<mtp::crypto::PublicKeyBundle> {
+        let result = clients_for_get.lock().unwrap().get(&id).cloned();
+        if result.is_some() {
+            println!("Auth lookup: client ID {id} found");
+        } else {
+            eprintln!("Auth lookup: unknown client ID {id}");
+        }
+        result
+    });
+
+    let clients_for_register = clients.clone();
+    let next_id_for_register = next_id.clone();
+    let clients_path = "clients.json".to_string();
+    let complete_register = Box::new(move |bundle: mtp::crypto::PublicKeyBundle| -> u64 {
+        let mut db = clients_for_register.lock().unwrap();
+        let mut nid = next_id_for_register.lock().unwrap();
+        let id = *nid;
+        *nid += 1;
+        db.insert(id, bundle);
+        match serde_json::to_string_pretty(&*db) {
+            Ok(json) => match std::fs::write(&clients_path, json) {
+                Ok(()) => {}
+                Err(e) => eprintln!("Failed to persist client database to {clients_path}: {e}"),
+            },
+            Err(e) => eprintln!("Failed to serialize client database after registering {id}: {e}"),
+        }
+        println!("Registered new client with ID: {}", id);
+        id
+    });
+
+    println!("Starting MTP server on port 8080 ...");
+
+    let config = HostConfig {
+        ip: std::net::IpAddr::V4(std::net::Ipv4Addr::UNSPECIFIED),
+        port: 8080,
+        tls_fullchain: cert_pem,
+        tls_key: key_pem,
+        require_authentication: true,
+        host_id,
+        host_keyring,
+        get_existing_user,
+        complete_register,
+    };
+
+    let mut host = MTPHost::new(config).await?;
+    println!("Server listening on {}", host.local_addr());
+
+    while let Some(conn) = host.accept().await {
+        println!(
+            "\n--- New authenticated connection (version {}) ---",
+            conn.version
+        );
+        println!("Client ID: {}", conn.client_id);
+
+        let tm: &TypeMap = conn.codec.registry().get(&conn.version).unwrap();
+
+        match conn.receiver.receive().await {
+            Ok(msg) => {
+                println!("Received: {msg}");
+                let response = handlers::process_and_respond(
+                    &msg,
+                    tm,
+                    conn.client_public_key.as_ref(),
+                    &decrypt_keyring,
+                );
+                println!("Sending: {response}");
+                conn.sender.send(&response).await?;
+            }
+            Err(e) => {
+                eprintln!("Receive error: {e}");
+            }
+        }
+
+        conn.sender.close();
+        println!("Connection closed\n");
+    }
+
+    Ok(())
+}

example/server/src/tls.rs

@@ -0,0 +1,70 @@
+use std::fs;
+use std::path::Path;
+
+use base64::Engine;
+
+pub fn load_or_generate_tls(
+    cert_path: &str,
+    key_path: &str,
+) -> Result<(Vec<u8>, Vec<u8>), Box<dyn std::error::Error>> {
+    if let (Ok(c), Ok(k)) = (fs::read(cert_path), fs::read(key_path)) {
+        println!("Using existing TLS cert from {cert_path}");
+        return Ok((c, k));
+    }
+
+    println!("Generating self-signed TLS certificate ...");
+    if let Some(parent) = Path::new(cert_path).parent() {
+        fs::create_dir_all(parent)?;
+    }
+    if let Some(parent) = Path::new(key_path).parent() {
+        fs::create_dir_all(parent)?;
+    }
+    let key_pair = rcgen::KeyPair::generate()?;
+    let params = rcgen::CertificateParams::new(vec!["localhost".into(), "127.0.0.1".into()])?;
+    let cert = params.self_signed(&key_pair)?;
+
+    let cert_str = cert.pem();
+    let key_str = key_pair.serialize_pem();
+
+    fs::write(cert_path, cert_str.as_bytes())?;
+    fs::write(key_path, key_str.as_bytes())?;
+    println!("Wrote {cert_path} and {key_path}");
+
+    Ok((cert_str.into_bytes(), key_str.into_bytes()))
+}
+
+pub fn certificate_sha256_hex(cert: &[u8]) -> Result<String, Box<dyn std::error::Error>> {
+    let der = if cert.starts_with(b"-----BEGIN CERTIFICATE-----") {
+        let pem = std::str::from_utf8(cert)?;
+        let base64 = pem
+            .lines()
+            .filter(|line| !line.starts_with("-----"))
+            .collect::<String>();
+        base64::engine::general_purpose::STANDARD.decode(base64)?
+    } else {
+        cert.to_vec()
+    };
+
+    Ok(hex::encode(mtp::crypto::sha256(&der)))
+}
+
+pub fn export_webtransport_cert_hash(hash: &str) -> Result<(), Box<dyn std::error::Error>> {
+    let public_dir = if Path::new("web-client").exists() {
+        Path::new("web-client/public")
+    } else {
+        Path::new("example/web-client/public")
+    };
+    fs::create_dir_all(public_dir)?;
+    fs::write(public_dir.join("mtp_dev_cert_hash.txt"), hash)?;
+
+    let dev_cert_dir = if Path::new("dev-cert").exists() {
+        Path::new("dev-cert")
+    } else {
+        Path::new("example/dev-cert")
+    };
+    if dev_cert_dir.exists() {
+        fs::write(dev_cert_dir.join("sha256.txt"), hash)?;
+    }
+
+    Ok(())
+}

