@scriptc/runtime 0.0.29 → 0.0.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime",
-  "version": "0.0.29",
+  "version": "0.0.31",
   "description": "scriptc native runtime — C sources, compiled into every scriptc binary",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",

package/src/scr_http.c

@@ -112,6 +112,10 @@ static const char *scr_http_reason(int code) {
  * typedef lives in scr_runtime.h (both units name it). */
 static const ScrHttpH2Ops *scr_http_h2_ops = NULL;
 static void (*scr_http_h2_request_hook)(void *h2ctx, ScrClosure *cb /*moves*/,
+                                         void *fn, bool once) = NULL;
+static void (*scr_http_h2_connect_hook)(void *h2ctx, ScrClosure *cb /*moves*/,
+                                        void *h1_fn, void *h2_fn, bool once) = NULL;
+static void (*scr_http_h2_upgrade_hook)(void *h2ctx, ScrClosure *cb /*moves*/,
                                         void *fn, bool once) = NULL;
 
 void scr_http_set_h2_ops(const ScrHttpH2Ops *ops) { scr_http_h2_ops = ops; }
@@ -119,6 +123,13 @@ void scr_http_set_h2_ops(const ScrHttpH2Ops *ops) { scr_http_h2_ops = ops; }
 void scr_http_set_h2_request_hook(void (*hook)(void *h2ctx, ScrClosure *cb, void *fn, bool once)) {
   scr_http_h2_request_hook = hook;
 }
+void scr_http_set_h2_connect_hook(void (*hook)(void *h2ctx, ScrClosure *cb,
+                                               void *h1_fn, void *h2_fn, bool once)) {
+  scr_http_h2_connect_hook = hook;
+}
+void scr_http_set_h2_upgrade_hook(void (*hook)(void *h2ctx, ScrClosure *cb, void *fn, bool once)) {
+  scr_http_h2_upgrade_hook = hook;
+}
 
 /* ── the request handle ──────────────────────────────────────────────── */
 
@@ -762,6 +773,27 @@ static void scr_http_buf_append(ScrHttpBuf *b, const char *s, size_t n) {
 
 static void scr_http_buf_str(ScrHttpBuf *b, const char *s) { scr_http_buf_append(b, s, strlen(s)); }
 
+static bool scr_http_header_has_token(const ScrStr *value, const char *token) {
+  size_t token_len = strlen(token);
+  for (size_t off = 0; off < value->len;) {
+    while (off < value->len &&
+           (value->data[off] == ',' || value->data[off] == ' ' || value->data[off] == '\t')) off++;
+    size_t end = off;
+    while (end < value->len && value->data[end] != ',' &&
+           value->data[end] != ' ' && value->data[end] != '\t') end++;
+    if (end - off == token_len) {
+      bool equal = true;
+      for (size_t i = 0; i < token_len && equal; i++) {
+        if (tolower((unsigned char)value->data[off + i]) != token[i]) equal = false;
+      }
+      if (equal) return true;
+    }
+    while (end < value->len && value->data[end] != ',') end++;
+    off = end;
+  }
+  return false;
+}
+
 /* Serializes and sends the head. `body_len` >= 0 fixes Content-Length
  * (the end(data)-before-head path); -1 means chunked unless the user set
  * Content-Length or Transfer-Encoding (Node's useChunkedEncodingByDefault
@@ -788,12 +820,19 @@ static void scr_http_res_send_head(ScrHttpRes *r, long long body_len) {
   if (r->status_msg) scr_http_buf_append(&b, r->status_msg->data, r->status_msg->len);
   else scr_http_buf_str(&b, scr_http_reason(status));
   scr_http_buf_str(&b, "\r\n");
+  bool user_chunked = false;
   for (size_t i = 0; i < r->nheaders; i++) {
     scr_http_buf_append(&b, r->hnames[i]->data, r->hnames[i]->len);
     scr_http_buf_str(&b, ": ");
     scr_http_buf_append(&b, r->hvalues[i]->data, r->hvalues[i]->len);
     scr_http_buf_str(&b, "\r\n");
+    bool transfer = r->hnames[i]->len == 17;
+    for (size_t j = 0; j < 17 && transfer; j++) {
+      if (tolower((unsigned char)r->hnames[i]->data[j]) != "transfer-encoding"[j]) transfer = false;
+    }
+    if (transfer && scr_http_header_has_token(r->hvalues[i], "chunked")) user_chunked = true;
   }
+  r->chunked = user_chunked;
   if (!r->no_date && !scr_http_res_has_header(r, "date")) {
     /* Node's utcDate: "Date: Wed, 16 Jul 2026 04:20:00 GMT" */
     time_t now = time(NULL);
@@ -1406,6 +1445,50 @@ static void scr_http_srv_ctx_settle(void *p) {
   scr_net_ls_drop(&ctx->connect_ls);
 }
 
+/* Combined HTTP/2 allowHTTP1 servers retain the HTTP/1 parser ctx behind
+ * their h2-facing alias. These narrow hooks let scr_http2.c mirror request
+ * listeners and settle both protocol lists without exposing the ctx shape. */
+void scr_http1_ctx_on_request(void *p, ScrClosure *cb /*moves*/, ScrHttpReqFn fn, bool once,
+                              ScrNetOnce *shared_once /*moves, nullable*/) {
+  ScrHttpSrvCtx *ctx = (ScrHttpSrvCtx *)p;
+  if (ctx == NULL || ctx->proto != SCR_NET_PROTO_HTTP1) {
+    scr_closure_release(cb);
+    scr_net_once_release(shared_once);
+    return;
+  }
+  if (shared_once != NULL) {
+    scr_net_ls_add_shared_once(&ctx->request_ls, cb, (void *)fn, shared_once);
+  } else {
+    scr_net_ls_add(&ctx->request_ls, cb, (void *)fn, once);
+  }
+}
+
+void scr_http1_ctx_on_connect(void *p, ScrClosure *cb /*moves*/, ScrHttpUpgradeFn fn, bool once,
+                              ScrNetOnce *shared_once /*moves, nullable*/) {
+  ScrHttpSrvCtx *ctx = (ScrHttpSrvCtx *)p;
+  if (ctx == NULL || ctx->proto != SCR_NET_PROTO_HTTP1) {
+    scr_closure_release(cb);
+    scr_net_once_release(shared_once);
+    return;
+  }
+  if (shared_once != NULL) {
+    scr_net_ls_add_shared_once(&ctx->connect_ls, cb, (void *)fn, shared_once);
+  } else {
+    scr_net_ls_add(&ctx->connect_ls, cb, (void *)fn, once);
+  }
+}
+
+void scr_http1_ctx_on_upgrade(void *p, ScrClosure *cb /*moves*/, ScrHttpUpgradeFn fn, bool once) {
+  ScrHttpSrvCtx *ctx = (ScrHttpSrvCtx *)p;
+  if (ctx == NULL || ctx->proto != SCR_NET_PROTO_HTTP1) {
+    scr_closure_release(cb);
+    return;
+  }
+  scr_net_ls_add(&ctx->upgrade_ls, cb, (void *)fn, once);
+}
+
+void scr_http1_ctx_settle(void *p) { scr_http_srv_ctx_settle(p); }
+
 static void scr_http_conn_drop_request(ScrHttpConn *conn, bool fire_end) {
   /* the deferred 'close' emits: res before req, Node's order */
   if (conn->res) scr_http_queue_res_close(conn->res);
@@ -1626,13 +1709,12 @@ static bool scr_http_conn_parse_head(ScrHttpConn *conn, size_t head_len) {
   /* A CONNECT request: 'connect' fires INSTEAD of 'request' — the
    * upgrade machinery's exact shape ((req, socket, head); the parser
    * steps aside; no listener destroys the socket, Node's default). The
-   * h2 compat server's HTTP/1.1 arm lands here too — under the
-   * allowHTTP1 lowering it is the ONLY arm (SEMANTICS.md divergence
-   * 57), so a portless-style listener always takes the raw socket. */
+   * h2 compat server's HTTP/1.1 arm lands here too; its HTTP/2 arm is
+   * dispatched separately with the compatibility response handle. */
   if (req->method->len == 7 && memcmp(req->method->data, "CONNECT", 7) == 0) {
     memmove(conn->buf, conn->buf + head_len, conn->len - head_len);
     conn->len -= head_len;
-    if (conn->srv->connect_ls.n == 0) {
+    if (!scr_net_ls_has_live(&conn->srv->connect_ls)) {
       scr_http_req_release(req);
       conn->len = 0;
       scr_net_sock_destroy(conn->sock);
@@ -2082,6 +2164,16 @@ ScrHttpReq *scr_http_h2_req_new(ScrNetSocket *sock /*borrowed, nullable*/,
   return req;
 }
 
