Changes for version 0.001
- Initial distribution scaffold.
- Establish HTTP protocol, transport, message, transaction, and high-level client-operation boundaries.
- Use the flat Linux::Event::HTTP namespace and make the server-side transport class Linux::Event::HTTP::Server::Connection.
- Require Linux::Event 0.113 for the Listener, tuning, TLS, and stream APIs used by this distribution.
- Vendor picohttpparser for self-contained native HTTP/1 request-head parsing.
- Add strict obs-fold rejection and explicit header-count limits above pico.
- Add native Request state with lazy method, target, and header materialization.
- Preserve original header spelling, duplicate values, and legal underscore names.
- Validate HTTP/1 Host, Content-Length, Transfer-Encoding, body framing, and persistence.
- Reject ambiguous TE/CL framing and unsupported request transfer codings.
- Define Request and Response as direction-neutral HTTP message classes shared by client and server code rather than endpoint-role-specific objects.
- Add public locally constructible Request and Response messages while preserving the existing lazy XS-backed representation for parsed server Requests.
- Keep Response transport-independent: it owns response message metadata/body state but no Connection, peer Request, output writer, or protocol-handoff lifecycle.
- Use protocol-neutral message accessors such as version(), while keeping HTTP/1 framing and persistence decisions private to the HTTP/1 execution layer.
- Add symmetric header APIs including add_header, remove_header, header_values, exact indexed header access, content_length, body, and is_complete.
- Add Linux::Event::HTTP::Transaction to represent exactly one Request/Response exchange with coarse lifecycle state, cancellation, completion, and errors.
- Keep the server callback shape on_request($conn, $req, $res); expose the active exchange as $conn->transaction rather than adding another callback argument.
- Separate Response message completion from server transport-output completion so Response->is_complete describes the HTTP message rather than socket write state.
- Move response-output start/completion state from Response to Transaction.
- Define Response->body as a complete scalar byte body declaration.
- Move incremental response-body producer ownership from Response to Transaction; use $conn->transaction->response_body for server-side incremental output.
- Keep Body::Stream writes on Linux::Event's existing ordered-byte output machinery, preserving cooperative backpressure and avoiding a second HTTP output queue.
- Make Transaction->response_body lazy and stable; selecting it does not commit response metadata, while the first producer write or completion starts output and freezes metadata.
- Keep complete scalar body and incremental producer selection mutually exclusive.
- Remove transitional public Response->write, Response->complete, and Response->stream_body methods rather than carrying compatibility aliases into the initial release.
- Remove Response connection/request/output/Upgrade lifecycle accessors so Request and Response remain usable as the same message classes on client and server.
- Expose Request->is_complete at the actual received body boundary and Response->is_complete at the complete scalar/final incremental body boundary.
- Lock response status and headers when protocol output commits the message, not merely when complete body bytes become known.
- Defer scalar response output until the enclosing HTTP callback returns so metadata may still be configured after body assignment.
- Add Transaction->send_response for a scalar Response completed later from another event callback, avoiding a hidden Connection back-reference in Response.
- Stream Content-Length request bodies through cached on_body callbacks.
- Decode chunked request bodies natively with picohttpparser while preserving pipeline bytes.
- Add on_request_end request completion and body draining when no consumer is installed.
- Support HTTP/1.1 Expect: 100-continue and reject unsupported expectations with 417.
- Add automatic HTTP/1.1 chunked framing for incremental response output when Content-Length is unknown.
- Fall back to close-delimited output for unknown-length HTTP/1.0 responses.
- Add HTTP::Server as a thin Listener convenience with retained constructor callbacks, application data propagation, and configurable Server::Connection subclasses.
- Adopt Linux::Event Listener stream recipes for accepted HTTP Connections and remove the private acceptance adapter so Listener constructs connection_class directly.
- Expose Server tuning and TLS deployment policy directly, use stream_tuning class defaults, and distinguish accepted-Connection on_error from on_listener_error.
- Preserve constructor-callback override semantics through Server acceptance without allocating per-connection wrapper closures or adding per-request Server dispatch.
- Compose HTTP body-producer drain/cancellation bookkeeping with custom Connection on_drain and on_close lifecycle callbacks rather than replacing subclass behavior.
- Integrate HTTPS through Linux::Event declarative TLS policy on the configured Server::Connection subclass, including server-handshake validation and HTTP/1.1 ALPN.
- Verify TLS readiness precedes HTTP dispatch and expose negotiated ALPN, protocol, and cipher through ordinary Server::Connection transport accessors.
- Move validated HTTP/1.1 101 handoff from Response->upgrade to Transaction->upgrade while preserving live transport state.
