haxetink
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 12 additions & 3 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 12 additions & 3 deletions
diff --git a/‎.gitignore‎
Lines changed: 3 additions & 1 deletion b/‎.gitignore‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎.haxerc‎
Lines changed: 1 addition & 1 deletion b/‎.haxerc‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.vscode/settings.json‎
Lines changed: 3 additions & 1 deletion b/‎.vscode/settings.json‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎README.md‎
Lines changed: 98 additions & 25 deletions b/‎README.md‎
Lines changed: 98 additions & 25 deletions
@@ -3,21 +3,22 @@ name: CI
 on:
   push:
   pull_request:
-    branches: [master]
+    branches: [master, api2]
 
 jobs:
   test:
     runs-on: ubuntu-latest
-    continue-on-error: ${{ matrix.haxe-version == 'nightly' }}
     strategy:
       fail-fast: false
       matrix:
         haxe-version:
-          - stable
+          # - stable
           - nightly
         target:
           - node
           - jvm
+          - interp
+          - cpp -lib linc_uv
 
     steps:
       - name: Check out repo
@@ -38,6 +39,14 @@ jobs:
       - name: Install Haxe Libraries
         run: lix download
 
+      - name: Compile hxcpp tools
+        if: contains(matrix.target, 'cpp') && matrix.haxe-version == 'nightly'
+        run: |
+          HXCPP_LIBPATH=$(haxelib libpath hxcpp)
+          pushd "$HXCPP_LIBPATH"/tools/hxcpp
+          haxe compile.hxml
+          popd
+
       - name: Run Test
         run: lix run travix ${{ matrix.target }} ${{ matrix.flags }}
 
 
@@ -1,3 +1,5 @@
 /bin
 node_modules
-travix.n
+travix.n
+native/hl/*.o
+native/hl/*.hdll
@@ -1,4 +1,4 @@
 {
-  "version": "4.3.7",
+  "version": "5f83789",
   "resolveLibs": "scoped"
 }
@@ -1,5 +1,7 @@
 {
     "haxe.displayConfigurations": [
         ["dev.hxml"]
-    ]
+    ],
+    "editor.tabSize": 2,
+    "editor.insertSpaces": true
 }
@@ -9,46 +9,119 @@ package tink.tcp;
 
 using tink.io.Source;//defines IdealSource and RealSource
 
-abstract Endpoint from { host: String, port: Int, ?secure:Bool } {
+abstract Endpoint from { host: String, port: Int } {
   public var host(get, never):String;
   public var port(get, never):Int;
-  public var secure(get, never):Bool;
   @:from static function fromPort(port:Int):Endpoint;
   @:to function toString():String;
 }
 
-typedef Incoming = {
-  var from(default, never):Endpoint;
-  var to(default, never):Endpoint;
-  var stream(default, never):RealSource;
+enum SessionOutcome {
+  GoneGraceful;   // outbound pipe + end/shutdown succeeded
+  Aborted;        // user called abort()
+  Failed(e:Error); // outbound pipe and/or end/shutdown failed
 }
 
-typedef Outgoing = {
-  var stream(default, never):IdealSource;
-  @:optional var allowHalfOpen(default, never):Bool;
+typedef IncomingConnection = {
+  final source:RealSource;
+  final local:Endpoint;
+  final peer:Endpoint;
+  final closed:Future<SessionOutcome>;
+  function abort():Void;
 }
 
-abstract Handler {
-  function handle(incoming:Incoming):Future<Outgoing>;
-  @:from static private function ofAsync(f:Incoming->Future<Outgoing>):Handler;
-  @:from static private function ofSync(f:Incoming->Outgoing):Handler;
+/** Internal connection shape; platforms pass `TcpConnection` (UV+TLS shared path) or `NodeConnection` / `JavaConnection` to `Handler.run`. */
+interface Connection {
+  final source:RealSource;
+  final sink:RealSink;
+  final local:Endpoint;
+  final peer:Endpoint;
+  function abort():Void;
 }
 
-class OpenPort {
-  
-  var queued(default, null):Int;
-  var running(default, null):Int;
-  var maxRunning(default, null):Int = 0x100000;
-
-  function setHandler(handler:Handler):Promise<Noise>;
-  function shutdown(?hard:Bool):Promise<Bool>;
+@:callable
+abstract Handler(IncomingConnection->IdealSource) from IncomingConnection->IdealSource {
+  /** Platforms call `app.run(conn)` after dial/accept (fire-and-forget). */
+  public function run(conn:Connection):Void;
 }
 
-interface Connector {
-  function connect(to:Endpoint, handler:Handler):Promise<Noise>;
+class Client {
+  static public function connect(to:Endpoint, app:Handler, ?options:ConnectOptions):Promise<Noise>;
 }
 
