eggfetch 0.1.8__tar.gz → 0.2.1__tar.gz

{eggfetch-0.1.8 → eggfetch-0.2.1}/Cargo.lock

@@ -495,13 +495,17 @@ dependencies = [
  "futures-core",
  "futures-util",
  "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
  "tokio",
  "url",
 ]
 
 [[package]]
 name = "eggfetch-cli"
-version = "0.1.8"
+version = "0.2.1"
 dependencies = [
  "anyhow",
  "bytes",
@@ -518,7 +522,7 @@ dependencies = [
 
 [[package]]
 name = "eggfetch-core"
-version = "0.1.8"
+version = "0.2.1"
 dependencies = [
  "async-compression",
  "base64 0.23.1",
@@ -564,7 +568,7 @@ dependencies = [
 
 [[package]]
 name = "eggfetch-ffi"
-version = "0.1.8"
+version = "0.2.1"
 dependencies = [
  "bytes",
  "eggfetch-core",
@@ -576,7 +580,7 @@ dependencies = [
 
 [[package]]
 name = "eggfetch-http-connect"
-version = "0.1.8"
+version = "0.2.1"
 dependencies = [
  "base64 0.23.1",
  "thiserror",
@@ -585,7 +589,7 @@ dependencies = [
 
 [[package]]
 name = "eggfetch-node"
-version = "0.1.8"
+version = "0.2.1"
 dependencies = [
  "eggfetch-ffi",
  "napi",
@@ -597,7 +601,7 @@ dependencies = [
 
 [[package]]
 name = "eggfetch-python"
-version = "0.1.8"
+version = "0.2.1"
 dependencies = [
  "bytes",
  "eggfetch-core",
@@ -928,6 +932,7 @@ dependencies = [
  "http",
  "http-body",
  "httparse",
+ "httpdate",
  "itoa",
  "pin-project-lite",
  "smallvec",

{eggfetch-0.1.8 → eggfetch-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eggfetch
-Version: 0.1.8
+Version: 0.2.1
 Classifier: Development Status :: 3 - Alpha
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
@@ -39,6 +39,7 @@ eggfetch is a Rust-native async HTTP client engine (tokio + hyper) with Python b
 
 - **HTTP/1.1, HTTP/2, HTTP/3** — ALPN negotiation; HTTP/3 over QUIC is experimental ([guide](docs/rust/guide.md))
 - **Streaming** — response bodies stream without eager buffering (`bytes_stream()`, `text_lines()`), with trailers after EOF ([guide](docs/rust/guide.md))
+- **Performance qualification** — API-safe Rust/Python hot-path benchmarks, including the tested loopback HTTP forward-proxy fixture, and reproduction commands are documented in [architecture/benchmarks](docs/architecture/benchmarks.md)
 - **Pooling and timeouts** — per-origin connection pools, phase-aware timeouts (pool/connect/write/read/total), and transport metrics ([pool/timeouts](docs/architecture/core-timeout-pool.md))
 - **TLS** — rustls with per-client crypto providers, custom or additive CA roots, mTLS client certs, version policy, and verification toggle ([TLS](docs/concepts/tls.md))
 - **Proxy** — HTTP forwarding, HTTPS CONNECT, proxy auth, per-request override, `NO_PROXY`, SOCKS5, and UDS routes ([proxy](docs/concepts/proxy.md)). CONNECT wire bytes live in the small `eggfetch-http-connect` crate (no sockets/TLS/retry) consumed by `eggfetch-core` via the `proxy` feature.
@@ -51,6 +52,10 @@ eggfetch is a Rust-native async HTTP client engine (tokio + hyper) with Python b
 - **CLI** — streaming output, machine-readable formats, shell completions ([guide](docs/cli/guide.md))
 - **C ABI and Node.js prototype** — opaque-handle FFI plus an experimental N-API wrapper ([ffi-and-node](docs/architecture/ffi-and-node.md))
 
+The implementation ownership and frozen low-level Rust compatibility surfaces
+are tracked in the [architecture overview](docs/architecture/overview.md) and
+the [Rust surface-containment inventory](docs/architecture/rust-surface-containment.md).
+
 ## Installation
 
