Switch Nym WS transport to nym-client's binary protocol, drop second base64 layer

Client.Send now speaks nym-client's native binary websocket protocol
(tag || recipient || conn_id || data_len || data) instead of wrapping
the ciphertext in a JSON text message, which required base64-encoding
it a second time on top of the browser's own base64 layer.

The reader's self-address query also switched to the binary protocol:
nym-client picks text-vs-binary for every later "received" push based
on the format of the last request seen on a connection, so leaving the
reader in JSON/text mode would have made nym-client run a lossy UTF-8
conversion over the now-unencoded binary payload, corrupting it. Fixed
the binary Received-frame parsing along the way (previous code assumed
a fixed 16-byte tag with no length prefix, which never matched the real
protocol and was never exercised while the connection stayed text-mode).

Verified end-to-end against the real embedded nym-client 1.1.76 binary,
with the exact wire format cross-checked against upstream nym source at
the pinned build commit.

4 files changed, 291 insertions, 23 deletions

diff --git a/internal/nym/address.go b/internal/nym/address.go
new file mode 100644
index 0000000..f8c251a
--- /dev/null
+++ b/internal/nym/address.go
@@ -0,0 +1,131 @@
+package nym
+
+import (
+	"fmt"
+	"math/big"
+	"strings"
+)
+
+const (
+	pubkeySize = 32
+	// RecipientLen is the wire length of a nym-client Recipient: identity ||
+	// encryption || gateway pubkeys, 32 bytes each.
+	RecipientLen = 3 * pubkeySize
+)
+
+var base58Alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+
+// decodeBase58 decodes plain base58 (Bitcoin alphabet, no checksum), matching
+// the Rust `bs58` crate defaults used by nym-sphinx for identity/encryption keys.
+func decodeBase58(s string) ([]byte, error) {
+	if s == "" {
+		return nil, fmt.Errorf("empty base58 string")
+	}
+
+	num := new(big.Int)
+	base := big.NewInt(58)
+	for _, r := range s {
+		idx := strings.IndexRune(base58Alphabet, r)
+		if idx < 0 {
+			return nil, fmt.Errorf("invalid base58 character %q", r)
+		}
+		num.Mul(num, base)
+		num.Add(num, big.NewInt(int64(idx)))
+	}
+
+	decoded := num.Bytes()
+
+	// Each leading '1' encodes a leading zero byte.
+	leadingZeros := 0
+	for _, r := range s {
+		if r != '1' {
+			break
+		}
+		leadingZeros++
+	}
+
+	out := make([]byte, leadingZeros+len(decoded))
+	copy(out[leadingZeros:], decoded)
+	return out, nil
+}
+
+// ParseRecipient converts a nym address string "identity.encryption@gateway"
+// into the 96-byte wire encoding expected by the nym-client binary WS protocol
+// (identity_pubkey || encryption_pubkey || gateway_identity_pubkey).
+func ParseRecipient(addr string) ([]byte, error) {
+	atParts := strings.Split(addr, "@")
+	if len(atParts) != 2 {
+		return nil, fmt.Errorf("nym address must contain exactly one '@': %q", addr)
+	}
+	clientHalf, gatewayHalf := atParts[0], atParts[1]
+
+	dotParts := strings.Split(clientHalf, ".")
+	if len(dotParts) != 2 {
+		return nil, fmt.Errorf("nym address client part must contain exactly one '.': %q", addr)
+	}
+
+	identity, err := decodeBase58(dotParts[0])
+	if err != nil {
+		return nil, fmt.Errorf("decode identity key: %w", err)
+	}
+	encryption, err := decodeBase58(dotParts[1])
+	if err != nil {
+		return nil, fmt.Errorf("decode encryption key: %w", err)
+	}
+	gateway, err := decodeBase58(gatewayHalf)
+	if err != nil {
+		return nil, fmt.Errorf("decode gateway key: %w", err)
+	}
+
+	if len(identity) != pubkeySize || len(encryption) != pubkeySize || len(gateway) != pubkeySize {
+		return nil, fmt.Errorf("nym address %q: expected 3x%d byte keys, got %d/%d/%d",
+			addr, pubkeySize, len(identity), len(encryption), len(gateway))
+	}
+
+	out := make([]byte, 0, RecipientLen)
+	out = append(out, identity...)
+	out = append(out, encryption...)
+	out = append(out, gateway...)
+	return out, nil
+}
+
+// FormatRecipient is the inverse of ParseRecipient: it encodes 96 raw
