# avril-http

HTTP/1.1 transport for avril, independent of V8 and runtime capability types.

The engine owns TCP/Unix listeners, request and response streaming, connection
lifetimes, graceful/forced shutdown, and validated WebSocket upgrade handshakes.
Its caller supplies an authorization callback for each listener. Runtime policy
and JS bindings stay in `exts/http/src`; CLI listeners supply host authority
without changing guest capabilities.

An accepted upgrade returns a stream and a lease. Keep the lease for the entire
WebSocket session: dropping it finishes the request and releases the server's
shutdown tracking. WebSocket framing and events reuse the runtime's existing
client implementation, with server-role masking and closing semantics.

Listener binding is shared with raw sockets through `avril-net`. Unix listeners
use Linux procfs for FD-relative binding, with pinned parent
directories and identity-checked socket cleanup. Other Unix platforms use ordinary
path-based binding and best-effort identity-checked cleanup. Authorization still
applies, but that fallback can race with filesystem changes. Non-Unix platforms
report an unsupported-operation error.