 **Python:**
@@ -63,7 +68,7 @@ pip install eggfetch
 
 ```toml
 [dependencies]
-eggfetch-core = "0.1"
+eggfetch-core = "0.2"
 ```
 
 The default features are the secure HTTP/1.1 client with Rustls and native roots. See the [feature profile matrix](docs/architecture/feature-flags.md#supported-core-profiles) for minimal, deterministic, and embedded recipes. Low-level embedding without the `url`/`idna`/ICU closure selects `native-http1` (or `native-http2`) without `high-level-url` and uses `Client::execute_http_body` with a caller-owned `http::Uri` (callers own IDNA/punycode conversion). The lean high-level recipe (`standard-http1` + `tls-rustls`, without `advanced-routing` or the `logical-retry`/`redirects`/`basic-auth` policy bundle) keeps the URL/request/response conveniences, Bearer auth, timeouts, body bounds, pooling, TLS, and typed failures while dispatching once over the standard route and returning 3xx without following.
@@ -143,6 +148,18 @@ See [`docs/python/guide.md`](docs/python/guide.md) for the full Python API refer
 
 The native package supports Python 3.10–3.15 and ships `py.typed` stubs for its public API. `Client` and the top-level sync helpers accept lazy sync `content=` iterables (async-only iterables are rejected before dispatch); `AsyncClient` additionally accepts lazy async iterables, pulled only as the transport asks for them. `eggfetch._native` is a private implementation module — import from `eggfetch`.
 
+Buffered Python responses retain the raw body and decode `.text` lazily; their
+`iter_bytes()`, `iter_text()`, and `iter_lines()` iterators yield one item at a
+time without pre-materializing the complete iterator result. Sync streaming
+uses bounded async-aware backpressure so a slow consumer does not block the
+client runtime. These are private implementation details and do not change
+the public API or chunking contracts.
+
+Maintainers can run `./scripts/check.sh` for routine local CI-equivalent
+validation. The stable Rust profile contracts run in Tier 1; the exact Rust
+surface snapshots and semver cross-check are an extended gate documented in
+[`compat/rust-public-api/README.md`](compat/rust-public-api/README.md).
+
 ## Usage -- Rust
 
 ```rust
@@ -232,6 +249,7 @@ See [`docs/reference/compatibility.md`](docs/reference/compatibility.md) for the
 | [migration/](docs/migration/) | Migration guides from requests and HTTPX |
 | [cookbook/](docs/cookbook/) | Practical runnable examples |
 | [reference/](docs/reference/) | Compatibility matrix, feature matrix, error reference |
+| [releases/](docs/releases/) | Release process and compatibility policy |
 | [security/](docs/security/) | Security guidelines and troubleshooting |
 | [architecture/](docs/architecture/) | Internal architecture documentation |
 | [ffi/](docs/ffi/) | C ABI and FFI binding guide |

{eggfetch-0.1.8/crates/eggfetch-http-connect → eggfetch-0.2.1}/README.md

@@ -13,6 +13,7 @@ eggfetch is a Rust-native async HTTP client engine (tokio + hyper) with Python b
 
 - **HTTP/1.1, HTTP/2, HTTP/3** — ALPN negotiation; HTTP/3 over QUIC is experimental ([guide](docs/rust/guide.md))
 - **Streaming** — response bodies stream without eager buffering (`bytes_stream()`, `text_lines()`), with trailers after EOF ([guide](docs/rust/guide.md))
+- **Performance qualification** — API-safe Rust/Python hot-path benchmarks, including the tested loopback HTTP forward-proxy fixture, and reproduction commands are documented in [architecture/benchmarks](docs/architecture/benchmarks.md)
 - **Pooling and timeouts** — per-origin connection pools, phase-aware timeouts (pool/connect/write/read/total), and transport metrics ([pool/timeouts](docs/architecture/core-timeout-pool.md))
 - **TLS** — rustls with per-client crypto providers, custom or additive CA roots, mTLS client certs, version policy, and verification toggle ([TLS](docs/concepts/tls.md))
 - **Proxy** — HTTP forwarding, HTTPS CONNECT, proxy auth, per-request override, `NO_PROXY`, SOCKS5, and UDS routes ([proxy](docs/concepts/proxy.md)). CONNECT wire bytes live in the small `eggfetch-http-connect` crate (no sockets/TLS/retry) consumed by `eggfetch-core` via the `proxy` feature.
@@ -25,6 +26,10 @@ eggfetch is a Rust-native async HTTP client engine (tokio + hyper) with Python b
 - **CLI** — streaming output, machine-readable formats, shell completions ([guide](docs/cli/guide.md))
 - **C ABI and Node.js prototype** — opaque-handle FFI plus an experimental N-API wrapper ([ffi-and-node](docs/architecture/ffi-and-node.md))
 
+The implementation ownership and frozen low-level Rust compatibility surfaces
+are tracked in the [architecture overview](docs/architecture/overview.md) and
+the [Rust surface-containment inventory](docs/architecture/rust-surface-containment.md).
+
 ## Installation
 
 **Python:**
@@ -37,7 +42,7 @@ pip install eggfetch
 