+void *scr_http_req_h2_stream(ScrHttpReq *r) {
+  return r->h2_stream != NULL ? scr_http_h2_ops->retain(r->h2_stream) : NULL;
+}
+
+void *scr_http_req_h2_stream_or_throw(ScrHttpReq *r, ScrStr *member /*borrowed*/) {
+  if (r->h2_stream != NULL) return scr_http_h2_ops->retain(r->h2_stream);
+  scr_http2_stream_undef_call(member);
+  return NULL;
+}
+
 void scr_http_h2_req_line(ScrHttpReq *r, ScrStr *method /*borrowed, nullable*/,
                            ScrStr *url /*borrowed, nullable*/) {
   if (method != NULL) {
@@ -2148,23 +2240,36 @@ bool scr_http_h2_res_finished(ScrHttpRes *r) { return r->finished; }
  * server.on("upgrade", ...) below: the registration twins of on_request.
  * On a server with no HTTP parser neither list ever fires — honest dead
  * weight, Node's shape. */
-void scr_http_server_on_connect(ScrNetServer *s, ScrClosure *cb /*moves*/, ScrHttpUpgradeFn fn,
+void scr_http_server_on_connect(ScrNetServer *s, ScrClosure *cb /*moves*/,
+                                 ScrHttpUpgradeFn h1_fn, ScrHttpConnectH2Fn h2_fn,
                                  bool once) {
   ScrHttpSrvCtx *ctx = (ScrHttpSrvCtx *)scr_net_server_get_http_ctx(s);
-  if (ctx != NULL && ctx->proto != SCR_NET_PROTO_HTTP1) ctx = NULL; /* an h2 server's ctx */
+  if (ctx != NULL && ctx->proto != SCR_NET_PROTO_HTTP1) {
+    if (scr_http_h2_connect_hook != NULL && !scr_net_server_settled(s)) {
+      scr_http_h2_connect_hook(ctx, cb, (void *)h1_fn, (void *)h2_fn, once);
+      return;
+    }
+    ctx = NULL;
+  }
   if (ctx == NULL) {
     /* no HTTP parser on this server: the event can never fire (Node's
      * net server never emits 'connect' either) — honest dead weight */
     scr_closure_release(cb);
     return;
   }
-  scr_net_ls_add(&ctx->connect_ls, cb, (void *)fn, once);
+  scr_net_ls_add(&ctx->connect_ls, cb, (void *)h1_fn, once);
 }
 
 void scr_http_server_on_upgrade(ScrNetServer *s, ScrClosure *cb /*moves*/, ScrHttpUpgradeFn fn,
-                                 bool once) {
+                                  bool once) {
   ScrHttpSrvCtx *ctx = (ScrHttpSrvCtx *)scr_net_server_get_http_ctx(s);
-  if (ctx != NULL && ctx->proto != SCR_NET_PROTO_HTTP1) ctx = NULL; /* an h2 server's ctx */
+  if (ctx != NULL && ctx->proto != SCR_NET_PROTO_HTTP1) {
+    if (scr_http_h2_upgrade_hook != NULL && !scr_net_server_settled(s)) {
+      scr_http_h2_upgrade_hook(ctx, cb, (void *)fn, once);
+      return;
+    }
+    ctx = NULL;
+  }
   if (ctx == NULL) {
     scr_closure_release(cb);
     return;

package/src/scr_http2.c

@@ -688,7 +688,11 @@ typedef struct ScrH2SrvCtx {
   ScrNetLs stream_ls;
   ScrNetLs session_ls;
   ScrNetLs request_ls; /* the compat (req, res) listeners — createServer's
-                        * eager handler and server.on("request", ...) */
+                         * eager handler and server.on("request", ...) */
+  ScrNetLs connect_ls; /* traditional/RFC 8441 CONNECT (req, res) listeners */
+  ScrNetLs session_error_ls; /* server 'sessionError' (err, session) */
+  void *http1_ctx;     /* borrowed: owned by the TLS wrapper's inner hook */
+  bool enable_connect_protocol;
 } ScrH2SrvCtx;
 
 /* The SETTINGS the API observes (session.localSettings/remoteSettings —
@@ -750,6 +754,7 @@ struct ScrH2Session {
   /* the API-visible settings records + the in-flight local ack */
   ScrH2Settings local_settings, remote_settings;
   bool pending_settings_ack;
+  bool error_emitted;
   ScrNetLs stream_ls, close_ls, err_ls, connect_ls, goaway_ls,
       remote_settings_ls, local_settings_ls;
 };
@@ -802,6 +807,8 @@ static void scr_h2_srv_ctx_release(ScrH2SrvCtx *ctx) {
   scr_net_ls_drop(&ctx->stream_ls);
   scr_net_ls_drop(&ctx->session_ls);
   scr_net_ls_drop(&ctx->request_ls);
+  scr_net_ls_drop(&ctx->connect_ls);
+  scr_net_ls_drop(&ctx->session_error_ls);
   free(ctx);
 }
 
@@ -949,6 +956,11 @@ static void scr_h2_send_settings(ScrH2Session *s) {
     scr_h2_send_frame(s, SCR_H2_F_SETTINGS, 0, 0, no_push, 6);
     return;
   }
+  if (s->local_settings.enable_connect_protocol) {
+    static const uint8_t enable_connect[6] = { 0x0, 0x8, 0, 0, 0, 1 };
+    scr_h2_send_frame(s, SCR_H2_F_SETTINGS, 0, 0, enable_connect, 6);
+    return;
+  }
   scr_h2_send_frame(s, SCR_H2_F_SETTINGS, 0, 0, NULL, 0);
 }
 
@@ -1233,6 +1245,8 @@ static void scr_h2_cleanup_atexit(void) {
 
 static const ScrHttpH2Ops scr_h2_compat_ops;
 static void scr_h2_request_hook(void *ctx, ScrClosure *cb, void *fn, bool once);
+static void scr_h2_connect_hook(void *ctx, ScrClosure *cb, void *h1_fn, void *h2_fn, bool once);
+static void scr_h2_upgrade_hook(void *ctx, ScrClosure *cb, void *fn, bool once);
 
 static void scr_http2_install(void) {
   static bool installed = false;
@@ -1244,6 +1258,8 @@ static void scr_http2_install(void) {
    * ops vtable and h2-tagged 'request' registrations through the hook */
   scr_http_set_h2_ops(&scr_h2_compat_ops);
   scr_http_set_h2_request_hook(&scr_h2_request_hook);
+  scr_http_set_h2_connect_hook(&scr_h2_connect_hook);
+  scr_http_set_h2_upgrade_hook(&scr_h2_upgrade_hook);
 }
 
 /* ── session lifecycle ───────────────────────────────────────────────── */
@@ -1281,6 +1297,31 @@ static void scr_h2_session_abort_streams(ScrH2Session *s) {
   }
 }
 
