diff --git a/.gitignore b/.gitignore
index ad9ae7b4..579000fd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ zig-out
 /vendor/libiconv/
 lightpanda.id
 /v8/
+/vendor/nghttp2/lib/includes/nghttp2/nghttp2ver.h
diff --git a/.gitmodules b/.gitmodules
index f025f0bd..01e8ca81 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -19,3 +19,15 @@
 [submodule "vendor/mimalloc"]
 	path = vendor/mimalloc
 	url = https://github.com/microsoft/mimalloc.git/
+[submodule "vendor/nghttp2"]
+	path = vendor/nghttp2
+	url = https://github.com/nghttp2/nghttp2.git
+[submodule "vendor/mbedtls"]
+	path = vendor/mbedtls
+	url = https://github.com/Mbed-TLS/mbedtls.git
+[submodule "vendor/zlib"]
+	path = vendor/zlib
+	url = https://github.com/madler/zlib.git
+[submodule "vendor/curl"]
+	path = vendor/curl
+	url = https://github.com/curl/curl.git
diff --git a/build.zig b/build.zig
index 6f3906f3..e3c025d9 100644
--- a/build.zig
+++ b/build.zig
@@ -19,11 +19,13 @@
 const std = @import("std");
 const builtin = @import("builtin");
 
+const Build = std.Build;
+
 /// Do not rename this constant. It is scanned by some scripts to determine
 /// which zig version to install.
 const recommended_zig_version = "0.14.1";
 
-pub fn build(b: *std.Build) !void {
+pub fn build(b: *Build) !void {
     switch (comptime builtin.zig_version.order(std.SemanticVersion.parse(recommended_zig_version) catch unreachable)) {
         .eq => {},
         .lt => {
@@ -138,29 +140,28 @@ pub fn build(b: *std.Build) !void {
     }
 }
 
-fn common(b: *std.Build, opts: *std.Build.Step.Options, step: *std.Build.Step.Compile) !void {
+fn common(b: *Build, opts: *Build.Step.Options, step: *Build.Step.Compile) !void {
     const mod = step.root_module;
     const target = mod.resolved_target.?;
     const optimize = mod.optimize.?;
     const dep_opts = .{ .target = target, .optimize = optimize };
 
     try moduleNetSurf(b, step, target);
-    mod.addImport("tls", b.dependency("tls", dep_opts).module("tls"));
+    mod.addImport("build_config", opts.createModule());
     mod.addImport("tigerbeetle-io", b.dependency("tigerbeetle_io", .{}).module("tigerbeetle_io"));
 
     {
         // v8
+        mod.link_libcpp = true;
+
         const v8_opts = b.addOptions();
         v8_opts.addOption(bool, "inspector_subtype", false);
 
         const v8_mod = b.dependency("v8", dep_opts).module("v8");
         v8_mod.addOptions("default_exports", v8_opts);
         mod.addImport("v8", v8_mod);
-    }
 
-    mod.link_libcpp = true;
 
-    {
         const release_dir = if (mod.optimize.? == .Debug) "debug" else "release";
         const os = switch (target.result.os.tag) {
             .linux => "linux",
@@ -181,21 +182,210 @@ fn common(b: *std.Build, opts: *std.Build.Step.Options, step: *std.Build.Step.Co
             );
         };
         mod.addObjectFile(mod.owner.path(lib_path));
+
+        switch (target.result.os.tag) {
+            .macos => {
+                // v8 has a dependency, abseil-cpp, which, on Mac, uses CoreFoundation
+                mod.addSystemFrameworkPath(.{ .cwd_relative = "/System/Library/Frameworks" });
+                mod.linkFramework("CoreFoundation", .{});
+            },
+            else => {},
+        }
     }
 
-    switch (target.result.os.tag) {
-        .macos => {
-            // v8 has a dependency, abseil-cpp, which, on Mac, uses CoreFoundation
-            mod.addSystemFrameworkPath(.{ .cwd_relative = "/System/Library/Frameworks" });
-            mod.linkFramework("CoreFoundation", .{});
-        },
-        else => {},
-    }
+    {
+        //curl
+        {
+            const is_linux = target.result.os.tag == .linux;
+            if (is_linux) {
+                mod.addCMacro("HAVE_LINUX_TCP_H", "1");
+                mod.addCMacro("HAVE_MSG_NOSIGNAL", "1");
+                mod.addCMacro("HAVE_GETHOSTBYNAME_R", "1");
+            }
+            mod.addCMacro("_FILE_OFFSET_BITS", "64");
+            mod.addCMacro("BUILDING_LIBCURL", "1");
+            mod.addCMacro("CURL_DISABLE_AWS", "1");
+            mod.addCMacro("CURL_DISABLE_DICT", "1");
+            mod.addCMacro("CURL_DISABLE_DOH", "1");
+            mod.addCMacro("CURL_DISABLE_FILE", "1");
+            mod.addCMacro("CURL_DISABLE_FTP", "1");
+            mod.addCMacro("CURL_DISABLE_GOPHER", "1");
+            mod.addCMacro("CURL_DISABLE_KERBEROS", "1");
+            mod.addCMacro("CURL_DISABLE_IMAP", "1");
+            mod.addCMacro("CURL_DISABLE_IPFS", "1");
+            mod.addCMacro("CURL_DISABLE_LDAP", "1");
+            mod.addCMacro("CURL_DISABLE_LDAPS", "1");
+            mod.addCMacro("CURL_DISABLE_MQTT", "1");
+            mod.addCMacro("CURL_DISABLE_NTLM", "1");
+            mod.addCMacro("CURL_DISABLE_PROGRESS_METER", "1");
+            mod.addCMacro("CURL_DISABLE_POP3", "1");
+            mod.addCMacro("CURL_DISABLE_RTSP", "1");
+            mod.addCMacro("CURL_DISABLE_SMB", "1");
+            mod.addCMacro("CURL_DISABLE_SMTP", "1");
+            mod.addCMacro("CURL_DISABLE_TELNET", "1");
+            mod.addCMacro("CURL_DISABLE_TFTP", "1");
+            mod.addCMacro("CURL_EXTERN_SYMBOL", "__attribute__ ((__visibility__ (\"default\"))");
+            mod.addCMacro("CURL_OS", if (is_linux) "\"Linux\"" else "\"mac\"");
+            mod.addCMacro("CURL_STATICLIB", "1");
+            mod.addCMacro("ENABLE_IPV6", "1");
+            mod.addCMacro("HAVE_ALARM", "1");
+            mod.addCMacro("HAVE_ALLOCA_H", "1");
+            mod.addCMacro("HAVE_ARPA_INET_H", "1");
+            mod.addCMacro("HAVE_ARPA_TFTP_H", "1");
+            mod.addCMacro("HAVE_ASSERT_H", "1");
+            mod.addCMacro("HAVE_BASENAME", "1");
+            mod.addCMacro("HAVE_BOOL_T", "1");
+            mod.addCMacro("HAVE_BUILTIN_AVAILABLE", "1");
+            mod.addCMacro("HAVE_CLOCK_GETTIME_MONOTONIC", "1");
+            mod.addCMacro("HAVE_DLFCN_H", "1");
+            mod.addCMacro("HAVE_ERRNO_H", "1");
+            mod.addCMacro("HAVE_FCNTL", "1");
+            mod.addCMacro("HAVE_FCNTL_H", "1");
+            mod.addCMacro("HAVE_FCNTL_O_NONBLOCK", "1");
+            mod.addCMacro("HAVE_FREEADDRINFO", "1");
+            mod.addCMacro("HAVE_FSETXATTR", "1");
+            mod.addCMacro("HAVE_FSETXATTR_5", "1");
+            mod.addCMacro("HAVE_FTRUNCATE", "1");
+            mod.addCMacro("HAVE_GETADDRINFO", "1");
+            mod.addCMacro("HAVE_GETEUID", "1");
+            mod.addCMacro("HAVE_GETHOSTBYNAME", "1");
+            mod.addCMacro("HAVE_GETHOSTBYNAME_R_6", "1");
+            mod.addCMacro("HAVE_GETHOSTNAME", "1");
+            mod.addCMacro("HAVE_GETPEERNAME", "1");
+            mod.addCMacro("HAVE_GETPPID", "1");
+            mod.addCMacro("HAVE_GETPPID", "1");
+            mod.addCMacro("HAVE_GETPROTOBYNAME", "1");
+            mod.addCMacro("HAVE_GETPWUID", "1");
+            mod.addCMacro("HAVE_GETPWUID_R", "1");
+            mod.addCMacro("HAVE_GETRLIMIT", "1");
+            mod.addCMacro("HAVE_GETSOCKNAME", "1");
+            mod.addCMacro("HAVE_GETTIMEOFDAY", "1");
+            mod.addCMacro("HAVE_GMTIME_R", "1");
+            mod.addCMacro("HAVE_IDN2_H", "1");
+            mod.addCMacro("HAVE_IF_NAMETOINDEX", "1");
+            mod.addCMacro("HAVE_IFADDRS_H", "1");
+            mod.addCMacro("HAVE_INET_ADDR", "1");
+            mod.addCMacro("HAVE_INET_PTON", "1");
+            mod.addCMacro("HAVE_INTTYPES_H", "1");
+            mod.addCMacro("HAVE_IOCTL", "1");
+            mod.addCMacro("HAVE_IOCTL_FIONBIO", "1");
+            mod.addCMacro("HAVE_IOCTL_SIOCGIFADDR", "1");
+            mod.addCMacro("HAVE_LDAP_URL_PARSE", "1");
+            mod.addCMacro("HAVE_LIBGEN_H", "1");
+            mod.addCMacro("HAVE_LIBZ", "1");
+            mod.addCMacro("HAVE_LL", "1");
+            mod.addCMacro("HAVE_LOCALE_H", "1");
+            mod.addCMacro("HAVE_LOCALTIME_R", "1");
+            mod.addCMacro("HAVE_LONGLONG", "1");
+            mod.addCMacro("HAVE_MALLOC_H", "1");
+            mod.addCMacro("HAVE_MEMORY_H", "1");
+            mod.addCMacro("HAVE_NET_IF_H", "1");
+            mod.addCMacro("HAVE_NETDB_H", "1");
+            mod.addCMacro("HAVE_NETINET_IN_H", "1");
+            mod.addCMacro("HAVE_NETINET_TCP_H", "1");
+            mod.addCMacro("HAVE_PIPE", "1");
+            mod.addCMacro("HAVE_POLL", "1");
+            mod.addCMacro("HAVE_POLL_FINE", "1");
+            mod.addCMacro("HAVE_POLL_H", "1");
+            mod.addCMacro("HAVE_POSIX_STRERROR_R", "1");
+            mod.addCMacro("HAVE_PTHREAD_H", "1");
+            mod.addCMacro("HAVE_PWD_H", "1");
+            mod.addCMacro("HAVE_RECV", "1");
+            mod.addCMacro("HAVE_SA_FAMILY_T", "1");
+            mod.addCMacro("HAVE_SELECT", "1");
+            mod.addCMacro("HAVE_SEND", "1");
+            mod.addCMacro("HAVE_SETJMP_H", "1");
+            mod.addCMacro("HAVE_SETLOCALE", "1");
+            mod.addCMacro("HAVE_SETRLIMIT", "1");
+            mod.addCMacro("HAVE_SETSOCKOPT", "1");
+            mod.addCMacro("HAVE_SIGACTION", "1");
+            mod.addCMacro("HAVE_SIGINTERRUPT", "1");
+            mod.addCMacro("HAVE_SIGNAL", "1");
+            mod.addCMacro("HAVE_SIGNAL_H", "1");
+            mod.addCMacro("HAVE_SIGSETJMP", "1");
+            mod.addCMacro("HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID", "1");
+            mod.addCMacro("HAVE_SOCKET", "1");
+            mod.addCMacro("HAVE_STDBOOL_H", "1");
+            mod.addCMacro("HAVE_STDINT_H", "1");
+            mod.addCMacro("HAVE_STDIO_H", "1");
+            mod.addCMacro("HAVE_STDLIB_H", "1");
+            mod.addCMacro("HAVE_STRCASECMP", "1");
+            mod.addCMacro("HAVE_STRDUP", "1");
+            mod.addCMacro("HAVE_STRERROR_R", "1");
+            mod.addCMacro("HAVE_STRING_H", "1");
+            mod.addCMacro("HAVE_STRINGS_H", "1");
+            mod.addCMacro("HAVE_STRSTR", "1");
+            mod.addCMacro("HAVE_STRTOK_R", "1");
+            mod.addCMacro("HAVE_STRTOLL", "1");
+            mod.addCMacro("HAVE_STRUCT_SOCKADDR_STORAGE", "1");
+            mod.addCMacro("HAVE_STRUCT_TIMEVAL", "1");
+            mod.addCMacro("HAVE_SYS_IOCTL_H", "1");
+            mod.addCMacro("HAVE_SYS_PARAM_H", "1");
+            mod.addCMacro("HAVE_SYS_POLL_H", "1");
+            mod.addCMacro("HAVE_SYS_RESOURCE_H", "1");
+            mod.addCMacro("HAVE_SYS_SELECT_H", "1");
+            mod.addCMacro("HAVE_SYS_SOCKET_H", "1");
+            mod.addCMacro("HAVE_SYS_STAT_H", "1");
+            mod.addCMacro("HAVE_SYS_TIME_H", "1");
+            mod.addCMacro("HAVE_SYS_TYPES_H", "1");
+            mod.addCMacro("HAVE_SYS_UIO_H", "1");
+            mod.addCMacro("HAVE_SYS_UN_H", "1");
+            mod.addCMacro("HAVE_TERMIO_H", "1");
+            mod.addCMacro("HAVE_TERMIOS_H", "1");
+            mod.addCMacro("HAVE_TIME_H", "1");
+            mod.addCMacro("HAVE_UNAME", "1");
+            mod.addCMacro("HAVE_UNISTD_H", "1");
+            mod.addCMacro("HAVE_UTIME", "1");
+            mod.addCMacro("HAVE_UTIME_H", "1");
+            mod.addCMacro("HAVE_UTIMES", "1");
+            mod.addCMacro("HAVE_VARIADIC_MACROS_C99", "1");
+            mod.addCMacro("HAVE_VARIADIC_MACROS_GCC", "1");
+            mod.addCMacro("HAVE_ZLIB_H", "1");
+            mod.addCMacro("RANDOM_FILE", "\"/dev/urandom\"");
+            mod.addCMacro("RECV_TYPE_ARG1", "int");
+            mod.addCMacro("RECV_TYPE_ARG2", "void *");
+            mod.addCMacro("RECV_TYPE_ARG3", "size_t");
+            mod.addCMacro("RECV_TYPE_ARG4", "int");
+            mod.addCMacro("RECV_TYPE_RETV", "ssize_t");
+            mod.addCMacro("SEND_QUAL_ARG2", "const");
+            mod.addCMacro("SEND_TYPE_ARG1", "int");
+            mod.addCMacro("SEND_TYPE_ARG2", "void *");
+            mod.addCMacro("SEND_TYPE_ARG3", "size_t");
+            mod.addCMacro("SEND_TYPE_ARG4", "int");
+            mod.addCMacro("SEND_TYPE_RETV", "ssize_t");
+            mod.addCMacro("SIZEOF_CURL_OFF_T", "8");
+            mod.addCMacro("SIZEOF_INT", "4");
+            mod.addCMacro("SIZEOF_LONG", "8");
+            mod.addCMacro("SIZEOF_OFF_T", "8");
+            mod.addCMacro("SIZEOF_SHORT", "2");
+            mod.addCMacro("SIZEOF_SIZE_T", "8");
+            mod.addCMacro("SIZEOF_TIME_T", "8");
+            mod.addCMacro("STDC_HEADERS", "1");
+            mod.addCMacro("TIME_WITH_SYS_TIME", "1");
+            mod.addCMacro("USE_NGHTTP2", "1");
+            mod.addCMacro("USE_MBEDTLS", "1");
+            mod.addCMacro("USE_THREADS_POSIX", "1");
+            mod.addCMacro("USE_UNIX_SOCKETS", "1");
+        }
 
-    mod.addImport("build_config", opts.createModule());
+        try buildZlib(b, mod);
+        try buildMbedtls(b, mod);
+        try buildNghttp2(b, mod);
+        try buildCurl(b, mod);
+
+        switch (target.result.os.tag) {
+            .macos => {
+                // needed for proxying on mac
+                mod.addSystemFrameworkPath(.{ .cwd_relative = "/System/Library/Frameworks" });
+                mod.linkFramework("CoreFoundation", .{});
+                mod.linkFramework("SystemConfiguration", .{});
+            },
+            else => {},
+        }
+    }
 }
 
-fn moduleNetSurf(b: *std.Build, step: *std.Build.Step.Compile, target: std.Build.ResolvedTarget) !void {
+fn moduleNetSurf(b: *Build, step: *Build.Step.Compile, target: std.Build.ResolvedTarget) !void {
     const os = target.result.os.tag;
     const arch = target.result.cpu.arch;
 
@@ -250,3 +440,396 @@ fn moduleNetSurf(b: *std.Build, step: *std.Build.Step.Compile, target: std.Build
         step.addIncludePath(b.path(ns ++ "/" ++ lib ++ "/src"));
     }
 }
+
+fn buildZlib(b: *Build, m: *Build.Module) !void {
+    const zlib = b.addLibrary(.{
+        .name = "zlib",
+        .root_module = m,
+    });
+
+    const root = "vendor/zlib/";
+    zlib.installHeader(b.path(root ++ "zlib.h"), "zlib.h");
+    zlib.installHeader(b.path(root ++ "zconf.h"), "zconf.h");
+    zlib.addCSourceFiles(.{
+        .flags = &.{
+            "-DHAVE_SYS_TYPES_H",
+            "-DHAVE_STDINT_H",
+            "-DHAVE_STDDEF_H",
+        },
+        .files = &.{
+            root ++ "adler32.c",
+            root ++ "compress.c",
+            root ++ "crc32.c",
+            root ++ "deflate.c",
+            root ++ "gzclose.c",
+            root ++ "gzlib.c",
+            root ++ "gzread.c",
+            root ++ "gzwrite.c",
+            root ++ "inflate.c",
+            root ++ "infback.c",
+            root ++ "inftrees.c",
+            root ++ "inffast.c",
+            root ++ "trees.c",
+            root ++ "uncompr.c",
+            root ++ "zutil.c",
+        }
+    });
+}
+
+fn buildMbedtls(b: *Build, m: *Build.Module) !void {
+    const mbedtls = b.addLibrary(.{
+        .name = "mbedtls",
+        .root_module = m,
+    });
+
+    const root = "vendor/mbedtls/";
+    mbedtls.addIncludePath(b.path(root ++ "include"));
+    mbedtls.addIncludePath(b.path(root ++ "library"));
+
+    mbedtls.addCSourceFiles(.{
+        .flags = &.{
+        },
+        .files = &.{
+            root ++ "library/aes.c",
+            root ++ "library/aesni.c",
+            root ++ "library/aesce.c",
+            root ++ "library/aria.c",
+            root ++ "library/asn1parse.c",
+            root ++ "library/asn1write.c",
+            root ++ "library/base64.c",
+            root ++ "library/bignum.c",
+            root ++ "library/bignum_core.c",
+            root ++ "library/bignum_mod.c",
+            root ++ "library/bignum_mod_raw.c",
+            root ++ "library/camellia.c",
+            root ++ "library/ccm.c",
+            root ++ "library/chacha20.c",
+            root ++ "library/chachapoly.c",
+            root ++ "library/cipher.c",
+            root ++ "library/cipher_wrap.c",
+            root ++ "library/constant_time.c",
+            root ++ "library/cmac.c",
+            root ++ "library/ctr_drbg.c",
+            root ++ "library/des.c",
+            root ++ "library/dhm.c",
+            root ++ "library/ecdh.c",
+            root ++ "library/ecdsa.c",
+            root ++ "library/ecjpake.c",
+            root ++ "library/ecp.c",
+            root ++ "library/ecp_curves.c",
+            root ++ "library/entropy.c",
+            root ++ "library/entropy_poll.c",
+            root ++ "library/error.c",
+            root ++ "library/gcm.c",
+            root ++ "library/hkdf.c",
+            root ++ "library/hmac_drbg.c",
+            root ++ "library/lmots.c",
+            root ++ "library/lms.c",
+            root ++ "library/md.c",
+            root ++ "library/md5.c",
+            root ++ "library/memory_buffer_alloc.c",
+            root ++ "library/nist_kw.c",
+            root ++ "library/oid.c",
+            root ++ "library/padlock.c",
+            root ++ "library/pem.c",
+            root ++ "library/pk.c",
+            root ++ "library/pk_ecc.c",
+            root ++ "library/pk_wrap.c",
+            root ++ "library/pkcs12.c",
+            root ++ "library/pkcs5.c",
+            root ++ "library/pkparse.c",
+            root ++ "library/pkwrite.c",
+            root ++ "library/platform.c",
+            root ++ "library/platform_util.c",
+            root ++ "library/poly1305.c",
+            root ++ "library/psa_crypto.c",
+            root ++ "library/psa_crypto_aead.c",
+            root ++ "library/psa_crypto_cipher.c",
+            root ++ "library/psa_crypto_client.c",
+            root ++ "library/psa_crypto_ffdh.c",
+            root ++ "library/psa_crypto_driver_wrappers_no_static.c",
+            root ++ "library/psa_crypto_ecp.c",
+            root ++ "library/psa_crypto_hash.c",
+            root ++ "library/psa_crypto_mac.c",
+            root ++ "library/psa_crypto_pake.c",
+            root ++ "library/psa_crypto_rsa.c",
+            root ++ "library/psa_crypto_se.c",
+            root ++ "library/psa_crypto_slot_management.c",
+            root ++ "library/psa_crypto_storage.c",
+            root ++ "library/psa_its_file.c",
+            root ++ "library/psa_util.c",
+            root ++ "library/ripemd160.c",
+            root ++ "library/rsa.c",
+            root ++ "library/rsa_alt_helpers.c",
+            root ++ "library/sha1.c",
+            root ++ "library/sha3.c",
+            root ++ "library/sha256.c",
+            root ++ "library/sha512.c",
+            root ++ "library/threading.c",
+            root ++ "library/timing.c",
+            root ++ "library/version.c",
+            root ++ "library/version_features.c",
+            root ++ "library/pkcs7.c",
+            root ++ "library/x509.c",
+            root ++ "library/x509_create.c",
+            root ++ "library/x509_crl.c",
+            root ++ "library/x509_crt.c",
+            root ++ "library/x509_csr.c",
+            root ++ "library/x509write.c",
+            root ++ "library/x509write_crt.c",
+            root ++ "library/x509write_csr.c",
+            root ++ "library/debug.c",
+            root ++ "library/mps_reader.c",
+            root ++ "library/mps_trace.c",
+            root ++ "library/net_sockets.c",
+            root ++ "library/ssl_cache.c",
+            root ++ "library/ssl_ciphersuites.c",
+            root ++ "library/ssl_client.c",
+            root ++ "library/ssl_cookie.c",
+            root ++ "library/ssl_debug_helpers_generated.c",
+            root ++ "library/ssl_msg.c",
+            root ++ "library/ssl_ticket.c",
+            root ++ "library/ssl_tls.c",
+            root ++ "library/ssl_tls12_client.c",
+            root ++ "library/ssl_tls12_server.c",
+            root ++ "library/ssl_tls13_keys.c",
+            root ++ "library/ssl_tls13_server.c",
+            root ++ "library/ssl_tls13_client.c",
+            root ++ "library/ssl_tls13_generic.c",
+        }
+    });
+}
+
+fn buildNghttp2(b: *Build, m: *Build.Module) !void {
+    const nghttp2 = b.addLibrary(.{
+        .name = "nghttp2",
+        .root_module = m,
+    });
+
+    const nghttp2_version_file = b.addWriteFile(
+        "vendor/nghttp2/lib/includes/nghttp2/nghttp2ver.h",
+        \\ #ifndef NGHTTP2VER_H
+        \\ #define NGHTTP2VER_H
+        \\ #define NGHTTP2_VERSION "1.66"
+        \\ #define NGHTTP2_VERSION_NUM 0x014300
+        \\ #endif /* NGHTTP2VER_H */
+    );
+    nghttp2.step.dependOn(&nghttp2_version_file.step);
+
+    const root = "vendor/nghttp2/";
+    nghttp2.addIncludePath(b.path(root ++ "lib"));
+    nghttp2.addIncludePath(b.path(root ++ "lib/includes"));
+    nghttp2.addCSourceFiles(.{
+        .flags = &.{
+            "-DNGHTTP2_STATICLIB",
+            "-DHAVE_NETINET_IN",
+            "-DHAVE_TIME_H",
+        },
+        .files = &.{
+            root ++ "lib/sfparse.c",
+            root ++ "lib/nghttp2_alpn.c",
+            root ++ "lib/nghttp2_buf.c",
+            root ++ "lib/nghttp2_callbacks.c",
+            root ++ "lib/nghttp2_debug.c",
+            root ++ "lib/nghttp2_extpri.c",
+            root ++ "lib/nghttp2_frame.c",
+            root ++ "lib/nghttp2_hd.c",
+            root ++ "lib/nghttp2_hd_huffman.c",
+            root ++ "lib/nghttp2_hd_huffman_data.c",
+            root ++ "lib/nghttp2_helper.c",
+            root ++ "lib/nghttp2_http.c",
+            root ++ "lib/nghttp2_map.c",
+            root ++ "lib/nghttp2_mem.c",
+            root ++ "lib/nghttp2_option.c",
+            root ++ "lib/nghttp2_outbound_item.c",
+            root ++ "lib/nghttp2_pq.c",
+            root ++ "lib/nghttp2_priority_spec.c",
+            root ++ "lib/nghttp2_queue.c",
+            root ++ "lib/nghttp2_rcbuf.c",
+            root ++ "lib/nghttp2_session.c",
+            root ++ "lib/nghttp2_stream.c",
+            root ++ "lib/nghttp2_submit.c",
+            root ++ "lib/nghttp2_version.c",
+            root ++ "lib/nghttp2_ratelim.c",
+            root ++ "lib/nghttp2_time.c",
+        }
+    });
+}
+
+fn buildCurl(b: *Build, m: *Build.Module) !void {
+    const curl = b.addLibrary(.{
+        .name = "curl",
+        .root_module = m,
+    });
+
+    const root = "vendor/curl/";
+
+    curl.addIncludePath(b.path(root ++ "lib"));
+    curl.addIncludePath(b.path(root ++ "include"));
+    curl.addCSourceFiles(.{
+        .flags = &.{
+        },
+        .files = &.{
+            root ++ "lib/altsvc.c",
+            root ++ "lib/amigaos.c",
+            root ++ "lib/asyn-ares.c",
+            root ++ "lib/asyn-base.c",
+            root ++ "lib/asyn-thrdd.c",
+            root ++ "lib/bufq.c",
+            root ++ "lib/bufref.c",
+            root ++ "lib/cf-h1-proxy.c",
+            root ++ "lib/cf-h2-proxy.c",
+            root ++ "lib/cf-haproxy.c",
+            root ++ "lib/cf-https-connect.c",
+            root ++ "lib/cf-socket.c",
+            root ++ "lib/cfilters.c",
+            root ++ "lib/conncache.c",
+            root ++ "lib/connect.c",
+            root ++ "lib/content_encoding.c",
+            root ++ "lib/cookie.c",
+            root ++ "lib/cshutdn.c",
+            root ++ "lib/curl_addrinfo.c",
+            root ++ "lib/curl_des.c",
+            root ++ "lib/curl_endian.c",
+            root ++ "lib/curl_fnmatch.c",
+            root ++ "lib/curl_get_line.c",
+            root ++ "lib/curl_gethostname.c",
+            root ++ "lib/curl_gssapi.c",
+            root ++ "lib/curl_memrchr.c",
+            root ++ "lib/curl_ntlm_core.c",
+            root ++ "lib/curl_range.c",
+            root ++ "lib/curl_rtmp.c",
+            root ++ "lib/curl_sasl.c",
+            root ++ "lib/curl_sha512_256.c",
+            root ++ "lib/curl_sspi.c",
+            root ++ "lib/curl_threads.c",
+            root ++ "lib/curl_trc.c",
+            root ++ "lib/cw-out.c",
+            root ++ "lib/cw-pause.c",
+            root ++ "lib/dict.c",
+            root ++ "lib/doh.c",
+            root ++ "lib/dynhds.c",
+            root ++ "lib/easy.c",
+            root ++ "lib/easygetopt.c",
+            root ++ "lib/easyoptions.c",
+            root ++ "lib/escape.c",
+            root ++ "lib/fake_addrinfo.c",
+            root ++ "lib/file.c",
+            root ++ "lib/fileinfo.c",
+            root ++ "lib/fopen.c",
+            root ++ "lib/formdata.c",
+            root ++ "lib/ftp.c",
+            root ++ "lib/ftplistparser.c",
+            root ++ "lib/getenv.c",
+            root ++ "lib/getinfo.c",
+            root ++ "lib/gopher.c",
+            root ++ "lib/hash.c",
+            root ++ "lib/headers.c",
+            root ++ "lib/hmac.c",
+            root ++ "lib/hostip.c",
+            root ++ "lib/hostip4.c",
+            root ++ "lib/hostip6.c",
+            root ++ "lib/hsts.c",
+            root ++ "lib/http.c",
+            root ++ "lib/http1.c",
+            root ++ "lib/http2.c",
+            root ++ "lib/http_aws_sigv4.c",
+            root ++ "lib/http_chunks.c",
+            root ++ "lib/http_digest.c",
+            root ++ "lib/http_negotiate.c",
+            root ++ "lib/http_ntlm.c",
+            root ++ "lib/http_proxy.c",
+            root ++ "lib/httpsrr.c",
+            root ++ "lib/idn.c",
+            root ++ "lib/if2ip.c",
+            root ++ "lib/imap.c",
+            root ++ "lib/krb5.c",
+            root ++ "lib/ldap.c",
+            root ++ "lib/llist.c",
+            root ++ "lib/macos.c",
+            root ++ "lib/md4.c",
+            root ++ "lib/md5.c",
+            root ++ "lib/memdebug.c",
+            root ++ "lib/mime.c",
+            root ++ "lib/mprintf.c",
+            root ++ "lib/mqtt.c",
+            root ++ "lib/multi.c",
+            root ++ "lib/multi_ev.c",
+            root ++ "lib/netrc.c",
+            root ++ "lib/noproxy.c",
+            root ++ "lib/openldap.c",
+            root ++ "lib/parsedate.c",
+            root ++ "lib/pingpong.c",
+            root ++ "lib/pop3.c",
+            root ++ "lib/progress.c",
+            root ++ "lib/psl.c",
+            root ++ "lib/rand.c",
+            root ++ "lib/rename.c",
+            root ++ "lib/request.c",
+            root ++ "lib/rtsp.c",
+            root ++ "lib/select.c",
+            root ++ "lib/sendf.c",
+            root ++ "lib/setopt.c",
+            root ++ "lib/sha256.c",
+            root ++ "lib/share.c",
+            root ++ "lib/slist.c",
+            root ++ "lib/smb.c",
+            root ++ "lib/smtp.c",
+            root ++ "lib/socketpair.c",
+            root ++ "lib/socks.c",
+            root ++ "lib/socks_gssapi.c",
+            root ++ "lib/socks_sspi.c",
+            root ++ "lib/speedcheck.c",
+            root ++ "lib/splay.c",
+            root ++ "lib/strcase.c",
+            root ++ "lib/strdup.c",
+            root ++ "lib/strequal.c",
+            root ++ "lib/strerror.c",
+            root ++ "lib/system_win32.c",
+            root ++ "lib/telnet.c",
+            root ++ "lib/tftp.c",
+            root ++ "lib/transfer.c",
+            root ++ "lib/uint-bset.c",
+            root ++ "lib/uint-hash.c",
+            root ++ "lib/uint-spbset.c",
+            root ++ "lib/uint-table.c",
+            root ++ "lib/url.c",
+            root ++ "lib/urlapi.c",
+            root ++ "lib/version.c",
+            root ++ "lib/ws.c",
+            root ++ "lib/curlx/base64.c",
+            root ++ "lib/curlx/dynbuf.c",
+            root ++ "lib/curlx/inet_ntop.c",
+            root ++ "lib/curlx/nonblock.c",
+            root ++ "lib/curlx/strparse.c",
+            root ++ "lib/curlx/timediff.c",
+            root ++ "lib/curlx/timeval.c",
+            root ++ "lib/curlx/wait.c",
+            root ++ "lib/curlx/warnless.c",
+            root ++ "lib/vquic/curl_ngtcp2.c",
+            root ++ "lib/vquic/curl_osslq.c",
+            root ++ "lib/vquic/curl_quiche.c",
+            root ++ "lib/vquic/vquic.c",
+            root ++ "lib/vquic/vquic-tls.c",
+            root ++ "lib/vauth/cleartext.c",
+            root ++ "lib/vauth/cram.c",
+            root ++ "lib/vauth/digest.c",
+            root ++ "lib/vauth/digest_sspi.c",
+            root ++ "lib/vauth/gsasl.c",
+            root ++ "lib/vauth/krb5_gssapi.c",
+            root ++ "lib/vauth/krb5_sspi.c",
+            root ++ "lib/vauth/ntlm.c",
+            root ++ "lib/vauth/ntlm_sspi.c",
+            root ++ "lib/vauth/oauth2.c",
+            root ++ "lib/vauth/spnego_gssapi.c",
+            root ++ "lib/vauth/spnego_sspi.c",
+            root ++ "lib/vauth/vauth.c",
+            root ++ "lib/vtls/cipher_suite.c",
+            root ++ "lib/vtls/mbedtls.c",
+            root ++ "lib/vtls/mbedtls_threadlock.c",
+            root ++ "lib/vtls/vtls.c",
+            root ++ "lib/vtls/vtls_scache.c",
+            root ++ "lib/vtls/x509asn1.c",
+        },
+    });
+}
diff --git a/build.zig.zon b/build.zig.zon
index b51e82da..6a45c2d8 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -4,10 +4,6 @@
     .version = "0.0.0",
     .fingerprint = 0xda130f3af836cea0,
     .dependencies = .{
-        .tls = .{
-            .url = "https://github.com/ianic/tls.zig/archive/55845f755d9e2e821458ea55693f85c737cd0c7a.tar.gz",
-            .hash = "tls-0.1.0-ER2e0m43BQAshi8ixj1qf3w2u2lqKtXtkrxUJ4AGZDcl",
-        },
         .tigerbeetle_io = .{
             .url = "https://github.com/lightpanda-io/tigerbeetle-io/archive/61d9652f1a957b7f4db723ea6aa0ce9635e840ce.tar.gz",
             .hash = "tigerbeetle_io-0.0.0-ViLgxpyRBAB5BMfIcj3KMXfbJzwARs9uSl8aRy2OXULd",
diff --git a/src/app.zig b/src/app.zig
index ad66f73a..80954855 100644
--- a/src/app.zig
+++ b/src/app.zig
@@ -1,10 +1,11 @@
 const std = @import("std");
+
 const Allocator = std.mem.Allocator;
 
 const log = @import("log.zig");
 const Loop = @import("runtime/loop.zig").Loop;
-const http = @import("http/client.zig");
 const Platform = @import("runtime/js.zig").Platform;
+const http = @import("http/client.zig");
 
 const Telemetry = @import("telemetry/telemetry.zig").Telemetry;
 const Notification = @import("notification.zig").Notification;
@@ -17,7 +18,7 @@ pub const App = struct {
     platform: ?*const Platform,
     allocator: Allocator,
     telemetry: Telemetry,
-    http_client: http.Client,
+    http_client: *http.Client,
     app_dir_path: ?[]const u8,
     notification: *Notification,
 
