@annadata/capacitor-mqtt-quic 0.1.6 → 0.1.8

package/android/install/wolfssl-android/x86_64/share/doc/wolfssl/taoCert.txt

@@ -0,0 +1,176 @@
+
+***** Create a self signed cert ************
+
+1) openssl genrsa 1024 > client-key.pem
+
+2) openssl req -new -x509 -nodes -sha1 -days 1000 -key client-key.pem > client-cert.pem
+
+3) note md5 would be -md5
+
+-- adding metadata to beginning
+
+3) openssl x509 -in client-cert.pem -text > tmp.pem
+
+4) mv tmp.pem client-cert.pem
+
+
+***** Create a CA, signing authority **********
+
+same as self signed, use ca prefix instead of client
+
+
+***** Create a cert signed by CA **************
+
+1) openssl req -newkey rsa:1024 -sha1 -days 1000 -nodes -keyout server-key.pem > server-req.pem
+
+* note if using existing key do: -new -key keyName
+
+2) copy ca-key.pem ca-cert.srl   (why ????)
+
+3) openssl x509 -req -in server-req.pem -days 1000 -sha1 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
+
+
+***** Adding Subject Key ID and Authentication Key ID extensions to a cert *****
+
+Create a config file for OpenSSL with the example contents:
+
+    [skidakid]
+    subjectKeyIdentifier=hash
+    authorityKeyIdentifier=keyid
+
+Add to the openssl command for creating a cert signed by a CA step 3 the
+following options:
+
+    -extfile <file.cnf> -extensions skidakid
+
+anywhere before the redirect. This will add the cert's public key hash as the
+Subject Key Identifier, and the signer's SKID as the Authentication Key ID.
+
+
+***** To create a dsa cert ********************
+
+1) openssl dsaparam 512 > dsa512.param       # creates group params
+
+2) openssl gendsa dsa512.param > dsa512.pem  # creates private key
+
+3) openssl req -new -x509 -nodes -days 1000 -key dsa512.pem > dsa-cert.pem 
+
+
+
+
+***** To convert from PEM to DER **************
+
+a) openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
+
+to convert rsa private PEM to DER :
+
+b) openssl rsa -in key.pem -outform DER -out key.der
+
+
+**** To encrypt rsa key already in pem **********
+
+a) openssl rsa <server-key.pem.bak -des >server-keyEnc.pem
+
+note location of des, pass = yassl123
+
+
+*** To make a public key from a private key ******
+
+
+openssl rsa -in 1024rsa.priv -pubout -out 1024rsa.pub
+
+
+**** To convert to pkcs8 *******
+
+openssl pkcs8 -nocrypt -topk8 -in server-key.pem -out server-keyPkcs8.pem
+
+
+**** To convert to pkcs8 encrypted *******
+
+openssl pkcs8 -topk8 -in server-key.pem -out server-keyPkcs8Enc.pem
+
+passwd: yassl123
+
+to use PKCS#5 v2 instead of v1.5 which is default add
+
+-v2 des3       # file Pkcs8Enc2
+
+to use PKCS#12 instead use -v1 which a 12 algo like
+
+-v1 PBE-SHA1-3DES   # file Pkcs8Enc12 , see man pkcs8 for more info
+-v1 PBE-SHA1-RC4-128   # no longer file Pkcs8Enc12, arc4 now off by default
+
+
+**** To convert from pkcs8 to traditional ****
+
+openssl pkcs8 -nocrypt -in server-keyPkcs8.pem -out server-key.pem
+
+
+*** DH parameters ***
+
+openssl dhparam 2048 > dh2048.param
+
+to add metadata
+
+openssl dhparam -in dh2048.param -text > dh2048.pem
+
+**** ECC ******
+
+1) make a key
+
+    to see types available do
+        openssl ecparam -list_curves
+
+    make a new key
+        openssl ecparam -genkey -text -name secp256r1 -out ecc-key.pem
+
+    convert to compressed
+        openssl ec -in ecc-key.pem -conv_form compressed -out ecc-key-comp.pem 
+
+*** CRL ***
+
+1) create a crl
+
+a) openssl ca -gencrl -crldays 120 -out crl.pem -keyfile ./ca-key.pem -cert ./ca-cert.pem
+
+Error No ./CA root/index.txt so:
+
+b) touch ./CA root/index.txt
+
+a) again
+
+Error No ./CA root/crlnumber so:
+
+c) touch ./CA root/crlnumber
+
+a) again
+
+Error unable to load CRL number
+
+d) add '01' to crlnumber file
+
+a) again
+
+2)  view crl file
+
+openssl crl -in crl.pem -text
+
+3) revoke
+
+openssl ca -revoke server-cert.pem -keyfile ./ca-key.pem -cert ./ca-cert.pem
+
+Then regenerate crl with a)
+
+4) verify
+
+openssl verify -CAfile ./ca-cert.pem  ./server-cert.pem
+
+OK
+
+Make file with both ca and crl
+
+cat ca-cert.pem crl.pem > ca-crl.pem
+
+openssl verify -CAfile ./ca-crl.pem -crl_check ./ca-cert.pem
+
+revoked

