raptor 0.20.2 → 0.22.0

data/lib/raptor/http2.rb

@@ -4,8 +4,11 @@
 require "stringio"
 
 require "atomic-ruby/atom"
+require "atomic-ruby/atomic_boolean"
+require "atomic-ruby/atomic_condition_variable"
 require "rack"
 
+require_relative "detached_body"
 require_relative "http"
 require_relative "raptor_http2"
 require_relative "thread_locals"
@@ -14,13 +17,14 @@ module Raptor
   # Handles HTTP/2 request processing and Rack application integration.
   #
   class Http2
-    # Serialises concurrent frame writes on a single HTTP/2 connection so
-    # exactly one thread is writing at any moment.
+    RESPONSE_TRAILERS = "raptor.response_trailers"
+
+    # Queues concurrent frame writes while the reactor remains the sole
+    # owner of the connection socket.
     #
     class Writer
-      IDLE = :idle
-
-      # @rbs @state: Atom
+      # @rbs @reactor: Reactor?
+      # @rbs @connection_id: Integer?
       # @rbs @write_timeout: Integer
 
       # Creates a new Writer.
@@ -30,57 +34,63 @@ module Raptor
       #
       # @rbs (write_timeout: Integer) -> void
       def initialize(write_timeout:)
-        @state = Atom.new(IDLE)
+        @reactor = nil
+        @connection_id = nil
         @write_timeout = write_timeout
       end
 
-      # Writes frames to the socket, coordinating with concurrent writers
-      # so that exactly one thread is actively writing at any time.
+      # Routes subsequent frame writes through the connection's reactor.
+      #
+      # @param reactor [Reactor] the reactor that owns the connection
+      # @param connection_id [Integer] unique connection identifier
+      # @return [void]
+      #
+      # @rbs (Reactor reactor, Integer connection_id) -> void
+      def attach(reactor, connection_id)
+        @reactor = reactor
+        @connection_id = connection_id
+      end
+
+      # Queues frames for the reactor to write. Before attachment, writes
+      # directly so the writer remains usable during connection setup.
       #
       # @param socket [OpenSSL::SSL::SSLSocket] the connection socket
-      # @param frames [Array<String>] frame bytes to write in order
+      # @param frames [Array<String>, nil] frame bytes to write in order
       # @return [void]
       #
-      # @rbs (OpenSSL::SSL::SSLSocket socket, Array[String] frames) -> void
+      # @rbs (OpenSSL::SSL::SSLSocket socket, Array[String]? frames) -> void
       def write_frames(socket, frames)
         return if !frames || frames.empty?
 
-        claimed = false
-        @state.swap do |current|
-          if current.equal?(IDLE)
-            claimed = true
-            frames
-          else
-            claimed = false
-            current + frames
-          end
+        if @reactor
+          @reactor.write_http2_frames(@connection_id, frames)
+        else
+          Http.socket_write(socket, frames.join, timeout: @write_timeout) rescue nil
         end
+      end
 
-        return unless claimed
-
-        loop do
-          pending = nil
-          @state.swap do |current|
-            pending = current
-            current.empty? ? IDLE : []
-          end
-
-          break if pending.empty?
-
-          Http.socket_write(socket, pending.join, timeout: @write_timeout) rescue nil
-        end
+      # Attaches a response body that outlives its application thread.
+      #
+      # @rbs (Integer stream_id, DetachedBody body, ^(Symbol) -> void finished) -> bool
+      def attach_body(stream_id, body, finished)
+        @reactor.attach_http2_body(@connection_id, stream_id, body, finished)
       end
     end
 
-    # Tracks the peer's connection-level and per-stream receive windows so
-    # outbound `DATA` frames respect RFC 7540 section 5.2.
+    class StreamClosedError < StandardError
+      # @rbs () -> String
+      def message = "HTTP/2 stream closed"
+    end
+
+    # Coordinates outbound flow control and stream cancellation without
+    # polling or mutexes.
     #
     class FlowControl
-      ACQUIRE_POLL_INTERVAL = 0.001
-
       # @rbs @connection_window: Atom
       # @rbs @stream_windows: Atom
       # @rbs @initial_stream_window: Atom
+      # @rbs @cancelled_streams: Atom
+      # @rbs @available: AtomicConditionVariable
 
       # Creates a new FlowControl with the spec-default windows.
       #
@@ -91,32 +101,25 @@ module Raptor
         @connection_window = Atom.new(DEFAULT_WINDOW_SIZE)
         @stream_windows = Atom.new({})
         @initial_stream_window = Atom.new(DEFAULT_WINDOW_SIZE)
+        @cancelled_streams = Atom.new({})
+        @available = AtomicConditionVariable.new
       end
 