example/type-maps.yaml

@@ -0,0 +1,28 @@
+protocol_version: "1.0"
+
+type_maps:
+  "0.0":
+    CommunicationTypes:
+    DataTypes:
+  "1.0":
+    CommunicationTypes:
+    DataTypes:
+      Data: 32
+      Flags: 33
+      Value: 34
+      BinaryData: 35
+      Items: 36
+      EncryptedPayload: 37
+      SignedPayload: 38
+      SecurePayload: 39
+  "2.0":
+    CommunicationTypes:
+    DataTypes:
+      Data: 34
+      Flags: 33
+      Value: 35
+      BinaryData: 36
+      Items: 37
+      EncryptedPayload: 38
+      SignedPayload: 39
+      SecurePayload: 40

example/web-client/.gitignore

@@ -0,0 +1 @@
+dist

example/web-client/bun.lock

@@ -0,0 +1,130 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "mtp-web-client",
+      "devDependencies": {
+        "typescript": "^5.4.0",
+        "vite": "^5.4.0",
+      },
+    },
+  },
+  "packages": {
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.21.5", "", { "os": "aix", "cpu": "ppc64" }, "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ=="],
+
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.21.5", "", { "os": "android", "cpu": "arm" }, "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg=="],
+
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.21.5", "", { "os": "android", "cpu": "arm64" }, "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A=="],
+
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.21.5", "", { "os": "android", "cpu": "x64" }, "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA=="],
+
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.21.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ=="],
+
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.21.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw=="],
+
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.21.5", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g=="],
+
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.21.5", "", { "os": "freebsd", "cpu": "x64" }, "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ=="],
+
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.21.5", "", { "os": "linux", "cpu": "arm" }, "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA=="],
+
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.21.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q=="],
+
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.21.5", "", { "os": "linux", "cpu": "ia32" }, "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg=="],
+
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg=="],
+
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg=="],
+
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.21.5", "", { "os": "linux", "cpu": "ppc64" }, "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w=="],
+
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA=="],
+
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.21.5", "", { "os": "linux", "cpu": "s390x" }, "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A=="],
+
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.21.5", "", { "os": "linux", "cpu": "x64" }, "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ=="],
+
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.21.5", "", { "os": "none", "cpu": "x64" }, "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg=="],
+
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.21.5", "", { "os": "openbsd", "cpu": "x64" }, "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow=="],
+
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.21.5", "", { "os": "sunos", "cpu": "x64" }, "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg=="],
+
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.21.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A=="],
+
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.21.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA=="],
+
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.21.5", "", { "os": "win32", "cpu": "x64" }, "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw=="],
+
+    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.62.2", "", { "os": "android", "cpu": "arm" }, "sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg=="],
+
+    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.62.2", "", { "os": "android", "cpu": "arm64" }, "sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw=="],
+
+    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.62.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A=="],
+
+    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.62.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA=="],
+
+    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.62.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw=="],
+
+    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.62.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg=="],
+
+    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.62.2", "", { "os": "linux", "cpu": "arm" }, "sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg=="],
+
+    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.62.2", "", { "os": "linux", "cpu": "arm" }, "sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA=="],
+
+    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.62.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA=="],
+
+    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.62.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ=="],
+
+    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg=="],
+
+    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ=="],
+
+    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.62.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A=="],
+
+    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.62.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w=="],
+
+    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg=="],
+
+    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q=="],
+
+    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.62.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg=="],
+
+    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.62.2", "", { "os": "linux", "cpu": "x64" }, "sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A=="],
+
+    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.62.2", "", { "os": "linux", "cpu": "x64" }, "sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg=="],
+
+    "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.62.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg=="],
+
+    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.62.2", "", { "os": "none", "cpu": "arm64" }, "sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA=="],
+
+    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.62.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg=="],
+
+    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.62.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q=="],
+
+    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.62.2", "", { "os": "win32", "cpu": "x64" }, "sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg=="],
+
+    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.62.2", "", { "os": "win32", "cpu": "x64" }, "sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA=="],
+
+    "@types/estree": ["@types/estree@1.0.9", "", {}, "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg=="],
+
+    "esbuild": ["esbuild@0.21.5", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.21.5", "@esbuild/android-arm": "0.21.5", "@esbuild/android-arm64": "0.21.5", "@esbuild/android-x64": "0.21.5", "@esbuild/darwin-arm64": "0.21.5", "@esbuild/darwin-x64": "0.21.5", "@esbuild/freebsd-arm64": "0.21.5", "@esbuild/freebsd-x64": "0.21.5", "@esbuild/linux-arm": "0.21.5", "@esbuild/linux-arm64": "0.21.5", "@esbuild/linux-ia32": "0.21.5", "@esbuild/linux-loong64": "0.21.5", "@esbuild/linux-mips64el": "0.21.5", "@esbuild/linux-ppc64": "0.21.5", "@esbuild/linux-riscv64": "0.21.5", "@esbuild/linux-s390x": "0.21.5", "@esbuild/linux-x64": "0.21.5", "@esbuild/netbsd-x64": "0.21.5", "@esbuild/openbsd-x64": "0.21.5", "@esbuild/sunos-x64": "0.21.5", "@esbuild/win32-arm64": "0.21.5", "@esbuild/win32-ia32": "0.21.5", "@esbuild/win32-x64": "0.21.5" }, "bin": "bin/esbuild" }, "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw=="],
+
+    "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
+
+    "nanoid": ["nanoid@3.3.15", "", { "bin": "bin/nanoid.cjs" }, "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA=="],
+
+    "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
+
+    "postcss": ["postcss@8.5.15", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A=="],
+
+    "rollup": ["rollup@4.62.2", "", { "dependencies": { "@types/estree": "1.0.9" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.62.2", "@rollup/rollup-android-arm64": "4.62.2", "@rollup/rollup-darwin-arm64": "4.62.2", "@rollup/rollup-darwin-x64": "4.62.2", "@rollup/rollup-freebsd-arm64": "4.62.2", "@rollup/rollup-freebsd-x64": "4.62.2", "@rollup/rollup-linux-arm-gnueabihf": "4.62.2", "@rollup/rollup-linux-arm-musleabihf": "4.62.2", "@rollup/rollup-linux-arm64-gnu": "4.62.2", "@rollup/rollup-linux-arm64-musl": "4.62.2", "@rollup/rollup-linux-loong64-gnu": "4.62.2", "@rollup/rollup-linux-loong64-musl": "4.62.2", "@rollup/rollup-linux-ppc64-gnu": "4.62.2", "@rollup/rollup-linux-ppc64-musl": "4.62.2", "@rollup/rollup-linux-riscv64-gnu": "4.62.2", "@rollup/rollup-linux-riscv64-musl": "4.62.2", "@rollup/rollup-linux-s390x-gnu": "4.62.2", "@rollup/rollup-linux-x64-gnu": "4.62.2", "@rollup/rollup-linux-x64-musl": "4.62.2", "@rollup/rollup-openbsd-x64": "4.62.2", "@rollup/rollup-openharmony-arm64": "4.62.2", "@rollup/rollup-win32-arm64-msvc": "4.62.2", "@rollup/rollup-win32-ia32-msvc": "4.62.2", "@rollup/rollup-win32-x64-gnu": "4.62.2", "@rollup/rollup-win32-x64-msvc": "4.62.2", "fsevents": "~2.3.2" }, "bin": "dist/bin/rollup" }, "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA=="],
+
+    "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
+
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "vite": ["vite@5.4.21", "", { "dependencies": { "esbuild": "^0.21.3", "postcss": "^8.4.43", "rollup": "^4.20.0" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || >=20.0.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.4.0" }, "optionalPeers": ["@types/node", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser"], "bin": "bin/vite.js" }, "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw=="],
+  }
+}