@@ -59,12 +60,8 @@ pub const App = struct {
             .platform = config.platform,
             .app_dir_path = app_dir_path,
             .notification = notification,
-            .http_client = try http.Client.init(allocator, loop, .{
-                .max_concurrent = 3,
-                .http_proxy = config.http_proxy,
-                .proxy_type = config.proxy_type,
-                .proxy_auth = config.proxy_auth,
-                .tls_verify_host = config.tls_verify_host,
+            .http_client = try http.Client.init(allocator, .{
+                .max_concurrent_transfers = 3,
             }),
             .config = config,
         };
diff --git a/src/browser/ScriptManager.zig b/src/browser/ScriptManager.zig
new file mode 100644
index 00000000..895fe065
--- /dev/null
+++ b/src/browser/ScriptManager.zig
@@ -0,0 +1,543 @@
+// Copyright (C) 2023-2025  Lightpanda (Selecy SAS)
+//
+// Francis Bouvier <francis@lightpanda.io>
+// Pierre Tachoire <pierre@lightpanda.io>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+const std = @import("std");
+
+
+const log = @import("../log.zig");
+const parser = @import("netsurf.zig");
+const http = @import("../http/client.zig");
+
+const App = @import("../app.zig").App;
+const Env = @import("env.zig").Env;
+const Page = @import("page.zig").Page;
+const URL = @import("../url.zig").URL;
+
+const Allocator = std.mem.Allocator;
+const ArrayListUnmanaged = std.ArrayListUnmanaged;
+
+const ScriptManager = @This();
+
+page: *Page,
+
+// Only once this is true can deferred scripts be run
+static_scripts_done: bool,
+
+// Normal scripts (non-deffered & non-async). These must be executed ni order
+scripts: OrderList,
+
+// List of deferred scripts. These must be executed in order, but only once
+// dom_loaded == true,
+deferred: OrderList,
+
+client: *http.Client,
+allocator: Allocator,
+buffer_pool: BufferPool,
+script_pool: std.heap.MemoryPool(PendingScript),
+
+const OrderList = std.DoublyLinkedList(*PendingScript);
+
+pub fn init(app: *App, page: *Page) ScriptManager {
+    const allocator = app.allocator;
+    return .{
+        .page = page,
+        .scripts = .{},
+        .deferred = .{},
+        .allocator = allocator,
+        .client = app.http_client,
+        .static_scripts_done = false,
+        .buffer_pool = BufferPool.init(allocator, 5),
+        .script_pool = std.heap.MemoryPool(PendingScript).init(allocator),
+    };
+}
+
+pub fn deinit(self: *ScriptManager) void {
+    self.buffer_pool.deinit();
+    self.script_pool.deinit();
+}
+
+pub fn addFromElement(self: *ScriptManager, element: *parser.Element) !void {
+    if (try parser.elementGetAttribute(element, "nomodule") != null) {
+        // these scripts should only be loaded if we don't support modules
+        // but since we do support modules, we can just skip them.
+        return;
+    }
+
+    // If a script tag gets dynamically created and added to the dom:
+    //    document.getElementsByTagName('head')[0].appendChild(script)
+    // that script tag will immediately get executed by our scriptAddedCallback.
+    // However, if the location where the script tag is inserted happens to be
+    // below where processHTMLDoc curently is, then we'll re-run that same script
+    // again in processHTMLDoc. This flag is used to let us know if a specific
+    // <script> has already been processed.
+    if (try parser.scriptGetProcessed(@ptrCast(element))) {
+        return;
+    }
+    try parser.scriptSetProcessed(@ptrCast(element), true);
+
+    const kind: Script.Kind = blk: {
+        const script_type = try parser.elementGetAttribute(element, "type") orelse break :blk .javascript;
+        if (script_type.len == 0) {
+            break :blk .javascript;
+        }
+        if (std.ascii.eqlIgnoreCase(script_type, "application/javascript")) {
+            break :blk .javascript;
+        }
+        if (std.ascii.eqlIgnoreCase(script_type, "text/javascript")) {
+            break :blk .javascript;
+        }
+        if (std.ascii.eqlIgnoreCase(script_type, "module")) {
+            break :blk .module;
+        }
+        log.warn(.user_script, "unknown script type", .{ .type = script_type });
+        return;
+    };
+
+    var onload: ?Script.Callback = null;
+    var onerror: ?Script.Callback = null;
+
+    const page = self.page;
+    if (page.getNodeState(@ptrCast(element))) |se| {
+        // if the script has a node state, then it was dynamically added and thus
+        // the onload/onerror were saved in the state (if there are any)
+        if (se.onload) |function| {
+            onload = .{ .function = function };
+        }
+        if (se.onerror) |function| {
+            onerror = .{ .function = function };
+        }
+    } else {
+        // if the script has no node state, then it could still be dynamically
+        // added (could have been dynamically added, but no attributes were set
+        // which required a node state to be created) or it could be a inline
+        // <script>.
+        if (try parser.elementGetAttribute(element, "onload")) |string| {
+            onload = .{ .string = string };
+        }
+        if (try parser.elementGetAttribute(element, "onerror")) |string| {
+            onerror = .{ .string = string };
+        }
+    }
+
+    var source: Script.Source = undefined;
+    var remote_url: ?[:0]const u8 = null;
+    if (try parser.elementGetAttribute(element, "src")) |src| {
+        remote_url = try URL.stitch(page.arena, src, page.url.raw, .{ .null_terminated = true });
+        source = .{ .remote = .{} };
+    } else {
+        const inline_source = try parser.nodeTextContent(@ptrCast(element)) orelse return;
+        source = .{ .@"inline" = inline_source };
+    }
+
+    var script = Script{
+        .kind = kind,
+        .onload = onload,
+        .onerror = onerror,
+        .element = element,
+        .source = source,
+        .url = remote_url orelse page.url.raw,
+        .is_defer = try parser.elementGetAttribute(element, "defer") != null,
+        .is_async = try parser.elementGetAttribute(element, "async") != null,
+    };
+
+    if (source == .@"inline" and self.scripts.first == null) {
+        // inline script with no pending scripts, execute it immediately.
+        return script.eval(page);
+    }
+
+    const pending_script = try self.script_pool.create();
+    errdefer self.script_pool.destroy(pending_script);
+    pending_script.* = .{
+        .script = script,
+        .complete = false,
+        .manager = self,
+        .node = undefined,
+    };
+
+    if (source == .@"inline") {
+        // if we're here, it means that we have pending scripts (i.e. self.ordered
+        // is not empty). Because the script is inline, it's complete/ready, but
+        // we need to process them in order
+        pending_script.complete = true;
+        self.scripts.append(&pending_script.node);
+        return;
+    }
+
+    try self.client.request(.{
+        .url = remote_url.?,
+        .ctx = pending_script,
+        .method = .GET,
+        .start_callback = startCallback,
+        .header_callback = headerCallback,
+        .data_callback = dataCallback,
+        .done_callback = doneCallback,
+        .error_callback = errorCallback,
+    });
+}
+
+pub fn staticScriptsDone(self: *ScriptManager) void {
+    std.debug.assert(self.static_scripts_done == false);
+    self.static_scripts_done = true;
+}
+
+// try to evaluate completed scripts (in order). This is called whenever a script
+// is completed.
+fn evaluate(self: *ScriptManager) void {
+    const page = self.page;
+
+    while (self.scripts.first) |n| {
+        var pending_script = n.data;
+        if (pending_script.complete == false) {
+            return;
+        }
+        defer pending_script.deinit();
+        pending_script.script.eval(page);
+    }
+
+    if (self.static_scripts_done == false) {
+        // We can only execute deferred scripts if
+        // 1 - all the normal scripts are done
+        // 2 - and we've loaded all the normal scripts
+        // The last one isn't obvious, but it's possible for self.scripts to/
+        // be empty not because we're done executing all the normal scripts
+        // but because we're done executing some (or maybe none), but we're still
+        // parsing the HTML.
+        return;
+    }
+
+    while (self.deferred.first) |n| {
+        var pending_script = n.data;
+        if (pending_script.complete == false) {
+            return;
+        }
+        defer pending_script.deinit();
+        pending_script.script.eval(page);
+    }
+
+    page.documentIsLoaded();
+}
+
+fn getList(self: *ScriptManager, script: *const Script) ?*OrderList {
+    if (script.is_defer) {
+        return &self.deferred;
+    }
+
+    if (script.is_async) {
+        // async don't need to execute in order.
+        return null;
+    }
+
+    return &self.scripts;
+}
+
+fn startCallback(transfer: *http.Transfer) !void {
+    const script: *PendingScript = @alignCast(@ptrCast(transfer.ctx));
+    script.startCallback(transfer) catch |err| {
+        log.err(.http, "SM.startCallback", .{ .err = err, .transfer = transfer });
+        return err;
+    };
+}
+
+fn headerCallback(transfer: *http.Transfer) !void {
+    const script: *PendingScript = @alignCast(@ptrCast(transfer.ctx));
+    script.headerCallback(transfer) catch |err| {
+        log.err(.http, "SM.headerCallback", .{ .err = err, .transfer = transfer });
+        return err;
+    };
+}
+
+fn dataCallback(transfer: *http.Transfer, data: []const u8) !void {
+    const script: *PendingScript = @alignCast(@ptrCast(transfer.ctx));
+    script.dataCallback(data) catch |err| {
+        log.err(.http, "SM.dataCallback", .{ .err = err, .transfer = transfer, .len = data.len });
+        return err;
+    };
+}
+
+fn doneCallback(transfer: *http.Transfer) !void {
+    const script: *PendingScript = @alignCast(@ptrCast(transfer.ctx));
+    script.doneCallback(transfer);
+}
+
+fn errorCallback(transfer: *http.Transfer, err: anyerror) void {
+    const script: *PendingScript = @alignCast(@ptrCast(transfer.ctx));
+    script.errorCallback(transfer, err);
+}
+
+// A script which is pending execution.
+// It could be pending because:
+//   (a) we're still downloading its content or
+//   (b) this is a non-async script that has to be executed in order
+const PendingScript = struct {
+    script: Script,
+    complete: bool,
+    node: OrderList.Node,
+    manager: *ScriptManager,
+
+    fn deinit(self: *PendingScript) void {
+        var manager = self.manager;
+        if (self.script.source == .remote) {
+            manager.buffer_pool.release(self.script.source.remote);
+        }
+        if (manager.getList(&self.script)) |list| {
+            list.remove(&self.node);
+        }
+    }
+
+    fn startCallback(self: *PendingScript, transfer: *http.Transfer) !void {
+        if (self.manager.getList(&self.script)) |list| {
+            self.node.data = self;
+            list.append(&self.node);
+        }
+
+        // if the script is async, it isn't tracked in a list, because we can
+        // execute it as soon as it's done loading.
+        log.debug(.http, "script fetch start", .{ .req = transfer });
+    }
+
+    fn headerCallback(self: *PendingScript, transfer: *http.Transfer) !void {
+        const header = &transfer.response_header.?;
+        if (header.status != 200) {
+            return error.InvalidStatusCode;
+        }
+
+        // @newhttp TODO: pre size based on content-length
+        // @newhttp TODO: max-length enfocement
+        self.script.source = .{ .remote = self.manager.buffer_pool.get() };
+
+        log.debug(.http, "script header", .{
+            .req = transfer,
+            .status = header.status,
+            .content_type = header.contentType(),
+        });
+    }
+
+    fn dataCallback(self: *PendingScript, data: []const u8) !void {
+        // @newhttp TODO: max-length enforcement
+        try self.script.source.remote.appendSlice(self.manager.allocator, data);
+    }
+
+    fn doneCallback(self: *PendingScript, transfer: *http.Transfer) void {
+        log.debug(.http, "script fetch complete", .{ .req = transfer });
+        if (self.script.is_async) {
+            // async script can be evaluated immediately
+            defer self.deinit();
+            self.script.eval(self.manager.page);
+        } else {
+            self.complete = true;
+            self.manager.evaluate();
+        }
+    }
+
+    fn errorCallback(self: *PendingScript, transfer: *http.Transfer, err: anyerror) void {
+        log.warn(.http, "script fetch error", .{ .req = transfer, .err = err });
+        self.deinit();
+    }
+};
+
+const Script = struct {
+    kind: Kind,
+    url: []const u8,
+    is_async: bool,
+    is_defer: bool,
+    source: Source,
+    onload: ?Callback,
+    onerror: ?Callback,
+    element: *parser.Element,
+
+    const Kind = enum {
+        module,
+        javascript,
+    };
+
+    const Callback = union(enum) {
+        string: []const u8,
+        function: Env.Function,
+    };
+
+    const Source = union(enum) {
+        @"inline": []const u8,
+        remote: std.ArrayListUnmanaged(u8),
+
+        fn content(self: Source) []const u8 {
+            return switch (self) {
+                .remote => |buf| buf.items,
+                .@"inline" => |c| c,
+            };
+        }
+    };
+
+    fn eval(self: *Script, page: *Page) void {
+
+        // inline scripts aren't cached. remote ones are.
+        const cacheable = self.source == .remote;
+
+        const url = self.url;
+
+        log.debug(.browser, "executing script", .{
+            .src = url,
+            .kind = self.kind,
+            .cacheable = cacheable,
+        });
+
+        const js_context = page.main_context;
+        var try_catch: Env.TryCatch = undefined;
+        try_catch.init(js_context);
+        defer try_catch.deinit();
+
+        const success = blk: {
+            const content = self.source.content();
+            switch (self.kind) {
+                .javascript => _ = js_context.eval(content, url) catch break :blk false,
+                .module => {
+                    // We don't care about waiting for the evaluation here.
+                    _ = js_context.module(content, url, cacheable) catch break :blk false;
+                },
+            }
+            break :blk true;
+        };
+
+        if (success) {
+            self.executeCallback("onload", page);
+            return;
+        }
+
+        if (page.delayed_navigation) {
+            // If we're navigating to another page, an error is expected
+            // since we probably terminated the script forcefully.
+            return;
+        }
+
+        const msg = try_catch.err(page.arena) catch |err| @errorName(err) orelse "unknown";
+        log.warn(.user_script, "eval script", .{
+            .url = url,
+            .err = msg,
+            .cacheable = cacheable,
+        });
+
+        self.executeCallback("onerror", page);
+    }
+
+    fn executeCallback(self: *const Script, comptime typ: []const u8, page: *Page) void {
+        const callback = @field(self, typ) orelse return;
+
+        switch (callback) {
+            .string => |str| {
+                var try_catch: Env.TryCatch = undefined;
+                try_catch.init(page.main_context);
+                defer try_catch.deinit();
+
+                _ = page.main_context.exec(str, typ) catch |err| {
+                    const msg = try_catch.err(page.arena) catch @errorName(err) orelse "unknown";
+                    log.warn(.user_script, "script callback", .{
+                        .url = self.url,
+                        .err = msg,
+                        .type = typ,
+                        .@"inline" = true,
+                    });
+                };
+            },
+            .function => |f| {
+                const Event = @import("events/event.zig").Event;
+                const loadevt = parser.eventCreate() catch |err| {
+                    log.err(.browser, "SM event creation", .{ .err = err });
+                    return;
+                };
+                defer parser.eventDestroy(loadevt);
+
+                var result: Env.Function.Result = undefined;
+                const iface = Event.toInterface(loadevt) catch |err| {
+                    log.err(.browser, "SM event interface", .{ .err = err });
+                    return;
+                };
+                f.tryCall(void, .{iface}, &result) catch {
+                    log.warn(.user_script, "script callback", .{
+                        .url = self.url,
+                        .type = typ,
+                        .err = result.exception,
+                        .stack = result.stack,
+                        .@"inline" = false,
+                    });
+                };
+            },
+        }
+    }
+};
+
+const BufferPool = struct {
+    free: List = .{},
+    available: usize,
+    allocator: Allocator,
+    max_concurrent_transfers: u8,
+    node_pool: std.heap.MemoryPool(List.Node),
+
+    const List = std.DoublyLinkedList(std.ArrayListUnmanaged(u8));
+
+    fn init(allocator: Allocator, max_concurrent_transfers: u8) BufferPool {
+        return .{
+            .free = .{},
+            .available = 0,
+            .allocator = allocator,
+            .max_concurrent_transfers = max_concurrent_transfers,
+            .node_pool = std.heap.MemoryPool(List.Node).init(allocator),
+        };
+    }
+
+    fn deinit(self: *BufferPool) void {
+        const allocator = self.allocator;
+
+        var node = self.free.first;
+        while (node) |n| {
+            node = n.next;
+            n.data.deinit(allocator);
+        }
+        self.node_pool.deinit();
+    }
+
+    fn get(self: *BufferPool) ArrayListUnmanaged(u8) {
+        const node = self.free.popFirst() orelse {
+            // return a new buffer
+            return .{};
+        };
+
+        defer self.node_pool.destroy(node);
+        return node.data;
+    }
+
+    fn release(self: *BufferPool, buffer: ArrayListUnmanaged(u8)) void {
+        // @newhttp TODO: discard buffers that are larger than some configured max?
+
+        // create mutable copy
+        var b = buffer;
+
+        if (self.available == self.max_concurrent_transfers) {
+            b.deinit(self.allocator);
+        }
+
+        const node = self.node_pool.create() catch |err| {
+            b.deinit(self.allocator);
+            log.err(.http, "SM BufferPool release", .{ .err = err });
+            return;
+        };
+
+        b.clearRetainingCapacity();
+        node.data = b;
+        self.available += 1;
+        self.free.append(node);
+    }
+};
diff --git a/src/browser/browser.zig b/src/browser/browser.zig
index 23f2bdd6..6d51a9aa 100644
--- a/src/browser/browser.zig
+++ b/src/browser/browser.zig
@@ -28,7 +28,6 @@ const Session = @import("session.zig").Session;
 const Notification = @import("../notification.zig").Notification;
 
 const log = @import("../log.zig");
-
 const http = @import("../http/client.zig");
 
 // Browser is an instance of the browser.
@@ -61,7 +60,7 @@ pub const Browser = struct {
             .session = null,
             .allocator = allocator,
             .notification = notification,
-            .http_client = &app.http_client,
+            .http_client = app.http_client,
             .page_arena = ArenaAllocator.init(allocator),
             .session_arena = ArenaAllocator.init(allocator),
             .transfer_arena = ArenaAllocator.init(allocator),
diff --git a/src/browser/mime.zig b/src/browser/mime.zig
index 693006ab..ac9ce2e1 100644
--- a/src/browser/mime.zig
+++ b/src/browser/mime.zig
@@ -22,11 +22,11 @@ const Allocator = std.mem.Allocator;
 pub const Mime = struct {
     content_type: ContentType,
     params: []const u8 = "",
-    charset: ?[]const u8 = null,
+    charset: ?[:0]const u8 = null,
 
     pub const unknown = Mime{
         .params = "",
-        .charset = "",
+        .charset = null,
         .content_type = .{ .unknown = {} },
     };
 
@@ -52,7 +52,7 @@ pub const Mime = struct {
         other: struct { type: []const u8, sub_type: []const u8 },
     };
 
-    pub fn parse(arena: Allocator, input: []u8) !Mime {
+    pub fn parse(input: []u8) !Mime {
         if (input.len > 255) {
             return error.TooBig;
         }
@@ -69,7 +69,7 @@ pub const Mime = struct {
 
         const params = trimLeft(normalized[type_len..]);
 
-        var charset: ?[]const u8 = null;
+        var charset: ?[:0]const u8 = null;
 
         var it = std.mem.splitScalar(u8, params, ';');
         while (it.next()) |attr| {
@@ -86,7 +86,24 @@ pub const Mime = struct {
             }, name) orelse continue;
 
             switch (attribute_name) {
-                .charset => charset = try parseAttributeValue(arena, value),
+                .charset => {
+                    // We used to have a proper value parser, but we currently
+                    // only care about the charset attribute, plus only about
+                    // the UTF-8 value. It's a lot easier to do it this way,
+                    // and it doesn't require an allocation to (a) unescape the
+                    // value or (b) ensure the correct lifetime.
+                    if (value.len == 0) {
+                        break;
+                    }
+                    var attribute_value = value;
+                    if (value[0] == '"' and value[value.len - 1] == '"') {
+                        attribute_value = value[1 .. value.len - 1];
+                    }
+
+                    if (std.ascii.eqlIgnoreCase(attribute_value, "utf-8")) {
+                        charset = "UTF-8";
+                    }
+                },
             }
         }
 
@@ -224,58 +241,6 @@ pub const Mime = struct {
         break :blk v;
     };
 
-    fn parseAttributeValue(arena: Allocator, value: []const u8) ![]const u8 {
-        if (value[0] != '"') {
-            // almost certainly referenced from an http.Request which has its
-            // own lifetime.
-            return arena.dupe(u8, value);
-        }
-
-        // 1 to skip the opening quote
-        var value_pos: usize = 1;
-        var unescaped_len: usize = 0;
-        const last = value.len - 1;
-
-        while (value_pos < value.len) {
-            switch (value[value_pos]) {
-                '"' => break,
-                '\\' => {
-                    if (value_pos == last) {
-                        return error.Invalid;
-                    }
-                    const next = value[value_pos + 1];
-                    if (T_SPECIAL[next] == false) {
-                        return error.Invalid;
-                    }
-                    value_pos += 2;
-                },
-                else => value_pos += 1,
-            }
-            unescaped_len += 1;
-        }
-
-        if (unescaped_len == 0) {
-            return error.Invalid;
-        }
-
-        value_pos = 1;
-        const owned = try arena.alloc(u8, unescaped_len);
-        for (0..unescaped_len) |i| {
-            switch (value[value_pos]) {
-                '"' => break,
-                '\\' => {
-                    owned[i] = value[value_pos + 1];
-                    value_pos += 2;
-                },
-                else => |c| {
-                    owned[i] = c;
-                    value_pos += 1;
-                },
-            }
-        }
-        return owned;
-    }
-
     const VALID_CODEPOINTS = blk: {
         var v: [256]bool = undefined;
         for (0..256) |i| {
@@ -329,7 +294,7 @@ test "Mime: invalid " {
 
     for (invalids) |invalid| {
         const mutable_input = try testing.arena_allocator.dupe(u8, invalid);
-        try testing.expectError(error.Invalid, Mime.parse(undefined, mutable_input));
+        try testing.expectError(error.Invalid, Mime.parse(mutable_input));
     }
 }
 
@@ -409,7 +374,7 @@ test "Mime: isHTML" {
     const isHTML = struct {
         fn isHTML(expected: bool, input: []const u8) !void {
             const mutable_input = try testing.arena_allocator.dupe(u8, input);
-            var mime = try Mime.parse(testing.arena_allocator, mutable_input);
+            var mime = try Mime.parse(mutable_input);
             try testing.expectEqual(expected, mime.isHTML());
         }
     }.isHTML;
@@ -495,7 +460,7 @@ const Expectation = struct {
 fn expect(expected: Expectation, input: []const u8) !void {
     const mutable_input = try testing.arena_allocator.dupe(u8, input);
 
-    const actual = try Mime.parse(testing.arena_allocator, mutable_input);
+    const actual = try Mime.parse(mutable_input);
     try testing.expectEqual(
         std.meta.activeTag(expected.content_type),
         std.meta.activeTag(actual.content_type),
diff --git a/src/browser/netsurf.zig b/src/browser/netsurf.zig
index 068df34d..1cdbec07 100644
--- a/src/browser/netsurf.zig
+++ b/src/browser/netsurf.zig
@@ -2362,6 +2362,31 @@ fn parserErr(err: HubbubErr) ParserError!void {
     };
 }
 
+pub const Parser = struct {
+    html_doc: *DocumentHTML,
+    parser: *c.dom_hubbub_parser,
+
+    pub fn init(encoding: ?[:0]const u8) !Parser {
+        var params = parseParams(encoding);
+        var doc: ?*c.dom_document = undefined;
+        var parser: ?*c.dom_hubbub_parser = undefined;
+
+        try parserErr(c.dom_hubbub_parser_create(&params, &parser, &doc));
+        return .{
+            .parser = parser.?,
+            .html_doc = @ptrCast(doc.?),
+        };
+    }
+
+    pub fn deinit(self: *Parser) void {
+        c.dom_hubbub_parser_destroy(self.parser);
+    }
+
+    pub fn process(self: *Parser, data: []const u8) !void {
+        try parserErr(c.dom_hubbub_parser_parse_chunk(self.parser, data.ptr, data.len));
+    }
+};
+
 // documentHTMLParseFromStr parses the given HTML string.
 // The caller is responsible for closing the document.
 pub fn documentHTMLParseFromStr(str: []const u8) !*DocumentHTML {
@@ -2370,18 +2395,10 @@ pub fn documentHTMLParseFromStr(str: []const u8) !*DocumentHTML {
 }
 
 pub fn documentHTMLParse(reader: anytype, enc: ?[:0]const u8) !*DocumentHTML {
-    var parser: ?*c.dom_hubbub_parser = undefined;
-    var doc: ?*c.dom_document = undefined;
-    var err: c.hubbub_error = undefined;
-    var params = parseParams(enc);
-
-    err = c.dom_hubbub_parser_create(&params, &parser, &doc);
-    try parserErr(err);
-    defer c.dom_hubbub_parser_destroy(parser);
-
-    try parseData(parser.?, reader);
-
-    return @as(*DocumentHTML, @ptrCast(doc.?));
+    var parser = try Parser.init(enc);
+    defer parser.deinit();
+    try parseData(parser.parser, reader);
+    return parser.html_doc;
 }
 
 pub fn documentParseFragmentFromStr(self: *Document, str: []const u8) !*DocumentFragment {
diff --git a/src/browser/page.zig b/src/browser/page.zig
index de78f63a..fd4eae1d 100644
--- a/src/browser/page.zig
+++ b/src/browser/page.zig
@@ -31,8 +31,8 @@ const Renderer = @import("renderer.zig").Renderer;
 const Window = @import("html/window.zig").Window;
 const Walker = @import("dom/walker.zig").WalkerDepthFirst;
 const Loop = @import("../runtime/loop.zig").Loop;
+const ScriptManager = @import("ScriptManager.zig");
 const HTMLDocument = @import("html/document.zig").HTMLDocument;
-const RequestFactory = @import("../http/client.zig").RequestFactory;
 
 const URL = @import("../url.zig").URL;
 
@@ -55,7 +55,8 @@ pub const Page = struct {
     cookie_jar: *storage.CookieJar,
 
     // Pre-configured http/cilent.zig used to make HTTP requests.
-    request_factory: RequestFactory,
+    // @newhttp
+    // request_factory: RequestFactory,
 
     session: *Session,
 
@@ -66,16 +67,12 @@ pub const Page = struct {
     // above arena. It should only be used by WebAPIs.
     call_arena: Allocator,
 
-    // Serves are the root object of our JavaScript environment
+    // Serves as the root object of our JavaScript environment
     window: Window,
 
     // The URL of the page
     url: URL,
 
-    // If the body of the main page isn't HTML, we capture its raw bytes here
-    // (currently, this is only useful in fetch mode with the --dump option)
-    raw_data: ?[]const u8,
-
     renderer: Renderer,
 
     // run v8 micro tasks
@@ -97,26 +94,46 @@ pub const Page = struct {
 
     polyfill_loader: polyfill.Loader = .{},
 
+    http_client: *http.Client,
+    script_manager: ScriptManager,
+
+    mode: Mode,
+
+    loaded: bool = false,
+
+    const Mode = union(enum) {
+        pre: void,
+        err: anyerror,
+        parsed: void,
+        html: parser.Parser,
+        raw: std.ArrayListUnmanaged(u8),
+        raw_done: []const u8,
+    };
+
     pub fn init(self: *Page, arena: Allocator, session: *Session) !void {
         const browser = session.browser;
+        const script_manager = ScriptManager.init(browser.app, self);
+
         self.* = .{
+            .url = URL.empty,
+            .mode = .{ .pre = {} },
             .window = try Window.create(null, null),
             .arena = arena,
-            .raw_data = null,
-            .url = URL.empty,
             .session = session,
             .call_arena = undefined,
             .loop = browser.app.loop,
             .renderer = Renderer.init(arena),
             .state_pool = &browser.state_pool,
             .cookie_jar = &session.cookie_jar,
+            .script_manager = script_manager,
+            .http_client = browser.http_client,
             .microtask_node = .{ .func = microtaskCallback },
             .messageloop_node = .{ .func = messageLoopCallback },
             .keydown_event_node = .{ .func = keydownCallback },
             .window_clicked_event_node = .{ .func = windowClicked },
-            .request_factory = browser.http_client.requestFactory(.{
-                .notification = browser.notification,
-            }),
+            // .request_factory = browser.http_client.requestFactory(.{
+            //     .notification = browser.notification,
+            // }),
             .main_context = undefined,
         };
         self.main_context = try session.executor.createJsContext(&self.window, self, self, true, Env.GlobalMissingCallback.init(&self.polyfill_loader));
@@ -129,6 +146,10 @@ pub const Page = struct {
         }
     }
 
+    pub fn deinit(self: *Page) void {
+        self.script_manager.deinit();
+    }
+
     fn microtaskCallback(node: *Loop.CallbackNode, repeat_delay: *?u63) void {
         const self: *Page = @fieldParentPtr("microtask_node", node);
         self.session.browser.runMicrotasks();
@@ -150,12 +171,25 @@ pub const Page = struct {
 
     // dump writes the page content into the given file.
     pub fn dump(self: *const Page, opts: DumpOpts, out: std.fs.File) !void {
-        if (self.raw_data) |raw_data| {
-            // raw_data was set if the document was not HTML, dump the data content only.
-            return try out.writeAll(raw_data);
+        switch (self.mode) {
+            .pre => return error.PageNotLoaded,
+            .raw => |buf| {
+                // maybe page.wait timed-out, print what we have
+                log.warn(.http, "incomplete load", .{ .mode = "raw" });
+                return out.writeAll(buf.items);
+            },
+            .raw_done => |data| return out.writeAll(data),
+            .html => {
+                // maybe page.wait timed-out, print what we have
+                log.warn(.http, "incomplete load", .{ .mode = "html" });
+                // processed below, along with .html
+            },
+            .parsed => {
+                // processed below, along with .html
+            },
+            .err => |err| return err,
         }
 
-        // if the page has a pointer to a document, dumps the HTML.
         const doc = parser.documentHTMLToDocument(self.window.document);
 
         // if the base si requested, add the base's node in the document's headers.
@@ -188,24 +222,58 @@ pub const Page = struct {
     }
 
     pub fn fetchModuleSource(ctx: *anyopaque, src: []const u8) !?[]const u8 {
-        const self: *Page = @ptrCast(@alignCast(ctx));
-        return self.fetchData("module", src);
+        _ = ctx;
+        _ = src;
+        // @newhttp
+        return error.NewHTTP;
+        // const self: *Page = @ptrCast(@alignCast(ctx));
+        // return self.fetchData("module", src);
     }
 
-    pub fn wait(self: *Page, wait_ns: usize) !void {
-        var try_catch: Env.TryCatch = undefined;
-        try_catch.init(self.main_context);
-        defer try_catch.deinit();
+    pub fn wait(self: *Page, wait_sec: usize) !void {
+        switch (self.mode) {
+            .pre, .html, .raw, .parsed => {
+                // The HTML page was parsed. We're now either have JS scripts to
+                // download, or timeouts to execute, or both.
 