-      # Reserves outbound capacity on the given stream, polling until at
+      # Reserves outbound capacity on the given stream, waiting until at
       # least one byte is available on both the connection and stream
-      # windows. The returned size is capped at `MAX_FRAME_SIZE`.
+      # windows. Raises when the stream or connection closes.
       #
       # @param stream_id [Integer] the HTTP/2 stream identifier
       # @param max_bytes [Integer] the largest size the caller would like to send
-      # @param end_stream [Boolean] true when this is the final frame on the stream
       # @return [Integer] the number of bytes the caller may now send
       #
-      # @rbs (Integer stream_id, Integer max_bytes, ?end_stream: bool) -> Integer
-      def acquire(stream_id, max_bytes, end_stream: false)
+      # @rbs (Integer stream_id, Integer max_bytes) -> Integer
+      def acquire(stream_id, max_bytes)
         initial = @initial_stream_window.value
         capped = max_bytes < MAX_FRAME_SIZE ? max_bytes : MAX_FRAME_SIZE
 
-        if end_stream && capped <= initial && !@stream_windows.value.key?(stream_id)
-          loop do
-            granted = reserve_connection(capped)
-            return granted if granted.positive?
-
-            sleep ACQUIRE_POLL_INTERVAL
-          end
-        end
-
-        loop do
+        @available.wait do
+          check(stream_id)
           stream_window = @stream_windows.value[stream_id] || initial
           capped_full = capped < stream_window ? capped : stream_window
           granted = capped_full.positive? ? reserve_connection(capped_full) : 0
@@ -126,11 +129,33 @@ module Raptor
               current = windows[stream_id] || initial
               windows.merge(stream_id => current - granted)
             end
-            return granted
+            granted
           end
+        end
+      end
 
-          sleep ACQUIRE_POLL_INTERVAL
+      # Reserves outbound capacity without waiting for a window update.
+      #
+      # @param stream_id [Integer] the HTTP/2 stream identifier
+      # @param max_bytes [Integer] the largest size the caller would like to send
+      # @return [Integer] available bytes, or 0 when flow control is exhausted
+      #
+      # @rbs (Integer stream_id, Integer max_bytes) -> Integer
+      def try_acquire(stream_id, max_bytes)
+        check(stream_id)
+        initial = @initial_stream_window.value
+        stream_window = @stream_windows.value[stream_id] || initial
+        capped = [max_bytes, MAX_FRAME_SIZE, stream_window].min
+        return 0 unless capped.positive?
+
+        granted = reserve_connection(capped)
+        if granted.positive?
+          @stream_windows.swap do |windows|
+            current = windows[stream_id] || initial
+            windows.merge(stream_id => current - granted)
+          end
         end
+        granted
       end
 
       # Increments the connection-level send window by `increment` bytes.
@@ -141,6 +166,7 @@ module Raptor
       # @rbs (Integer increment) -> void
       def add_connection_window(increment)
         @connection_window.swap { |window| window + increment }
+        @available.broadcast
       end
 
       # Increments the send window for the given stream by `increment` bytes.
@@ -156,6 +182,7 @@ module Raptor
           current = windows[stream_id] || initial
           windows.merge(stream_id => current + increment)
         end
+        @available.broadcast
       end
 
       # Updates the peer's `SETTINGS_INITIAL_WINDOW_SIZE`. Shifts every
@@ -174,6 +201,40 @@ module Raptor
         @stream_windows.swap do |windows|
           windows.transform_values { |size| size + delta }
         end
+        @available.broadcast
+      end
+
+      # Raises when the given stream can no longer write a response.
+      #
+      # @param stream_id [Integer] the HTTP/2 stream identifier
+      # @return [void]
+      # @raise [StreamClosedError] if the stream or connection has closed
+      #
+      # @rbs (Integer stream_id) -> void
+      def check(stream_id)
+        cancelled = @cancelled_streams.value
+        raise StreamClosedError if cancelled.key?(0) || cancelled.key?(stream_id)
+      end
+
+      # Cancels pending and future writes for the given stream.
+      #
+      # @param stream_id [Integer] the HTTP/2 stream identifier
+      # @return [void]
+      #
+      # @rbs (Integer stream_id) -> void
+      def cancel_stream(stream_id)
+        @cancelled_streams.swap { |streams| streams.merge(stream_id => true) }
+        @available.broadcast
+      end
+
+      # Cancels pending and future writes for the connection.
+      #
+      # @return [void]
+      #
+      # @rbs () -> void
+      def close
+        @cancelled_streams.swap { |streams| streams.merge(0 => true) }
+        @available.broadcast
       end
 
       # Discards any per-stream tracking for the given stream.
@@ -183,8 +244,6 @@ module Raptor
       #
       # @rbs (Integer stream_id) -> void
       def discard_stream(stream_id)
-        return unless @stream_windows.value.key?(stream_id)
-
         @stream_windows.swap do |windows|
           next windows unless windows.key?(stream_id)
 