example/web-client/index.html

@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>MTP Web Client</title>
+  <style>
+    body { background: #111; color: #eee; font-family: "Public Sans", sans-serif; }
+    label, input, textarea { display: block; margin-bottom: 0.5rem; }
+    input, textarea, button { font-family: "Public Sans", sans-serif; }
+    input, textarea { background: #222; color: #eee; }
+    #status, #key-status { white-space: pre-wrap; }
+    .state { color: #ff0; }
+    .received { color: #0ff; }
+    .error { color: #f00; }
+  </style>
+</head>
+<body>
+  <h1>MTP WebTransport Client</h1>
+  <label for="server-url">Server URL</label>
+  <input id="server-url" value="https://127.0.0.1:8080" />
+
+  <label for="host-public-key">Host public key bundle hex</label>
+  <textarea id="host-public-key" placeholder="Paste PublicKeyBundle bytes as hex"></textarea>
+
+  <label for="client-public-key">Generated client public key bundle hex</label>
+  <textarea id="client-public-key" readonly></textarea>
+
+  <div>
+    <button id="generate-keypair" type="button">Generate keypair</button>
+    <button id="connect" type="button" disabled>Connect</button>
+    <button id="clear-keys" type="button">Clear saved keys</button>
+  </div>
+
+  <div id="key-status">Initializing...</div>
+  <div id="status"></div>
+  <script type="module" src="/src/main.ts"></script>
+</body>
+</html>

example/web-client/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "mtp-web-client",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build",
+    "preview": "vite preview"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.0",
+    "vite": "^5.4.0"
+  }
+}