- Expose Transaction Upgrade pending state and complete the HTTP Transaction before Linux::Event transition_to() hands the same live stream to the target protocol.
- Preserve same-read post-HTTP bytes across Upgrade, keep the normal request-end callback lifecycle, and queue the 101 response before target-protocol output.
- Add Linux::Event::HTTP::Client::Connection as the low-level HTTP/1 client executor on Linux::Event::IO::Sock::Stream.
- Serialize complete scalar Request messages and add Content-Length when needed.
- Add Transaction-owned streaming client Request bodies through the shared Body::Stream producer abstraction without adding a second HTTP output queue.
- Enforce exact streamed Content-Length when declared; automatically use HTTP/1.1 chunked transfer coding for unknown-length streams and require Content-Length for HTTP/1.0 streaming Requests.
- Compose streaming Request producer on_drain with Linux::Event transport drain and custom Client::Connection subclass on_drain behavior.
- Cancel unfinished Request producers on early final Responses and mark the HTTP/1 connection non-reusable rather than continuing to emit bytes for a finished exchange.
- Parse HTTP/1 response heads strictly in Perl as the correctness baseline before considering response-parser XS; reuse the existing native _HTTP1::Chunked decoder.
- Deliver client response bodies incrementally for Content-Length, chunked, and close-delimited framing; drain/discard when no on_body callback is installed.
- Support informational responses, reject ambiguous TE/CL response framing, and validate explicit HTTP/1.1 101 Upgrade handoff separately from ordinary 1xx flow.
- Add explicit client Upgrade handoff with upgrade_to and on_upgrade on both Client::Connection and the high-level Client operation API.
- Require bodyless HTTP/1.1 Upgrade requests with Connection: Upgrade and at least one offered Upgrade protocol; reject invalid requests before wire output.
- Validate 101 responses before handoff, including Connection: Upgrade, no message framing fields, and selection of a protocol actually offered by the Request.
- Complete the HTTP Response and Transaction before Linux::Event transition_to() hands the same live client stream object to the target protocol class.
- Preserve bytes already read after a 101 response head and deliver them to the transitioned protocol class without another socket or transport queue.
- Regenerate Upgrade handshake fields across redirect hops and keep a successfully upgraded stream permanently outside the HTTP idle-connection pool.
- Add explicit HTTP/1.1 CONNECT tunneling with tunnel_to and on_tunnel on Client::Connection, using authority-form request targets and the same live Linux::Event stream transition model as Upgrade.
- Add Client->connect_tunnel(proxy_url,target_authority,...) as a high-level explicit tunnel operation without making ordinary requests implicitly proxy-aware.
- Reject CONNECT request bodies, Content-Length, and Transfer-Encoding by field presence, require Host to match the authority target, and fail invalid CONNECT configurations before protocol execution.
- Treat any successful 2xx CONNECT response as the HTTP-to-tunnel boundary at the end of the response head, ignoring Content-Length and Transfer-Encoding on that 2xx and preserving already-read bytes as tunnel input.
- Keep non-2xx CONNECT responses as ordinary HTTP so proxy errors such as 407 can use normal incremental or bounded body handling and persistent proxy connections can be reused when framing permits it.
- Keep successfully tunneled connections permanently outside the HTTP idle pool while allowing an explicit HTTP or HTTPS proxy endpoint to be reused after failed CONNECT.
- Keep one in-flight Transaction per HTTP/1 client connection and support sequential persistent reuse without enabling HTTP/1 pipelining.
- Make client Transaction cancellation close the HTTP/1 connection rather than risk reusing a socket with an unfinished response on the wire.
- Add Linux::Event::HTTP::Client as the ordinary URL-oriented client entry point with request/get/head/post/put/delete methods returning Client::Operation objects.
- Add Linux::Event::HTTP::Client::Operation as the high-level client lifecycle object; keep Transaction defined as exactly one HTTP exchange while an Operation can retain the ordered Transaction history for redirects and authentication retries.
- Use URI for URL parsing while keeping full URLs out of Request; synthesize Host and use path/query as the canonical direct request-target.
- Add bounded automatic redirect following for 301, 302, 303, 307, and 308 with a default max_redirects of five and a per-request override.
- Resolve relative Location values against the current absolute URL and preserve inherited fragment state for redirect processing without transmitting fragments in HTTP request-targets.
- Apply familiar redirect method semantics: 301/302 POST to GET, 303 to GET except HEAD remains HEAD, and 307/308 preserve method and body.
- Replay complete scalar bodies on method-preserving redirects but reject automatic replay of streaming Request producers because they are not inherently rewindable.