-interface Acceptor {
-  function bind(?port:Int):Promise<OpenPort>;
+interface Server {
+  var endpoint(get, never):Endpoint;
+  var errors(get, never):Signal<Error>;
+  function shutdown():Promise<Noise>;
+
+  static public function bind(to:Endpoint, app:Handler, ?options:BindOptions):Promise<Server>;
 }
 ```
+
+`Client.connect` resolves when the TCP/TLS dial **succeeds** and rejects when it **fails**. The handler runs only after a successful dial. The Promise does **not** wait for the handler’s outbound pipe or session lifetime — dial ≠ session. Observe session teardown via `incoming.closed`.
+
+`Server.bind` takes a `Handler` up front. Each accepted peer is passed to that handler; the returned `IdealSource` is piped to the peer (`pipeTo(sink, {end: true})`).
+
+**`incoming.closed`:** a `Future<SessionOutcome>` that settles **once** when the outbound IdealSource pipe (and sink `end` / TLS shutdown) finishes. Subscribe at the start of the Handler — the Future exists before `app` runs. Outcomes: `GoneGraceful` (pipe + end/shutdown succeeded), `Aborted` (this side called `abort()`), or `Failed(e)` (outbound write and/or end/shutdown failed). Inbound `source` read errors are **not** reported here; the Handler owns inbound. Prefer `closed` over treating `Client.connect`’s Promise as session lifetime.
+
+**`Server.errors`:** a `Signal<Error>` for **listen-adjacent** faults only — accept-loop failures (non-shutdown) and server TLS handshake failures for peers that never reach the `Handler`. It does **not** report per-session I/O or outbound pipe failures; use `incoming.closed` for those. Shutdown-interrupted accept stays silent.
+
+**Graceful close vs `abort()`:** The normal teardown is finishing both sides of the session — drain or end the inbound `source`, and let the returned `IdealSource` complete so `pipeTo(sink, {end: true})` can shut the socket down cleanly (TCP FIN / orderly TLS shutdown as the platform provides) — that path settles `closed` as `GoneGraceful`. Call `incoming.abort()` when you need to tear down mid-session without completing that path: it is an **idempotent, best-effort hard close / local cleanup** of the underlying socket or handle (pending reads/writes fail or end; graceful stream `end` / TLS `close_notify` are skipped) and settles `closed` as `Aborted` (abort wins over a concurrent pipe failure). A TCP RST (or `ECONNRESET`) is **not** promised.
+
+Use the static entry points — do not construct platform clients:
+
+```haxe
+Server.bind({ host: '0.0.0.0', port: 8080 }, incoming -> {
+  incoming.closed.handle(o -> switch o {
+    case GoneGraceful: /* outbound finished cleanly */
+    case Aborted: /* this side called abort() */
+    case Failed(e): /* outbound pipe / end failed */
+  });
+  // read from incoming.source; return bytes to send
+  return ('hello\n' : IdealSource).append(incoming.source.idealize(_ -> Source.EMPTY));
+}).handle(o -> switch o {
+  case Success(server):
+    server.errors.handle(e -> {/* accept / server-TLS-handshake only; not session I/O */});
+    Client.connect(server.endpoint, incoming -> {
+      incoming.source.all().handle(_ -> {});
+      return ('ping\n' : IdealSource);
+    }).handle(o -> switch o {
+      case Success(_): /* dial ok; session lifetime is via incoming.closed / streams */
+      case Failure(e): /* dial failed */
+    });
+  case Failure(e): /* bind failed */
+});
+```
+
+Platform backends (dispatched by `Client.connect` / `Server.bind`):
+
+- Node.js
+- JVM
+- Eval (interp), with optional `BindOptions.loop`
+- HashLink, with optional `BindOptions.loop`
+- C++ (hxcpp + linc_uv)
+
+TLS is opt-in via `options.tls` on `Server.bind` and `Client.connect`. It is implemented on **Node.js**, **JVM**, **HashLink**, **C++** (owned mbedtls over libuv), and **eval** (when built with an Haxe version that exposes eval mbedtls `set_bio`, `own_cert`, and ALPN). PKCS#8 private keys only (`BEGIN PRIVATE KEY`). CI `interp` TLS tests are gated behind `-D eval_tls` until the updated Haxe build is available upstream.
+
+```haxe
+// Server: requires cert + key (see TlsServerOptions in tink.tcp.Tls)
+Server.bind({ host: '0.0.0.0', port: 443 }, incoming -> {
+  incoming.source.all().handle(_ -> {});
+  return ('ok' : IdealSource);
+}, { tls: { cert: certBytes, key: keyBytes } });
+
+// Client: see TlsClientOptions in tink.tcp.Tls
+Client.connect({ host: 'example.com', port: 443 }, incoming -> {
+  incoming.source.all().handle(_ -> {});
+  return Source.EMPTY;
+}, { tls: { ca: caBytes, servername: 'example.com' } });
+```
+
+Eval TLS local test run: `lix run travix interp -D eval_tls`
+
+C++ requires `-lib linc_uv` (and hxcpp). Example: `lix run travix cpp`
+
+## TODO
+
+- **cpp DNS:** `CppClient` / `CppServer` currently resolve hostnames synchronously via `sys.net.Host`. Switch to async `uv_getaddrinfo` (`linc_uv` `GetAddrInfo`) so connect/bind do not block the event loop.
+- **cpp ALPN:** TLS ALPN options are accepted in the public API but not yet wired on cpp (throws if `alpn` is set).
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`	`1`	`{`
`2`		`- "version": "4.3.7",`
	`2`	`+ "version": "5f83789",`
`3`	`3`	`"resolveLibs": "scoped"`
`4`	`4`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"haxe.displayConfigurations": [`
`3`	`3`	`["dev.hxml"]`
`4`		`- ]`
	`4`	`+ ],`
	`5`	`+ "editor.tabSize": 2,`
	`6`	`+ "editor.insertSpaces": true`
`5`	`7`	`}`