example/web-client/src/main.ts

@@ -0,0 +1,271 @@
+import init, {
+  WasmClient,
+  ConnectionConfig,
+  ConnectionState,
+  WasmKeyring,
+  ed25519_generate,
+  keyring_from_ed25519,
+  build_demo_message,
+  format_frame,
+} from "mtp-wasm";
+
+const STATUS = document.getElementById("status")!;
+const KEY_STATUS = document.getElementById("key-status")!;
+const SERVER_URL = document.getElementById("server-url") as HTMLInputElement;
+const HOST_PUBLIC_KEY = document.getElementById("host-public-key") as HTMLTextAreaElement;
+const CLIENT_PUBLIC_KEY = document.getElementById("client-public-key") as HTMLTextAreaElement;
+const GENERATE_KEYPAIR = document.getElementById("generate-keypair") as HTMLButtonElement;
+const CONNECT = document.getElementById("connect") as HTMLButtonElement;
+const CLEAR_KEYS = document.getElementById("clear-keys") as HTMLButtonElement;
+
+const STORAGE_KEY = "mtp-web-client-keys";
+
+type SavedKeys = {
+  clientId: string | null;
+  keyring: number[];
+  hostPublicKey?: number[];
+};
+
+let keyringBytes: Uint8Array | null = null;
+let clientId: bigint | null = null;
+let devCertHash = "";
+
+function log(msg: string, cls = "") {
+  const line = document.createElement("div");
+  line.textContent = msg;
+  if (cls) line.className = cls;
+  STATUS.appendChild(line);
+}
+
+function setKeyStatus(msg: string) {
+  KEY_STATUS.textContent = msg;
+}
+
+function bytesToHex(bytes: Uint8Array): string {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function hexToBytes(value: string): Uint8Array {
+  const hex = value.replace(/[^0-9a-fA-F]/g, "");
+  if (hex.length === 0) throw new Error("host public key is required");
+  if (hex.length % 2 !== 0) throw new Error("host public key hex has an odd length");
+
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+function saveKeys() {
+  if (!keyringBytes) {
+    return;
+  }
+
+  let hostPublicKey: number[] | undefined;
+  try {
+    hostPublicKey = Array.from(hexToBytes(HOST_PUBLIC_KEY.value));
+  } catch {
+    hostPublicKey = undefined;
+  }
+
+  const data: SavedKeys = {
+    clientId: clientId?.toString() ?? null,
+    keyring: Array.from(keyringBytes),
+    hostPublicKey,
+  };
+  localStorage.setItem(STORAGE_KEY, JSON.stringify(data));
+}
+
+function loadKeys() {
+  const raw = localStorage.getItem(STORAGE_KEY);
+  if (!raw) {
+    setKeyStatus("No client keypair generated yet.");
+    return;
+  }
+
+  const data = JSON.parse(raw) as SavedKeys;
+  keyringBytes = new Uint8Array(data.keyring);
+  clientId = data.clientId ? BigInt(data.clientId) : null;
+  CLIENT_PUBLIC_KEY.value = publicKeyHexFromKeyring(keyringBytes);
+  if (data.hostPublicKey) {
+    HOST_PUBLIC_KEY.value = bytesToHex(new Uint8Array(data.hostPublicKey));
+  }
+
+  setKeyStatus(
+    clientId
+      ? `Loaded saved client keypair for client ${clientId}.`
+      : "Loaded generated client keypair. Not registered yet.",
+  );
+}
+
+async function loadHostPublicKey() {
+  try {
+    const response = await fetch("/host_public_key_bundle.hex", { cache: "no-store" });
+    if (!response.ok) return;
+
+    const hostPublicKey = (await response.text()).trim();
+    if (!hostPublicKey) return;
+
+    HOST_PUBLIC_KEY.value = hostPublicKey;
+    saveKeys();
+    log(`Loaded host public key bundle (${hostPublicKey.length / 2} bytes).`);
+  } catch {
+    // Manual paste still works when the server has not exported the file yet.
+  }
+}
+
+async function loadDevCertHash() {
+  try {
+    const response = await fetch("/mtp_dev_cert_hash.txt", { cache: "no-store" });
+    if (!response.ok) return;
+
+    devCertHash = (await response.text()).trim();
+    if (devCertHash) {
+      log(`Loaded WebTransport certificate hash: ${devCertHash}`);
+    }
+  } catch {
+    devCertHash = "";
+  }
+}
+
+async function initWasm() {
+  log("Loading WASM module...");
+  await init();
+  log(`WASM loaded. WebTransport supported: ${WasmClient.is_supported()}`);
+  CONNECT.disabled = !WasmClient.is_supported();
+}
+
+function createClient(): WasmClient {