+static void scr_h2_session_fail(ScrH2Session *s, const char *text) {
+  if (s->error_emitted) return;
+  s->error_emitted = true;
+  ScrStr *msg = scr_str_new(text, strlen(text));
+  if (s->srv != NULL && s->srv->session_error_ls.n > 0) {
+    ScrNetL *snap;
+    size_t n = scr_net_ls_snapshot(&s->srv->session_error_ls, &snap);
+    ScrNetServer *server = s->sock ? scr_net_sock_server(s->sock) : NULL;
+    scr_dyn_this_push(server, SCR_DYNH_NET_SERVER);
+    for (size_t i = 0; i < n; i++) {
+      if (!scr_exc_pending()) {
+        ((ScrH2SessionErrorFn)snap[i].fn)(snap[i].cb, msg,
+                                          scr_http2_session_retain(s));
+      }
+      scr_closure_release(snap[i].cb);
+    }
+    scr_dyn_this_pop();
+    free(snap);
+  }
+  if (!scr_exc_pending() && s->err_ls.n > 0) {
+    scr_net_fire_err_this(&s->err_ls, msg, s, SCR_DYNH_H2_SESSION);
+  }
+  scr_str_release(msg);
+}
+
 void scr_http2_session_destroy(ScrH2Session *s) {
   if (s->destroyed) return;
   s->destroyed = true;
@@ -1303,7 +1344,7 @@ static void scr_h2_dispatch_headers(ScrH2Session *s, int32_t stream_id, uint8_t
                                      ScrH2Headers *h);
 static void scr_h2_stream_flush(ScrH2Stream *st);
 static void scr_h2_compat_dispatch(ScrH2Session *s, ScrH2Stream *st, const ScrH2Headers *h,
-                                    bool end_stream);
+                                    bool end_stream, ScrNetLs *listeners);
 
 /* The settings record the API observes (Node's key order; maxHeaderSize
  * aliases maxHeaderListSize; customSettings not modeled — empty). +1. */
@@ -1342,8 +1383,7 @@ static bool scr_h2_on_frame(ScrH2Session *s, uint8_t type, uint8_t flags, int32_
                              const uint8_t *p, size_t n) {
   /* An open header block admits only its CONTINUATIONs. */
   if (s->hblock_active && type != SCR_H2_F_CONTINUATION) {
-    scr_http2_session_destroy(s);
-    return false;
+    goto proto_err;
   }
   switch (type) {
   case SCR_H2_F_HEADERS: {
@@ -1583,6 +1623,7 @@ static bool scr_h2_on_frame(ScrH2Session *s, uint8_t type, uint8_t flags, int32_
   return true;
 proto_err:
   scr_h2_send_goaway(s, 1 /* NGHTTP2_PROTOCOL_ERROR */);
+  scr_h2_session_fail(s, "Protocol error");
   scr_http2_session_destroy(s);
   return false;
 }
@@ -1605,6 +1646,7 @@ static void scr_h2_on_data(void *ctx, const char *buf, size_t n) {
   if (!s->client && !s->preface_done) {
     if (s->rlen - off < 24) goto done;
     if (memcmp(s->rbuf + off, SCR_H2_PREFACE, 24) != 0) {
+      scr_h2_session_fail(s, "Protocol error");
       scr_http2_session_destroy(s);
       goto done;
     }
@@ -1659,8 +1701,10 @@ static void scr_h2_on_closed(void *ctx) {
 
 static bool scr_h2_on_err(void *ctx, ScrStr *msg) {
   ScrH2Session *s = ctx;
-  if (s->err_ls.n == 0) return false; /* the socket's error story applies */
-  scr_net_fire_err_this(&s->err_ls, msg, s, SCR_DYNH_H2_SESSION);
+  if (s->err_ls.n == 0 && (s->srv == NULL || s->srv->session_error_ls.n == 0)) {
+    return false; /* the socket's error story applies */
+  }
+  scr_h2_session_fail(s, (const char *)msg->data);
   return true;
 }
 
@@ -2043,6 +2087,15 @@ static void scr_h2_dispatch_headers(ScrH2Session *s, int32_t stream_id, uint8_t
       st->end_recv = true;
       st->state = SCR_H2_S_CLOSED_REMOTE;
     }
+    bool connect_request = false;
+    for (size_t i = 0; i < h->n; i++) {
+      ScrStr *name = h->names[i];
+      ScrStr *value = h->values[i];
+      if (name->len == 7 && memcmp(name->data, ":method", 7) == 0 &&
+          value->len == 7 && memcmp(value->data, "CONNECT", 7) == 0) {
+        connect_request = true;
+      }
+    }
     ScrArr *pairs = scr_h2_headers_pairs(h, false, NULL);
     ScrNetServer *server = s->sock ? scr_net_sock_server(s->sock) : NULL;
     if (s->srv) scr_h2_fire_stream_list(&s->srv->stream_ls, st, pairs, fl, server, SCR_DYNH_NET_SERVER);
@@ -2050,9 +2103,12 @@ static void scr_h2_dispatch_headers(ScrH2Session *s, int32_t stream_id, uint8_t
       scr_h2_fire_stream_list(&s->stream_ls, st, pairs, fl, s, SCR_DYNH_H2_SESSION);
     }
     scr_arr_release(pairs);
-    /* the compat layer: 'request' listeners get the (req, res) pair */
-    if (!scr_exc_pending() && s->srv != NULL && s->srv->request_ls.n > 0 && !st->destroyed) {
-      scr_h2_compat_dispatch(s, st, h, end_stream);
+    /* The stream events precede their compatibility event, Node's order.
+     * Both traditional and extended CONNECT emit 'connect', never
+     * 'request'; ordinary methods retain the request path. */
+    if (!scr_exc_pending() && s->srv != NULL && !st->destroyed) {
+      ScrNetLs *listeners = connect_request ? &s->srv->connect_ls : &s->srv->request_ls;
+      if (scr_net_ls_has_live(listeners)) scr_h2_compat_dispatch(s, st, h, end_stream, listeners);
     }
     scr_http2_stream_release(st);
     return;
@@ -2171,13 +2227,57 @@ static const ScrHttpH2Ops scr_h2_compat_ops = {
  * ctx carries the h2 proto tag (the compat registration seam). */
 static void scr_h2_request_hook(void *ctx, ScrClosure *cb /*moves*/, void *fn, bool once) {
   ScrH2SrvCtx *srv = (ScrH2SrvCtx *)ctx;
-  scr_net_ls_add(&srv->request_ls, cb, fn, once);
+  ScrNetOnce *shared_once = srv->http1_ctx != NULL && once ? scr_net_once_new() : NULL;
+  if (srv->http1_ctx != NULL) {
+    scr_http1_ctx_on_request(srv->http1_ctx, scr_closure_retain(cb), (ScrHttpReqFn)fn, once,
+                             shared_once != NULL ? scr_net_once_retain(shared_once) : NULL);
+  }
+  if (shared_once != NULL) {
+    scr_net_ls_add_shared_once(&srv->request_ls, cb, fn, shared_once);
+  } else {
+    scr_net_ls_add(&srv->request_ls, cb, fn, once);
+  }
+}
+
+static void scr_h2_connect_hook(void *ctx, ScrClosure *cb /*moves*/,
+                                void *h1_fn, void *h2_fn, bool once) {
+  ScrH2SrvCtx *srv = (ScrH2SrvCtx *)ctx;
+  bool have_h1 = srv->http1_ctx != NULL;
+  bool have_h2 = h2_fn != NULL;
+  ScrNetOnce *shared_once = have_h1 && have_h2 && once ? scr_net_once_new() : NULL;
+  if (!have_h1 && !have_h2) {
+    scr_closure_release(cb);
+    return;
+  }
+  if (have_h1 && !have_h2) {
+    scr_http1_ctx_on_connect(srv->http1_ctx, cb, (ScrHttpUpgradeFn)h1_fn, once, NULL);
+    return;
+  }
+  if (srv->http1_ctx != NULL) {
+    scr_http1_ctx_on_connect(srv->http1_ctx, scr_closure_retain(cb),
+                             (ScrHttpUpgradeFn)h1_fn, once,
+                             shared_once != NULL ? scr_net_once_retain(shared_once) : NULL);
+  }
+  if (shared_once != NULL) {
+    scr_net_ls_add_shared_once(&srv->connect_ls, cb, h2_fn, shared_once);
+  } else {
+    scr_net_ls_add(&srv->connect_ls, cb, h2_fn, once);
+  }
+}
+
+static void scr_h2_upgrade_hook(void *ctx, ScrClosure *cb /*moves*/, void *fn, bool once) {
+  ScrH2SrvCtx *srv = (ScrH2SrvCtx *)ctx;
+  if (srv->http1_ctx != NULL) {
+    scr_http1_ctx_on_upgrade(srv->http1_ctx, cb, (ScrHttpUpgradeFn)fn, once);
+  } else {
+    scr_closure_release(cb);
+  }
 }
 
