(feat): add max message size to wasm

(feat): add pq key generation to wasm
(qol): update gitignores

wasm/pkg/mtp_wasm.d.ts

@@ -1,318 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-
-export interface ParsedFrame {
-    id?: number;
-    type: string;
-    sender?: bigint;
-    receiver?: bigint;
-    data: Record<string, unknown>;
-    raw: Uint8Array;
-}
-
-
-
-export class ConnectionConfig {
-    free(): void;
-    [Symbol.dispose](): void;
-    constructor(url: string);
-    client_id: bigint;
-    set server_certificate_hashes(value: string[]);
-    readonly url: string;
-}
-
-export enum ConnectionState {
-    Disconnected = 0,
-    Connecting = 1,
-    Connected = 2,
-    Failed = 3,
-}
-
-export class WasmChaCha20Poly1305 {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Decrypt `nonce || ciphertext` with `aad`.
-     */
-    decrypt(ciphertext: Uint8Array, aad: Uint8Array): Uint8Array;
-    /**
-     * Encrypt `plaintext` with `aad`.
-     * Returns `nonce || ciphertext`.
-     */
-    encrypt(plaintext: Uint8Array, aad: Uint8Array): Uint8Array;
-    /**
-     * Create a new cipher with a 32-byte key.
-     */
-    constructor(key: Uint8Array);
-}
-
-export class WasmClient {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Authenticated login with an existing client ID.
-     * Exchanges Identification + signatures and verifies the host response.
-     *
-     * - `host_public_key_bytes`: serialized PublicKeyBundle from the server
-     * - `keyring_bytes`: serialized Keyring of this client (must match `client_id`)
-     * - `client_id`: previously assigned client ID
-     *
-     * Returns the confirmed (same) client ID on success.
-     */
-    auth_connect(config: ConnectionConfig, host_public_key_bytes: Uint8Array, keyring_bytes: Uint8Array, client_id: bigint): Promise<bigint>;
-    /**
-     * Authenticated registration with a fresh keyring.
-     * The server assigns a new client ID.
-     *
-     * - `host_public_key_bytes`: serialized PublicKeyBundle from the server
-     * - `keyring_bytes`: serialized Keyring (must include ed25519 secret key)
-     *
-     * Returns the newly assigned client ID.
-     */
-    auth_register(config: ConnectionConfig, host_public_key_bytes: Uint8Array, keyring_bytes: Uint8Array): Promise<bigint>;
-    /**
-     * Unauthenticated connect (sends basic Identification, enables receive loop).
-     */
-    connect(config: ConnectionConfig): Promise<void>;
-    disconnect(): void;
-    static is_supported(): boolean;
-    constructor(on_state_change: Function, on_message: Function, on_error: Function);
-    request(frame: Uint8Array, response_type?: string | null): Promise<any>;
-    send(frame: Uint8Array): Promise<void>;
-    start_protocol_pings(interval_ms: number, client_id: bigint): void;
-    stop_protocol_pings(): void;
-    subscribe(message_type: string, callback: Function): number;
-    unsubscribe(id: number): boolean;
-    readonly state: number;
-}
-
-export class WasmEd25519Signer {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Load a signer from its 32-byte secret key.
-     */
-    constructor(secret_key: Uint8Array);
-    /**
-     * Sign `message` and return the signature bytes.
-     */
-    sign(message: Uint8Array): Uint8Array;
-    /**
-     * Verify `signature` against `message`.
-     */
-    verify(message: Uint8Array, signature: Uint8Array): void;
-}
-
-export class WasmKeyring {
-    private constructor();
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Deserialise a keyring from bytes.
-     */
-    static from_bytes(bytes: Uint8Array): WasmKeyring;
-    /**
-     * Return the public half of this keyring as a bundle.
-     */
-    public_key_bundle(): WasmPublicKeyBundle;
-    /**
-     * Serialise the keyring to bytes.
-     */
-    to_bytes(): Uint8Array;
-}
-
-/**
- * Log severity used by the public SDK when translating raw WASM events.
- */
-export enum WasmLogHint {
-    Info = 0,
-    Warning = 1,
-    Error = 2,
-}
-
-export class WasmPublicKeyBundle {
-    private constructor();
-    free(): void;
-    [Symbol.dispose](): void;
-    static from_bytes(bytes: Uint8Array): WasmPublicKeyBundle;
-    to_bytes(): Uint8Array;
-    readonly kem_public_key: Uint8Array;
-    readonly sig_cl_public_key: Uint8Array;
-    readonly sig_pq_public_key: Uint8Array;
-}
-
-/**
- * Minimal message router used by higher-level SDK subscription code.
- */