-        try self.session.browser.app.loop.run(wait_ns);
+                const cutoff = timestamp() + wait_sec;
 
-        if (try_catch.hasCaught() == false) {
-            log.debug(.browser, "page wait complete", .{});
-            return;
+                var loop = self.session.browser.app.loop;
+
+                var try_catch: Env.TryCatch = undefined;
+                try_catch.init(self.main_context);
+                defer try_catch.deinit();
+
+                // @newhttp Not sure about the timing / the order / any of this.
+                // I think I want to remove the loop. Implement our own timeouts
+                // and switch the CDP server to blocking. For now, just try this.`
+                while (timestamp() < cutoff) {
+                    const active = try self.http_client.tick(10); // 10ms
+
+                    if (active == 0) {
+                        if (!self.loaded) {
+                            // We have no pending HTTP requests and we haven't
+                            // triggered the load event. Trigger the load event.
+                            self.documentIsComplete();
+                        } else if (loop.hasPendingTimeout() == false) {
+                            // we have no active HTTP requests, and no timeouts pending
+                            return;
+                        }
+                    }
+
+                    // 10ms
+                    try loop.run(std.time.ns_per_ms * 10);
+
+                    if (try_catch.hasCaught()) {
+                        const msg = (try try_catch.err(self.arena)) orelse "unknown";
+                        log.err(.browser, "page wait error", .{ .err = msg });
+                        return error.JsError;
+                    }
+                }
+            },
+            .err => |err| return err,
+            .raw_done => return,
         }
-
-        const msg = (try try_catch.err(self.arena)) orelse "unknown";
-        log.err(.browser, "page wait error", .{ .err = msg });
     }
 
     pub fn origin(self: *const Page, arena: Allocator) ![]const u8 {
@@ -215,11 +283,7 @@ pub const Page = struct {
     }
 
     // spec reference: https://html.spec.whatwg.org/#document-lifecycle
-    pub fn navigate(self: *Page, request_url: URL, opts: NavigateOpts) !void {
-        const arena = self.arena;
-        const session = self.session;
-        const notification = session.browser.notification;
-
+    pub fn navigate(self: *Page, request_url: []const u8, opts: NavigateOpts) !void {
         log.debug(.http, "navigate", .{
             .url = request_url,
             .method = opts.method,
@@ -228,237 +292,43 @@ pub const Page = struct {
         });
 
         // if the url is about:blank, nothing to do.
-        if (std.mem.eql(u8, "about:blank", request_url.raw)) {
-            var fbs = std.io.fixedBufferStream("");
-            try self.loadHTMLDoc(fbs.reader(), "utf-8");
+        if (std.mem.eql(u8, "about:blank", request_url)) {
+            const html_doc = try parser.documentHTMLParseFromStr("");
+            try self.setDocument(html_doc);
+
             // We do not processHTMLDoc here as we know we don't have any scripts
             // This assumption may be false when CDP Page.addScriptToEvaluateOnNewDocument is implemented
             try HTMLDocument.documentIsComplete(self.window.document, self);
             return;
         }
 
-        // we don't clone url, because we're going to replace self.url
-        // later in this function, with the final request url (since we might
-        // redirect)
-        self.url = request_url;
+        const owned_url = try self.arena.dupeZ(u8, request_url);
 
-        {
-            // block exists to limit the lifetime of the request, which holds
-            // onto a connection
-            var request = try self.newHTTPRequest(opts.method, &self.url, .{ .navigation = true, .is_http = true });
-            defer request.deinit();
-
-            request.body = opts.body;
-            request.notification = notification;
-
-            notification.dispatch(.page_navigate, &.{
-                .opts = opts,
-                .url = &self.url,
-                .timestamp = timestamp(),
-            });
-
-            var response = try request.sendSync(.{});
-
-            // would be different than self.url in the case of a redirect
-            self.url = try URL.fromURI(arena, request.request_uri);
-
-            const header = response.header;
-            try session.cookie_jar.populateFromResponse(&self.url.uri, &header);
-
-            // TODO handle fragment in url.
-            try self.window.replaceLocation(.{ .url = try self.url.toWebApi(arena) });
-
-            const content_type = header.get("content-type");
-
-            const mime: Mime = blk: {
-                if (content_type) |ct| {
-                    break :blk try Mime.parse(arena, ct);
-                }
-                break :blk Mime.sniff(try response.peek());
-            } orelse .unknown;
-
-            log.info(.http, "navigation", .{
-                .status = header.status,
-                .content_type = content_type,
-                .charset = mime.charset,
-                .url = request_url,
-                .method = opts.method,
-                .reason = opts.reason,
-            });
-
-            if (mime.isHTML()) {
-                // the page is an HTML, load it as it.
-                try self.loadHTMLDoc(&response, mime.charset orelse "utf-8");
-            } else {
-                // the page isn't an HTML
-                var arr: std.ArrayListUnmanaged(u8) = .{};
-                while (try response.next()) |data| {
-                    try arr.appendSlice(arena, try arena.dupe(u8, data));
-                }
-                // save the body into the page.
-                self.raw_data = arr.items;
-
-                // construct a pseudo HTML containing the response body.
-                var buf: std.ArrayListUnmanaged(u8) = .{};
-
-                switch (mime.content_type) {
-                    .application_json, .text_plain, .text_javascript, .text_css => {
-                        try buf.appendSlice(arena, "<html><head><meta charset=\"utf-8\"></head><body><pre>");
-                        try buf.appendSlice(arena, self.raw_data.?);
-                        try buf.appendSlice(arena, "</pre></body></html>\n");
-                    },
-                    // In other cases, we prefer to not integrate the content into the HTML document page iself.
-                    else => {},
-                }
-                var fbs = std.io.fixedBufferStream(buf.items);
-                try self.loadHTMLDoc(fbs.reader(), mime.charset orelse "utf-8");
-            }
-        }
-
-        try self.processHTMLDoc();
-
-        notification.dispatch(.page_navigated, &.{
-            .url = &self.url,
-            .timestamp = timestamp(),
-        });
-        log.debug(.http, "navigation complete", .{
-            .url = request_url,
+        try self.http_client.request(.{
+            .ctx = self,
+            .url = owned_url,
+            .method = opts.method,
+            .header_callback = pageHeaderCallback,
+            .data_callback = pageDataCallback,
+            .done_callback = pageDoneCallback,
+            .error_callback = pageErrorCallback,
         });
     }
 
-    // https://html.spec.whatwg.org/#read-html
-    pub fn loadHTMLDoc(self: *Page, reader: anytype, charset: []const u8) !void {
-        const ccharset = try self.arena.dupeZ(u8, charset);
-
-        const html_doc = try parser.documentHTMLParse(reader, ccharset);
-        const doc = parser.documentHTMLToDocument(html_doc);
-
-        // inject the URL to the document including the fragment.
-        try parser.documentSetDocumentURI(doc, self.url.raw);
-
-        // TODO set the referrer to the document.
-        try self.window.replaceDocument(html_doc);
-        self.window.setStorageShelf(
-            try self.session.storage_shed.getOrPut(try self.origin(self.arena)),
-        );
+    pub fn documentIsLoaded(self: *Page) void {
+        HTMLDocument.documentIsLoaded(self.window.document, self) catch |err| {
+            log.err(.browser, "document is loaded", .{ .err = err });
+        };
     }
 
-    fn processHTMLDoc(self: *Page) !void {
-        const html_doc = self.window.document;
-        const doc = parser.documentHTMLToDocument(html_doc);
-
-        // we want to be notified of any dynamically added script tags
-        // so that we can load the script
-        parser.documentSetScriptAddedCallback(doc, self, scriptAddedCallback);
-
-        const document_element = (try parser.documentGetDocumentElement(doc)) orelse return error.DocumentElementError;
-        _ = try parser.eventTargetAddEventListener(
-            parser.toEventTarget(parser.Element, document_element),
-            "click",
-            &self.window_clicked_event_node,
-            false,
-        );
-        _ = try parser.eventTargetAddEventListener(
-            parser.toEventTarget(parser.Element, document_element),
-            "keydown",
-            &self.keydown_event_node,
-            false,
-        );
-
-        // https://html.spec.whatwg.org/#read-html
-
-        // browse the DOM tree to retrieve scripts
-        // TODO execute the synchronous scripts during the HTL parsing.
-        // TODO fetch the script resources concurrently but execute them in the
-        // declaration order for synchronous ones.
-
-        // async_scripts stores scripts which can be run asynchronously.
-        // for now they are just run after the non-async one in order to
-        // dispatch DOMContentLoaded the sooner as possible.
-        var async_scripts: std.ArrayListUnmanaged(Script) = .{};
-
-        // defer_scripts stores scripts which are meant to be deferred. For now
-        // this doesn't have a huge impact, since normal scripts are parsed
-        // after the document is loaded. But (a) we should fix that and (b)
-        // this results in JavaScript being loaded in the same order as browsers
-        // which can help debug issues (and might actually fix issues if websites
-        // are expecting this execution order)
-        var defer_scripts: std.ArrayListUnmanaged(Script) = .{};
-
-        const root = parser.documentToNode(doc);
-        const walker = Walker{};
-        var next: ?*parser.Node = null;
-        while (true) {
-            next = try walker.get_next(root, next) orelse break;
-
-            // ignore non-elements nodes.
-            if (try parser.nodeType(next.?) != .element) {
-                continue;
-            }
-
-            const current = next.?;
-
-            const e = parser.nodeToElement(current);
-            const tag = try parser.elementTag(e);
-
-            if (tag != .script) {
-                // ignore non-js script.
-                continue;
-            }
-
-            const script = try Script.init(e, null) orelse continue;
-
-            // TODO use fetchpriority
-            // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#fetchpriority
-
-            // > async
-            // > For classic scripts, if the async attribute is present,
-            // > then the classic script will be fetched in parallel to
-            // > parsing and evaluated as soon as it is available.
-            // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#async
-            if (script.is_async) {
-                try async_scripts.append(self.arena, script);
-                continue;
-            }
-
-            if (script.is_defer) {
-                try defer_scripts.append(self.arena, script);
-                continue;
-            }
-
-            // TODO handle for attribute
-            // TODO handle event attribute
-
-            // > Scripts without async, defer or type="module"
-            // > attributes, as well as inline scripts without the
-            // > type="module" attribute, are fetched and executed
-            // > immediately before the browser continues to parse the
-            // > page.
-            // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#notes
-            if (self.evalScript(&script) == false) {
-                return;
-            }
-        }
-
-        for (defer_scripts.items) |*script| {
-            if (self.evalScript(script) == false) {
-                return;
-            }
-        }
-        // dispatch DOMContentLoaded before the transition to "complete",
-        // at the point where all subresources apart from async script elements
-        // have loaded.
-        // https://html.spec.whatwg.org/#reporting-document-loading-status
-        try HTMLDocument.documentIsLoaded(html_doc, self);
-
-        // eval async scripts.
-        for (async_scripts.items) |*script| {
-            if (self.evalScript(script) == false) {
-                return;
-            }
-        }
-
-        try HTMLDocument.documentIsComplete(html_doc, self);
+    fn documentIsComplete(self: *Page) void {
+        self.loaded = true;
+        self._documentIsComplete() catch |err| {
+            log.err(.browser, "document is complete", .{ .err = err });
+        };
+    }
+    fn _documentIsComplete(self: *Page) !void {
+        try HTMLDocument.documentIsComplete(self.window.document, self);
 
         // dispatch window.load event
         const loadevt = try parser.eventCreate();
@@ -472,135 +342,128 @@ pub const Page = struct {
         );
     }
 
-    fn evalScript(self: *Page, script: *const Script) bool {
-        self.tryEvalScript(script) catch |err| switch (err) {
-            error.JsErr => {}, // already been logged with detail
-            error.Terminated => return false,
-            else => log.err(.js, "eval script error", .{ .err = err, .src = script.src }),
-        };
-        return true;
+    fn pageHeaderCallback(transfer: *http.Transfer) !void {
+        var self: *Page = @alignCast(@ptrCast(transfer.ctx));
+
+        // would be different than self.url in the case of a redirect
+        const header = &transfer.response_header.?;
+        const owned_url = try self.arena.dupe(u8, std.mem.span(header.url));
+        self.url = try URL.parse(owned_url, null);
+
+        log.debug(.http, "navigate header", .{
+            .url = self.url,
+            .status = header.status,
+            .content_type = header.contentType(),
+        });
     }
 
-    // evalScript evaluates the src in priority.
-    // if no src is present, we evaluate the text source.
-    // https://html.spec.whatwg.org/multipage/scripting.html#script-processing-model
-    fn tryEvalScript(self: *Page, script: *const Script) !void {
-        if (try script.alreadyProcessed()) {
-            return;
+    fn pageDataCallback(transfer: *http.Transfer, data: []const u8) !void {
+        var self: *Page = @alignCast(@ptrCast(transfer.ctx));
+
+        if (self.mode == .pre) {
+            // we lazily do this, because we might need the first chunk of data
+            // to sniff the content type
+            const mime: Mime = blk: {
+                if (transfer.response_header.?.contentType()) |ct| {
+                    break :blk try Mime.parse(ct);
+                }
+                break :blk Mime.sniff(data);
+            } orelse .unknown;
+
+            const is_html = mime.isHTML();
+            log.debug(.http, "navigate first chunk", .{ .html = is_html, .len = data.len });
+
+            if (is_html) {
+                self.mode = .{ .html = try parser.Parser.init(mime.charset orelse "UTF-8") };
+            } else {
+                self.mode = .{ .raw = .{} };
+            }
         }
 
-        try script.markAsProcessed();
-
-        const html_doc = self.window.document;
-        try parser.documentHTMLSetCurrentScript(html_doc, @ptrCast(script.element));
-
-        defer parser.documentHTMLSetCurrentScript(html_doc, null) catch |err| {
-            log.err(.browser, "clear document script", .{ .err = err });
-        };
-
-        const src = script.src orelse {
-            // source is inline
-            // TODO handle charset attribute
-            const script_source = try parser.nodeTextContent(parser.elementToNode(script.element)) orelse return;
-            return script.eval(self, script_source);
-        };
-
-        // https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-script
-        const script_source = (try self.fetchData("script", src)) orelse {
-            // TODO If el's result is null, then fire an event named error at
-            // el, and return
-            return;
-        };
-        return script.eval(self, script_source);
-
-        // TODO If el's from an external file is true, then fire an event
-        // named load at el.
+        switch (self.mode) {
+            .html => |*p| try p.process(data),
+            .raw => |*buf| try buf.appendSlice(self.arena, data),
+            .pre => unreachable,
+            .parsed => unreachable,
+            .err => unreachable,
+            .raw_done => unreachable,
+        }
     }
 
-    // fetchData returns the data corresponding to the src target.
-    // It resolves src using the page's uri.
-    // If a base path is given, src is resolved according to the base first.
-    // the caller owns the returned string
-    fn fetchData(
-        self: *const Page,
-        comptime reason: []const u8,
-        src: []const u8,
-    ) !?[]const u8 {
-        const arena = self.arena;
+    fn pageDoneCallback(transfer: *http.Transfer) !void {
+        log.debug(.http, "navigate done", .{});
 
-        // Handle data URIs.
-        if (try DataURI.parse(arena, src)) |data_uri| {
-            return data_uri.data;
+        var self: *Page = @alignCast(@ptrCast(transfer.ctx));
+
+        switch (self.mode) {
+            .raw => |buf| self.mode = .{ .raw_done = buf.items },
+            .html => |*p| {
+                const html_doc = p.html_doc;
+                p.deinit(); // don't need the parser anymore
+
+                self.mode = .{ .parsed = {} };
+
+                try self.setDocument(html_doc);
+                const doc = parser.documentHTMLToDocument(html_doc);
+
+                // we want to be notified of any dynamically added script tags
+                // so that we can load the script
+                parser.documentSetScriptAddedCallback(doc, self, scriptAddedCallback);
+
+                const document_element = (try parser.documentGetDocumentElement(doc)) orelse return error.DocumentElementError;
+                _ = try parser.eventTargetAddEventListener(
+                    parser.toEventTarget(parser.Element, document_element),
+                    "click",
+                    &self.window_clicked_event_node,
+                    false,
+                );
+                _ = try parser.eventTargetAddEventListener(
+                    parser.toEventTarget(parser.Element, document_element),
+                    "keydown",
+                    &self.keydown_event_node,
+                    false,
+                );
+
+                const root = parser.documentToNode(doc);
+                const walker = Walker{};
+                var next: ?*parser.Node = null;
+                while (try walker.get_next(root, next)) |n| {
+                    next = n;
+                    const node = next.?;
+                    const tag = (try parser.nodeHTMLGetTagType(node)) orelse continue;
+                    if (tag != .script) {
+                        // ignore non-js script.
+                        continue;
+                    }
+                    try self.script_manager.addFromElement(@ptrCast(node));
+                }
+
+                self.script_manager.staticScriptsDone();
+            },
+            else => unreachable,
         }
-
-        var origin_url = &self.url;
-        const url = try origin_url.resolve(arena, src);
-
-        var status_code: u16 = 0;
-        log.debug(.http, "fetching script", .{
-            .url = url,
-            .src = src,
-            .reason = reason,
-        });
-
-        errdefer |err| log.err(.http, "fetch error", .{
-            .err = err,
-            .url = url,
-            .reason = reason,
-            .status = status_code,
-        });
-
-        var request = try self.newHTTPRequest(.GET, &url, .{
-            .origin_uri = &origin_url.uri,
-            .navigation = false,
-            .is_http = true,
-        });
-        defer request.deinit();
-
-        var response = try request.sendSync(.{});
-        var header = response.header;
-        try self.session.cookie_jar.populateFromResponse(&url.uri, &header);
-
-        status_code = header.status;
-        if (status_code < 200 or status_code > 299) {
-            return error.BadStatusCode;
-        }
-
-        var arr: std.ArrayListUnmanaged(u8) = .{};
-        while (try response.next()) |data| {
-            try arr.appendSlice(arena, try arena.dupe(u8, data));
-        }
-
-        // TODO check content-type
-
-        // check no body
-        if (arr.items.len == 0) {
-            return null;
-        }
-
-        log.info(.http, "fetch complete", .{
-            .url = url,
-            .reason = reason,
-            .status = status_code,
-            .content_length = arr.items.len,
-        });
-        return arr.items;
     }
 
-    fn newHTTPRequest(self: *const Page, method: http.Request.Method, url: *const URL, opts: storage.cookie.LookupOpts) !*http.Request {
-        // Don't use the state's request_factory here, since requests made by the
-        // page (i.e. to load <scripts>) should not generate notifications.
-        var request = try self.session.browser.http_client.request(method, &url.uri);
-        errdefer request.deinit();
-
-        var arr: std.ArrayListUnmanaged(u8) = .{};
-        try self.cookie_jar.forRequest(&url.uri, arr.writer(self.arena), opts);
-
-        if (arr.items.len > 0) {
-            try request.addHeader("Cookie", arr.items, .{});
+    fn pageErrorCallback(transfer: *http.Transfer, err: anyerror) void {
+        log.err(.http, "navigate failed", .{ .err = err });
+        var self: *Page = @alignCast(@ptrCast(transfer.ctx));
+        switch (self.mode) {
+            .html => |*p| p.deinit(), // don't need the parser anymore
+            else => {},
         }
+        self.mode = .{ .err = err };
+    }
 
-        return request;
+    // extracted because this sis called from tests to set things up.
+    pub fn setDocument(self: *Page, html_doc: *parser.DocumentHTML) !void {
+        const doc = parser.documentHTMLToDocument(html_doc);
+        try parser.documentSetDocumentURI(doc, self.url.raw);
+
+        // TODO set the referrer to the document.
+        try self.window.replaceDocument(html_doc);
+        self.window.setStorageShelf(
+            try self.session.storage_shed.getOrPut(try self.origin(self.arena)),
+        );
     }
 
     pub const MouseEvent = struct {
@@ -885,258 +748,65 @@ const DelayedNavigation = struct {
     // are still pending async requests, which we've seen happen, even after
     // an abort).
     fn delayNavigate(node: *Loop.CallbackNode, repeat_delay: *?u63) void {
-        const self: *DelayedNavigation = @fieldParentPtr("navigate_node", node);
+        _ = node;
+        _ = repeat_delay;
+        // @newhttp
+        // const self: *DelayedNavigation = @fieldParentPtr("navigate_node", node);
 
-        const session = self.session;
-        const initial = self.initial;
+        // const session = self.session;
+        // const initial = self.initial;
 
-        if (initial) {
-            // Prior to schedule this task, we terminated excution to stop
-            // the running script. If we don't resume it before doing a shutdown
-            // we'll get an error.
-            session.executor.resumeExecution();
+        // if (initial) {
+        //     // Prior to schedule this task, we terminated excution to stop
+        //     // the running script. If we don't resume it before doing a shutdown
+        //     // we'll get an error.
+        //     session.executor.resumeExecution();
 
-            session.removePage();
-            _ = session.createPage() catch |err| {
-                log.err(.browser, "delayed navigation page error", .{
-                    .err = err,
-                    .url = self.url,
-                });
-                return;
-            };
-            self.initial = false;
-        }
+        //     session.removePage();
+        //     _ = session.createPage() catch |err| {
+        //         log.err(.browser, "delayed navigation page error", .{
+        //             .err = err,
+        //             .url = self.url,
+        //         });
+        //         return;
+        //     };
+        //     self.initial = false;
+        // }
 
-        if (session.browser.http_client.freeSlotCount() == 0) {
-            log.debug(.browser, "delayed navigate waiting", .{});
-            const delay = 0 * std.time.ns_per_ms;
+        // if (session.browser.http_client.freeSlotCount() == 0) {
+        //     log.debug(.browser, "delayed navigate waiting", .{});
+        //     const delay = 0 * std.time.ns_per_ms;
 
-            // If this isn't the initial check, we can safely re-use the timer
-            // to check again.
-            if (initial == false) {
-                repeat_delay.* = delay;
-                return;
-            }
+        //     // If this isn't the initial check, we can safely re-use the timer
+        //     // to check again.
+        //     if (initial == false) {
+        //         repeat_delay.* = delay;
+        //         return;
+        //     }
 
-            // However, if this _is_ the initial check, we called
-            // session.removePage above, and that reset the loop ctx_id.
-            // We can't re-use this timer, because it has the previous ctx_id.
-            // We can create a new timeout though, and that'll get the new ctx_id.
-            //
-            // Page has to be not-null here because we called createPage above.
-            _ = session.page.?.loop.timeout(delay, &self.navigate_node) catch |err| {
-                log.err(.browser, "delayed navigation loop err", .{ .err = err });
-            };
-            return;
-        }
+        //     // However, if this _is_ the initial check, we called
+        //     // session.removePage above, and that reset the loop ctx_id.
+        //     // We can't re-use this timer, because it has the previous ctx_id.
+        //     // We can create a new timeout though, and that'll get the new ctx_id.
+        //     //
+        //     // Page has to be not-null here because we called createPage above.
+        //     _ = session.page.?.loop.timeout(delay, &self.navigate_node) catch |err| {
+        //         log.err(.browser, "delayed navigation loop err", .{ .err = err });
+        //     };
+        //     return;
+        // }
 
-        const page = session.currentPage() orelse return;
-        defer if (!page.delayed_navigation) {
-            // If, while loading the page, we intend to navigate to another
-            // page, then we need to keep the transfer_arena around, as this
-            // sub-navigation is probably using it.
-            _ = session.browser.transfer_arena.reset(.{ .retain_with_limit = 64 * 1024 });
-        };
+        // const page = session.currentPage() orelse return;
+        // defer if (!page.delayed_navigation) {
+        //     // If, while loading the page, we intend to navigate to another
+        //     // page, then we need to keep the transfer_arena around, as this
+        //     // sub-navigation is probably using it.
+        //     _ = session.browser.transfer_arena.reset(.{ .retain_with_limit = 64 * 1024 });
+        // };
 
-        return page.navigate(self.url, self.opts) catch |err| {
-            log.err(.browser, "delayed navigation error", .{ .err = err, .url = self.url });
-        };
-    }
-};
-
-const Script = struct {
-    kind: Kind,
-    is_async: bool,
-    is_defer: bool,
-    src: ?[]const u8,
-    element: *parser.Element,
-    // The javascript to load after we successfully load the script
-    onload: ?Callback,
-    onerror: ?Callback,
-
-    // The javascript to load if we have an error executing the script
-    // For now, we ignore this, since we still have a lot of errors that we
-    // shouldn't
-    //onerror: ?[]const u8,
-
-    const Kind = enum {
-        module,
-        javascript,
-    };
-
-    const Callback = union(enum) {
-        string: []const u8,
-        function: Env.Function,
-    };
-
-    fn init(e: *parser.Element, page_: ?*const Page) !?Script {
-        if (try parser.elementGetAttribute(e, "nomodule") != null) {
-            // these scripts should only be loaded if we don't support modules
-            // but since we do support modules, we can just skip them.
-            return null;
-        }
-
-        const kind = parseKind(try parser.elementGetAttribute(e, "type")) orelse {
-            return null;
-        };
-
-        var onload: ?Callback = null;
-        var onerror: ?Callback = null;
-
-        if (page_) |page| {
-            // If we're given the page, then it means the script is dynamic
-            // and we need to load the onload and onerror function (if there are
-            // any) from our WebAPI.
-            // This page == null is an optimization which isn't technically
-            // correct, as a static script could have a dynamic onload/onerror
-            // attached to it. But this seems quite unlikely and it does help
-            // optimize loading scripts, of which there can be hundreds for a
-            // page.
-            if (page.getNodeState(@ptrCast(e))) |se| {
-                if (se.onload) |function| {
-                    onload = .{ .function = function };
-                }
-                if (se.onerror) |function| {
-                    onerror = .{ .function = function };
-                }
-            }
-        } else {
-            if (try parser.elementGetAttribute(e, "onload")) |string| {
-                onload = .{ .string = string };
-            }
-            if (try parser.elementGetAttribute(e, "onerror")) |string| {
-                onerror = .{ .string = string };
-            }
-        }
-
-        return .{
-            .kind = kind,
-            .element = e,
-            .onload = onload,
-            .onerror = onerror,
-            .src = try parser.elementGetAttribute(e, "src"),
-            .is_async = try parser.elementGetAttribute(e, "async") != null,
-            .is_defer = try parser.elementGetAttribute(e, "defer") != null,
-        };
-    }
-
-    // > type
-    // > Attribute is not set (default), an empty string, or a JavaScript MIME
-    // > type indicates that the script is a "classic script", containing
-    // > JavaScript code.
-    // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#attribute_is_not_set_default_an_empty_string_or_a_javascript_mime_type
-    fn parseKind(script_type_: ?[]const u8) ?Kind {
-        const script_type = script_type_ orelse return .javascript;
-        if (script_type.len == 0) {
-            return .javascript;
-        }
-
-        if (std.ascii.eqlIgnoreCase(script_type, "application/javascript")) return .javascript;
-        if (std.ascii.eqlIgnoreCase(script_type, "text/javascript")) return .javascript;
-        if (std.ascii.eqlIgnoreCase(script_type, "module")) return .module;
-
-        return null;
-    }
-
-    // If a script tag gets dynamically created and added to the dom:
-    //    document.getElementsByTagName('head')[0].appendChild(script)
-    // that script tag will immediately get executed by our scriptAddedCallback.
-    // However, if the location where the script tag is inserted happens to be
-    // below where processHTMLDoc curently is, then we'll re-run that same script
-    // again in processHTMLDoc. This flag is used to let us know if a specific
-    // <script> has already been processed.
-    fn alreadyProcessed(self: *const Script) !bool {
-        return parser.scriptGetProcessed(@ptrCast(self.element));
-    }
-
-    fn markAsProcessed(self: *const Script) !void {
-        return parser.scriptSetProcessed(@ptrCast(self.element), true);
-    }
-
-    fn eval(self: *const Script, page: *Page, body: []const u8) !void {
-        var try_catch: Env.TryCatch = undefined;
-        try_catch.init(page.main_context);
-        defer try_catch.deinit();
-
-        const src: []const u8 = blk: {
-            const s = self.src orelse break :blk page.url.raw;
-            break :blk try URL.stitch(page.arena, s, page.url.raw, .{ .alloc = .if_needed });
-        };
-
-        // if self.src is null, then this is an inline script, and it should
-        // not be cached.
-        const cacheable = self.src != null;
-
-        log.debug(.browser, "executing script", .{
-            .src = src,
-            .kind = self.kind,
-            .cacheable = cacheable,
-        });
-
-        const failed = blk: {
-            switch (self.kind) {
-                .javascript => _ = page.main_context.eval(body, src) catch break :blk true,
-                // We don't care about waiting for the evaluation here.
-                .module => _ = page.main_context.module(body, src, cacheable) catch break :blk true,
-            }
-            break :blk false;
-        };
-
-        if (failed) {
-            if (page.delayed_navigation) {
-                return error.Terminated;
-            }
-
-            if (try try_catch.err(page.arena)) |msg| {
-                log.warn(.user_script, "eval script", .{
-                    .src = src,
-                    .err = msg,
-                    .cacheable = cacheable,
-                });
-            }
-
-            try self.executeCallback("onerror", page);
-            return error.JsErr;
-        }
-
-        try self.executeCallback("onload", page);
-    }
-
-    fn executeCallback(self: *const Script, comptime typ: []const u8, page: *Page) !void {
-        const callback = @field(self, typ) orelse return;
-        switch (callback) {
-            .string => |str| {
-                var try_catch: Env.TryCatch = undefined;
-                try_catch.init(page.main_context);
-                defer try_catch.deinit();
-                _ = page.main_context.exec(str, typ) catch {
-                    if (try try_catch.err(page.arena)) |msg| {
-                        log.warn(.user_script, "script callback", .{
-                            .src = self.src,
-                            .err = msg,
-                            .type = typ,
-                            .@"inline" = true,
-                        });
-                    }
-                };
-            },
-            .function => |f| {
-                const Event = @import("events/event.zig").Event;
-                const loadevt = try parser.eventCreate();
-                defer parser.eventDestroy(loadevt);
-
-                var result: Env.Function.Result = undefined;
-                f.tryCall(void, .{try Event.toInterface(loadevt)}, &result) catch {
-                    log.warn(.user_script, "script callback", .{
-                        .src = self.src,
-                        .type = typ,
-                        .err = result.exception,
-                        .stack = result.stack,
-                        .@"inline" = false,
-                    });
-                };
-            },
-        }
+        // return page.navigate(self.url, self.opts) catch |err| {
+        //     log.err(.browser, "delayed navigation error", .{ .err = err, .url = self.url });
+        // };
     }
 };
 
