58 changed files with 1538 additions and 1801 deletions
--- a/.envrc
+++ b/.envrc
@ -1 +0,0 @@
 use flake
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@ -7,12 +7,16 @@ on:
 env:
  CARGO_TERM_COLOR: always
  NIX_CONFIG: experimental-features = nix-command flakes
 jobs:
  checks:
    name: checks
    runs-on: nixos
    steps:
      - name: Install node
        run: nix profile add nixpkgs#nodejs_24
      - name: Checkout
        uses: https://data.forgejo.org/actions/checkout@v7
@ -29,6 +33,7 @@ jobs:
            cargo machete
            pnpm install --frozen-lockfile
            pnpm run dup
            RUSTFLAGS="--cfg web_sys_unstable_apis" wasm-pack test --node wasm
            RUSTFLAGS="--cfg web_sys_unstable_apis" wasm-pack build wasm --target web
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@ -14,10 +14,16 @@ on:
        required: true
        type: string
 env:
  NIX_CONFIG: experimental-features = nix-command flakes
 jobs:
  release:
    runs-on: nixos
    steps:
      - name: Install node & bun
        run: nix profile add nixpkgs#nodejs_24 nixpkgs#bun
      - name: Check out repo
        uses: https://data.forgejo.org/actions/checkout@v7
        with:
@ -26,6 +32,9 @@ jobs:
      - name: Install dependencies
        run: bun install
      - name: Install cc linker, sed & jq
        run: nix profile add nixpkgs#stdenv.cc nixpkgs#gnused nixpkgs#jq
      - name: Build all
        run: bun build:all
--- a/.gitignore
+++ b/.gitignore
@ -6,4 +6,3 @@ dist/
 *.tgz
 wasm/pkg/
 web_client/
 .direnv
--- a/Cargo.lock
+++ b/Cargo.lock
@ -90,9 +90,9 @@ dependencies = [
 [[package]]
 name = "async-trait"
-version = "0.1.92"
+version = "0.1.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
 dependencies = [
 "proc-macro2",
 "quote",
@ -221,9 +221,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 [[package]]
 name = "cc"
-version = "1.4.3"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
+checksum = "5d262e149917187838d5b42777c8253bcb64500067342904e7d429499a6f277e"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@ -256,9 +256,9 @@ dependencies = [
 [[package]]
 name = "chacha20"
-version = "0.10.2"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.3.0",
@ -561,7 +561,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 [[package]]
@ -596,9 +596,9 @@ checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.11"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+checksum = "26b73573e6edcd2af0cdf47bd6cb58f0b3839491263c314eaad1ccf24430e1de"
 [[package]]
 name = "fnv"
@ -629,9 +629,9 @@ checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 [[package]]
 name = "futures"
-version = "0.3.34"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
 dependencies = [
 "futures-channel",
 "futures-core",
@ -660,9 +660,9 @@ checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 [[package]]
 name = "futures-executor"
-version = "0.3.34"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
 dependencies = [
 "futures-core",
 "futures-task",
@ -764,9 +764,9 @@ dependencies = [
 [[package]]
 name = "h2"
-version = "0.4.16"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
+checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
 dependencies = [
 "atomic-waker",
 "bytes",
@ -895,9 +895,9 @@ dependencies = [
 [[package]]
 name = "http-body-util"
-version = "0.1.5"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
 "bytes",
 "futures-core",
@ -966,9 +966,9 @@ dependencies = [
 [[package]]
 name = "icu_collections"
-version = "2.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
 "displaydoc",
 "potential_utf",
@ -980,9 +980,9 @@ dependencies = [
 [[package]]
 name = "icu_locale_core"
-version = "2.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
 "displaydoc",
 "litemap",
@ -993,9 +993,9 @@ dependencies = [
 [[package]]
 name = "icu_normalizer"
-version = "2.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
 "icu_collections",
 "icu_normalizer_data",
@ -1007,17 +1007,16 @@ dependencies = [
 [[package]]
 name = "icu_normalizer_data"
-version = "2.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 [[package]]
 name = "icu_properties"
-version = "2.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
 "displaydoc",
 "icu_collections",
 "icu_locale_core",
 "icu_properties_data",
@ -1028,15 +1027,15 @@ dependencies = [
 [[package]]
 name = "icu_properties_data"
-version = "2.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 [[package]]
 name = "icu_provider"
-version = "2.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92a7ed671a6aad807a8651a2e1782a6598fda9ce5185dd8158549e95a91c6428"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
 "displaydoc",
 "icu_locale_core",
@ -1154,9 +1153,9 @@ dependencies = [
 [[package]]
 name = "js-sys"
-version = "0.3.104"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
 dependencies = [
 "cfg-if",
 "futures-util",
@ -1174,9 +1173,9 @@ dependencies = [
 [[package]]
 name = "keccak"
-version = "0.2.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffd9697dc4a9a62e2da93389f34400b77a28f0287711263cabb203b3ccb9c0e4"
+checksum = "9e24a010dd405bd7ed803e5253182815b41bf2e6a80cc3bfc066658e03a198aa"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.3.0",
@ -1202,9 +1201,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 [[package]]
 name = "litemap"
-version = "0.8.3"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 [[package]]
 name = "lock_api"
@ -1235,9 +1234,9 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 [[package]]
 name = "minicov"
-version = "0.3.9"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3aa3aa12b448ac225b3102217d1ac5cc717908f02722926524b0599c933c7a0"
+checksum = "4869b6a491569605d66d3952bcdf03df789e5b536e5f0cf7758a7f08a55ae24d"
 dependencies = [
 "cc",
 "walkdir",
@ -1326,6 +1325,9 @@ dependencies = [
 "mtp-transport",
 "mtp-type-map",
 "mtp-webserver",
 "rand",
 "rcgen",
 "tokio",
 ]
 [[package]]
@ -1360,6 +1362,7 @@ name = "mtp-common"
 version = "0.3.0"
 dependencies = [
 "quinn",
 "rustls",
 "thiserror 2.0.20",
 "wtransport",
 ]
@ -1662,9 +1665,9 @@ dependencies = [
 [[package]]
 name = "pkg-config"
-version = "0.3.34"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 [[package]]
 name = "poly1305"
@ -1697,9 +1700,9 @@ checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
 [[package]]
 name = "potential_utf"
-version = "0.1.6"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
 "zerovec",
 ]
@ -1742,9 +1745,9 @@ dependencies = [
 [[package]]
 name = "quinn-proto"
-version = "0.11.17"
+version = "0.11.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
 dependencies = [
 "aws-lc-rs",
 "bytes",
@ -1776,7 +1779,7 @@ dependencies = [
 "once_cell",
 "socket2",
 "tracing",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 [[package]]
@ -1800,7 +1803,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.2",
+ "chacha20 0.10.1",
 "getrandom 0.4.3",
 "rand_core 0.10.1",
 ]
@ -1947,7 +1950,7 @@ dependencies = [
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 [[package]]
@ -2117,7 +2120,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
 dependencies = [
 "digest 0.11.3",
- "keccak 0.2.1",
+ "keccak 0.2.0",
 "sponge-cursor",
 ]
@ -2342,9 +2345,9 @@ dependencies = [
 [[package]]
 name = "tinystr"
-version = "0.8.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
 "displaydoc",
 "zerovec",
@ -2416,14 +2419,13 @@ dependencies = [
 [[package]]
 name = "tokio-util"
-version = "0.7.19"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
 "bytes",
 "futures-core",
 "futures-sink",
 "libc",
 "pin-project-lite",
 "tokio",
 ]
@ -2568,9 +2570,9 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.127"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
 "cfg-if",
 "once_cell",
@ -2581,9 +2583,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.77"
+version = "0.4.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
@ -2591,9 +2593,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.127"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@ -2601,9 +2603,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.127"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
 dependencies = [
 "bumpalo",
 "proc-macro2",
@ -2614,18 +2616,18 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.127"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
 dependencies = [
 "unicode-ident",
 ]
 [[package]]
 name = "wasm-bindgen-test"
-version = "0.3.77"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "895a2607575412a4eda1df892084a375ea10dfeadc4d7d2ab87b854e4ddc7ba1"
+checksum = "2a0d555ca874445df8d314f94f5c948a4e74e5418f332c89f660a3d8310a96f4"
 dependencies = [
 "async-trait",
 "cast",
@ -2645,9 +2647,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-test-macro"
-version = "0.3.77"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288cb0ebe215033bf949ae1fd046726daa4c32a157f24b9dc6ac387a52aa759"
+checksum = "94eb68555b95bcea5e8cf4abe280b529049479fa995bfc23734af96a6aedc120"
 dependencies = [
 "proc-macro2",
 "quote",
@ -2656,9 +2658,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-test-shared"
-version = "0.2.127"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ff1c1b360982e93b6d8ea9c04836f71dba0817a16f91e229cf3a51bdd9d987"
+checksum = "c31d56021e873866c968588ed85ccdf56db5c426e44afdb4618c39895104b920"
 [[package]]
 name = "wasm-tracing"
@ -2696,7 +2698,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 [[package]]
@ -2789,9 +2791,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 [[package]]
 name = "writeable"
-version = "0.6.4"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 [[package]]
 name = "wtransport"
@ -2936,9 +2938,9 @@ dependencies = [
 [[package]]
 name = "zerotrie"
-version = "0.2.5"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
 "displaydoc",
 "yoke",
@ -2947,9 +2949,9 @@ dependencies = [
 [[package]]
 name = "zerovec"
-version = "0.11.7"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94b5c6b5976d66c1d703c4fd17d3f5e43c8cedaacf604961b171adc7130896d8"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
 "yoke",
 "zerofrom",
@ -2958,13 +2960,13 @@ dependencies = [
 [[package]]
 name = "zerovec-derive"
-version = "0.11.5"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f212a141d820099d57ffafb9569be9617a6f27d3dc881fbee8fb56642f917a9"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 2.0.119",
 ]
 [[package]]
--- a/Cargo.toml
+++ b/Cargo.toml
@ -113,5 +113,10 @@ tls = ["crypto", "mtp-crypto?/tls"]
 # Requires MTP_INSECURE_TLS=1 at runtime.
 insecure-tls = ["dep:mtp-transport", "mtp-transport?/insecure-tls"]
 [dev-dependencies]
 tokio = { version = "1", features = ["full"] }
 rcgen = "0.14"
 rand = "0.10.1"
 [package.metadata.cargo-machete]
 ignored = ["mtp-transport"]
--- a/README.md
+++ b/README.md
@ -47,29 +47,18 @@ Feature summary:
 | Feature | Pulls in | Enables |
 | --- | --- | --- |
-| `serde` | Crypto serialization support | Serde implementations for crypto key types |
+| `crypto` | `mtp::crypto` | AEAD, signatures, KEM, KDF, hashing |
-| `crypto` | `mtp::crypto` | AEAD, signatures, KEM, KDF, hashing, and connection authentication support |
+| `host` | `mtp::host`, codec registry | QUIC host and version negotiation |
-| `host` | `mtp::host` | Native QUIC host and version negotiation |
+| `client` | `mtp::client` | QUIC client connections |
-| `client` | `mtp::client` | Native QUIC client connections |
+| `webserver` | `mtp::webserver` | HTTPS server with HTTP/1.1, HTTP/2, HTTP/3, and WebTransport MTP sessions |
 | `transport` | `mtp-transport` dependency | Low-level transport support; enabled automatically by `host` and `client` |
 | `pipes` | Pipe support in transport, host, client, and web server | Raw and encrypted byte streams |
 | `files` | `mtp::files` | `.mk` keyrings and `.mpkb` public bundles; also enables `crypto` |
 | `raw` | Raw file APIs | Legacy plaintext keyring migration APIs |
 | `web-server` | `mtp::webserver` | HTTPS server with HTTP/1.1, HTTP/2, HTTP/3, and WebTransport MTP sessions |
 | `full-server` | Native host and web-server surface | `host`, `web-server`, `crypto`, and `pipes` together |
 | `tls` | `mtp::crypto::tls` | Development self-signed certificate generation |
 | `insecure-tls` | Lower-level transport | Development-only certificate verification bypass, gated by `MTP_INSECURE_TLS=1` |
-The core modules always available from the facade are `codec`, `common`, and
+The core crates are always available: `codec`, `transport`, `common`, and `type_map`. See the [native client](./docs/NATIVE-CLIENT.md) and [native host](./docs/NATIVE-HOST.md)
 `type_map`. Native `client` and `host` modules re-export the transport policy
 types; the low-level transport crate is not exposed as `mtp::transport`. See the [native client](./docs/NATIVE-CLIENT.md) and [native host](./docs/NATIVE-HOST.md)
 guides for configuration and usage. See [Security](./docs/SECURITY.md) for security boundaries.
 ## Sub-crates
 The `mtp` facade re-exports the following modules:
-`mtp::codec`, `mtp::common`, `mtp::type_map`, `mtp::crypto`, `mtp::host`,
+`mtp::codec`, `mtp::transport`, `mtp::common`, `mtp::type_map`, `mtp::crypto`, `mtp::host`, and `mtp::client`.
 `mtp::client`, `mtp::files`, and `mtp::webserver` when their features are enabled.
 ### Codec
--- a/client/src/pipe.rs
+++ b/client/src/pipe.rs
@ -78,41 +78,9 @@ pub struct PipeRequest {
    pub(crate) pipe_id: u32,
    pub(crate) description: String,
    pub(crate) sender: Sender,
    pub(crate) receiver: Receiver,
    pub(crate) dispatcher: Arc<PipeDispatcher>,
 }
 #[cfg(feature = "pipes")]
 struct ExpectedPipeGuard {
    receiver: Receiver,
    pipe_id: u32,
    armed: bool,
 }
 #[cfg(feature = "pipes")]
 impl ExpectedPipeGuard {
    fn new(receiver: Receiver, pipe_id: u32) -> Self {
        Self {
            receiver,
            pipe_id,
            armed: true,
        }
    }
    fn disarm(&mut self) {
        self.armed = false;
    }
 }
 #[cfg(feature = "pipes")]
 impl Drop for ExpectedPipeGuard {
    fn drop(&mut self) {
        if self.armed {
            self.receiver.cancel_expected_pipe(self.pipe_id);
        }
    }
 }
 #[cfg(feature = "pipes")]
 impl PipeRequest {
    pub fn id(&self) -> u32 {
@ -124,10 +92,6 @@ impl PipeRequest {
    }
    pub async fn accept(self) -> Result<mtp_transport::PipeReader, PipeError> {
        self.receiver
            .expect_pipe(self.pipe_id)
            .map_err(PipeError::from)?;
        let mut expected_pipe = ExpectedPipeGuard::new(self.receiver.clone(), self.pipe_id);
        let (pipe_tx, pipe_rx) = tokio::sync::oneshot::channel();
        {
            let mut pending = self.dispatcher.pending_pipes.lock().await;
@ -151,10 +115,7 @@ impl PipeRequest {
        let timeout = self.dispatcher.policy.read_timeout;
        match tokio::time::timeout(timeout, pipe_rx).await {
-            Ok(Ok(reader)) => {
+            Ok(Ok(reader)) => Ok(reader),
                expected_pipe.disarm();
                Ok(reader)
            }
            Ok(Err(_)) => {
                self.dispatcher
                    .pending_pipes
@ -452,7 +413,6 @@ pub(crate) async fn run_dispatcher(
                        pipe_id,
                        description,
                        sender: sender.clone(),
                        receiver: receiver.clone(),
                        dispatcher: dispatcher.clone(),
                    };
                    let _ = pipe_req_tx.send(req).await;
--- a/codec/Cargo.lock
+++ b/codec/Cargo.lock
@ -187,9 +187,9 @@ dependencies = [
 [[package]]
 name = "chacha20"
-version = "0.10.2"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.3.0",
@ -1151,7 +1151,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.2",
+ "chacha20 0.10.1",
 "getrandom 0.4.3",
 "rand_core 0.10.1",
 ]
--- a/common/Cargo.lock
+++ b/common/Cargo.lock
@ -139,9 +139,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 [[package]]
 name = "chacha20"
-version = "0.10.2"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
 "cfg-if",
 "cpufeatures",
--- a/common/Cargo.toml
+++ b/common/Cargo.toml
@ -15,6 +15,7 @@ wtransport = { version = "0.7.1", default-features = false, features = [
    "quinn",
    "self-signed",
 ] }
 rustls = { version = "0.23.41" }
 quinn = { version = "0.11.11", default-features = false, features = [
    "rustls-aws-lc-rs",
    "rustls",
--- a/common/src/lib.rs
+++ b/common/src/lib.rs
@ -164,9 +164,6 @@ pub enum CommunicationError {
    #[error("Stream Error")]
    StreamError,
    #[error("Stream failed after delivery may have started")]
    DeliveryUnknown,
    #[error("Stream Error: {0}")]
    #[cfg(not(target_arch = "wasm32"))]
    StreamWriteError(#[from] wtransport::error::StreamWriteError),
@ -185,38 +182,6 @@ pub enum CommunicationError {
    Other(String),
 }
 /// How the protocol layer should handle the first frame on a receive stream.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum FirstFrameDisposition {
    Message,
    Pipe(u32),
 }
 /// Classify a first frame without tying the decision to a WebTransport backend.
 ///
 /// `PipeRequest` is used both as a control message and as the header of the raw
 /// stream opened after that request is accepted. Only the protocol layer knows
 /// which raw stream IDs are currently expected.
 pub fn classify_first_frame(
    is_pipe_request: bool,
    pipe_id: Option<u32>,
    pipe_is_expected: bool,
 ) -> Result<FirstFrameDisposition, CommunicationError> {
    if !is_pipe_request {
        return Ok(FirstFrameDisposition::Message);
    }
    let pipe_id = pipe_id.filter(|id| *id != 0).ok_or_else(|| {
        CommunicationError::Other("PipeRequest frame must contain a non-zero id".into())
    })?;
    if pipe_is_expected {
        Ok(FirstFrameDisposition::Pipe(pipe_id))
    } else {
        Ok(FirstFrameDisposition::Message)
    }
 }
 // ---- manual PartialEq (quinn / wtransport types don't impl PartialEq) ----
 impl PartialEq for CommunicationError {
@ -247,7 +212,6 @@ impl PartialEq for CommunicationError {
            (Self::ReadExactError(_), Self::ReadExactError(_)) => true,
            (Self::StreamClosed, Self::StreamClosed) => true,
            (Self::StreamError, Self::StreamError) => true,
            (Self::DeliveryUnknown, Self::DeliveryUnknown) => true,
            #[cfg(not(target_arch = "wasm32"))]
            (Self::StreamWriteError(_), Self::StreamWriteError(_)) => true,
            #[cfg(not(target_arch = "wasm32"))]
--- a/crypto/Cargo.lock
+++ b/crypto/Cargo.lock
@ -181,9 +181,9 @@ dependencies = [
 [[package]]
 name = "chacha20"
-version = "0.10.2"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.3.0",
@ -853,7 +853,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.2",
+ "chacha20 0.10.1",
 "getrandom 0.4.3",
 "rand_core 0.10.1",
 ]
--- a/deny.toml
+++ b/deny.toml
@ -8,23 +8,9 @@ ignore = []
 [bans]
 # Flag multiple versions of the same crate so duplicate trees are visible.
-multiple-versions = "deny"
+multiple-versions = "warn"
 wildcards = "deny"
 # These versions are required by incompatible upstream dependency lines:
 # - pem/rcgen/wtransport still use base64 0.22.
 # - ring and wasm-bindgen still use getrandom 0.2.
 # - current displaydoc/serde/thiserror/tokio and wasm-bindgen trees span syn 2
 #   and syn 3.
 # - ring still uses windows-sys 0.52 while the Tokio/QUIC tree uses 0.61.
 # Keep the duplicate-version policy strict for every other crate/version.
 skip = [
    { name = "base64", version = "0.22.1" },
    { name = "getrandom", version = "0.2.17" },
    { name = "syn", version = "2.0.119" },
    { name = "windows-sys", version = "0.52.0" },
 ]
 [licenses]
 # Allowlist of licenses acceptable for this project's dependencies.
 allow = [
--- a/docs/CONNECTIONS.md
+++ b/docs/CONNECTIONS.md
@ -1,23 +1,19 @@
 # MTP Connections
-Native clients and server-side hosts expose parallel connection handles after the
+Native clients and hosts share the same connection shape after the opening handshake. The client creates the connection; the host receives it from `accept()`.
 opening handshake. The client creates its handle; the host receives one from
 `accept()`.
 | Member | Native client | Native host | Web host (`WebMTPConnection`) |
 | --- | --- | --- | --- |
 | `version` | Compiled client version accepted by the host | Version selected by the registry | Version selected by the registry |
 | `sender` | Sends `CommunicationValue` frames | Sends `CommunicationValue` frames | Sends `CommunicationValue` frames |
-| `receiver` | Underlying receiver; use `receive()` for application frames | Underlying receiver; use `receive()` for application frames | Underlying receiver; use `receive()` for application frames |
+| `receiver` | Receives application frames | Receives application frames | Receives application frames |
 | `description` | Optional label sent during setup | Optional label received from the client | Optional label received from the client |
 | `client_id` | Confirmed or assigned ID with `crypto` | Authenticated or guest client ID with `crypto` | Authenticated or guest client ID with `crypto` |
 | `auth_state` | Authentication result with `crypto` | Authentication result with `crypto` | Authentication result with `crypto` |
-| `path` | — | Native hosts use `/` | WebTransport CONNECT path (e.g. `/mtp`) |
+| `request_path` | / | / | WebTransport CONNECT path (e.g. `/mtp`) |
 | `remote_addr` | Server `SocketAddr` when available | Peer `SocketAddr` | Peer `SocketAddr` |
-`WebMTPConnection`, returned by `MTPWebServer::accept()`, exposes the same
+`WebMTPConnection`, returned by `MTPWebServer::accept()`, exposes the same members as the native host connection plus `request_path`, which contains the HTTP/3 path used for the WebTransport extended CONNECT request.
 server-side members as the native host connection. Its `path` contains the
 HTTP/3 path used for the WebTransport extended CONNECT request.