-export class WasmSubscriptionRouter {
-    free(): void;
-    [Symbol.dispose](): void;
-    dispatch(message_type: string, message: any): boolean;
-    constructor();
-    subscribe(message_type: string, callback: Function): void;
-    unsubscribe(message_type: string): boolean;
-}
-
-/**
- * Build a typed MTP frame using generated communication/data type names.
- */
-export function build_frame(message_type: string, data: any, options: any): Uint8Array;
-
-/**
- * Build a protocol-level Ping frame with description, timestamp, and optional data.
- */
-export function build_ping_frame(client_id: bigint, description: string, timestamp: bigint, data: Uint8Array): Uint8Array;
-
-/**
- * Generate a fresh Ed25519 keypair.
- *
- * Returns `{ signer: WasmEd25519Signer, secretKey: Uint8Array, publicKey: Uint8Array }`.
- */
-export function ed25519_generate(): any;
-
-/**
- * Standalone Ed25519 signature verification.
- */
-export function ed25519_verify(public_key: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
-
-/**
- * Parse any MTP frame into the human-readable CommunicationValue display form.
- */
-export function format_frame(frame: Uint8Array): string;
-
-/**
- * Build a [`Keyring`] containing only an Ed25519 keypair (no KEM, no ML-DSA).
- *
- * Takes the Ed25519 secret key and public key, each 32 bytes.
- * Returns the serialised keyring bytes, suitable for passing to `WasmClient.auth_register`.
- */
-export function keyring_from_ed25519(secret_key: Uint8Array, public_key: Uint8Array): Uint8Array;
-
-export function main(): void;
-
-/**
- * Parse an auth response frame into a JS object.
- */
-export function parse_auth_response(response: Uint8Array): any;
-
-/**
- * Parse any MTP frame into structured JavaScript data.
- */
-export function parse_frame(frame: Uint8Array): ParsedFrame;
-
-/**
- * Derive a 32-byte encryption key from `ikm` with `salt` and `context`.
- */
-export function wasm_derive_encryption_key(ikm: Uint8Array, salt: Uint8Array, context: Uint8Array): Uint8Array;
-
-/**
- * HKDF-expand: derive `len` bytes from `ikm` with `salt` and `info`.
- */
-export function wasm_hkdf_expand(ikm: Uint8Array, salt: Uint8Array, info: Uint8Array, len: number): Uint8Array;
-
-/**
- * SHA-256 digest.
- */
-export function wasm_sha256(data: Uint8Array): Uint8Array;
-
-/**
- * Double SHA-256 (SHA-256 applied twice).
- */
-export function wasm_sha256_double(data: Uint8Array): Uint8Array;
-
-export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
-
-export interface InitOutput {
-    readonly memory: WebAssembly.Memory;
-    readonly build_frame: (a: number, b: number, c: any, d: any) => [number, number, number, number];
-    readonly build_ping_frame: (a: bigint, b: number, c: number, d: bigint, e: number, f: number) => [number, number, number, number];
-    readonly format_frame: (a: number, b: number) => [number, number, number, number];
-    readonly parse_auth_response: (a: number, b: number) => [number, number, number];
-    readonly parse_frame: (a: number, b: number) => [number, number, number];
-    readonly __wbg_wasmchacha20poly1305_free: (a: number, b: number) => void;
-    readonly __wbg_wasmed25519signer_free: (a: number, b: number) => void;
-    readonly __wbg_wasmkeyring_free: (a: number, b: number) => void;
-    readonly __wbg_wasmpublickeybundle_free: (a: number, b: number) => void;
-    readonly ed25519_generate: () => [number, number, number];
-    readonly ed25519_verify: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number];
-    readonly keyring_from_ed25519: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-    readonly wasm_derive_encryption_key: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
-    readonly wasm_hkdf_expand: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => [number, number, number, number];
-    readonly wasm_sha256: (a: number, b: number) => [number, number];
-    readonly wasm_sha256_double: (a: number, b: number) => [number, number];
-    readonly wasmchacha20poly1305_decrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
-    readonly wasmchacha20poly1305_encrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
-    readonly wasmchacha20poly1305_new: (a: number, b: number) => [number, number, number];
-    readonly wasmed25519signer_new: (a: number, b: number) => [number, number, number];
-    readonly wasmed25519signer_sign: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly wasmed25519signer_verify: (a: number, b: number, c: number, d: number, e: number) => [number, number];