package/android/src/main/cpp/CMakeLists.txt

@@ -11,28 +11,28 @@ if(NOT ANDROID_PLATFORM)
     set(ANDROID_PLATFORM android-21)
 endif()
 
-# Default OpenSSL path (can be overridden via -DOPENSSL_ROOT_DIR=...)
-if(NOT OPENSSL_ROOT_DIR)
-    set(OPENSSL_ROOT_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../install/openssl-android" CACHE PATH "Path to OpenSSL for Android")
-    # ABI-aware layout: allow installs under .../openssl-android/<abi>
-    if(EXISTS "${OPENSSL_ROOT_DIR}/${ANDROID_ABI}")
-        set(OPENSSL_ROOT_DIR "${OPENSSL_ROOT_DIR}/${ANDROID_ABI}" CACHE PATH "Path to OpenSSL for Android (ABI)" FORCE)
-    endif()
+# WolfSSL path (same layout as iOS: TLS backend for ngtcp2). Override via -DWOLFSSL_ROOT_DIR=...
+if(NOT WOLFSSL_ROOT_DIR)
+    set(WOLFSSL_ROOT_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../install/wolfssl-android" CACHE PATH "Path to WolfSSL for Android")
 endif()
-
-# Help FindOpenSSL by pointing at explicit locations when present
-if(NOT OPENSSL_INCLUDE_DIR AND EXISTS "${OPENSSL_ROOT_DIR}/include")
-    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/include")
+# Prefer ABI-specific subdir when present (e.g. when WOLFSSL_ROOT_DIR is passed as base path from Gradle)
+if(EXISTS "${WOLFSSL_ROOT_DIR}/${ANDROID_ABI}")
+    set(WOLFSSL_ROOT_DIR "${WOLFSSL_ROOT_DIR}/${ANDROID_ABI}" CACHE PATH "Path to WolfSSL for Android (ABI)" FORCE)
 endif()
-if(NOT OPENSSL_CRYPTO_LIBRARY AND EXISTS "${OPENSSL_ROOT_DIR}/lib/libcrypto.a")
-    set(OPENSSL_CRYPTO_LIBRARY "${OPENSSL_ROOT_DIR}/lib/libcrypto.a")
+if(NOT WOLFSSL_INCLUDE_DIR AND EXISTS "${WOLFSSL_ROOT_DIR}/include")
+    set(WOLFSSL_INCLUDE_DIR "${WOLFSSL_ROOT_DIR}/include")
 endif()
-if(NOT OPENSSL_SSL_LIBRARY AND EXISTS "${OPENSSL_ROOT_DIR}/lib/libssl.a")
-    set(OPENSSL_SSL_LIBRARY "${OPENSSL_ROOT_DIR}/lib/libssl.a")
+if(NOT WOLFSSL_LIBRARY AND EXISTS "${WOLFSSL_ROOT_DIR}/lib/libwolfssl.a")
+    set(WOLFSSL_LIBRARY "${WOLFSSL_ROOT_DIR}/lib/libwolfssl.a")
+endif()
+if(NOT WOLFSSL_LIBRARY OR NOT WOLFSSL_INCLUDE_DIR)
+    message(FATAL_ERROR
+        "WolfSSL not found at ${WOLFSSL_ROOT_DIR}. "
+        "One-time fix (from your app project root): "
+        "cd node_modules/@annadata/capacitor-mqtt-quic && "
+        "./build-native.sh --android-only --abi ${ANDROID_ABI} "
+        "(repeat for armeabi-v7a, x86_64). See plugin README 'Production / First-time build'.")
 endif()
-
-# Find required packages
-find_package(OpenSSL REQUIRED)
 