@@ -192,6 +251,13 @@ module Raptor
           pruned.delete(stream_id)
           pruned
         end
+        @cancelled_streams.swap do |streams|
+          next streams unless streams.key?(stream_id)
+
+          pruned = streams.dup
+          pruned.delete(stream_id)
+          pruned
+        end
       end
 
       private
@@ -214,6 +280,142 @@ module Raptor
       end
     end
 
+    # Adapts one HTTP/2 response stream to Rack's streaming body interface.
+    #
+    class ResponseStream
+      # @rbs @socket: OpenSSL::SSL::SSLSocket
+      # @rbs @writer: Writer
+      # @rbs @flow_control: FlowControl
+      # @rbs @stream_id: Integer
+      # @rbs @trailers: Hash[String, String | Array[String]]
+      # @rbs @parser: Http2Parser
+      # @rbs @bytes_written: Integer
+      # @rbs @closed: bool
+
+      # Returns the number of response body bytes written to the stream.
+      #
+      # @return [Integer]
+      attr_reader :bytes_written #: Integer
+
+      # Creates a response stream for a Rack streaming body.
+      #
+      # @param socket [OpenSSL::SSL::SSLSocket] the connection socket
+      # @param writer [Writer] frame writer for the connection
+      # @param flow_control [FlowControl] outbound flow controller
+      # @param stream_id [Integer] the HTTP/2 stream identifier
+      # @param trailers [Hash] trailing response headers populated by the Rack application
+      # @return [void]
+      #
+      # @rbs (OpenSSL::SSL::SSLSocket socket, Writer writer, FlowControl flow_control, Integer stream_id, Hash[String, String | Array[String]] trailers) -> void
+      def initialize(socket, writer, flow_control, stream_id, trailers)
+        @socket = socket
+        @writer = writer
+        @flow_control = flow_control
+        @stream_id = stream_id
+        @trailers = trailers
+        @parser = Http2Parser.new
+        @bytes_written = 0
+        @closed = false
+      end
+
+      # Streaming responses are write-only.
+      #
+      # @raise [IOError]
+      #
+      # @rbs (*untyped) -> bot
+      def read(*)
+        raise IOError, "not opened for reading"
+      end
+
+      # Writes response body bytes to the stream.
+      #
+      # @param chunk [String] response body bytes
+      # @return [Integer] number of bytes written
+      #
+      # @rbs (String chunk) -> Integer
+      def write(chunk)
+        raise IOError, "closed stream" if @closed
+        raise TypeError, "body must yield String values" unless chunk.is_a?(String)
+
+        offset = 0
+        while offset < chunk.bytesize
+          granted = @flow_control.acquire(@stream_id, chunk.bytesize - offset)
+          slice = offset.zero? && granted == chunk.bytesize ? chunk : chunk.byteslice(offset, granted)
+          offset += granted
+          @writer.write_frames(@socket, [@parser.build_frame(:data, 0, @stream_id, slice)])
+        end
+
+        @bytes_written += chunk.bytesize
+        chunk.bytesize
+      end
+
+      # Writes response body bytes and returns the stream.
+      #
+      # @param chunk [String] response body bytes
+      # @return [ResponseStream]
+      #
+      # @rbs (String chunk) -> ResponseStream
+      def <<(chunk)
+        write(chunk)
+        self
+      end
+
+      # Flushes the stream. Frame writes are already immediate.
+      #
+      # @return [ResponseStream]
+      #
+      # @rbs () -> ResponseStream
+      def flush
+        self
+      end
+
+      # Finishes the stream.
+      #
+      # @return [void]
+      #
+      # @rbs () -> void
+      def close
+        return if @closed
+
+        @flow_control.check(@stream_id)
+        @closed = true
+        if @trailers.empty?
+          frame = @parser.build_frame(:data, FLAG_END_STREAM, @stream_id, nil)
+        else
+          encoded = @parser.encode_response_trailers(@trailers)
+          frame = @parser.build_frame(:headers, FLAG_END_STREAM | FLAG_END_HEADERS, @stream_id, encoded)
+        end
+        @writer.write_frames(@socket, [frame])
+      end
+
+      # Closes the unsupported read side of the stream.
+      #
+      # @raise [IOError]
+      #
+      # @rbs () -> bot
+      def close_read
+        raise IOError, "closing non-duplex IO for reading"
+      end
+
+      # Finishes the writable side of the stream.
+      #
+      # @return [void]
+      #
+      # @rbs () -> void
+      def close_write
+        close
+      end
+
+      # Returns whether the stream has finished.
+      #
+      # @return [Boolean]
+      #
+      # @rbs () -> bool
+      def closed?
+        @closed
+      end
+    end
+
     EAGER_READ_TIMEOUT = 0.001
     EAGER_READ_BUFFER_SIZE = 64 * 1024
     EAGER_MAX_ROUNDS = 8
@@ -225,6 +427,8 @@ module Raptor
 
     ERROR_NO_ERROR = 0x0
     ERROR_PROTOCOL_ERROR = 0x1
+    ERROR_INTERNAL_ERROR = 0x2
+    ERROR_REFUSED_STREAM = 0x7
 
     DEFAULT_WINDOW_SIZE = 65_535
     MAX_FRAME_SIZE = 16_384
@@ -272,6 +476,7 @@ module Raptor
     # @rbs @clean_fiber_locals: bool
     # @rbs @on_error: ^(Hash[String, untyped]?, Exception) -> void | nil
     # @rbs @initial_settings_frame: String
+    # @rbs @running: AtomicBoolean
 