-    readonly wasmkeyring_from_bytes: (a: number, b: number) => [number, number, number];
-    readonly wasmkeyring_public_key_bundle: (a: number) => number;
-    readonly wasmkeyring_to_bytes: (a: number) => [number, number];
-    readonly wasmpublickeybundle_from_bytes: (a: number, b: number) => [number, number, number];
-    readonly wasmpublickeybundle_kem_public_key: (a: number) => [number, number];
-    readonly wasmpublickeybundle_sig_cl_public_key: (a: number) => [number, number];
-    readonly wasmpublickeybundle_sig_pq_public_key: (a: number) => [number, number];
-    readonly wasmpublickeybundle_to_bytes: (a: number) => [number, number];
-    readonly __wbg_wasmclient_free: (a: number, b: number) => void;
-    readonly wasmclient_auth_connect: (a: number, b: number, c: number, d: number, e: number, f: number, g: bigint) => any;
-    readonly wasmclient_auth_register: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
-    readonly wasmclient_connect: (a: number, b: number) => any;
-    readonly wasmclient_disconnect: (a: number) => void;
-    readonly wasmclient_is_supported: () => number;
-    readonly wasmclient_new: (a: any, b: any, c: any) => number;
-    readonly wasmclient_request: (a: number, b: number, c: number, d: number, e: number) => any;
-    readonly wasmclient_send: (a: number, b: number, c: number) => any;
-    readonly wasmclient_start_protocol_pings: (a: number, b: number, c: bigint) => [number, number];
-    readonly wasmclient_state: (a: number) => number;
-    readonly wasmclient_stop_protocol_pings: (a: number) => void;
-    readonly wasmclient_subscribe: (a: number, b: number, c: number, d: any) => number;
-    readonly wasmclient_unsubscribe: (a: number, b: number) => number;
-    readonly __wbg_wasmsubscriptionrouter_free: (a: number, b: number) => void;
-    readonly main: () => void;
-    readonly wasmsubscriptionrouter_dispatch: (a: number, b: number, c: number, d: any) => number;
-    readonly wasmsubscriptionrouter_new: () => number;
-    readonly wasmsubscriptionrouter_subscribe: (a: number, b: number, c: number, d: any) => void;
-    readonly wasmsubscriptionrouter_unsubscribe: (a: number, b: number, c: number) => number;
-    readonly __wbg_connectionconfig_free: (a: number, b: number) => void;
-    readonly connectionconfig_client_id: (a: number) => bigint;
-    readonly connectionconfig_new: (a: number, b: number) => number;
-    readonly connectionconfig_set_client_id: (a: number, b: bigint) => void;
-    readonly connectionconfig_set_server_certificate_hashes: (a: number, b: number, c: number) => void;
-    readonly connectionconfig_url: (a: number) => [number, number];
-    readonly wasm_bindgen__convert__closures_____invoke__h6588d25cdde23584: (a: number, b: number, c: any) => [number, number];
-    readonly wasm_bindgen__convert__closures_____invoke__h4bf2427f775cf424: (a: number, b: number, c: any, d: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__h3c511b580d027299: (a: number, b: number, c: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__h99ead69e8d7f5bae: (a: number, b: number) => void;
-    readonly __wbindgen_malloc: (a: number, b: number) => number;
-    readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
-    readonly __wbindgen_exn_store: (a: number) => void;
-    readonly __externref_table_alloc: () => number;
-    readonly __wbindgen_externrefs: WebAssembly.Table;
-    readonly __wbindgen_free: (a: number, b: number, c: number) => void;
-    readonly __wbindgen_destroy_closure: (a: number, b: number) => void;
-    readonly __externref_table_dealloc: (a: number) => void;
-    readonly __wbindgen_start: () => void;
-}
-
-export type SyncInitInput = BufferSource | WebAssembly.Module;
-
-/**
- * Instantiates the given `module`, which can either be bytes or
- * a precompiled `WebAssembly.Module`.
- *
- * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
- *
- * @returns {InitOutput}
- */
-export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
-
-/**
- * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
- * for everything else, calls `WebAssembly.instantiate` directly.
- *
- * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
- *
- * @returns {Promise<InitOutput>}
- */
-export default function __wbg_init (module_or_path?: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;