 # ngtcp2 install/source directories (adjust as needed)
 if(NOT NGTCP2_INSTALL_DIR)
@@ -52,7 +52,15 @@ if(NOT NGHTTP3_INSTALL_DIR)
 endif()
 set(NGHTTP3_SOURCE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../../../nghttp3" CACHE PATH "Path to nghttp3 source")
 
-# Prefer installed libraries, fallback to source build
+# Prefer ABI-specific subdir when install dirs are passed as base path from Gradle
+if(EXISTS "${NGTCP2_INSTALL_DIR}/${ANDROID_ABI}")
+    set(NGTCP2_INSTALL_DIR "${NGTCP2_INSTALL_DIR}/${ANDROID_ABI}" CACHE PATH "Path to ngtcp2 install (ABI)" FORCE)
+endif()
+if(EXISTS "${NGHTTP3_INSTALL_DIR}/${ANDROID_ABI}")
+    set(NGHTTP3_INSTALL_DIR "${NGHTTP3_INSTALL_DIR}/${ANDROID_ABI}" CACHE PATH "Path to nghttp3 install (ABI)" FORCE)
+endif()
+
+# Prefer installed libraries (WolfSSL backend: libngtcp2_crypto_wolfssl.a), fallback to source build
 set(NGTCP2_INCLUDE_DIR "")
 set(NGTCP2_LIBRARY "")
 set(NGTCP2_CRYPTO_LIBRARY "")
@@ -63,10 +71,10 @@ if(EXISTS "${NGTCP2_INSTALL_DIR}/include/ngtcp2/ngtcp2.h")
     elseif(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2.so")
         set(NGTCP2_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2.so")
     endif()
-    if(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_quictls.a")
-        set(NGTCP2_CRYPTO_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_quictls.a")
-    elseif(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_quictls.so")
-        set(NGTCP2_CRYPTO_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_quictls.so")
+    if(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_wolfssl.a")
+        set(NGTCP2_CRYPTO_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_wolfssl.a")
+    elseif(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_wolfssl.so")
+        set(NGTCP2_CRYPTO_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_wolfssl.so")
     endif()
 else()
     if(NOT EXISTS "${NGTCP2_SOURCE_DIR}/lib/includes/ngtcp2/ngtcp2.h" AND NOT EXISTS "${NGTCP2_SOURCE_DIR}/lib/ngtcp2.h")
@@ -114,14 +122,12 @@ target_include_directories(ngtcp2_client PRIVATE
     ${NGHTTP3_INCLUDE_DIR}
     ${NGTCP2_SOURCE_DIR}/lib/includes
     ${NGHTTP3_SOURCE_DIR}/lib/includes
-    ${OpenSSL_INCLUDE_DIR}
+    ${WOLFSSL_INCLUDE_DIR}
 )
 