 Server-side MTP connections expose `remote_addr`, the peer address observed by
 QUIC. HTTP route handlers receive the peer address as `HttpRequest::remote_addr`.
--- a/docs/CONNECTOR.md
+++ b/docs/CONNECTOR.md
@ -4,28 +4,23 @@ This file documents the connection and version negotiation logic.
 ## Registry
-The `registry` module provides a multi-version `Registry` used by the host for
+The `registry` module provides a multi-version `Registry` used by the host for version negotiation. Accessed through the `mtp` facade (requires the `host` feature):
 version negotiation. Accessed through the `mtp` facade (requires the `host`
 feature). In this repository, `Registry::builtin()` is generated from
 [`example/type-maps.yaml`](../example/type-maps.yaml), which currently contains
 protocol version 3.0 only. Downstream projects can register additional versions
 in their own YAML configuration.
 ```rust
-use mtp::codec::{Version, registry::Registry};
+use mtp::codec::registry::Registry;
-let registry = Registry::builtin(); // loads all TypeMaps from the build config
+let registry = Registry::builtin(); // loads all TypeMaps from config
 // Check if a version is supported
-assert!(registry.supports(&Version(3, 0)));
+assert!(registry.supports(&Version(1, 0)));
 // Find highest mutual version for a client
-let client_versions = &[Version(2, 0), Version(3, 0)];
+let client_versions = &[Version(0, 0), Version(1, 0)];
 let negotiated = registry.negotiate(client_versions);
-assert_eq!(negotiated, Some(Version(3, 0)));
+assert_eq!(negotiated, Some(Version(1, 0)));
 // Look up a version's TypeMap
-let tm = registry.get(&Version(3, 0)).unwrap();
+let tm = registry.get(&Version(2, 0)).unwrap();
 ```
 The `Registry::builtin()` constructor uses the `TypeMap::vX_Y()` methods generated from the config.
@ -59,9 +54,9 @@ let mut host = MTPHost::new(config).await?;
 while let Some(conn) = host.accept().await? {
    // conn.version is the negotiated version
    // conn.codec is a VersionedCodec scoped to that version
-    // conn.sender / conn.receive() for application CommunicationValue I/O
+    // conn.sender / conn.receiver for raw CommunicationValue I/O
-    let msg = conn.receive().await?;
+    let msg = conn.receiver.receive().await?;
 }
 ```
@ -99,31 +94,29 @@ The client's `PROTOCOL_VERSION` constant is set by `protocol_version` in `type-m
 ## Version Negotiation Flow
 ```
-Client (v3.0)         Host (v3.0)
+Client (v2.0)         Host (v0.0, v1.0, v2.0)
    |                        |
    |  QUIC connect          |
    |----------------------->|
    |                        |
    |  CommValue{ Ident. }   |
-    |    Version -> "3.0"    |
+    |    Version -> "2.0"    |
    |    Id -> 8765          |
    |  (unsigned hello; auth |
    |   challenge follows)   |
    |----------------------->|
-    |                        |  registry.negotiate(&[Version(3,0)])
+    |                        |  registry.negotiate(&[Version(2,0)])
-    |                        |  -> Some(Version(3,0))
+    |                        |  -> Some(Version(2,0))
    |                        |
-    |  Response              |  selected v3.0 TypeMap
+    |  Response              |  selected v2.0 TypeMap
    |<-----------------------|
    |  Status, version       |
    |                        |
    |  subsequent messages   |
-    |  use v3.0 TypeMap      |
+    |  use v2.0 TypeMap      |
 ```
-If the client sends an unsupported version (for example, v2.0 to the current
+If the client sends an unsupported version (e.g. v3.0 when the host only knows up to v2.0), `negotiate` returns `None` and the connection is closed.
 repository builtin host), `negotiate` returns `None` and the connection is
 closed.
 ## Protocol Ping and Pong
--- a/docs/ERRORS.md
+++ b/docs/ERRORS.md
@ -12,8 +12,6 @@ MTP reports codec failures separately from connection and transport failures.
 | `ReservedCommunicationType` | An application attempted to use a reserved communication type ID. |
 | `InvalidEncoding` | Bytes do not match the MTP value or frame format. |
 | `TooManyEntries` | A serialized value or frame exceeds its representable size. |
 | `MissingTypeMap` | A versioned codec was asked to encode a value without a retained negotiated type map. |
 | `TypeMapMismatch` | A value was created with a different protocol type map from the codec or peer operation. |
 | `CryptoFailed` | Signing, verification, encryption, or decryption failed while encoding or decoding. |
 | `MissingField` | A required typed field is absent. |
@ -45,4 +43,4 @@ Native builds may expose additional variants wrapping QUIC and WebTransport erro
 ## Authentication Rejections
-The host reports unsupported or missing protocol versions through `AcceptError`. Authentication failures return `AcceptError::AuthenticationFailed` after the host sends a rejected handshake response; a handshake that exceeds the configured limit returns `AcceptError::AuthenticationTimedOut`. The authentication flow and its signed fields are defined in [Security](SECURITY.md).
+The host reports unsupported or missing protocol versions through `AcceptError`. Authentication failures return `AcceptError::AuthenticationFailed` after the host sends a rejected handshake response. The authentication flow and its signed fields are defined in [Security](SECURITY.md).
--- a/docs/NATIVE-CLIENT.md
+++ b/docs/NATIVE-CLIENT.md
@ -19,7 +19,7 @@ let request = CommunicationValue::new(CommunicationType::Ping).with_id(1);
 conn.sender.send(&request).await?;
 let response = conn.receive().await?;
 println!("received {:?}", response.id());
-conn.sender.close().await;
+conn.sender.close();
 ```
 ## Configuration
@ -230,7 +230,7 @@ let response = conn
 Requests are routed by id through the connection's receive dispatcher. Frames with other ids remain available through `conn.receive()`.
-Two send modes (configured via `mtp::client::Policy`):
+Two send modes (configured via `mtp::transport::Policy`):
 - `PersistentStream` (default): reuses one QUIC unidirectional stream
 - `SingleStreamPerMessage`: opens a new stream per message
@ -248,16 +248,12 @@ Inbound frames are queued internally. The `receive()` method returns the next av
 ### Close
 ```rust
-conn.sender.close().await;
+conn.sender.close();
 // or
 conn.receiver.close();
 ```
-`Sender::close().await` gracefully finishes the active send stream, sends the
+Sends a close frame and signals the peer. The `Sender::close()` spawns an async task that sends the frame, waits for `force_close_delay` (default 300ms), then force-closes the QUIC connection if the peer has not already done so.
 MTP close frame, and waits for `force_close_delay` (default 300ms) before
 force-closing the QUIC connection if necessary. `Sender::close_immediate()` is
 the fire-and-forget variant. `Receiver::close()` closes the local receive
 handle without performing the sender's graceful close sequence.
 ### Pipes
@ -313,7 +309,7 @@ For `public_signer`, call `verify` and `into_verified` before calling `decrypt`;
 The `Policy` struct controls transport behaviour:
 ```rust
-use mtp::client::{Policy, SendMode};
+use mtp::transport::{Policy, SendMode};
 let policy = Policy {
    send_mode: SendMode::PersistentStream,
--- a/docs/NATIVE-HOST-WEB-SERVER.md
+++ b/docs/NATIVE-HOST-WEB-SERVER.md
@ -130,7 +130,7 @@ while let Some(connection) = server.accept().await? {
 ```
 > `MTPWebServer::new` consumes a `HostConfig` (not an `MTPHost` instance). It creates its own QUIC endpoint and does not share a port with a running `MTPHost`.
-`server.accept()` returns `Option<WebMTPConnection>` for each WebTransport session. Ordinary HTTP routes do not surface through `accept()` because the server dispatches them internally. `WebMTPConnection` retains the negotiated version, codec, `path`, remote address, description, sender, and receiver used by native MTP connections.
+`server.accept()` returns `Option<WebMTPConnection>` for each WebTransport session. Ordinary HTTP routes do not surface through `accept()` because the server dispatches them internally. `WebMTPConnection` retains the negotiated version, codec, request path, remote address, description, sender, and receiver used by native MTP connections.
 ## Deployment
@ -138,7 +138,7 @@ For direct browser access, leave `serve_tcp_https(true)` enabled. The server adv
 When a reverse proxy or another process owns TCP, use `WebServerConfig::new().serve_tcp_https(false)`. This retains the UDP HTTP/3/WebTransport endpoint and its shared router without claiming the TCP port.
-With port `0` and TCP enabled, construction binds TCP first and binds UDP to the selected TCP port, so `local_addr()` reports the common address. With TCP disabled, Quinn selects the UDP port as before. `shutdown().await` stops both accept loops, gracefully finishes active HTTP requests until `drain_timeout`, closes Quinn, and then aborts remaining work. `close().await` and dropping the server stop both listeners immediately.
+With port `0` and TCP enabled, construction binds TCP first and binds UDP to the selected TCP port, so `local_addr()` reports the common address. With TCP disabled, Quinn selects the UDP port as before. `shutdown()` stops both accept loops, gracefully finishes active HTTP requests until `drain_timeout`, closes Quinn, and then aborts remaining work. `close()` and dropping the server stop both listeners immediately.
 ### Authentication
@ -164,18 +164,12 @@ On success, the connection has `AuthState::Authenticated`, the assigned `client_
 ## Errors
-`MTPWebServer::new` returns `CommunicationError` for certificate parsing,
+`MTPWebServer::new` returns `CommunicationError` for certificate parsing, certificate loading, bind failures, and rejected authentication policy.
 certificate loading, and bind failures. Authentication policy is evaluated when
 WebTransport sessions are accepted, not rejected during construction.
 `accept()` returns `AcceptError` for a missing or unsupported version, a receive failure, or a send failure during the WebTransport opening handshake. HTTP route failures are reported through `WebServerMetrics::error_occurred` when metrics are configured. See [Errors](ERRORS.md) for shared error variants.
 `WebServerMetrics` has these callbacks:
 ```rust
 use std::time::Duration;
 fn connection_accepted(&self)
 fn connection_closed(&self, duration: Duration, reason: &str)
 fn request_started(&self, path: &str)
 fn request_completed(&self, path: &str, status: u16, duration: Duration)
 fn error_occurred(&self, error: &WebServerError)
--- a/docs/NATIVE-HOST.md
+++ b/docs/NATIVE-HOST.md
@ -83,18 +83,18 @@ network metadata, not an authenticated client identity.
 ## Version Negotiation
-`accept()` uses the version-bearing opening frame and registry flow in [Connector](CONNECTOR.md). The host registry is built from the type maps in [`example/type-maps.yaml`](../example/type-maps.yaml) by `Registry::builtin()` in this repository; downstream builds can provide their own `MTP_TYPE_MAPS` configuration.
+`accept()` uses the version-bearing opening frame and registry flow in [Connector](CONNECTOR.md). The host registry is built from the type maps in `type-maps.yaml` by `Registry::builtin()`.
 ### Registry
 ```rust
-use mtp::codec::Version;
+use mtp::codec::registry::Registry;
 let registry = host.registry();
-assert!(registry.supports(&Version(3, 0)));
+assert!(registry.supports(&Version(2, 0)));
-let negotiated = registry.negotiate(&[Version(2, 0), Version(3, 0)]);
+let negotiated = registry.negotiate(&[Version(1, 0), Version(2, 0)]);
-// -> Some(Version(3, 0)) for this repository's builtin map
+// -> Some(Version(2, 0)) if both versions are registered
 ```
 ## Authentication Flow
@ -105,15 +105,13 @@ After a successful handshake, `MTPConnection` exposes `AuthState::Authenticated`
 ## Handling Messages
-Use `conn.sender` and `conn.receive()` for bidirectional message exchange. The
+Use `conn.sender` and `conn.receiver` for bidirectional message exchange:
 connection dispatcher owns the underlying receiver, especially when `pipes` is
 enabled:
 ```rust
 while let Some(conn) = host.accept().await? {
    tokio::spawn(async move {
        loop {
-            match conn.receive().await {
+            match conn.receiver.receive().await {
                Ok(msg) => {
                    let response = process_message(&msg, &conn);
                    conn.sender.send(&response).await.ok();
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@ -39,4 +39,4 @@ Back up host keyrings and client keyrings as protected secrets. Test restoring a
 ### Graceful Shutdown
-Stop accepting new connections, reject new work at the application layer, and allow active requests and pipe writers to finish. For `MTPWebServer`, call `shutdown().await`; its `drain_timeout` controls graceful TCP HTTP completion and the QUIC drain period before remaining connection tasks are terminated.
+Stop accepting new connections, reject new work at the application layer, and allow active requests and pipe writers to finish. For `MTPWebServer`, call `shutdown()`; its `drain_timeout` controls graceful TCP HTTP completion and the QUIC drain period before remaining connection tasks are terminated.
--- a/docs/PIPES.md
+++ b/docs/PIPES.md
@ -167,9 +167,6 @@ if let Some(writer) = handle.wait().await? {
 ```rust
 // Host
 use mtp_transport::{PipeSessionParameters, accept_pipe_session};
 use sha2::{Digest, Sha256};
 // The streaming digest below requires `sha2` as a direct application dependency.
 while let Ok(request) = conn.receive_pipe().await {
    if request.description() != "file-upload" {
@ -185,7 +182,7 @@ while let Ok(request) = conn.receive_pipe().await {
    let mut reader = accept_pipe_session(
        reader.into_inner(), &params, &own_keyring, &client_public_bundle,
    ).await?;
-    let mut hasher = Sha256::new();
+    let mut hasher = sha2::Sha256::new();
    while let Some(chunk) = reader.read_record().await? {
        hasher.update(&chunk);
        process_chunk(&chunk).await?;
--- a/docs/PROTOCOL-REFERENCE.md
+++ b/docs/PROTOCOL-REFERENCE.md
@ -112,9 +112,4 @@ identity-specific response for deployments where IDs are public.
 The client sends one compiled-in protocol version. The host compares it with the versions in its registry and returns the selected version in the opening response. Subsequent frames use that version's type map. An unsupported version closes the connection with `AcceptError::UnsupportedVersion`.
-The current self-delimiting `DataValue` codec and three-bit communication header
+The self-delimiting `DataValue` codec and the three-bit communication header begin at protocol version `3.0`. A peer offering an older codec version is rejected during version negotiation; the new decoder does not attempt legacy flag, ID, or crypto-container fallbacks.
 are used by the repository's protocol 3.0 map. The checked-in builtin registry
 contains only 3.0, so its native clients and hosts do not provide legacy map
 fallbacks. Type-map versions are configuration-driven; a custom registry may
 register another version number, but its map must use the current codec format
 and is not a fallback for a different legacy wire format.
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@ -27,7 +27,7 @@ For rotation, publish the replacement certificate or key before changing the ser
 ### Development Certificates
-The `tls` feature exposes `mtp_crypto::tls::generate_self_signed_cert`. It creates an ECDSA P-256 server certificate for the requested domain, `127.0.0.1`, and `::1`; the certificate is valid for 13 days. The lower-level `mtp_transport::HostConfig::self_signed` provides a transport-level self-signed setup without the crypto certificate helper.
+The `tls` feature exposes `mtp_crypto::tls::generate_self_signed_cert`. It creates an ECDSA P-256 server certificate for the requested domain, `127.0.0.1`, and `::1`; the certificate is valid for 13 days. `HostConfig::self_signed` provides a transport-level self-signed setup without the crypto certificate helper.
 Self-signed certificates are for development. Production deployments should use a certificate trusted by the client or an explicitly pinned certificate.
@ -212,7 +212,6 @@ The crate's feature groups are:
 | `serde` | Serialization support for key types |
 | `wasm` | `getrandom` support for WebAssembly |
 | `tls` | Development certificate generation |
 | `password-kdf` | Argon2id password derivation for protected keyring files |
 The main types are `Keyring`, `PublicKeyBundle`, `EncryptionType`, `HybridKem`, `XChaCha20Poly1305` (with the legacy `ChaCha20Poly1305` alias), `Aes256Gcm`, `Ed25519Signer`, and `MlDsaSigner`. Hashing and KDF helpers include `sha256`, `sha256_double`, `hkdf_extract`, `hkdf_expand`, and `derive_encryption_key`. Handshake payload builders are in `mtp_crypto::auth`.
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@ -59,7 +59,7 @@ When `require_pq` is true, both Ed25519 and ML-DSA-65 keys and signatures must b
 **Prevention:** Treat generated type maps as versioned build artifacts.
-`CodecError::UnknownVersion` means the codec was created for a version absent from its registry. `UnknownCommunicationType` and `UnknownDataType` mean the selected `TypeMap` has no mapping for the value being encoded. `MissingTypeMap` means a versioned value lost its retained negotiated map; `TypeMapMismatch` means it was combined with a value or codec for another version. Select the negotiated type map and do not send an unmapped variant.
+`CodecError::UnknownVersion` means the codec was created for a version absent from its registry. `UnknownCommunicationType` and `UnknownDataType` mean the selected `TypeMap` has no mapping for the value being encoded. Select the negotiated type map and do not send an unmapped variant.
 `ReservedCommunicationType` means application code attempted to use a reserved wire ID. Use generated communication types instead of assigning protocol IDs manually. `MissingField` means a required typed field was not present.
--- a/docs/TYPE-MAP.md
+++ b/docs/TYPE-MAP.md
@ -1,14 +1,8 @@
 # Type Map
-This file documents the type-map and registry configuration used by MTP. The
+This file documents the Type Map & Registry configuration used by the MTP protocol. It will assume you are working with the [example-type-maps.yaml](./../example-type-maps.yaml).