 ```toml
 [dependencies]
-eggfetch-core = "0.1"
+eggfetch-core = "0.2"
 ```
 
 The default features are the secure HTTP/1.1 client with Rustls and native roots. See the [feature profile matrix](docs/architecture/feature-flags.md#supported-core-profiles) for minimal, deterministic, and embedded recipes. Low-level embedding without the `url`/`idna`/ICU closure selects `native-http1` (or `native-http2`) without `high-level-url` and uses `Client::execute_http_body` with a caller-owned `http::Uri` (callers own IDNA/punycode conversion). The lean high-level recipe (`standard-http1` + `tls-rustls`, without `advanced-routing` or the `logical-retry`/`redirects`/`basic-auth` policy bundle) keeps the URL/request/response conveniences, Bearer auth, timeouts, body bounds, pooling, TLS, and typed failures while dispatching once over the standard route and returning 3xx without following.
@@ -117,6 +122,18 @@ See [`docs/python/guide.md`](docs/python/guide.md) for the full Python API refer
 
 The native package supports Python 3.10–3.15 and ships `py.typed` stubs for its public API. `Client` and the top-level sync helpers accept lazy sync `content=` iterables (async-only iterables are rejected before dispatch); `AsyncClient` additionally accepts lazy async iterables, pulled only as the transport asks for them. `eggfetch._native` is a private implementation module — import from `eggfetch`.
 
+Buffered Python responses retain the raw body and decode `.text` lazily; their
+`iter_bytes()`, `iter_text()`, and `iter_lines()` iterators yield one item at a
+time without pre-materializing the complete iterator result. Sync streaming
+uses bounded async-aware backpressure so a slow consumer does not block the
+client runtime. These are private implementation details and do not change
+the public API or chunking contracts.
+
+Maintainers can run `./scripts/check.sh` for routine local CI-equivalent
+validation. The stable Rust profile contracts run in Tier 1; the exact Rust
+surface snapshots and semver cross-check are an extended gate documented in
+[`compat/rust-public-api/README.md`](compat/rust-public-api/README.md).
+
 ## Usage -- Rust
 
 ```rust
@@ -206,6 +223,7 @@ See [`docs/reference/compatibility.md`](docs/reference/compatibility.md) for the
 | [migration/](docs/migration/) | Migration guides from requests and HTTPX |
 | [cookbook/](docs/cookbook/) | Practical runnable examples |
 | [reference/](docs/reference/) | Compatibility matrix, feature matrix, error reference |
+| [releases/](docs/releases/) | Release process and compatibility policy |
 | [security/](docs/security/) | Security guidelines and troubleshooting |
 | [architecture/](docs/architecture/) | Internal architecture documentation |
 | [ffi/](docs/ffi/) | C ABI and FFI binding guide |

