C# SDK

The C# account client is in csharp/auth.cs in mesgd-sdk. Use it to enroll an account, obtain a session, and manage public keys independently of the PKI layer. The examples use an existing account named alice; passwords and authenticator codes come from the application rather than literals in source.

Support status

The account adapter is available, but a built-in HTTPS transport is still pending. The transport argument in the examples is application code, not a missing SDK constructor.

Completeness position: 10 of 18. Local JWK/PKI and cross-language fixture tests; HTTPS transport and account-runner coverage remain pending. The language matrix explains the ranking criteria and comparable tiers. WSS readiness is listed separately; no SDK currently provides a complete, validated encrypted messaging workflow against this server.

Setup and transport

Include auth.cs in a .NET application with System.Text.Json.Nodes. The repository's csharp.csproj currently targets net10.0; use a matching SDK when building that project. The client itself exposes asynchronous account operations.

Supply Mesgd.AuthClient.Transport, an asynchronous delegate returning (int Status, JsonObject Body). Configure the application HTTP client for verified HTTPS, no redirects, and a finite timeout. The SDK does not include that transport.

A custom transport must serialize JSON, attach Authorization: Bearer TOKEN only when a token is supplied, verify the certificate and hostname, reject redirects, and use a finite timeout. Its origin is an HTTPS URL, such as https://mesgd.example.com, rather than a WebSocket URL.

Log in, read keys, and log out

Pass the current authenticator code as a six-digit string, preserving leading zeroes. This example reads the account's published keys and ends the session on its successful path. Applications that retain a session can keep the bearer until logout or expiry instead.

using System.Text.Json.Nodes;
using System.Threading.Tasks;
using Mesgd;

static class AccountExample {
    public static async Task<JsonObject> ReadKeys(
        AuthClient.Transport transport, string password, string otp) {
        var client = new AuthClient(transport);
        var session = await client.Login("alice", password, otp);
        var token = session["access_token"]!.GetValue<string>();
        try {
            return await client.Keys(token);
        } finally {
            await client.Logout(token);
        }
    }
}

Methods return Task<JsonObject>. HTTP errors throw Mesgd.AuthException with Status. Signup requires an explicit JsonArray; key updates clone the array before attaching it to a request, avoiding reuse of a JSON node with two parents.

Enroll a new account

The following fragment uses an existing client or transport from the example above. Signup returns a pending enrollment. Display qr_png_base64 or otpauth_uri, let the person configure the authenticator, then collect a code to confirm it. These calls are separate application steps, with user interaction between them.

var enrollment = await client.Signup("alice", "alice@example.com", password, new JsonArray());
// Display enrollment before obtaining enrollmentOtp.
var session = await client.Confirm("alice",
    enrollment["enrollment_token"]!.GetValue<string>(), enrollmentOtp);
var recoveryCodes = session["recovery_codes"];

Confirmation returns the first session and eight recovery codes. Display the recovery codes for separate safekeeping. A code accepted for confirmation cannot be reused for login or a key update; wait for a new authenticator step before another operation that consumes a code.

Account operations

A key update takes the session token, current password, a fresh authenticator code, and an array containing only public JWKs. An empty array clears the linked keys. A password reset takes the username, a saved recovery code, a new password, and a fresh authenticator code; success replaces the recovery codes and revokes existing sessions without returning a new session.

The shared authentication reference documents argument order, response fields, and transport behavior. Session refresh is available through the HTTP API but is not wrapped by these seven SDK operations.

Local signing and encryption

Include pki.cs in the same application assembly. The PKI class is separate from the Mesgd account namespace and is internal to that assembly.

PKI.Init("pki_keys.json");
var signature = PKI.Sign("hello");
if (!PKI.Verify("hello", signature)) throw new System.Exception("signature rejected");
var ciphertext = PKI.Encrypt("hello");
if (PKI.Decrypt(ciphertext) != "hello") throw new System.Exception("round trip failed");

This local round trip does not open a message connection. A different recipient needs its own public encryption key, and the full key file must remain private. See Keys for formats and interoperability limits.

Message connections

Account login does not establish a message connection. The current server accepts JSON WebSocket frames and can authenticate an upgrade with a login session or an issued grant token. Login sessions carry identity without path restrictions; grants limit routing to assigned patterns. See WebSocket and Routing.

The encrypted registration handshake in the ping/pong samples is not implemented by the current mesgd listener. Treat those samples as experimental cryptographic examples, with compatibility limits described in Samples.

Validation

This account module is not included in the shared auth contract runner. Check it with the application's own toolchain and transport before deployment. The presence of source examples does not imply that live HTTPS or cross-language cryptographic behavior has been validated for this implementation. Languages lists the repository's current test coverage.