Nocter v0.43.0 Release Notes

Nocter v0.43.0 adds authenticated TLS client streams and makes the existing synchronous and asynchronous HTTP/1.1 client usable with https URLs. The implementation uses the operating system's Network.framework and Security.framework directly, preserving Nocter's self-contained compiler distribution and external-runtime-free generated executables. The only implemented host and native target remains arm64-darwin.

Authenticated TLS Streams

std/tls.TlsStream is a uniquely owned encrypted byte stream. Its connection operations resolve the requested host, authenticate that same hostname against the operating-system trust store, require TLS 1.2 or newer, and preserve one deadline across ordered address fallback.

The stream implements the existing Reader and Writer contracts and provides synchronous and asynchronous reads and complete writes. Address inspection, timeout configuration, directional shutdown, explicit close, destruction, and cancellation use the same ownership model as plain TCP.

use std/tls

let stream = tls.TlsStream.connect("example.com", 443)?

HTTPS Through the Existing HTTP Client

The existing std/http.Client now selects authenticated TLS for https URLs and plain TCP for http URLs. Both transports feed the same request policy, response-head decoder, body-framing state, limits, cursor, and uniquely owned Response; HTTPS does not introduce a second HTTP codec.

HTTPS advertises only HTTP/1.1 through ALPN and rejects an authenticated server unless it selects that exact protocol. Missing or different negotiation, certificate failure, hostname mismatch, and malformed TLS records use the stable std.net.tls_failed error code.

use std/http
use std/url

let client = http.Client.new()
let destination = url.Url.parse("https://example.com/")?
let request = http.Request.get(move destination)?
var response = client.send(move request)?

Client.send_async follows the same authenticated transport selection. Request preparation and synchronous name resolution remain in the immediate outer result; connection, transmission, and final-response reception belong to the returned lazy computation.

Additional Trust Roots

TrustAnchor.from_der copies one non-empty DER-encoded certificate. TLS connection operations and Client.with_trust_anchor add that root to the operating-system store instead of replacing system trust or disabling hostname and certificate-validity checks. Asynchronous operations own an independent copy, so a pending computation does not borrow the caller's anchor.

use std/http
use std/tls

func client_with_root(certificate: &[u8]): http.Client! {
    let anchor = tls.TrustAnchor.from_der(certificate)?
    return http.Client.new().with_trust_anchor(move anchor)
}

Provider and Ownership Boundary

Plain TCP and TLS now use one Network.framework connection and callback-event substrate. Native connection objects, callback blocks, trust values, negotiated metadata, and provider error codes remain behind compiler-owned primitive operations. Public source receives only opaque stream owners, addresses, caller-owned bytes, and stable errors.

Cancelling or destroying a stream waits for the terminal provider state and crosses its serial callback-queue barrier before releasing the connection and copied trust context. Deferred TLS and HTTPS computations own their hostname, candidates, trust bytes, ALPN identifier, and deadline.

Editor and Example Support

Hover, completion, signature help, navigation, semantic tokens, and inlay hints consume the same checked TLS and HTTP declarations used by compilation. The existing http-get example accepts authenticated https URLs through the ordinary Client path; it does not select a parallel TLS API or depend on example-only transport logic.

Compatibility and Non-goals

The provider migration preserves the public TCP stream and listener contracts. UDP remains on its datagram-specific descriptor substrate. v0.43.0 does not add HTTP/2, HTTP/3, redirects, retries, request replay, decompression, connection pooling, asynchronous DNS, a TLS server, a public foreign- function interface, detached tasks, multiple executor threads, or another native target.

Release Qualification

Release-content commit de4932a08a123b274f8b44df39f706511f549255 passed two independent complete compiler gates, the explicit public-HTTPS dependency-acquisition test, and two independent optimized package builds. The resulting archives and installed homes were identical. Fresh extraction passed the installed CLI, every public example, selected exact process contracts, native execution, framed LSP analysis, installed-home immutability, and compiler and standard- library tamper rejection.

The nocter-v0.43.0-arm64-darwin.tar.gz release is the exact retained qualified archive. It is 8,918,593 bytes with SHA-256 5e81c1079353ed777f28018c11099935b71a8dcbf383792967709542ca22c2d3; publication reused this retained archive without rebuilding it.