- Regenerate Host and HTTP framing fields for every redirect hop; strip Authorization and caller-managed Cookie on cross-origin target redirects, retain manually supplied Proxy-Authorization only for the same selected proxy route, and regenerate connection-specific fields rather than forwarding them verbatim.
- Keep on_response/on_body/on_complete focused on the final response; expose on_redirect($operation,$tx,$res,$next_url) for completed intermediate redirects while retaining every Transaction in Operation history.
- Make max_redirects => 0 disable redirect interpretation completely so a 3xx, including duplicate Location fields, is delivered as an ordinary final response.
- Add a bounded initial reuse policy that retains at most one idle connection per route origin while allowing concurrent requests to use separate connections.
- Let each redirect hop independently evaluate its target origin while selecting or reusing the operation's route connection when eligible.
- Integrate HTTPS through Linux::Event TLS transport policy with the same Client and Client::Connection classes and HTTP/1.1-only ALPN advertisement.
- Add explicit buffer_body => $max_bytes client response buffering on top of the incremental body path without introducing implicit or unbounded accumulation.
- Count the buffer limit against delivered body bytes after HTTP/1 transfer framing; reject known oversized Content-Length bodies before accumulation and unknown-size bodies when decoded accumulation would cross the configured bound.
- Apply the same response-buffer bound while intermediate redirect and authentication challenge bodies are consumed.
- Keep buffered response metadata committed/read-only, expose the completed scalar through Response->body only after the final message boundary, and close the HTTP/1 connection on buffer-limit failure so unread response bytes cannot be reused.
- Add client tests for scalar and streaming request bodies, fixed/chunked/ close-delimited responses, informational responses, ambiguous framing rejection, cancellation, URL handling, connection reuse, concurrency, HTTPS, bounded whole-response buffering, producer backpressure, early upload cancellation, redirect chains, relative Location resolution, method/body transformation, cross-origin credential stripping, redirect limits, disabled redirect policy, client Upgrade validation, same-read protocol handoff, redirected Upgrade, CONNECT validation, successful same-read tunnel handoff, non-2xx proxy response, forward-proxy routing, default-proxy selection, cookie-jar target isolation, target/proxy authentication retries, Digest auth-int context, authenticated CONNECT, and streaming-body authentication replay refusal.
- Add a forked end-to-end HTTP benchmark harness with persistent connections, pipelining, request-body workloads, latency percentiles, JSON output, and optional Linux::Event loop profiling.
- Add a reproducible cross-server comparison harness for Linux::Event, Feersum, Mojolicious, Node.js, Go, aiohttp, and optional libh2o reference runs.
- Keep on_request -> Response as the single server request API while transparently optimizing eligible scalar Response->body calls with a narrow native builder.
- Consolidate request parsing, chunked decoding, response serialization, and the default-final builder into one private Linux::Event::HTTP::_HTTP1 extension.
- Remove the benchmark-oriented on_request_final public shortcut while retaining its useful optimization lesson inside the ordinary Response->body path.
- Preserve the native default scalar-response fast path while making it terminate the same Transaction lifecycle as the general response path.
- Keep a focused response-finalization benchmark for supported callback shapes and update the transaction-ladder contract for the callback-return body commit point.
- Add ordered keep-alive/pipelined request dispatch and deferred response support.
- Add focused Transaction tests covering pairing, request/response completion, cancellation, body-producer backpressure, chunking, close delimiting, deferred send, Upgrade, and the native scalar fast path.
- Simplify the README around the ordinary Client and Server APIs, leaving advanced Connection, framing, and lifecycle detail in the architecture document and POD.
- Add parser benchmarks, provenance documentation, and distribution integrity tests.
- Add server-side Transaction->tunnel() and is_tunneling for explicit acceptance of valid HTTP/1.1 CONNECT requests without adding a new server callback or message type.
- Validate server CONNECT authority-form targets, matching Host, absent request body and framing fields, and a bodyless 2xx response with no framing fields or Connection: close before scheduling handoff.
- Complete the server CONNECT Request/Response Transaction before Linux::Event transition_to() hands the same accepted stream to the target protocol, preserving already-read post-head bytes as tunnel input and retaining object identity.
- Keep rejected CONNECT requests on the ordinary HTTP response path so non-2xx bodies, persistent reuse, and later pipelined requests continue to work normally.
- Keep upstream destination authorization, upstream connection creation, and byte relay/bridge ownership outside Linux::Event::HTTP; server CONNECT adds no proxy framework, second transport object, output queue, or protocol-specific XS.