 /* Build the (req, res) pair over a fresh server stream and fire the
  * 'request' listeners (this = the net server, the http/1 shape). */
 static void scr_h2_compat_dispatch(ScrH2Session *s, ScrH2Stream *st, const ScrH2Headers *h,
-                                    bool end_stream) {
+                                    bool end_stream, ScrNetLs *listeners) {
   ScrHttpReq *req = scr_http_h2_req_new(s->sock, st);
   for (size_t i = 0; i < h->n; i++) {
     ScrStr *name = h->names[i];
@@ -2199,7 +2299,7 @@ static void scr_h2_compat_dispatch(ScrH2Session *s, ScrH2Stream *st, const ScrH2
    * already satisfied (settle conditions see a delivered read side) */
   if (end_stream) st->end_emitted = true;
   ScrNetL *snap;
-  size_t n = scr_net_ls_snapshot(&s->srv->request_ls, &snap);
+  size_t n = scr_net_ls_snapshot(listeners, &snap);
   ScrNetServer *server = s->sock ? scr_net_sock_server(s->sock) : NULL;
   scr_dyn_this_push(server, SCR_DYNH_NET_SERVER);
   for (size_t i = 0; i < n; i++) {
@@ -2226,6 +2326,9 @@ static void scr_h2_srv_ctx_settle(void *p) {
   scr_net_ls_drop(&ctx->stream_ls);
   scr_net_ls_drop(&ctx->session_ls);
   scr_net_ls_drop(&ctx->request_ls);
+  scr_net_ls_drop(&ctx->connect_ls);
+  scr_net_ls_drop(&ctx->session_error_ls);
+  if (ctx->http1_ctx != NULL) scr_http1_ctx_settle(ctx->http1_ctx);
 }
 
 static void scr_h2_on_connection(void *ctx, ScrNetSocket *sock) {
@@ -2234,6 +2337,7 @@ static void scr_h2_on_connection(void *ctx, ScrNetSocket *sock) {
   sess->srv = scr_h2_srv_ctx_retain(srv);
   sess->sock = scr_net_sock_retain(sock);
   sess->next_stream_id = 2; /* server-initiated ids are even (push, unused) */
+  sess->local_settings.enable_connect_protocol = srv->enable_connect_protocol;
   scr_net_sock_set_native_reader(sock, &scr_h2_on_data, &scr_h2_on_eof, &scr_h2_on_closed,
                                   sess, &scr_h2_session_ctx_free);
   scr_net_sock_set_native_events(sock, NULL, &scr_h2_on_err);
@@ -2279,19 +2383,43 @@ ScrNetServer *scr_http2_create_server_req(ScrClosure *handler /*moves*/, ScrHttp
  * tears down at establishment (Node parks it as 'unknownProtocol' and
  * destroys at the timeout — this surface destroys now). */
 ScrNetServer *scr_http2_create_secure_server(const char *cert, size_t cert_len,
-                                              const char *key, size_t key_len) {
+                                               const char *key, size_t key_len,
+                                               bool enable_connect_protocol) {
   scr_http2_install();
   ScrNetServer *s = scr_net_create_server(NULL, NULL);
   ScrH2SrvCtx *ctx = calloc(1, sizeof *ctx);
   if (!ctx) scr_h2_oom();
   ctx->proto = SCR_NET_PROTO_H2;
   ctx->rc = 1;
+  ctx->enable_connect_protocol = enable_connect_protocol;
   scr_net_server_set_http_ctx(s, ctx); /* borrowed alias: 'stream'/'session' registration */
   scr_net_server_set_proto_settle(s, &scr_h2_srv_ctx_settle);
   /* the TLS wrap owns the ctx reference (+1 moved in) and dispatches
    * established h2 connections back into scr_h2_on_connection */
   scr_tls_server_wrap_h2(s, cert, cert_len, key, key_len, &scr_h2_on_connection, ctx,
-                          &scr_h2_srv_ctx_free_v);
+                          &scr_h2_srv_ctx_free_v, NULL, NULL);
+  return s;
+}
+
+ScrNetServer *scr_http2_create_secure_server_allow_http1(
+    const char *cert, size_t cert_len, const char *key, size_t key_len,
+    ScrClosure *handler /*moves, nullable*/, ScrHttpReqFn fn,
+    ScrClosure *sni_cb /*moves, nullable*/, void *sni_answer_fn,
+    bool enable_connect_protocol) {
+  scr_http2_install();
+  ScrNetServer *s = scr_http_create_server(NULL, NULL);
+  void *http1_ctx = scr_net_server_get_http_ctx(s);
+  ScrH2SrvCtx *ctx = calloc(1, sizeof *ctx);
+  if (!ctx) scr_h2_oom();
+  ctx->proto = SCR_NET_PROTO_H2;
+  ctx->rc = 1;
+  ctx->http1_ctx = http1_ctx;
+  ctx->enable_connect_protocol = enable_connect_protocol;
+  scr_net_server_set_http_ctx(s, ctx);
+  scr_net_server_set_proto_settle(s, &scr_h2_srv_ctx_settle);
+  if (handler != NULL) scr_h2_request_hook(ctx, handler, (void *)fn, false);
+  scr_tls_server_wrap_h2(s, cert, cert_len, key, key_len, &scr_h2_on_connection, ctx,
+                          &scr_h2_srv_ctx_free_v, sni_cb, sni_answer_fn);
   return s;
 }
 
@@ -2307,10 +2435,12 @@ static ScrH2SrvCtx *scr_h2_server_ctx(ScrNetServer *s) {
  * first 'request' listener over the ALPN=h2 server — the
  * create_server_req route, secured. */
 ScrNetServer *scr_http2_create_secure_server_req(const char *cert, size_t cert_len,
-                                                  const char *key, size_t key_len,
-                                                  ScrClosure *handler /*moves, nullable*/,
-                                                  ScrHttpReqFn fn) {
-  ScrNetServer *s = scr_http2_create_secure_server(cert, cert_len, key, key_len);
+                                                   const char *key, size_t key_len,
+                                                   ScrClosure *handler /*moves, nullable*/,
+                                                   ScrHttpReqFn fn,
+                                                   bool enable_connect_protocol) {
+  ScrNetServer *s = scr_http2_create_secure_server(cert, cert_len, key, key_len,
+                                                    enable_connect_protocol);
   if (handler != NULL) {
     ScrH2SrvCtx *ctx = scr_h2_server_ctx(s);
     if (ctx != NULL) scr_net_ls_add(&ctx->request_ls, handler, (void *)fn, false);
@@ -2346,7 +2476,8 @@ ScrNetServer *scr_http2_create_secure_server_dyn(const ScrDyn *opts /*borrowed*/
       ? scr_https_create_server((const char *)cert->data, cert->len,
                                  (const char *)key->data, key->len, handler, fn)
       : scr_http2_create_secure_server_req((const char *)cert->data, cert->len,
-                                            (const char *)key->data, key->len, handler, fn);
+                                            (const char *)key->data, key->len, handler, fn,
+                                            false);
   scr_bytes_release(cert);
   scr_bytes_release(key);
   return s;
@@ -2531,6 +2662,33 @@ void scr_http2_session_on_error(ScrH2Session *s, ScrClosure *cb /*moves*/, ScrCh
   scr_net_ls_add(&s->err_ls, cb, (void *)fn, once);
 }
 