-# Link libraries
-target_link_libraries(ngtcp2_client
-    # OpenSSL
-    ${OpenSSL_LIBRARIES}
-    # Android log
+# Link libraries: WolfSSL + ngtcp2 (same TLS backend as iOS)
+target_link_libraries(ngtcp2_client PRIVATE
+    ${WOLFSSL_LIBRARY}
     log
 )
 

package/android/src/main/cpp/ngtcp2_jni.cpp

@@ -10,11 +10,9 @@
 
 #include <ngtcp2/ngtcp2.h>
 #include <ngtcp2/ngtcp2_crypto.h>
-#include <ngtcp2/ngtcp2_crypto_quictls.h>
+#include <ngtcp2/ngtcp2_crypto_wolfssl.h>
 
-#include <openssl/ssl.h>
-#include <openssl/rand.h>
-#include <openssl/err.h>
+#include <wolfssl/ssl.h>
 
 #include <arpa/inet.h>
 #include <fcntl.h>
@@ -190,7 +188,7 @@ class QuicClient {
     if (!conn_) {
       return 0;
     }
-    int rv = ngtcp2_conn_shutdown_stream_write(conn_, stream_id, 0);
+    int rv = ngtcp2_conn_shutdown_stream_write(conn_, 0, stream_id, 0);
     if (rv != 0) {
       setError(ngtcp2_strerror(rv));
       return -1;
@@ -268,12 +266,12 @@ class QuicClient {
       if (fd == -1) {
         continue;
       }
-      if (connect(fd, rp->ai_addr, rp->ai_addrlen) == 0) {
+      if (::connect(fd, rp->ai_addr, rp->ai_addrlen) == 0) {
         memcpy(&remote_addr_, rp->ai_addr, rp->ai_addrlen);
         remote_addrlen_ = (socklen_t)rp->ai_addrlen;
         break;
       }
-      close(fd);
+      ::close(fd);
       fd = -1;
     }
     freeaddrinfo(res);
@@ -286,7 +284,7 @@ class QuicClient {
     if (getsockname(fd, (struct sockaddr *)&local_addr_, &local_addrlen_) !=
         0) {
       setError("getsockname failed");
-      close(fd);
+      ::close(fd);
       return -1;
     }
 
@@ -300,56 +298,56 @@ class QuicClient {
   }
 
   int init_tls(const std::string &alpn) {
-    if (ngtcp2_crypto_quictls_init() != 0) {
-      setError("ngtcp2_crypto_quictls_init failed");
-      return -1;
-    }
-    ssl_ctx_ = SSL_CTX_new(TLS_client_method());
+    ssl_ctx_ = wolfSSL_CTX_new(wolfTLS_client_method());
     if (!ssl_ctx_) {
-      setError("SSL_CTX_new failed");
+      setError("wolfSSL_CTX_new failed");
       return -1;
     }
-    if (ngtcp2_crypto_quictls_configure_client_context(ssl_ctx_) != 0) {
-      setError("ngtcp2_crypto_quictls_configure_client_context failed");
+    if (ngtcp2_crypto_wolfssl_configure_client_context(ssl_ctx_) != 0) {
+      setError("ngtcp2_crypto_wolfssl_configure_client_context failed");
       return -1;
     }
-    SSL_CTX_set_verify(ssl_ctx_, SSL_VERIFY_PEER, nullptr);
+    wolfSSL_CTX_set_verify(ssl_ctx_, WOLFSSL_VERIFY_PEER, nullptr);
 
-    ssl_ = SSL_new(ssl_ctx_);
+    ssl_ = wolfSSL_new(ssl_ctx_);
     if (!ssl_) {
-      setError("SSL_new failed");
+      setError("wolfSSL_new failed");
       return -1;
     }
-    SSL_set_app_data(ssl_, &conn_ref_);
-    SSL_set_connect_state(ssl_);
+    wolfSSL_set_app_data(ssl_, &conn_ref_);
+    wolfSSL_set_connect_state(ssl_);
 
     std::string alpn_vec;
     alpn_vec.push_back(static_cast<char>(alpn.size()));
     alpn_vec.append(alpn);
-    SSL_set_alpn_protos(ssl_,
-                        reinterpret_cast<const unsigned char *>(alpn_vec.data()),
-                        (unsigned int)alpn_vec.size());
-    SSL_set_tlsext_host_name(ssl_, host_.c_str());
+    wolfSSL_set_alpn_protos(ssl_,
+                            reinterpret_cast<const unsigned char *>(alpn_vec.data()),
+                            (unsigned int)alpn_vec.size());
+    wolfSSL_set_tlsext_host_name(ssl_, host_.c_str());
 