-repository workspace uses [`example/type-maps.yaml`](../example/type-maps.yaml)
+A type musn't be the version of MTP, it stays independant.
-through [`.cargo/config.toml`](../.cargo/config.toml); that map currently
+MTP version defines the codec. The Type-Map version defines the available Types.
 selects protocol version 3.0. The root [`example-type-maps.yaml`](../example-type-maps.yaml)
 is a separate illustrative multi-version configuration used by the manual WASM
 build script. Downstream applications should provide their own map.
 The protocol version selects the generated codec/type-map build, while the
 type-map entries define the available application types and their IDs.
 ## Binary Frame Format
@ -137,7 +131,7 @@ After editing the config and rebuilding, `CommunicationType` and `DataType` enum
 use mtp::type_map::{CommunicationType, DataType, TypeMap};
 let tm = TypeMap::v3_0();
-let id = tm.data_id_enum(DataType::ExampleText).unwrap();
+let id = tm.data_id_enum(DataType::SomeType).unwrap();
 ```
 For native builds with the `registry` feature, the enums are a **union across
@ -151,31 +145,30 @@ compiled by the Vite plugin.
 Encoding/decoding uses a `TypeMap` to resolve type names to wire IDs:
 ```rust
-use mtp::codec::{CommunicationType, CommunicationValue, DataType, DataValue};
+use mtp::codec::{encode, decode, DataValue};
 use mtp::type_map::TypeMap;
-let tm = TypeMap::v3_0();
+let tm = TypeMap::v2_0();
-let value = CommunicationValue::new_with_type_map(CommunicationType::Ping, &tm)
+let value = DataValue::Str("hello".into());
    .add_typed(DataType::Description, &tm, DataValue::Str("hello".into()));
-let bytes = value.to_bytes().unwrap();
+let bytes = encode(&value, &tm).unwrap();
-let decoded = CommunicationValue::from_bytes_with(&bytes, &tm).unwrap();
+let decoded = decode(&bytes, &tm).unwrap();
 ```
 ```rust
 let tm_v3 = TypeMap::v3_0();
-assert!(tm_v3.data_id_enum(DataType::ExampleText).is_some());
+assert!(tm_v3.data_id_enum(DataType::SomeType).is_some());
 ```
-When communicating with a peer on another version, encode only variants that map in the negotiated version. If an incoming frame names a type absent from the selected map, reject it as a protocol or type-map compatibility error; do not reinterpret its wire ID using another version's map. The current repository map uses the self-delimiting codec format for protocol version `3.0`; a custom registry may register other version numbers, but those maps are not legacy wire-format fallbacks.
+When communicating with a peer on another version, encode only variants that map in the negotiated version. If an incoming frame names a type absent from the selected map, reject it as a protocol or type-map compatibility error; do not reinterpret its wire ID using another version's map. The self-delimiting codec begins at protocol version `3.0`; older versions are not codec fallbacks.
 ### Forward/Backward Compatibility Between Versions
 Because enums are a union of all types across versions, a variant might exist that has no wire mapping in the *negotiated* version:
 ```
-v3.0 client sends DataType::ExampleText → host encodes with v3.0 TypeMap → wire ID 43
+v3.0 client sends DataType::SomeType    → host encodes with v3.0 TypeMap → wire ID 32
-v3.0 host receives a version absent from the registry                 → version negotiation error
+v3.0 host receives an unsupported pre-v3.0 peer                    → version negotiation error
 ```
 Encoding a frame with an unmapped communication or data type returns `CodecError::UnknownCommunicationType` or `CodecError::UnknownDataType`. Select a mapped variant from the compiled-in version before sending it.
--- a/docs/WASM-CLIENT.md
+++ b/docs/WASM-CLIENT.md
@ -104,9 +104,6 @@ if (!MTPClient.isSupported()) {
 | `requestTimeoutMs` | 30 seconds | Default `request()` timeout. |
 | `pings` | `false` | Protocol pings, or an object with `intervalMs`. |
 | `logger` | No-op | Receives SDK state and error events. |
 | `schemas` | None | Client-wide request and response schema registry. |
 | `throwProtocolErrors` | `false` | Reject requests whose correlated response is an `Error*` frame. |
 | `onValidationError` | No-op | Receives subscription validation failures. |
 | `sessionStorage` | In-memory | E2EE session state storage. |
 | `encryptedSecretProvider` | In-memory | Independent caller-managed encrypted secret storage. |
 | `defaultSignatureVerificationPolicy` | `"ed25519"` | Receiver policy for protected signatures. |
@ -474,60 +471,6 @@ const unsubscribe = client.subscribe("SomeType", (message) => {
 unsubscribe();
 ```
 ### Zod request and response schemas
 Applications can provide their request and response schemas once when creating
 the client. MTP uses `parseAsync`, so synchronous schemas, async refinements,
 defaults, coercions, and transforms all work. MTP has no runtime dependency on
 Zod; the application supplies its preferred Zod version.
 ```typescript
 import { z } from "zod";
 import { MTPClient, MTPValidationError } from "mtp";
 const schemas = {
  GetUser: {
    request: z.object({ UserId: z.number().int().positive() }),
    response: z.object({
      UserId: z.number().int().positive(),
      Display: z.string(),
    }),
  },
 };
 const client = await MTPClient.create({
  url,
  schemas,
  throwProtocolErrors: true,
  onValidationError(error) {
    console.error(error.messageType, error.cause);
  },
 });
 const response = await client.request("GetUser", { UserId: 42 });
 console.log(response.data.Display);
 ```
 Request schemas run before frame encoding and transmission. Their transformed
 output is sent. Response schemas run after request correlation, and their
 transformed output replaces `frame.data`; `frame.raw`, when present, remains the
 original wire frame. Invalid requests and responses reject with
 `MTPValidationError`. Invalid subscription messages do not reach the handler
 and are reported through `onValidationError`.
 `throwProtocolErrors: true` converts correlated `Error*` frames into
 `MTPProtocolError`. It defaults to `false` for compatibility.
 `MTPProxyConnection` applies the same schema registry to another TypeScript
 request/subscription transport, such as a Tauri command and event proxy:
 ```typescript
 const connection = new MTPProxyConnection(adapter, {
  schemas,
  throwProtocolErrors: true,
 });
 ```
 Protocol ping behavior is defined in [Protocol Reference](PROTOCOL-REFERENCE.md#protocol-keepalive). The SDK configuration is:
 ```typescript
@ -659,19 +602,8 @@ The SDK logger receives parsed events:
 ```typescript
 type MTPLogEvent =
-  | {
+  | { hint: "info" | "warning"; type: string; data: unknown }
-      hint: "info" | "warning";
+  | { hint: "error"; type: string | "error"; error: string };
      type: string;
      data: unknown;
      direction?: "send" | "recv";
    }
  | {
      hint: "error";
      type: string | "error";
      error: string;
      data?: unknown;
      direction?: "send" | "recv";
    };
 ```
 Incoming non-error frames and sent frames are logged as `info`. Error frames and transport errors are logged as `error`.
--- a/example/Cargo.lock
+++ b/example/Cargo.lock
@ -225,9 +225,9 @@ dependencies = [
 [[package]]
 name = "chacha20"
-version = "0.10.2"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.3.0",
@ -1305,6 +1305,7 @@ name = "mtp-common"
 version = "0.3.0"
 dependencies = [
 "quinn",
 "rustls",
 "thiserror 2.0.20",
 "wtransport",
 ]
@ -1313,7 +1314,6 @@ dependencies = [
 name = "mtp-crypto"
 version = "0.3.0"
 dependencies = [
 "argon2",
 "base64 0.22.1",
 "chacha20poly1305",
 "ed25519-dalek",
@ -1337,6 +1337,7 @@ dependencies = [
 name = "mtp-files"
 version = "0.3.0"
 dependencies = [
 "argon2",
 "mtp-crypto",
 "rand",
 "thiserror 2.0.20",
@ -1352,7 +1353,6 @@ dependencies = [
 "mtp-crypto",
 "mtp-transport",
 "rand",
 "thiserror 2.0.20",
 "tokio",
 "tracing",
 "wtransport",
@ -1701,7 +1701,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.2",
+ "chacha20 0.10.1",
 "getrandom 0.4.3",
 "rand_core 0.10.1",
 ]
--- a/example/client/src/messages.rs
+++ b/example/client/src/messages.rs
@ -62,7 +62,7 @@ pub fn build_demo_message(
        )
        .add_typed_default(
            DataType::Timestamp,
-            DataValue::UnsignedNumber(timestamp),
+            DataValue::UnsignedNumber(timestamp as u128),
        )
        .add_typed_default(DataType::Data, DataValue::Str("Hello, MTP!".into()))
        .add_typed_default(DataType::Flags, DataValue::BoolTrue)
--- a/example/client/src/metrics.rs
+++ b/example/client/src/metrics.rs
@ -79,7 +79,6 @@ pub struct ClientMetrics {
 }
 impl ClientMetrics {
    #[cfg(test)]
    pub fn new() -> Self {
        Self {
            sessions: Vec::new(),
--- a/example/server/src/handlers.rs
+++ b/example/server/src/handlers.rs
@ -47,7 +47,7 @@ fn pong(tm: &TypeMap, data: impl Into<String>) -> Result<CommunicationValue, Str
    CommunicationValue::from_comm(CommunicationType::Pong, tm)
        .add_data(desc_id, DataValue::Str("MTP example response".into()))
        .map_err(|e| e.to_string())?
-        .add_data(ts_id, DataValue::UnsignedNumber(now))
+        .add_data(ts_id, DataValue::UnsignedNumber(now as u128))
        .map_err(|e| e.to_string())?
        .add_data(data_id, DataValue::Str(data.into()))
        .map_err(|e| e.to_string())
@ -388,7 +388,7 @@ pub fn process_and_respond(
    let response = CommunicationValue::from_comm(CommunicationType::Pong, tm)
        .add_data(desc_id, description)
        .map_err(|e| e.to_string())?
-        .add_data(ts_id, DataValue::UnsignedNumber(now))
+        .add_data(ts_id, DataValue::UnsignedNumber(now as u128))
        .map_err(|e| e.to_string())?
        .add_data(
            data_id,
--- a/example/server/src/main.rs
+++ b/example/server/src/main.rs
@ -38,7 +38,6 @@ async fn handle_pipe_loopback(
    conn: &mtp::webserver::WebMTPConnection,
    request: mtp::host::PipeRequest<
        mtp::webserver::WebMtpSender,
        mtp::webserver::WebMtpReceiver,
        mtp::webserver::H3TransportReceiver,
    >,
 ) -> Result<u64, Box<dyn std::error::Error>> {
@ -101,10 +100,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                serde_json::to_string_pretty(&*db).ok()
            };
-            if let Some(json) = json
+            if let Some(json) = json {
-                && let Err(error) = tokio::fs::write("clients.json", json).await
+                if let Err(error) = tokio::fs::write("clients.json", json).await {
-            {
+                    eprintln!("Failed to persist clients.json: {error}");
-                eprintln!("Failed to persist clients.json: {error}");
+                }
            }
            println!("Registered new client with ID: {id}");
--- a/example/server/src/metrics.rs
+++ b/example/server/src/metrics.rs
@ -108,7 +108,6 @@ pub struct ServerMetrics {
 }
 impl ServerMetrics {
    #[cfg(test)]
    pub fn new() -> Self {
        Self {
            inner: Mutex::new(Inner {
@ -219,7 +218,6 @@ impl ServerMetrics {
        }
    }
    #[cfg(test)]
    pub fn snapshot(&self) -> ServerMetricsFile {
        let inner = self.inner.lock().unwrap();
        self.to_file(&inner)
@ -555,11 +553,11 @@ mod tests {
        let metrics = ServerMetrics::new();
        for i in 0..3 {
-            let mut session = metrics.start_session(1000 + i, format!("session {i}"));
+            let mut session = metrics.start_session(1000 + i as u64, format!("session {i}"));
            for _ in 0..(i + 1) * 2 {
                session.record_message(Duration::from_millis(1 + i), true);
            }
-            session.record_pipe((i + 1) * 1000);
+            session.record_pipe((i as u64 + 1) * 1000);
            session.finish(format!("exit {i}"));
        }
--- a/flake.nix
+++ b/flake.nix
@ -5,30 +5,26 @@
    rust-overlay.url = "github:oxalica/rust-overlay";
  };
-  outputs =
+  outputs = {
-    {
+    self,
-      self,
+    nixpkgs,
-      nixpkgs,
+    rust-overlay,
-      rust-overlay,
+  }: let
-    }:
+    systems = [
-    let
+      "aarch64-darwin"
-      systems = [
+      "aarch64-linux"
-        "aarch64-darwin"
+      "x86_64-darwin"
-        "aarch64-linux"
+      "x86_64-linux"
-        "x86_64-darwin"
+    ];
-        "x86_64-linux"
+    eachSystem = f:
-      ];
+      nixpkgs.lib.foldl' nixpkgs.lib.recursiveUpdate {} (
-      eachSystem =
+        map (system: nixpkgs.lib.mapAttrs (_: value: {${system} = value;}) (f system)) systems
-        f:
+      );
-        nixpkgs.lib.foldl' nixpkgs.lib.recursiveUpdate { } (
+  in
          map (system: nixpkgs.lib.mapAttrs (_: value: { ${system} = value; }) (f system)) systems
        );
    in
    eachSystem (
-      system:
+      system: let
-      let
+        overlays = [rust-overlay.overlays.default];
-        overlays = [ rust-overlay.overlays.default ];
+        pkgs = import nixpkgs {inherit system overlays;};
        pkgs = import nixpkgs { inherit system overlays; };
        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
          extensions = [
@ -36,12 +32,12 @@
            "clippy"
            "rustfmt"
          ];
-          targets = [ "wasm32-unknown-unknown" ];
+          targets = ["wasm32-unknown-unknown"];
        };
        clippyCheck = pkgs.writeShellApplication {
          name = "mtp-clippy";
-          runtimeInputs = [ rustToolchain ];
+          runtimeInputs = [rustToolchain];
          text = ''
            export MTP_TYPE_MAPS="''${MTP_TYPE_MAPS:-$PWD/example/type-maps.yaml}"
            cargo clippy --workspace --exclude mtp-wasm --all-targets --all-features -- -D warnings -W unreachable-pub
@ -50,7 +46,7 @@
        macheteCheck = pkgs.writeShellApplication {
          name = "mtp-machete";
-          runtimeInputs = [ pkgs.cargo-machete ];
+          runtimeInputs = [pkgs.cargo-machete];
          text = ''
            cargo machete "$@"
          '';
@ -58,15 +54,7 @@
        buildAll = pkgs.writeShellApplication {
          name = "mtp-build-all";
-          runtimeInputs = [
+          runtimeInputs = [rustToolchain pkgs.cargo-deny pkgs.wasm-pack pkgs.pnpm pkgs.coreutils clippyCheck macheteCheck];
            rustToolchain
            pkgs.cargo-deny
            pkgs.wasm-pack
            pkgs.pnpm
            pkgs.coreutils
            clippyCheck
            macheteCheck
          ];
          text = ''
            export MTP_TYPE_MAPS="''${MTP_TYPE_MAPS:-$PWD/example/type-maps.yaml}"
@ -78,6 +66,7 @@
              cargo check --manifest-path example/Cargo.toml --workspace --all-targets --all-features
            mtp-clippy
            mtp-machete
            pnpm run dup
            pnpm run build
            RUSTFLAGS="--cfg web_sys_unstable_apis" wasm-pack test --node wasm
            pnpm run test:e2e
@ -90,17 +79,13 @@
        healthCheck = pkgs.writeShellApplication {
          name = "mtp-health";
-          runtimeInputs = [
+          runtimeInputs = [clippyCheck macheteCheck];
            clippyCheck
            macheteCheck
          ];
          text = ''
            mtp-clippy
            mtp-machete
          '';
        };
-      in
+      in {
      {
        devShells = {
          default = pkgs.mkShell {
            name = "mtp-dev";
--- a/host/src/config.rs
+++ b/host/src/config.rs
@ -251,8 +251,6 @@ pub struct HostConfig {
    #[cfg(feature = "crypto")]
    pub authentication_policy: AuthenticationPolicy,
    #[cfg(feature = "crypto")]
    authentication_policy_explicit: bool,
    #[cfg(feature = "crypto")]
    pub auth_timeout: Duration,
    #[cfg(feature = "crypto")]
    pub require_pq: bool,
@ -290,8 +288,6 @@ impl HostConfig {
            #[cfg(feature = "crypto")]
            authentication_policy: AuthenticationPolicy::Unauthenticated,
            #[cfg(feature = "crypto")]
            authentication_policy_explicit: false,
            #[cfg(feature = "crypto")]
            auth_timeout: Duration::from_secs(30),
            #[cfg(feature = "crypto")]
            require_pq: true,
@ -345,9 +341,7 @@ impl HostConfig {
        get_existing_client: GetExistingClient,
        complete_register: CompleteRegister,
    ) -> Self {
-        if !self.authentication_policy_explicit {
+        self.authentication_policy = AuthenticationPolicy::ForceAuthentication;
            self.authentication_policy = AuthenticationPolicy::ForceAuthentication;
        }
        self.host_keyring = host_keyring;
        self.get_existing_client = Box::new(get_existing_client);
        self.complete_register = Box::new(complete_register);
@ -357,7 +351,6 @@ impl HostConfig {
    #[cfg(feature = "crypto")]
    pub fn with_authentication_policy(mut self, policy: AuthenticationPolicy) -> Self {
        self.authentication_policy = policy;
        self.authentication_policy_explicit = true;
        self
    }
@ -448,78 +441,4 @@ mod tests {
                .expect("repeated registration decision")
        );
    }
    fn test_keyring() -> mtp_crypto::Keyring {
        mtp_crypto::Keyring::new(
            mtp_crypto::KemPublicKey::new(Vec::new()),
            mtp_crypto::KemPrivateKey::new(Vec::new()),
            mtp_crypto::SignaturePqPublicKey::new(Vec::new()),
            mtp_crypto::SignaturePqPrivateKey::new(Vec::new()),
            mtp_crypto::SignaturePublicKey::new(Vec::new()),
            mtp_crypto::SignaturePrivateKey::new(Vec::new()),
        )
    }
    fn test_get_existing_client() -> GetExistingClient {
        Box::new(|_, _| Box::pin(async { None }))
    }
    fn test_complete_register() -> CompleteRegister {
        Box::new(|_, _| Box::pin(async { 1 }))
    }
    fn test_config() -> HostConfig {
        HostConfig::new(
            IpAddr::V4(std::net::Ipv4Addr::LOCALHOST),
            4433,
            Vec::new(),
            Vec::new(),
        )
    }
    #[test]
    fn with_authentication_defaults_to_force_authentication() {
        let config = test_config().with_authentication(
            test_keyring(),
            test_get_existing_client(),
            test_complete_register(),
        );
        assert_eq!(
            config.authentication_policy,
            AuthenticationPolicy::ForceAuthentication
        );
    }
    #[test]
    fn explicit_authentication_policy_before_with_authentication_is_preserved() {
        let config = test_config()
            .with_authentication_policy(AuthenticationPolicy::AllowAuthentication)
            .with_authentication(
                test_keyring(),
                test_get_existing_client(),
                test_complete_register(),
            );
        assert_eq!(
            config.authentication_policy,
            AuthenticationPolicy::AllowAuthentication
        );
    }
    #[test]
    fn explicit_authentication_policy_after_with_authentication_is_preserved() {
        let config = test_config()
            .with_authentication(
                test_keyring(),
                test_get_existing_client(),
                test_complete_register(),
            )
            .with_authentication_policy(AuthenticationPolicy::AllowAuthentication);
        assert_eq!(
            config.authentication_policy,
            AuthenticationPolicy::AllowAuthentication
        );
    }
 }
--- a/host/src/connection.rs
+++ b/host/src/connection.rs
@ -73,7 +73,7 @@ pub struct MTPConnection<
    #[cfg(feature = "pipes")]
    pub(crate) app_rx: Mutex<mpsc::Receiver<Result<CommunicationValue, CommunicationError>>>,
    #[cfg(feature = "pipes")]
-    pub(crate) pipe_req_rx: Mutex<mpsc::Receiver<PipeRequest<S, R, P>>>,
+    pub(crate) pipe_req_rx: Mutex<mpsc::Receiver<PipeRequest<S, P>>>,
    #[cfg(feature = "pipes")]
    pub(crate) pipe_dispatcher: Arc<PipeDispatcher<P>>,
    #[cfg(not(feature = "pipes"))]
@ -381,7 +381,7 @@ where
        })
    }
-    pub async fn receive_pipe(&self) -> Result<PipeRequest<S, R, P>, CommunicationError> {
+    pub async fn receive_pipe(&self) -> Result<PipeRequest<S, P>, CommunicationError> {
        self.pipe_req_rx
            .lock()
            .await
--- a/host/src/engine.rs
+++ b/host/src/engine.rs
@ -217,12 +217,6 @@ impl HandshakeEngine {
        _authentication_context: &AuthenticationContext,
    ) -> Result<HandshakeResult, AcceptError> {
        let mut first_msg = receiver.receive().await.map_err(AcceptError::Receive)?;
        tracing::debug!(
            message_type = ?first_msg.get_type(),
            version = ?first_msg.get_str(DataType::Version),
            client_id = ?first_msg.get_data(DataType::Id),
            "received MTP opening message"
        );
        let version_str = match first_msg.get_data(DataType::Version) {
            Some(DataValue::Str(s)) => s.clone(),
@ -277,11 +271,6 @@ impl HandshakeEngine {
                return Err(AcceptError::UnsupportedVersion(client_version));
            }
        };
        tracing::debug!(
            client_version = %client_version,
            negotiated_version = %negotiated,
            "MTP protocol version negotiated"
        );
        let codec = VersionedCodec::for_version(self.registry.clone(), negotiated.clone())
            .ok_or_else(|| AcceptError::UnsupportedVersion(negotiated.clone()))?;
@ -309,12 +298,6 @@ impl HandshakeEngine {
            ) || registration
                || first_msg.get_data(DataType::PublicKeys).is_some()
                || claimed_client_id.is_some_and(|client_id| client_id != 0);
            tracing::info!(
                claimed_client_id = ?claimed_client_id,
                registration,
                authentication_requested,
                "classified MTP opening authentication mode"
            );
            if authentication_requested {
                let attempt = crate::config::AuthenticationAttempt {
                    peer_network_identity: _authentication_context.peer_network_identity.clone(),
@ -572,7 +555,6 @@ impl HandshakeEngine {
            }
            // Unknown or zero ID: fall back to guest
            tracing::info!("allocating MTP guest identity");
            let guest_id_lease = match self.assign_guest_id().await {
                Ok(lease) => lease,
                Err(error) => {