+  return new WasmClient(
+    (state: number) =>
+      log(`[state] ${ConnectionState[state] ?? state}`, "state"),
+    (data: Uint8Array) => {
+      try {
+        log(`Received: ${format_frame(data)}`, "received");
+      } catch (e) {
+        log(`[message parse error] ${e}`, "error");
+      }
+    },
+    (err: any) => log(`[error] ${err}`, "error"),
+  );
+}
+
+function generateKeyringBytes(): Uint8Array {
+  const gen = ed25519_generate();
+  const sk = gen.secretKey as Uint8Array;
+  const pk = gen.publicKey as Uint8Array;
+  gen.signer.free();
+  return keyring_from_ed25519(sk, pk);
+}
+
+function publicKeyHexFromKeyring(bytes: Uint8Array): string {
+  const keyring = WasmKeyring.from_bytes(bytes);
+  const publicBundle = keyring.public_key_bundle();
+  const publicHex = bytesToHex(publicBundle.to_bytes());
+  publicBundle.free();
+  keyring.free();
+  return publicHex;
+}
+
+async function connect() {
+  STATUS.textContent = "";
+
+  if (!WasmClient.is_supported()) {
+    log("WebTransport is not supported in this browser.", "error");
+    return;
+  }
+  if (!keyringBytes) {
+    log("Generate a client keypair first.", "error");
+    return;
+  }
+
+  const hostPk = hexToBytes(HOST_PUBLIC_KEY.value);
+  await loadDevCertHash();
+
+  const client = createClient();
+  const serverUrl = SERVER_URL.value.trim();
+  const config = new ConnectionConfig(serverUrl);
+  if (devCertHash) {
+    log(`Pinning WebTransport certificate hash: sha-256:${devCertHash}`);
+    config.server_certificate_hashes = [`sha-256:${devCertHash}`];
+  } else {
+    log("No WebTransport certificate hash loaded; relying on browser trust store.", "state");
+  }
+
+  try {
+    let activeClientId: bigint;
+    if (clientId !== null) {
+      log(`Using saved client ID ${clientId}...`);
+      activeClientId = await client.auth_connect(
+        config,
+        hostPk,
+        keyringBytes,
+        clientId,
+      );
+      log(`Authenticated as client ${activeClientId}`);
+    } else {
+      log("Registering generated client keypair...");
+      activeClientId = await client.auth_register(config, hostPk, keyringBytes);
+      clientId = activeClientId;
+      saveKeys();
+      log(`Registered with ID: ${activeClientId}`);
+    }
+
+    log("\nSending demo message...");
+    const frame = build_demo_message(activeClientId, keyringBytes, hostPk);
+    log(`Sending: ${format_frame(frame)}`, "state");
+    await client.send(frame);
+    log(`Sent ${frame.length} bytes`);
+
+    log("\nClient running. Waiting for incoming messages...");
+  } finally {
+    config.free();
+  }
+}
+
+GENERATE_KEYPAIR.addEventListener("click", () => {
+  try {
+    keyringBytes = generateKeyringBytes();
+    clientId = null;
+    saveKeys();
+    CLIENT_PUBLIC_KEY.value = publicKeyHexFromKeyring(keyringBytes);
+    setKeyStatus("Generated client keypair. Not registered yet.");
+    log("Generated and saved a new client keypair.");
+  } catch (e) {
+    log(`Key generation failed: ${e}`, "error");
+    console.error(e);
+  }
+});
+
+CONNECT.addEventListener("click", () => {
+  connect().catch((e) => {
+    log(`Fatal error: ${e}`, "error");
+    log(
+      `[fatal context] clientId=${clientId?.toString() ?? "unregistered"}, server=${SERVER_URL.value.trim()}, hostPkChars=${HOST_PUBLIC_KEY.value.replace(/[^0-9a-fA-F]/g, "").length}, keyringBytes=${keyringBytes?.length ?? 0}, certHash=${devCertHash || "none"}`,
+      "error",
+    );
+    console.error(e);
+  });
+});
+
+CLEAR_KEYS.addEventListener("click", () => {
+  keyringBytes = null;
+  clientId = null;
+  CLIENT_PUBLIC_KEY.value = "";
+  localStorage.removeItem(STORAGE_KEY);
+  setKeyStatus("No client keypair generated yet.");
+  log("Cleared saved client keys.");
+});
+
+HOST_PUBLIC_KEY.addEventListener("change", saveKeys);
+
+initWasm()
+  .then(() => {
+    loadKeys();
+    return Promise.all([loadHostPublicKey(), loadDevCertHash()]);
+  })
+  .catch((e) => {
+    log(`Fatal error: ${e}`, "error");
+    console.error(e);
+  });