- Add explicit per-request forward-proxy routing with proxy => $proxy_url for ordinary high-level Client requests; direct requests remain origin-form while proxied requests use HTTP/1 absolute-form and regenerate Host from the target URL.
- Keep target origin and route origin separate: redirects, target authentication, cookies, and Operation URLs use the target, while connection acquisition, proxy authentication, and idle reuse use the explicit proxy route.
- Allow HTTP or HTTPS proxy endpoints without making HTTPS target URLs imply CONNECT; connect_tunnel() remains the explicit tunnel API.
- Add a Client-level default proxy, a read-only proxy accessor, per-request proxy override, and proxy => undef as an explicit direct-route bypass.
- Keep Client::Connection proxy-unaware and add no environment-proxy discovery, PAC/NO_PROXY policy, SOCKS behavior, second output queue, or proxy-specific XS.
- Add HTTP::CookieJar 0.014 as the cookie-policy implementation rather than reimplementing RFC cookie storage and selection in Linux::Event::HTTP.
- Accept an explicitly injected Client cookie_jar and expose it through a read-only accessor; do not create hidden cookie state or decide persistence/sharing policy.
- Generate Cookie from cookie_header($target_url) before each ordinary request exchange and feed every Set-Cookie field to add($target_url,$value) before redirect, authentication, or application response processing.
- Recompute jar-managed Cookie on every redirect target, keeping proxy routes entirely outside cookie-origin decisions and delegating domain, path, expiry, Secure handling, and cookie ordering to HTTP::CookieJar.
- Reject caller Cookie fields while cookie_jar is configured so cookie selection has one owner; applications can seed or alter state directly through the jar.
- Keep connect_tunnel() outside cookie-jar policy.
- Add Uniform::HTTP::Auth 0.02 from the Uniform-HTTP distribution as the HTTP authentication implementation rather than reimplementing Basic, Bearer, Digest, challenge parsing, or Digest nonce state in Linux::Event::HTTP.
- Add Client auth and proxy_auth policy objects for target 401 / WWW-Authenticate and proxy 407 / Proxy-Authenticate respectively, with Client defaults and per-operation override/bypass.
- Keep Uniform responsible for authentication mechanics while Linux::Event::HTTP owns challenge reception, target-versus-route origin selection, replayability, response draining, connection reuse, retry Transactions, and callback lifecycle.
- Add max_auth_retries (default three), auth_retry_count, and separate redirect/auth accounting so each automatic challenge retry is another Transaction without distorting redirect_count.
- Supply Uniform the exact wire request-target: origin-form for direct requests, absolute-form for ordinary proxy requests, and authority-form for CONNECT.
- Replay complete scalar Request bodies and supply entity_body for Digest auth-int, while refusing automatic authentication retry for streaming producers because their application state is not inherently rewindable.
- Keep generated Authorization and Proxy-Authorization attempt-local rather than propagating them across redirects; allow a proxy-authenticated attempt that receives target 401 to retain proxy authentication while adding target Authorization.
- Let connect_tunnel() use proxy_auth for 407 challenge/retry before successful 2xx handoff, while keeping target auth and cookies outside CONNECT policy.
- Reject manually supplied Authorization or Proxy-Authorization when the corresponding Uniform manager is active so each authentication field has one policy owner.
- Make Request and Response conform by behavior to the Uniform::HTTP 0.02 message contract without replacing the native/live message classes or adding inheritance.
- Make public header_values return an array reference, preserve first-occurrence position on header replacement, return undef for past-end indexed access, and expose explicit buffered-body, mutability, lossless-header, and exact-target capabilities.
- Preserve the lazy XS-backed parsed Request representation and private list-oriented header access for executor hot paths while exposing the Uniform-compatible public API.
- Pass the actual Linux::Event::HTTP::Request object to Uniform::HTTP::Auth 0.02 so method, exact request-target, and buffered scalar body come through the shared message contract without consuming incremental body producers.
- Add focused Uniform message-contract coverage including an XS-parsed native Request.
- Repair the transaction-lifecycle diagnostic to the Transaction-owned response lifecycle and run its smoke mode in regular latest-Perl CI to prevent benchmark/API drift before release.
- Complete CPAN metadata for all public modules, mark private helper packages no_index, and include all advertised benchmark backends in the distribution MANIFEST.
Modules
native HTTP protocol support for Linux::Event
writable producer for a streaming HTTP body
asynchronous HTTP client
one HTTP/1 client connection
lifecycle of one high-level HTTP client operation
HTTP request message
HTTP response message
HTTP server endpoint
HTTP/1 connection protocol state
lifecycle of one HTTP request/response exchange