{eggfetch-0.1.8 → eggfetch-0.2.1}/crates/eggfetch-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "eggfetch-core"
-version = "0.1.8"
+version = "0.2.1"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -73,7 +73,7 @@ json = ["dep:serde", "dep:serde_json"]
 compression-gzip = ["dep:async-compression", "async-compression/gzip", "dep:tokio-util", "tokio/io-util", "dep:flate2"]
 compression-brotli = ["dep:async-compression", "async-compression/brotli", "dep:tokio-util", "tokio/io-util", "dep:brotli"]
 compression-zstd = ["dep:async-compression", "async-compression/zstd", "dep:tokio-util", "tokio/io-util", "dep:zstd"]
-compression-deflate = ["dep:async-compression", "async-compression/deflate", "dep:tokio-util", "tokio/io-util", "dep:flate2"]
+compression-deflate = ["dep:async-compression", "async-compression/deflate", "async-compression/zlib", "dep:tokio-util", "tokio/io-util", "dep:flate2"]
 cookies = ["dep:cookie", "high-level-url"]
 proxy = ["http1", "tls-rustls", "tokio/io-util", "high-level-url", "dep:eggfetch-http-connect", "dep:base64"]
 tracing = ["dep:tracing"]
@@ -82,7 +82,7 @@ test-util = ["tokio/test-util"]
 
 [dependencies]
 bytes = "1"
-eggfetch-http-connect = { version = "0.1.8", path = "../eggfetch-http-connect", optional = true }
+eggfetch-http-connect = { version = "0.2.1", path = "../eggfetch-http-connect", optional = true }
 futures-core = "0.3"
 futures-util = { version = "0.3", default-features = false, features = ["alloc"] }
 http = "1"

{eggfetch-0.1.8 → eggfetch-0.2.1}/crates/eggfetch-core/README.md

@@ -13,6 +13,7 @@ eggfetch is a Rust-native async HTTP client engine (tokio + hyper) with Python b
 
 - **HTTP/1.1, HTTP/2, HTTP/3** — ALPN negotiation; HTTP/3 over QUIC is experimental ([guide](docs/rust/guide.md))
 - **Streaming** — response bodies stream without eager buffering (`bytes_stream()`, `text_lines()`), with trailers after EOF ([guide](docs/rust/guide.md))
+- **Performance qualification** — API-safe Rust/Python hot-path benchmarks, including the tested loopback HTTP forward-proxy fixture, and reproduction commands are documented in [architecture/benchmarks](docs/architecture/benchmarks.md)
 - **Pooling and timeouts** — per-origin connection pools, phase-aware timeouts (pool/connect/write/read/total), and transport metrics ([pool/timeouts](docs/architecture/core-timeout-pool.md))
 - **TLS** — rustls with per-client crypto providers, custom or additive CA roots, mTLS client certs, version policy, and verification toggle ([TLS](docs/concepts/tls.md))
 - **Proxy** — HTTP forwarding, HTTPS CONNECT, proxy auth, per-request override, `NO_PROXY`, SOCKS5, and UDS routes ([proxy](docs/concepts/proxy.md)). CONNECT wire bytes live in the small `eggfetch-http-connect` crate (no sockets/TLS/retry) consumed by `eggfetch-core` via the `proxy` feature.
@@ -25,6 +26,10 @@ eggfetch is a Rust-native async HTTP client engine (tokio + hyper) with Python b
 - **CLI** — streaming output, machine-readable formats, shell completions ([guide](docs/cli/guide.md))
 - **C ABI and Node.js prototype** — opaque-handle FFI plus an experimental N-API wrapper ([ffi-and-node](docs/architecture/ffi-and-node.md))
 
+The implementation ownership and frozen low-level Rust compatibility surfaces
+are tracked in the [architecture overview](docs/architecture/overview.md) and
+the [Rust surface-containment inventory](docs/architecture/rust-surface-containment.md).
+
 ## Installation
 
 **Python:**
@@ -37,7 +42,7 @@ pip install eggfetch
 
 ```toml
 [dependencies]
-eggfetch-core = "0.1"
+eggfetch-core = "0.2"
 ```
 
