SDK v1.0.52 · Cepha CLI v1.0.129 · .NET 11 Proposal

WasmMvcRuntime

Client-Side ASP.NET MVC Runtime for WebAssembly.
Run Controllers, Razor Views, EF Core, Identity, and SignalR entirely in the browser — no server required.

9
Core Modules
0
Servers Required
<50ms
Navigation Latency
100%
Offline Capable

ASP.NET MVC has no client-side story.

MVC is the most widely adopted .NET web programming model — yet it requires a server. Developers with large MVC codebases have no path to deploy as static SPAs, to edge runtimes, or to offline-capable environments without a full rewrite.

Today

.NET MVC requires a server

  • MVC Controllers need ASP.NET server hosting
  • No offline capability for MVC apps
  • Migrating to Blazor requires full rewrite
  • SignalR & Identity need server infrastructure
  • No edge deployment for MVC
With WasmMvcRuntime

MVC runs entirely in the browser

  • Controllers execute in a WebAssembly Worker
  • Full offline-first with SQLite + OPFS
  • Same .cshtml Views — no rewrite needed
  • Identity & SignalR run in-process
  • Deploy to CDN, Cloudflare, Deno, Node.js
  • PassKey, 2FA & OAuth — no server identity provider
  • Security audit CI — identity, crypto, PCI-DSS compliance

Three threads. Zero server calls.

The .NET runtime boots inside a Web Worker. The main thread is a thin display surface that receives pre-rendered HTML frames and applies them at 60fps.

Main Thread
Display Surface
SPA Router · Link interception · Form handling · requestAnimationFrame rendering · CSS/Script re-hydration
postMessage
Runtime Worker
.NET WASM
MvcEngine · RazorTemplateEngine · EF Core + SQLite · Identity + RBAC + 2FA · SignalR
Data Worker
OPFS I/O
Database snapshots · Session persistence · Offline change queue
Binary Snapshots
Origin Private File System
identity.db · app-data.db · sessions.json — Persistent, large-capacity, Worker-accessible

Everything MVC, in the browser.

A complete ASP.NET MVC runtime — Controllers, Views, Database, Auth, Real-time — compiled to WebAssembly and deployed as static files.

⚙️

Full MVC Pipeline

Controller base class with ViewData, ViewBag, TempData, ModelState. Attribute routing, Areas, ApiController, and convention-based routing.

📄

Razor Views (No Roslyn)

Runtime template engine processes @Model, @ViewData, @if, @foreach, @RenderBody, @section, Html.PartialAsync, and asp-* tag helpers.

🗄️

EF Core + SQLite

Full Entity Framework Core with SQLite compiled to WASM. LINQ, migrations, relationships. Database persisted to OPFS.

🔐

Client-Side Identity

PBKDF2-SHA256 hashing, HMAC-signed session tokens, fingerprint binding, account lockout, cross-tab auth sync.

📡

In-Process SignalR

Hub discovery via reflection, Clients.All/Caller/Others/Group proxies, connection management — all running in-process.

🌐

Dual Hosting

Same code runs as a browser SPA or a Node.js/Edge API. Deploy to Cloudflare Workers, Deno, or Lambda@Edge.

🛡️

RBAC Authorization

[Authorize], [AllowAnonymous], role-based access control, claims-based policies — enforced at the MvcEngine level before action invocation.

🔑

PassKey & 2FA (TOTP)

WebAuthn/FIDO2 passkey registration, RFC 6238 TOTP authenticator with real QR codes, recovery codes — following aspnetcore patterns.

🧩

Extensible Identity Builder

Fluent AddWasmIdentity() builder: external OAuth providers, custom token providers, password policy, admin seeding — mirrors ASP.NET Core IdentityBuilder.

🖥️

Visual Studio F5 Debug

Full Visual Studio debugging with pre-configured launchSettings.json — press F5 and debug your WASM MVC app with breakpoints, watch, and hot reload.

📋

SDK Compliance Directives

All 70 source files enforce strict ASP.NET Core API fidelity. AI-assisted code generation must consult SDK_DEVELOPMENT_STANDARDS.md — zero deviation from the official surface.

🌊

Streaming Views & SignalR

[StreamingResponse] for NDJSON/SSE IAsyncEnumerable rendering. SignalR stream protocol with char-by-char chat demo. Opt-in per action — default buffered for safety.

Up and running in minutes.

Install the SDK or CLI, scaffold a project, and deploy as static files.

Install the CLI

# Install globally dotnet tool install --global Cepha.CLI # Create a new project cepha new MyApp cepha new MyApp --identity # with auth

Or use the SDK directly

<!-- MyApp.csproj --> <Project Sdk="NetWasmMvc.SDK/1.0.20"> <PropertyGroup> <TargetFramework>net10.0</TargetFramework> </PropertyGroup> </Project>

MVC + Extensible Identity

// Standard MVC — works unchanged public class HomeController : Controller { public IActionResult Index() { ViewData["Title"] = "Welcome"; return View(); } } // Extensible Identity Builder services.AddWasmIdentity(options => { options.Password.RequiredLength = 10; options.TwoFactor.EnableAuthenticator = true; options.SeedAdmin("admin@cepha.local", "Admin@Cepha!2025"); }) .AddPassKeys() .AddExternalProvider("Google", p => { p.ClientId = "your-client-id"; p.ClientSecret = "your-secret"; }) .AddDefaultTokenProviders();

Build & deploy as static files

# Build dotnet publish -c Release # Output: static files (HTML, JS, WASM) # Deploy to any CDN, GitHub Pages, # Cloudflare Pages, Azure Static Web Apps cepha publish cf # one-command deploy

What's next.