     # Returns the initial server SETTINGS frame to send on every new
     # HTTP/2 connection.
@@ -302,6 +507,7 @@ module Raptor
       @clean_thread_locals = clean_thread_locals
       @clean_fiber_locals = clean_fiber_locals
       @on_error = on_error
+      @running = AtomicBoolean.new(true)
 
       parser = Http2Parser.new
       settings_payload = parser.build_settings(
@@ -320,6 +526,22 @@ module Raptor
       Writer.new(write_timeout: @write_timeout)
     end
 
+    # Stops new stream dispatch and asks clients to finish streams already
+    # handed to the application.
+    #
+    # @param reactor [Reactor] the reactor managing HTTP/2 connections
+    # @return [void]
+    #
+    # @rbs (Reactor reactor) -> void
+    def shutdown(reactor)
+      @running.make_false
+      parser = Http2Parser.new
+      reactor.drain_http2 do |stream_id|
+        payload = [stream_id, ERROR_NO_ERROR].pack("NN")
+        parser.build_frame(:goaway, 0, 0, payload)
+      end
+    end
+
     # Returns a Ractor-safe proc that parses HTTP/2 frames from the
     # state hash's buffered bytes.
     #
@@ -347,7 +569,9 @@ module Raptor
       streams = data[:http2_streams] ? data[:http2_streams].dup : {}
       outgoing_frames = []
       completed_requests = []
+      cancelled_streams = []
       window_updates = []
+      ping_acknowledgements = []
       peer_initial_window_size = nil
       connection_window = data[:http2_window] || DEFAULT_WINDOW_SIZE
       preface_received = data[:http2_preface_received] || false
@@ -360,7 +584,7 @@ module Raptor
           buffer = buffer.byteslice(24..-1) || ""
           preface_received = true
         else
-          return build_result(data, buffer, hpack_table, streams, outgoing_frames, completed_requests, window_updates, peer_initial_window_size, connection_window, preface_received, last_client_stream_id, pending_headers, false)
+          return build_result(data, buffer, hpack_table, streams, outgoing_frames, completed_requests, cancelled_streams, window_updates, ping_acknowledgements, peer_initial_window_size, connection_window, preface_received, last_client_stream_id, pending_headers, false)
         end
       end
 
@@ -387,8 +611,9 @@ module Raptor
         when :headers
           stream_id = frame[:stream_id]
           header_payload = frame[:payload]
+          trailers = streams.key?(stream_id)
 
-          unless streams.key?(stream_id)
+          unless trailers
             if stream_id.even? || stream_id <= last_client_stream_id
               goaway_error = ERROR_PROTOCOL_ERROR
               break
@@ -404,14 +629,12 @@ module Raptor
 
           if frame[:flags].anybits?(FLAG_END_HEADERS)
             decoded_headers, hpack_table = parser.parse_headers(header_payload, hpack_table)
-            if invalid_pseudo_headers?(decoded_headers)
-              streams.delete(stream_id)
-              outgoing_frames << parser.build_frame(:rst_stream, 0, stream_id, [ERROR_PROTOCOL_ERROR].pack("N"))
-            else
-              streams, completed_requests = finalize_headers(streams, completed_requests, stream_id, decoded_headers, end_stream)
-            end
+            streams, completed_requests = complete_header_block(
+              streams, completed_requests, outgoing_frames, parser,
+              stream_id, decoded_headers, end_stream, trailers
+            )
           else
-            pending_headers = { stream_id: stream_id, buffer: header_payload, end_stream: end_stream }
+            pending_headers = { stream_id: stream_id, buffer: header_payload, end_stream: end_stream, trailers: trailers }
           end
 
         when :continuation
@@ -425,12 +648,10 @@ module Raptor
           if frame[:flags].anybits?(FLAG_END_HEADERS)
             stream_id = pending_headers[:stream_id]
             decoded_headers, hpack_table = parser.parse_headers(pending_headers[:buffer], hpack_table)
-            if invalid_pseudo_headers?(decoded_headers)
-              streams.delete(stream_id)
-              outgoing_frames << parser.build_frame(:rst_stream, 0, stream_id, [ERROR_PROTOCOL_ERROR].pack("N"))
-            else
-              streams, completed_requests = finalize_headers(streams, completed_requests, stream_id, decoded_headers, pending_headers[:end_stream])
-            end
+            streams, completed_requests = complete_header_block(
+              streams, completed_requests, outgoing_frames, parser,
+              stream_id, decoded_headers, pending_headers[:end_stream], pending_headers[:trailers]
+            )
             pending_headers = nil
           end
 
@@ -475,7 +696,9 @@ module Raptor
           window_updates << [frame[:stream_id], increment]
 
         when :ping
-          if frame[:flags].nobits?(FLAG_ACK)
+          if frame[:flags].anybits?(FLAG_ACK)
+            ping_acknowledgements << frame[:payload]
+          else
             outgoing_frames << parser.build_frame(:ping, FLAG_ACK, 0, frame[:payload])
           end
 