-    if (SSL_set1_host(ssl_, host_.c_str()) != 1) {
-      setError("SSL_set1_host failed");
+    if (wolfSSL_set1_host(ssl_, host_.c_str()) != 1) {
+      setError("wolfSSL_set1_host failed");
       return -1;
     }
 
     bool ca_loaded = false;
     const char *ca_file = std::getenv("MQTT_QUIC_CA_FILE");
     const char *ca_path = std::getenv("MQTT_QUIC_CA_PATH");
-    if ((ca_file && ca_file[0] != '\0') || (ca_path && ca_path[0] != '\0')) {
-      if (SSL_CTX_load_verify_locations(ssl_ctx_, ca_file, ca_path) != 1) {
+    const char *file_arg = (ca_file && ca_file[0] != '\0') ? ca_file : nullptr;
+    const char *path_arg = (ca_path && ca_path[0] != '\0') ? ca_path : nullptr;
+    if (file_arg || path_arg) {
+      if (wolfSSL_CTX_load_verify_locations(ssl_ctx_, file_arg, path_arg) == 1) {
+        ca_loaded = true;
+      } else {
         setError("Failed to load CA bundle from MQTT_QUIC_CA_FILE/CA_PATH");
         return -1;
       }
+    }
+    if (!ca_loaded && wolfSSL_CTX_set_default_verify_paths(ssl_ctx_) == 1) {
       ca_loaded = true;
     }
-    if (!ca_loaded) {
-      if (SSL_CTX_set_default_verify_paths(ssl_ctx_) == 1) {
-        ca_loaded = true;
-      }
+    if (!ca_loaded && wolfSSL_CTX_load_system_CA_certs(ssl_ctx_) == 1) {
+      ca_loaded = true;
     }
     if (!ca_loaded) {
       setError("No CA bundle available for TLS verification");
@@ -403,13 +401,13 @@ class QuicClient {
 
     ngtcp2_cid dcid, scid;
     dcid.datalen = NGTCP2_MIN_INITIAL_DCIDLEN;
-    if (RAND_bytes(dcid.data, (int)dcid.datalen) != 1) {
-      setError("RAND_bytes failed");
+    if (wolfSSL_RAND_bytes(dcid.data, (int)dcid.datalen) != 1) {
+      setError("wolfSSL_RAND_bytes failed");
       return -1;
     }
     scid.datalen = 8;
-    if (RAND_bytes(scid.data, (int)scid.datalen) != 1) {
-      setError("RAND_bytes failed");
+    if (wolfSSL_RAND_bytes(scid.data, (int)scid.datalen) != 1) {
+      setError("wolfSSL_RAND_bytes failed");
       return -1;
     }
 