@ -581,7 +563,6 @@ impl HandshakeEngine {
                }
            };
            let guest_id = guest_id_lease.id;
            tracing::info!(guest_id, "allocated MTP guest identity");
            send_accepted_generic(sender, &negotiated, tm, Some(guest_id))
                .await
                .map_err(AcceptError::Send)?;
@ -1124,12 +1105,6 @@ async fn send_rejection_generic<S: HandshakeSender>(
        .add_typed_default(DataType::Connected, DataValue::BoolFalse)
        .add_typed_default(DataType::ErrorMessage, DataValue::Str(reason.to_string())),
    };
    tracing::debug!(
        reason = %reason,
        response_type = ?response.get_type(),
        has_version = response.get_data(DataType::Version).is_some(),
        "sending MTP handshake rejection"
    );
    let _ = sender.send(&response).await;
 }
@ -1163,11 +1138,6 @@ async fn send_accepted_generic<S: HandshakeSender>(
    if let Some(id) = assigned_id {
        response = response.add_typed_default(DataType::Id, DataValue::UnsignedNumber(id as u128));
    }
    tracing::debug!(
        version = %version,
        assigned_id = ?assigned_id,
        "sending accepted MTP handshake response"
    );
    sender.send(&response).await?;
    sender.finish_stream().await
 }
--- a/host/src/pipe.rs
+++ b/host/src/pipe.rs
@ -27,10 +27,6 @@ pub trait PipeReceiver<P>: Clone + Send + Sync + 'static
 where
    P: tokio::io::AsyncRead + Send + Unpin + 'static,
 {
    fn expect_pipe(&self, pipe_id: u32) -> Result<(), CommunicationError>;
    fn cancel_expected_pipe(&self, pipe_id: u32);
    fn receive_pipe_event(
        &self,
    ) -> impl std::future::Future<Output = Result<TransportEvent<P>, CommunicationError>> + Send;
@ -56,14 +52,6 @@ impl PipeSender for mtp_transport::Sender {
 }
 impl PipeReceiver<wtransport::RecvStream> for mtp_transport::Receiver {
    fn expect_pipe(&self, pipe_id: u32) -> Result<(), CommunicationError> {
        self.expect_pipe(pipe_id)
    }
    fn cancel_expected_pipe(&self, pipe_id: u32) {
        self.cancel_expected_pipe(pipe_id);
    }
    async fn receive_pipe_event(
        &self,
    ) -> Result<TransportEvent<wtransport::RecvStream>, CommunicationError> {
@ -99,14 +87,6 @@ where
    C: mtp_transport::TransportConnection,
    C::RecvStream: tokio::io::AsyncRead + Send + Unpin + 'static,
 {
    fn expect_pipe(&self, pipe_id: u32) -> Result<(), CommunicationError> {
        self.expect_pipe(pipe_id)
    }
    fn cancel_expected_pipe(&self, pipe_id: u32) {
        self.cancel_expected_pipe(pipe_id);
    }
    async fn receive_pipe_event(
        &self,
    ) -> Result<TransportEvent<C::RecvStream>, CommunicationError> {
@ -172,60 +152,16 @@ where
    }
 }
-pub struct PipeRequest<S, R, P> {
+pub struct PipeRequest<S, P> {
    pub(crate) pipe_id: u32,
    pub(crate) description: String,
    pub(crate) sender: S,
    pub(crate) receiver: R,
    pub(crate) dispatcher: Arc<PipeDispatcher<P>>,
 }
-struct ExpectedPipeGuard<R, P>
+impl<S, P> PipeRequest<S, P>
 where
    R: PipeReceiver<P>,
    P: tokio::io::AsyncRead + Send + Unpin + 'static,
 {
    receiver: R,
    pipe_id: u32,
    armed: bool,
    _stream: std::marker::PhantomData<P>,
 }
 impl<R, P> ExpectedPipeGuard<R, P>
 where
    R: PipeReceiver<P>,
    P: tokio::io::AsyncRead + Send + Unpin + 'static,
 {
    fn new(receiver: R, pipe_id: u32) -> Self {
        Self {
            receiver,
            pipe_id,
            armed: true,
            _stream: std::marker::PhantomData,
        }
    }
    fn disarm(&mut self) {
        self.armed = false;
    }
 }
 impl<R, P> Drop for ExpectedPipeGuard<R, P>
 where
    R: PipeReceiver<P>,
    P: tokio::io::AsyncRead + Send + Unpin + 'static,
 {
    fn drop(&mut self) {
        if self.armed {
            self.receiver.cancel_expected_pipe(self.pipe_id);
        }
    }
 }
 impl<S, R, P> PipeRequest<S, R, P>
 where
    S: PipeSender,
    R: PipeReceiver<P>,
    P: tokio::io::AsyncRead + Send + Unpin + 'static,
 {
    pub fn id(&self) -> u32 {
@ -237,10 +173,6 @@ where
    }
    pub async fn accept(self) -> Result<PipeReader<P>, PipeError> {
        self.receiver
            .expect_pipe(self.pipe_id)
            .map_err(PipeError::from)?;
        let mut expected_pipe = ExpectedPipeGuard::<R, P>::new(self.receiver.clone(), self.pipe_id);
        let (pipe_tx, pipe_rx) = tokio::sync::oneshot::channel();
        self.dispatcher
            .pending_pipes
@ -264,10 +196,7 @@ where
        }
        match tokio::time::timeout(self.dispatcher.policy.read_timeout, pipe_rx).await {
-            Ok(Ok(reader)) => {
+            Ok(Ok(reader)) => Ok(reader),
                expected_pipe.disarm();
                Ok(reader)
            }
            Ok(Err(_)) => {
                self.dispatcher
                    .pending_pipes
@ -432,7 +361,7 @@ pub(crate) async fn run_dispatcher<S, R, P>(
    receiver: R,
    sender: S,
    app_tx: mpsc::Sender<Result<CommunicationValue, CommunicationError>>,
-    pipe_req_tx: mpsc::Sender<PipeRequest<S, R, P>>,
+    pipe_req_tx: mpsc::Sender<PipeRequest<S, P>>,
    dispatcher: Arc<PipeDispatcher<P>>,
 ) where
    S: PipeSender,
@ -459,7 +388,6 @@ pub(crate) async fn run_dispatcher<S, R, P>(
                            .unwrap_or("")
                            .to_owned(),
                        sender: sender.clone(),
                        receiver: receiver.clone(),
                        dispatcher: dispatcher.clone(),
                    };
                    let _ = pipe_req_tx.send(request).await;
@ -518,7 +446,6 @@ pub(crate) async fn run_dispatcher<S, R, P>(
                    pipe_id,
                    description: reader.description().to_owned(),
                    sender: sender.clone(),
                    receiver: receiver.clone(),
                    dispatcher: dispatcher.clone(),
                };
                let _ = pipe_req_tx.send(request).await;
--- a/mtp-webserver/src/h3.rs
+++ b/mtp-webserver/src/h3.rs
@ -143,11 +143,6 @@ pub(crate) async fn run_driver(
                                    return;
                                }
                            };
                            tracing::debug!(
                                remote = %remote_addr,
                                session_id = ?session.session_id(),
                                "accepted WebTransport MTP session"
                            );
                            tokio::spawn(run_session_requests(
                                session.clone(),
                                router.clone(),
--- a/mtp-webserver/src/transport.rs
+++ b/mtp-webserver/src/transport.rs
@ -32,8 +32,6 @@ pub struct H3TransportSender {
 pub struct H3TransportReceiver {
    stream: H3RecvStream,
    quinn: quinn::Connection,
    read_exact_calls: u64,
 }
 impl H3TransportConnection {
@ -57,14 +55,14 @@ impl TransportSendStream for H3TransportSender {
        self.stream
            .write_all(buf)
            .await
-            .map_err(|_| CommunicationError::DeliveryUnknown)?;
+            .map_err(|_| CommunicationError::StreamError)?;
        // Control/authentication frames use a persistent stream. h3 keeps
        // those writes buffered until flushed; without this the peer can wait
        // for the challenge while the server waits for its proof.
        self.stream
            .flush()
            .await
-            .map_err(|_| CommunicationError::DeliveryUnknown)
+            .map_err(|_| CommunicationError::StreamError)
    }
    async fn finish(&mut self) -> Result<(), CommunicationError> {
@ -73,53 +71,23 @@ impl TransportSendStream for H3TransportSender {
            .await
            .map_err(|_| CommunicationError::StreamError)
    }
    fn reset(&mut self, code: u32) -> Result<(), CommunicationError> {
        h3::quic::SendStream::reset(&mut self.stream, code as u64);
        Ok(())
    }
 }
 #[async_trait::async_trait]
 impl TransportRecvStream for H3TransportReceiver {
    async fn read_exact(&mut self, buf: &mut [u8]) -> Result<(), CommunicationError> {
        let first_read = self.read_exact_calls == 0;
        self.read_exact_calls += 1;
        self.stream
            .read_exact(buf)
            .await
-            .map(|_| {
+            .map(|_| ())
                if first_read {
                    tracing::debug!(
                        remote = %self.quinn.remote_address(),
                        bytes = buf.len(),
                        header = ?buf,
                        "received first bytes from WebTransport MTP stream"
                    );
                }
            })
            .map_err(|error| {
-                if error.kind() == std::io::ErrorKind::UnexpectedEof
+                if error.kind() == std::io::ErrorKind::UnexpectedEof {
-                    || self.quinn.close_reason().is_some()
+                    // Browser control frames are sent on one-frame uni streams.
-                {
+                    // Reaching FIN while looking for another frame is normal.
                    /*
                     * Reaching FIN, or losing the enclosing QUIC connection,
                     * is a normal stream-closure path. Do not turn it into a
                     * frame-header failure and close the connection again.
                     */
                    return CommunicationError::StreamClosed;
                }
-                error!(
+                error!("[mtp-webserver] receive stream read_exact failed ({} bytes): {error}", buf.len());
-                    "[mtp-webserver] receive stream read_exact failed ({} bytes): {error}",
+                tracing::warn!(len = buf.len(), %error, "WebTransport receive stream read_exact failed");
                    buf.len()
                );
                tracing::warn!(
                    remote = %self.quinn.remote_address(),
                    first_read,
                    len = buf.len(),
                    %error,
                    "WebTransport receive stream read_exact failed"
                );
                CommunicationError::StreamError
            })
    }
@ -133,9 +101,6 @@ impl TransportRecvStream for H3TransportReceiver {
                Ok(Some(buf))
            }
            Err(error) => {
                if self.quinn.close_reason().is_some() {
                    return Err(CommunicationError::StreamClosed);
                }
                error!(
                    "[mtp-webserver] receive stream read failed (max {} bytes): {error}",
                    max
@ -145,11 +110,6 @@ impl TransportRecvStream for H3TransportReceiver {
            }
        }
    }
    fn stop(mut self, code: u32) -> Result<(), CommunicationError> {
        h3::quic::RecvStream::stop_sending(&mut self.stream, code as u64);
        Ok(())
    }
 }
 impl tokio::io::AsyncWrite for H3TransportSender {
@ -207,27 +167,10 @@ impl TransportConnection for H3TransportConnection {
        loop {
            match self.session.accept_uni().await {
                Ok(Some((id, stream))) if id == self.session.session_id() => {
-                    let stream_id = h3::quic::RecvStream::recv_id(&stream);
+                    return Ok(H3TransportReceiver { stream });
                    tracing::debug!(
                        remote = %self.quinn.remote_address(),
                        session_id = ?self.session.session_id(),
                        stream_id = ?stream_id,
                        "accepted WebTransport MTP receive stream"
                    );
                    return Ok(H3TransportReceiver {
                        stream,
                        quinn: self.quinn.clone(),
                        read_exact_calls: 0,
                    });
                }
-                Ok(Some((stream_session_id, _stream))) => {
+                Ok(Some(_)) => {
                    consecutive_errors = 0;
                    tracing::debug!(
                        remote = %self.quinn.remote_address(),
                        session_id = ?self.session.session_id(),
                        stream_session_id = ?stream_session_id,
                        "ignored WebTransport receive stream belonging to another session"
                    );
                    continue;
                }
                Ok(None) => return Err(CommunicationError::StreamClosed),
@ -363,18 +306,7 @@ async fn accept_web_connection_inner(
                connection_id,
            },
        )
-        .await;
+        .await?;
    #[cfg(feature = "crypto")]
    if let Err(error) = &result {
        tracing::warn!(
            remote = %remote_addr,
            connection_id,
            %error,
            "WebTransport MTP handshake failed"
        );
    }
    #[cfg(feature = "crypto")]
    let result = result?;
    #[cfg(not(feature = "crypto"))]
    let result = engine.accept(&sender, &receiver).await?;
--- a/package.json
+++ b/package.json
@ -61,6 +61,7 @@
    "pack": "pnpm run release:web",
    "release:web": "node create-web-release.mjs",
    "build:all": "nix run .#build-all",
    "dup": "jscpd --pattern '**/*.{rs,ts}' --ignore 'target/**' --ignore 'wasm/pkg/**' --ignore '.git/**' --min-lines 8 --min-tokens 80 --threshold 4 --reporters console --noTips .",
    "test:e2e": "tsc && node test/e2ee.mjs",
    "test:secrets": "tsc && node --test --test-isolation=none test/encrypted-secret.mjs",
    "test:wasm-init": "tsc && node --test test/wasm-init.mjs",
@ -71,7 +72,7 @@
  },
  "devDependencies": {
    "@types/node": "^26.0.1",
-    "jscpd": "5.0.14",
+    "jscpd": "4.2.5",
    "typescript": "^7.0.0"
  },
  "dependencies": {
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
--- a/src/sdk/client.ts
+++ b/src/sdk/client.ts
@ -10,15 +10,6 @@ import * as bindings from "mtp/raw";
 import { unixTimeMillis, utf8Encode } from "./utils.js";
 import type * as RawBindings from "../raw/index";
 import type { MTPCommunicationType } from "../type-map/index";
 import { MTPProtocol } from "./schema.js";
 import type {
  MTPMessageType,
  MTPFrame,
  MTPNoSchemas,
  MTPRequestData,
  MTPResponseFrame,
  MTPSchemaRegistry,
 } from "./schema.js";
 import type { MTPSessionStorage, MTPSessionState } from "./session";
 import { MTPSessionManager } from "./session.js";
 import {
@ -258,9 +249,7 @@ export interface MTPPublicKeyBundleKeys {
  sigClPublicKey: Uint8Array;
 }
-export interface MTPClientOptions<
+export interface MTPClientOptions {
  Registry extends MTPSchemaRegistry = MTPNoSchemas,
 > {
  url: string;
  descriptor?: string;
  hostPublicKey?: MTPKeyMaterialInput;
@ -293,12 +282,6 @@ export interface MTPClientOptions<
  securityProfile?: MTPSecurityProfile;
  /** One receive resource policy shared by frame and protected-value opening. */
  receiveLimits?: MTPReceiveLimits;
  /** Application request and response schemas, keyed by communication type. */
  schemas?: Registry;
  /** Reject `request()` when the correlated response is an `Error*` frame. */
  throwProtocolErrors?: boolean;
  /** Receives subscription validation failures. Request failures reject normally. */
  onValidationError?: (error: import("./schema.js").MTPValidationError) => void;
 }
 export interface MTPSecurityProfile {
@ -579,8 +562,8 @@ export interface MTPAcceptEncryptedPipeOptions {
  signaturePolicy?: MTPSignatureVerificationPolicy;
 }
-type NormalizedMTPClientOptions<Registry extends MTPSchemaRegistry> = Omit<
+type NormalizedMTPClientOptions = Omit<
-  MTPClientOptions<Registry>,
+  MTPClientOptions,
  "hostPublicKey" | "receiveLimits"
 > & {
  hostPublicKey?: Uint8Array;
@ -931,34 +914,14 @@ function validateOptions(options) {
  ) {
    throw new TypeError("requestTimeoutMs must be a positive safe integer");
  }
  if (options.schemas != null) {
    if (typeof options.schemas !== "object" || Array.isArray(options.schemas)) {
      throw new TypeError("schemas must be an object");
    }
    for (const [type, pair] of Object.entries(options.schemas)) {
      if (
        !pair ||
        typeof pair !== "object" ||
        typeof (pair as { request?: { parseAsync?: unknown } }).request
          ?.parseAsync !== "function" ||
        typeof (pair as { response?: { parseAsync?: unknown } }).response
          ?.parseAsync !== "function"
      ) {
        throw new TypeError(
          `schemas.${type} must contain request and response schemas with parseAsync()`,
        );
      }
    }
  }
 }
-export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
+export class MTPClient {
  static readonly crypto = crypto;
  static readonly codec = codec;
  #credentials: InternalCredentials | null;
-  #options: NormalizedMTPClientOptions<Registry>;
+  #options: NormalizedMTPClientOptions;
  readonly #protocol: MTPProtocol<Registry> | undefined;
  readonly #protectedReplayGuard = new InMemoryReplayGuard();
  readonly #relayReplayGuard = new InMemoryReplayGuard();
  readonly raw: MTPRaw;
@ -971,17 +934,10 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
  readonly encryptedSecretProvider: MTPEncryptedSecretProvider;
  private constructor(
-    options: NormalizedMTPClientOptions<Registry>,
+    options: NormalizedMTPClientOptions,
    client: RawBindings.WasmClient,
  ) {
    this.#options = options;
    this.#protocol = options.schemas
      ? new MTPProtocol({
          schemas: options.schemas,
          throwProtocolErrors: options.throwProtocolErrors,
          onValidationError: options.onValidationError,
        })
      : undefined;
    this.#credentials = deserializeCredentials(options.credentials);
    this.raw = { client, bindings };
    this.encryptedSecretProvider =
@ -991,11 +947,7 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
    );
  }
-  static async create<
+  static async create(options: MTPClientOptions): Promise<MTPClient> {
    const Registry extends MTPSchemaRegistry = MTPNoSchemas,
  >(
    options: MTPClientOptions<Registry>,
  ): Promise<MTPClient<Registry>> {
    validateOptions(options);
    await MTPClient.init(options.wasm);
@ -1016,7 +968,7 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
      securityProfile: resolveSecurityProfile(options),
    };
-    let sdk: MTPClient<Registry> | undefined;
+    let sdk: MTPClient | undefined;
    const client = new WasmClient(
      (state) =>
        emit(normalizedOptions.logger, {
@ -1052,7 +1004,7 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
      setReceiveLimits.call(rawClient, normalizedOptions.receiveLimits);
    }
-    sdk = new MTPClient<Registry>(normalizedOptions, client);
+    sdk = new MTPClient(normalizedOptions, client);
    await sdk.#loadStoredCredentials();
    if (!sdk.#credentials) {
      sdk.#credentials = {
@ -1286,35 +1238,6 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
    };
  }
  async #parseRequestData(
    type: MTPCommunicationType,
    data: unknown,
  ): Promise<Record<string, unknown>> {
    if (!this.#protocol || !this.#protocol.schemas[type]) {
      return (data ?? {}) as Record<string, unknown>;
    }
    const parsed = await this.#protocol.parseRequest(
      type as MTPMessageType<Registry>,
      data as never,
    );
    return (parsed ?? {}) as Record<string, unknown>;
  }
  async #parseResponseData(
    requestedType: MTPCommunicationType,
    frame: ParsedFrame,
    phase: "response" | "subscription" = "response",
  ): Promise<MTPFrame<unknown>> {
    if (!this.#protocol || !this.#protocol.schemas[requestedType]) {
      return frame;
    }
    return await this.#protocol.parseResponse(
      requestedType as MTPMessageType<Registry>,
      frame,
      phase,
    );
  }
  #buildFrame(typeOrFrame, data, options) {
    if (typeOrFrame instanceof Uint8Array) {
      if (
@ -1356,11 +1279,6 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
  }
  async send(message: Uint8Array): Promise<void>;
  async send<Type extends MTPMessageType<Registry>>(
    type: Type,
    data?: MTPRequestData<Registry, Type>,
    options?: MTPSendOptions,
  ): Promise<void>;
  async send(
    type: MTPCommunicationType,
    data: Record<string, unknown>,
@ -1368,14 +1286,10 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
  ): Promise<void>;
  async send(
    typeOrFrame: Uint8Array | MTPCommunicationType,
-    data?: unknown,
+    data?: Record<string, unknown>,
    options?: MTPSendOptions,
  ): Promise<void> {
-    const parsedData =
+    const message = this.#buildFrame(typeOrFrame, data, options);
      typeof typeOrFrame === "string"
        ? await this.#parseRequestData(typeOrFrame, data)
        : data;
    const message = this.#buildFrame(typeOrFrame, parsedData, options);
    try {
      const frame = this.raw.bindings.parse_frame(message);
@ -1431,11 +1345,6 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
    data?: never,
    options?: MTPRequestOptions,
  ): Promise<ParsedFrame>;
  async request<Type extends MTPMessageType<Registry>>(
    type: Type,
    data?: MTPRequestData<Registry, Type>,
    options?: MTPRequestOptions,
  ): Promise<MTPResponseFrame<Registry, Type>>;
  async request(
    type: MTPCommunicationType,
    data: Record<string, unknown>,
@ -1443,19 +1352,15 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
  ): Promise<ParsedFrame>;
  async request(
    typeOrFrame: Uint8Array | MTPCommunicationType,
-    data?: unknown,
+    data?: Record<string, unknown>,
    options: MTPRequestOptions = {},
-  ): Promise<ParsedFrame | MTPFrame<unknown>> {
+  ): Promise<ParsedFrame> {
    const timeoutMs =
      options.timeoutMs ?? this.#options.requestTimeoutMs ?? 30_000;
    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
      throw new TypeError("request timeoutMs must be a positive safe integer");
    }
-    const parsedData =
+    const frame = this.#buildFrame(typeOrFrame, data, options);
      typeof typeOrFrame === "string"
        ? await this.#parseRequestData(typeOrFrame, data)
        : data;
    const frame = this.#buildFrame(typeOrFrame, parsedData, options);
    try {
      const parsed = this.raw.bindings.parse_frame(frame);
      emit(
@ -1486,29 +1391,16 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
    // The WASM client owns request expiry and its late-response tombstones.