@@ -483,7 +706,10 @@ module Raptor
           break
 
         when :rst_stream
-          streams.delete(frame[:stream_id])
+          stream_id = frame[:stream_id]
+          streams.delete(stream_id)
+          completed_requests.reject! { |request| request[:stream_id] == stream_id }
+          cancelled_streams << stream_id
         end
       end
 
@@ -492,8 +718,47 @@ module Raptor
         outgoing_frames << parser.build_frame(:goaway, 0, 0, goaway_payload)
       end
 
-      build_result(data, buffer, hpack_table, streams, outgoing_frames, completed_requests, window_updates, peer_initial_window_size, connection_window, preface_received, last_client_stream_id, pending_headers, !!goaway_error)
+      build_result(data, buffer, hpack_table, streams, outgoing_frames, completed_requests, cancelled_streams, window_updates, ping_acknowledgements, peer_initial_window_size, connection_window, preface_received, last_client_stream_id, pending_headers, !!goaway_error)
+    end
+
+    # Applies one complete request header block to its stream, resetting
+    # malformed initial headers or trailers and completing valid trailers.
+    #
+    # @param streams [Hash] current open-stream map
+    # @param completed_requests [Array<Hash>] accumulator of completed stream requests
+    # @param outgoing_frames [Array<String>] accumulator of protocol response frames
+    # @param parser [Http2Parser] frame parser and encoder
+    # @param stream_id [Integer] the stream identifier
+    # @param decoded_headers [Array<Array(String, String)>] decoded header pairs
+    # @param end_stream [Boolean] whether the source frame had END_STREAM set
+    # @param trailers [Boolean] whether this is a trailing header block
+    # @return [Array(Hash, Array<Hash>)] updated streams and completed requests
+    #
+    # @rbs (Hash[Integer, Hash[Symbol, untyped]] streams, Array[Hash[Symbol, untyped]] completed_requests, Array[String] outgoing_frames, Http2Parser parser, Integer stream_id, Array[[String, String]] decoded_headers, bool end_stream, bool trailers) -> [Hash[Integer, Hash[Symbol, untyped]], Array[Hash[Symbol, untyped]]]
+    def self.complete_header_block(streams, completed_requests, outgoing_frames, parser, stream_id, decoded_headers, end_stream, trailers)
+      invalid = if trailers
+        !end_stream || decoded_headers.any? { |name, _value| name.start_with?(":") }
+      else
+        invalid_pseudo_headers?(decoded_headers)
+      end
+
+      if invalid
+        streams.delete(stream_id)
+        outgoing_frames << parser.build_frame(:rst_stream, 0, stream_id, [ERROR_PROTOCOL_ERROR].pack("N"))
+      elsif trailers
+        stream = streams.delete(stream_id)
+        completed_requests << {
+          stream_id: stream_id,
+          headers: stream[:headers],
+          body: stream[:body] || ""
+        }
+      else
+        streams, completed_requests = finalize_headers(streams, completed_requests, stream_id, decoded_headers, end_stream)
+      end
+
+      [streams, completed_requests]
     end
+    private_class_method :complete_header_block
 
     # Merges a decoded header block into the stream's accumulated state,
     # promoting the stream to `completed_requests` when END_STREAM is set.
@@ -534,7 +799,9 @@ module Raptor
     # @param streams [Hash] updated stream states
     # @param outgoing_frames [Array<String>] frames to write to the socket
     # @param completed_requests [Array<Hash>] fully received stream requests
+    # @param cancelled_streams [Array<Integer>] streams reset by the peer
     # @param window_updates [Array<Array(Integer, Integer)>] inbound WINDOW_UPDATE pairs as [stream_id, increment]
+    # @param ping_acknowledgements [Array<String>] acknowledged PING payloads
     # @param peer_initial_window_size [Integer, nil] new SETTINGS_INITIAL_WINDOW_SIZE announced by the peer
     # @param connection_window [Integer] current connection flow control window
     # @param preface_received [Boolean] whether the connection preface has been received
@@ -543,8 +810,8 @@ module Raptor
     # @param close_connection [Boolean] whether the connection should be closed after writing outgoing frames
     # @return [Hash] frozen result hash
     #
-    # @rbs (Hash[Symbol, untyped] data, String buffer, Array[untyped] hpack_table, Hash[Integer, Hash[Symbol, untyped]] streams, Array[String] outgoing_frames, Array[Hash[Symbol, untyped]] completed_requests, Array[[Integer, Integer]] window_updates, Integer? peer_initial_window_size, Integer connection_window, bool preface_received, Integer last_client_stream_id, Hash[Symbol, untyped]? pending_headers, bool close_connection) -> Hash[Symbol, untyped]
-    def self.build_result(data, buffer, hpack_table, streams, outgoing_frames, completed_requests, window_updates, peer_initial_window_size, connection_window, preface_received, last_client_stream_id, pending_headers, close_connection)
+    # @rbs (Hash[Symbol, untyped] data, String buffer, Array[untyped] hpack_table, Hash[Integer, Hash[Symbol, untyped]] streams, Array[String] outgoing_frames, Array[Hash[Symbol, untyped]] completed_requests, Array[Integer] cancelled_streams, Array[[Integer, Integer]] window_updates, Array[String] ping_acknowledgements, Integer? peer_initial_window_size, Integer connection_window, bool preface_received, Integer last_client_stream_id, Hash[Symbol, untyped]? pending_headers, bool close_connection) -> Hash[Symbol, untyped]
+    def self.build_result(data, buffer, hpack_table, streams, outgoing_frames, completed_requests, cancelled_streams, window_updates, ping_acknowledgements, peer_initial_window_size, connection_window, preface_received, last_client_stream_id, pending_headers, close_connection)
       result = {
         id: data[:id],
         protocol: :http2,
@@ -561,7 +828,9 @@ module Raptor
         remote_addr: data[:remote_addr],
         url_scheme: data[:url_scheme]
       }
+      result[:cancelled_streams] = cancelled_streams unless cancelled_streams.empty?
       result[:window_updates] = window_updates unless window_updates.empty?
+      result[:ping_acknowledgements] = ping_acknowledgements unless ping_acknowledgements.empty?
       result[:peer_initial_window_size] = peer_initial_window_size if peer_initial_window_size
       Ractor.make_shareable(result)
     end
@@ -582,8 +851,15 @@ module Raptor
     #
     # @rbs (OpenSSL::SSL::SSLSocket socket, Integer id, Reactor reactor, AtomicThreadPool thread_pool, String remote_addr, String url_scheme) -> void
     def eager_accept(socket, id, reactor, thread_pool, remote_addr, url_scheme)
+      unless @running.true?
+        socket.close rescue nil
+        return
+      end
+
       writer = create_writer
       flow_control = FlowControl.new
+      ping_payload = [id].pack("Q>")
+      ping_frame = Http2Parser.new.build_frame(:ping, 0, 0, ping_payload).freeze
       initial_state = {
         id: id,
         protocol: :http2,
@@ -591,7 +867,19 @@ module Raptor
         url_scheme: url_scheme
       }
 