 The default features are the secure HTTP/1.1 client with Rustls and native roots. See the [feature profile matrix](docs/architecture/feature-flags.md#supported-core-profiles) for minimal, deterministic, and embedded recipes. Low-level embedding without the `url`/`idna`/ICU closure selects `native-http1` (or `native-http2`) without `high-level-url` and uses `Client::execute_http_body` with a caller-owned `http::Uri` (callers own IDNA/punycode conversion). The lean high-level recipe (`standard-http1` + `tls-rustls`, without `advanced-routing` or the `logical-retry`/`redirects`/`basic-auth` policy bundle) keeps the URL/request/response conveniences, Bearer auth, timeouts, body bounds, pooling, TLS, and typed failures while dispatching once over the standard route and returning 3xx without following.
@@ -117,6 +122,18 @@ See [`docs/python/guide.md`](docs/python/guide.md) for the full Python API refer
 
 The native package supports Python 3.10–3.15 and ships `py.typed` stubs for its public API. `Client` and the top-level sync helpers accept lazy sync `content=` iterables (async-only iterables are rejected before dispatch); `AsyncClient` additionally accepts lazy async iterables, pulled only as the transport asks for them. `eggfetch._native` is a private implementation module — import from `eggfetch`.
 
+Buffered Python responses retain the raw body and decode `.text` lazily; their
+`iter_bytes()`, `iter_text()`, and `iter_lines()` iterators yield one item at a
+time without pre-materializing the complete iterator result. Sync streaming
+uses bounded async-aware backpressure so a slow consumer does not block the
+client runtime. These are private implementation details and do not change
+the public API or chunking contracts.
+
+Maintainers can run `./scripts/check.sh` for routine local CI-equivalent
+validation. The stable Rust profile contracts run in Tier 1; the exact Rust
+surface snapshots and semver cross-check are an extended gate documented in
+[`compat/rust-public-api/README.md`](compat/rust-public-api/README.md).
+
 ## Usage -- Rust
 
 ```rust
@@ -206,6 +223,7 @@ See [`docs/reference/compatibility.md`](docs/reference/compatibility.md) for the
 | [migration/](docs/migration/) | Migration guides from requests and HTTPX |
 | [cookbook/](docs/cookbook/) | Practical runnable examples |
 | [reference/](docs/reference/) | Compatibility matrix, feature matrix, error reference |
+| [releases/](docs/releases/) | Release process and compatibility policy |
 | [security/](docs/security/) | Security guidelines and troubleshooting |
 | [architecture/](docs/architecture/) | Internal architecture documentation |
 | [ffi/](docs/ffi/) | C ABI and FFI binding guide |

{eggfetch-0.1.8 → eggfetch-0.2.1}/crates/eggfetch-core/src/body.rs

@@ -468,7 +468,7 @@ impl NativeResponseBody {
     /// Construct a native body around an eggfetch-owned response body.
     pub(crate) fn new<B>(
         body: B,
-        lease: PoolGuardArc,
+        lease: Option<PoolGuardArc>,
         read_timeout: Option<Duration>,
         total_deadline: Option<ResponseDeadline>,
     ) -> Self
@@ -477,7 +477,7 @@ impl NativeResponseBody {
     {
         Self {
             inner: Box::pin(body),
-            lease: Some(lease),
+            lease,
             read_timeout,
             total_deadline,
             read_sleep: None,
@@ -651,7 +651,7 @@ impl NativeResponseBody {
     /// stable eggfetch error type.
     pub(crate) fn from_incoming(
         incoming: hyper::body::Incoming,
-        lease: PoolGuardArc,
+        lease: Option<PoolGuardArc>,
         read_timeout: Option<Duration>,
         total_deadline: Option<ResponseDeadline>,
     ) -> Self {

eggfetch-0.2.1/crates/eggfetch-core/src/client/config.rs

@@ -0,0 +1,120 @@