    // Keeping a second Promise timer here can reject the SDK call while the
    // protocol request is still allowed to complete successfully.
-    const response = await this.raw.client.request(
+    return await this.raw.client.request(
      frame,
      options.responseType ?? null,
      timeoutMs,
    );
    return typeof typeOrFrame === "string"
      ? await this.#parseResponseData(typeOrFrame, response)
      : response;
  }
  subscribe<Type extends MTPMessageType<Registry>>(
    type: Type,
    handler: (
      message: MTPResponseFrame<Registry, Type>,
    ) => void | Promise<void>,
  ): Unsubscribe;
  subscribe(
    type: MTPCommunicationType,
-    handler: (message: ParsedFrame) => void | Promise<void>,
+    handler: (message: ParsedFrame) => void,
  ): Unsubscribe;
  subscribe(
    type: MTPCommunicationType,
    handler: (message: any) => void | Promise<void>,
  ): Unsubscribe {
    if (typeof type !== "string" || !type) {
      throw new TypeError("subscription type must be a non-empty string");
@ -1516,25 +1408,8 @@ export class MTPClient<Registry extends MTPSchemaRegistry = MTPNoSchemas> {
    if (typeof handler !== "function") {
      throw new TypeError("subscription handler must be a function");
    }
-    let active = true;
+    const id = this.raw.client.subscribe(type, handler);
-    const id = this.raw.client.subscribe(type, (message) => {
+    return () => this.raw.client.unsubscribe(id);
      if (!this.#protocol || !this.#protocol.schemas[type]) {
        void handler(message);
        return;
      }
      void this.#parseResponseData(type, message, "subscription").then(
        (parsed) => {
          if (active) void handler(parsed);
        },
        (error) => {
          this.#protocol?.reportValidationError(error);
        },
      );
    });
    return () => {
      active = false;
      this.raw.client.unsubscribe(id);
    };
  }
  #handleFrame(frame) {
--- a/src/sdk/index.ts
+++ b/src/sdk/index.ts
@ -5,4 +5,3 @@
 * keeps the package's historical exports stable.
 */
 export * from "./client.js";
 export * from "./schema.js";
--- a/src/sdk/schema.ts
+++ b/src/sdk/schema.ts
@ -1,234 +0,0 @@
 import type { MTPRequestOptions, ParsedFrame, Unsubscribe } from "./client.js";
 import type { MTPCommunicationType } from "../type-map/index.js";
 export interface MTPSchema<Input = unknown, Output = Input> {
  readonly _input: Input;
  readonly _output: Output;
  parseAsync(value: unknown): Promise<Output>;
 }
 export interface MTPSchemaPair<
  Request extends MTPSchema = MTPSchema,
  Response extends MTPSchema = MTPSchema,
 > {
  request: Request;
  response: Response;
 }
 export type MTPSchemaRegistry = Record<string, MTPSchemaPair>;
 export type MTPNoSchemas = Record<never, never>;
 export type MTPSchemaInput<Schema extends MTPSchema> = Schema["_input"];
 export type MTPSchemaOutput<Schema extends MTPSchema> = Schema["_output"];
 export type MTPMessageType<Registry extends MTPSchemaRegistry> =
  keyof Registry & string;
 export type MTPFrame<Data = ParsedFrame["data"]> = {
  id?: number;
  type: string;
  data: Data;
  sender?: ParsedFrame["sender"];
  receiver?: ParsedFrame["receiver"];
  raw?: ParsedFrame["raw"];
 };
 export type MTPTypedFrame<Data = ParsedFrame["data"]> = MTPFrame<Data>;
 export type MTPResponseFrame<
  Registry extends MTPSchemaRegistry,
  Type extends MTPMessageType<Registry>,
 > = MTPTypedFrame<MTPSchemaOutput<Registry[Type]["response"]>>;
 export type MTPRequestData<
  Registry extends MTPSchemaRegistry,
  Type extends MTPMessageType<Registry>,
 > = MTPSchemaInput<Registry[Type]["request"]>;
 export type MTPRequestFunction<Registry extends MTPSchemaRegistry> = <
  Type extends MTPMessageType<Registry>,
 >(
  type: Type,
  data?: MTPRequestData<Registry, Type>,
  options?: MTPRequestOptions,
 ) => Promise<MTPResponseFrame<Registry, Type>>;
 export type MTPSubscriptionFunction<Registry extends MTPSchemaRegistry> = <
  Type extends MTPMessageType<Registry>,
 >(
  type: Type,
  handler: (message: MTPResponseFrame<Registry, Type>) => void | Promise<void>,
 ) => Unsubscribe;
 export class MTPValidationError extends Error {
  readonly phase: "request" | "response" | "subscription";
  readonly messageType: string;
  readonly frame?: MTPFrame;
  constructor(
    phase: MTPValidationError["phase"],
    messageType: string,
    cause: unknown,
    frame?: MTPFrame,
  ) {
    super(`${phase} validation failed for ${messageType}`, { cause });
    this.name = "MTPValidationError";
    this.phase = phase;
    this.messageType = messageType;
    this.frame = frame;
  }
 }
 export class MTPProtocolError extends Error {
  readonly type: string;
  readonly id: number | undefined;
  readonly communicationType: string;
  readonly requestId: number | undefined;
  readonly errorType: string | undefined;
  readonly frame: MTPFrame;
  constructor(frame: MTPFrame) {
    const errorType =
      frame.data &&
      typeof frame.data === "object" &&
      !Array.isArray(frame.data) &&
      typeof (frame.data as Record<string, unknown>).ErrorType === "string"
        ? ((frame.data as Record<string, unknown>).ErrorType as string)
        : undefined;
    super(errorType ? `${frame.type}: ${errorType}` : frame.type);
    this.name = "MTPProtocolError";
    this.type = frame.type;
    this.id = frame.id;
    this.communicationType = frame.type;
    this.requestId = frame.id;
    this.errorType = errorType;
    this.frame = frame;
  }
 }
 export interface MTPProtocolOptions<Registry extends MTPSchemaRegistry> {
  schemas: Registry;
  throwProtocolErrors?: boolean;
  onValidationError?: (error: MTPValidationError) => void;
 }
 function isErrorFrame(frame: MTPFrame): boolean {
  return frame.type.startsWith("Error");
 }
 export class MTPProtocol<Registry extends MTPSchemaRegistry> {
  readonly schemas: Registry;
  readonly #throwProtocolErrors: boolean;
  readonly #onValidationError:
    | ((error: MTPValidationError) => void)
    | undefined;
  constructor(options: MTPProtocolOptions<Registry>) {
    this.schemas = options.schemas;
    this.#throwProtocolErrors = options.throwProtocolErrors ?? false;
    this.#onValidationError = options.onValidationError;
  }
  async parseRequest<Type extends MTPMessageType<Registry>>(
    type: Type,
    data: MTPRequestData<Registry, Type> | undefined,
  ): Promise<MTPSchemaOutput<Registry[Type]["request"]>> {
    try {
      return await this.schemas[type].request.parseAsync(data);
    } catch (error) {
      throw new MTPValidationError("request", type, error);
    }
  }
  async parseResponse<Type extends MTPMessageType<Registry>>(
    requestedType: Type,
    frame: MTPFrame,
    phase: "response" | "subscription" = "response",
  ): Promise<MTPResponseFrame<Registry, Type>> {
    if (isErrorFrame(frame)) {
      if (phase === "response" && this.#throwProtocolErrors) {
        throw new MTPProtocolError(frame);
      }
      return frame as MTPResponseFrame<Registry, Type>;
    }
    const schema =
      this.schemas[frame.type]?.response ??
      this.schemas[requestedType].response;
    try {
      const data = await schema.parseAsync(frame.data);
      return { ...frame, data } as MTPResponseFrame<Registry, Type>;
    } catch (error) {
      throw new MTPValidationError(
        phase,
        frame.type || requestedType,
        error,
        frame,
      );
    }
  }
  reportValidationError(error: unknown): void {
    if (error instanceof MTPValidationError) {
      this.#onValidationError?.(error);
    }
  }
 }
 export interface MTPProxyAdapter {
  request(
    type: MTPCommunicationType,
    data: Record<string, unknown>,
    options?: MTPRequestOptions,
  ): Promise<MTPFrame>;
  subscribe(
    type: MTPCommunicationType,
    handler: (message: MTPFrame) => void,
  ): Unsubscribe;
 }
 export class MTPProxyConnection<Registry extends MTPSchemaRegistry> {
  readonly #adapter: MTPProxyAdapter;
  readonly #protocol: MTPProtocol<Registry>;
  constructor(adapter: MTPProxyAdapter, options: MTPProtocolOptions<Registry>) {
    this.#adapter = adapter;
    this.#protocol = new MTPProtocol(options);
  }
  async request<Type extends MTPMessageType<Registry>>(
    type: Type,
    data?: MTPRequestData<Registry, Type>,
    options?: MTPRequestOptions,
  ): Promise<MTPResponseFrame<Registry, Type>> {
    const parsed = await this.#protocol.parseRequest(type, data);
    const response = await this.#adapter.request(
      type,
      (parsed ?? {}) as Record<string, unknown>,
      options,
    );
    return await this.#protocol.parseResponse(type, response);
  }
  subscribe<Type extends MTPMessageType<Registry>>(
    type: Type,
    handler: (
      message: MTPResponseFrame<Registry, Type>,
    ) => void | Promise<void>,
  ): Unsubscribe {
    let active = true;
    const unsubscribe = this.#adapter.subscribe(type, (message) => {
      void this.#protocol.parseResponse(type, message, "subscription").then(
        (parsed) => {
          if (active) void handler(parsed);
        },
        (error) => {
          this.#protocol.reportValidationError(error);
        },
      );
    });
    return () => {
      active = false;
      unsubscribe();
    };
  }
 }
--- a/transport/src/connection.rs
+++ b/transport/src/connection.rs
@ -4,10 +4,6 @@ use crate::framing::RetryClassifier;
 use crate::pipe::PipeReader;
 use mtp_codec::{CommunicationValue, DecodeError, DecodeLimits, EncodeLimits, TypeMap};
 use mtp_common::CommunicationError;
 #[cfg(feature = "pipes")]
 use mtp_common::{FirstFrameDisposition, classify_first_frame};
 #[cfg(feature = "pipes")]
 use std::collections::HashSet;
 use std::ops::Deref;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicU64, Ordering};
@ -292,15 +288,15 @@ impl Sender {
            Ok(Ok(())) => Ok(()),
            Ok(Err(wtransport::error::StreamWriteError::Stopped(code))) => {
                warn!("[Sender] write failed: peer sent STOP_SENDING (error code {code})");
-                Err(CommunicationError::DeliveryUnknown)
+                Err(CommunicationError::StreamClosed)
            }
            Ok(Err(other)) => {
                warn!("[Sender] write failed: {other}");
-                Err(CommunicationError::DeliveryUnknown)
+                Err(CommunicationError::StreamError)
            }
            Err(_) => {
                warn!("[Sender] write timed out (len={})", bytes.len());
-                Err(CommunicationError::DeliveryUnknown)
+                Err(CommunicationError::StreamError)
            }
        }
    }
@ -402,15 +398,15 @@ impl Sender {
            Ok(Ok(())) => Ok(()),
            Ok(Err(wtransport::error::StreamWriteError::Stopped(code))) => {
                warn!("[Sender] finish failed: peer sent STOP_SENDING (error code {code})");
-                Err(CommunicationError::DeliveryUnknown)
+                Err(CommunicationError::StreamClosed)
            }
            Ok(Err(other)) => {
                warn!("[Sender] finish failed: {other}");
-                Err(CommunicationError::DeliveryUnknown)
+                Err(CommunicationError::StreamError)
            }
            Err(_) => {
                warn!("[Sender] finish timed out");
-                Err(CommunicationError::DeliveryUnknown)
+                Err(CommunicationError::StreamError)
            }
        }
    }
@ -749,8 +745,6 @@ struct ReceiverInner {
    max_message_size: Arc<AtomicU64>,
    type_map: Arc<RwLock<TypeMap>>,
    decode_rejections: Arc<DecodeRejectionCounters>,
    #[cfg(feature = "pipes")]
    expected_pipes: Arc<std::sync::Mutex<HashSet<u32>>>,
 }
 impl Clone for Receiver {
@ -837,10 +831,6 @@ impl Receiver {
        let accept_type_map = type_map.clone();
        let decode_rejections = Arc::new(DecodeRejectionCounters::default());
        let accept_decode_rejections = decode_rejections.clone();
        #[cfg(feature = "pipes")]
        let expected_pipes = Arc::new(std::sync::Mutex::new(HashSet::new()));
        #[cfg(feature = "pipes")]
        let accept_expected_pipes = expected_pipes.clone();
        let stream_limit = Arc::new(Semaphore::new(policy.max_concurrent_stream_tasks.max(1)));
        let accept_stream_limit = stream_limit.clone();
        debug!(
@ -910,8 +900,6 @@ impl Receiver {
                                let stream_max_message_size = accept_max_message_size.clone();
                                let stream_type_map = accept_type_map.clone();
                                let stream_decode_rejections = accept_decode_rejections.clone();
                                #[cfg(feature = "pipes")]
                                let stream_expected_pipes = accept_expected_pipes.clone();
                                tokio::spawn(async move {
                                    let _permit = permit;
@ -947,54 +935,38 @@ impl Receiver {
                                                #[cfg(feature = "pipes")]
                                                {
-                                                    if frame_count == 1 {
+                                                    if msg.is_type(mtp_codec::CommunicationType::PipeRequest)
-                                                        let is_pipe_request = msg.is_type(
+                                                        && frame_count == 1
-                                                            mtp_codec::CommunicationType::PipeRequest,
+                                                    {
-                                                        );
+                                                        let Some(pipe_id) = msg.id().filter(|id| *id != 0) else {
-                                                        let pipe_id = msg.id().filter(|id| *id != 0);
+                                                            let error = CommunicationError::Other(
-                                                        let pipe_is_expected = is_pipe_request && pipe_id.is_some_and(|pipe_id| {
+                                                                "PipeRequest frame must contain a non-zero id".into(),
-                                                            stream_expected_pipes
+                                                            );
-                                                                .lock()
+                                                            let _ = msg_tx_stream.send(Err(error.clone())).await;
-                                                                .is_ok_and(|mut expected| expected.remove(&pipe_id))
+                                                            stream_handle.close(Some(error));
-                                                        });
+                                                            break;
-                                                        let disposition = match classify_first_frame(
+                                                        };
-                                                            is_pipe_request,
+                                                        let description = msg
-                                                            msg.id(),
+                                                            .get_str(mtp_codec::DataType::Description)
-                                                            pipe_is_expected,
+                                                            .unwrap_or("")
-                                                        ) {
+                                                            .to_string();
-                                                            Ok(disposition) => disposition,
+
-                                                            Err(error) => {
+                                                        let pipe_reader = crate::pipe::PipeReader {
-                                                                let _ = msg_tx_stream
+                                                            stream: s,
-                                                                    .send(Err(error.clone()))
+                                                            description,
-                                                                    .await;
+                                                            pipe_id,
                                                                stream_handle.close(Some(error));
                                                                break;
                                                            }
                                                        };
-                                                        if let FirstFrameDisposition::Pipe(pipe_id) = disposition {
+                                                        if pipe_tx_stream
-                                                            let description = msg
+                                                            .send(pipe_reader)
-                                                                .get_str(mtp_codec::DataType::Description)
+                                                            .await
-                                                                .unwrap_or("")
+                                                            .is_err()
-                                                                .to_string();
+                                                        {
-
+                                                            stream_handle.close(Some(
-                                                            let pipe_reader = crate::pipe::PipeReader {
+                                                                CommunicationError::StreamClosed,
-                                                                stream: s,
+                                                            ));
                                                                description,
                                                                pipe_id,
                                                            };
                                                            if pipe_tx_stream
                                                                .send(pipe_reader)
                                                                .await
                                                                .is_err()
                                                            {
                                                                stream_handle.close(Some(
                                                                    CommunicationError::StreamClosed,
                                                                ));
                                                            }
                                                            break;
                                                        }
                                                        break;
                                                    }
                                                }
@ -1139,8 +1111,6 @@ impl Receiver {
                max_message_size,
                type_map,
                decode_rejections,
                #[cfg(feature = "pipes")]
                expected_pipes,
            }),
        }
    }
@ -1157,26 +1127,6 @@ impl Receiver {
        *self.inner.type_map.write().await = type_map.clone();
    }
    #[cfg(feature = "pipes")]
    pub fn expect_pipe(&self, pipe_id: u32) -> Result<(), CommunicationError> {
        if pipe_id == 0 {
            return Err(CommunicationError::Other("pipe id must be non-zero".into()));
        }
        self.inner
            .expected_pipes
            .lock()
            .map_err(|_| CommunicationError::Other("expected pipe state is unavailable".into()))?