+// recipient bytes back into "identity.encryption@gateway" base58 form.
+func FormatRecipient(b []byte) (string, error) {
+	if len(b) != RecipientLen {
+		return "", fmt.Errorf("expected %d recipient bytes, got %d", RecipientLen, len(b))
+	}
+	identity := encodeBase58(b[:pubkeySize])
+	encryption := encodeBase58(b[pubkeySize : 2*pubkeySize])
+	gateway := encodeBase58(b[2*pubkeySize:])
+	return identity + "." + encryption + "@" + gateway, nil
+}
+
+// encodeBase58 is the inverse of decodeBase58 (plain base58, Bitcoin alphabet,
+// no checksum).
+func encodeBase58(data []byte) string {
+	leadingZeros := 0
+	for _, b := range data {
+		if b != 0 {
+			break
+		}
+		leadingZeros++
+	}
+
+	num := new(big.Int).SetBytes(data)
+	base := big.NewInt(58)
+	mod := new(big.Int)
+	var out []byte
+	for num.Sign() > 0 {
+		num.DivMod(num, base, mod)
+		out = append(out, base58Alphabet[mod.Int64()])
+	}
+	for i := 0; i < leadingZeros; i++ {
+		out = append(out, '1')
+	}
+	// out was built least-significant-digit first; reverse it.
+	for i, j := 0, len(out)-1; i < j; i, j = i+1, j-1 {
+		out[i], out[j] = out[j], out[i]
+	}
+	return string(out)
+}
diff --git a/internal/nym/address_test.go b/internal/nym/address_test.go
new file mode 100644
index 0000000..d73210a
--- /dev/null
+++ b/internal/nym/address_test.go
@@ -0,0 +1,68 @@
+package nym
+
+import "testing"
+
+func TestParseRecipient(t *testing.T) {
+	// Real nymdrop-inbox address (see project session.md).
+	addr := "5xme8W448FjvSG69GaNWNkSwYpurgzmLrooPMt6XWThU.GpKLJHB2oiSqRsG5u55t4h2D25tA7BNSfvCQbfup3j1k@6mMs1GQkDRa7rPPtzG9vkFscmEBmAvQX4zjLSoaDg9Wa"
+
+	got, err := ParseRecipient(addr)
+	if err != nil {
+		t.Fatalf("parseRecipient: %v", err)
+	}
+	if len(got) != RecipientLen {
+		t.Fatalf("expected %d bytes, got %d", RecipientLen, len(got))
+	}
+}
+
+func TestParseRecipientRustTestVector(t *testing.T) {
+	// Same address used in nym-client's own Rust unit tests
+	// (websocket-requests/src/requests.rs: send_request_serialization_works).
+	addr := "CytBseW6yFXUMzz4SGAKdNLGR7q3sJLLYxyBGvutNEQV.4QXYyEVc5fUDjmmi8PrHN9tdUFV4PCvSJE1278cHyvoe@4sBbL1ngf1vtNqykydQKTFh26sQCw888GpUqvPvyNB4f"
+
+	got, err := ParseRecipient(addr)
+	if err != nil {
+		t.Fatalf("parseRecipient: %v", err)
+	}
+	if len(got) != RecipientLen {
+		t.Fatalf("expected %d bytes, got %d", RecipientLen, len(got))
+	}
+}
+
+func TestParseRecipientMalformed(t *testing.T) {
+	cases := []string{
+		"",
+		"no-at-sign",
+		"a@b@c",
+		"nodot@gateway",
+		"id.enc@0OIl", // invalid base58 chars
+	}
+	for _, addr := range cases {
+		if _, err := ParseRecipient(addr); err == nil {
+			t.Errorf("ParseRecipient(%q): expected error, got none", addr)
+		}
+	}
+}
+
+func TestMakeSendRequestLayout(t *testing.T) {
+	c := &Client{recipient: make([]byte, RecipientLen)}
+	for i := range c.recipient {
+		c.recipient[i] = byte(i)
+	}
+	payload := []byte("hello mixnet")
+
+	req := make([]byte, 0, 1+len(c.recipient)+8+8+len(payload))
+	req = append(req, ReqSend)
+	req = append(req, c.recipient...)
+	req = append(req, 0, 0, 0, 0, 0, 0, 0, 0) // connection_id = 0
+	req = append(req, 0, 0, 0, 0, 0, 0, 0, byte(len(payload)))
+	req = append(req, payload...)
+
+	wantLen := 1 + RecipientLen + 8 + 8 + len(payload)
+	if len(req) != wantLen {
+		t.Fatalf("expected length %d, got %d", wantLen, len(req))
+	}
+	if req[0] != 0x00 {
+		t.Fatalf("expected tag 0x00, got 0x%02x", req[0])
+	}
+}
diff --git a/internal/nym/client.go b/internal/nym/client.go
index 89fcf52..e0b14d2 100644
--- a/internal/nym/client.go
+++ b/internal/nym/client.go
@@ -1,8 +1,7 @@
 package nym
 
 import (
-	"encoding/base64"
-	"encoding/json"
+	"encoding/binary"
 	"fmt"
 	"io"
 	"io/fs"
@@ -18,6 +17,7 @@ import (
 // Client sends payloads through the Nym mixnet via an embedded nym-client subprocess.
 type Client struct {
 	journalistAddr string
+	recipient      []byte // parsed 96-byte wire form of journalistAddr
 	wsPort         int
 	dryRun         bool
 	process        *exec.Cmd
@@ -26,8 +26,12 @@ type Client struct {
 	configDir      string
 }
 