The core runtime is complete. Here's where we're headed.

Full MVC Pipeline
Controllers, Razor Views, Routing, Areas, ViewData/ViewBag/TempData
Complete
EF Core + SQLite + OPFS Persistence
Full relational database in the browser with durable storage
Complete
Client-Side Identity & SignalR
HMAC sessions, IdentityAtom, in-process hubs, cross-tab sync
Complete
CLI Tooling & Dual Hosting
Cepha.CLI scaffolding, dev server, Node.js/Edge API hosting
Complete
RBAC Authorization & Identity Builder
Fluent WasmIdentityBuilder, [Authorize]/[AllowAnonymous] attributes, role-based policies, admin seeding, external provider support
Complete
PassKey (WebAuthn) & TOTP 2FA
FIDO2 passkey registration, RFC 6238 authenticator with QR codes, recovery codes, custom token providers
Complete
WebAssembly 3.0 (SIMD + Tail-Call)
SIMD v128, relaxed SIMD, tail-call optimization — validated with wasm-tools and wasmtime
Complete
Security Audit CI Pipeline
GitHub Actions: identity compliance (14 checks), crypto compliance (7 checks), PCI-DSS v4.0 (25+ checks) — all passing
Complete
WASI Crypto Fallback
Pure managed SHA-256 (FIPS 180-4), HMAC-SHA256 (RFC 2104), HKDF-SHA256, PBKDF2-SHA256 for WASI environments
Complete
Visual Studio F5 Debug
Pre-configured launchSettings.json with HTTPS:5001/HTTP:5000 — press F5 to debug with breakpoints, IIS Express, and Blazor WASM inspector
Complete
Real TOTP 2FA (RFC 6238)
True HMAC-SHA1 TOTP with QR code generation, Base32 secrets, recovery codes, and authenticator app integration
Complete
Full ActionResults API Surface
12 new result types (BadRequest, Unauthorized, Forbid, NoContent, Conflict, Created, Accepted, etc.) + 14 new ControllerBase methods — matching official ASP.NET Core API
Complete
Strict SDK Compliance Directives
All 70 source files carry mandatory compliance headers enforcing ASP.NET Core API fidelity. AI-assisted development must consult SDK_DEVELOPMENT_STANDARDS.md before any modification
Complete
NativeAOT / Trimming
Reduce bundle from ~15-25MB to <5MB with ahead-of-time compilation
Up Next
Streaming Views & SignalR Streaming
IAsyncEnumerable rendering (NDJSON/SSE), [StreamingResponse]/[BufferedResponse] attributes, SignalR stream protocol, streaming chat demo
Complete
Blazor Interop & MAUI WebView
Embed MVC views in Blazor components, ship inside native apps
Future

Proposed for .NET 11.

This runtime is being proposed as an experimental hosting model for .NET 11. The proposal requests targeted infrastructure — an SDK target, a lightweight MvcEngine, and a Razor template contract — not a new framework.

Why Cepha exists — and what remains open.

The .NET WebAssembly toolchain has critical gaps that prevent MVC apps from publishing correctly via Visual Studio. Cepha (Cepha.CLI + NetWasmMvc.SDK) was built to bridge these gaps. The following issues remain open in the .NET runtime and directly affect this proposal.

🐛

Visual Studio Publish: Empty Output Folder

When publishing a browser-wasm project from Visual Studio's Publish dialog, the destination folder is completely empty — no _framework/, no wwwroot/, no index.html. The same project publishes correctly via dotnet publish -c Release from the command line.

Impact: Developers cannot use Visual Studio's standard Publish workflow for WebAssembly MVC apps. This is a fundamental tooling gap that prevents adoption in enterprise environments where VS-integrated deployment is expected.

📌 NetWasmMVCRuntime #39 — Tracked Issue →
📋

Client-Side ASP.NET MVC Runtime for WebAssembly

The core proposal filed in dotnet/runtime. .NET currently provides no SDK target, no MvcEngine, and no Razor template contract for running MVC in WebAssembly. The entire MVC pipeline assumes a server host — there is no Microsoft.NET.Sdk.WebAssembly.Mvc.

Status: Open · Milestone: Future · Labels: area-Meta, os-browser

🔗 dotnet/runtime #125136 — View Issue →
💬

Community Discussion: MVC WASM Feasibility

The companion discussion in dotnet/runtime seeking community feedback on whether client-side MVC for WebAssembly should be officially supported. Covers bundle size concerns, NativeAOT timeline, edge deployment interest, and the relationship with Blazor.

Key question: Should this start as an experimental SDK — similar to how Blazor began — to let the community validate the model before full investment?

🔗 dotnet/runtime #125144 — Join Discussion →
🧬

Cepha: The Bridge Until .NET Closes the Gap

While these runtime issues remain open, Cepha provides a complete solution today: a custom SDK target (NetWasmMvc.SDK), a lightweight MvcEngine, a Razor template engine, CLI tooling with cepha dev / cepha publish, and correct dotnet publish output for browser-wasm.

Cepha solves today what the .NET team has acknowledged as a gap for .NET 11+. Install Cepha.CLI and start building MVC WebAssembly apps now — no server required.

📦 Install Cepha.CLI from NuGet →