-      reactor.attach_http2(id: id, socket: socket, state: initial_state, writer: writer, flow_control: flow_control)
+      reactor.attach_http2(
+        id: id,
+        socket: socket,
+        state: initial_state,
+        writer: writer,
+        flow_control: flow_control,
+        ping_frame: ping_frame,
+        ping_payload: ping_payload
+      )
+      unless @running.true?
+        reactor.close_connection(id)
+        return
+      end
 
       socket.write(@initial_settings_frame) rescue nil
 
@@ -605,7 +893,7 @@ module Raptor
         return
       end
 
-      while socket.pending.positive?
+      while socket.respond_to?(:pending) && socket.pending.positive?
         buffer << socket.read_nonblock(socket.pending)
       end
 
@@ -636,8 +924,15 @@ module Raptor
 
       rounds = 0
       loop do
-        if flow_control && (result[:window_updates] || result[:peer_initial_window_size])
+        reactor.acknowledge_http2_ping(result[:id], result[:ping_acknowledgements])
+        result[:cancelled_streams]&.each do |stream_id|
+          flow_control.cancel_stream(stream_id)
+          reactor.cancel_http2_body(result[:id], stream_id)
+        end
+
+        if flow_control && (result[:window_updates]&.any? || result[:peer_initial_window_size])
           apply_flow_control_updates(flow_control, result)
+          reactor.resume_http2_bodies(result[:id])
         end
 
         writer.write_frames(socket, result[:outgoing_frames])
@@ -651,6 +946,11 @@ module Raptor
           stream_id = request[:stream_id]
           remote_addr = result[:remote_addr] || Server::DEFAULT_REMOTE_ADDR
 
+          unless reactor.dispatch_http2_stream(result[:id], stream_id)
+            write_http2_reset_stream(socket, writer, stream_id, ERROR_REFUSED_STREAM)
+            next
+          end
+
           thread_pool << proc do
             dispatch_stream_request(
               socket, writer, flow_control, stream_id,
@@ -716,7 +1016,7 @@ module Raptor
       buffer = String.new
       buffer << data
 
-      while socket.pending.positive?
+      while socket.respond_to?(:pending) && socket.pending.positive?
         buffer << socket.read_nonblock(socket.pending)
       end
 
@@ -750,13 +1050,57 @@ module Raptor
     #
     # @rbs (OpenSSL::SSL::SSLSocket socket, Writer writer, FlowControl flow_control, Integer stream_id, Array[[String, String]] headers, String body, remote_addr: String) -> void
     def perform_stream_request(socket, writer, flow_control, stream_id, headers, body, remote_addr:)
-      env = build_rack_env(headers, body, remote_addr: remote_addr)
+      env = nil
+      status = nil
+      response_headers = nil
+      response_started = false
+      detached = false
+
+      flow_control.check(stream_id)
+      env = build_rack_env(headers, body, socket, writer, flow_control, stream_id, remote_addr: remote_addr)
       status, response_headers, response_body = @app.call(env)
 