@@ -658,23 +656,23 @@ class QuicClient {
       conn_ = nullptr;
     }
     if (ssl_) {
-      SSL_free(ssl_);
+      wolfSSL_free(ssl_);
       ssl_ = nullptr;
     }
     if (ssl_ctx_) {
-      SSL_CTX_free(ssl_ctx_);
+      wolfSSL_CTX_free(ssl_ctx_);
       ssl_ctx_ = nullptr;
     }
     if (fd_ != -1) {
-      close(fd_);
+      ::close(fd_);
       fd_ = -1;
     }
     if (wakeup_fds_[0] != -1) {
-      close(wakeup_fds_[0]);
+      ::close(wakeup_fds_[0]);
       wakeup_fds_[0] = -1;
     }
     if (wakeup_fds_[1] != -1) {
-      close(wakeup_fds_[1]);
+      ::close(wakeup_fds_[1]);
       wakeup_fds_[1] = -1;
     }
   }
@@ -693,7 +691,7 @@ class QuicClient {
   static void rand_cb(uint8_t *dest, size_t destlen,
                       const ngtcp2_rand_ctx *rand_ctx) {
     (void)rand_ctx;
-    if (RAND_bytes(dest, (int)destlen) != 1) {
+    if (wolfSSL_RAND_bytes(dest, (int)destlen) != 1) {
       abort();
     }
   }
@@ -703,11 +701,11 @@ class QuicClient {
                                       void *user_data) {
     (void)conn;
     (void)user_data;
-    if (RAND_bytes(cid->data, (int)cidlen) != 1) {
+    if (wolfSSL_RAND_bytes(cid->data, (int)cidlen) != 1) {
       return NGTCP2_ERR_CALLBACK_FAILURE;
     }
     cid->datalen = cidlen;
-    if (RAND_bytes(token, NGTCP2_STATELESS_RESET_TOKENLEN) != 1) {
+    if (wolfSSL_RAND_bytes(token, NGTCP2_STATELESS_RESET_TOKENLEN) != 1) {
       return NGTCP2_ERR_CALLBACK_FAILURE;
     }
     return 0;
@@ -746,10 +744,11 @@ class QuicClient {
     return 0;
   }
 
-  static int stream_close_cb(ngtcp2_conn *conn, int64_t stream_id,
-                             uint64_t app_error_code, void *user_data,
-                             void *stream_user_data) {
+  static int stream_close_cb(ngtcp2_conn *conn, uint32_t flags,
+                             int64_t stream_id, uint64_t app_error_code,
+                             void *user_data, void *stream_user_data) {
     (void)conn;
+    (void)flags;
     (void)app_error_code;
     (void)stream_user_data;
     auto *client = static_cast<QuicClient *>(user_data);
@@ -777,8 +776,8 @@ class QuicClient {
   struct sockaddr_storage local_addr_;
   socklen_t local_addrlen_;
 
-  SSL_CTX *ssl_ctx_;
-  SSL *ssl_;
+  WOLFSSL_CTX *ssl_ctx_;
+  WOLFSSL *ssl_;
   ngtcp2_conn *conn_;
   ngtcp2_crypto_conn_ref conn_ref_;
   ngtcp2_ccerr last_error_;
@@ -932,4 +931,11 @@ Java_ai_annadata_mqttquic_quic_NGTCP2Client_nativeGetLastError(
   return env->NewStringUTF(it->second->last_error());
 }
 
+// Debug-build alias: Kotlin/AGP can mangle the method name to include the module suffix.
+JNIEXPORT jstring JNICALL
+Java_ai_annadata_mqttquic_quic_NGTCP2Client_nativeGetLastError_00024annadata_1capacitor_1mqtt_1quic_1debug__J(
+    JNIEnv *env, jobject thiz, jlong connHandle) {
+  return Java_ai_annadata_mqttquic_quic_NGTCP2Client_nativeGetLastError(env, thiz, connHandle);
+}
+
 } // extern "C"