@@ -1150,7 +820,7 @@ pub const NavigateReason = enum {
 pub const NavigateOpts = struct {
     cdp_id: ?i64 = null,
     reason: NavigateReason = .address_bar,
-    method: http.Request.Method = .GET,
+    method: http.Method = .GET,
     body: ?[]const u8 = null,
 };
 
@@ -1167,16 +837,19 @@ fn timestamp() u32 {
 // after the document is loaded, it's ok to execute any async and defer scripts
 // immediately.
 pub export fn scriptAddedCallback(ctx: ?*anyopaque, element: ?*parser.Element) callconv(.C) void {
-    const self: *Page = @alignCast(@ptrCast(ctx.?));
-    if (self.delayed_navigation) {
-        // if we're planning on navigating to another page, don't run this script
-        return;
-    }
+    _ = ctx;
+    _ = element;
+    // @newhttp
+    // const self: *Page = @alignCast(@ptrCast(ctx.?));
+    // if (self.delayed_navigation) {
+    //     // if we're planning on navigating to another page, don't run this script
+    //     return;
+    // }
 
-    var script = Script.init(element.?, self) catch |err| {
-        log.warn(.browser, "script added init error", .{ .err = err });
-        return;
-    } orelse return;
+    // var script = Script.init(element.?, self) catch |err| {
+    //     log.warn(.browser, "script added init error", .{ .err = err });
+    //     return;
+    // } orelse return;
 
-    _ = self.evalScript(&script);
+    // _ = self.evalScript(&script);
 }
diff --git a/src/browser/session.zig b/src/browser/session.zig
index 8cedf7d7..625f3561 100644
--- a/src/browser/session.zig
+++ b/src/browser/session.zig
@@ -128,6 +128,7 @@ pub const Session = struct {
         // window.setTimeout and running microtasks should be ignored
         self.browser.app.loop.reset();
 
+        self.page.?.deinit();
         self.page = null;
 
         // clear netsurf memory arena.
diff --git a/src/browser/storage/cookie.zig b/src/browser/storage/cookie.zig
index 07d9c028..8c061576 100644
--- a/src/browser/storage/cookie.zig
+++ b/src/browser/storage/cookie.zig
@@ -4,7 +4,6 @@ const Allocator = std.mem.Allocator;
 const ArenaAllocator = std.heap.ArenaAllocator;
 
 const log = @import("../../log.zig");
-const http = @import("../../http/client.zig");
 const DateTime = @import("../../datetime.zig").DateTime;
 const public_suffix_list = @import("../../data/public_suffix_list.zig").lookup;
 
@@ -104,17 +103,18 @@ pub const Jar = struct {
         }
     }
 
-    pub fn populateFromResponse(self: *Jar, uri: *const Uri, header: *const http.ResponseHeader) !void {
-        const now = std.time.timestamp();
-        var it = header.iterate("set-cookie");
-        while (it.next()) |set_cookie| {
-            const c = Cookie.parse(self.allocator, uri, set_cookie) catch |err| {
-                log.warn(.web_api, "cookie parse failed", .{ .raw = set_cookie, .err = err });
-                continue;
-            };
-            try self.add(c, now);
-        }
-    }
+    // @newhttp
+    // pub fn populateFromResponse(self: *Jar, uri: *const Uri, header: *const http.ResponseHeader) !void {
+    //     const now = std.time.timestamp();
+    //     var it = header.iterate("set-cookie");
+    //     while (it.next()) |set_cookie| {
+    //         const c = Cookie.parse(self.allocator, uri, set_cookie) catch |err| {
+    //             log.warn(.web_api, "cookie parse failed", .{ .raw = set_cookie, .err = err });
+    //             continue;
+    //         };
+    //         try self.add(c, now);
+    //     }
+    // }
 
     fn writeCookie(cookie: *const Cookie, writer: anytype) !void {
         if (cookie.name.len > 0) {
diff --git a/src/browser/xhr/xhr.zig b/src/browser/xhr/xhr.zig
index f14cf438..eb26f551 100644
--- a/src/browser/xhr/xhr.zig
+++ b/src/browser/xhr/xhr.zig
@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+
 const Allocator = std.mem.Allocator;
 
 const DOMError = @import("../netsurf.zig").DOMError;
@@ -28,8 +29,8 @@ const log = @import("../../log.zig");
 const URL = @import("../../url.zig").URL;
 const Mime = @import("../mime.zig").Mime;
 const parser = @import("../netsurf.zig");
-const http = @import("../../http/client.zig");
 const Page = @import("../page.zig").Page;
+const http = @import("../../http/client.zig");
 const Loop = @import("../../runtime/loop.zig").Loop;
 const CookieJar = @import("../storage/storage.zig").CookieJar;
 
@@ -83,7 +84,7 @@ pub const XMLHttpRequest = struct {
     arena: Allocator,
     request: ?*http.Request = null,
 
-    method: http.Request.Method,
+    method: http.Method,
     state: State,
     url: ?URL = null,
     origin_url: *const URL,
@@ -264,10 +265,11 @@ pub const XMLHttpRequest = struct {
     }
 
     pub fn destructor(self: *XMLHttpRequest) void {
-        if (self.request) |req| {
-            req.abort();
-            self.request = null;
-        }
+        // @newhttp
+        // if (self.request) |req| {
+        // req.abort();
+        self.request = null;
+        // }
     }
 
     pub fn reset(self: *XMLHttpRequest) void {
@@ -414,7 +416,7 @@ pub const XMLHttpRequest = struct {
     }
 
     const methods = [_]struct {
-        tag: http.Request.Method,
+        tag: http.Method,
         name: []const u8,
     }{
         .{ .tag = .DELETE, .name = "DELETE" },
@@ -424,20 +426,12 @@ pub const XMLHttpRequest = struct {
         .{ .tag = .POST, .name = "POST" },
         .{ .tag = .PUT, .name = "PUT" },
     };
-    const methods_forbidden = [_][]const u8{ "CONNECT", "TRACE", "TRACK" };
-
-    pub fn validMethod(m: []const u8) DOMError!http.Request.Method {
+    pub fn validMethod(m: []const u8) DOMError!http.Method {
         for (methods) |method| {
             if (std.ascii.eqlIgnoreCase(method.name, m)) {
                 return method.tag;
             }
         }
-        // If method is a forbidden method, then throw a "SecurityError" DOMException.
-        for (methods_forbidden) |method| {
-            if (std.ascii.eqlIgnoreCase(method, m)) {
-                return DOMError.Security;
-            }
-        }
 
         // If method is not a method, then throw a "SyntaxError" DOMException.
         return DOMError.Syntax;
@@ -461,13 +455,15 @@ pub const XMLHttpRequest = struct {
             self.request_body = try self.arena.dupe(u8, b);
         }
 
-        try page.request_factory.initAsync(
-            page.arena,
-            self.method,
-            &self.url.?.uri,
-            self,
-            onHttpRequestReady,
-        );
+        // @newhttp
+        _ = page;
+        // try page.request_factory.initAsync(
+        //     page.arena,
+        //     self.method,
+        //     &self.url.?.uri,
+        //     self,
+        //     onHttpRequestReady,
+        // );
     }
 
     fn onHttpRequestReady(ctx: *anyopaque, request: *http.Request) !void {
diff --git a/src/cdp/domains/network.zig b/src/cdp/domains/network.zig
index cbe4c963..44701fae 100644
--- a/src/cdp/domains/network.zig
+++ b/src/cdp/domains/network.zig
@@ -236,11 +236,12 @@ pub fn httpRequestStart(arena: Allocator, bc: anytype, request: *const Notificat
     const page = bc.session.currentPage() orelse unreachable;
 
     // Modify request with extra CDP headers
-    try request.headers.ensureTotalCapacity(request.arena, request.headers.items.len + cdp.extra_headers.items.len);
-    for (cdp.extra_headers.items) |extra| {
-        const new = putAssumeCapacity(request.headers, extra);
-        if (!new) log.debug(.cdp, "request header overwritten", .{ .name = extra.name });
-    }
+    // @newhttp
+    // try request.headers.ensureTotalCapacity(request.arena, request.headers.items.len + cdp.extra_headers.items.len);
+    // for (cdp.extra_headers.items) |extra| {
+    //     const new = putAssumeCapacity(request.headers, extra);
+    //     if (!new) log.debug(.cdp, "request header overwritten", .{ .name = extra.name });
+    // }
 
     const document_url = try urlToString(arena, &page.url.uri, .{
         .scheme = true,
@@ -262,11 +263,12 @@ pub fn httpRequestStart(arena: Allocator, bc: anytype, request: *const Notificat
         .fragment = true,
     });
 
-    var headers: std.StringArrayHashMapUnmanaged([]const u8) = .empty;
-    try headers.ensureTotalCapacity(arena, request.headers.items.len);
-    for (request.headers.items) |header| {
-        headers.putAssumeCapacity(header.name, header.value);
-    }
+    // @newhttp
+    const headers: std.StringArrayHashMapUnmanaged([]const u8) = .empty;
+    // try headers.ensureTotalCapacity(arena, request.headers.items.len);
+    // for (request.headers.items) |header| {
+    //     headers.putAssumeCapacity(header.name, header.value);
+    // }
 
     // We're missing a bunch of fields, but, for now, this seems like enough
     try cdp.sendEvent("Network.requestWillBeSent", .{
@@ -303,11 +305,12 @@ pub fn httpRequestComplete(arena: Allocator, bc: anytype, request: *const Notifi
         .query = true,
     });
 
-    var headers: std.StringArrayHashMapUnmanaged([]const u8) = .empty;
-    try headers.ensureTotalCapacity(arena, request.headers.len);
-    for (request.headers) |header| {
-        headers.putAssumeCapacity(header.name, header.value);
-    }
+    // @newhttp
+    const headers: std.StringArrayHashMapUnmanaged([]const u8) = .empty;
+    // try headers.ensureTotalCapacity(arena, request.headers.len);
+    // for (request.headers) |header| {
+    //     headers.putAssumeCapacity(header.name, header.value);
+    // }
 
     // We're missing a bunch of fields, but, for now, this seems like enough
     try cdp.sendEvent("Network.responseReceived", .{
diff --git a/src/cdp/domains/page.zig b/src/cdp/domains/page.zig
index 5ffdca2d..5bab951f 100644
--- a/src/cdp/domains/page.zig
+++ b/src/cdp/domains/page.zig
@@ -148,12 +148,10 @@ fn navigate(cmd: anytype) !void {
         return error.SessionIdNotLoaded;
     }
 
-    const url = try URL.parse(params.url, "https");
-
     var page = bc.session.currentPage() orelse return error.PageNotLoaded;
     bc.loader_id = bc.cdp.loader_id_gen.next();
 
-    try page.navigate(url, .{
+    try page.navigate(params.url, .{
         .reason = .address_bar,
         .cdp_id = cmd.input.id,
     });
diff --git a/src/data/public_suffix_list.zig b/src/data/public_suffix_list.zig
index 16eb145d..dcab218a 100644
--- a/src/data/public_suffix_list.zig
+++ b/src/data/public_suffix_list.zig
@@ -8,7 +8,8 @@ pub fn lookup(value: []const u8) bool {
 const public_suffix_list = std.StaticStringMap(void).initComptime(entries);
 
 const entries: []const struct { []const u8, void } =
-    if (builtin.is_test) &.{
+    // @newhttp
+    if (builtin.is_test or true) &.{
         .{ "api.gov.uk", {} },
         .{ "gov.uk", {} },
     } else &.{
diff --git a/src/http/ca_certs.zig b/src/http/ca_certs.zig
new file mode 100644
index 00000000..b0ec31af
--- /dev/null
+++ b/src/http/ca_certs.zig
@@ -0,0 +1,93 @@
+// Copyright (C) 2023-2025  Lightpanda (Selecy SAS)
+//
+// Francis Bouvier <francis@lightpanda.io>
+// Pierre Tachoire <pierre@lightpanda.io>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+const std = @import("std");
+const c = @import("client.zig").c;
+
+const Allocator = std.mem.Allocator;
+
+// TODO: on BSD / Linux, we could just read the PEM file directly.
+// This whole rescan + decode is really just needed for MacOS. On Linux
+// bundle.rescan does find the .pem file(s) which could be in a few different
+// places, so it's still useful, just not efficient.
+pub fn load(allocator: Allocator, arena: Allocator) !c.curl_blob {
+    var bundle: std.crypto.Certificate.Bundle = .{};
+    try bundle.rescan(allocator);
+    defer bundle.deinit(allocator);
+
+    var it = bundle.map.valueIterator();
+    const bytes = bundle.bytes.items;
+
+    const encoder = std.base64.standard.Encoder;
+    var arr: std.ArrayListUnmanaged(u8) = .empty;
+
+    const encoded_size = encoder.calcSize(bytes.len);
+    const buffer_size = encoded_size +
+        (bundle.map.count() * 75) +  // start / end per certificate + extra, just in case
+        (encoded_size / 64)          // newline per 64 characters
+    ;
+    try arr.ensureTotalCapacity(arena, buffer_size);
+    var writer = arr.writer(arena);
+
+    while (it.next()) |index| {
+        const cert = try std.crypto.Certificate.der.Element.parse(bytes, index.*);
+
+        try writer.writeAll("-----BEGIN CERTIFICATE-----\n");
+        var line_writer = LineWriter{.inner = writer};
+        try encoder.encodeWriter(&line_writer, bytes[index.*..cert.slice.end]);
+        try writer.writeAll("\n-----END CERTIFICATE-----\n");
+    }
+
+    // Final encoding should not be larger than our initial size estimate
+    std.debug.assert(buffer_size > arr.items.len);
+
+    return .{
+        .len = arr.items.len,
+        .data = arr.items.ptr,
+        .flags = 0,
+    };
+}
+
+// Wraps lines @ 64 columns
+const LineWriter = struct {
+    col: usize = 0,
+    inner: std.ArrayListUnmanaged(u8).Writer,
+
+    pub fn writeAll(self: *LineWriter, data: []const u8) !void {
+        var writer = self.inner;
+
+        var col = self.col;
+        const len = 64 - col;
+
+        var remain = data;
+        if (remain.len > len) {
+            col = 0;
+            try writer.writeAll(data[0..len]);
+            try writer.writeByte('\n');
+            remain = data[len..];
+        }
+
+        while (remain.len > 64) {
+            try writer.writeAll(remain[0..64]);
+            try writer.writeByte('\n');
+            remain = data[len..];
+        }
+        try writer.writeAll(remain);
+        self.col = col + remain.len;
+    }
+};
diff --git a/src/http/client.zig b/src/http/client.zig
index d719006f..2c4b6c9e 100644
--- a/src/http/client.zig
+++ b/src/http/client.zig
@@ -1,4 +1,4 @@
-// Copyright (C) 2023-2024  Lightpanda (Selecy SAS)
+// Copyright (C) 2023-2025  Lightpanda (Selecy SAS)
 //
 // Francis Bouvier <francis@lightpanda.io>
 // Pierre Tachoire <pierre@lightpanda.io>
@@ -15,31 +15,515 @@
 //
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+pub const c = @cImport({
+    @cInclude("curl/curl.h");
+});
+
+const ENABLE_DEBUG = false;
+
 const std = @import("std");
 const builtin = @import("builtin");
+const errors = @import("errors.zig");
 
-const os = std.os;
-const posix = std.posix;
-const Uri = std.Uri;
-const Thread = std.Thread;
 const Allocator = std.mem.Allocator;
-const MemoryPool = std.heap.MemoryPool;
 const ArenaAllocator = std.heap.ArenaAllocator;
 
-const tls = @import("tls");
-const log = @import("../log.zig");
-const IO = @import("../runtime/loop.zig").IO;
-const Loop = @import("../runtime/loop.zig").Loop;
-const Notification = @import("../notification.zig").Notification;
+pub fn init() !void {
+    try errorCheck(c.curl_global_init(c.CURL_GLOBAL_SSL));
+    if (comptime ENABLE_DEBUG) {
+        std.debug.print("curl version: {s}\n\n", .{c.curl_version()});
+    }
+}
 
-// We might need to peek at the body to try and sniff the content-type.
-// While we only need a few bytes, in most cases we need to ignore leading
-// whitespace, so we want to get a reasonable-sized chunk.
-const PEEK_BUF_LEN = 1024;
+const LogFn = *const fn(ctx: []const u8, err: anyerror) void;
 
-const BUFFER_LEN = tls.max_ciphertext_record_len;
+pub fn deinit() void {
+    c.curl_global_cleanup();
+}
 
-const MAX_HEADER_LINE_LEN = 4096;
+pub const Client = struct {
+    log: LogFn,
+    active: usize,
+    multi: *c.CURLM,
+    handles: Handles,
+    queue: RequestQueue,
+    allocator: Allocator,
+    transfer_pool: std.heap.MemoryPool(Transfer),
+    queue_node_pool: std.heap.MemoryPool(RequestQueue.Node),
+    //@newhttp
+    http_proxy: ?std.Uri = null,
+
+    const RequestQueue = std.DoublyLinkedList(Request);
+
+    const Opts = struct {
+        log: ?LogFn = null,
+        timeout_ms: u31 = 0,
+        max_redirects: u8 = 10,
+        connect_timeout_ms: u31 = 5000,
+        max_concurrent_transfers: u8 = 5,
+    };
+    pub fn init(allocator: Allocator, opts: Opts) !*Client {
+        var transfer_pool = std.heap.MemoryPool(Transfer).init(allocator);
+        errdefer transfer_pool.deinit();
+
+        var queue_node_pool = std.heap.MemoryPool(RequestQueue.Node).init(allocator);
+        errdefer queue_node_pool.deinit();
+
+        const client = try allocator.create(Client);
+        errdefer allocator.destroy(client);
+
+        var handles = try Handles.init(allocator, client, opts);
+        errdefer handles.deinit(allocator);
+
+        const multi = c.curl_multi_init() orelse return error.FailedToInitializeMulti;
+        errdefer _ = c.curl_multi_cleanup(multi);
+
+        client.* = .{
+            .log = opts.log orelse noopLog,
+            .queue = .{},
+            .active = 0,
+            .multi = multi,
+            .handles = handles,
+            .allocator = allocator,
+            .transfer_pool = transfer_pool,
+            .queue_node_pool = queue_node_pool,
+        };
+        return client;
+    }
+
+    pub fn deinit(self: *Client) void {
+        self.handles.deinit(self.allocator);
+        _ = c.curl_multi_cleanup(self.multi);
+
+        self.transfer_pool.deinit();
+        self.queue_node_pool.deinit();
+        self.allocator.destroy(self);
+    }
+
+    pub fn tick(self: *Client, timeout_ms: usize) !usize {
+        var handles = &self.handles.available;
+        while (true) {
+            if (handles.first == null) {
+                break;
+            }
+            const queue_node = self.queue.popFirst() orelse break;
+
+            defer self.queue_node_pool.destroy(queue_node);
+
+            const handle = handles.popFirst().?.data;
+            try self.makeRequest(handle, queue_node.data);
+        }
+
+        try self.perform(@intCast(timeout_ms));
+        return self.active;
+    }
+
+    pub fn request(self: *Client, req: Request) !void {
+        if (self.handles.getFreeHandle()) |handle| {
+            return self.makeRequest(handle, req);
+        }
+
+        const node = try self.queue_node_pool.create();
+        node.data = req;
+        self.queue.append(node);
+    }
+
+    fn makeRequest(self: *Client, handle: *Handle, req: Request) !void {
+        const easy = handle.easy;
+
+        const header_list = blk: {
+            errdefer self.handles.release(handle);
+            try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_URL, req.url.ptr));
+            switch (req.method) {
+                .GET => try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_HTTPGET, @as(c_long, 1))),
+                .POST => try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_HTTPPOST, @as(c_long, 1))),
+                .PUT => try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_CUSTOMREQUEST, "put")),
+                .DELETE => try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_CUSTOMREQUEST, "delete")),
+                .HEAD => try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_CUSTOMREQUEST, "head")),
+                .OPTIONS => try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_CUSTOMREQUEST, "options")),
+            }
+
+
+            const header_list = c.curl_slist_append(null, "User-Agent: lightpanda/1");
+            errdefer c.curl_slist_free_all(header_list);
+
+            try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_HTTPHEADER, header_list));
+
+
+            //try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_POSTFIELDSIZE, @as(c_long, @intCast(STRING.len))));
+            //try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_POSTFIELDS, STRING.ptr));
+
+            break :blk header_list;
+        };
+
+        {
+            errdefer self.handles.release(handle);
+
+            const transfer = try self.transfer_pool.create();
+            transfer.* = .{
+                .id = 0,
+                .req = req,
+                .ctx = req.ctx,
+                .handle = handle,
+                ._request_header_list = header_list,
+            };
+            errdefer self.transfer_pool.destroy(transfer);
+            try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_PRIVATE, transfer));
+
+            try errorMCheck(c.curl_multi_add_handle(self.multi, easy));
+            if (req.start_callback) |cb| {
+                cb(transfer) catch |err| {
+                    try errorMCheck(c.curl_multi_remove_handle(self.multi, easy));
+                    return err;
+                };
+            }
+        }
+
+        self.active += 1;
+        return self.perform(0);
+    }
+
+    fn perform(self: *Client, timeout_ms: c_int) !void {
+        const multi = self.multi;
+
+        var running: c_int = undefined;
+        try errorMCheck(c.curl_multi_perform(multi, &running));
+
+        if (timeout_ms > 0) {
+            try errorMCheck(c.curl_multi_poll(multi, null, 0, timeout_ms, null));
+        }
+
+        while (true) {
+            var remaining: c_int = undefined;
+            const msg: *c.CURLMsg = c.curl_multi_info_read(multi, &remaining) orelse break;
+            if (msg.msg == c.CURLMSG_DONE) {
+                self.active -= 1;
+                const easy = msg.easy_handle.?;
+                const transfer = try Transfer.fromEasy(easy);
+                defer {
+                    self.handles.release(transfer.handle);
+                    transfer.deinit();
+                    self.transfer_pool.destroy(transfer);
+                }
+
+                if (errorCheck(msg.data.result)) {
+                    transfer.req.done_callback(transfer) catch |err| transfer.onError(err);
+                } else |err| {
+                    transfer.onError(err);
+                }
+
+                try errorMCheck(c.curl_multi_remove_handle(multi, easy));
+            }
+
+            if (remaining == 0) {
+                break;
+            }
+        }
+    }
+};
+
+const Handles = struct {
+    handles: []Handle,
+    available: FreeList,
+    cert_arena: ArenaAllocator,
+
+    const FreeList = std.DoublyLinkedList(*Handle);
+
+    fn init(allocator: Allocator, client: *Client, opts: Client.Opts) !Handles {
+        const count = opts.max_concurrent_transfers;
+        std.debug.assert(count > 0);
+
+        const handles = try allocator.alloc(Handle, count);
+        errdefer allocator.free(handles);
+
+        var initialized_count: usize = 0;
+        errdefer cleanup(allocator, handles[0..initialized_count]);
+
+        var cert_arena = ArenaAllocator.init(allocator);
+        errdefer cert_arena.deinit();
+        const ca_blob = try @import("ca_certs.zig").load(allocator, cert_arena.allocator());
+
+        var available: FreeList = .{};
+        for (0..count) |i| {
+            const node = try allocator.create(FreeList.Node);
+            errdefer allocator.destroy(node);
+
+            handles[i] = .{
+                .node = node,
+                .client = client,
+                .easy = undefined,
+            };
+            try handles[i].init(ca_blob, opts);
+            initialized_count += 1;
+
+            node.data = &handles[i];
+            available.append(node);
+         }
+
+         return .{
+            .handles = handles,
+            .available = available,
+            .cert_arena = cert_arena,
+         };
+    }
+
+    fn deinit(self: *Handles, allocator: Allocator) void {
+        cleanup(allocator, self.handles);
+        allocator.free(self.handles);
+        self.cert_arena.deinit();
+    }
+
+    // Done line this so that cleanup can be called from init with a partial state
+    fn cleanup(allocator: Allocator, handles: []Handle) void {
+        for (handles) |*h| {
+            _ = c.curl_easy_cleanup(h.easy);
+            allocator.destroy(h.node);
+        }
+    }
+
+    fn getFreeHandle(self: *Handles) ?*Handle {
+        if (self.available.popFirst()) |handle| {
+            return handle.data;
+        }
+        return null;
+    }
+
+    fn release(self: *Handles, handle: *Handle) void {
+        self.available.append(handle.node);
+    }
+};
+
+// wraps a c.CURL (an easy handle), mostly to make it easier to keep a
+// handle_pool and error_buffer associated with each easy handle
+const Handle = struct {
+    easy: *c.CURL,
+    client: *Client,
+    node: *Handles.FreeList.Node,
+    error_buffer: [c.CURL_ERROR_SIZE:0]u8 = undefined,
+
+    // Is called by Handles when already partially initialized. Done like this
+    // so that we have a stable pointer to error_buffer.
+    fn init(self: *Handle, ca_blob: c.curl_blob, opts: Client.Opts) !void {
+        const easy = c.curl_easy_init() orelse return error.FailedToInitializeEasy;
+        errdefer _ = c.curl_easy_cleanup(easy);
+
+        self.easy = easy;
+
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_ERRORBUFFER, &self.error_buffer));
+
+        // timeouts
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_TIMEOUT_MS, @as(c_long, @intCast(opts.timeout_ms))));
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_CONNECTTIMEOUT_MS, @as(c_long, @intCast(opts.connect_timeout_ms))));
+
+        // redirect behavior
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_MAXREDIRS, @as(c_long, @intCast(opts.max_redirects))));
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_FOLLOWLOCATION, @as(c_long, 2)));
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_REDIR_PROTOCOLS_STR, "HTTP,HTTPS")); // remove FTP and FTPS from the default
+
+        // callbacks
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_HEADERDATA, self));
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_HEADERFUNCTION, Transfer.headerCallback));
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_WRITEDATA, self));
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_WRITEFUNCTION, Transfer.bodyCallback));
+
+        // tls
+        // try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_SSL_VERIFYHOST, @as(c_long, 0)));
+        // try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_SSL_VERIFYPEER, @as(c_long, 0)));
+        try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_CAINFO_BLOB, ca_blob));
+
+        // debug
+        if (comptime ENABLE_DEBUG) {
+            try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_VERBOSE, @as(c_long, 1)));
+        }
+    }
+};
+
+pub const Request = struct {
+    method: Method,
+    url: [:0]const u8,
+    // arbitrary data that can be associated with this request
+    ctx: *anyopaque = undefined,
+
+    start_callback: ?*const fn(req: *Transfer) anyerror!void = noopStart,
+    header_callback: *const fn (req: *Transfer) anyerror!void,
+    data_callback: *const fn(req: *Transfer, data: []const u8) anyerror!void,
+    done_callback: *const fn(req: *Transfer) anyerror!void,
+    error_callback: *const fn(req: *Transfer, err: anyerror) void,
+};
+
+pub const Transfer = struct {
+    id: usize,
+    req: Request,
+    ctx: *anyopaque,
+
+    // We'll store the response header here
+    response_header: ?Header = null,
+
+    handle: *Handle,
+
+    _redirecting: bool = false,
+    // needs to be freed when we're done
+    _request_header_list: ?*c.curl_slist = null,
+
+    pub fn format(self: *const Transfer, comptime _: []const u8, _: std.fmt.FormatOptions, writer: anytype) !void {
+        const req = self.req;
+        return writer.print("[{d}] {s} {s}", .{self.id, @tagName(req.method), req.url});
+    }
+
+    fn onError(self: *Transfer, err: anyerror) void {
+        self.req.error_callback(self, err);
+    }
+
+    fn deinit(self: *Transfer) void {
+        if (self._request_header_list) |list| {
+            c.curl_slist_free_all(list);
+        }
+    }
+
+    fn headerCallback(buffer: [*]const u8, header_count: usize, buf_len: usize, data: *anyopaque) callconv(.c) usize {
+        // libcurl should only ever emit 1 header at a time
+        std.debug.assert(header_count == 1);
+
+        const handle: *Handle = @alignCast(@ptrCast(data));
+        var transfer = fromEasy(handle.easy) catch |err| {
+            handle.client.log("retrieve private info", err);
+            return 0;
+        };
+
+        const header = buffer[0..buf_len];
+
+        if (transfer.response_header == null) {
+            if (buf_len < 13 or std.mem.startsWith(u8, header, "HTTP/") == false) {
+                if (transfer._redirecting) {
+                    return buf_len;
+                }
+                transfer.onError(error.InvalidResponseLine);
+                return 0;
+            }
+            const version_start: usize = if (header[5] == '2') 7 else 9;
+            const version_end = version_start + 3;
+
+            // a bit silly, but it makes sure that we don't change the length check
+            // above in a way that could break this.
+            std.debug.assert(version_end < 13);
+
+            const status = std.fmt.parseInt(u16, header[version_start..version_end], 10) catch {
+                transfer.onError(error.InvalidResponseStatus);
+                return 0;
+            };
+
+            if (status >= 300 and status <= 399) {
+                transfer._redirecting = true;
+                return buf_len;
+            }
+            transfer._redirecting = false;
+
+            var url: [*c]u8 = undefined;
+            errorCheck(c.curl_easy_getinfo(handle.easy, c.CURLINFO_EFFECTIVE_URL, &url)) catch |err| {
+                transfer.onError(err);
+                return 0;
+            };
+
+            transfer.response_header = .{
+                .url = url,
+                .status = status,
+            };
+            return buf_len;
+        }
+
+        const CONTENT_TYPE_LEN = "content-type:".len;
+
+        var hdr = &transfer.response_header.?;
+        if (hdr._content_type_len == 0) {
+            if (buf_len > CONTENT_TYPE_LEN) {
+                if (std.ascii.eqlIgnoreCase(header[0..CONTENT_TYPE_LEN], "content-type:")) {
+                    const value = std.mem.trimLeft(u8, header[CONTENT_TYPE_LEN..], " ");
+                    // -2 to trim the trailing \r\n
+                    const len = @min(value.len - 2, hdr._content_type.len);
+                    hdr._content_type_len = len;
+                    @memcpy(hdr._content_type[0..len], value[0..len]);
+                }
+            }
+        }
+
+        if (buf_len == 2) {
+            transfer.req.header_callback(transfer) catch {
+                // returning < buf_len terminates the request
+                return 0;
+            };
+        }
+        return buf_len;
+    }
+
+    fn bodyCallback(buffer: [*]const u8, chunk_count: usize, chunk_len: usize, data: *anyopaque) callconv(.c) usize {
+        // libcurl should only ever emit 1 chunk at a time
+        std.debug.assert(chunk_count == 1);
+
+        const handle: *Handle = @alignCast(@ptrCast(data));
+        var transfer = fromEasy(handle.easy) catch |err| {
+            handle.client.log("retrieve private info", err);
+            return 0;
+        };
+
+        if (transfer._redirecting) {
+            return chunk_len;
+        }
+
+        transfer.req.data_callback(transfer, buffer[0..chunk_len]) catch {
+            return c.CURL_WRITEFUNC_ERROR;
+        };
+        return chunk_len;
+    }
+
+    fn fromEasy(easy: *c.CURL) !*Transfer {
+        var private: *anyopaque = undefined;
+        try errorCheck(c.curl_easy_getinfo(easy, c.CURLINFO_PRIVATE, &private));
+        return @alignCast(@ptrCast(private));
+    }
+};
+
+pub const Header = struct {
+    status: u16,
+    url: [*c]const u8,
+    _content_type_len: usize = 0,
+    _content_type: [64]u8 = undefined,
+
+    pub fn contentType(self: *Header) ?[]u8 {
+        if (self._content_type_len == 0) {
+            return null;
+        }
+        return self._content_type[0..self._content_type_len];
+    }
+};
+
+fn errorCheck(code: c.CURLcode) errors.Error!void {
+    if (code == c.CURLE_OK) {
+        return;
+    }
+    return errors.fromCode(code);
+}
+
+fn errorMCheck(code: c.CURLMcode) errors.Multi!void {
+    if (code == c.CURLM_OK) {
+        return;
+    }
+    if (code == c.CURLM_CALL_MULTI_PERFORM) {
+        // should we can client.perform() here?
+        // or just wait until the next time we naturally call it?
+        return;
+    }
+    return errors.fromMCode(code);
+}
+
+pub const Method = enum {
+    GET,
+    PUT,
+    POST,
+    DELETE,
+    HEAD,
+    OPTIONS,
+};
 
 pub const ProxyType = enum {
     forward,
@@ -49,3837 +533,12 @@ pub const ProxyType = enum {
 pub const ProxyAuth = union(enum) {
     basic: struct { user_pass: []const u8 },
     bearer: struct { token: []const u8 },
-
-    pub fn header_value(self: ProxyAuth, allocator: Allocator) ![]const u8 {
-        switch (self) {
-            .basic => |*auth| {
-                if (std.mem.indexOfScalar(u8, auth.user_pass, ':') == null) return error.InvalidProxyAuth;
-
-                const prefix = "Basic ";
-                var encoder = std.base64.standard.Encoder;
-                const size = encoder.calcSize(auth.user_pass.len);
-                var buffer = try allocator.alloc(u8, size + prefix.len);
-                @memcpy(buffer[0..prefix.len], prefix);
-                _ = std.base64.standard.Encoder.encode(buffer[prefix.len..], auth.user_pass);
-                return buffer;
-            },
-            .bearer => |*auth| {
-                const prefix = "Bearer ";
-                var buffer = try allocator.alloc(u8, auth.token.len + prefix.len);
-                @memcpy(buffer[0..prefix.len], prefix);
-                @memcpy(buffer[prefix.len..], auth.token);
-                return buffer;
-            },
-        }
-    }
 };
 