-      response_size = write_http2_response(socket, writer, flow_control, stream_id, status, response_headers, response_body)
+      no_body = env[Rack::REQUEST_METHOD] == "HEAD" || (status >= 100 && status < 200) || status == 204 || status == 304
+      if response_body.is_a?(DetachedBody) && !no_body
+        finished = proc do |reason|
+          error = StreamClosedError.new unless reason == :closed
+          write_access_log(env, status, "-", remote_addr) if @access_log_io
+          Http.call_response_finished(env, status, response_headers, error)
+          flow_control.discard_stream(stream_id)
+        end
+        detached = write_http2_detached_response(socket, writer, flow_control, stream_id, status, response_headers, response_body, finished) do
+          response_started = true
+        end
+        return
+      end
+
+      response_size = write_http2_response(
+        socket,
+        writer,
+        flow_control,
+        stream_id,
+        status,
+        response_headers,
+        response_body,
+        trailers: env[RESPONSE_TRAILERS],
+        request_method: env[Rack::REQUEST_METHOD]
+      ) { response_started = true }
+      if response_body.is_a?(DetachedBody)
+        response_body.finish(:closed)
+      elsif response_body.respond_to?(:close)
+        response_body.close
+      end
       write_access_log(env, status, response_size, remote_addr) if @access_log_io
+      Http.call_response_finished(env, status, response_headers, nil)
+    rescue StreamClosedError => error
+      Http.call_response_finished(env, status, response_headers, error)
     rescue => error
-      write_http2_error_response(socket, writer, stream_id)
+      Http.call_response_finished(env, status, response_headers, error)
+      if response_started
+        write_http2_reset_stream(socket, writer, stream_id, ERROR_INTERNAL_ERROR)
+      else
+        write_http2_error_response(socket, writer, stream_id)
+      end
 
       if @on_error
         @on_error.call(env, error) rescue nil
@@ -764,8 +1108,21 @@ module Raptor
         raise
       end
     ensure
-      response_body.close if response_body.respond_to?(:close)
-      flow_control.discard_stream(stream_id) if flow_control
+      flow_control.discard_stream(stream_id) if flow_control && !detached
+    end
+
+    # Starts a detached HTTP/2 response after writing its response headers.
+    #
+    # @rbs (OpenSSL::SSL::SSLSocket socket, Writer writer, FlowControl flow_control, Integer stream_id, Integer status, Hash[String, String | Array[String]] headers, DetachedBody body, ^(Symbol) -> void finished) { () -> void } -> bool
+    def write_http2_detached_response(socket, writer, flow_control, stream_id, status, headers, body, finished)
+      flow_control.check(stream_id)
+      parser = Http2Parser.new
+      encoded = parser.encode_response_headers(status, headers)
+      writer.write_frames(socket, [parser.build_frame(:headers, FLAG_END_HEADERS, stream_id, encoded)])
+      yield
+      attached = writer.attach_body(stream_id, body, finished)
+      write_http2_reset_stream(socket, writer, stream_id, ERROR_REFUSED_STREAM) unless attached
+      true
     end
 
     # Writes a Rack response as HTTP/2 frames to the socket, partitioning
@@ -778,44 +1135,69 @@ module Raptor
     # @param status [Integer] HTTP status code
     # @param headers [Hash] response headers from the Rack application
     # @param body [Object] response body responding to each
+    # @param trailers [Hash] trailing response headers populated by the Rack application
+    # @param request_method [String] request method used to suppress HEAD response bodies
     # @return [String] the response body size in bytes
     #
-    # @rbs (OpenSSL::SSL::SSLSocket socket, Writer writer, FlowControl flow_control, Integer stream_id, Integer status, Hash[String, String | Array[String]] headers, untyped body) -> String
-    def write_http2_response(socket, writer, flow_control, stream_id, status, headers, body)
+    # @rbs (OpenSSL::SSL::SSLSocket socket, Writer writer, FlowControl flow_control, Integer stream_id, Integer status, Hash[String, String | Array[String]] headers, untyped body, trailers: Hash[String, String | Array[String]], request_method: String) ?{ () -> void } -> String
+    def write_http2_response(socket, writer, flow_control, stream_id, status, headers, body, trailers:, request_method:)
       parser = Http2Parser.new
 
       encoded_headers = parser.encode_response_headers(status, headers)
-      body_chunks = []
-      body_bytes = 0
-      body.each do |chunk|
-        next if chunk.empty?
-        body_chunks << chunk
-        body_bytes += chunk.bytesize
-      end
-
-      if body_chunks.empty?
+      flow_control.check(stream_id)
+      no_body = request_method == "HEAD" || (status >= 100 && status < 200) || status == 204 || status == 304
+      if no_body
         writer.write_frames(socket, [parser.build_frame(:headers, FLAG_END_STREAM | FLAG_END_HEADERS, stream_id, encoded_headers)])
+        yield if block_given?
         return "0"
       end
 
-      frames = [parser.build_frame(:headers, FLAG_END_HEADERS, stream_id, encoded_headers)]
+      writer.write_frames(socket, [parser.build_frame(:headers, FLAG_END_HEADERS, stream_id, encoded_headers)])
+      yield if block_given?
 