+//! Private client configuration and its redacted defaults.
+
+use std::sync::Arc;
+
+use crate::headers::Headers;
+use crate::http_version::HttpVersionPolicy;
+use crate::timeout::Timeout;
+
+#[cfg(feature = "cookies")]
+use crate::cookie::CookieJar;
+#[cfg(feature = "proxy")]
+use crate::proxy::Proxy;
+#[cfg(feature = "redirects")]
+use crate::redirect::RedirectPolicy;
+#[cfg(feature = "logical-retry")]
+use crate::retry::RetryPolicy;
+#[cfg(feature = "advanced-routing")]
+use crate::transport::dialer::Dialer;
+
+/// Shared client configuration. This module is private; public builder
+/// methods remain declared in the parent `client` module.
+#[derive(Clone)]
+pub(crate) struct ClientConfig {
+    pub(crate) default_headers: Headers,
+    pub(crate) user_agent: Option<String>,
+    pub(crate) timeout: Option<Timeout>,
+    #[cfg(feature = "redirects")]
+    pub(crate) redirect: RedirectPolicy,
+    pub(crate) auth: Option<crate::auth::AuthScheme>,
+    #[cfg(feature = "cookies")]
+    pub(crate) cookie_jar: CookieJar,
+    pub(crate) automatic_decompression: bool,
+    pub(crate) max_decoded_body_size: Option<usize>,
+    pub(crate) max_decompression_ratio: Option<f64>,
+    #[cfg(feature = "proxy")]
+    pub(crate) proxy: Option<Proxy>,
+    #[cfg(feature = "proxy")]
+    pub(crate) environment_proxies: Vec<Proxy>,
+    #[cfg(feature = "tls-rustls")]
+    pub(crate) tls_config: Option<crate::tls::TlsConfig>,
+    #[cfg(feature = "logical-retry")]
+    pub(crate) retry: Option<RetryPolicy>,
+    pub(crate) retry_canceled_requests: bool,
+    #[cfg(feature = "advanced-routing")]
+    pub(crate) dialer: Option<Arc<dyn Dialer>>,
+    #[cfg(feature = "advanced-routing")]
+    pub(crate) uds_configured: bool,
+    #[allow(
+        dead_code,
+        reason = "stored for inspection and future request-level use"
+    )]
+    pub(crate) http_version_policy: HttpVersionPolicy,
+}
+
+impl std::fmt::Debug for ClientConfig {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let mut debug = f.debug_struct("ClientConfig");
+        debug
+            .field("default_headers", &self.default_headers)
+            .field("user_agent", &self.user_agent)
+            .field("timeout", &self.timeout);
+        #[cfg(feature = "redirects")]
+        debug.field("redirect", &self.redirect);
+        debug.field("auth", &self.auth);
+        #[cfg(feature = "cookies")]
+        debug.field("cookie_jar", &self.cookie_jar);
+        debug
+            .field("automatic_decompression", &self.automatic_decompression)
+            .field("max_decoded_body_size", &self.max_decoded_body_size)
+            .field("max_decompression_ratio", &self.max_decompression_ratio);
+        #[cfg(feature = "proxy")]
+        debug
+            .field("proxy", &self.proxy)
+            .field("environment_proxies", &self.environment_proxies);
+        #[cfg(feature = "tls-rustls")]
+        debug.field("tls_config", &self.tls_config);
+        #[cfg(feature = "logical-retry")]
+        debug.field("retry", &self.retry);
+        debug.field("retry_canceled_requests", &self.retry_canceled_requests);
+        #[cfg(feature = "advanced-routing")]
+        debug
+            .field("dialer", &self.dialer.as_ref().map(|_| "configured"))
+            .field("uds_configured", &self.uds_configured);
+        debug
+            .field("http_version_policy", &self.http_version_policy)
+            .finish_non_exhaustive()
+    }
+}
+
+impl Default for ClientConfig {
+    fn default() -> Self {
+        Self {
+            default_headers: Headers::new(),
+            user_agent: None,
+            timeout: None,
+            #[cfg(feature = "redirects")]
+            redirect: RedirectPolicy::default(),
+            auth: None,