+void scr_http2_server_on_session_error(ScrNetServer *s, ScrClosure *cb /*moves*/,
+                                        ScrH2SessionErrorFn fn, bool once) {
+  ScrH2SrvCtx *ctx = scr_h2_server_ctx(s);
+  if (ctx == NULL || scr_net_server_settled(s)) {
+    scr_closure_release(cb);
+    return;
+  }
+  scr_net_ls_add(&ctx->session_error_ls, cb, (void *)fn, once);
+}
+
+void scr_http2_session_error_thunk0(ScrClosure *cb, ScrStr *msg, ScrH2Session *session) {
+  (void)msg;
+  scr_http2_session_release(session);
+  ((void (*)(ScrClosure *))cb->fn)(cb);
+}
+
+void scr_http2_session_error_thunk1(ScrClosure *cb, ScrStr *msg, ScrH2Session *session) {
+  scr_http2_session_release(session);
+  ScrError *err = scr_error_new(0, msg);
+  ((void (*)(ScrClosure *, ScrError *))cb->fn)(cb, err);
+}
+
+void scr_http2_session_error_thunk2(ScrClosure *cb, ScrStr *msg, ScrH2Session *session) {
+  ScrError *err = scr_error_new(0, msg);
+  ((void (*)(ScrClosure *, ScrError *, ScrH2Session *))cb->fn)(cb, err, session);
+}
+
 void scr_http2_session_on_connect(ScrH2Session *s, ScrClosure *cb /*moves*/, ScrH2ConnectFn fn, bool once) {
   if (s->close_emitted) {
     scr_closure_release(cb);

package/src/scr_lib.c

@@ -106,6 +106,7 @@ extern char **environ; /* env snapshot (scr_env_pairs) */
 
 static SCR_TL int scr_lib_argc = 0;
 static SCR_TL char **scr_lib_argv = NULL;
+static SCR_TL bool scr_lib_skip_reexec_arg = false;
 static SCR_TL ScrArr *scr_argv_arr = NULL;    /* interned process.argv */
 static SCR_TL ScrStr *scr_platform_str = NULL; /* interned process.platform */
 static SCR_TL ScrStr *scr_exec_path_str = NULL; /* interned process.execPath */
@@ -133,9 +134,28 @@ static void scr_lib_cleanup(void) {
  * atexit handlers (the emitted library init never calls this; keeping it out
  * the archive's objects free of any atexit reference — the K8 ambient
  * audit's bar). */
+static bool scr_lib_same_executable_arg(const char *a, const char *b) {
+  if (strcmp(a, b) == 0) return true;
+  char resolved_a[PATH_MAX], resolved_b[PATH_MAX];
+#ifdef _WIN32
+  const char *use_a = _fullpath(resolved_a, a, sizeof resolved_a) != NULL ? resolved_a : a;
+  const char *use_b = _fullpath(resolved_b, b, sizeof resolved_b) != NULL ? resolved_b : b;
+  return _stricmp(use_a, use_b) == 0;
+#else
+  const char *use_a = realpath(a, resolved_a) != NULL ? resolved_a : a;
+  const char *use_b = realpath(b, resolved_b) != NULL ? resolved_b : b;
+  return strcmp(use_a, use_b) == 0;
+#endif
+}
+
 void scr_lib_init(int argc, char **argv) {
   scr_lib_argc = argc;
   scr_lib_argv = argv;
+  /* Node self-reexecution spells `spawn(process.execPath,
+   * [process.argv[1], ...args])`. In a native binary argv[0] already IS the
+   * entry executable, so collapse that repeated first argument before
+   * exposing Node's [exec, script, ...args] process.argv shape. */
+  scr_lib_skip_reexec_arg = argc >= 2 && scr_lib_same_executable_arg(argv[0], argv[1]);
   atexit(scr_lib_cleanup);
 }
 #endif /* !SCR_LIB */
@@ -151,18 +171,21 @@ void scr_lib_session_cleanup(void) { scr_lib_cleanup(); }
 /* Raw argv accessors for the island's process shim (scr_island.c): the
  * island's process.argv must match the static world's ["scriptc",
  * argv[0], ...] shape exactly, so both build from the same stash. */
-int scr_lib_arg_count(void) { return scr_lib_argc; }
-const char *scr_lib_arg(int i) { return scr_lib_argv[i]; }
+int scr_lib_arg_count(void) { return scr_lib_argc - (scr_lib_skip_reexec_arg ? 1 : 0); }
+const char *scr_lib_arg(int i) {
+  return scr_lib_argv[i + (scr_lib_skip_reexec_arg && i > 0 ? 1 : 0)];
+}
 
 ScrArr *scr_process_argv(void) {
   if (!scr_argv_arr) {
     /* ["scriptc", argv[0], argv[1], ...]: positions and length line up
      * with Node's [node-path, script-path, ...args]; the argv[0]/argv[1]
      * VALUES diverge (SEMANTICS.md). */
-    scr_argv_arr = scr_arr_new(SCR_ELEM_STR, (size_t)scr_lib_argc + 1);
+    int argc = scr_lib_arg_count();
+    scr_argv_arr = scr_arr_new(SCR_ELEM_STR, (size_t)argc + 1);
     scr_arr_push_ref(scr_argv_arr, scr_str_new("scriptc", 7));
-    for (int i = 0; i < scr_lib_argc; i++) {
-      const char *a = scr_lib_argv[i];
+    for (int i = 0; i < argc; i++) {
+      const char *a = scr_lib_arg(i);
       scr_arr_push_ref(scr_argv_arr, scr_str_new(a, strlen(a)));
     }
   }

package/src/scr_library.c

@@ -53,6 +53,35 @@ void scr_library_set_sink(ScrLibSinkFn fn, void *ctx) {
   scr_library_sink_ctx = ctx;
 }
 
+/* ── host-callback channels (scr_runtime.h's contract) ────────────────────
+ * Fixed slot storage, one pair per profile-declared channel (declaration
+ * order = slot index, assigned by the generated registration symbol's
+ * dispatch). SCR_TL gives thread-instanced archives per-instance
+ * registration; localization gives multi-instance processes per-archive
+ * slots — exactly the sink's story. The generated program TU is the only
+ * caller, with slot indices proven in range at compile time (the profile
+ * caps channels at SCR_LIB_MAX_CALLBACKS). */
+
+static SCR_TL ScrLibCbFn scr_library_cb_fns[SCR_LIB_MAX_CALLBACKS];
+static SCR_TL void *scr_library_cb_ctxs[SCR_LIB_MAX_CALLBACKS];
+
+void scr_library_cb_set(size_t slot, ScrLibCbFn fn, void *ctx) {
+  /* A pure store, the sink registration's rule: latest wins, NULL clears,
+   * not poison-guarded, persists across init/reset. */
+  scr_library_cb_fns[slot] = fn;
+  scr_library_cb_ctxs[slot] = ctx;
+}
+
+ScrLibCbFn scr_library_cb_require(size_t slot, const char *trap_msg) {
+  /* trap_msg is the call site's constant ("scriptc: library callback
+   * '<name>' invoked before registration\n") — a DETECTED trap the funnel
+   * classifies SC4025 and assembles with the entry the host called. */
+  if (scr_library_cb_fns[slot] == NULL) scr_trap(trap_msg);
+  return scr_library_cb_fns[slot];
+}
+
+void *scr_library_cb_ctx(size_t slot) { return scr_library_cb_ctxs[slot]; }
+
 /* ── the trap funnel, library expansion ───────────────────────────────────
  * Poison first (the sink may longjmp to a host frame below the entry — the
  * conforming survival pattern), then deliver exactly once, then abort:
@@ -104,6 +133,7 @@ static const struct {
   {"scriptc: SyntaxError: ", "SC4016"},     /* syntax trap (regex compile) */
   {"scriptc: out of memory", "SC4017"},     /* allocation failure */
   {"scriptc: internal error: ", "SC4018"},  /* internal invariant failure */
+  {"scriptc: library callback ", "SC4025"}, /* unregistered host callback */
 };
 
 static const char *scr_library_trap_code(const char *msg, size_t len) {

package/src/scr_net.c

@@ -283,6 +283,27 @@ static const char *scr_net_errname(int err) {
  * The types live in scr_runtime.h: scr_http.c reuses the whole family
  * for its request-body listener lists. */
 