-      last_chunk_index = body_chunks.size - 1
-      body_chunks.each_with_index do |chunk, chunk_index|
-        offset = 0
-        while offset < chunk.bytesize
-          remaining = chunk.bytesize - offset
-          last_frame = chunk_index == last_chunk_index && remaining <= MAX_FRAME_SIZE
-          granted = flow_control.acquire(stream_id, remaining, end_stream: last_frame)
-          slice = offset.zero? && granted == chunk.bytesize ? chunk : chunk.byteslice(offset, granted)
-          offset += granted
-          end_stream = chunk_index == last_chunk_index && offset == chunk.bytesize
-          frames << parser.build_frame(:data, end_stream ? FLAG_END_STREAM : 0, stream_id, slice)
-        end
+      stream = ResponseStream.new(socket, writer, flow_control, stream_id, trailers)
+      if body.respond_to?(:each)
+        body.each { |chunk| stream.write(chunk) }
+      else
+        body.call(stream)
       end
+      stream.close
 
-      writer.write_frames(socket, frames)
-      body_bytes.to_s
+      stream.bytes_written.to_s
+    end
+
+    # Sends an HTTP 103 Early Hints response.
+    #
+    # @param socket [OpenSSL::SSL::SSLSocket] the connection socket
+    # @param writer [Writer] frame writer for the connection
+    # @param flow_control [FlowControl] per-connection outbound flow controller
+    # @param stream_id [Integer] the HTTP/2 stream identifier
+    # @param hints [Hash] response headers to send as early hints
+    # @return [void]
+    #
+    # @rbs (OpenSSL::SSL::SSLSocket socket, Writer writer, FlowControl flow_control, Integer stream_id, Hash[String, String | Array[String]] hints) -> void
+    def send_early_hints(socket, writer, flow_control, stream_id, hints)
+      return if hints.empty?
+
+      flow_control.check(stream_id)
+      parser = Http2Parser.new
+      encoded = parser.encode_response_headers(103, hints)
+      writer.write_frames(socket, [parser.build_frame(:headers, FLAG_END_HEADERS, stream_id, encoded)])
+    end
+
+    # Resets one HTTP/2 stream with the given error code.
+    #
+    # @param socket [OpenSSL::SSL::SSLSocket] the connection socket
+    # @param writer [Writer] frame writer for the connection
+    # @param stream_id [Integer] the HTTP/2 stream identifier
+    # @param error_code [Integer] the HTTP/2 error code
+    # @return [void]
+    #
+    # @rbs (OpenSSL::SSL::SSLSocket socket, Writer writer, Integer stream_id, Integer error_code) -> void
+    def write_http2_reset_stream(socket, writer, stream_id, error_code)
+      parser = Http2Parser.new
+      frame = parser.build_frame(:rst_stream, 0, stream_id, [error_code].pack("N"))
+      writer.write_frames(socket, [frame])
     end
 
     # Writes a 500 error response as HTTP/2 frames.
@@ -854,11 +1236,14 @@ module Raptor
     #
     # @param headers [Array<Array(String, String)>] HTTP/2 header pairs
     # @param body [String] the request body
+    # @param socket [OpenSSL::SSL::SSLSocket] the connection socket
+    # @param writer [Writer] frame writer for the connection
+    # @param stream_id [Integer] the HTTP/2 stream identifier
     # @param remote_addr [String] the client IP address
     # @return [Hash] fully populated Rack environment hash
     #
-    # @rbs (Array[[String, String]] headers, String body, remote_addr: String) -> Hash[String, untyped]
-    def build_rack_env(headers, body, remote_addr:)
+    # @rbs (Array[[String, String]] headers, String body, OpenSSL::SSL::SSLSocket socket, Writer writer, FlowControl flow_control, Integer stream_id, remote_addr: String) -> Hash[String, untyped]
+    def build_rack_env(headers, body, socket, writer, flow_control, stream_id, remote_addr:)
       env = {}
 
       headers.each do |name, value|
@@ -887,6 +1272,9 @@ module Raptor
       env[Rack::RACK_INPUT] = StringIO.new(body).set_encoding(Encoding::ASCII_8BIT)
       env[Rack::RACK_ERRORS] = $stderr
       env[Rack::RACK_RESPONSE_FINISHED] = []
+      env[Rack::RACK_EARLY_HINTS] = proc do |hints|
+        send_early_hints(socket, writer, flow_control, stream_id, hints) rescue nil
+      end
       env[Rack::RACK_IS_HIJACK] = false
 
       env[Rack::SCRIPT_NAME] = "" unless env.key?(Rack::SCRIPT_NAME)
@@ -900,6 +1288,7 @@ module Raptor
       env[Http::REMOTE_ADDR] = remote_addr
       env[Http::SERVER_SOFTWARE] = Http::SERVER_SOFTWARE_VALUE
       env[Http::HTTP_VERSION] = SERVER_PROTOCOL
+      env[RESPONSE_TRAILERS] = {}
 
       populate_server_name_and_port(env)