            .insert(pipe_id);
        Ok(())
    }
    #[cfg(feature = "pipes")]
    pub fn cancel_expected_pipe(&self, pipe_id: u32) {
        if let Ok(mut expected) = self.inner.expected_pipes.lock() {
            expected.remove(&pipe_id);
        }
    }
    /// Return local counts for frames rejected by the structured decoder.
    ///
    /// These counters are intentionally local-only; peers continue to receive
--- a/transport/src/framing.rs
+++ b/transport/src/framing.rs
@ -82,10 +82,6 @@ mod tests {
        async fn finish(&mut self) -> Result<(), CommunicationError> {
            Ok(())
        }
        fn reset(&mut self, _code: u32) -> Result<(), CommunicationError> {
            Ok(())
        }
    }
    #[tokio::test]
--- a/transport/src/generic_connection.rs
+++ b/transport/src/generic_connection.rs
@ -9,13 +9,9 @@ use crate::{
    connection::{DecodeRejectionCounters, RuntimePolicy, classify_decode_error},
    framing::{RetryClassifier, write_frame},
 };
-use mtp_codec::{CommunicationValue, DataType, DecodeLimits, TypeMap};
+use mtp_codec::{CommunicationValue, DecodeLimits, TypeMap};
-use mtp_common::{CommunicationError, FirstFrameDisposition, classify_first_frame};
+use mtp_common::CommunicationError;
 #[cfg(feature = "pipes")]
 use std::collections::HashSet;
 use std::sync::Arc;
 #[cfg(feature = "pipes")]
 use std::sync::Mutex as StdMutex;
 use std::sync::atomic::{AtomicU64, Ordering};
 use tokio::sync::{Mutex, Notify, RwLock, Semaphore, mpsc};
 use tokio::time::{Instant, timeout, timeout_at};
@ -71,15 +67,6 @@ impl<C: TransportConnection> GenericSender<C> {
        if self.connection.close_reason().is_some() {
            return Err(CommunicationError::StreamClosed);
        }
        if let Some(version) = value.get_str(DataType::Version) {
            tracing::debug!(
                message_type = ?value.get_type(),
                version,
                connected = ?value.get_data(DataType::Connected),
                client_id = ?value.get_data(DataType::Id),
                "sending MTP handshake response frame"
            );
        }
        match self.policy.send_mode {
            crate::SendMode::SingleStreamPerMessage => {
                let mut stream = self.open().await?;
@ -89,10 +76,9 @@ impl<C: TransportConnection> GenericSender<C> {
                )
                .await
                .map_err(|_| CommunicationError::StreamError)??;
-                match timeout(self.policy.write_timeout, stream.finish()).await {
+                timeout(self.policy.write_timeout, stream.finish())
-                    Ok(Ok(())) => Ok(()),
+                    .await
-                    Ok(Err(_)) | Err(_) => Err(CommunicationError::DeliveryUnknown),
+                    .map_err(|_| CommunicationError::StreamError)?
                }
            }
            crate::SendMode::PersistentStream => {
                let mut stream = self.persistent.lock().await;
@ -209,8 +195,6 @@ pub struct GenericReceiver<C: TransportConnection> {
    type_map: Arc<RwLock<TypeMap>>,
    queue_notify: Arc<Notify>,
    decode_rejections: Arc<DecodeRejectionCounters>,
    #[cfg(feature = "pipes")]
    expected_pipes: Arc<StdMutex<HashSet<u32>>>,
    _accept_task: Arc<tokio::task::JoinHandle<()>>,
 }
@ -226,8 +210,6 @@ impl<C: TransportConnection> Clone for GenericReceiver<C> {
            type_map: self.type_map.clone(),
            queue_notify: self.queue_notify.clone(),
            decode_rejections: self.decode_rejections.clone(),
            #[cfg(feature = "pipes")]
            expected_pipes: self.expected_pipes.clone(),
            _accept_task: self._accept_task.clone(),
        }
    }
@ -263,10 +245,6 @@ impl<C: TransportConnection> GenericReceiver<C> {
        let task_queue_notify = queue_notify.clone();
        let decode_rejections = Arc::new(DecodeRejectionCounters::default());
        let task_decode_rejections = decode_rejections.clone();
        #[cfg(feature = "pipes")]
        let expected_pipes = Arc::new(StdMutex::new(HashSet::new()));
        #[cfg(feature = "pipes")]
        let task_expected_pipes = expected_pipes.clone();
        let task_accept_task_tx = tx.clone();
        #[cfg(feature = "pipes")]
        let task_accept_task_pipe_tx = pipe_tx.clone();
@ -325,8 +303,6 @@ impl<C: TransportConnection> GenericReceiver<C> {
                let connection = task_connection.clone();
                let type_map = task_type_map.clone();
                let decode_rejections = task_decode_rejections.clone();
                #[cfg(feature = "pipes")]
                let expected_pipes = task_expected_pipes.clone();
                tokio::spawn(async move {
                    let _permit = permit;
                    let mut stream = stream;
@ -357,18 +333,6 @@ impl<C: TransportConnection> GenericReceiver<C> {
                                break 'stream;
                            }
                            Err(_) => {
                                if frames == 0 {
                                    tracing::warn!(
                                        timeout = ?policy.read_timeout,
                                        "MTP receive stream timed out before its first complete frame"
                                    );
                                } else {
                                    tracing::debug!(
                                        frames,
                                        timeout = ?policy.read_timeout,
                                        "MTP receive stream idle timeout"
                                    );
                                }
                                break;
                            }
                        }
@ -412,9 +376,6 @@ impl<C: TransportConnection> GenericReceiver<C> {
                            )
                            .await;
                            if !matches!(&body_read, Ok(Ok(()))) {
                                if matches!(&body_read, Ok(Err(CommunicationError::StreamClosed))) {
                                    break 'stream;
                                }
                                tracing::warn!(
                                    pipe_chunk_len = chunk_len,
                                    ?body_read,
@ -447,62 +408,42 @@ impl<C: TransportConnection> GenericReceiver<C> {
                                break;
                            }
                        };
                        tracing::debug!(
                            frames,
                            frame_len,
                            message_type = ?message.get_type(),
                            "decoded MTP receive frame"
                        );
                        let negotiated_type_map = type_map.read().await.clone();
                        message.set_type_map(&negotiated_type_map);
                        #[cfg(feature = "pipes")]
                        {
-                            if frames == 1 {
+                            if message.is_type(mtp_codec::CommunicationType::PipeRequest)
-                                let is_pipe_request =
+                                && frames == 1
-                                    message.is_type(mtp_codec::CommunicationType::PipeRequest);
+                            {
-                                let pipe_id = message.id().filter(|id| *id != 0);
+                                let Some(pipe_id) = message.id().filter(|id| *id != 0) else {
-                                let pipe_is_expected = is_pipe_request
+                                    let error = CommunicationError::Other(
-                                    && pipe_id.is_some_and(|pipe_id| {
+                                        "PipeRequest frame must contain a non-zero id".into(),
-                                        expected_pipes
+                                    );
-                                            .lock()
+                                    let _ = tx.send(Err(error.clone())).await;
-                                            .is_ok_and(|mut expected| expected.remove(&pipe_id))
+                                    connection.close(
-                                    });
+                                        policy.application_close_code,
-                                let disposition = match classify_first_frame(
+                                        b"pipe request missing id",
-                                    is_pipe_request,
+                                    );
-                                    message.id(),
+                                    break;
-                                    pipe_is_expected,
+                                };
-                                ) {
+                                let description = message
-                                    Ok(disposition) => disposition,
+                                    .get_str(mtp_codec::DataType::Description)
-                                    Err(error) => {
+                                    .unwrap_or("")
-                                        let _ = tx.send(Err(error.clone())).await;
+                                    .to_string();
-                                        connection.close(
+
-                                            policy.application_close_code,
+                                let pipe_reader = PipeReader {
-                                            b"pipe request missing id",
+                                    stream,
-                                        );
+                                    description,
-                                        break;
+                                    pipe_id,
                                    }
                                };
-                                if let FirstFrameDisposition::Pipe(pipe_id) = disposition {
+                                tracing::debug!(pipe_id, description = %pipe_reader.description, "classified incoming pipe stream");
                                    let description = message
                                        .get_str(mtp_codec::DataType::Description)
                                        .unwrap_or("")
                                        .to_string();
-                                    let pipe_reader = PipeReader {
+                                if pipe_tx.send(pipe_reader).await.is_err() {
-                                        stream,
+                                    break;
                                        description,
                                        pipe_id,
                                    };
                                    tracing::debug!(pipe_id, description = %pipe_reader.description, "classified incoming pipe stream");
                                    if pipe_tx.send(pipe_reader).await.is_err() {
                                        break;
                                    }
                                    return;
                                }
                                return;
                            }
                        }
@ -546,8 +487,6 @@ impl<C: TransportConnection> GenericReceiver<C> {
            type_map,
            queue_notify,
            decode_rejections,
            #[cfg(feature = "pipes")]
            expected_pipes,
            _accept_task: Arc::new(accept_task),
        }
    }
@ -555,25 +494,6 @@ impl<C: TransportConnection> GenericReceiver<C> {
        *self.ping_sender.write().await = Some(sender);
    }
    #[cfg(feature = "pipes")]
    pub fn expect_pipe(&self, pipe_id: u32) -> Result<(), CommunicationError> {
        if pipe_id == 0 {
            return Err(CommunicationError::Other("pipe id must be non-zero".into()));
        }
        self.expected_pipes
            .lock()
            .map_err(|_| CommunicationError::Other("expected pipe state is unavailable".into()))?
            .insert(pipe_id);
        Ok(())
    }
    #[cfg(feature = "pipes")]
    pub fn cancel_expected_pipe(&self, pipe_id: u32) {
        if let Ok(mut expected) = self.expected_pipes.lock() {
            expected.remove(&pipe_id);
        }
    }
    /// Switch from the handshake frame limit to the application frame limit.
    pub fn set_max_message_size(&self, max_message_size: u64) {
        self.max_message_size
--- a/transport/src/transport_traits.rs
+++ b/transport/src/transport_traits.rs
@ -17,7 +17,6 @@ use mtp_common::CommunicationError;
 pub trait TransportSendStream: tokio::io::AsyncWrite + Send + Sync {
    async fn write_all(&mut self, buf: &[u8]) -> Result<(), CommunicationError>;
    async fn finish(&mut self) -> Result<(), CommunicationError>;
    fn reset(&mut self, code: u32) -> Result<(), CommunicationError>;
 }
 /// A readable unidirectional stream suitable for MTP frames.
@ -29,9 +28,6 @@ pub trait TransportSendStream: tokio::io::AsyncWrite + Send + Sync {
 pub trait TransportRecvStream: tokio::io::AsyncRead + Send + Sync {
    async fn read_exact(&mut self, buf: &mut [u8]) -> Result<(), CommunicationError>;
    async fn read_chunk(&mut self, max: usize) -> Result<Option<Vec<u8>>, CommunicationError>;
    fn stop(self, code: u32) -> Result<(), CommunicationError>
    where
        Self: Sized;
 }
 /// A QUIC/WebTransport connection that provides MTP's unidirectional streams.
@ -51,7 +47,7 @@ impl TransportSendStream for wtransport::SendStream {
    async fn write_all(&mut self, buf: &[u8]) -> Result<(), CommunicationError> {
        wtransport::SendStream::write_all(self, buf)
            .await
-            .map_err(|_| CommunicationError::DeliveryUnknown)
+            .map_err(|_| CommunicationError::StreamError)
    }
    async fn finish(&mut self) -> Result<(), CommunicationError> {
@ -59,23 +55,14 @@ impl TransportSendStream for wtransport::SendStream {
            .await
            .map_err(|_| CommunicationError::StreamError)
    }
    fn reset(&mut self, code: u32) -> Result<(), CommunicationError> {
        wtransport::SendStream::reset(self, wtransport::VarInt::from_u32(code))
            .map_err(|_| CommunicationError::StreamClosed)
    }
 }
 #[async_trait]
 impl TransportRecvStream for wtransport::RecvStream {
    async fn read_exact(&mut self, buf: &mut [u8]) -> Result<(), CommunicationError> {
-        match wtransport::RecvStream::read_exact(self, buf).await {
+        wtransport::RecvStream::read_exact(self, buf)
-            Ok(()) => Ok(()),
+            .await
-            Err(wtransport::error::StreamReadExactError::FinishedEarly(0)) => {
+            .map_err(|_| CommunicationError::StreamError)
                Err(CommunicationError::StreamClosed)
            }
            Err(_) => Err(CommunicationError::StreamError),
        }
    }
    async fn read_chunk(&mut self, max: usize) -> Result<Option<Vec<u8>>, CommunicationError> {
@ -89,11 +76,6 @@ impl TransportRecvStream for wtransport::RecvStream {
            Err(_) => Err(CommunicationError::StreamError),
        }
    }
    fn stop(self, code: u32) -> Result<(), CommunicationError> {
        wtransport::RecvStream::stop(self, wtransport::VarInt::from_u32(code));
        Ok(())
    }
 }
 #[async_trait]
--- a/transport/tests/generic_pipe.rs
+++ b/transport/tests/generic_pipe.rs
@ -4,7 +4,7 @@ use async_trait::async_trait;
 use mtp_codec::CommunicationValue;
 use mtp_common::CommunicationError;
 use mtp_transport::{
-    GenericReceiver, GenericSender, Policy, SendMode, TransportConnection, TransportEvent,
+    GenericReceiver, GenericSender, Policy, TransportConnection, TransportEvent,
    TransportRecvStream, TransportSendStream,
 };
 use std::sync::Arc;
@ -53,10 +53,6 @@ impl TransportSendStream for MockSendStream {
            .await
            .map_err(|_| CommunicationError::StreamError)
    }
    fn reset(&mut self, _code: u32) -> Result<(), CommunicationError> {
        Ok(())
    }
 }
 struct MockRecvStream {
@ -93,10 +89,6 @@ impl TransportRecvStream for MockRecvStream {
            Err(_) => Err(CommunicationError::StreamError),
        }
    }
    fn stop(self, _code: u32) -> Result<(), CommunicationError> {
        Ok(())
    }
 }
 #[derive(Clone)]
@ -165,7 +157,6 @@ async fn test_open_pipe_and_receive_reader() -> Result<(), Box<dyn std::error::E
    let sender = GenericSender::new(conn_a, policy.clone());
    let receiver = GenericReceiver::new(conn_b, policy);
    receiver.expect_pipe(42)?;
    let pipe_writer = sender.open_pipe(42, "test-pipe").await?;
    let pipe_reader = receiver.receive_pipe().await?;
@ -183,7 +174,6 @@ async fn test_pipe_raw_data_roundtrip() -> Result<(), Box<dyn std::error::Error>
    let sender = GenericSender::new(conn_a, policy.clone());
    let receiver = GenericReceiver::new(conn_b, policy);
    receiver.expect_pipe(1)?;
    let mut pipe_writer = sender.open_pipe(1, "data-pipe").await?;
    let data = b"hello through the pipe";
@ -205,7 +195,6 @@ async fn test_pipe_large_payload() -> Result<(), Box<dyn std::error::Error>> {
    let sender = GenericSender::new(conn_a, policy.clone());
    let receiver = GenericReceiver::new(conn_b, policy);
    receiver.expect_pipe(7)?;
    let mut pipe_writer = sender.open_pipe(7, "big-pipe").await?;
    let data: Vec<u8> = (0..256 * 1024).map(|i| (i % 256) as u8).collect();
@ -234,7 +223,6 @@ async fn test_receive_event_dispatches_pipe() -> Result<(), Box<dyn std::error::
    let sender = GenericSender::new(conn_a, policy.clone());
    let receiver = GenericReceiver::new(conn_b, policy);
    receiver.expect_pipe(99)?;
    let mut pipe_writer = sender.open_pipe(99, "event-pipe").await?;
    match receiver.receive_event().await? {
@ -273,23 +261,22 @@ async fn test_try_receive_pipe_returns_none_when_empty() -> Result<(), Box<dyn s
 async fn test_regular_messages_still_work_alongside_pipes() -> Result<(), Box<dyn std::error::Error>>
 {
    let (conn_a, conn_b) = mock_connected_pair().await;
-    let policy = Arc::new(Policy::default().with_send_mode(SendMode::SingleStreamPerMessage));
+    let policy = Arc::new(Policy::default());
    let sender = GenericSender::new(conn_a, policy.clone());
    let receiver = GenericReceiver::new(conn_b, policy);
-    let request = CommunicationValue::new(mtp_codec::CommunicationType::PipeRequest)
+    let msg = CommunicationValue::new(mtp_codec::CommunicationType::BadRequest);
-        .with_id(1)
+    sender.send(&msg).await?;
-        .add_typed_default(
+
-            mtp_codec::DataType::Description,
+    let _pipe_writer = sender.open_pipe(1, "mixed-pipe").await?;
            mtp_codec::DataValue::Str("mixed-pipe".into()),
        );
    sender.send(&request).await?;
    let received = receiver.receive().await?;
-    assert!(received.is_type(mtp_codec::CommunicationType::PipeRequest));
+    assert_eq!(
-
+        received.get_type(),
-    receiver.expect_pipe(1)?;
+        mtp_codec::CommunicationType::BadRequest
-    let _pipe_writer = sender.open_pipe(1, "mixed-pipe").await?;
+            .try_to_id(&mtp_codec::TypeMap::latest())
            .unwrap()
    );
    let pipe_reader = receiver.receive_pipe().await?;
    assert_eq!(pipe_reader.pipe_id(), 1);
@ -304,8 +291,6 @@ async fn test_multiple_pipes() -> Result<(), Box<dyn std::error::Error>> {
    let sender = GenericSender::new(conn_a, policy.clone());
    let receiver = GenericReceiver::new(conn_b, policy);
    receiver.expect_pipe(10)?;
    receiver.expect_pipe(20)?;
    let mut pw1 = sender.open_pipe(10, "first").await?;
    let mut pw2 = sender.open_pipe(20, "second").await?;
--- a/type-map/Cargo.toml
+++ b/type-map/Cargo.toml
@ -16,7 +16,3 @@ pipes = []
 [build-dependencies]
 serde = { version = "1", features = ["derive"] }
 serde_yaml = "0.9"
 [package.metadata.cargo-machete]
 # cargo-machete does not inspect build.rs, where both build dependencies are used.
 ignored = ["serde", "serde_yaml"]
--- a/wasm/src/client/authentication.rs
+++ b/wasm/src/client/authentication.rs
@ -8,14 +8,6 @@ use crate::config::ConnectionConfig;
 use crate::error::js_error;
 use crate::transport::WasmTransport;
 fn server_rejection_message(outcome: &CommunicationValue) -> Option<&str> {
    (outcome.get_data(DataType::Connected) == Some(&DataValue::BoolFalse)).then(|| {
        outcome
            .get_str(DataType::ErrorMessage)
            .unwrap_or("host rejected the connection")
    })
 }
 #[wasm_bindgen]
 #[allow(deprecated)]
 impl WasmClient {
@ -87,31 +79,10 @@ impl WasmClient {
                        .unwrap_or("host does not support this protocol version"),
                ));
            }
            // Generic host rejections are IdentificationResponse frames with
            // Connected=false. They intentionally do not carry a negotiated
            // Version because negotiation never completed. Check this before
            // reading Version, otherwise a useful server error such as an
            // authentication timeout is reported as the misleading
            // "host omitted a valid negotiated protocol version".