-// Thread-safe. Holds our root certificate, connection pool and state pool
-// Used to create Requests.
-pub const Client = struct {
-    loop: *Loop,
-    req_id: usize,
-    allocator: Allocator,
-    state_pool: StatePool,
-    http_proxy: ?Uri,
-    proxy_type: ?ProxyType,
-    proxy_auth: ?[]const u8, // Basic <user:pass; base64> or Bearer <token>
-    root_ca: std.crypto.Certificate.Bundle,
-    tls_verify_host: bool = true,
-    connection_manager: ConnectionManager,
-    request_pool: std.heap.MemoryPool(Request),
-
-    const Opts = struct {
-        max_concurrent: usize = 3,
-        http_proxy: ?std.Uri = null,
-        proxy_type: ?ProxyType = null,
-        proxy_auth: ?ProxyAuth = null,
-        tls_verify_host: bool = true,
-        max_idle_connection: usize = 10,
-    };
-
-    pub fn init(allocator: Allocator, loop: *Loop, opts: Opts) !Client {
-        var root_ca: std.crypto.Certificate.Bundle = if (builtin.is_test) .{} else try tls.config.cert.fromSystem(allocator);
-        errdefer root_ca.deinit(allocator);
-
-        var state_pool = try StatePool.init(allocator, opts.max_concurrent);
-        errdefer state_pool.deinit(allocator);
-
-        var connection_manager = ConnectionManager.init(allocator, opts.max_idle_connection);
-        errdefer connection_manager.deinit();
-
-        return .{
-            .req_id = 0,
-            .loop = loop,
-            .root_ca = root_ca,
-            .allocator = allocator,
-            .state_pool = state_pool,
-            .http_proxy = opts.http_proxy,
-            .proxy_type = if (opts.http_proxy == null) null else (opts.proxy_type orelse .connect),
-            .proxy_auth = if (opts.proxy_auth) |*auth| try auth.header_value(allocator) else null,
-            .tls_verify_host = opts.tls_verify_host,
-            .connection_manager = connection_manager,
-            .request_pool = std.heap.MemoryPool(Request).init(allocator),
-        };
-    }
-
-    pub fn deinit(self: *Client) void {
-        const allocator = self.allocator;
-        if (builtin.is_test == false) {
-            self.root_ca.deinit(allocator);
-        }
-        self.state_pool.deinit(allocator);
-        self.connection_manager.deinit();
-        self.request_pool.deinit();
-
-        if (self.proxy_auth) |auth| {
-            allocator.free(auth);
-        }
-    }
-
-    pub fn request(self: *Client, method: Request.Method, uri: *const Uri) !*Request {
-        const state = self.state_pool.acquireWait();
-        errdefer self.state_pool.release(state);
-
-        const req = try self.request_pool.create();
-        errdefer self.request_pool.destroy(req);
-
-        req.* = try Request.init(self, state, method, uri);
-        return req;
-    }
-
-    pub fn initAsync(
-        self: *Client,
-        arena: Allocator,
-        method: Request.Method,
-        uri: *const Uri,
-        ctx: *anyopaque,
-        callback: AsyncQueue.Callback,
-        opts: RequestOpts,
-    ) !void {
-
-        // See the page's DelayedNavitation for why we're doing this. TL;DR -
-        // we need to keep 1 slot available for the blocking page navigation flow
-        // (Almost worth keeping a dedicate State just for that flow, but keep
-        // thinking we need a more permanent solution (i.e. making everything
-        // non-blocking).
-        if (self.freeSlotCount() > 1) {
-            if (self.state_pool.acquireOrNull()) |state| {
-                // if we have state ready, we can skip the loop and immediately
-                // kick this request off.
-                return self.asyncRequestReady(method, uri, ctx, callback, state, opts);
-            }
-        }
-
-        // This cannot be a client-owned MemoryPool. The page can end before
-        // this is ever completed (and the check callback will never be called).
-        // As long as the loop doesn't guarantee that callbacks will be called,
-        // this _has_ to be the page arena.
-        const queue = try arena.create(AsyncQueue);
-        queue.* = .{
-            .ctx = ctx,
-            .uri = uri,
-            .opts = opts,
-            .client = self,
-            .method = method,
-            .callback = callback,
-            .node = .{ .func = AsyncQueue.check },
-        };
-        _ = try self.loop.timeout(10 * std.time.ns_per_ms, &queue.node);
-    }
-
-    // Either called directly from initAsync (if we have a state ready)
-    // Or from when the AsyncQueue(T) is ready.
-    fn asyncRequestReady(
-        self: *Client,
-        method: Request.Method,
-        uri: *const Uri,
-        ctx: *anyopaque,
-        callback: AsyncQueue.Callback,
-        state: *State,
-        opts: RequestOpts,
-    ) !void {
-        errdefer self.state_pool.release(state);
-
-        // We need the request on the heap, because it can have a longer lifetime
-        // than the code making the request. That sounds odd, but consider the
-        // case of an XHR request: it can still be inflight (e.g. waiting for
-        // the response) when the page gets unloaded. Once the page is unloaded
-        // the page arena is reset and the XHR instance becomes invalid. If the
-        // XHR instance owns the `Request`, we'd crash once an async callback
-        // executes.
-        const req = try self.request_pool.create();
-        errdefer self.request_pool.destroy(req);
-
-        req.* = try Request.init(self, state, method, uri);
-        if (opts.notification) |notification| {
-            req.notification = notification;
-        }
-
-        errdefer req.deinit();
-        try callback(ctx, req);
-    }
-
-    pub fn requestFactory(self: *Client, opts: RequestOpts) RequestFactory {
-        return .{
-            .opts = opts,
-            .client = self,
-        };
-    }
-
-    pub fn freeSlotCount(self: *Client) usize {
-        return self.state_pool.freeSlotCount();
-    }
-
-    fn isConnectProxy(self: *const Client) bool {
-        const proxy_type = self.proxy_type orelse return false;
-        return proxy_type == .connect;
-    }
-
-    fn isForwardProxy(self: *const Client) bool {
-        const proxy_type = self.proxy_type orelse return false;
-        return proxy_type == .forward;
-    }
-
-    fn isProxy(self: *const Client) bool {
-        return self.proxy_type != null;
-    }
-};
-
-const RequestOpts = struct {
-    notification: ?*Notification = null,
-};
-
-// A factory for creating requests with a given set of options.
-pub const RequestFactory = struct {
-    client: *Client,
-    opts: RequestOpts,
-
-    pub fn initAsync(
-        self: RequestFactory,
-        arena: Allocator,
-        method: Request.Method,
-        uri: *const Uri,
-        ctx: *anyopaque,
-        callback: AsyncQueue.Callback,
-    ) !void {
-        return self.client.initAsync(arena, method, uri, ctx, callback, self.opts);
-    }
-};
-
-const AsyncQueue = struct {
-    ctx: *anyopaque,
-    method: Request.Method,
-    uri: *const Uri,
-    client: *Client,
-    opts: RequestOpts,
-    node: Loop.CallbackNode,
-    callback: Callback,
-
-    const Callback = *const fn (*anyopaque, *Request) anyerror!void;
-
-    fn check(node: *Loop.CallbackNode, repeat_delay: *?u63) void {
-        const self: *AsyncQueue = @fieldParentPtr("node", node);
-        self._check(repeat_delay) catch |err| {
-            log.err(.http_client, "async queue check", .{ .err = err });
-        };
-    }
-
-    fn _check(self: *AsyncQueue, repeat_delay: *?u63) !void {
-        const client = self.client;
-        if (client.freeSlotCount() == 1) {
-            // always leave 1 free connection for sync requests
-            repeat_delay.* = 10 * std.time.ns_per_ms;
-            return;
-        }
-
-        const state = client.state_pool.acquireOrNull() orelse {
-            // re-run this function in 10 milliseconds
-            repeat_delay.* = 10 * std.time.ns_per_ms;
-            return;
-        };
-
-        try client.asyncRequestReady(
-            self.method,
-            self.uri,
-            self.ctx,
-            self.callback,
-            state,
-            self.opts,
-        );
-    }
-};
-
-// We assume most connections are going to end up in the IdleConnnection pool,
-// so this always end up in on the heap (as a *Connection) using the client's
-// connection_pool MemoryPool.
-// You'll notice that we have both this "Connection", and that both the SyncHandler
-// and the AsyncHandler have a "Conn". The "Conn" are a specialized version
-// of this "Connection". The SyncHandler.Conn provides a synchronous API over
-// the socket/tls. The AsyncHandler.Conn provides an asynchronous API over these.
-//
-// The Request and IdleConnections are the only ones that deal directly with this
-// "Connection" - and the variable name is "connection".
-//
-// The Sync/Async handlers deal only with their respective "Conn" - and the
-// variable name is "conn".
-const Connection = struct {
-    port: u16,
-    blocking: bool,
-    tls: ?TLSClient,
-    host: []const u8,
-    socket: posix.socket_t,
-
-    const TLSClient = union(enum) {
-        blocking: tls.Connection(std.net.Stream),
-        blocking_tlsproxy: struct {
-            proxy: tls.Connection(std.net.Stream), // Note, self-referential field. Proxy should be pinned in memory.
-            destination: tls.Connection(*tls.Connection(std.net.Stream)),
-        },
-        nonblocking: tls.nonblock.Connection,
-
-        fn close(self: *TLSClient) void {
-            switch (self.*) {
-                .blocking => |*tls_client| tls_client.close() catch {},
-                .blocking_tlsproxy => |*tls_in_tls| {
-                    tls_in_tls.destination.close() catch {};
-                    tls_in_tls.proxy.close() catch {};
-                },
-                .nonblocking => {},
-            }
-        }
-    };
-
-    fn deinit(self: *Connection, allocator: Allocator) void {
-        allocator.free(self.host);
-        if (self.tls) |*tls_client| {
-            tls_client.close();
-        }
-        posix.close(self.socket);
-    }
-};
-
-// Represents a request. Can be used to make either a synchronous or an
-// asynchronous request. When a synchronous request is made, `request.deinit()`
-// should be called once the response is no longer needed.
-// When an asychronous request is made, the request is automatically cleaned up
-// (but request.deinit() should still be called to discard the request
-// before the `sendAsync` is called).
-pub const Request = struct {
-    id: usize,
-
-    // The HTTP Method to use
-    method: Method,
-
-    // The URI we requested
-    request_uri: *const Uri,
-
-    // The URI that we're connecting to. Can be different than request_uri when
-    // proxying is enabled
-    connect_uri: *const Uri,
-
-    // If we're redirecting, this is where we're redirecting to. The only reason
-    // we really have this is so that we can set self.request_uri = &self.redirect_url.?
-    redirect_uri: ?Uri = null,
-
-    // Optional body
-    body: ?[]const u8,
-
-    // Arena used for the lifetime of the request. Most large allocations are
-    // either done through the state (pre-allocated on startup + pooled) or
-    // by the TLS library.
-    arena: Allocator,
-
-    // List of request headers
-    headers: std.ArrayListUnmanaged(std.http.Header),
-
-    // whether or not we should keep the underlying socket open and and usable
-    // for other requests
-    _keepalive: bool,
-
-    // extracted from request_uri
-    _request_port: u16,
-    _request_host: []const u8,
-    // Whether or not we expect this connection to be secure, connection may still be secure due to proxy
-    _request_secure: bool,
-    // Whether or not we expect the SIMPLE/CONNECT proxy connection to be secure
-    _proxy_secure: bool,
-
-    // extracted from connect_uri
-    _connect_port: u16,
-    _connect_host: []const u8,
-
-    // whether or not the socket comes from the connection pool. If it does,
-    // and we get an error sending the header, we might retry on a new connection
-    // because it's possible the other closed the connection, and that's no
-    // reason to fail the request.
-    _connection_from_keepalive: bool,
-
-    // Used to limit the # of redirects we'll follow
-    _redirect_count: u16,
-
-    // The actual connection, including the socket and, optionally, a TLS client
-    _connection: ?*Connection,
-
-    // Pooled buffers and arena
-    _state: *State,
-
-    // The parent client. Used to get the root certificates, to interact
-    // with the connection pool, and to return _state to the state pool when done
-    _client: *Client,
-
-    // Whether the Host header has been set via `request.addHeader()`. If not
-    // we'll set it based on `uri` before issuing the request.
-    _has_host_header: bool,
-
-    // Whether or not we should verify that the host matches the certificate CN
-    _tls_verify_host: bool,
-
-    // We only want to emit a start / complete notifications once per request.
-    // Because of things like redirects and error handling, it is possible for
-    // the notification functions to be called multiple times, so we guard them
-    // with these booleans
-    _notified_fail: bool,
-    _notified_start: bool,
-    _notified_complete: bool,
-
-    // The notifier that we emit request notifications to, if any.
-    notification: ?*Notification,
-
-    // Aborting an async request is complicated, as we need to wait until all
-    // in-flight IO events are completed. Our AsyncHandler is a generic type
-    // that we don't have the necessary type information for in the Request,
-    // so we need to rely on anyopaque.
-    _aborter: ?Aborter,
-
-    const Aborter = struct {
-        ctx: *anyopaque,
-        func: *const fn (*anyopaque) void,
-    };
-
-    pub const Method = enum {
-        GET,
-        PUT,
-        HEAD,
-        POST,
-        DELETE,
-        OPTIONS,
-
-        pub fn format(self: Method, comptime _: []const u8, _: std.fmt.FormatOptions, writer: anytype) !void {
-            return writer.writeAll(@tagName(self));
-        }
-
-        fn safeToRetry(self: Method) bool {
-            return self == .GET or self == .HEAD or self == .OPTIONS;
-        }
-    };
-
-    fn init(client: *Client, state: *State, method: Method, uri: *const Uri) !Request {
-        const decomposed = try decomposeURL(client, uri);
-
-        const id = client.req_id + 1;
-        client.req_id = id;
-
-        return .{
-            .id = id,
-            .request_uri = uri,
-            .connect_uri = decomposed.connect_uri,
-            .body = null,
-            .headers = .{},
-            .method = method,
-            .notification = null,
-            .arena = state.arena.allocator(),
-            ._connect_host = decomposed.connect_host,
-            ._connect_port = decomposed.connect_port,
-            ._proxy_secure = decomposed.proxy_secure,
-            ._request_host = decomposed.request_host,
-            ._request_port = decomposed.request_port,
-            ._request_secure = decomposed.request_secure,
-            ._state = state,
-            ._client = client,
-            ._aborter = null,
-            ._connection = null,
-            ._keepalive = false,
-            ._redirect_count = 0,
-            ._has_host_header = false,
-            ._notified_fail = false,
-            ._notified_start = false,
-            ._notified_complete = false,
-            ._connection_from_keepalive = false,
-            ._tls_verify_host = client.tls_verify_host,
-        };
-    }
-
-    pub fn deinit(self: *Request) void {
-        self.releaseConnection();
-        self._client.state_pool.release(self._state);
-        self._client.request_pool.destroy(self);
-    }
-
-    pub fn abort(self: *Request) void {
-        self.requestFailed("aborted");
-        const aborter = self._aborter orelse {
-            self.deinit();
-            return;
-        };
-        aborter.func(aborter.ctx);
-    }
-
-    const DecomposedURL = struct {
-        connect_port: u16,
-        connect_host: []const u8,
-        connect_uri: *const std.Uri,
-        proxy_secure: bool,
-        request_port: u16,
-        request_host: []const u8,
-        request_secure: bool,
-    };
-    fn decomposeURL(client: *const Client, uri: *const Uri) !DecomposedURL {
-        if (uri.host == null) {
-            return error.UriMissingHost;
-        }
-        const request_host = uri.host.?.percent_encoded;
-
-        var connect_uri = uri;
-        var connect_host = request_host;
-        if (client.http_proxy) |*proxy| {
-            connect_uri = proxy;
-            connect_host = proxy.host.?.percent_encoded;
-        }
-
-        var request_secure: bool = undefined;
-        if (std.ascii.eqlIgnoreCase(uri.scheme, "https")) {
-            request_secure = true;
-        } else if (std.ascii.eqlIgnoreCase(uri.scheme, "http")) {
-            request_secure = false;
-        } else {
-            return error.UnsupportedUriScheme;
-        }
-        const proxy_secure = client.http_proxy != null and std.ascii.eqlIgnoreCase(client.http_proxy.?.scheme, "https");
-
-        const request_port: u16 = uri.port orelse if (request_secure) 443 else 80;
-        const connect_port: u16 = connect_uri.port orelse blk: {
-            if (client.isConnectProxy()) {
-                if (proxy_secure) break :blk 443 else break :blk 80;
-            } else break :blk request_port;
-        };
-
-        return .{
-            .connect_port = connect_port,
-            .connect_host = connect_host,
-            .connect_uri = connect_uri,
-            .proxy_secure = proxy_secure,
-            .request_port = request_port,
-            .request_host = request_host,
-            .request_secure = request_secure,
-        };
-    }
-
-    // Called in deinit, but also called when we're redirecting to another page
-    fn releaseConnection(self: *Request) void {
-        const connection = self._connection orelse return;
-        self._connection = null;
-
-        if (self._keepalive == false) {
-            self._client.connection_manager.destroy(connection);
-            return;
-        }
-
-        self._client.connection_manager.keepIdle(connection) catch |err| {
-            self.destroyConnection(connection);
-            log.err(.http_client, "release to pool error", .{ .err = err });
-        };
-    }
-
-    fn createConnection(self: *Request, socket: posix.socket_t, blocking: bool) !*Connection {
-        const client = self._client;
-        const connection, const owned_host = try client.connection_manager.create(self._connect_host);
-
-        connection.* = .{
-            .tls = null,
-            .socket = socket,
-            .blocking = blocking,
-            .host = owned_host,
-            .port = self._connect_port,
-        };
-
-        return connection;
-    }
-
-    fn destroyConnection(self: *Request, connection: *Connection) void {
-        self._client.connection_manager.destroy(connection);
-    }
-
-    const AddHeaderOpts = struct {
-        dupe_name: bool = false,
-        dupe_value: bool = false,
-    };
-    pub fn addHeader(self: *Request, name: []const u8, value: []const u8, opts: AddHeaderOpts) !void {
-        const arena = self.arena;
-
-        var owned_name = name;
-        var owned_value = value;
-
-        if (opts.dupe_name) {
-            owned_name = try arena.dupe(u8, name);
-        }
-        if (opts.dupe_value) {
-            owned_value = try arena.dupe(u8, value);
-        }
-
-        if (self._has_host_header == false and std.ascii.eqlIgnoreCase(name, "host")) {
-            self._has_host_header = true;
-        }
-
-        try self.headers.append(arena, .{ .name = owned_name, .value = owned_value });
-    }
-
-    // TODO timeout
-    const SendSyncOpts = struct {
-        tls_verify_host: ?bool = null,
-    };
-    // Makes an synchronous request
-    pub fn sendSync(self: *Request, opts: SendSyncOpts) anyerror!Response {
-        if (opts.tls_verify_host) |override| {
-            self._tls_verify_host = override;
-        }
-
-        try self.prepareInitialSend();
-        return self.doSendSync(true);
-    }
-
-    // Called internally, follows a redirect.
-    fn redirectSync(self: *Request, redirect: Reader.Redirect) anyerror!Response {
-        try self.prepareToRedirect(redirect);
-        return self.doSendSync(true);
-    }
-
-    fn doSendSync(self: *Request, use_pool: bool) anyerror!Response {
-        // https://github.com/ziglang/zig/issues/20369
-        // errdefer |err| self.requestFailed(@errorName(err));
-        errdefer self.requestFailed("network error");
-
-        if (use_pool) {
-            if (self.findExistingConnection(true)) |connection| {
-                self._connection = connection;
-                self._connection_from_keepalive = true;
-            }
-        }
-
-        if (self._connection == null) {
-            const socket, const address = try self.createSocket(true);
-
-            posix.connect(socket, &address.any, address.getOsSockLen()) catch |err| {
-                posix.close(socket);
-                return err;
-            };
-
-            const connection = self.createConnection(socket, true) catch |err| {
-                posix.close(socket);
-                return err;
-            };
-            self._connection = connection;
-
-            const tls_config = tls.config.Client{
-                .host = self._request_host,
-                .root_ca = self._client.root_ca,
-                .insecure_skip_verify = self._tls_verify_host == false,
-                // .key_log_callback = tls.config.key_log.callback,
-            };
-
-            // proxy
-            const is_connect_proxy = self._client.isConnectProxy();
-
-            if (is_connect_proxy) {
-                var proxy_conn: SyncHandler.Conn = .{ .plain = self._connection.?.socket };
-
-                if (self._proxy_secure) {
-                    // Create an underlying TLS stream with the proxy
-                    var proxy_tls_config = tls_config;
-                    proxy_tls_config.host = self._connect_host;
-                    var proxy_conn_tls = try tls.client(std.net.Stream{ .handle = socket }, proxy_tls_config);
-                    proxy_conn = .{ .tls = &proxy_conn_tls };
-                }
-
-                // Connect to the proxy
-                try SyncHandler.connect(self, &proxy_conn);
-
-                if (self._proxy_secure) {
-                    if (self._request_secure) {
-                        // If secure endpoint, create the main TLS stream encapsulated into the TLS stream proxy
-                        self._connection.?.tls = .{
-                            .blocking_tlsproxy = .{
-                                .proxy = proxy_conn.tls.*,
-                                .destination = undefined,
-                            },
-                        };
-                        const proxy = &self._connection.?.tls.?.blocking_tlsproxy.proxy;
-                        self._connection.?.tls.?.blocking_tlsproxy.destination = try tls.client(proxy, tls_config);
-                    } else {
-                        // Otherwise, just use the TLS stream proxy
-                        self._connection.?.tls = .{ .blocking = proxy_conn.tls.* };
-                    }
-                }
-            }
-            if (self._request_secure and !self._proxy_secure and !self._client.isForwardProxy()) {
-                self._connection.?.tls = .{
-                    .blocking = try tls.client(std.net.Stream{ .handle = socket }, tls_config),
-                };
-            }
-
-            self._connection_from_keepalive = false;
-        }
-
-        var handler = SyncHandler{ .request = self };
-        return handler.send() catch |err| {
-            log.warn(.http_client, "sync error", .{
-                .err = err,
-                .method = self.method,
-                .url = self.request_uri,
-                .redirects = self._redirect_count,
-            });
-            return err;
-        };
-    }
-
-    const SendAsyncOpts = struct {
-        tls_verify_host: ?bool = null,
-    };
-    // Makes an asynchronous request
-    pub fn sendAsync(self: *Request, handler: anytype, opts: SendAsyncOpts) !void {
-        if (opts.tls_verify_host) |override| {
-            self._tls_verify_host = override;
-        }
-        try self.prepareInitialSend();
-        return self.doSendAsync(handler, true);
-    }
-    pub fn redirectAsync(self: *Request, redirect: Reader.Redirect, handler: anytype) !void {
-        try self.prepareToRedirect(redirect);
-        return self.doSendAsync(handler, true);
-    }
-
-    fn doSendAsync(self: *Request, handler: anytype, use_pool: bool) !void {
-        if (use_pool) {
-            if (self.findExistingConnection(false)) |connection| {
-                self._connection = connection;
-                self._connection_from_keepalive = true;
-            }
-        }
-
-        var address: std.net.Address = undefined;
-        if (self._connection == null) {
-            const socket, address = try self.createSocket(false);
-            errdefer posix.close(socket);
-
-            // It seems wrong to set self._connection here. While we have a
-            // connection, it isn't yet connected. PLUS, if this is a secure
-            // connection, we also don't have a handshake.
-            // But, request._connection only ever gets released to the idle pool
-            // when request._keepalive == true. And this can only be true _after_
-            // we've processed the request - at which point, we'd obviously be
-            // connected + handshake.
-            self._connection = try self.createConnection(socket, false);
-            self._connection_from_keepalive = false;
-        }
-
-        const connection = self._connection.?;
-        errdefer self.destroyConnection(connection);
-
-        const loop = self._client.loop;
-
-        const AsyncHandlerT = AsyncHandler(@TypeOf(handler));
-        const async_handler = try self.arena.create(AsyncHandlerT);
-
-        const state = self._state;
-        async_handler.* = .{
-            .loop = loop,
-            .request = self,
-            .handler = handler,
-            .read_buf = state.read_buf,
-            .write_buf = state.write_buf,
-            .reader = self.newReader(),
-            .socket = connection.socket,
-            .conn = .{ .handler = async_handler, .protocol = .{ .plain = {} } },
-        };
-
-        if (self._client.isConnectProxy() and self._proxy_secure) {
-            log.warn(.http, "not implemented", .{ .feature = "async tls connect" });
-        }
-
-        if (self._connection_from_keepalive) {
-            if ((self._client.isProxy() and self._proxy_secure) or (!self._client.isForwardProxy() and self._request_secure)) {
-                // If the connection came from the keepalive pool, than we already have a TLS Connection.
-                async_handler.conn.protocol = .{ .encrypted = .{ .conn = &connection.tls.?.nonblocking } };
-            }
-            // We're already connected
-            async_handler.pending_connect = false;
-            return async_handler.conn.connected();
-        }
-
-        self._aborter = .{
-            .ctx = async_handler,
-            .func = AsyncHandlerT.abort,
-        };
-
-        return loop.connect(
-            AsyncHandlerT,
-            async_handler,
-            &async_handler.read_completion,
-            AsyncHandlerT.connected,
-            connection.socket,
-            address,
-        );
-    }
-
-    fn newReader(self: *Request) Reader {
-        return Reader.init(self._state);
-    }
-
-    // Does additional setup of the request for the firsts (i.e. non-redirect) call.
-    fn prepareInitialSend(self: *Request) !void {
-        const arena = self.arena;
-        if (self.body) |body| {
-            const cl = try std.fmt.allocPrint(arena, "{d}", .{body.len});
-            try self.headers.append(arena, .{ .name = "Content-Length", .value = cl });
-        }
-
-        if (!self._has_host_header) {
-            try self.headers.append(arena, .{ .name = "Host", .value = self._request_host });
-        }
-
-        try self.headers.append(arena, .{ .name = "User-Agent", .value = "Lightpanda/1.0" });
-        try self.headers.append(arena, .{ .name = "Accept", .value = "*/*" });
-
-        if (self._client.isForwardProxy()) {
-            if (self._client.proxy_auth) |proxy_auth| {
-                try self.headers.append(arena, .{ .name = "Proxy-Authorization", .value = proxy_auth });
-            }
-        }
-
-        self.requestStarting();
-    }
-
-    // Sets up the request for redirecting.
-    fn prepareToRedirect(self: *Request, redirect: Reader.Redirect) !void {
-        self.releaseConnection();
-
-        // CANNOT reset the arena (╥﹏╥)
-        // We need it for self.request_uri (which we're about to use to resolve
-        // redirect.location, and it might own some/all headers)
-
-        const redirect_count = self._redirect_count;
-        if (redirect_count == 10) {
-            return error.TooManyRedirects;
-        }
-
-        var buf = try self.arena.alloc(u8, 2048);
-
-        const previous_request_host = self._request_host;
-        self.redirect_uri = try self.request_uri.resolve_inplace(redirect.location, &buf);
-
-        self.request_uri = &self.redirect_uri.?;
-        const decomposed = try decomposeURL(self._client, self.request_uri);
-        self.connect_uri = decomposed.connect_uri;
-        self._request_host = decomposed.request_host;
-        self._request_secure = decomposed.request_secure;
-        self._connect_host = decomposed.connect_host;
-        self._connect_port = decomposed.connect_port;
-        self._proxy_secure = decomposed.proxy_secure;
-        self._keepalive = false;
-        self._redirect_count = redirect_count + 1;
-
-        if (redirect.use_get) {
-            // Some redirect status codes _require_ that we switch the method
-            // to a GET.
-            self.method = .GET;
-        }
-        log.debug(.http, "redirecting", .{ .method = self.method, .url = self.request_uri });
-
-        if (self.body != null and self.method == .GET) {
-            // If we have a body and the method is a GET, then we must be following
-            // a redirect which switched the method. Remove the body.
-            // Reset the Content-Length
-            self.body = null;
-            for (self.headers.items) |*hdr| {
-                if (std.mem.eql(u8, hdr.name, "Content-Length")) {
-                    hdr.value = "0";
-                    break;
-                }
-            }
-        }
-
-        if (std.mem.eql(u8, previous_request_host, self._request_host) == false) {
-            for (self.headers.items) |*hdr| {
-                if (std.mem.eql(u8, hdr.name, "Host")) {
-                    hdr.value = self._request_host;
-                    break;
-                }
-            }
-        }
-    }
-
-    fn findExistingConnection(self: *Request, blocking: bool) ?*Connection {
-        // This is being overly cautious, but it's a bit risky to re-use
-        // connections for other methods. It isn't so much re-using the
-        // connection that's the issue, it's dealing with a write error
-        // when trying to send the request and deciding whether or not we
-        // should retry the request.
-        if (self.method.safeToRetry() == false) {
-            return null;
-        }
-
-        if (self.body != null) {
-            return null;
-        }
-
-        // A simple http proxy to an https destination is made into tls by the proxy, we see it as a plain connection
-        const expect_tls = self._proxy_secure or (self._request_secure and !self._client.isForwardProxy());
-        return self._client.connection_manager.get(expect_tls, self._connect_host, self._connect_port, blocking);
-    }
-
-    fn createSocket(self: *Request, blocking: bool) !struct { posix.socket_t, std.net.Address } {
-        const addresses = try std.net.getAddressList(self.arena, self._connect_host, self._connect_port);
-        if (addresses.addrs.len == 0) {
-            return error.UnknownHostName;
-        }
-
-        // TODO: rotate?
-        const address = addresses.addrs[0];
-
-        const sock_flags = posix.SOCK.STREAM | posix.SOCK.CLOEXEC | if (blocking) @as(u32, 0) else posix.SOCK.NONBLOCK;
-        const socket = try posix.socket(address.any.family, sock_flags, posix.IPPROTO.TCP);
-        errdefer posix.close(socket);
-
-        if (@hasDecl(posix.TCP, "NODELAY")) {
-            try posix.setsockopt(socket, posix.IPPROTO.TCP, posix.TCP.NODELAY, &std.mem.toBytes(@as(c_int, 1)));
-        }
-        return .{ socket, address };
-    }
-
-    fn buildHeader(self: *Request) ![]const u8 {
-        const proxied = self._client.isForwardProxy();
-
-        const buf = self._state.header_buf;
-        var fbs = std.io.fixedBufferStream(buf);
-        var writer = fbs.writer();
-
-        try writer.writeAll(@tagName(self.method));
-        try writer.writeByte(' ');
-        try self.request_uri.writeToStream(.{ .scheme = proxied, .authority = proxied, .path = true, .query = true }, writer);
-        try writer.writeAll(" HTTP/1.1\r\n");
-        for (self.headers.items) |header| {
-            try writer.writeAll(header.name);
-            try writer.writeAll(": ");
-            try writer.writeAll(header.value);
-            try writer.writeAll("\r\n");
-        }
-        try writer.writeAll("\r\n");
-        return buf[0..fbs.pos];
-    }
-
-    fn buildConnectHeader(self: *Request) ![]const u8 {
-        const buf = self._state.header_buf;
-        var fbs = std.io.fixedBufferStream(buf);