+struct ScrNetOnce {
+  size_t rc;
+  bool fired;
+};
+
+ScrNetOnce *scr_net_once_new(void) {
+  ScrNetOnce *once = calloc(1, sizeof *once);
+  if (!once) scr_net_oom();
+  once->rc = 1;
+  return once;
+}
+
+ScrNetOnce *scr_net_once_retain(ScrNetOnce *once) {
+  once->rc++;
+  return once;
+}
+
+void scr_net_once_release(ScrNetOnce *once) {
+  if (once != NULL && --once->rc == 0) free(once);
+}
+
 void scr_net_ls_add(ScrNetLs *l, ScrClosure *cb, void *fn, bool once) {
   if (l->n == l->cap) {
     l->cap = l->cap ? l->cap * 2 : 2;
@@ -292,11 +313,28 @@ void scr_net_ls_add(ScrNetLs *l, ScrClosure *cb, void *fn, bool once) {
   l->ls[l->n].cb = cb;
   l->ls[l->n].fn = fn;
   l->ls[l->n].once = once;
+  l->ls[l->n].shared_once = NULL;
   l->n++;
 }
 
+void scr_net_ls_add_shared_once(ScrNetLs *l, ScrClosure *cb, void *fn,
+                                ScrNetOnce *once /*moves*/) {
+  scr_net_ls_add(l, cb, fn, true);
+  l->ls[l->n - 1].shared_once = once;
+}
+
+bool scr_net_ls_has_live(const ScrNetLs *l) {
+  for (size_t i = 0; i < l->n; i++) {
+    if (l->ls[i].shared_once == NULL || !l->ls[i].shared_once->fired) return true;
+  }
+  return false;
+}
+
 void scr_net_ls_drop(ScrNetLs *l) {
-  for (size_t i = 0; i < l->n; i++) scr_closure_release(l->ls[i].cb);
+  for (size_t i = 0; i < l->n; i++) {
+    scr_closure_release(l->ls[i].cb);
+    scr_net_once_release(l->ls[i].shared_once);
+  }
   free(l->ls);
   l->ls = NULL;
   l->n = l->cap = 0;
@@ -314,22 +352,32 @@ size_t scr_net_ls_snapshot(ScrNetLs *l, ScrNetL **out) {
   }
   ScrNetL *snap = malloc(n * sizeof *snap);
   if (!snap) scr_net_oom();
-  for (size_t i = 0; i < n; i++) {
-    snap[i] = l->ls[i];
-    scr_closure_retain(snap[i].cb);
-  }
-  /* remove the once entries from the live list */
+  size_t nsnap = 0;
   size_t w = 0;
   for (size_t i = 0; i < l->n; i++) {
+    ScrNetL entry = l->ls[i];
+    bool emit = entry.shared_once == NULL || !entry.shared_once->fired;
+    if (emit) {
+      if (entry.shared_once != NULL) entry.shared_once->fired = true;
+      snap[nsnap] = entry;
+      snap[nsnap].shared_once = NULL;
+      scr_closure_retain(snap[nsnap].cb);
+      nsnap++;
+    }
     if (l->ls[i].once) {
       scr_closure_release(l->ls[i].cb);
+      scr_net_once_release(l->ls[i].shared_once);
     } else {
       l->ls[w++] = l->ls[i];
     }
   }
   l->n = w;
+  if (nsnap == 0) {
+    free(snap);
+    snap = NULL;
+  }
   *out = snap;
-  return n;
+  return nsnap;
 }
 
 /* Fire a zero-payload event list (end/close/connect/listening) with the

package/src/scr_runtime.h

@@ -103,8 +103,9 @@ typedef struct ScrBytes ScrBytes;
  *
  * Every trap the runtime DETECTS arrives structured: the funnel assembles
  * the baseline human line into field 0 unchanged, a stable code for the
- * trap kind (the compiler registry's SC4013–SC4019 runtime family,
- * classified in scr_library.c), the entry symbol recorded by the trapping
+ * trap kind (the compiler registry's runtime family — SC4013–SC4019 plus
+ * the SC4025 unregistered-callback trap, classified in scr_library.c), the
+ * entry symbol recorded by the trapping
  * entry's prologue, and the profile's remediation for that code when the
  * program TU's overlay table declares one (the whole fourth field is
  * absent otherwise). A message that already begins with the marker — a
@@ -114,6 +115,39 @@ typedef void (*ScrLibSinkFn)(void *ctx, const uint8_t *msg, size_t msg_len,
                               uint64_t address);
 void scr_library_set_sink(ScrLibSinkFn fn, void *ctx); /* latest wins */
 
+/* ── host-callback channels ───────────────────────────────────────────────
+ * The panic sink's registration pattern generalized into a synchronous
+ * outbound seam: the profile declares named channels (bytes/scalar
+ * signatures), the generated registration symbol maps a channel name to a
+ * slot index here, and compiled call sites fetch the slot through
+ * scr_library_cb_require — which returns the host's pointer or delivers
+ * the call site's trap message through the funnel (the SC4025 detected
+ * trap) when the host never registered. The typed shape of each stored
+ * pointer is the channel's, with the opaque context first:
+ *
+ *   <ret> (*)(void *ctx, <params...>)
+ *
+ * Registration is a pure store like the sink's (no entry prologue, no
+ * poison guard, legal before init); latest wins, NULL clears, and
+ * registrations persist across init/reset. Slots are per-copy of this
+ * state, exactly the sink's story: per-archive under abi.localize_runtime,
+ * per-thread instance under abi.instance_per_thread (SCR_TL) — a callback
+ * registered on thread T fires only for T's instance. The host's callback
+ * runs on the calling thread inside the entry's dynamic extent and must
+ * NOT call back into any library entry (registration symbols included) or
+ * unwind/longjmp across library frames: read the borrowed buffers, copy
+ * what outlives the call, return. Buffer parameters are borrowed for the
+ * duration of the call only. */
+#define SCR_LIB_MAX_CALLBACKS 32 /* keep in step with LIB_MAX_CALLBACKS (library/profile.ts) */
+/* The stored shape: generated call sites cast a slot's pointer to the
+ * channel's typed shape before calling. */
+typedef void (*ScrLibCbFn)(void);
+void scr_library_cb_set(size_t slot, ScrLibCbFn fn, void *ctx);
+/* The call-site fetch: the registered pointer, or the funnel trap with
+ * trap_msg (never returns NULL). */
+ScrLibCbFn scr_library_cb_require(size_t slot, const char *trap_msg);
+void *scr_library_cb_ctx(size_t slot);
+
 /* Entry prologue: aborts deterministically when the library is poisoned (a
  * trap already fired — no profile entry may run again; recovery is process
  * restart). reset_arena additionally drops the result arena (the
@@ -162,8 +196,8 @@ _Noreturn void scr_trap_len(const char *msg, size_t len);
  * (both emissions emit identical data) and consumed by the funnel when it
  * assembles a detected trap's structured message: flat triples of
  * (code, teaching-or-NULL, remediation-or-NULL), one per runtime trap code
- * (SC4013–SC4019 family) the profile declares text for; _len counts
- * triples. A declared teaching replaces the baseline human line as field 0;
+ * (the SC4013–SC4019 family plus SC4025) the profile declares text for;
+ * _len counts triples. A declared teaching replaces the baseline human line as field 0;
  * a declared remediation becomes the optional fourth field. */
 extern const char *const scr_library_trap_overlays[];
 extern const size_t scr_library_trap_overlays_len;
@@ -5072,10 +5106,13 @@ typedef void (*ScrNetDataFn)(ScrClosure *cb, ScrBytes *chunk);    /* borrowed */
 
