diff --git a/wit-0.3.0-draft/client.wit b/wit-0.3.0-draft/client.wit
new file mode 100644
index 0000000..8f282db
--- /dev/null
+++ b/wit-0.3.0-draft/client.wit
@@ -0,0 +1,22 @@
+interface client {
+    use types.{error};
+
+    resource connector {
+        constructor();
+
+        /// Set up the encryption stream transform.
+        /// This takes an unprotected `cleartext` application data stream and
+        /// returns an encrypted data stream, ready to be sent out over the network.
+        /// Closing the `cleartext` stream will cause a `close_notify` packet to be emitted on the returned output stream.
+        send: func(cleartext: stream<u8>) -> tuple<stream<u8>, future<result<_, error>>>;
+
+        /// Set up the decryption stream transform.
+        /// This takes an encrypted data stream, as received via e.g. the network,
+        /// and returns a decrypted application data stream.
+        receive: func(ciphertext: stream<u8>) -> tuple<stream<u8>, future<result<_, error>>>;
+
+        /// Perform the handshake.
+        /// The `send` & `receive` streams must be set up before calling this method.
+        connect: static async func(this: connector, server-name: string) -> result<_, error>;
+    }
+}
diff --git a/wit-0.3.0-draft/types.wit b/wit-0.3.0-draft/types.wit
new file mode 100644
index 0000000..fc6c4b1
--- /dev/null
+++ b/wit-0.3.0-draft/types.wit
@@ -0,0 +1,5 @@
+interface types {
+    resource error {
+        to-debug-string: func() -> string;
+    }
+}
diff --git a/wit-0.3.0-draft/world.wit b/wit-0.3.0-draft/world.wit
new file mode 100644
index 0000000..599d496
--- /dev/null
+++ b/wit-0.3.0-draft/world.wit
@@ -0,0 +1,6 @@
+package wasi:tls@0.3.0-draft;
+
+world imports {
+    import client;
+    import types;
+}