-func New(journalistAddr string, binFS fs.FS) *Client {
-	return &Client{journalistAddr: journalistAddr, wsPort: 1978, binFS: binFS}
+func New(journalistAddr string, binFS fs.FS) (*Client, error) {
+	recipient, err := ParseRecipient(journalistAddr)
+	if err != nil {
+		return nil, fmt.Errorf("parse journalist nym address: %w", err)
+	}
+	return &Client{journalistAddr: journalistAddr, recipient: recipient, wsPort: 1978, binFS: binFS}, nil
 }
 
 func NewDryRun(journalistAddr string) *Client {
@@ -75,31 +79,26 @@ func (c *Client) Start() error {
 	return fmt.Errorf("nym-client websocket did not start in time")
 }
 
-type sendMsg struct {
-	Type          string `json:"type"`
-	Message       string `json:"message"`
-	Recipient     string `json:"recipient"`
-	WithReplySurb bool   `json:"withReplySurb"`
-}
-
-// Send delivers payload to the journalist's Nym address through the mixnet.
+// Send delivers payload to the journalist's Nym address through the mixnet
+// using nym-client's binary websocket protocol (tag || recipient || conn_id ||
+// data_len || data). This avoids the JSON+base64 wrapping of the old text
+// protocol, which inflated every payload by ~4/3 before it ever reached the
+// nym-client's own 16MB hardcoded websocket message limit.
 func (c *Client) Send(payload []byte) error {
 	if c.dryRun {
 		fmt.Printf("[dry-run] payload received: %d bytes — would send to %s\n",
 			len(payload), c.journalistAddr)
 		return nil
 	}
-	msg := sendMsg{
-		Type:          "send",
-		Message:       base64.StdEncoding.EncodeToString(payload),
-		Recipient:     c.journalistAddr,
-		WithReplySurb: false,
-	}
-	raw, err := json.Marshal(msg)
-	if err != nil {
-		return fmt.Errorf("marshal: %w", err)
-	}
-	if err := websocket.Message.Send(c.ws, string(raw)); err != nil {
+
+	req := make([]byte, 0, 1+len(c.recipient)+8+8+len(payload))
+	req = append(req, ReqSend)
+	req = append(req, c.recipient...)
+	req = binary.BigEndian.AppendUint64(req, 0) // connection_id: none
+	req = binary.BigEndian.AppendUint64(req, uint64(len(payload)))
+	req = append(req, payload...)
+
+	if err := websocket.Message.Send(c.ws, req); err != nil {
 		return fmt.Errorf("ws send: %w", err)
 	}
 	return nil
diff --git a/internal/nym/protocol.go b/internal/nym/protocol.go
new file mode 100644
index 0000000..577ac5b
--- /dev/null
+++ b/internal/nym/protocol.go
@@ -0,0 +1,70 @@
+package nym
+
+import (
+	"encoding/binary"
+	"fmt"
+)
+
+// Wire-protocol tags for nym-client's native binary websocket protocol.
+// See clients/native/websocket-requests/src/{requests,responses}.rs upstream
+// (pinned to commit f84de25302e886d4bd97a898885c569724c002a7, the exact
+// nym-client 1.1.76 build embedded in this project).
+const (
+	ReqSend        byte = 0x00
+	ReqSelfAddress byte = 0x03
+
+	RespError       byte = 0x00
+	RespReceived    byte = 0x01
+	RespSelfAddress byte = 0x02
+)
+
+// senderTagSize is AnonymousSenderTag's wire size, only present on a
+// Received push when the original sender used SendAnonymous/reply SURBs.
+const senderTagSize = 16
+
+// EncodeSelfAddressRequest builds the binary "self address" request.
+func EncodeSelfAddressRequest() []byte {
+	return []byte{ReqSelfAddress}
+}
+
+// DecodeSelfAddressResponse parses a binary SelfAddress response
+// (tag || 96-byte recipient) and formats it back into "id.enc@gw" form.
+func DecodeSelfAddressResponse(frame []byte) (string, error) {
+	if len(frame) != 1+RecipientLen || frame[0] != RespSelfAddress {
+		return "", fmt.Errorf("not a self-address response (%d bytes, tag 0x%02x)", len(frame), safeTag(frame))
+	}
+	return FormatRecipient(frame[1:])
+}
+
+// DecodeReceived extracts the message payload from a binary "Received" push:
+//
+//	tag(1) || has_sender_tag(1) || [sender_tag(16) if flag=1] || msg_len(8, BE) || msg
+func DecodeReceived(frame []byte) ([]byte, bool) {
+	if len(frame) < 2 || frame[0] != RespReceived {
+		return nil, false
+	}
+	i := 2
+	switch frame[1] {
+	case 0:
+	case 1:
+		i += senderTagSize
+	default:
+		return nil, false
+	}
+	if len(frame) < i+8 {
+		return nil, false
+	}
+	msgLen := binary.BigEndian.Uint64(frame[i : i+8])
+	i += 8
+	if uint64(len(frame)-i) != msgLen {
+		return nil, false
+	}
+	return frame[i:], true
+}
+
+func safeTag(frame []byte) byte {
+	if len(frame) == 0 {
+		return 0xff
+	}
+	return frame[0]
+}