wasm/pkg/mtp_wasm_bg.wasm.d.ts

@@ -1,72 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-export const memory: WebAssembly.Memory;
-export const build_frame: (a: number, b: number, c: any, d: any) => [number, number, number, number];
-export const build_ping_frame: (a: bigint, b: number, c: number, d: bigint, e: number, f: number) => [number, number, number, number];
-export const format_frame: (a: number, b: number) => [number, number, number, number];
-export const parse_auth_response: (a: number, b: number) => [number, number, number];
-export const parse_frame: (a: number, b: number) => [number, number, number];
-export const __wbg_wasmchacha20poly1305_free: (a: number, b: number) => void;
-export const __wbg_wasmed25519signer_free: (a: number, b: number) => void;
-export const __wbg_wasmkeyring_free: (a: number, b: number) => void;
-export const __wbg_wasmpublickeybundle_free: (a: number, b: number) => void;
-export const ed25519_generate: () => [number, number, number];
-export const ed25519_verify: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number];
-export const keyring_from_ed25519: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-export const wasm_derive_encryption_key: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
-export const wasm_hkdf_expand: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => [number, number, number, number];
-export const wasm_sha256: (a: number, b: number) => [number, number];
-export const wasm_sha256_double: (a: number, b: number) => [number, number];
-export const wasmchacha20poly1305_decrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
-export const wasmchacha20poly1305_encrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
-export const wasmchacha20poly1305_new: (a: number, b: number) => [number, number, number];
-export const wasmed25519signer_new: (a: number, b: number) => [number, number, number];
-export const wasmed25519signer_sign: (a: number, b: number, c: number) => [number, number, number, number];
-export const wasmed25519signer_verify: (a: number, b: number, c: number, d: number, e: number) => [number, number];
-export const wasmkeyring_from_bytes: (a: number, b: number) => [number, number, number];
-export const wasmkeyring_public_key_bundle: (a: number) => number;
-export const wasmkeyring_to_bytes: (a: number) => [number, number];
-export const wasmpublickeybundle_from_bytes: (a: number, b: number) => [number, number, number];
-export const wasmpublickeybundle_kem_public_key: (a: number) => [number, number];
-export const wasmpublickeybundle_sig_cl_public_key: (a: number) => [number, number];
-export const wasmpublickeybundle_sig_pq_public_key: (a: number) => [number, number];
-export const wasmpublickeybundle_to_bytes: (a: number) => [number, number];
-export const __wbg_wasmclient_free: (a: number, b: number) => void;
-export const wasmclient_auth_connect: (a: number, b: number, c: number, d: number, e: number, f: number, g: bigint) => any;
-export const wasmclient_auth_register: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
-export const wasmclient_connect: (a: number, b: number) => any;
-export const wasmclient_disconnect: (a: number) => void;
-export const wasmclient_is_supported: () => number;
-export const wasmclient_new: (a: any, b: any, c: any) => number;
-export const wasmclient_request: (a: number, b: number, c: number, d: number, e: number) => any;
-export const wasmclient_send: (a: number, b: number, c: number) => any;
-export const wasmclient_start_protocol_pings: (a: number, b: number, c: bigint) => [number, number];
-export const wasmclient_state: (a: number) => number;
-export const wasmclient_stop_protocol_pings: (a: number) => void;
-export const wasmclient_subscribe: (a: number, b: number, c: number, d: any) => number;
-export const wasmclient_unsubscribe: (a: number, b: number) => number;
-export const __wbg_wasmsubscriptionrouter_free: (a: number, b: number) => void;
-export const main: () => void;
-export const wasmsubscriptionrouter_dispatch: (a: number, b: number, c: number, d: any) => number;
-export const wasmsubscriptionrouter_new: () => number;
-export const wasmsubscriptionrouter_subscribe: (a: number, b: number, c: number, d: any) => void;
-export const wasmsubscriptionrouter_unsubscribe: (a: number, b: number, c: number) => number;
-export const __wbg_connectionconfig_free: (a: number, b: number) => void;
-export const connectionconfig_client_id: (a: number) => bigint;
-export const connectionconfig_new: (a: number, b: number) => number;
-export const connectionconfig_set_client_id: (a: number, b: bigint) => void;
-export const connectionconfig_set_server_certificate_hashes: (a: number, b: number, c: number) => void;
-export const connectionconfig_url: (a: number) => [number, number];
-export const wasm_bindgen__convert__closures_____invoke__h6588d25cdde23584: (a: number, b: number, c: any) => [number, number];
-export const wasm_bindgen__convert__closures_____invoke__h4bf2427f775cf424: (a: number, b: number, c: any, d: any) => void;
-export const wasm_bindgen__convert__closures_____invoke__h3c511b580d027299: (a: number, b: number, c: any) => void;
-export const wasm_bindgen__convert__closures_____invoke__h99ead69e8d7f5bae: (a: number, b: number) => void;
-export const __wbindgen_malloc: (a: number, b: number) => number;
-export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
-export const __wbindgen_exn_store: (a: number) => void;
-export const __externref_table_alloc: () => number;
-export const __wbindgen_externrefs: WebAssembly.Table;
-export const __wbindgen_free: (a: number, b: number, c: number) => void;
-export const __wbindgen_destroy_closure: (a: number, b: number) => void;
-export const __externref_table_dealloc: (a: number) => void;
-export const __wbindgen_start: () => void;

