Switch Nym WS transport to nym-client's binary protocol, drop second base64 layer

Client.Send now speaks nym-client's native binary websocket protocol
(tag || recipient || conn_id || data_len || data) instead of wrapping
the ciphertext in a JSON text message, which required base64-encoding
it a second time on top of the browser's own base64 layer.

The reader's self-address query also switched to the binary protocol:
nym-client picks text-vs-binary for every later "received" push based
on the format of the last request seen on a connection, so leaving the
reader in JSON/text mode would have made nym-client run a lossy UTF-8
conversion over the now-unencoded binary payload, corrupting it. Fixed
the binary Received-frame parsing along the way (previous code assumed
a fixed 16-byte tag with no length prefix, which never matched the real
protocol and was never exercised while the connection stayed text-mode).

Verified end-to-end against the real embedded nym-client 1.1.76 binary,
with the exact wire format cross-checked against upstream nym source at
the pinned build commit.

1 files changed, 70 insertions, 0 deletions

diff --git a/internal/nym/protocol.go b/internal/nym/protocol.go
new file mode 100644
index 0000000..577ac5b
--- /dev/null
+++ b/internal/nym/protocol.go
@@ -0,0 +1,70 @@
+package nym
+
+import (
+	"encoding/binary"
+	"fmt"
+)
+
+// Wire-protocol tags for nym-client's native binary websocket protocol.
+// See clients/native/websocket-requests/src/{requests,responses}.rs upstream
+// (pinned to commit f84de25302e886d4bd97a898885c569724c002a7, the exact
+// nym-client 1.1.76 build embedded in this project).
+const (
+	ReqSend        byte = 0x00
+	ReqSelfAddress byte = 0x03
+
+	RespError       byte = 0x00
+	RespReceived    byte = 0x01
+	RespSelfAddress byte = 0x02
+)
+
+// senderTagSize is AnonymousSenderTag's wire size, only present on a
+// Received push when the original sender used SendAnonymous/reply SURBs.
+const senderTagSize = 16
+
+// EncodeSelfAddressRequest builds the binary "self address" request.
+func EncodeSelfAddressRequest() []byte {
+	return []byte{ReqSelfAddress}
+}
+
+// DecodeSelfAddressResponse parses a binary SelfAddress response
+// (tag || 96-byte recipient) and formats it back into "id.enc@gw" form.
+func DecodeSelfAddressResponse(frame []byte) (string, error) {
+	if len(frame) != 1+RecipientLen || frame[0] != RespSelfAddress {
+		return "", fmt.Errorf("not a self-address response (%d bytes, tag 0x%02x)", len(frame), safeTag(frame))
+	}
+	return FormatRecipient(frame[1:])
+}
+
+// DecodeReceived extracts the message payload from a binary "Received" push:
+//
+//	tag(1) || has_sender_tag(1) || [sender_tag(16) if flag=1] || msg_len(8, BE) || msg
+func DecodeReceived(frame []byte) ([]byte, bool) {
+	if len(frame) < 2 || frame[0] != RespReceived {
+		return nil, false
+	}
+	i := 2
+	switch frame[1] {
+	case 0:
+	case 1:
+		i += senderTagSize
+	default:
+		return nil, false
+	}
+	if len(frame) < i+8 {
+		return nil, false
+	}
+	msgLen := binary.BigEndian.Uint64(frame[i : i+8])
+	i += 8
+	if uint64(len(frame)-i) != msgLen {
+		return nil, false
+	}
+	return frame[i:], true
+}
+
+func safeTag(frame []byte) byte {
+	if len(frame) == 0 {
+		return 0xff
+	}
+	return frame[0]
+}