 /* The listener-list family (snapshot firing, once-before-run): owned by
  * scr_net.c, reused by scr_http.c for the request-body event lists. */
+typedef struct ScrNetOnce ScrNetOnce;
+
 typedef struct {
   ScrClosure *cb; /* owned */
   void *fn;       /* adapter with the event's firing ABI */
   bool once;
+  ScrNetOnce *shared_once; /* owned, nullable: one once registration mirrored across lists */
 } ScrNetL;
 
 typedef struct {
@@ -5084,6 +5121,12 @@ typedef struct {
 } ScrNetLs;
 
 void scr_net_ls_add(ScrNetLs *l, ScrClosure *cb, void *fn, bool once);
+ScrNetOnce *scr_net_once_new(void); /* +1 */
+ScrNetOnce *scr_net_once_retain(ScrNetOnce *once); /* +1 */
+void scr_net_once_release(ScrNetOnce *once);
+void scr_net_ls_add_shared_once(ScrNetLs *l, ScrClosure *cb, void *fn,
+                                ScrNetOnce *once /*moves*/);
+bool scr_net_ls_has_live(const ScrNetLs *l);
 void scr_net_ls_drop(ScrNetLs *l);
 size_t scr_net_ls_snapshot(ScrNetLs *l, ScrNetL **out);
 void scr_net_fire0(ScrNetLs *l);
@@ -5410,7 +5453,7 @@ void scr_tls_sock_on_session(ScrNetSocket *s, ScrClosure *cb /*moves*/, void *fn
  * the https-authority client wrap. scr_http2.c calls both directly —
  * every http2-using binary links the TLS unit (the moduleUsesTls
  * switch), so no registration indirection is needed. */
-void scr_tls_server_wrap_h2(ScrNetServer *s, const char *cert, size_t cert_len, const char *key, size_t key_len, ScrNetNativeConnFn h2_conn, void *h2_ctx /*moves*/, void (*h2_ctx_free)(void *));
+void scr_tls_server_wrap_h2(ScrNetServer *s, const char *cert, size_t cert_len, const char *key, size_t key_len, ScrNetNativeConnFn h2_conn, void *h2_ctx /*moves*/, void (*h2_ctx_free)(void *), ScrClosure *sni_cb /*moves, nullable*/, void *sni_answer_fn);
 void scr_tls_h2_client_wrap(ScrNetSocket *sock, ScrStr *host /*borrowed*/, bool reject_unauthorized, const char *ca /*borrowed, len 0 = none*/, size_t ca_len);
 
 /* ── tls.SecureContext + the SNI callback (scr_tls.c) ─────────────────
@@ -5483,6 +5526,7 @@ bool scr_tls_ca_default_override(const char **pem, size_t *len, uint64_t *gen);
 typedef struct ScrHttpReq ScrHttpReq;
 typedef struct ScrHttpRes ScrHttpRes;
 typedef void (*ScrHttpReqFn)(ScrClosure *cb, ScrHttpReq *req, ScrHttpRes *res); /* both +1 */
+typedef void (*ScrHttpConnectH2Fn)(ScrClosure *cb, ScrHttpReq *req, ScrHttpRes *res); /* both +1 */
 /* 'upgrade' listeners, both sides: (req-or-res, socket, head) — all +1.
  * The parser steps aside (native reader cleared) and the socket is the
  * listener's raw stream; `head` carries bytes read past the 101/request
@@ -5525,10 +5569,16 @@ typedef struct ScrHttpH2Ops {
 void scr_http_set_h2_ops(const ScrHttpH2Ops *ops);
 void scr_http_set_h2_request_hook(void (*hook)(void *h2ctx, ScrClosure *cb /*moves*/,
                                                void *fn, bool once));
+void scr_http_set_h2_connect_hook(void (*hook)(void *h2ctx, ScrClosure *cb /*moves*/,
+                                               void *h1_fn, void *h2_fn, bool once));
+void scr_http_set_h2_upgrade_hook(void (*hook)(void *h2ctx, ScrClosure *cb /*moves*/,
+                                               void *fn, bool once));
 
 /* The compat pair, built by scr_http2.c per server stream. */
 ScrHttpReq *scr_http_h2_req_new(ScrNetSocket *sock /*borrowed, nullable*/,
                                  void *stream /*borrowed, nullable*/); /* +1 */
+void *scr_http_req_h2_stream(ScrHttpReq *r); /* +1 or NULL */
+void *scr_http_req_h2_stream_or_throw(ScrHttpReq *r, ScrStr *member /*borrowed*/); /* +1 */
 void scr_http_h2_req_line(ScrHttpReq *r, ScrStr *method /*borrowed, nullable*/,
                            ScrStr *url /*borrowed, nullable*/);
 void scr_http_h2_req_header(ScrHttpReq *r, ScrStr *name /*borrowed*/, ScrStr *value /*borrowed*/);
@@ -5563,6 +5613,12 @@ void scr_http2_stream_undef_call(ScrStr *member);
  * server) the closure releases unregistered: 'request' never fires
  * there, like Node. */
 void scr_http_server_on_request(ScrNetServer *s, ScrClosure *cb /*moves*/, ScrHttpReqFn fn, bool once);
+void scr_http1_ctx_on_request(void *ctx, ScrClosure *cb /*moves*/, ScrHttpReqFn fn, bool once,
+                              ScrNetOnce *shared_once /*moves, nullable*/);
+void scr_http1_ctx_on_connect(void *ctx, ScrClosure *cb /*moves*/, ScrHttpUpgradeFn fn, bool once,
+                              ScrNetOnce *shared_once /*moves, nullable*/);
+void scr_http1_ctx_on_upgrade(void *ctx, ScrClosure *cb /*moves*/, ScrHttpUpgradeFn fn, bool once);
+void scr_http1_ctx_settle(void *ctx);
 ScrStr *scr_http_req_url(ScrHttpReq *r);      /* +1 */
 ScrStr *scr_http_req_method(ScrHttpReq *r);   /* +1 */
 ScrStr *scr_http_req_header(ScrHttpReq *r, ScrStr *name /*borrowed*/); /* +1 or NULL (undefined arm) */
@@ -5610,10 +5666,10 @@ void scr_http_server_join_duplicate_headers(ScrNetServer *s);
 void scr_http_handler_thunk0(ScrClosure *cb, ScrHttpReq *req, ScrHttpRes *res);
 void scr_http_handler_thunk1(ScrClosure *cb, ScrHttpReq *req, ScrHttpRes *res);
 void scr_http_handler_thunk2(ScrClosure *cb, ScrHttpReq *req, ScrHttpRes *res);
-/* server.on("connect", ...) — HTTP CONNECT, the upgrade twin: fired
- * INSTEAD of 'request' for CONNECT-method requests with (req, socket,
- * head); no listener destroys the socket. */
-void scr_http_server_on_connect(ScrNetServer *s, ScrClosure *cb /*moves*/, ScrHttpUpgradeFn fn,
+/* server.on("connect", ...) — fired instead of 'request' for CONNECT.
+ * HTTP/1 uses (req, socket, head); HTTP/2 compatibility uses (req, res). */
+void scr_http_server_on_connect(ScrNetServer *s, ScrClosure *cb /*moves*/,
+                                 ScrHttpUpgradeFn h1_fn, ScrHttpConnectH2Fn h2_fn,
                                  bool once);
 void scr_http_server_on_upgrade(ScrNetServer *s, ScrClosure *cb /*moves*/, ScrHttpUpgradeFn fn, bool once);
 ScrArr *scr_http_req_raw_headers(ScrHttpReq *r); /* +1 — [name, value, ...], arrival order/case */
@@ -5758,6 +5814,8 @@ enum { SCR_NET_PROTO_HTTP1 = 1, SCR_NET_PROTO_H2 = 2 };
 