-        var writer = fbs.writer();
-
-        try writer.print("CONNECT {s}:{d} HTTP/1.1\r\n", .{ self._request_host, self._request_port });
-        try writer.print("Host: {s}:{d}\r\n", .{ self._request_host, self._request_port });
-
-        if (self._client.proxy_auth) |proxy_auth| {
-            try writer.print("Proxy-Authorization: {s}\r\n", .{proxy_auth});
-        }
-
-        _ = try writer.write("\r\n");
-        return buf[0..fbs.pos];
-    }
-
-    fn requestStarting(self: *Request) void {
-        const notification = self.notification orelse return;
-        if (self._notified_start) {
-            return;
-        }
-        self._notified_start = true;
-        notification.dispatch(.http_request_start, &.{
-            .arena = self.arena,
-            .id = self.id,
-            .url = self.request_uri,
-            .method = self.method,
-            .headers = &self.headers,
-            .has_body = self.body != null,
-        });
-    }
-
-    fn requestFailed(self: *Request, err: []const u8) void {
-        const notification = self.notification orelse return;
-        if (self._notified_fail) {
-            return;
-        }
-        self._notified_fail = true;
-        notification.dispatch(.http_request_fail, &.{
-            .id = self.id,
-            .err = err,
-            .url = self.request_uri,
-        });
-    }
-
-    fn requestCompleted(self: *Request, response: ResponseHeader, can_keepalive: bool) void {
-        const notification = self.notification orelse return;
-        if (self._notified_complete) {
-            return;
-        }
-
-        self._notified_complete = true;
-        self._keepalive = can_keepalive;
-        notification.dispatch(.http_request_complete, &.{
-            .id = self.id,
-            .url = self.request_uri,
-            .status = response.status,
-            .headers = response.headers.items,
-        });
-    }
-
-    fn shouldProxyConnect(self: *const Request) bool {
-        // if the connection comes from a keepalive pool, than we already
-        // made a CONNECT request
-        if (self._connection_from_keepalive) {
-            return false;
-        }
-        return self._client.isConnectProxy();
-    }
-};
-
-// Handles asynchronous requests
-fn AsyncHandler(comptime H: type) type {
-    return struct {
-        loop: *Loop,
-        handler: H,
-        request: *Request,
-        read_buf: []u8,
-
-        // When we're using TLS, we'll probably need to keep read_buf intact
-        // until we get a ful TLS record. `read_pos` is the position into `read_buf`
-        // that we have valid, but unprocessed, data up to.
-        read_pos: usize = 0,
-
-        // need a separate read and write buf because, with TLS, messages are
-        // not strictly req->resp.
-        write_buf: []u8,
-
-        socket: posix.socket_t,
-        read_completion: IO.Completion = undefined,
-        send_completion: IO.Completion = undefined,
-
-        // used for parsing the response
-        reader: Reader,
-
-        // Can only ever have 1 inflight write to a socket (multiple could
-        // get interleaved). You'd think this isn't normally a problem: send
-        // the header, send the body (or maybe send them together!), but with TLS
-        // we have no guarantee from the library whether or not it'll want us
-        // to make multiple writes
-        send_queue: SendQueue = .{},
-
-        // Used to help us know if we're writing the header or the body;
-        state: SendState = .handshake,
-
-        // Abstraction over TLS and plain text socket, this is a version of
-        // the request._connection (which is a *Connection) that is async-specific.
-        conn: Conn,
-
-        // This will be != null when we're supposed to redirect AND we've
-        // drained the response body. We need this as a field, because we'll
-        // detect this inside our TLS onRecv callback (which is executed
-        // inside the TLS client, and so we can't deinitialize the tls_client)
-        redirect: ?Reader.Redirect = null,
-
-        // There can be cases where we're forced to read the whole body into
-        // memory in order to process it (*cough* CloudFront incorrectly sending
-        // gzipped responses *cough*)
-        full_body: ?std.ArrayListUnmanaged(u8) = null,
-
-        // Shutting down an async request requires that we wait for all inflight
-        // IO to be completed. So we need to track what inflight requests we
-        // have and whether or not we're shutting down
-        shutdown: bool = false,
-        pending_write: bool = false,
-        pending_receive: bool = false,
-        pending_connect: bool = true,
-
-        const Self = @This();
-        const SendQueue = std.DoublyLinkedList([]const u8);
-
-        const SendState = enum {
-            connect,
-            handshake,
-            header,
-            body,
-        };
-
-        const ProcessStatus = enum {
-            wait,
-            done,
-            need_more,
-            handler_error,
-        };
-
-        fn deinit(self: *Self) void {
-            self.request.deinit();
-        }
-
-        fn abort(ctx: *anyopaque) void {
-            var self: *Self = @alignCast(@ptrCast(ctx));
-            self.shutdown = true;
-            posix.shutdown(self.request._connection.?.socket, .both) catch {};
-            self.maybeShutdown();
-        }
-
-        fn connected(self: *Self, _: *IO.Completion, result: IO.ConnectError!void) void {
-            self.pending_connect = false;
-            if (self.shutdown) {
-                return self.maybeShutdown();
-            }
-
-            result catch |err| return self.handleError("Connection failed", err);
-
-            const request = self.request;
-            if ((request._client.isProxy() and request._proxy_secure) or (!request._client.isForwardProxy() and request._request_secure)) {
-                std.debug.assert(request._connection.?.tls == null);
-                self.conn.protocol = .{
-                    .handshake = tls.nonblock.Client.init(.{
-                        .host = if (request._client.isConnectProxy()) request._request_host else request._connect_host,
-                        .root_ca = request._client.root_ca,
-                        .insecure_skip_verify = request._tls_verify_host == false,
-                        .key_log_callback = tls.config.key_log.callback,
-                    }),
-                };
-            }
-
-            if (self.request.shouldProxyConnect()) {
-                self.state = .connect;
-                const header = self.request.buildConnectHeader() catch |err| {
-                    return self.handleError("Failed to build CONNECT header", err);
-                };
-                self.send(header);
-                self.receive();
-                return;
-            }
-
-            self.conn.connected() catch |err| {
-                self.handleError("connected handler error", err);
-            };
-        }
-
-        fn send(self: *Self, data: []const u8) void {
-            const node = self.request.arena.create(SendQueue.Node) catch |err| {
-                self.handleError("out of memory", err);
-                return;
-            };
-
-            node.data = data;
-            self.send_queue.append(node);
-            if (self.send_queue.len > 1) {
-                // if we already had a message in the queue, then our send loop
-                // is already setup.
-                return;
-            }
-
-            self.pending_write = true;
-            self.loop.send(
-                Self,
-                self,
-                &self.send_completion,
-                sent,
-                self.socket,
-                node.data,
-            ) catch |err| {
-                self.handleError("loop send error", err);
-            };
-        }
-
-        fn sent(self: *Self, _: *IO.Completion, n_: IO.SendError!usize) void {
-            self.pending_write = false;
-            if (self.shutdown) {
-                return self.maybeShutdown();
-            }
-            const n = n_ catch |err| {
-                return self.handleError("Write error", err);
-            };
-
-            const node = self.send_queue.first.?;
-            const data = node.data;
-            var next: ?*SendQueue.Node = node;
-            if (n == data.len) {
-                _ = self.send_queue.popFirst();
-                next = node.next;
-            } else {
-                // didn't send all the data, we prematurely popped this off
-                // (because, in most cases, it _will_ send all the data)
-                node.data = data[n..];
-            }
-
-            if (next) |next_| {
-                self.pending_write = true;
-                // we still have data to send
-                self.loop.send(
-                    Self,
-                    self,
-                    &self.send_completion,
-                    sent,
-                    self.socket,
-                    next_.data,
-                ) catch |err| {
-                    self.handleError("loop send error", err);
-                };
-                return;
-            }
-
-            if (self.state == .connect) {
-                // We're in a proxy CONNECT flow. There's nothing for us to
-                // do except for wait for the response.
-                return;
-            }
-
-            self.conn.sent() catch |err| {
-                self.handleError("send handling", err);
-            };
-        }
-
-        // Normally, you'd think of HTTP as being a straight up request-response
-        // and that we can send, and then receive. But with TLS, we need to receive
-        // while handshaking and potentially while sending data. So we're always
-        // receiving.
-        fn receive(self: *Self) void {
-            if (self.pending_receive) {
-                return;
-            }
-
-            self.pending_receive = true;
-            self.loop.recv(
-                Self,
-                self,
-                &self.read_completion,
-                Self.received,
-                self.socket,
-                self.read_buf[self.read_pos..],
-            ) catch |err| {
-                self.handleError("loop recv error", err);
-            };
-        }
-
-        fn received(self: *Self, _: *IO.Completion, n_: IO.RecvError!usize) void {
-            self.pending_receive = false;
-            if (self.shutdown) {
-                return self.maybeShutdown();
-            }
-
-            const n = n_ catch |err| {
-                return self.handleError("Read error", err);
-            };
-            if (n == 0) {
-                if (self.maybeRetryRequest()) {
-                    return;
-                }
-                return self.handleError("Connection closed", error.ConnectionResetByPeer);
-            }
-
-            const data = self.read_buf[0 .. self.read_pos + n];
-
-            if (self.state == .connect) {
-                const success = self.reader.connectResponse(data) catch |err| {
-                    return self.handleError("Invalid CONNECT response", err);
-                };
-
-                if (!success) {
-                    self.receive();
-                } else {
-                    // CONNECT was successful, resume our normal flow
-                    self.state = .handshake;
-                    self.reader = self.request.newReader();
-                    self.conn.connected() catch |err| {
-                        self.handleError("connected handler error", err);
-                    };
-                }
-                return;
-            }
-
-            const status = self.conn.received(data) catch |err| {
-                if (err == error.TlsAlertCloseNotify and self.state == .handshake and self.maybeRetryRequest()) {
-                    return;
-                }
-
-                self.handleError("data processing", err);
-                return;
-            };
-
-            switch (status) {
-                .wait => {},
-                .need_more => self.receive(),
-                .handler_error => {
-                    // handler should never have been called if we're redirecting
-                    std.debug.assert(self.redirect == null);
-                    self.request.requestCompleted(self.reader.response, self.reader.keepalive);
-                    self.deinit();
-                    return;
-                },
-                .done => {
-                    const redirect = self.redirect orelse {
-                        var handler = self.handler;
-                        self.request.requestCompleted(self.reader.response, self.reader.keepalive);
-                        self.deinit();
-
-                        // Emit the done chunk. We expect the caller to do
-                        // processing once the full request is completed. By
-                        // emiting this AFTER we've relreased the connection,
-                        // we free the connection and its state for re-use.
-                        // If we don't do this this way, we can end up with
-                        // _a lot_ of pending request/states.
-                        // DO NOT USE `self` here, it's no longer valid.
-                        handler.onHttpResponse(.{
-                            .data = null,
-                            .done = true,
-                            .first = false,
-                            .header = .{},
-                        }) catch {};
-                        return;
-                    };
-
-                    self.request.redirectAsync(redirect, self.handler) catch |err| {
-                        self.handleError("Setup async redirect", err);
-                        return;
-                    };
-                    // redirectAsync has given up any claim to the request,
-                    // including the socket.
-                },
-            }
-        }
-
-        fn maybeShutdown(self: *Self) void {
-            std.debug.assert(self.shutdown);
-            if (self.pending_write or self.pending_receive or self.pending_connect) {
-                return;
-            }
-
-            // Who knows what state we're in, safer to not try to re-use the connection
-            self.request._keepalive = false;
-            self.request.deinit();
-        }
-
-        // If our socket came from the connection pool, it's possible that we're
-        // failing because it's since timed out. If
-        fn maybeRetryRequest(self: *Self) bool {
-            const request = self.request;
-
-            // We only retry if the connection came from the keepalive pool
-            // We only use a keepalive connection for specific methods and if
-            // there's no body.
-            if (request._connection_from_keepalive == false) {
-                return false;
-            }
-
-            // Because of the `self.state == .body` check above, it should be
-            // impossible to be here and have this be true. This is an important
-            // check, because we're about to release a connection that we know
-            // is bad, and we don't want it to go back into the pool.
-            std.debug.assert(request._keepalive == false);
-            request.releaseConnection();
-
-            request.doSendAsync(self.handler, false) catch |conn_err| {
-                // You probably think it's weird that we fallthrough to the:
-                //   return true;
-                // The caller will take the `true` and just exit. This is what
-                // we want in this error case, because the next line handles
-                // the error. We rather emit an "connection error" at this point
-                // than whatever error we had using the pooled connection.
-                self.handleError("connection error", conn_err);
-            };
-
-            return true;
-        }
-
-        fn processData(self: *Self, d: []u8) ProcessStatus {
-            const reader = &self.reader;
-
-            var data = d;
-            while (true) {
-                const would_be_first = reader.header_done == false;
-                const result = reader.process(data) catch |err| {
-                    self.handleError("Invalid server response", err);
-                    return .done;
-                };
-
-                if (reader.header_done == false) {
-                    // need more data
-                    return .need_more;
-                }
-
-                // at this point, If `would_be_first == true`, then
-                // `would_be_first` should be thought of as `is_first` because
-                // we now have a complete header for the first time.
-                if (reader.redirect()) |redirect| {
-                    // We don't redirect until we've drained the body (to be
-                    // able to re-use the connection for keepalive).
-                    // Calling `reader.redirect()` over and over again might not
-                    // be the most efficient (it's a very simple function though),
-                    // but for a redirect response, chances are we slurped up
-                    // the header and body in a single go.
-                    if (result.done == false) {
-                        return .need_more;
-                    }
-                    self.redirect = redirect;
-                    return .done;
-                }
-
-                if (would_be_first) {
-                    if (reader.response.get("content-encoding")) |ce| {
-                        if (std.ascii.eqlIgnoreCase(ce, "gzip") == false) {
-                            self.handleError("unsupported content encoding", error.UnsupportedContentEncoding);
-                            return .done;
-                        }
-                        // Our requests _do not_ include an Accept-Encoding header
-                        // but some servers (e.g. CloudFront) can send gzipped
-                        // responses nonetheless. Zig's compression libraries
-                        // do not work well with our async flow - they expect
-                        // to be able to read(buf) more data as needed, instead
-                        // of having us yield new data as it becomes available.
-                        // If async ever becomes a first class citizen, we could
-                        // expect this problem to go away. But, for now, we're
-                        // going to read the _whole_ body into memory. It makes
-                        // our life a lot easier, but it's still a mess.
-                        self.full_body = .empty;
-                    }
-                }
-
-                const done = result.done;
-
-                // see a few lines up, if this isn't null, something decided
-                // we should buffer the entire body into memory.
-                if (self.full_body) |*full_body| {
-                    if (result.data) |chunk| {
-                        full_body.appendSlice(self.request.arena, chunk) catch |err| {
-                            self.handleError("response buffering error", err);
-                            return .done;
-                        };
-                    }
-
-                    // when buffering the body into memory, we only emit it once
-                    // everything is done (because we need to process the body
-                    // as a whole)
-                    if (done) {
-                        // We should probably keep track of _why_ we're buffering
-                        // the body into memory. But, for now, the only possible
-                        // reason is that the response was gzipped. That means
-                        // we need to decompress it.
-                        var fbs = std.io.fixedBufferStream(full_body.items);
-                        var decompressor = std.compress.gzip.decompressor(fbs.reader());
-                        var next = decompressor.next() catch |err| {
-                            self.handleError("decompression error", err);
-                            return .done;
-                        };
-
-                        var first = true;
-                        while (next) |chunk| {
-                            // we need to know if there's another chunk so that
-                            // we know if done should be true or false
-                            next = decompressor.next() catch |err| {
-                                self.handleError("decompression error", err);
-                                return .done;
-                            };
-
-                            self.handler.onHttpResponse(.{
-                                .data = chunk,
-                                .first = first,
-                                .done = false,
-                                .header = reader.response,
-                            }) catch return .handler_error;
-
-                            first = false;
-                        }
-                    }
-                } else if (result.data != null or would_be_first) {
-                    // If we have data. Or if the request is done. Or if this is the
-                    // first time we have a complete header. Emit the chunk.
-                    self.handler.onHttpResponse(.{
-                        .done = false,
-                        .data = result.data,
-                        .first = would_be_first,
-                        .header = reader.response,
-                    }) catch return .handler_error;
-                }
-
-                if (done == true) {
-                    return .done;
-                }
-
-                // With chunked-encoding, it's possible that we we've only
-                // partially processed the data. So we need to keep processing
-                // any unprocessed data. It would be nice if we could just glue
-                // this all together, but that would require copying bytes around
-                data = result.unprocessed orelse return .need_more;
-            }
-        }
-
-        fn handleError(self: *Self, comptime msg: []const u8, err: anyerror) void {
-            log.err(.http_client, msg, .{
-                .err = err,
-                .method = self.request.method,
-                .url = self.request.request_uri,
-            });
-
-            self.handler.onHttpResponse(err) catch {};
-            // just to be safe
-            self.request._keepalive = false;
-
-            self.request.requestFailed(@errorName(err));
-            self.request.deinit();
-        }
-
-        const Conn = struct {
-            handler: *Self,
-            protocol: Protocol,
-
-            const Encrypted = struct {
-                conn: *tls.nonblock.Connection,
-                // If we want to send "XYZ", we'll ask conn to encrypt it. But
-                // the result might not fit in our write buffer. The encrypt
-                // return tells us what part of "XYZ" wasn't encrypted. We need
-                // to keep this around, so that when our writer buffer becomes
-                // available (when our send is complete), we can continue
-                // encrypting + sending the unsent part.
-                unsent: []const u8 = "",
-            };
-
-            const Protocol = union(enum) {
-                plain: void,
-                encrypted: Encrypted,
-                handshake: tls.nonblock.Client,
-            };
-
-            fn connected(self: *Conn) !void {
-                const handler = self.handler;
-
-                std.debug.assert(handler.state == .handshake);
-                switch (self.protocol) {
-                    .plain => {
-                        handler.state = .header;
-                        const header = try handler.request.buildHeader();
-                        handler.send(header);
-                    },
-                    .encrypted => |*encrypted| {
-                        // If we're here, it means that we've just "connected"
-                        // from a keepalive connection. We already did the
-                        // handshake in a previous request (which is why we now
-                        // have an encrypted connection) and can send the request
-                        // header directly.
-                        std.debug.assert(handler.request._connection_from_keepalive);
-                        try self.sendHeaderEncrypted(encrypted);
-                    },
-                    .handshake => |*handshake| {
-                        // initiate the handshake
-                        const res = try handshake.run(handler.read_buf[0..0], handler.write_buf);
-
-                        // there should always be something to send
-                        std.debug.assert(res.send.len > 0);
-                        handler.send(res.send);
-
-                        // Regardless of the TLS version, our handshake cannot
-                        // be done at this point.
-                        std.debug.assert(handshake.done() == false);
-
-                        handler.receive();
-                    },
-                }
-            }
-
-            fn received(self: *Conn, data: []u8) !ProcessStatus {
-                const handler = self.handler;
-                switch (self.protocol) {
-                    .plain => {
-                        std.debug.assert(handler.state == .body);
-                        return handler.processData(data);
-                    },
-                    .encrypted => |*encrypted| {
-                        std.debug.assert(handler.state == .body);
-                        const res = try encrypted.conn.decrypt(data, data);
-
-                        if (res.ciphertext_pos == 0) {
-                            // no part of the encrypted data was consumed
-                            // no cleartext data should have been generated
-                            std.debug.assert(res.cleartext.len == 0);
-
-                            // our next read needs to append more data to
-                            // the existing data
-                            handler.read_pos = data.len;
-                            return if (res.closed) .done else .need_more;
-                        }
-
-                        var status = ProcessStatus.need_more;
-
-                        if (res.cleartext.len > 0) {
-                            status = handler.processData(res.cleartext);
-                        }
-
-                        if (res.closed) {
-                            return .done;
-                        }
-
-                        const unused = res.unused_ciphertext;
-                        if (unused.len == 0) {
-                            // all of data was used up, our next read can use
-                            // the whole read buffer.
-                            handler.read_pos = 0;
-                            return status;
-                        }
-
-                        // We used some of the data, but have some leftover
-                        // (i.e. there was 1+ full records AND an incomplete
-                        // record). We need to maintain the "leftover" data
-                        // for subsequent reads.
-
-                        // Remember that our read_buf is the MAX possible TLS
-                        // record size. So as long as we make sure that the start
-                        // of a record is at read_buf[0], we know that we'll
-                        // always have enough space for 1 record.
-                        std.mem.copyForwards(u8, handler.read_buf, unused);
-                        handler.read_pos = unused.len;
-
-                        // an incomplete record means there must be more data
-                        return .need_more;
-                    },
-                    .handshake => |*handshake| {
-                        std.debug.assert(handler.state == .handshake);
-                        const res = try handshake.run(data, handler.write_buf);
-
-                        if (res.send.len > 0) {
-                            handler.send(res.send);
-                        } else if (handshake.done()) {
-                            // if our handshake is done, all of our received data
-                            // should have been used
-                            std.debug.assert(res.unused_recv.len == 0);
-                            handler.read_pos = 0;
-                            try self.upgradeHandshake(handshake.cipher().?);
-
-                            // the next step after sendind the header is to wait
-                            // for the sent() callback, so that we know the header
-                            // has been sent and we can either send the body
-                            // or start receiving the response.
-                            return .wait;
-                        }
-
-                        const unused = res.unused_recv;
-                        if (unused.len == 0) {
-                            handler.read_pos = 0;
-                        } else {
-                            std.mem.copyForwards(u8, handler.read_buf, unused);
-                            handler.read_pos = unused.len;
-                        }
-
-                        // whether we have unused data or not, our handshake
-                        // isn't done, so we need more data.
-                        return .need_more;
-                    },
-                }
-            }
-
-            fn sent(self: *Conn) !void {
-                const handler = self.handler;
-                switch (self.protocol) {
-                    .plain => switch (handler.state) {
-                        .handshake, .connect => unreachable,
-                        .header => return self.sendBody(),
-                        .body => {},
-                    },
-                    .encrypted => |*encrypted| {
-                        if (encrypted.unsent.len > 0) {
-                            return self.send(encrypted.unsent);
-                        }
-                        switch (handler.state) {
-                            .handshake, .connect => unreachable,
-                            .header => return self.sendBody(),
-                            .body => {},
-                        }
-                    },
-                    .handshake => |*handshake| {
-                        if (handshake.done()) {
-                            return self.upgradeHandshake(handshake.cipher().?);
-                        }
-                        // else still handshaking, nothing to do until we
-                        // receive data
-                    },
-                }
-            }
-
-            fn upgradeHandshake(self: *Conn, cipher: anytype) !void {
-                const encrypted = tls.nonblock.Connection.init(cipher);
-
-                // Hack, but we need to store this in the underlying
-                // connection object, since that's what we "keepalive".
-                var handler = self.handler;
-                std.debug.assert(handler.request._connection.?.tls == null);
-                handler.request._connection.?.tls = .{ .nonblocking = encrypted };
-                self.protocol = .{
-                    .encrypted = .{
-                        .conn = &handler.request._connection.?.tls.?.nonblocking,
-                    },
-                };
-                try self.sendHeaderEncrypted(&self.protocol.encrypted);
-            }
-
-            // This can be called from two places because, I think, of differences
-            // between TLS 1.2 and 1.3. TLS 1.3 requires 1 fewer round trip, and
-            // as soon as we've written our handshake, we consider the connection
-            // "connected". TLS 1.2 requires a extra round trip, and thus is
-            // only connected after we receive response from the server.
-            fn sendHeaderEncrypted(self: *Conn, encrypted: *Encrypted) !void {
-                const handler = self.handler;
-                handler.state = .header;
-
-                const header = try self.handler.request.buildHeader();
-                const res = try encrypted.conn.encrypt(header, handler.write_buf);
-                encrypted.unsent = res.unused_cleartext;
-
-                // we always expect encrypted our header to result in some data
-                // encrypted data we can send.
-                std.debug.assert(res.ciphertext.len > 0);
-
-                handler.send(res.ciphertext);
-            }
-
-            fn sendBody(self: *Conn) !void {
-                var handler = self.handler;
-                handler.state = .body;
-                if (handler.request.body) |b| {
-                    try self.send(b);
-                }
-                handler.receive();
-            }
-
-            fn send(self: *Conn, data: []const u8) !void {
-                const handler = self.handler;
-                switch (self.protocol) {
-                    .plain => return handler.send(data),
-                    .encrypted => |*encrypted| {
-                        const res = try encrypted.conn.encrypt(data, handler.write_buf);
-                        encrypted.unsent = res.unused_cleartext;
-                        return handler.send(res.ciphertext);
-                    },
-                    .handshake => {
-                        // While we do send data during handshake, we send it
-                        // directly.
-                        unreachable;
-                    },
-                }
-            }
-        };
-    };
+fn noopLog(ctx: []const u8, _: anyerror) void {
+    _ = ctx;
 }
 