example/web-client/src/messages.ts

@@ -0,0 +1,30 @@
+import { build_demo_message, build_ping_frame, parse_auth_response } from 'mtp-wasm';
+
+export function buildAuthResponse(
+  response: Uint8Array,
+): {
+  connected: boolean;
+  clientNonce: Uint8Array;
+  assignedId: bigint;
+  timestamp: bigint;
+  signature: Uint8Array;
+} {
+  return parse_auth_response(response);
+}
+
+export function buildDemoMessage(
+  clientId: bigint,
+  keyringBytes: Uint8Array,
+  hostBundle: Uint8Array,
+): Uint8Array {
+  return build_demo_message(clientId, keyringBytes, hostBundle);
+}
+
+export function buildPingFrame(
+  clientId: bigint,
+  description: string,
+  timestamp: bigint,
+  data?: Uint8Array,
+): Uint8Array {
+  return build_ping_frame(clientId, description, timestamp, data ?? new Uint8Array());
+}

example/web-client/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noEmit": true,
+    "isolatedModules": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "paths": {
+      "mtp-wasm": ["../../wasm/pkg"]
+    },
+    "rootDir": "../.."
+  },
+  "include": ["src", "../../wasm/pkg"]
+}

example/web-client/vite.config.ts

@@ -0,0 +1,28 @@
+import { defineConfig } from 'vite';
+import fs from 'fs';
+import path from 'path';
+
+const devCertDir = path.resolve(__dirname, '../dev-cert');
+const certPath = process.env.MTP_DEV_CERT ?? path.join(devCertDir, 'cert.pem');
+const keyPath = process.env.MTP_DEV_KEY ?? path.join(devCertDir, 'key.pem');
+
+const hasDevCert = fs.existsSync(certPath) && fs.existsSync(keyPath);
+
+export default defineConfig({
+  resolve: {
+    alias: {
+      'mtp-wasm': path.resolve(__dirname, '../../wasm/pkg'),
+    },
+  },
+  server: {
+    https: hasDevCert
+      ? {
+          cert: fs.readFileSync(certPath),
+          key: fs.readFileSync(keyPath),
+        }
+      : undefined,
+    fs: {
+      allow: ['.', path.resolve(__dirname, '../../wasm/pkg')],
+    },
+  },
+});