package/android/src/main/kotlin/ai/annadata/mqttquic/MqttQuicPlugin.kt

@@ -7,7 +7,10 @@ import com.getcapacitor.Plugin
 import com.getcapacitor.PluginCall
 import com.getcapacitor.PluginMethod
 import com.getcapacitor.annotation.CapacitorPlugin
+import android.os.Handler
+import android.os.Looper
 import android.system.Os
+import android.util.Base64
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -85,7 +88,19 @@ class MqttQuicPlugin : Plugin() {
                     client.disconnect()
                 }
                 client = MQTTClient(protocolVersion)
-                client.connect(host, port, clientId, username, password, cleanSession, keepalive, sessionExpiryInterval)
+                // Forward every incoming PUBLISH to JS so addListener('message', ...) receives topic + payload
+                client.onPublish = { topic, payload ->
+                    val payloadStr = try {
+                        String(payload, StandardCharsets.UTF_8)
+                    } catch (_: Exception) {
+                        Base64.encodeToString(payload, Base64.NO_WRAP)
+                    }
+                    val data = JSObject().put("topic", topic).put("payload", payloadStr)
+                    Handler(Looper.getMainLooper()).post {
+                        notifyListeners("message", data)
+                    }
+                }
+                client.connect(host, port, clientId, username, password, cleanSession ?: true, keepalive ?: 20, sessionExpiryInterval)
                 call.resolve(JSObject().put("connected", true))
                 notifyListeners("connected", JSObject().put("connected", true))
             } catch (e: Exception) {
@@ -184,7 +199,7 @@ class MqttQuicPlugin : Plugin() {
                 val properties = mutableMapOf<Int, Any>()
                 messageExpiryInterval?.let { properties[MQTT5PropertyType.MESSAGE_EXPIRY_INTERVAL.toInt()] = it }
                 contentType?.let { properties[MQTT5PropertyType.CONTENT_TYPE.toInt()] = it }
-                client.publish(topic, data, minOf(qos, 2), if (properties.isNotEmpty()) properties else null)
+                client.publish(topic, data, minOf(qos ?: 0, 2), if (properties.isNotEmpty()) properties else null)
                 call.resolve(JSObject().put("success", true))
             } catch (e: Exception) {
                 val msg = e.message ?: "Publish failed"
@@ -211,7 +226,7 @@ class MqttQuicPlugin : Plugin() {
 
         scope.launch {
             try {
-                client.subscribe(topic, minOf(qos, 2), subscriptionIdentifier)
+                client.subscribe(topic, minOf(qos ?: 0, 2), subscriptionIdentifier)
                 call.resolve(JSObject().put("success", true))
             } catch (e: Exception) {
                 call.reject(e.message ?: "Subscribe failed")

package/android/src/main/kotlin/ai/annadata/mqttquic/client/MQTTClient.kt

@@ -57,6 +57,9 @@ class MQTTClient {
     private var keepaliveJob: kotlinx.coroutines.Job? = null
     private var nextPacketId = 1
     private val subscribedTopics = mutableMapOf<String, (ByteArray) -> Unit>()
+    /** Optional global callback for every incoming PUBLISH (topic, payload). Used by plugin to forward to JS. */
+    @Volatile
+    var onPublish: ((String, ByteArray) -> Unit)? = null
     /** Per-connection Topic Alias map (alias -> topic name) for MQTT 5.0 incoming PUBLISH. */
     private val topicAliasMap = mutableMapOf<Int, String>()
     private val lock = Mutex()
@@ -369,9 +372,9 @@ class MQTTClient {
     /** Send PINGREQ at effectiveKeepalive interval so server sees activity and does not close (idle/keepalive). [MQTT-3.1.2-20] */
     private fun startKeepaliveLoop() {
         keepaliveJob?.cancel()
-        val ka = lock.withLock { effectiveKeepalive }
-        if (ka <= 0) return
         keepaliveJob = scope.launch {
+            val ka = lock.withLock { effectiveKeepalive }
+            if (ka <= 0) return@launch
             while (isActive) {
                 delay(ka * 1000L) // seconds to ms
                 val (w, stillConnected) = lock.withLock {
@@ -425,14 +428,14 @@ class MQTTClient {
                                 if (activeProtocolVersion == MQTTProtocolLevel.V5) {
                                     MQTT5Protocol.parsePublishV5(rest, 0, qos, topicAliasMap)
                                 } else {
-                                    val t = MQTTProtocol.parsePublish(rest, 0, qos)
-                                    Triple(t.first, t.second, t.third)
+                                    MQTTProtocol.parsePublish(rest, 0, qos)
                                 }
                             }
 