-// Handles synchronous requests
-const SyncHandler = struct {
-    request: *Request,
-
-    fn send(self: *SyncHandler) !Response {
-        var request = self.request;
-
-        // Take the request._connection (a *Connection), and turn it into
-        // something specific to our SyncHandler, a Conn.
-        var conn: Conn = blk: {
-            const c = request._connection.?;
-            if (c.tls) |*tls_client| {
-                switch (tls_client.*) {
-                    .nonblocking => unreachable,
-                    .blocking => |*blocking| {
-                        break :blk .{ .tls = blocking };
-                    },
-                    .blocking_tlsproxy => |*blocking_tlsproxy| {
-                        break :blk .{ .tls_in_tls = &blocking_tlsproxy.destination };
-                    },
-                }
-            }
-            break :blk .{ .plain = c.socket };
-        };
-
-        const header = try request.buildHeader();
-        try conn.sendRequest(header, request.body);
-
-        var reader = request.newReader();
-        var read_buf = request._state.read_buf;
-
-        while (true) {
-            const n = conn.read(read_buf) catch |err| {
-                return self.maybeRetryOrErr(err);
-            };
-
-            const result = try reader.process(read_buf[0..n]);
-            if (reader.header_done == false) {
-                continue;
-            }
-
-            if (reader.redirect()) |redirect| {
-                if (result.done == false) {
-                    try self.drain(&reader, &conn, result.unprocessed);
-                }
-                return request.redirectSync(redirect);
-            }
-
-            // we have a header, and it isn't a redirect, we return our Response
-            // object which can be iterated to get the body.
-            std.debug.assert(result.done or reader.body_reader != null);
-            std.debug.assert(result.data == null);
-
-            // See CompressedReader for an explanation. This isn't great code. Sorry.
-            if (reader.response.get("content-encoding")) |ce| {
-                if (std.ascii.eqlIgnoreCase(ce, "gzip") == false) {
-                    log.warn(.http_client, "unsupported content encoding", .{
-                        .content_encoding = ce,
-                        .uri = request.request_uri,
-                    });
-                    return error.UnsupportedContentEncoding;
-                }
-
-                var compress_reader = CompressedReader{
-                    .over = "",
-                    .inner = &reader,
-                    .done = result.done,
-                    .buffer = read_buf,
-                    .data = result.unprocessed,
-                    .conn = conn,
-                };
-                var body: std.ArrayListUnmanaged(u8) = .{};
-                var decompressor = std.compress.gzip.decompressor(compress_reader.reader());
-                try decompressor.decompress(body.writer(request.arena));
-
-                return .{
-                    .header = reader.response,
-                    ._done = true,
-                    ._request = request,
-                    ._peek_buf = body.items,
-                    ._peek_len = body.items.len,
-                    ._buf = undefined,
-                    ._conn = undefined,
-                    ._reader = undefined,
-                };
-            }
-
-            return .{
-                ._conn = conn,
-                ._buf = read_buf,
-                ._request = request,
-                ._reader = reader,
-                ._done = result.done,
-                ._data = result.unprocessed,
-                ._peek_len = 0,
-                ._peek_buf = request._state.peek_buf,
-                .header = reader.response,
-            };
-        }
-    }
-
-    // Unfortunately, this is called from the Request doSendSync since we need
-    // to do this before setting up our TLS connection.
-    fn connect(request: *Request, conn: *Conn) !void {
-        const header = try request.buildConnectHeader();
-        try conn.writeAll(header);
-
-        var pos: usize = 0;
-        var reader = request.newReader();
-        var read_buf = request._state.read_buf;
-
-        while (true) {
-            // we would never 'maybeRetryOrErr' on a CONNECT request, because
-            // we only send CONNECT requests on newly established connections
-            // and maybeRetryOrErr is only for connections that might have been
-            // closed while being kept-alive
-            const n = try conn.read(read_buf[pos..]);
-            if (n == 0) {
-                return error.ConnectionResetByPeer;
-            }
-            pos += n;
-            if (try reader.connectResponse(read_buf[0..pos])) {
-                // returns true if we have a successful connect response
-                return;
-            }
-
-            // we don't have enough data yet.
-        }
-        return;
-    }
-
-    fn maybeRetryOrErr(self: *SyncHandler, err: anyerror) !Response {
-        var request = self.request;
-
-        // we'll only retry if the connection came from the idle pool, because
-        // these connections might have been closed while idling, so an error
-        // isn't exactly surprising.
-        if (request._connection_from_keepalive == false) {
-            return err;
-        }
-
-        if (err != error.ConnectionResetByPeer) {
-            return err;
-        }
-
-        // this should be our default, and this function should never have been
-        // called at a point where this could have been set to true. This is
-        // important because we're about to release a bad connection, and
-        // we don't want it to go back into the idle pool.
-        std.debug.assert(request._keepalive == false);
-        request.releaseConnection();
-
-        // Don't change this false to true. It ensures that we get a new
-        // connection. This prevents an endless loop because, if this new
-        // connection also fails, connection_from_keepalive will be false, and our
-        // above guard clause will abort the retry.
-        return request.doSendSync(false);
-    }
-
-    fn drain(self: SyncHandler, reader: *Reader, conn: *Conn, unprocessed: ?[]u8) !void {
-        if (unprocessed) |data| {
-            const result = try reader.process(data);
-            if (result.done) {
-                return;
-            }
-        }
-
-        var buf = self.request._state.read_buf;
-        while (true) {
-            const n = try conn.read(buf);
-            const result = try reader.process(buf[0..n]);
-            if (result.done) {
-                return;
-            }
-        }
-    }
-
-    const Conn = union(enum) {
-        tls_in_tls: *tls.Connection(*tls.Connection(std.net.Stream)),
-        tls: *tls.Connection(std.net.Stream),
-        plain: posix.socket_t,
-
-        fn sendRequest(self: *Conn, header: []const u8, body: ?[]const u8) !void {
-            switch (self.*) {
-                inline .tls, .tls_in_tls => |tls_client| {
-                    try tls_client.writeAll(header);
-                    if (body) |b| {
-                        try tls_client.writeAll(b);
-                    }
-                },
-                .plain => |socket| {
-                    if (body) |b| {
-                        var vec = [2]posix.iovec_const{
-                            .{ .len = header.len, .base = header.ptr },
-                            .{ .len = b.len, .base = b.ptr },
-                        };
-                        return writeAllIOVec(socket, &vec);
-                    }
-                    return self.writeAll(header);
-                },
-            }
-        }
-
-        fn read(self: *Conn, buf: []u8) !usize {
-            const n = switch (self.*) {
-                .tls => |tls_client| try tls_client.read(buf),
-                .tls_in_tls => |tls_client| try tls_client.read(buf),
-                .plain => |socket| try posix.read(socket, buf),
-            };
-            if (n == 0) {
-                return error.ConnectionResetByPeer;
-            }
-            return n;
-        }
-
-        fn writeAll(self: *Conn, data: []const u8) !void {
-            switch (self.*) {
-                .tls => |tls_client| try tls_client.writeAll(data),
-                .tls_in_tls => |tls_client| try tls_client.writeAll(data),
-                .plain => |socket| {
-                    var i: usize = 0;
-                    while (i < data.len) {
-                        i += try posix.write(socket, data[i..]);
-                    }
-                },
-            }
-        }
-
-        fn writeAllIOVec(socket: posix.socket_t, vec: []posix.iovec_const) !void {
-            var i: usize = 0;
-            while (true) {
-                var n = try posix.writev(socket, vec[i..]);
-                while (n >= vec[i].len) {
-                    n -= vec[i].len;
-                    i += 1;
-                    if (i >= vec.len) {
-                        return;
-                    }
-                }
-                vec[i].base += n;
-                vec[i].len -= n;
-            }
-        }
-    };
-
-    // We don't ask for encoding, but some providers (CloudFront!!)
-    // encode anyways. This is an issue for our async-path because Zig's
-    // decompressors aren't async-friendly - they want to pull data in
-    // rather than being given data when it's available. Unfortunately
-    // this is a problem for our own Reader, which is shared by both our
-    // sync and async handlers, but has an async-ish API. It's hard to
-    // use our Reader with Zig's decompressors. Given the way our Reader
-    // is write, this is a problem even for our sync requests. For now, we
-    // just read the entire body into memory, which makes things manageable.
-    // Finally, we leverage the existing `peek` logic in the Response to make
-    // this fully-read content available.
-    // If you think about it, this CompressedReader is just a fancy "peek" over
-    // the entire body.
-    const CompressedReader = struct {
-        done: bool,
-        conn: Conn,
-        buffer: []u8,
-        inner: *Reader,
-
-        // Represents data directly from the socket. It hasn't been processed
-        // by the body reader. It could, for example, have chunk information in it.
-        // Needed to be processed by `inner` before it can be returned
-        data: ?[]u8,
-
-        // Represents data that _was_ processed by the body reader, but coudln't
-        // fit in the destination buffer given to read.
-        // This adds complexity, but the reality is that we can read more data
-        // from the socket than space we have in the given `dest`. Think of
-        // this as doing something like a BufferedReader. We _could_ limit
-        // our reads to dest.len, but we can overread when initially reading
-        // the header/response, and at that point, we don't know anything about
-        // this Compression stuff.
-        over: []const u8,
-
-        const IOReader = std.io.Reader(*CompressedReader, anyerror, read);
-
-        pub fn reader(self: *CompressedReader) IOReader {
-            return .{ .context = self };
-        }
-
-        fn read(self: *CompressedReader, dest: []u8) anyerror!usize {
-            if (self.over.len > 0) {
-                // data from a previous `read` which is ready to go as-is. i.e.
-                // it's already been processed by inner (the body reader).
-                const l = @min(self.over.len, dest.len);
-                @memcpy(dest[0..l], self.over[0..l]);
-                self.over = self.over[l..];
-                return l;
-            }
-
-            var buffer = self.buffer;
-            buffer = buffer[0..@min(dest.len, buffer.len)];
-
-            while (true) {
-                if (try self.processData()) |data| {
-                    const l = @min(data.len, dest.len);
-                    @memcpy(dest[0..l], data[0..l]);
-
-                    // if we processed more data than fits into dest, we store
-                    // it in `over` for the next call to `read`
-                    self.over = data[l..];
-                    return l;
-                }
-
-                if (self.done) {
-                    return 0;
-                }
-
-                const n = try self.conn.read(self.buffer);
-                self.data = self.buffer[0..n];
-            }
-        }
-
-        fn processData(self: *CompressedReader) !?[]u8 {
-            const data = self.data orelse return null;
-            const result = try self.inner.process(data);
-
-            self.done = result.done;
-            self.data = result.unprocessed; // for the next call
-
-            return result.data;
-        }
-    };
-};
-
-// Used for reading the response (both the header and the body)
-const Reader = struct {
-    // Wether, from the reader's point of view, this connection could be kept-alive
-    keepalive: bool,
-
-    // always references state.header_buf
-    header_buf: []u8,
-
-    // position in header_buf that we have valid data up until
-    pos: usize,
-
-    // for populating the response headers list
-    arena: Allocator,
-
-    response: ResponseHeader,
-
-    body_reader: ?BodyReader,
-
-    header_done: bool,
-
-    // Whether or not the current header has to be skipped [because it's too long].
-    skip_current_header: bool,
-
-    fn init(state: *State) Reader {
-        return .{
-            .pos = 0,
-            .response = .{},
-            .body_reader = null,
-            .header_done = false,
-            .keepalive = false,
-            .skip_current_header = false,
-            .header_buf = state.header_buf,
-            .arena = state.arena.allocator(),
-        };
-    }
-
-    // Determines if we need to redirect
-    fn redirect(self: *const Reader) ?Redirect {
-        const use_get = switch (self.response.status) {
-            201, 301, 302, 303 => true,
-            307, 308 => false,
-            else => return null,
-        };
-
-        const location = self.response.get("location") orelse return null;
-        return .{ .use_get = use_get, .location = location };
-    }
-
-    fn connectResponse(self: *Reader, data: []u8) !bool {
-        const result = try self.process(data);
-        if (self.header_done == false) {
-            return false;
-        }
-
-        if (result.done == false) {
-            // CONNECT responses should not have a body. If the header is
-            // done, then the entire response should be done.
-            log.info(.http_client, "InvalidConnectResponse", .{ .status = self.response.status, .unprocessed = result.unprocessed });
-            return error.InvalidConnectResponse;
-        }
-
-        const status = self.response.status;
-        if (status < 200 or status > 299) {
-            return error.InvalidConnectResponseStatus;
-        }
-
-        return true;
-    }
-
-    fn process(self: *Reader, data: []u8) ProcessError!Result {
-        if (self.body_reader) |*br| {
-            const ok, const result = try br.process(data);
-            if (ok == false) {
-                // There's something that our body reader didn't like. It wants
-                // us to emit whatever data we have, but it isn't safe to keep
-                // the connection alive.
-                std.debug.assert(result.done == true);
-            }
-            return result;
-        }
-
-        // Still parsing the header
-
-        // What data do we have leftover in `data`?
-        // When header_done == true, then this is part (or all) of the body
-        // When header_done == false, then this is a header line that we didn't
-        // have enough data for.
-        var done = false;
-        var unprocessed = data;
-
-        if (self.skip_current_header) {
-            const index = std.mem.indexOfScalarPos(u8, data, 0, '\n') orelse {
-                // discard all of this data, since it belongs to a header we
-                // want to skip
-                return .{ .done = false, .data = null, .unprocessed = null };
-            };
-            self.pos = 0;
-            self.skip_current_header = false;
-            unprocessed = data[index + 1 ..];
-        }
-
-        // Data from a previous call to process that we weren't able to parse
-        const pos = self.pos;
-        const header_buf = self.header_buf;
-
-        const unparsed = header_buf[0..pos];
-        if (unparsed.len > 0) {
-            // This can get complicated, but we'll try to keep it simple, even
-            // if that means we'll copy a bit more than we have to. At most,
-            // unparsed can represent 1 header line. To have 1 complete line, we
-            // need to find a \n in data.
-            const line_end = (std.mem.indexOfScalarPos(u8, data, 0, '\n') orelse {
-                // data doesn't represent a complete header line. We need more data
-                const end = pos + data.len;
-                if (end > header_buf.len) {
-                    self.prepareToSkipLongHeader();
-                } else {
-                    self.pos = end;
-                    @memcpy(self.header_buf[pos..end], data);
-                }
-                return .{ .done = false, .data = null, .unprocessed = null };
-            }) + 1;
-
-            const end = pos + line_end;
-            if (end > header_buf.len) {
-                unprocessed = &.{};
-                self.prepareToSkipLongHeader();
-                // we can disable this immediately, since we've essentially
-                // finished skipping it this point.
-                self.skip_current_header = false;
-            } else {
-                @memcpy(header_buf[pos..end], data[0..line_end]);
-                done, unprocessed = try self.parseHeader(header_buf[0..end]);
-            }
-
-            // we gave parseHeader exactly 1 header line, there should be no leftovers
-            std.debug.assert(unprocessed.len == 0);
-
-            // we currently have no unprocessed header data
-            self.pos = 0;
-
-            // We still [probably] have data to process which was not part of
-            // the previously unparsed header line
-            unprocessed = data[line_end..];
-        }
-        if (done == false) {
-            // If we're here it means that
-            // 1 - Had no unparsed data, and skipped the entire block above
-            // 2 - Had unparsed data, but we managed to "complete" it. AND, the
-            //     unparsed data didn't represent the end of the header
-            //     We're now trying to parse the rest of the `data` which was not
-            //     parsed of the unparsed (unprocessed.len could be 0 here).
-            done, unprocessed = try self.parseHeader(unprocessed);
-            if (done == false) {
-                const p = self.pos; // don't use pos, self.pos might have been altered
-                const end = p + unprocessed.len;
-                if (end > header_buf.len) {
-                    self.prepareToSkipLongHeader();
-                } else {
-                    @memcpy(header_buf[p..end], unprocessed);
-                    self.pos = end;
-                }
-                return .{ .done = false, .data = null, .unprocessed = null };
-            }
-        }
-        var result = try self.prepareForBody();
-        if (unprocessed.len > 0) {
-            if (result.done == true) {
-                // We think we're done reading the body, but we still have data
-                // We'll return what we have as-is, but close the connection
-                // because we don't know what state it's in.
-                self.keepalive = false;
-            } else {
-                result.unprocessed = unprocessed;
-            }
-        }
-        return result;
-    }
-
-    // We're done parsing the header, and we need to (maybe) setup the BodyReader
-    fn prepareForBody(self: *Reader) !Result {
-        self.header_done = true;
-        const response = &self.response;
-
-        if (response.get("connection")) |connection| {
-            if (std.ascii.eqlIgnoreCase(connection, "close")) {
-                self.keepalive = false;
-            }
-        }
-
-        if (response.get("transfer-encoding")) |te| {
-            if (std.ascii.indexOfIgnoreCase(te, "chunked") != null) {
-                self.body_reader = .{ .chunked = .{
-                    .size = null,
-                    .missing = 0,
-                    .scrap_len = 0,
-                    .scrap = undefined,
-                } };
-                return .{ .done = false, .data = null, .unprocessed = null };
-            }
-        }
-
-        const content_length = blk: {
-            const cl = response.get("content-length") orelse break :blk 0;
-            break :blk std.fmt.parseInt(u32, cl, 10) catch {
-                return error.InvalidContentLength;
-            };
-        };
-
-        if (content_length == 0) {
-            return .{
-                .done = true,
-                .data = null,
-                .unprocessed = null,
-            };
-        }
-
-        self.body_reader = .{ .content_length = .{ .len = content_length, .read = 0 } };
-        return .{ .done = false, .data = null, .unprocessed = null };
-    }
-
-    fn prepareToSkipLongHeader(self: *Reader) void {
-        self.skip_current_header = true;
-        const buf = self.header_buf;
-        const pos = std.mem.indexOfScalar(u8, buf, ':') orelse @min(buf.len, 20);
-        log.warn(.http_client, "skipping long header", .{ .name = buf[0..pos] });
-    }
-
-    // returns true when done
-    // returns any remaining unprocessed data
-    // When done == true, the remaining data must belong to the body
-    // When done == false, at least part of the remaining data must belong to
-    // the header.
-    fn parseHeader(self: *Reader, data: []u8) !struct { bool, []u8 } {
-        var pos: usize = 0;
-        const arena = self.arena;
-        if (self.response.status == 0) {
-            // still don't have a status line
-            pos = std.mem.indexOfScalarPos(u8, data, 0, '\n') orelse {
-                return .{ false, data };
-            };
-            if (pos < 14 or data[pos - 1] != '\r') {
-                return error.InvalidStatusLine;
-            }
-            const protocol = data[0..9];
-            if (std.mem.eql(u8, protocol, "HTTP/1.1 ")) {
-                self.keepalive = true;
-            } else if (std.mem.eql(u8, protocol, "HTTP/1.0 ") == false) {
-                return error.InvalidStatusLine;
-            }
-            self.response.status = std.fmt.parseInt(u16, data[9..12], 10) catch {
-                return error.InvalidStatusLine;
-            };
-
-            // skip over the \n
-            pos += 1;
-        }
-
-        while (pos < data.len) {
-            if (data[pos] == '\r') {
-                const next = pos + 1;
-                if (data.len > next and data[next] == '\n') {
-                    return .{ true, data[next + 1 ..] };
-                }
-            }
-            const value_end = std.mem.indexOfScalarPos(u8, data, pos, '\n') orelse {
-                return .{ false, data[pos..] };
-            };
-
-            const sep = std.mem.indexOfScalarPos(u8, data[pos..value_end], 0, ':') orelse {
-                return error.InvalidHeader;
-            };
-            const name_end = pos + sep;
-
-            if (value_end - pos > MAX_HEADER_LINE_LEN) {
-                // at this point, we could return this header, but then it would
-                // be inconsistent with long headers that are split up and need
-                // to be buffered.
-                log.warn(.http_client, "skipping long header", .{ .name = data[pos..name_end] });
-                pos = value_end + 1;
-                continue;
-            }
-
-            const value_start = name_end + 1;
-
-            if (value_end == value_start or data[value_end - 1] != '\r') {
-                return error.InvalidHeader;
-            }
-
-            const name = data[pos..name_end];
-            const value = data[value_start .. value_end - 1];
-
-            // there's a limit to what whitespace is valid here, but let's be flexible
-            var normalized_name = std.mem.trim(u8, name, &std.ascii.whitespace);
-            const normalized_value = std.mem.trim(u8, value, &std.ascii.whitespace);
-
-            // constCast is safe here, and necessary because the std.mem.trim API is bad / broken;
-            normalized_name = std.ascii.lowerString(@constCast(normalized_name), normalized_name);
-            try self.response.headers.append(self.arena, .{
-                .name = try arena.dupe(u8, normalized_name),
-                .value = try arena.dupe(u8, normalized_value),
-            });
-
-            // +1 to skip over the trailing \n
-            pos = value_end + 1;
-        }
-        return .{ false, "" };
-    }
-
-    const BodyReader = union(enum) {
-        chunked: Chunked,
-        content_length: ContentLength,
-
-        fn process(self: *BodyReader, data: []u8) !struct { bool, Result } {
-            std.debug.assert(data.len > 0);
-            switch (self.*) {
-                inline else => |*br| return br.process(data),
-            }
-        }
-
-        const ContentLength = struct {
-            len: usize,
-            read: usize,
-
-            fn process(self: *ContentLength, d: []u8) !struct { bool, Result } {
-                const len = self.len;
-                var read = self.read;
-                const missing = len - read;
-
-                var data = d;
-                var valid = true;
-
-                if (d.len > missing) {
-                    valid = false;
-                    data = d[0..missing];
-                }
-                read += data.len;
-                self.read = read;
-
-                return .{ valid, .{
-                    .done = read == len,
-                    .data = if (data.len == 0) null else data,
-                    .unprocessed = null,
-                } };
-            }
-        };
-
-        const Chunked = struct {
-            // size of the current chunk
-            size: ?u32,
-
-            // the amount of data we're missing in the current chunk, not
-            // including the tailing end-chunk marker (\r\n)
-            missing: usize,
-
-            // Our chunk reader will emit data as it becomes available, even
-            // if it isn't a complete chunk. So, ideally, we don't need much state
-            // But we might also get partial meta-data, like part of the chunk
-            // length. For example, imagine we get data that looks like:
-            //    over 9000!\r\n32
-            //
-            // Now, if we assume that "over 9000!" completes the current chunk
-            // (which is to say that missing == 12), then the "32" would
-            // indicate _part_ of the length of the next chunk. But, is the next
-            // chunk 32, or is it 3293 or ??? So we need to keep the "32" around
-            // to figure it out.
-            scrap: [64]u8,
-            scrap_len: usize,
-
-            fn process(self: *Chunked, d: []u8) !struct { bool, Result } {
-                var data = d;
-
-                const scrap = &self.scrap;
-                const scrap_len = self.scrap_len;
-                const free_scrap = scrap.len - scrap_len;
-
-                if (self.size == null) {
-                    // we don't know the size of the next chunk
-                    const data_header_end = std.mem.indexOfScalarPos(u8, data, 0, '\n') orelse {
-                        // the data that we were given doesn't have a complete header
-                        if (data.len > free_scrap) {
-                            // How big can a chunk reasonably be?
-                            return error.InvalidChunk;
-                        }
-                        const end = scrap_len + data.len;
-                        // we still don't have the end of the chunk header
-                        @memcpy(scrap[scrap_len..end], data);
-                        self.scrap_len = end;
-                        return .{ true, .{ .done = false, .data = null, .unprocessed = null } };
-                    };
-
-                    var header = data[0..data_header_end];
-                    if (scrap_len > 0) {
-                        const end = scrap_len + data_header_end;
-                        @memcpy(scrap[scrap_len..end], data[0..data_header_end]);
-                        self.scrap_len = 0;
-                        header = scrap[0..end];
-                    }
-
-                    const next_size = try readChunkSize(header);
-                    self.scrap_len = 0;
-                    self.size = next_size;
-                    self.missing = next_size + 2; // include the footer
-                    data = data[data_header_end + 1 ..];
-                }
-
-                if (data.len == 0) {
-                    return .{ true, .{ .data = null, .done = false, .unprocessed = null } };
-                }
-
-                const size = self.size.?;
-                const missing = self.missing;
-
-                if (data.len >= missing) {
-                    self.size = null;
-                    self.missing = 0;
-                    if (missing == 1) {
-                        if (data[0] != '\n') {
-                            return error.InvalidChunk;
-                        }
-                        if (data.len == 1) {
-                            return .{ true, .{ .data = null, .done = size == 0, .unprocessed = null } };
-                        }
-                        return self.process(data[1..]);
-                    }
-
-                    if (missing == 2) {
-                        if (data[0] != '\r' or data[1] != '\n') {
-                            return error.InvalidChunk;
-                        }
-
-                        if (data.len == 2) {
-                            return .{ true, .{ .data = null, .done = size == 0, .unprocessed = null } };
-                        }
-                        return self.process(data[2..]);
-                    }
-
-                    // we have a complete chunk;
-                    var chunk: ?[]u8 = data;
-                    const last = missing - 2;
-                    if (data[last] != '\r' or data[missing - 1] != '\n') {
-                        return error.InvalidChunk;
-                    }
-                    chunk = if (last == 0) null else data[0..last];
-
-                    const unprocessed = data[missing..];
-
-                    return .{ true, .{
-                        .data = chunk,
-                        .done = size == 0,
-                        .unprocessed = if (unprocessed.len == 0) null else unprocessed,
-                    } };
-                }
-
-                const still_missing = missing - data.len;
-                if (still_missing == 1) {
-                    const last = data.len - 1;
-                    if (data[last] != '\r') {
-                        return error.InvalidChunk;
-                    }
-                    data = data[0..last];
-                }
-                self.missing = still_missing;
-
-                return .{ true, .{
-                    .data = data,
-                    .done = false,
-                    .unprocessed = null,
-                } };
-            }
-
-            fn readChunkSize(data: []const u8) !u32 {
-                std.debug.assert(data.len > 1);
-
-                if (data[data.len - 1] != '\r') {
-                    return error.InvalidChunk;
-                }
-                // ignore chunk extensions for now
-                const str_len = std.mem.indexOfScalarPos(u8, data, 0, ';') orelse data.len - 1;
-                return std.fmt.parseInt(u32, data[0..str_len], 16) catch return error.InvalidChunk;
-            }
-        };
-    };
-
-    const Redirect = struct {
-        use_get: bool,
-        location: []const u8,
-    };
-
-    const Result = struct {
-        done: bool,
-        data: ?[]u8,
-        // Any unprocessed data we have from the last call to "process".
-        // We can have unprocessed data when transitioning from parsing the
-        // header to parsing the body. When using Chunked encoding, we'll also
-        // have unprocessed data between chunks.
-        unprocessed: ?[]u8 = null,
-    };
-
-    const ProcessError = error{
-        HeaderTooLarge,
-        OutOfMemory,
-        InvalidHeader,
-        InvalidStatusLine,
-        InvalidContentLength,
-        InvalidChunk,
-    };
-};
-
-pub const ResponseHeader = struct {
-    status: u16 = 0,
-    headers: std.ArrayListUnmanaged(Header) = .{},
-
-    // Stored header has already been lower-cased
-    // `name` parameter should be passed in lower-cased
-    pub fn get(self: *const ResponseHeader, name: []const u8) ?[]u8 {
-        for (self.headers.items) |h| {
-            if (std.mem.eql(u8, name, h.name)) {
-                return h.value;
-            }
-        }
-        return null;
-    }
-
-    pub fn count(self: *const ResponseHeader) usize {
-        return self.headers.items.len;
-    }
-
-    pub fn iterate(self: *const ResponseHeader, name: []const u8) HeaderIterator {
-        return .{
-            .index = 0,
-            .name = name,
-            .headers = self.headers,
-        };
-    }
-};
-
-// We don't want to use std.http.Header, because the value is `[]const u8`.
-// We _could_ use it and @constCast, but this gives us more safety.
-// The main reason we want to do this is that a caller could lower-case the
-// value in-place.
-// The value (and key) are both safe to mutate because they're cloned from
-// the byte stream by our arena.
-pub const Header = struct {
-    name: []const u8,
-    value: []u8,
-};
-
-const HeaderIterator = struct {
-    index: usize,
-    name: []const u8,
-    headers: std.ArrayListUnmanaged(Header),
-
-    pub fn next(self: *HeaderIterator) ?[]u8 {
-        const name = self.name;
-        const index = self.index;
-        for (self.headers.items[index..], index..) |h, i| {
-            if (std.mem.eql(u8, name, h.name)) {
-                self.index = i + 1;
-                return h.value;
-            }
-        }
-        self.index = self.headers.items.len;
-        return null;
-    }
-};
-
-// What we emit from the AsyncHandler
-pub const Progress = struct {
-    first: bool,
-
-    // whether or not more data is expected
-    done: bool,
-
-    // part of the body
-    data: ?[]const u8,
-
-    header: ResponseHeader,
-};
-
-// The value that we return from a synchronous request.
-pub const Response = struct {
-    _reader: Reader,
-    _request: *Request,
-    _conn: SyncHandler.Conn,
-
-    // the buffer to read the peeked data into
-    _peek_buf: []u8,
-
-    // the length of data we've peeked. The peeked_data is _peek_buf[0.._peek_len].
-    // It's possible for peek_len > 0 and _done == true, in which case, the
-    // _peeked data should be emitted once and subsequent calls to `next` should
-    // return null.
-    _peek_len: usize,
-
-    // What we'll read from the socket into. This is the State's read_buf
-    _buf: []u8,
-
-    // Whether or not we're done reading the response. When true, next will
-    // return null.
-    _done: bool,
-
-    // Data that we've read. This can be set when the Response is first created
-    // from extra data received while parsing the body. Or, it can be set
-    // when `next` is called and we read more data from the socket.
-    _data: ?[]u8 = null,
-    header: ResponseHeader,
-
-    pub fn next(self: *Response) !?[]u8 {
-        // it's possible for peek_len > - and done == true. This would happen
-        // when, while peeking, we reached the end of the data. In that case,
-        // we return the peeked data once, and on subsequent call, we'll return
-        // null normally, because done == true;
-        const pl = self._peek_len;
-        if (pl > 0) {
-            self._peek_len = 0;
-            return self._peek_buf[0..pl];
-        }
-
-        return self._nextIgnorePeek(self._buf);
-    }
-
-    fn _nextIgnorePeek(self: *Response, buf: []u8) !?[]u8 {
-        while (true) {
-            if (try self.processData()) |data| {
-                return data;
-            }
-            if (self._done) {
-                self._request.requestCompleted(self.header, self._reader.keepalive);
-                return null;
-            }
-
-            const n = try self._conn.read(buf);
-            self._data = buf[0..n];
-        }
-    }
-
-    fn processData(self: *Response) !?[]u8 {
-        const data = self._data orelse return null;
-        const result = try self._reader.process(data);
-        self._done = result.done;
-        self._data = result.unprocessed; // for the next call
-        return result.data;
-    }
-
-    pub fn peek(self: *Response) ![]u8 {
-        if (self._peek_len > 0) {
-            // Under normal usage, this is only possible when we're dealing
-            // with a compressed response (despite not asking for it). We handle
-            // these responses by essentially peeking the entire body.
-            return self._peek_buf[0..self._peek_len];
-        }
-
-        if (try self.processData()) |data| {
-            // We already have some or all of the body. This happens because
-            // we always read as much as we can, so getting the header and
-            // part/all of the body is normal.
-            if (data.len > 100) {
-                self._peek_buf = data;
-                self._peek_len = data.len;
-                return data;
-            }
-            @memcpy(self._peek_buf[0..data.len], data);
-            self._peek_len = data.len;
-        }
-
-        while (true) {
-            var peek_buf = self._peek_buf;
-            const peek_len = self._peek_len;
-
-            const data = (try self._nextIgnorePeek(peek_buf[peek_len..])) orelse {
-                return peek_buf[0..peek_len];
-            };
-
-            const peek_end = peek_len + data.len;
-            @memcpy(peek_buf[peek_len..peek_end], data);
-            self._peek_len = peek_end;
-
-            if (peek_end > 100) {
-                return peek_buf[peek_len..peek_end];
-            }
-        }
-    }
-};
-
-// Pooled and re-used when creating a request
-const State = struct {
-    // We might be asked to peek at the response, i.e. to sniff the mime type.
-    // This will require storing any peeked data so that, later, if we stream
-    // the body, we can present a cohesive body.
-    peek_buf: []u8,
-
-    // Used for reading chunks of payload data.
-    read_buf: []u8,
-
-    // Used for writing data. If you're wondering why BOTH a read_buf and a
-    // write_buf, even though HTTP is req -> resp, it's for TLS, which has
-    // bidirectional data.
-    write_buf: []u8,
-
-    // Used for keeping any unparsed header line until more data is received
-    // At most, this represents 1 line in the header.
-    header_buf: []u8,
-