+            #[cfg(feature = "cookies")]
+            cookie_jar: CookieJar::new(),
+            automatic_decompression: true,
+            max_decoded_body_size: None,
+            max_decompression_ratio: None,
+            #[cfg(feature = "proxy")]
+            proxy: None,
+            #[cfg(feature = "proxy")]
+            environment_proxies: Vec::new(),
+            #[cfg(feature = "tls-rustls")]
+            tls_config: None,
+            #[cfg(feature = "logical-retry")]
+            retry: None,
+            retry_canceled_requests: true,
+            #[cfg(feature = "advanced-routing")]
+            dialer: None,
+            #[cfg(feature = "advanced-routing")]
+            uds_configured: false,
+            http_version_policy: HttpVersionPolicy::default(),
+        }
+    }
+}

eggfetch-0.2.1/crates/eggfetch-core/src/client/connectors.rs

@@ -0,0 +1,179 @@
+//! Private connector preparation for the client.
+
+#[cfg(feature = "advanced-routing")]
+use std::sync::Arc;
+
+#[cfg(feature = "advanced-routing")]
+use super::Dialer;
+#[cfg(feature = "advanced-routing")]
+use super::{Error, Result};
+#[cfg(any(feature = "transport-http1", feature = "transport-http2"))]
+use crate::transport::Connector;
+
+/// Build the standard cleartext connector.
+#[cfg(all(
+    not(feature = "tls-rustls"),
+    any(feature = "transport-http1", feature = "transport-http2")
+))]
+pub(super) fn build_standard_connector(
+    enabler: crate::http_version::HttpVersionPolicyEnabler,
+) -> Connector {
+    build_standard_connector_with_resolver(
+        hyper_util::client::legacy::connect::dns::GaiResolver::new(),
+        enabler,
+    )
+}
+
+/// Build a standard cleartext connector with a caller-selected private
+/// resolver. Production callers use the default system resolver; tests use
+/// this generic seam to keep resolver provenance deterministic.
+#[cfg(all(
+    not(feature = "tls-rustls"),
+    any(feature = "transport-http1", feature = "transport-http2")
+))]
+pub(super) fn build_standard_connector_with_resolver<R>(
+    resolver: R,
+    enabler: crate::http_version::HttpVersionPolicyEnabler,
+) -> hyper_util::client::legacy::connect::HttpConnector<
+    crate::transport::standard_resolver::ClassifyingResolver<R>,
+>
+where
+    R: tower_service::Service<hyper_util::client::legacy::connect::dns::Name>
+        + Clone
+        + Send
+        + Sync
+        + 'static,
+    R::Response: Iterator<Item = std::net::SocketAddr>,
+    R::Error: Into<Box<dyn std::error::Error + Send + Sync>>,
+    R::Future: Send + 'static,
+{
+    let _ = enabler;
+    let mut connector = hyper_util::client::legacy::connect::HttpConnector::new_with_resolver(
+        crate::transport::standard_resolver::ClassifyingResolver::new(resolver),
+    );
+    connector.enforce_http(true);
+    connector
+}
+
+/// Build the standard TLS connector from the authoritative [`TlsConfig`].
+#[cfg(all(
+    feature = "tls-rustls",
+    any(feature = "transport-http1", feature = "transport-http2")
+))]
+pub(super) fn build_standard_connector(
+    config: rustls::ClientConfig,
+    enabler: crate::http_version::HttpVersionPolicyEnabler,
+) -> Connector {
+    build_standard_connector_with_resolver(
+        config,
+        enabler,
+        hyper_util::client::legacy::connect::dns::GaiResolver::new(),
+    )
+}
+
+/// Build the standard Rustls connector around an explicitly constructed
+/// Hyper resolver connector so DNS provenance survives the TLS wrapper.
+#[cfg(all(
+    feature = "tls-rustls",
+    any(feature = "transport-http1", feature = "transport-http2")
+))]
+pub(super) fn build_standard_connector_with_resolver<R>(
+    mut config: rustls::ClientConfig,
+    enabler: crate::http_version::HttpVersionPolicyEnabler,
+    resolver: R,