wasm/pkg/package.json

@@ -1,15 +0,0 @@
-{
-  "name": "mtp-wasm",
-  "type": "module",
-  "version": "0.1.0",
-  "files": [
-    "mtp_wasm_bg.wasm",
-    "mtp_wasm.js",
-    "mtp_wasm.d.ts"
-  ],
-  "main": "mtp_wasm.js",
-  "types": "mtp_wasm.d.ts",
-  "sideEffects": [
-    "./snippets/*"
-  ]
-}

wasm/src/client.rs

@@ -71,21 +71,6 @@ fn route_incoming_frame(
         }
     }
 
-    if let Some(message_type) = message_type.as_ref() {
-        let matching_id = pending_requests
-            .borrow()
-            .iter()
-            .find_map(|(id, pending)| match pending.response_type.as_ref() {
-                Some(response_type) if response_type == message_type => Some(*id),
-                _ => None,
-            });
-        if let Some(id) = matching_id {
-            if let Some(pending) = pending_requests.borrow_mut().remove(&id) {
-                let _ = pending.sender.send(Ok(frame.clone()));
-            }
-        }
-    }
-
     let _ = on_message.call1(&JsValue::NULL, frame);
 
     let Some(message_type) = message_type else {
@@ -154,7 +139,7 @@ fn unexpected_response_type_error(
  */
 fn verify_host_challenge(
     challenge: &CommunicationValue,
-    tm: &mtp_codec::TypeMap,
+    _tm: &mtp_codec::TypeMap,
     host_pk: &mtp_crypto::PublicKeyBundle,
     id: u64,
     server_challenge: u128,
@@ -185,7 +170,7 @@ fn verify_host_challenge(
  */
 fn verify_host_final(
     resp: &CommunicationValue,
-    tm: &mtp_codec::TypeMap,
+    _tm: &mtp_codec::TypeMap,
     host_pk: &mtp_crypto::PublicKeyBundle,
     id: u64,
     client_nonce: u128,
@@ -230,12 +215,24 @@ fn signed_challenge_response_bytes(
         .sign(proof_payload)
         .map_err(|e| js_error(&format!("signature failed: {}", e)))?;
 