 typedef struct ScrH2Session ScrH2Session;
 typedef struct ScrH2Stream ScrH2Stream;
+typedef void (*ScrH2SessionErrorFn)(ScrClosure *cb, ScrStr *msg,
+                                    ScrH2Session *session); /* session +1 */
 
 typedef void (*ScrH2StreamFn)(ScrClosure *cb, ScrH2Stream *st, ScrArr *pairs, double flags); /* st, pairs +1 */
 typedef void (*ScrH2RespFn)(ScrClosure *cb, ScrArr *pairs, double status, double flags);     /* pairs +1 */
@@ -5784,11 +5842,12 @@ ScrNetServer *scr_http2_create_server_req(ScrClosure *handler /*moves*/, ScrHttp
 /* The REAL h2-over-TLS server (http2.createSecureServer({ cert, key })):
  * the same session machinery behind an mbedTLS handshake whose ALPN
  * advertises h2 alone — protocol-identical after establishment. */
-ScrNetServer *scr_http2_create_secure_server(const char *cert, size_t cert_len, const char *key, size_t key_len); /* +1 */
+ScrNetServer *scr_http2_create_secure_server(const char *cert, size_t cert_len, const char *key, size_t key_len, bool enable_connect_protocol); /* +1 */
+ScrNetServer *scr_http2_create_secure_server_allow_http1(const char *cert, size_t cert_len, const char *key, size_t key_len, ScrClosure *handler /*moves, nullable*/, ScrHttpReqFn fn, ScrClosure *sni_cb /*moves, nullable*/, void *sni_answer_fn, bool enable_connect_protocol); /* +1 */
 /* createSecureServer(options, handler): the eager COMPAT handler as the
  * first 'request' listener over the ALPN=h2 server (the createServerReq
  * route, secured). */
-ScrNetServer *scr_http2_create_secure_server_req(const char *cert, size_t cert_len, const char *key, size_t key_len, ScrClosure *handler /*moves, nullable*/, ScrHttpReqFn fn); /* +1 */
+ScrNetServer *scr_http2_create_secure_server_req(const char *cert, size_t cert_len, const char *key, size_t key_len, ScrClosure *handler /*moves, nullable*/, ScrHttpReqFn fn, bool enable_connect_protocol); /* +1 */
 /* createSecureServer with a RUNTIME options record (the divergence-66
  * stance): allowHTTP1 picks the flavor at runtime, cert/key ride the
  * shared TLS server walk (out-of-bounds members throw the catchable
@@ -5818,6 +5877,11 @@ void scr_http2_session_close(ScrH2Session *s, ScrClosure *cb /*moves, nullable*/
 void scr_http2_session_destroy(ScrH2Session *s);
 void scr_http2_session_on_close(ScrH2Session *s, ScrClosure *cb /*moves*/, bool once);
 void scr_http2_session_on_error(ScrH2Session *s, ScrClosure *cb /*moves*/, ScrChildErrFn fn, bool once);
+void scr_http2_server_on_session_error(ScrNetServer *s, ScrClosure *cb /*moves*/,
+                                       ScrH2SessionErrorFn fn, bool once);
+void scr_http2_session_error_thunk0(ScrClosure *cb, ScrStr *msg, ScrH2Session *session);
+void scr_http2_session_error_thunk1(ScrClosure *cb, ScrStr *msg, ScrH2Session *session);
+void scr_http2_session_error_thunk2(ScrClosure *cb, ScrStr *msg, ScrH2Session *session);
 void scr_http2_session_on_connect(ScrH2Session *s, ScrClosure *cb /*moves*/, ScrH2ConnectFn fn, bool once);
 void scr_http2_session_on_stream(ScrH2Session *s, ScrClosure *cb /*moves*/, ScrH2StreamFn fn, bool once);
 void scr_http2_session_on_goaway(ScrH2Session *s, ScrClosure *cb /*moves*/, ScrH2GoawayFn fn, bool once);

package/src/scr_tls.c

@@ -276,6 +276,7 @@ typedef struct ScrTlsSrv {
  * the handshake with no_application_protocol — Node's h2-only split). */
 static const char *SCR_TLS_ALPN_HTTP11[] = {"http/1.1", NULL};
 static const char *SCR_TLS_ALPN_H2[] = {"h2", NULL};
+static const char *SCR_TLS_ALPN_H2_HTTP11[] = {"h2", "http/1.1", NULL};
 
 static ScrTlsSrv *scr_tls_srv_new(const char *cert, size_t cert_len, const char *key,
                                    size_t key_len, bool alpn_http11) {
@@ -864,7 +865,8 @@ static void scr_tls_on_established(void *tctx) {
     const char *alpn = mbedtls_ssl_get_alpn_protocol(&t->ssl);
     if (alpn != NULL && strcmp(alpn, "h2") == 0) {
       t->srv->h2_conn(t->srv->h2_ctx, t->sock);
-    } else if (alpn != NULL && t->srv->inner_conn != NULL && strcmp(alpn, "http/1.1") == 0) {
+    } else if (t->srv->inner_conn != NULL &&
+               (alpn == NULL || strcmp(alpn, "http/1.1") == 0)) {
       t->srv->inner_conn(t->srv->inner_ctx, t->sock);
     } else {
       scr_net_sock_transport_error(t->sock, NULL);
@@ -1593,13 +1595,20 @@ ScrNetSocket *scr_tls_connect_dyn(double port, ScrStr *host /*borrowed, nullable
 void scr_tls_server_wrap_h2(ScrNetServer *s, const char *cert, size_t cert_len,
                              const char *key, size_t key_len,
                              ScrNetNativeConnFn h2_conn, void *h2_ctx /*moves*/,
-                             void (*h2_ctx_free)(void *)) {
+                             void (*h2_ctx_free)(void *),
+                             ScrClosure *sni_cb /*moves, nullable*/, void *sni_answer_fn) {
   ScrTlsSrv *srv = scr_tls_srv_new(cert, cert_len, key, key_len, false);
-  mbedtls_ssl_conf_alpn_protocols(&srv->conf, SCR_TLS_ALPN_H2);
   srv->h2_conn = h2_conn;
   srv->h2_ctx = h2_ctx;
   srv->h2_ctx_free = h2_ctx_free;
   scr_net_server_get_native_conn(s, &srv->inner_conn, &srv->inner_ctx, &srv->inner_ctx_free);
+  mbedtls_ssl_conf_alpn_protocols(
+      &srv->conf, srv->inner_conn != NULL ? SCR_TLS_ALPN_H2_HTTP11 : SCR_TLS_ALPN_H2);
+  if (sni_cb != NULL) {
+    srv->sni_cb = sni_cb;
+    srv->sni_answer_fn = sni_answer_fn;
+    mbedtls_ssl_conf_sni(&srv->conf, &scr_tls_f_sni, NULL);
+  }
   scr_net_server_set_native_conn(s, &scr_tls_srv_on_conn, srv, &scr_tls_srv_release_v);
   scr_net_server_defer_connections(s); /* 'connection'/'secureConnection' wait for the handshake */
 }