+) -> hyper_rustls::HttpsConnector<
+    hyper_util::client::legacy::connect::HttpConnector<
+        crate::transport::standard_resolver::ClassifyingResolver<R>,
+    >,
+>
+where
+    R: tower_service::Service<hyper_util::client::legacy::connect::dns::Name>
+        + Clone
+        + Send
+        + Sync
+        + 'static,
+    R::Response: Iterator<Item = std::net::SocketAddr>,
+    R::Error: Into<Box<dyn std::error::Error + Send + Sync>>,
+    R::Future: Send + 'static,
+{
+    // hyper-rustls fills ALPN from the selected protocol methods.
+    config.alpn_protocols.clear();
+    let mut http = hyper_util::client::legacy::connect::HttpConnector::new_with_resolver(
+        crate::transport::standard_resolver::ClassifyingResolver::new(resolver),
+    );
+    http.enforce_http(false);
+    let builder = hyper_rustls::HttpsConnectorBuilder::new()
+        .with_tls_config(config)
+        .https_or_http();
+    #[cfg(all(feature = "transport-http1", feature = "transport-http2"))]
+    {
+        match (enabler.enable_http1(), enabler.enable_http2()) {
+            (true, true) => builder.enable_http1().enable_http2().wrap_connector(http),
+            (true | false, false) => builder.enable_http1().wrap_connector(http),
+            (false, true) => builder.enable_http2().wrap_connector(http),
+        }
+    }
+    #[cfg(all(feature = "transport-http1", not(feature = "transport-http2")))]
+    {
+        let _ = enabler;
+        builder.enable_http1().wrap_connector(http)
+    }
+    #[cfg(all(feature = "transport-http2", not(feature = "transport-http1")))]
+    {
+        let _ = enabler;
+        builder.enable_http2().wrap_connector(http)
+    }
+}
+
+#[cfg(all(feature = "tls-rustls", feature = "advanced-routing"))]
+pub(super) fn build_custom_connector(
+    config: rustls::ClientConfig,
+    dialer: Arc<dyn Dialer>,
+    enabler: crate::http_version::HttpVersionPolicyEnabler,
+    sni_hostname: Option<&str>,
+) -> Result<crate::transport::CustomConnector> {
+    let config = configure_tls_alpn(config, enabler);
+    let resolver: Arc<dyn hyper_rustls::ResolveServerName + Send + Sync> =
+        if let Some(sni_hostname) = sni_hostname {
+            let server_name = rustls::pki_types::ServerName::try_from(sni_hostname.to_owned())
+                .map_err(|error| Error::Tls(format!("invalid SNI hostname: {error}")))?;
+            Arc::new(hyper_rustls::FixedServerNameResolver::new(server_name))
+        } else {
+            Arc::new(hyper_rustls::DefaultServerNameResolver::default())
+        };
+    Ok(hyper_rustls::HttpsConnector::new(
+        crate::transport::dialer::DialerConnector::new(dialer),
+        Arc::new(config),
+        false,
+        resolver,
+    ))
+}
+
+#[cfg(all(not(feature = "tls-rustls"), feature = "advanced-routing"))]
+pub(super) fn build_custom_connector(
+    _config: (),
+    dialer: Arc<dyn Dialer>,
+    _enabler: crate::http_version::HttpVersionPolicyEnabler,
+    _sni_hostname: Option<&str>,
+) -> Result<crate::transport::CustomConnector> {
+    Ok(crate::transport::dialer::DialerConnector::new(dialer))
+}
+
+/// Apply the selected HTTP protocol policy to a rustls client configuration.
+///
+/// The standard hyper-rustls connector applies this policy while building its
+/// connector. Custom connectors must set the same ALPN list themselves.
+#[cfg(feature = "tls-rustls")]
+pub(crate) fn configure_tls_alpn(
+    mut config: rustls::ClientConfig,
+    policy: crate::http_version::HttpVersionPolicyEnabler,
+) -> rustls::ClientConfig {
+    config.alpn_protocols.clear();
+    if policy.enable_http2() {
+        config.alpn_protocols.push(b"h2".to_vec());
+    }
+    if policy.enable_http1() {
+        config.alpn_protocols.push(b"http/1.1".to_vec());
+    }
+    config
+}