-    CommunicationValue::new(CommunicationType::ChallengeResponse)
+    let mut proof = CommunicationValue::new(CommunicationType::ChallengeResponse)
         .add_typed_default(
             DataType::ClientNonce,
             DataValue::UnsignedNumber(client_nonce),
         )
-        .add_typed_default(DataType::Signature, DataValue::Bytes(signature))
+        .add_typed_default(DataType::Signature, DataValue::Bytes(signature));
+
+    if !keyring.sig_pq_secret_key.as_bytes().is_empty() {
+        let pq_signer =
+            mtp_crypto::MlDsaSigner::new(&keyring.sig_pq_secret_key, &keyring.sig_pq_public_key)
+                .map_err(|e| js_error(&format!("PQ signer creation failed: {}", e)))?;
+        let pq_signature = pq_signer
+            .sign(proof_payload)
+            .map_err(|e| js_error(&format!("PQ signature failed: {}", e)))?;
+        proof = proof.add_typed_default(DataType::PqSignature, DataValue::Bytes(pq_signature));
+    }
+
+    proof
         .to_bytes()
         .map_err(|e| js_error(&format!("encode failed: {}", e)))
 }
@@ -297,8 +294,12 @@ impl WasmClient {
     #[wasm_bindgen]
     pub async fn connect(&mut self, config: &ConnectionConfig) -> Result<(), JsValue> {
         self.set_state(ConnectionState::Connecting);
-        let transport =
-            WasmTransport::connect(&config.url, config.server_certificate_hashes.clone()).await?;
+        let transport = WasmTransport::connect(
+            &config.url,
+            config.server_certificate_hashes.clone(),
+            config.max_message_size,
+        )
+        .await?;
 
         let version_str = format!("{}", PROTOCOL_VERSION);
         let ident = CommunicationValue::new(CommunicationType::Identification)
@@ -342,8 +343,12 @@ impl WasmClient {
         let tm = mtp_codec::TypeMap::latest();
         let version_str = format!("{}", PROTOCOL_VERSION);
 
-        let transport =
-            WasmTransport::connect(&config.url, config.server_certificate_hashes.clone()).await?;
+        let transport = WasmTransport::connect(
+            &config.url,
+            config.server_certificate_hashes.clone(),
+            config.max_message_size,
+        )
+        .await?;
 
         // 1. Send the unsigned Identification hello.
         let hello = CommunicationValue::new(CommunicationType::Identification)
@@ -450,8 +455,12 @@ impl WasmClient {
         let version_str = format!("{}", PROTOCOL_VERSION);
         let pk_bytes = keyring.public_key_bundle().as_bytes();
 
-        let transport =
-            WasmTransport::connect(&config.url, config.server_certificate_hashes.clone()).await?;
+        let transport = WasmTransport::connect(
+            &config.url,
+            config.server_certificate_hashes.clone(),
+            config.max_message_size,
+        )
+        .await?;
 
         // 1. Send the unsigned Register hello (version + public-key bundle).
         let hello = CommunicationValue::new(CommunicationType::Register)

wasm/src/config.rs

@@ -5,6 +5,7 @@ pub struct ConnectionConfig {
     pub(crate) url: String,
     pub(crate) server_certificate_hashes: Option<Vec<String>>,
     pub(crate) client_id: u64,
+    pub(crate) max_message_size: u32,
 }
 
 #[wasm_bindgen]
@@ -15,6 +16,7 @@ impl ConnectionConfig {
             url,
             server_certificate_hashes: None,
             client_id: 0,
+            max_message_size: 1_000_000_000,
         }
     }
 
@@ -37,4 +39,14 @@ impl ConnectionConfig {
     pub fn set_server_certificate_hashes(&mut self, hashes: Vec<String>) {
         self.server_certificate_hashes = Some(hashes);
     }
+
+    #[wasm_bindgen(setter)]
+    pub fn set_max_message_size(&mut self, max_message_size: u32) {
+        self.max_message_size = max_message_size;
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn max_message_size(&self) -> u32 {
+        self.max_message_size
+    }
 }

wasm/src/crypto.rs

@@ -42,6 +42,12 @@ impl WasmKeyring {
     }
 }
 
+/// Generate a full keyring with KEM, ML-DSA, and Ed25519 keys.
+#[wasm_bindgen]
+pub fn keyring_generate() -> Vec<u8> {
+    Keyring::generate().to_bytes()
+}
+
 /// Build a [`Keyring`] containing only an Ed25519 keypair (no KEM, no ML-DSA).
 ///
 /// Takes the Ed25519 secret key and public key, each 32 bytes.