            if let Some(message) = server_rejection_message(&outcome) {
                self.set_state_if_current(generation, ConnectionState::Disconnected);
                return Err(js_error(message));
            }
            let missing_version = || {
                js_error(format!(
                    "host omitted a valid negotiated protocol version (response_type={:?}, connected={:?}, frame_len={})",
                    outcome.get_type(),
                    outcome.get_data(DataType::Connected),
                    outcome_bytes.len(),
                ))
            };
            let negotiated_version = match outcome.get_data(DataType::Version) {
                Some(DataValue::Str(version)) => mtp_codec::Version::parse(version)
-                    .ok_or_else(|| missing_version())?,
+                    .ok_or_else(|| js_error("host omitted a valid negotiated protocol version"))?,
-                _ => return Err(missing_version()),
+                _ => return Err(js_error("host omitted a valid negotiated protocol version")),
            };
            if negotiated_version != PROTOCOL_VERSION {
                return Err(js_error(
@ -657,24 +628,3 @@ impl WasmClient {
        Ok(server_challenge)
    }
 }
 #[cfg(test)]
 mod tests {
    use super::server_rejection_message;
    use mtp_codec::{CommunicationType, CommunicationValue, DataType, DataValue};
    #[test]
    fn reports_rejection_reason_without_a_negotiated_version() {
        let response = CommunicationValue::new(CommunicationType::IdentificationResponse)
            .add_typed_default(DataType::Connected, DataValue::BoolFalse)
            .add_typed_default(
                DataType::ErrorMessage,
                DataValue::Str("authentication handshake timed out".into()),
            );
        assert_eq!(
            server_rejection_message(&response),
            Some("authentication handshake timed out")
        );
    }
 }
--- a/wasm/src/client/receive.rs
+++ b/wasm/src/client/receive.rs
@ -179,7 +179,6 @@ impl WasmClient {
        let expired_pipe_creations = self.expired_pipe_creations.clone();
        let pending_pipes = self.pending_pipes.clone();
        let loop_pending_pipes = pending_pipes.clone();
        let expected_pending_pipes = pending_pipes.clone();
        let on_pipe_request = self.on_pipe_request.clone();
        let loop_pipe_creations = pending_pipe_creations.clone();
        let loop_expired_pipe_creations = expired_pipe_creations.clone();
@ -294,12 +293,6 @@ impl WasmClient {
                            let _ = entry.sender.send(Ok(pipe_reader));
                        }
                    },
                    move |pipe_id| {
                        expected_pending_pipes
                            .borrow()
                            .get(&pipe_id)
                            .is_some_and(|entry| entry.generation == loop_generation)
                    },
                )
                .await;
            if connection_generation.get() != generation {
--- a/wasm/src/frame.rs
+++ b/wasm/src/frame.rs
@ -163,7 +163,6 @@ impl JsDataValueEncodeContext {
    }
 }
 #[cfg(test)]
 pub(crate) fn js_to_data_value(value: &JsValue, tm: &TypeMap) -> Result<DataValue, JsValue> {
    js_to_data_value_with_limits(value, tm, EncodeLimits::default())
 }
--- a/wasm/src/pipe.rs
+++ b/wasm/src/pipe.rs
@ -1,6 +1,9 @@
 use wasm_bindgen::JsCast;
 use wasm_bindgen::prelude::*;
 use wasm_bindgen_futures::JsFuture;
-use crate::transport::{BrowserRecvStream, BrowserSendStream, log_stream_error_code};
+use crate::error::js_error;
 use crate::transport::release_writer_lock;
 #[wasm_bindgen(typescript_custom_section)]
 const PIPE_TS: &str = r#"
@ -20,41 +23,54 @@ export interface PipeReader {
 #[wasm_bindgen]
 pub struct PipeWriter {
-    stream: BrowserSendStream,
+    writer: JsValue,
    pipe_id: u32,
 }
 impl PipeWriter {
-    pub(crate) fn new(stream: BrowserSendStream, pipe_id: u32) -> Self {
+    pub fn new(writer: JsValue, pipe_id: u32) -> Self {
-        Self { stream, pipe_id }
+        Self { writer, pipe_id }
    }
 }
 impl Drop for PipeWriter {
    fn drop(&mut self) {
        self.stream.release();
    }
 }
 #[wasm_bindgen]
 impl PipeWriter {
    pub async fn write(&mut self, data: &[u8]) -> Result<(), JsValue> {
-        self.stream.write_all(data).await
+        let chunk = js_sys::Uint8Array::from(data);
        let write_fn = js_sys::Reflect::get(&self.writer, &JsValue::from_str("write"))
            .map_err(|_| js_error("missing write"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("write not a function"))?;
        let write_promise = write_fn
            .call1(&self.writer, &chunk)
            .map_err(|e| js_error(format!("write failed: {:?}", e)))?;
        JsFuture::from(write_promise.unchecked_into::<js_sys::Promise>()).await?;
        Ok(())
    }
-    pub async fn close(mut self) -> Result<(), JsValue> {
+    pub async fn close(self) -> Result<(), JsValue> {
-        let result = self.stream.finish().await;
+        let close_fn = js_sys::Reflect::get(&self.writer, &JsValue::from_str("close"))
-        if let Err(error) = &result {
+            .map_err(|_| js_error("missing close"))?
-            log_stream_error_code(error, "pipe writer close");
+            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("close not a function"))?;
        let close_promise = close_fn
            .call0(&self.writer)
            .map_err(|e| js_error(format!("close failed: {:?}", e)))?;
        if let Err(e) = JsFuture::from(close_promise.unchecked_into::<js_sys::Promise>()).await {
            crate::transport::log_stream_error_code(&e, "pipe writer close");
        }
-        self.stream.release();
+        release_writer_lock(&self.writer);
-        result
+        Ok(())
    }
    pub fn abort(&mut self) -> Result<(), JsValue> {
-        let result = self.stream.reset(0);
+        let abort_fn = js_sys::Reflect::get(&self.writer, &JsValue::from_str("abort"))
-        self.stream.release();
+            .map_err(|_| js_error("missing abort"))?
-        result
+            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("abort not a function"))?;
        let _ = abort_fn.call0(&self.writer);
        release_writer_lock(&self.writer);
        Ok(())
    }
    pub fn pipe_id(&self) -> u32 {
@ -64,26 +80,19 @@ impl PipeWriter {
 #[wasm_bindgen]
 pub struct PipeReader {
-    stream: BrowserRecvStream,
+    reader: JsValue,
    description: String,
    pipe_id: u32,
    pending: Vec<u8>,
    finished: bool,
 }
 impl PipeReader {
-    pub(crate) fn new(
+    pub fn new(reader: JsValue, pipe_id: u32, description: String, pending: Vec<u8>) -> Self {
        stream: BrowserRecvStream,
        pipe_id: u32,
        description: String,
        pending: Vec<u8>,
    ) -> Self {
        Self {
-            stream,
+            reader,
            pipe_id,
            description,
            pending,
            finished: false,
        }
    }
 }
@ -96,18 +105,27 @@ impl PipeReader {
            return Ok(js_sys::Uint8Array::from(&data[..]).into());
        }
-        if self.finished {
+        let read_fn = js_sys::Reflect::get(&self.reader, &JsValue::from_str("read"))
            .map_err(|_| js_error("missing read"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("read not a function"))?;
        let promise = read_fn
            .call0(&self.reader)
            .map_err(|_| js_error("read call failed"))?
            .unchecked_into::<js_sys::Promise>();
        let result = JsFuture::from(promise).await?;
        let done = js_sys::Reflect::get(&result, &JsValue::from_str("done"))
            .ok()
            .and_then(|v| v.as_bool())
            .unwrap_or(true);
        if done {
            return Ok(JsValue::NULL);
        }
-        match self.stream.read_chunk().await? {
+        let value = js_sys::Reflect::get(&result, &JsValue::from_str("value"))
-            Some(value) => Ok(js_sys::Uint8Array::from(&value[..]).into()),
+            .map_err(|_| js_error("missing value"))?;
-            None => {
+        Ok(js_sys::Uint8Array::new(&value).into())
                self.stream.release();
                self.finished = true;
                Ok(JsValue::NULL)
            }
        }
    }
    pub fn pipe_id(&self) -> u32 {
@ -118,9 +136,3 @@ impl PipeReader {
        self.description.clone()
    }
 }
 impl Drop for PipeReader {
    fn drop(&mut self) {
        self.stream.release();
    }
 }
--- a/wasm/src/protected.rs
+++ b/wasm/src/protected.rs
@ -380,7 +380,6 @@ pub fn build_protected_frame_with_keyring_with_limits(
 /// Read the claimed, unverified signer ID after decrypting the protected
 /// payload. The result may only select trusted keys for the same signer ID.
 #[wasm_bindgen]
 #[allow(deprecated)]
 #[deprecated(note = "use protected_claimed_signer_id_with_limits")]
 pub fn protected_claimed_signer_id(
    frame: &[u8],
--- a/wasm/src/relay.rs
+++ b/wasm/src/relay.rs
@ -296,7 +296,6 @@ impl WasmVerifiedRelayContent {
 /// versioned relay metadata parser in the JavaScript SDK. The caller must bind
 /// this value as the expected signer during the subsequent verification call.
 #[wasm_bindgen]
 #[allow(deprecated)]
 #[deprecated(note = "use relay_metadata_claimed_signer_id_with_limits")]
 pub fn relay_metadata_claimed_signer_id(frame: &[u8], keyrings: JsValue) -> Result<u64, JsValue> {
    relay_metadata_claimed_signer_id_impl(frame, keyrings, JsValue::UNDEFINED)
--- a/wasm/src/transport.rs
+++ b/wasm/src/transport.rs
@ -9,7 +9,6 @@ use wasm_bindgen_futures::JsFuture;
 use crate::error::js_error;
 use crate::frame::parse_frame_value_with_limits;
 use mtp_codec::{DecodeLimits, EncodeLimits, TypeMap};
 use mtp_common::{FirstFrameDisposition, classify_first_frame};
 const CLOSE_FRAME_LEN: u32 = u32::MAX;
@ -26,6 +25,12 @@ pub(crate) fn log_stream_error_code(error: &JsValue, context: &str) {
    let stream_error_code = js_sys::Reflect::get(error, &JsValue::from_str("streamErrorCode"))
        .ok()
        .and_then(|v| v.as_f64());
    if matches!(stream_error_code, Some(0.0)) {
        // WebTransport reports peer-driven stream shutdown as code 0 in this
        // environment. For one-frame handshake streams, that is expected and
        // should not be surfaced as a warning.
        return;
    }
    let message = error
        .as_string()
        .or_else(|| {
@ -71,233 +76,6 @@ fn resolve_stream_readable(recv_stream: &JsValue) -> Result<JsValue, JsValue> {
    }
 }
 #[derive(Clone)]
 struct BrowserConnection {
    inner: JsValue,
    incoming_reader: Rc<RefCell<Option<JsValue>>>,
 }
 pub(crate) struct BrowserSendStream {
    writer: JsValue,
 }
 pub(crate) struct BrowserRecvStream {
    reader: JsValue,
 }
 impl BrowserConnection {
    async fn connect(url: &str, cert_hashes: Option<Vec<String>>) -> Result<Self, JsValue> {
        let constructor =
            js_sys::Reflect::get(&js_sys::global(), &JsValue::from_str("WebTransport"))?
                .dyn_into::<js_sys::Function>()
                .map_err(|_| js_error("WebTransport not available"))?;
        let args = js_sys::Array::new();
        args.push(&JsValue::from_str(url));
        if let Some(hashes) = cert_hashes {
            let webtransport_hashes = js_sys::Array::new();
            for hash in hashes {
                let (algorithm, value) = hash.split_once(':').unwrap_or(("sha-256", hash.as_str()));
                if let Ok(value) = hex::decode(value) {
                    let entry = js_sys::Object::new();
                    js_sys::Reflect::set(
                        &entry,
                        &JsValue::from_str("algorithm"),
                        &JsValue::from_str(algorithm),
                    )?;
                    js_sys::Reflect::set(
                        &entry,
                        &JsValue::from_str("value"),
                        &js_sys::Uint8Array::from(&value[..]),
                    )?;
                    webtransport_hashes.push(&entry);
                }
            }
            if webtransport_hashes.length() > 0 {
                let options = js_sys::Object::new();
                js_sys::Reflect::set(
                    &options,
                    &JsValue::from_str("serverCertificateHashes"),
                    &webtransport_hashes,
                )?;
                args.push(&options);
            }
        }
        let inner = js_sys::Reflect::construct(&constructor, &args)?;
        let ready = js_sys::Reflect::get(&inner, &JsValue::from_str("ready"))?
            .dyn_into::<js_sys::Promise>()
            .map_err(|_| js_error("WebTransport.ready is not a Promise"))?;
        JsFuture::from(ready)
            .await
            .map_err(|error| js_error(format!("WebTransport ready failed: {error:?}")))?;
        Ok(Self {
            inner,
            incoming_reader: Rc::new(RefCell::new(None)),
        })
    }
    async fn open_uni(&self) -> Result<BrowserSendStream, JsValue> {
        let create_stream = js_sys::Reflect::get(
            &self.inner,
            &JsValue::from_str("createUnidirectionalStream"),
        )?
        .dyn_into::<js_sys::Function>()
        .map_err(|_| js_error("createUnidirectionalStream not a function"))?;
        let stream_promise = create_stream
            .call0(&self.inner)?
            .dyn_into::<js_sys::Promise>()
            .map_err(|_| js_error("createUnidirectionalStream did not return a Promise"))?;
        let stream = JsFuture::from(stream_promise).await?;
        let writable = resolve_stream_writable(&stream)?;
        let writer = js_sys::Reflect::get(&writable, &JsValue::from_str("getWriter"))
            .map_err(|_| js_error("missing getWriter"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("getWriter not a function"))?
            .call0(&writable)
            .map_err(|_| js_error("getWriter call failed"))?;
        Ok(BrowserSendStream { writer })
    }
    async fn accept_uni(&self) -> Result<Option<BrowserRecvStream>, JsValue> {
        let streams_reader = if let Some(reader) = self.incoming_reader.borrow().clone() {
            reader
        } else {
            let incoming = js_sys::Reflect::get(
                &self.inner,
                &JsValue::from_str("incomingUnidirectionalStreams"),
            )?;
            let reader = js_sys::Reflect::get(&incoming, &JsValue::from_str("getReader"))
                .map_err(|_| js_error("missing getReader"))?
                .dyn_into::<js_sys::Function>()
                .map_err(|_| js_error("getReader not a function"))?
                .call0(&incoming)
                .map_err(|_| js_error("getReader call failed"))?;
            *self.incoming_reader.borrow_mut() = Some(reader.clone());
            reader
        };
        let read = js_sys::Reflect::get(&streams_reader, &JsValue::from_str("read"))
            .map_err(|_| js_error("missing read"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("read not a function"))?;
        let promise = read
            .call0(&streams_reader)
            .map_err(|_| js_error("read call failed"))?
            .unchecked_into::<js_sys::Promise>();
        let result = JsFuture::from(promise).await.map_err(|error| {
            log_stream_error_code(&error, "accept_uni");
            js_error(format!("accept stream failed: {error:?}"))
        })?;
        if js_sys::Reflect::get(&result, &JsValue::from_str("done"))
            .ok()
            .and_then(|value| value.as_bool())
            .unwrap_or(false)
        {
            return Ok(None);
        }
        let stream = js_sys::Reflect::get(&result, &JsValue::from_str("value"))
            .map_err(|_| js_error("missing value"))?;
        let readable = resolve_stream_readable(&stream)?;
        let reader = js_sys::Reflect::get(&readable, &JsValue::from_str("getReader"))
            .map_err(|_| js_error("missing stream getReader"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("stream getReader not a function"))?
            .call0(&readable)
            .map_err(|_| js_error("stream getReader call failed"))?;
        Ok(Some(BrowserRecvStream { reader }))
    }
    fn close(&self) {
        if let Some(reader) = self.incoming_reader.borrow_mut().take() {
            release_reader_lock(&reader);
        }
        if let Ok(close) = js_sys::Reflect::get(&self.inner, &JsValue::from_str("close"))
            .and_then(|value| value.dyn_into::<js_sys::Function>())
        {
            let _ = close.call1(&self.inner, &js_sys::Object::new());
        }
    }
 }
 impl BrowserSendStream {
    pub(crate) async fn write_all(&mut self, bytes: &[u8]) -> Result<(), JsValue> {
        let write = js_sys::Reflect::get(&self.writer, &JsValue::from_str("write"))
            .map_err(|_| js_error("missing write"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("write not a function"))?;
        let promise = write
            .call1(&self.writer, &js_sys::Uint8Array::from(bytes))
            .map_err(|error| js_error(format!("write failed: {error:?}")))?
            .unchecked_into::<js_sys::Promise>();
        JsFuture::from(promise).await.map(|_| ())
    }
    pub(crate) async fn finish(&mut self) -> Result<(), JsValue> {
        let close = js_sys::Reflect::get(&self.writer, &JsValue::from_str("close"))
            .map_err(|_| js_error("missing close"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("close not a function"))?;
        let promise = close
            .call0(&self.writer)
            .map_err(|error| js_error(format!("close failed: {error:?}")))?
            .unchecked_into::<js_sys::Promise>();
        JsFuture::from(promise).await.map(|_| ())
    }
    pub(crate) fn reset(&mut self, code: u32) -> Result<(), JsValue> {
        let abort = js_sys::Reflect::get(&self.writer, &JsValue::from_str("abort"))
            .map_err(|_| js_error("missing abort"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("abort not a function"))?;
        let _ = abort.call1(&self.writer, &JsValue::from_f64(code as f64))?;
        Ok(())
    }
    pub(crate) fn release(&self) {
        release_writer_lock(&self.writer);
    }
 }
 impl BrowserRecvStream {
    pub(crate) async fn read_chunk(&mut self) -> Result<Option<Vec<u8>>, JsValue> {
        let read = js_sys::Reflect::get(&self.reader, &JsValue::from_str("read"))
            .map_err(|_| js_error("missing read"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("read not a function"))?;
        let promise = read
            .call0(&self.reader)
            .map_err(|_| js_error("read call failed"))?