-                            val (cb, _) = lock.withLock {
-                                subscribedTopics[topic] to activeProtocolVersion
+                            val (cb, globalCb) = lock.withLock {
+                                subscribedTopics[topic] to onPublish
                             }
+                            globalCb?.invoke(topic, payload)
                             cb?.invoke(payload)
 
                             if (qos >= 1 && packetId != null) {

package/android/src/main/kotlin/ai/annadata/mqttquic/mqtt/MQTTProtocol.kt

@@ -201,9 +201,9 @@ object MQTTProtocol {
     
     /**
      * Parse PUBLISH payload (after fixed header).
-     * Returns (topic, packetId?, payload, newOffset). packetId only for QoS > 0.
+     * Returns (topic, packetId?, payload). packetId only for QoS > 0.
      */
-    fun parsePublish(data: ByteArray, offset: Int, qos: Int): Triple<String, Int?, ByteArray, Int> {
+    fun parsePublish(data: ByteArray, offset: Int, qos: Int): Triple<String, Int?, ByteArray> {
         var off = offset
         val (topic, next) = decodeString(data, off)
         off = next
@@ -214,7 +214,7 @@ object MQTTProtocol {
             off += 2
         }
         val payload = data.copyOfRange(off, data.size)
-        return Triple(topic, pid, payload, data.size)
+        return Triple(topic, pid, payload)
     }
 
     fun buildSubscribe(packetId: Int, topic: String, qos: Int = 0): ByteArray {

package/android/src/main/kotlin/ai/annadata/mqttquic/mqtt/MQTTTypes.kt

@@ -5,21 +5,21 @@ package ai.annadata.mqttquic.mqtt
  */
 
 object MQTTMessageType {
-    const val CONNECT: Byte = 0x10
-    const val CONNACK: Byte = 0x20
-    const val PUBLISH: Byte = 0x30
-    const val PUBACK: Byte = 0x40
-    const val PUBREC: Byte = 0x50
-    const val PUBREL: Byte = 0x62
-    const val PUBCOMP: Byte = 0x70
-    const val SUBSCRIBE: Byte = 0x82
-    const val SUBACK: Byte = 0x90
-    const val UNSUBSCRIBE: Byte = 0xA2
-    const val UNSUBACK: Byte = 0xB0
-    const val PINGREQ: Byte = 0xC0
-    const val PINGRESP: Byte = 0xD0
-    const val DISCONNECT: Byte = 0xE0
-    const val AUTH: Byte = 0xF0
+    const val CONNECT: Byte = 0x10.toByte()
+    const val CONNACK: Byte = 0x20.toByte()
+    const val PUBLISH: Byte = 0x30.toByte()
+    const val PUBACK: Byte = 0x40.toByte()
+    const val PUBREC: Byte = 0x50.toByte()
+    const val PUBREL: Byte = 0x62.toByte()
+    const val PUBCOMP: Byte = 0x70.toByte()
+    const val SUBSCRIBE: Byte = 0x82.toByte()
+    const val SUBACK: Byte = 0x90.toByte()
+    const val UNSUBSCRIBE: Byte = 0xA2.toByte()
+    const val UNSUBACK: Byte = 0xB0.toByte()
+    const val PINGREQ: Byte = 0xC0.toByte()
+    const val PINGRESP: Byte = 0xD0.toByte()
+    const val DISCONNECT: Byte = 0xE0.toByte()
+    const val AUTH: Byte = 0xF0.toByte()
 }
 
 object MQTTConnectFlags {

package/android/src/main/kotlin/ai/annadata/mqttquic/quic/NGTCP2Client.kt

@@ -47,6 +47,7 @@ class NGTCP2Client : QuicClient {
     private external fun nativeClose(connHandle: Long)
     private external fun nativeIsConnected(connHandle: Long): Boolean
     internal external fun nativeCloseStream(connHandle: Long, streamId: Long): Int
+    @JvmName("nativeGetLastError")
     internal external fun nativeGetLastError(connHandle: Long): String
     
     // Connection state