wasm/src/frame.rs

@@ -253,10 +253,7 @@ pub fn parse_auth_response(response: &[u8]) -> Result<JsValue, JsValue> {
     let comm = CommunicationValue::from_bytes(response)
         .map_err(|e| js_error(&format!("parse failed: {}", e)))?;
 
-    let connected = matches!(
-        comm.get_data(DataType::Connected),
-        DataValue::BoolTrue
-    );
+    let connected = matches!(comm.get_data(DataType::Connected), DataValue::BoolTrue);
 
     let client_nonce = match comm.get_data(DataType::ClientNonce) {
         DataValue::UnsignedNumber(n) => Some(*n),

wasm/src/transport.rs

@@ -55,6 +55,7 @@ enum FrameOutcome {
 #[derive(Clone)]
 pub struct WasmTransport {
     inner: JsValue,
+    max_message_size: u32,
     /// Reader over `incoming_unidirectional_streams()` (a singleton stream of streams).
     streams_reader: Rc<RefCell<Option<JsValue>>>,
     /// Reader over the host's current uni-directional stream, if one is open.
@@ -64,7 +65,11 @@ pub struct WasmTransport {
 }
 
 impl WasmTransport {
-    pub async fn connect(url: &str, cert_hashes: Option<Vec<String>>) -> Result<Self, JsValue> {
+    pub async fn connect(
+        url: &str,
+        cert_hashes: Option<Vec<String>>,
+        max_message_size: u32,
+    ) -> Result<Self, JsValue> {
         let ctor = js_sys::Reflect::get(&js_sys::global(), &JsValue::from_str("WebTransport"))?
             .dyn_into::<js_sys::Function>()
             .map_err(|_| js_error("WebTransport not available"))?;
@@ -111,6 +116,7 @@ impl WasmTransport {
             .map_err(|e| js_error(&format!("WebTransport ready failed: {:?}", e)))?;
         Ok(Self {
             inner: transport,
+            max_message_size,
             streams_reader: Rc::new(RefCell::new(None)),
             stream_reader: Rc::new(RefCell::new(None)),
             buffer: Rc::new(RefCell::new(Vec::new())),
@@ -122,6 +128,12 @@ impl WasmTransport {
     }
 
     pub async fn send_frame(&self, frame: &[u8]) -> Result<(), JsValue> {
+        if frame.len() as u64 > self.max_message_size as u64
+            || frame.len() as u64 >= CLOSE_FRAME_LEN as u64
+        {
+            return Err(js_error("message too large"));
+        }
+
         let create_stream = js_sys::Reflect::get(
             &self.inner,
             &JsValue::from_str("createUnidirectionalStream"),
@@ -273,6 +285,9 @@ impl WasmTransport {
         if frame_len == CLOSE_FRAME_LEN {
             return Ok(Some(FrameOutcome::Closed));
         }
+        if frame_len > self.max_message_size {
+            return Err(js_error("message too large"));
+        }
         let frame_len = frame_len as usize;
         let Some(frame_end) = 4usize.checked_add(frame_len) else {
             return Err(js_error("invalid frame length"));

wasm/types/mtp_wasm.d.ts

@@ -48,6 +48,7 @@ export class ConnectionConfig implements DisposableWasmObject {
   free(): void;
   [Symbol.dispose](): void;
   client_id: bigint;
+  max_message_size: number;
   server_certificate_hashes: string[];
   readonly url: string;
 }
@@ -158,6 +159,7 @@ export function ed25519_generate(): Ed25519GenerateResult;
 export function ed25519_verify(public_key: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
 export function format_frame(frame: Uint8Array): string;
 export function keyring_from_ed25519(secret_key: Uint8Array, public_key: Uint8Array): Uint8Array;
+export function keyring_generate(): Uint8Array;
 export function main(): void;
 export function parse_auth_response(response: Uint8Array): AuthResponse;
 export function parse_frame(frame: Uint8Array): ParsedFrame;