            .unchecked_into::<js_sys::Promise>();
        let result = JsFuture::from(promise).await?;
        if js_sys::Reflect::get(&result, &JsValue::from_str("done"))
            .ok()
            .and_then(|value| value.as_bool())
            .unwrap_or(true)
        {
            return Ok(None);
        }
        let value = js_sys::Reflect::get(&result, &JsValue::from_str("value"))
            .map_err(|_| js_error("missing value"))?;
        Ok(Some(js_sys::Uint8Array::new(&value).to_vec()))
    }
    #[allow(dead_code)]
    pub(crate) fn stop(self, code: u32) -> Result<(), JsValue> {
        let cancel = js_sys::Reflect::get(&self.reader, &JsValue::from_str("cancel"))
            .map_err(|_| js_error("missing cancel"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("cancel not a function"))?;
        let _ = cancel.call1(&self.reader, &JsValue::from_f64(code as f64))?;
        Ok(())
    }
    pub(crate) fn release(&self) {
        release_reader_lock(&self.reader);
    }
 }
 /// Releases a writer's lock so an abandoned writer isn't treated as an abort (which sends STOP_SENDING).
 pub(crate) fn release_writer_lock(writer: &JsValue) {
    if let Ok(release) = js_sys::Reflect::get(writer, &JsValue::from_str("releaseLock"))
@ -340,14 +118,18 @@ enum FrameOutcome {
 */
 #[derive(Clone)]
 pub struct WasmTransport {
-    connection: BrowserConnection,
+    inner: JsValue,
    max_message_size: u32,
-    /// Current incoming unidirectional stream, shared across handshake and receive loops.
+    /// Reader over `incoming_unidirectional_streams()` (a singleton stream of streams).
-    stream_reader: Rc<RefCell<Option<BrowserRecvStream>>>,
+    streams_reader: Rc<RefCell<Option<JsValue>>>,
    /// Reader over the host's current uni-directional stream, if one is open.
    stream_reader: Rc<RefCell<Option<JsValue>>>,
    /// Bytes already read from the current stream but not yet consumed as a frame.
    buffer: Rc<RefCell<Vec<u8>>>,
    /// Set to `true` when `open_next_stream` succeeds; cleared after the first frame is parsed.
    new_stream_frame: Rc<Cell<bool>>,
    /// A single ordered browser send stream shared by all cloned transports.
    outgoing_writer: Rc<RefCell<Option<JsValue>>>,
    /// Serializes stream creation and writes across concurrent callers.
    send_lock: Rc<AsyncMutex<()>>,
    type_map: Rc<RefCell<TypeMap>>,
@ -369,17 +151,65 @@ impl WasmTransport {
        max_message_size: u32,
        configured_limits: Option<DecodeLimits>,
    ) -> Result<Self, JsValue> {
-        let connection = BrowserConnection::connect(url, cert_hashes).await?;
+        let ctor = js_sys::Reflect::get(&js_sys::global(), &JsValue::from_str("WebTransport"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("WebTransport not available"))?;
        let args = js_sys::Array::new();
        args.push(&JsValue::from_str(url));
        if let Some(hashes) = cert_hashes {
            let wt_hashes = js_sys::Array::new();
            for h in hashes {
                let (algo, hex_val) = match h.split_once(':') {
                    Some((algo, hex_val)) => (algo, hex_val),
                    None => ("sha-256", h.as_str()),
                };
                if let Ok(bytes) = hex::decode(hex_val) {
                    let hash = js_sys::Object::new();
                    js_sys::Reflect::set(
                        &hash,
                        &JsValue::from_str("algorithm"),
                        &JsValue::from_str(algo),
                    )?;
                    js_sys::Reflect::set(
                        &hash,
                        &JsValue::from_str("value"),
                        &js_sys::Uint8Array::from(&bytes[..]),
                    )?;
                    wt_hashes.push(&hash);
                }
            }
            if wt_hashes.length() > 0 {
                let opts = js_sys::Object::new();
                js_sys::Reflect::set(
                    &opts,
                    &JsValue::from_str("serverCertificateHashes"),
                    &wt_hashes,
                )?;
                args.push(&opts);
            }
        };
        let transport = js_sys::Reflect::construct(&ctor, &args)?;
        let ready = js_sys::Reflect::get(&transport, &JsValue::from_str("ready"))?
            .dyn_into::<js_sys::Promise>()
            .map_err(|_| js_error("WebTransport.ready is not a Promise"))?;
        JsFuture::from(ready)
            .await
            .map_err(|e| js_error(format!("WebTransport ready failed: {:?}", e)))?;
        let transport_limits = DecodeLimits::for_transport_message_size(max_message_size as u64);
        let decode_limits = configured_limits
            .map(|limits| restrict_decode_limits(limits, transport_limits))
            .unwrap_or(transport_limits);
        Ok(Self {
-            connection,
+            inner: transport,
            max_message_size,
            streams_reader: Rc::new(RefCell::new(None)),
            stream_reader: Rc::new(RefCell::new(None)),
            buffer: Rc::new(RefCell::new(Vec::new())),
            new_stream_frame: Rc::new(Cell::new(false)),
            outgoing_writer: Rc::new(RefCell::new(None)),
            send_lock: Rc::new(AsyncMutex::new(())),
            type_map: Rc::new(RefCell::new(TypeMap::latest())),
            decode_limits: Rc::new(RefCell::new(decode_limits)),
@ -387,7 +217,7 @@ impl WasmTransport {
    }
    pub fn inner(&self) -> &JsValue {
-        &self.connection.inner
+        &self.inner
    }
    pub fn set_type_map(&self, type_map: &TypeMap) {
@ -417,61 +247,147 @@ impl WasmTransport {
            return Err(js_error("message too large"));
        }
-        // Use one WebTransport uni-stream per MTP frame. Chromium reliably
+        let writer_val = if let Some(writer) = self.outgoing_writer.borrow().clone() {
-        // publishes a browser-created uni-stream to the peer when it is
+            writer
-        // closed; leaving a shared stream open can leave the server waiting
+        } else {
-        // in accept_uni() until the authentication deadline. The bytes are
+            let create_stream = js_sys::Reflect::get(
-        // already the canonical MTP self-framed value, so no extra stream
+                &self.inner,
-        // length prefix is added here.
+                &JsValue::from_str("createUnidirectionalStream"),
-        let mut stream = self.connection.open_uni().await?;
+            )?
-        if let Err(e) = stream.write_all(frame).await {
+            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("createUnidirectionalStream not a function"))?;
            let stream_promise = create_stream
                .call0(&self.inner)?
                .dyn_into::<js_sys::Promise>()
                .map_err(|_| js_error("createUnidirectionalStream did not return a Promise"))?;
            let stream = JsFuture::from(stream_promise).await?;
            let writable_or_stream = resolve_stream_writable(&stream)?;
            let writer = js_sys::Reflect::get(&writable_or_stream, &JsValue::from_str("getWriter"))
                .map_err(|_| js_error("missing getWriter"))?
                .dyn_into::<js_sys::Function>()
                .map_err(|_| js_error("getWriter not a function"))?
                .call0(&writable_or_stream)
                .map_err(|_| js_error("getWriter call failed"))?;
            *self.outgoing_writer.borrow_mut() = Some(writer.clone());
            writer
        };
        let chunk = js_sys::Uint8Array::from(frame);
        let write_fn = js_sys::Reflect::get(&writer_val, &JsValue::from_str("write"))
            .map_err(|_| js_error("missing write"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("write not a function"))?;
        let write_promise = write_fn
            .call1(&writer_val, &chunk)
            .map_err(|e| js_error(format!("write failed: {:?}", e)))?;
        if let Err(e) = JsFuture::from(write_promise.unchecked_into::<js_sys::Promise>()).await {
            log_stream_error_code(&e, "send_frame write");
-            stream.release();
+            self.outgoing_writer.borrow_mut().take();
            release_writer_lock(&writer_val);
            return Err(e);
        }
        if let Err(e) = stream.finish().await {
            // The frame was already written; do not retry it merely because
            // FIN failed, as that would duplicate the MTP frame.
            log_stream_error_code(&e, "send_frame close");
        }
        stream.release();
        Ok(())
    }
    /// Get (creating once) the reader over `incoming_unidirectional_streams()`.
    fn ensure_streams_reader(&self) -> Result<JsValue, JsValue> {
        if let Some(reader) = self.streams_reader.borrow().clone() {
            return Ok(reader);
        }
        let incoming = js_sys::Reflect::get(
            &self.inner,
            &JsValue::from_str("incomingUnidirectionalStreams"),
        )?;
        let reader = js_sys::Reflect::get(&incoming, &JsValue::from_str("getReader"))
            .map_err(|_| js_error("missing getReader"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("getReader not a function"))?
            .call0(&incoming)
            .map_err(|_| js_error("getReader call failed"))?;
        *self.streams_reader.borrow_mut() = Some(reader.clone());
        Ok(reader)
    }
    /// Accept the next incoming uni-directional stream and make it current.
    /// Returns `false` if the incoming-streams readable has ended.
    async fn open_next_stream(&self) -> Result<bool, JsValue> {
-        let Some(stream) = self.connection.accept_uni().await? else {
+        let streams_reader = self.ensure_streams_reader()?;
-            return Ok(false);
+
        let read_fn = js_sys::Reflect::get(&streams_reader, &JsValue::from_str("read"))
            .map_err(|_| js_error("missing read"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("read not a function"))?;
        let promise = read_fn
            .call0(&streams_reader)
            .map_err(|_| js_error("read call failed"))?
            .unchecked_into::<js_sys::Promise>();
        let result = match JsFuture::from(promise).await {
            Ok(r) => r,
            Err(e) => {
                log_stream_error_code(&e, "open_next_stream accept");
                return Err(js_error(format!("accept stream failed: {:?}", e)));
            }
        };
-        *self.stream_reader.borrow_mut() = Some(stream);
+        let done = js_sys::Reflect::get(&result, &JsValue::from_str("done"))
            .ok()
            .and_then(|v| v.as_bool())
            .unwrap_or(false);
        if done {
            return Ok(false);
        }
        let recv_stream = js_sys::Reflect::get(&result, &JsValue::from_str("value"))
            .map_err(|_| js_error("missing value"))?;
        let readable = resolve_stream_readable(&recv_stream)?;
        let reader = js_sys::Reflect::get(&readable, &JsValue::from_str("getReader"))
            .map_err(|_| js_error("missing stream getReader"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("stream getReader not a function"))?
            .call0(&readable)
            .map_err(|_| js_error("stream getReader call failed"))?;
        *self.stream_reader.borrow_mut() = Some(reader);
        self.new_stream_frame.set(true);
        Ok(true)
    }
    /// Read one chunk from the current stream. `Ok(None)` means the stream ended.
    async fn read_chunk(&self) -> Result<Option<Vec<u8>>, JsValue> {
-        let mut stream = match self.stream_reader.borrow_mut().take() {
+        let reader = match self.stream_reader.borrow().clone() {
-            Some(stream) => stream,
+            Some(r) => r,
            None => return Ok(None),
        };
-        let result = match stream.read_chunk().await {
+
-            Ok(result) => result,
+        let read_fn = js_sys::Reflect::get(&reader, &JsValue::from_str("read"))
            .map_err(|_| js_error("missing read"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("read not a function"))?;
        let promise = read_fn
            .call0(&reader)
            .map_err(|_| js_error("read call failed"))?
            .unchecked_into::<js_sys::Promise>();
        let result = match JsFuture::from(promise).await {
            Ok(r) => r,
            Err(e) => {
                log_stream_error_code(&e, "read_chunk");
                stream.release();
                return Err(js_error(format!("read failed: {:?}", e)));
            }
        };
-        if result.is_some() {
+
-            *self.stream_reader.borrow_mut() = Some(stream);
+        let done = js_sys::Reflect::get(&result, &JsValue::from_str("done"))
-        } else {
+            .ok()
-            stream.release();
+            .and_then(|v| v.as_bool())
            .unwrap_or(true);
        if done {
            return Ok(None);
        }
-        Ok(result)
+
        let value = js_sys::Reflect::get(&result, &JsValue::from_str("value"))
            .map_err(|_| js_error("missing value"))?;
        Ok(Some(js_sys::Uint8Array::new(&value).to_vec()))
    }
    /// Try to pull one complete frame out of the buffer without reading more.
@ -533,7 +449,9 @@ impl WasmTransport {
                }
                None => {
                    // Stream finished; release the reader's lock to avoid a spurious cancel.
-                    // `read_chunk` releases the raw stream lock on clean FIN.
+                    if let Some(reader) = self.stream_reader.borrow_mut().take() {
                        release_reader_lock(&reader);
                    }
                    // A frame is never allowed to span stream boundaries. The
                    // native persistent-stream sender packs frames on one
                    // stream, while the WASM sender uses one stream per frame;
@ -592,17 +510,15 @@ impl WasmTransport {
    /// Pipe-aware receive loop. Identical to `receive_loop` but detects
    /// `PipeRequest` as the first frame on a new incoming stream and routes
    /// the stream to `on_pipe` instead of `on_message`.
-    pub async fn receive_loop_with_pipes<F, G, H, I>(
+    pub async fn receive_loop_with_pipes<F, G, H>(
        &self,
        mut on_message: F,
        mut on_error: H,
        mut on_pipe: G,
        mut pipe_is_expected: I,
    ) where
        F: FnMut(JsValue),
        G: FnMut(crate::pipe::PipeReader),
        H: FnMut(JsValue),
        I: FnMut(u32) -> bool,
    {
        loop {
            match self.next_frame(self.max_message_size).await {
@ -624,44 +540,36 @@ impl WasmTransport {
                    if is_first {
                        self.new_stream_frame.set(false);
-                        if let Some(comm) = comm.as_ref() {
+                        if let Some(comm) = comm.as_ref()
-                            let is_pipe_request = Some(comm.get_type()) == pipe_request_type;
+                            && Some(comm.get_type()) == pipe_request_type
-                            let pipe_id = comm.id().filter(|id| *id != 0);
+                        {
-                            let is_expected =
+                            let Some(pipe_id) = comm.id().filter(|id| *id != 0) else {
-                                is_pipe_request && pipe_id.is_some_and(&mut pipe_is_expected);
+                                on_error(JsValue::from_str(
-                            let disposition =
+                                    "PipeRequest frame must contain a non-zero id",
-                                match classify_first_frame(is_pipe_request, comm.id(), is_expected)
+                                ));
-                                {
+                                self.close();
-                                    Ok(disposition) => disposition,
+                                break;
-                                    Err(error) => {
+                            };
-                                        on_error(JsValue::from_str(&error.to_string()));
+                            let description = comm
-                                        self.close();
+                                .get_str(mtp_codec::DataType::Description)
-                                        break;
+                                .unwrap_or("")
-                                    }
+                                .to_string();
                                };
-                            if let FirstFrameDisposition::Pipe(pipe_id) = disposition {
+                            let pending = {
-                                let description = comm
+                                let mut buf = self.buffer.borrow_mut();
-                                    .get_str(mtp_codec::DataType::Description)
+                                std::mem::take(&mut *buf)
-                                    .unwrap_or("")
+                            };
                                    .to_string();
-                                let pending = {
+                            if let Some(reader) = self.stream_reader.borrow_mut().take() {
-                                    let mut buf = self.buffer.borrow_mut();
+                                let pipe_reader = crate::pipe::PipeReader::new(
-                                    std::mem::take(&mut *buf)
+                                    reader,
-                                };
+                                    pipe_id,
-
+                                    description,
-                                if let Some(reader) = self.stream_reader.borrow_mut().take() {
+                                    pending,
-                                    let pipe_reader = crate::pipe::PipeReader::new(
+                                );
-                                        reader,
+                                on_pipe(pipe_reader);
                                        pipe_id,
                                        description,
                                        pending,
                                    );
                                    on_pipe(pipe_reader);
                                }
                                continue;
                            }
                            continue;
                        }
                    }
@ -717,7 +625,25 @@ impl WasmTransport {
        description: &str,
    ) -> Result<crate::pipe::PipeWriter, JsValue> {
        let _send_guard = self.send_lock.lock().await;
-        let mut stream = self.connection.open_uni().await?;
+        let create_stream = js_sys::Reflect::get(
            &self.inner,
            &JsValue::from_str("createUnidirectionalStream"),
        )?
        .dyn_into::<js_sys::Function>()
        .map_err(|_| js_error("createUnidirectionalStream not a function"))?;
        let stream_promise = create_stream
            .call0(&self.inner)?
            .dyn_into::<js_sys::Promise>()
            .map_err(|_| js_error("createUnidirectionalStream did not return a Promise"))?;
        let stream = JsFuture::from(stream_promise).await?;
        let writable_or_stream = resolve_stream_writable(&stream)?;
        let writer_val = js_sys::Reflect::get(&writable_or_stream, &JsValue::from_str("getWriter"))
            .map_err(|_| js_error("missing getWriter"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("getWriter not a function"))?
            .call0(&writable_or_stream)
            .map_err(|_| js_error("getWriter call failed"))?;
        let type_map = self.type_map();
        let request = mtp_codec::CommunicationValue::new_with_type_map(
@ -733,21 +659,43 @@ impl WasmTransport {
            .to_bytes()
            .map_err(|e| js_error(format!("encode failed: {}", e)))?;
-        if let Err(e) = stream.write_all(&frame_bytes).await {
+        let chunk = js_sys::Uint8Array::from(&frame_bytes[..]);
        let write_fn = js_sys::Reflect::get(&writer_val, &JsValue::from_str("write"))
            .map_err(|_| js_error("missing write"))?
            .dyn_into::<js_sys::Function>()
            .map_err(|_| js_error("write not a function"))?;
        let write_promise = write_fn
            .call1(&writer_val, &chunk)
            .map_err(|e| js_error(format!("write failed: {:?}", e)))?;
        if let Err(e) = JsFuture::from(write_promise.unchecked_into::<js_sys::Promise>()).await {
            log_stream_error_code(&e, "open_pipe write");
-            stream.release();
+            release_writer_lock(&writer_val);
            return Err(e);
        }
-        Ok(crate::pipe::PipeWriter::new(stream, pipe_id))
+        Ok(crate::pipe::PipeWriter::new(writer_val, pipe_id))
    }
    pub fn close(&self) {
        if let Some(writer) = self.outgoing_writer.borrow_mut().take() {
            // The WebTransport session close below terminates the stream. The
            // lock must be released first so dropping it is not interpreted as
            // an application abort.
            release_writer_lock(&writer);
        }
        // Release reader locks before closing so they aren't treated as cancels.
        if let Some(reader) = self.stream_reader.borrow_mut().take() {
-            reader.release();
+            release_reader_lock(&reader);
        }
        if let Some(reader) = self.streams_reader.borrow_mut().take() {
            release_reader_lock(&reader);
        }
        if let Ok(close) = js_sys::Reflect::get(&self.inner, &JsValue::from_str("close"))
            .and_then(|value| value.dyn_into::<js_sys::Function>())
        {
            let _ = close.call1(&self.inner, &js_sys::Object::new());
        }
        self.connection.close();
    }
 }
`@ -39,4 +39,4 @@ Back up host keyrings and client keyrings as protected secrets. Test restoring a`

	`### Graceful Shutdown`	`### Graceful Shutdown`

	Stop accepting new connections, reject new work at the application layer, and allow active requests and pipe writers to finish. For `MTPWebServer`, call `shutdown().await`; its `drain_timeout` controls graceful TCP HTTP completion and the QUIC drain period before remaining connection tasks are terminated.	Stop accepting new connections, reject new work at the application layer, and allow active requests and pipe writers to finish. For `MTPWebServer`, call `shutdown()`; its `drain_timeout` controls graceful TCP HTTP completion and the QUIC drain period before remaining connection tasks are terminated.