-    // Used to optionally clone request headers, and always used to clone
-    // response headers.
-    arena: ArenaAllocator,
-
-    fn init(allocator: Allocator, header_size: usize, peek_size: usize, buf_size: usize) !State {
-        const peek_buf = try allocator.alloc(u8, peek_size);
-        errdefer allocator.free(peek_buf);
-
-        const read_buf = try allocator.alloc(u8, buf_size);
-        errdefer allocator.free(read_buf);
-
-        const write_buf = try allocator.alloc(u8, buf_size);
-        errdefer allocator.free(write_buf);
-
-        const header_buf = try allocator.alloc(u8, header_size);
-        errdefer allocator.free(header_buf);
-
-        return .{
-            .peek_buf = peek_buf,
-            .read_buf = read_buf,
-            .write_buf = write_buf,
-            .header_buf = header_buf,
-            .arena = std.heap.ArenaAllocator.init(allocator),
-        };
-    }
-
-    fn reset(self: *State) void {
-        _ = self.arena.reset(.{ .retain_with_limit = 64 * 1024 });
-    }
-
-    fn deinit(self: *State) void {
-        const allocator = self.arena.child_allocator;
-        allocator.free(self.peek_buf);
-        allocator.free(self.read_buf);
-        allocator.free(self.write_buf);
-        allocator.free(self.header_buf);
-        self.arena.deinit();
-    }
-};
-
-const StatePool = struct {
-    states: []*State,
-    available: usize,
-    mutex: Thread.Mutex,
-    cond: Thread.Condition,
-
-    pub fn init(allocator: Allocator, count: usize) !StatePool {
-        const states = try allocator.alloc(*State, count);
-        errdefer allocator.free(states);
-
-        var started: usize = 0;
-        errdefer for (0..started) |i| {
-            states[i].deinit();
-            allocator.destroy(states[i]);
-        };
-
-        for (0..count) |i| {
-            const state = try allocator.create(State);
-            errdefer allocator.destroy(state);
-            state.* = try State.init(allocator, MAX_HEADER_LINE_LEN, PEEK_BUF_LEN, BUFFER_LEN);
-            states[i] = state;
-            started += 1;
-        }
-
-        return .{
-            .cond = .{},
-            .mutex = .{},
-            .states = states,
-            .available = count,
-        };
-    }
-
-    pub fn deinit(self: *StatePool, allocator: Allocator) void {
-        for (self.states) |state| {
-            state.deinit();
-            allocator.destroy(state);
-        }
-        allocator.free(self.states);
-    }
-
-    pub fn freeSlotCount(self: *StatePool) usize {
-        self.mutex.lock();
-        defer self.mutex.unlock();
-        return self.available;
-    }
-
-    pub fn acquireWait(self: *StatePool) *State {
-        const states = self.states;
-
-        self.mutex.lock();
-        while (true) {
-            const available = self.available;
-            if (available == 0) {
-                self.cond.wait(&self.mutex);
-                continue;
-            }
-            const index = available - 1;
-            const state = states[index];
-            self.available = index;
-            self.mutex.unlock();
-            return state;
-        }
-    }
-
-    pub fn acquireOrNull(self: *StatePool) ?*State {
-        const states = self.states;
-
-        self.mutex.lock();
-        defer self.mutex.unlock();
-
-        const available = self.available;
-        if (available == 0) {
-            return null;
-        }
-
-        const index = available - 1;
-        const state = states[index];
-        self.available = index;
-        return state;
-    }
-
-    pub fn release(self: *StatePool, state: *State) void {
-        state.reset();
-        var states = self.states;
-
-        self.mutex.lock();
-        const available = self.available;
-        states[available] = state;
-        self.available = available + 1;
-        self.mutex.unlock();
-
-        self.cond.signal();
-    }
-};
-
-// Ideally, a connection could be reused as long as the host:port matches.
-// But we're also having to match based on blocking and nonblocking and TLS
-// and not TLS. It isn't the most efficient. For non-TLS, we could definitely
-// always re-use the connection (just toggle the socket's blocking status), but
-// for TLS, we'd need to see if the two different TLS objects (blocking and non
-// blocking) can be converted from each other.
-const ConnectionManager = struct {
-    max: usize,
-    idle: List,
-    count: usize,
-    mutex: Thread.Mutex,
-    allocator: Allocator,
-    node_pool: std.heap.MemoryPool(Node),
-    connection_pool: std.heap.MemoryPool(Connection),
-
-    const List = std.DoublyLinkedList(*Connection);
-    const Node = List.Node;
-
-    fn init(allocator: Allocator, max: usize) ConnectionManager {
-        return .{
-            .max = max,
-            .count = 0,
-            .idle = .{},
-            .mutex = .{},
-            .allocator = allocator,
-            .node_pool = std.heap.MemoryPool(Node).init(allocator),
-            .connection_pool = std.heap.MemoryPool(Connection).init(allocator),
-        };
-    }
-
-    fn deinit(self: *ConnectionManager) void {
-        const allocator = self.allocator;
-
-        self.mutex.lock();
-        defer self.mutex.unlock();
-        var node = self.idle.first;
-        while (node) |n| {
-            const next = n.next;
-            n.data.deinit(allocator);
-            node = next;
-        }
-        self.node_pool.deinit();
-        self.connection_pool.deinit();
-    }
-
-    fn get(self: *ConnectionManager, expect_tls: bool, host: []const u8, port: u16, blocking: bool) ?*Connection {
-        self.mutex.lock();
-        defer self.mutex.unlock();
-
-        var node = self.idle.first;
-        while (node) |n| {
-            const connection = n.data;
-            if (std.ascii.eqlIgnoreCase(connection.host, host) and connection.port == port and connection.blocking == blocking and ((connection.tls == null) == !expect_tls)) {
-                self.count -= 1;
-                self.idle.remove(n);
-                self.node_pool.destroy(n);
-                return connection;
-            }
-            node = n.next;
-        }
-        return null;
-    }
-
-    fn keepIdle(self: *ConnectionManager, connection: *Connection) !void {
-        self.mutex.lock();
-        defer self.mutex.unlock();
-
-        var node: *Node = undefined;
-        if (self.count == self.max) {
-            const oldest = self.idle.popFirst() orelse {
-                std.debug.assert(self.max == 0);
-                self.destroy(connection);
-                return;
-            };
-            self.destroy(oldest.data);
-            // re-use the node
-            node = oldest;
-        } else {
-            node = try self.node_pool.create();
-            self.count += 1;
-        }
-
-        node.data = connection;
-        self.idle.append(node);
-    }
-
-    fn create(self: *ConnectionManager, host: []const u8) !struct { *Connection, []const u8 } {
-        const connection = try self.connection_pool.create();
-        errdefer self.connection_pool.destroy(connection);
-
-        const owned_host = try self.allocator.dupe(u8, host);
-        return .{ connection, owned_host };
-    }
-
-    fn destroy(self: *ConnectionManager, connection: *Connection) void {
-        connection.deinit(self.allocator);
-        self.connection_pool.destroy(connection);
-    }
-};
-
-const testing = @import("../testing.zig");
-test "HttpClient Reader: fuzz" {
-    var state = try State.init(testing.allocator, 1024, 1024, 100);
-    defer state.deinit();
-
-    var res = TestResponse.init();
-    defer res.deinit();
-
-    // testReader randomly fragments the incoming data, hence the loop.
-    for (0..1000) |_| {
-        try testing.expectError(error.InvalidStatusLine, testReader(&state, &res, "hello\r\n\r\n"));
-        try testing.expectError(error.InvalidStatusLine, testReader(&state, &res, "http/1.1 200 \r\n\r\n"));
-        try testing.expectError(error.InvalidStatusLine, testReader(&state, &res, "HTTP/0.9 200 \r\n\r\n"));
-        try testing.expectError(error.InvalidStatusLine, testReader(&state, &res, "HTTP/1.1     \r\n\r\n"));
-        try testing.expectError(error.InvalidStatusLine, testReader(&state, &res, "HTTP/1.1 20a \r\n\r\n"));
-        try testing.expectError(error.InvalidStatusLine, testReader(&state, &res, "HTTP/1.1 20A \n"));
-        try testing.expectError(error.InvalidHeader, testReader(&state, &res, "HTTP/1.1 200 \r\nA\r\nB:1\r\n"));
-
-        try testing.expectError(error.InvalidChunk, testReader(&state, &res, "HTTP/1.1 200 \r\nTransfer-Encoding: chunked\r\n\r\n abc\r\n"));
-        try testing.expectError(error.InvalidChunk, testReader(&state, &res, "HTTP/1.1 200 \r\nTransfer-Encoding: chunked\r\n\r\n 123\n"));
-
-        {
-            res.reset();
-            try testReader(&state, &res, "HTTP/1.1 200 \r\n\r\n");
-            try testing.expectEqual(200, res.status);
-            try testing.expectEqual(0, res.body.items.len);
-            try testing.expectEqual(0, res.headers.items.len);
-        }
-
-        {
-            res.reset();
-            try testReader(&state, &res, "HTTP/1.0 404 \r\nError: Not-Found\r\n\r\n");
-            try testing.expectEqual(404, res.status);
-            try testing.expectEqual(0, res.body.items.len);
-            try res.assertHeaders(&.{ "error", "Not-Found" });
-        }
-
-        {
-            res.reset();
-            try testReader(&state, &res, "HTTP/1.1 200 \r\nSet-Cookie: a32;max-age=60\r\nContent-Length: 12\r\n\r\nOver 9000!!!");
-            try testing.expectEqual(200, res.status);
-            try testing.expectEqual("Over 9000!!!", res.body.items);
-            try res.assertHeaders(&.{ "set-cookie", "a32;max-age=60", "content-length", "12" });
-        }
-
-        {
-            res.reset();
-            try testReader(&state, &res, "HTTP/1.1 200 \r\nTransFEr-ENcoding:  chunked  \r\n\r\n0\r\n\r\n");
-            try testing.expectEqual(200, res.status);
-            try testing.expectEqual("", res.body.items);
-            try res.assertHeaders(&.{ "transfer-encoding", "chunked" });
-        }
-
-        {
-            res.reset();
-            try testReader(&state, &res, "HTTP/1.1 200 \r\nTransFEr-ENcoding:  chunked  \r\n\r\n0\r\n\r\n");
-            try testing.expectEqual(200, res.status);
-            try testing.expectEqual("", res.body.items);
-            try res.assertHeaders(&.{ "transfer-encoding", "chunked" });
-        }
-
-        {
-            res.reset();
-            try testReader(&state, &res, "HTTP/1.1 200 \r\nTransFEr-ENcoding:  chunked  \r\n\r\nE\r\nHello World!!!\r\n2eE;opts\r\n" ++ ("abc" ** 250) ++ "\r\n0\r\n\r\n");
-            try testing.expectEqual(200, res.status);
-            try testing.expectEqual("Hello World!!!" ++ ("abc" ** 250), res.body.items);
-            try res.assertHeaders(&.{ "transfer-encoding", "chunked" });
-        }
-    }
-
-    for (0..10) |_| {
-        {
-            // large body
-            const body = "abcdefghijklmnopqrstuvwxyz012345689ABCDEFGHIJKLMNOPQRSTUVWXYZ" ** 10000;
-            res.reset();
-            try testReader(&state, &res, "HTTP/1.1 200 OK\r\n Content-Length :   610000  \r\nOther: 13391AbC93\r\n\r\n" ++ body);
-            try testing.expectEqual(200, res.status);
-            try testing.expectEqual(body, res.body.items);
-            try res.assertHeaders(&.{ "content-length", "610000", "other", "13391AbC93" });
-        }
-
-        {
-            // skips large headers
-            const data = "HTTP/1.1 200 OK\r\na: b\r\n" ++ ("a" ** 5000) ++ ": wow\r\nx:zz\r\n\r\n";
-            try testReader(&state, &res, data);
-            try testing.expectEqual(200, res.status);
-            try res.assertHeaders(&.{ "a", "b", "x", "zz" });
-        }
-    }
+fn noopStart(transfer: *Transfer) !void {
+    _ = transfer;
 }
-
-test "HttpClient: invalid url" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-    const uri = try Uri.parse("http:///");
-    try testing.expectError(error.UriMissingHost, tc.client.request(.GET, &uri));
-}
-
-test "HttpClient: sync connect error" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    const uri = try Uri.parse("HTTP://127.0.0.1:9920");
-    var req = try tc.client.request(.GET, &uri);
-    defer req.deinit();
-
-    try testing.expectError(error.ConnectionRefused, req.sendSync(.{}));
-}
-
-test "HttpClient: sync no body" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    for (0..2) |i| {
-        const uri = try Uri.parse("http://127.0.0.1:9582/http_client/simple");
-        var req = try tc.client.request(.GET, &uri);
-        defer req.deinit();
-
-        var res = try req.sendSync(.{});
-
-        if (i == 0) {
-            try testing.expectEqual("", try res.peek());
-        }
-        try testing.expectEqual(null, try res.next());
-        try testing.expectEqual(200, res.header.status);
-        try testing.expectEqual(2, res.header.count());
-        try testing.expectEqual("close", res.header.get("connection"));
-        try testing.expectEqual("0", res.header.get("content-length"));
-    }
-}
-
-test "HttpClient: sync tls no body" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    for (0..2) |_| {
-        const uri = try Uri.parse("https://127.0.0.1:9581/http_client/simple");
-        var req = try tc.client.request(.GET, &uri);
-        defer req.deinit();
-
-        var res = try req.sendSync(.{ .tls_verify_host = false });
-
-        try testing.expectEqual(null, try res.next());
-        try testing.expectEqual(200, res.header.status);
-        try testing.expectEqual(2, res.header.count());
-        try testing.expectEqual("0", res.header.get("content-length"));
-        try testing.expectEqual("Close", res.header.get("connection"));
-    }
-}
-
-test "HttpClient: sync with body" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    for (0..2) |i| {
-        const uri = try Uri.parse("http://127.0.0.1:9582/http_client/echo");
-        var req = try tc.client.request(.GET, &uri);
-        defer req.deinit();
-
-        var res = try req.sendSync(.{});
-
-        if (i == 0) {
-            try testing.expectEqual("over 9000!", try res.peek());
-        }
-        try testing.expectEqual("over 9000!", try res.next());
-        try testing.expectEqual(201, res.header.status);
-        try testing.expectEqual(5, res.header.count());
-        try testing.expectEqual("Close", res.header.get("connection"));
-        try testing.expectEqual("10", res.header.get("content-length"));
-        try testing.expectEqual("127.0.0.1", res.header.get("_host"));
-        try testing.expectEqual("Lightpanda/1.0", res.header.get("_user-agent"));
-        try testing.expectEqual("*/*", res.header.get("_accept"));
-    }
-}
-
-test "HttpClient: sync with body proxy CONNECT" {
-    const proxy_uri = try Uri.parse("http://127.0.0.1:9582/");
-    var tc = try TestContext.init(.{ .proxy_type = .connect, .http_proxy = proxy_uri });
-    defer tc.deinit();
-
-    for (0..2) |i| {
-        const uri = try Uri.parse("http://127.0.0.1:9582/http_client/echo");
-        var req = try tc.client.request(.GET, &uri);
-        defer req.deinit();
-
-        var res = try req.sendSync(.{});
-
-        if (i == 0) {
-            try testing.expectEqual("over 9000!", try res.peek());
-        }
-        try testing.expectEqual("over 9000!", try res.next());
-        try testing.expectEqual(201, res.header.status);
-        try testing.expectEqual(6, res.header.count());
-        try testing.expectEqual("Close", res.header.get("connection"));
-        try testing.expectEqual("10", res.header.get("content-length"));
-        try testing.expectEqual("127.0.0.1", res.header.get("_host"));
-        try testing.expectEqual("Lightpanda/1.0", res.header.get("_user-agent"));
-        try testing.expectEqual("*/*", res.header.get("_accept"));
-        // Proxy headers
-        try testing.expectEqual("127.0.0.1:9582", res.header.get("__host"));
-    }
-}
-
-test "HttpClient: basic authentication CONNECT" {
-    const proxy_uri = try Uri.parse("http://127.0.0.1:9582/");
-    var tc = try TestContext.init(.{ .proxy_type = .connect, .http_proxy = proxy_uri, .proxy_auth = .{ .basic = .{ .user_pass = "user:pass" } } });
-    defer tc.deinit();
-
-    const uri = try Uri.parse("http://127.0.0.1:9582/http_client/echo");
-    var req = try tc.client.request(.GET, &uri);
-    defer req.deinit();
-
-    var res = try req.sendSync(.{});
-
-    try testing.expectEqual(201, res.header.status);
-    // Destination headers
-    try testing.expectEqual(null, res.header.get("_authorization"));
-    try testing.expectEqual(null, res.header.get("_proxy-authorization"));
-    // Proxy headers
-    try testing.expectEqual(null, res.header.get("__authorization"));
-    try testing.expectEqual("Basic dXNlcjpwYXNz", res.header.get("__proxy-authorization"));
-}
-
-test "HttpClient: bearer authentication CONNECT" {
-    const proxy_uri = try Uri.parse("http://127.0.0.1:9582/");
-    var tc = try TestContext.init(.{ .proxy_type = .connect, .http_proxy = proxy_uri, .proxy_auth = .{ .bearer = .{ .token = "fruitsalad" } } });
-    defer tc.deinit();
-
-    const uri = try Uri.parse("http://127.0.0.1:9582/http_client/echo");
-    var req = try tc.client.request(.GET, &uri);
-    defer req.deinit();
-
-    var res = try req.sendSync(.{});
-
-    try testing.expectEqual(201, res.header.status);
-    // Destination headers
-    try testing.expectEqual(null, res.header.get("_authorization"));
-    try testing.expectEqual(null, res.header.get("_proxy-authorization"));
-    // Proxy headers
-    try testing.expectEqual(null, res.header.get("__authorization"));
-    try testing.expectEqual("Bearer fruitsalad", res.header.get("__proxy-authorization"));
-}
-
-test "HttpClient: sync with gzip body" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    for (0..2) |i| {
-        const uri = try Uri.parse("http://127.0.0.1:9582/http_client/gzip");
-        var req = try tc.client.request(.GET, &uri);
-        defer req.deinit();
-
-        var res = try req.sendSync(.{});
-
-        if (i == 0) {
-            try testing.expectEqual("A new browser built for machines\n", try res.peek());
-        }
-        try testing.expectEqual("A new browser built for machines\n", try res.next());
-        try testing.expectEqual("gzip", res.header.get("content-encoding"));
-    }
-}
-
-test "HttpClient: sync tls with body" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    var arr: std.ArrayListUnmanaged(u8) = .{};
-    defer arr.deinit(testing.allocator);
-    try arr.ensureTotalCapacity(testing.allocator, 20);
-
-    for (0..5) |_| {
-        defer arr.clearRetainingCapacity();
-
-        const uri = try Uri.parse("https://127.0.0.1:9581/http_client/body");
-        var req = try tc.client.request(.GET, &uri);
-        defer req.deinit();
-
-        var res = try req.sendSync(.{ .tls_verify_host = false });
-
-        while (try res.next()) |data| {
-            arr.appendSliceAssumeCapacity(data);
-        }
-        try testing.expectEqual("1234567890abcdefhijk", arr.items);
-        try testing.expectEqual(201, res.header.status);
-        try testing.expectEqual(3, res.header.count());
-        try testing.expectEqual("20", res.header.get("content-length"));
-        try testing.expectEqual("HEaDer", res.header.get("another"));
-        try testing.expectEqual("Close", res.header.get("connection"));
-    }
-}
-
-test "HttpClient: sync redirect from TLS to Plaintext" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    var arr: std.ArrayListUnmanaged(u8) = .{};
-    defer arr.deinit(testing.allocator);
-    try arr.ensureTotalCapacity(testing.allocator, 20);
-
-    for (0..5) |_| {
-        defer arr.clearRetainingCapacity();
-
-        const uri = try Uri.parse("https://127.0.0.1:9581/http_client/redirect/insecure");
-        var req = try tc.client.request(.GET, &uri);
-        defer req.deinit();
-
-        var res = try req.sendSync(.{ .tls_verify_host = false });
-
-        while (try res.next()) |data| {
-            arr.appendSliceAssumeCapacity(data);
-        }
-        try testing.expectEqual(201, res.header.status);
-        try testing.expectEqual("over 9000!", arr.items);
-        try testing.expectEqual(5, res.header.count());
-        try testing.expectEqual("Close", res.header.get("connection"));
-        try testing.expectEqual("10", res.header.get("content-length"));
-        try testing.expectEqual("127.0.0.1", res.header.get("_host"));
-        try testing.expectEqual("Lightpanda/1.0", res.header.get("_user-agent"));
-        try testing.expectEqual("*/*", res.header.get("_accept"));
-    }
-}
-
-test "HttpClient: sync redirect plaintext to TLS" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    var arr: std.ArrayListUnmanaged(u8) = .{};
-    defer arr.deinit(testing.allocator);
-    try arr.ensureTotalCapacity(testing.allocator, 20);
-
-    for (0..5) |_| {
-        defer arr.clearRetainingCapacity();
-
-        const uri = try Uri.parse("http://127.0.0.1:9582/http_client/redirect/secure");
-        var req = try tc.client.request(.GET, &uri);
-        defer req.deinit();
-        var res = try req.sendSync(.{ .tls_verify_host = false });
-
-        while (try res.next()) |data| {
-            arr.appendSliceAssumeCapacity(data);
-        }
-        try testing.expectEqual(201, res.header.status);
-        try testing.expectEqual("1234567890abcdefhijk", arr.items);
-        try testing.expectEqual(3, res.header.count());
-        try testing.expectEqual("20", res.header.get("content-length"));
-        try testing.expectEqual("HEaDer", res.header.get("another"));
-        try testing.expectEqual("Close", res.header.get("connection"));
-    }
-}
-
-test "HttpClient: sync GET redirect" {
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    const uri = try Uri.parse("http://127.0.0.1:9582/http_client/redirect");
-    var req = try tc.client.request(.GET, &uri);
-    defer req.deinit();
-    var res = try req.sendSync(.{ .tls_verify_host = false });
-
-    try testing.expectEqual("over 9000!", try res.next());
-    try testing.expectEqual(201, res.header.status);
-    try testing.expectEqual(5, res.header.count());
-    try testing.expectEqual("Close", res.header.get("connection"));
-    try testing.expectEqual("10", res.header.get("content-length"));
-    try testing.expectEqual("127.0.0.1", res.header.get("_host"));
-    try testing.expectEqual("Lightpanda/1.0", res.header.get("_user-agent"));
-    try testing.expectEqual("*/*", res.header.get("_accept"));
-}
-
-test "HttpClient: async connect error" {
-    defer testing.reset();
-
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    const Handler = struct {
-        loop: *Loop,
-        reset: *Thread.ResetEvent,
-
-        fn requestReady(ctx: *anyopaque, req: *Request) !void {
-            const self: *@This() = @alignCast(@ptrCast(ctx));
-            try req.sendAsync(self, .{});
-        }
-
-        fn onHttpResponse(self: *@This(), res: anyerror!Progress) !void {
-            _ = res catch |err| {
-                if (err == error.ConnectionRefused) {
-                    self.reset.set();
-                    return;
-                }
-                std.debug.print("Expected error.ConnectionRefused, got error: {any}", .{err});
-                return;
-            };
-            std.debug.print("Expected error.ConnectionRefused, got no error", .{});
-        }
-    };
-
-    var reset: Thread.ResetEvent = .{};
-
-    var handler = Handler{
-        .loop = tc.loop,
-        .reset = &reset,
-    };
-
-    const uri = try Uri.parse("HTTP://127.0.0.1:9920");
-    try tc.client.initAsync(
-        testing.arena_allocator,
-        .GET,
-        &uri,
-        &handler,
-        Handler.requestReady,
-        .{},
-    );
-
-    for (0..10) |_| {
-        try tc.loop.io.run_for_ns(std.time.ns_per_ms * 10);
-        if (reset.isSet()) {
-            break;
-        }
-    } else {
-        return error.Timeout;
-    }
-}
-
-test "HttpClient: async no body" {
-    defer testing.reset();
-
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    var handler = tc.captureHandler();
-    defer handler.deinit();
-
-    const uri = try Uri.parse("HTTP://127.0.0.1:9582/http_client/simple");
-    try tc.client.initAsync(testing.arena_allocator, .GET, &uri, &handler, CaptureHandler.requestReady, .{});
-    try handler.waitUntilDone();
-
-    const res = handler.response;
-    try testing.expectEqual("", res.body.items);
-    try testing.expectEqual(200, res.status);
-    try res.assertHeaders(&.{ "content-length", "0", "connection", "close" });
-}
-
-test "HttpClient: async with body" {
-    defer testing.reset();
-
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    var handler = tc.captureHandler();
-    defer handler.deinit();
-
-    const uri = try Uri.parse("HTTP://127.0.0.1:9582/http_client/echo");
-    try tc.client.initAsync(testing.arena_allocator, .GET, &uri, &handler, CaptureHandler.requestReady, .{});
-    try handler.waitUntilDone();
-
-    const res = handler.response;
-    try testing.expectEqual("over 9000!", res.body.items);
-    try testing.expectEqual(201, res.status);
-    try res.assertHeaders(&.{
-        "content-length", "10",
-        "_host",          "127.0.0.1",
-        "_user-agent",    "Lightpanda/1.0",
-        "_accept",        "*/*",
-        "connection",     "Close",
-    });
-}
-
-test "HttpClient: async with gzip body" {
-    defer testing.reset();
-
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    var handler = tc.captureHandler();
-    defer handler.deinit();
-
-    const uri = try Uri.parse("HTTP://127.0.0.1:9582/http_client/gzip");
-    try tc.client.initAsync(testing.arena_allocator, .GET, &uri, &handler, CaptureHandler.requestReady, .{});
-    try handler.waitUntilDone();
-
-    const res = handler.response;
-    try testing.expectEqual("A new browser built for machines\n", res.body.items);
-    try testing.expectEqual(200, res.status);
-    try res.assertHeaders(&.{
-        "content-length",   "63",
-        "connection",       "close",
-        "content-encoding", "gzip",
-    });
-}
-
-test "HttpClient: async redirect" {
-    defer testing.reset();
-
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    var handler = tc.captureHandler();
-    defer handler.deinit();
-
-    const uri = try Uri.parse("HTTP://127.0.0.1:9582/http_client/redirect");
-    try tc.client.initAsync(testing.arena_allocator, .GET, &uri, &handler, CaptureHandler.requestReady, .{});
-
-    // Called twice on purpose. The initial GET resutls in the # of pending
-    // events to reach 0. This causes our `run_for_ns` to return. But we then
-    // start to requeue events (from the redirected request), so we need the
-    // loop to process those also.
-    try handler.loop.io.run_for_ns(std.time.ns_per_ms);
-    try handler.waitUntilDone();
-
-    const res = handler.response;
-    try testing.expectEqual("over 9000!", res.body.items);
-    try testing.expectEqual(201, res.status);
-    try res.assertHeaders(&.{
-        "content-length", "10",
-        "_host",          "127.0.0.1",
-        "_user-agent",    "Lightpanda/1.0",
-        "_accept",        "*/*",
-        "connection",     "Close",
-    });
-}
-
-test "HttpClient: async tls no body" {
-    defer testing.reset();
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    for (0..5) |_| {
-        var handler = tc.captureHandler();
-        defer handler.deinit();
-
-        const uri = try Uri.parse("HTTPs://127.0.0.1:9581/http_client/simple");
-        try tc.client.initAsync(testing.arena_allocator, .GET, &uri, &handler, CaptureHandler.requestReady, .{});
-        try handler.waitUntilDone();
-
-        const res = handler.response;
-        try testing.expectEqual("", res.body.items);
-        try testing.expectEqual(200, res.status);
-        try res.assertHeaders(&.{
-            "content-length",
-            "0",
-            "connection",
-            "Close",
-        });
-    }
-}
-
-test "HttpClient: async tls with body" {
-    defer testing.reset();
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    for (0..5) |_| {
-        var handler = tc.captureHandler();
-        defer handler.deinit();
-
-        const uri = try Uri.parse("HTTPs://127.0.0.1:9581/http_client/body");
-        try tc.client.initAsync(testing.arena_allocator, .GET, &uri, &handler, CaptureHandler.requestReady, .{});
-        try handler.waitUntilDone();
-
-        const res = handler.response;
-        try testing.expectEqual("1234567890abcdefhijk", res.body.items);
-        try testing.expectEqual(201, res.status);
-        try res.assertHeaders(&.{
-            "content-length", "20",
-            "connection",     "Close",
-            "another",        "HEaDer",
-        });
-    }
-}
-
-test "HttpClient: async redirect from TLS to Plaintext" {
-    defer testing.reset();
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    for (0..2) |_| {
-        var handler = tc.captureHandler();
-        defer handler.deinit();
-
-        const uri = try Uri.parse("https://127.0.0.1:9581/http_client/redirect/insecure");
-        try tc.client.initAsync(testing.arena_allocator, .GET, &uri, &handler, CaptureHandler.requestReady, .{});
-        try handler.waitUntilDone();
-
-        const res = handler.response;
-        try testing.expectEqual(201, res.status);
-        try testing.expectEqual("over 9000!", res.body.items);
-        try res.assertHeaders(&.{
-            "content-length", "10",
-            "_host",          "127.0.0.1",
-            "_user-agent",    "Lightpanda/1.0",
-            "_accept",        "*/*",
-            "connection",     "Close",
-        });
-    }
-}
-
-test "HttpClient: async redirect plaintext to TLS" {
-    defer testing.reset();
-    var tc = try TestContext.init(.{});
-    defer tc.deinit();
-
-    for (0..5) |_| {
-        var handler = tc.captureHandler();
-        defer handler.deinit();
-
-        const uri = try Uri.parse("http://127.0.0.1:9582/http_client/redirect/secure");
-        try tc.client.initAsync(testing.arena_allocator, .GET, &uri, &handler, CaptureHandler.requestReady, .{});
-        try handler.waitUntilDone();
-
-        const res = handler.response;
-        try testing.expectEqual(201, res.status);
-        try testing.expectEqual("1234567890abcdefhijk", res.body.items);
-        try res.assertHeaders(&.{ "content-length", "20", "connection", "Close", "another", "HEaDer" });
-    }
-}
-
-test "HttpClient: HeaderIterator" {
-    var header = ResponseHeader{};
-    defer header.headers.deinit(testing.allocator);
-
-    {
-        var it = header.iterate("nope");
-        try testing.expectEqual(null, it.next());
-        try testing.expectEqual(null, it.next());
-    }
-
-    // @constCast is totally unsafe here, but it's just a test, and we know
-    // nothing is going to write to it, so it works.
-    try header.headers.append(testing.allocator, .{ .name = "h1", .value = @constCast("value1") });
-    try header.headers.append(testing.allocator, .{ .name = "h2", .value = @constCast("value2") });
-    try header.headers.append(testing.allocator, .{ .name = "h3", .value = @constCast("value3") });
-    try header.headers.append(testing.allocator, .{ .name = "h1", .value = @constCast("value4") });
-    try header.headers.append(testing.allocator, .{ .name = "h1", .value = @constCast("value5") });
-
-    {
-        var it = header.iterate("nope");
-        try testing.expectEqual(null, it.next());
-        try testing.expectEqual(null, it.next());
-    }
-
-    {
-        var it = header.iterate("h2");
-        try testing.expectEqual("value2", it.next());
-        try testing.expectEqual(null, it.next());
-        try testing.expectEqual(null, it.next());
-    }
-
-    {
-        var it = header.iterate("h3");
-        try testing.expectEqual("value3", it.next());
-        try testing.expectEqual(null, it.next());
-        try testing.expectEqual(null, it.next());
-    }
-
-    {
-        var it = header.iterate("h1");
-        try testing.expectEqual("value1", it.next());
-        try testing.expectEqual("value4", it.next());
-        try testing.expectEqual("value5", it.next());
-        try testing.expectEqual(null, it.next());
-        try testing.expectEqual(null, it.next());
-    }
-}
-
-const TestResponse = struct {
-    status: u16,
-    arena: std.heap.ArenaAllocator,
-    body: std.ArrayListUnmanaged(u8),
-    headers: std.ArrayListUnmanaged(Header),
-
-    fn init() TestResponse {
-        return .{
-            .status = 0,
-            .body = .{},
-            .headers = .{},
-            .arena = ArenaAllocator.init(testing.allocator),
-        };
-    }
-
-    fn deinit(self: *TestResponse) void {
-        self.arena.deinit();
-    }
-
-    fn reset(self: *TestResponse) void {
-        _ = self.arena.reset(.{ .retain_capacity = {} });
-        self.status = 0;
-        self.body = .{};
-        self.headers = .{};
-    }
-
-    fn assertHeaders(self: *const TestResponse, expected: []const []const u8) !void {
-        const actual = self.headers.items;
-        errdefer {
-            std.debug.print("Actual headers:\n", .{});
-            for (actual) |a| {
-                std.debug.print("{s}: {s}\n", .{ a.name, a.value });
-            }
-        }
-
-        try testing.expectEqual(expected.len / 2, actual.len);
-
-        var i: usize = 0;
-        while (i < expected.len) : (i += 2) {
-            const a = actual[i / 2];
-            try testing.expectEqual(expected[i], a.name);
-            try testing.expectEqual(expected[i + 1], a.value);
-        }
-    }
-};
-
-fn testReader(state: *State, res: *TestResponse, data: []const u8) !void {
-    var status: u16 = 0;
-    var r = Reader.init(state);
-
-    // dupe it so that we have a mutable copy
-    const owned = try testing.allocator.dupe(u8, data);
-    defer testing.allocator.free(owned);
-
-    var unsent = owned;
-    while (unsent.len > 0) {
-        // send part of the response
-        const to_send = testing.Random.intRange(usize, 1, unsent.len);
-        var to_process = unsent[0..to_send];
-        while (true) {
-            const result = try r.process(to_process);
-
-            if (status == 0) {
-                if (r.response.status > 0) {
-                    status = r.response.status;
-                }
-            } else {
-                // once set, it should not change
-                try testing.expectEqual(status, r.response.status);
-            }
-
-            if (result.data) |d| {
-                try res.body.appendSlice(res.arena.allocator(), d);
-            }
-
-            if (result.done) {
-                res.status = status;
-                res.headers = r.response.headers;
-                return;
-            }
-            to_process = result.unprocessed orelse break;
-        }
-        unsent = unsent[to_send..];
-    }
-    return error.NeverDone;
-}
-
-const TestContext = struct {
-    loop: *Loop,
-    client: Client,
-
-    fn init(opts: Client.Opts) !TestContext {
-        const loop = try testing.allocator.create(Loop);
-        errdefer testing.allocator.destroy(loop);
-
-        loop.* = try Loop.init(testing.allocator);
-        errdefer loop.deinit();
-
-        var o = opts;
-        o.max_concurrent = 2;
-
-        const client = try Client.init(testing.allocator, loop, o);
-        errdefer client.deinit();
-
-        return .{
-            .loop = loop,
-            .client = client,
-        };
-    }
-
-    fn deinit(self: *TestContext) void {
-        self.loop.deinit();
-        self.client.deinit();
-        testing.allocator.destroy(self.loop);
-    }
-
-    fn captureHandler(self: *TestContext) CaptureHandler {
-        return .{
-            .reset = .{},
-            .loop = self.loop,
-            .response = TestResponse.init(),
-        };
-    }
-};
-
-const CaptureHandler = struct {
-    loop: *Loop,
-    reset: Thread.ResetEvent,
-    response: TestResponse,
-
-    fn deinit(self: *CaptureHandler) void {
-        self.response.deinit();
-    }
-
-    fn requestReady(ctx: *anyopaque, req: *Request) !void {
-        const self: *CaptureHandler = @alignCast(@ptrCast(ctx));
-        try req.sendAsync(self, .{ .tls_verify_host = false });
-    }
-
-    fn onHttpResponse(self: *CaptureHandler, progress_: anyerror!Progress) !void {
-        self.process(progress_) catch |err| {
-            std.debug.print("capture handler error: {}\n", .{err});
-        };
-    }
-
-    fn process(self: *CaptureHandler, progress_: anyerror!Progress) !void {
-        const progress = try progress_;
-        const allocator = self.response.arena.allocator();
-        try self.response.body.appendSlice(allocator, progress.data orelse "");
-        if (progress.first) {
-            std.debug.assert(!progress.done);
-            self.response.status = progress.header.status;
-            try self.response.headers.ensureTotalCapacity(allocator, progress.header.headers.items.len);
-            for (progress.header.headers.items) |header| {
-                self.response.headers.appendAssumeCapacity(.{
-                    .name = try allocator.dupe(u8, header.name),
-                    .value = try allocator.dupe(u8, header.value),
-                });
-            }
-        }
-
-        if (progress.done) {
-            self.reset.set();
-        }
-    }
-
-    fn waitUntilDone(self: *CaptureHandler) !void {
-        for (0..20) |_| {
-            try self.loop.io.run_for_ns(std.time.ns_per_ms * 25);
-            if (self.reset.isSet()) {
-                return;
-            }
-        }
-        return error.TimeoutWaitingForRequestToComplete;
-    }
-};
diff --git a/src/http/errors.zig b/src/http/errors.zig
new file mode 100644
index 00000000..dc9a4220
--- /dev/null
+++ b/src/http/errors.zig
@@ -0,0 +1,238 @@
+// Copyright (C) 2023-2025  Lightpanda (Selecy SAS)
+//
+// Francis Bouvier <francis@lightpanda.io>
+// Pierre Tachoire <pierre@lightpanda.io>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+const std = @import("std");
+const c = @import("client.zig").c;
+
+pub const Error = error {
+    UnsupportedProtocol,
+    FailedInit,
+    UrlMalformat,
+    NotBuiltIn,
+    CouldntResolveProxy,
+    CouldntResolveHost,
+    CouldntConnect,
+    WeirdServerReply,
+    RemoteAccessDenied,
+    FtpAcceptFailed,
+    FtpWeirdPassReply,
+    FtpAcceptTimeout,
+    FtpWeirdPasvReply,
+    FtpWeird227Format,
+    FtpCantGetHost,
+    Http2,
+    FtpCouldntSetType,
+    PartialFile,
+    FtpCouldntRetrFile,
+    QuoteError,
+    HttpReturnedError,
+    WriteError,
+    UploadFailed,
+    ReadError,
+    OutOfMemory,
+    OperationTimedout,
+    FtpPortFailed,
+    FtpCouldntUseRest,
+    RangeError,
+    SslConnectError,
+    BadDownloadResume,
+    FileCouldntReadFile,
+    LdapCannotBind,
+    LdapSearchFailed,
+    AbortedByCallback,
+    BadFunctionArgument,
+    InterfaceFailed,
+    TooManyRedirects,
+    UnknownOption,
+    SetoptOptionSyntax,
+    GotNothing,
+    SslEngineNotfound,
+    SslEngineSetfailed,
+    SendError,
+    RecvError,
+    SslCertproblem,
+    SslCipher,
+    PeerFailedVerification,
+    BadContentEncoding,
+    FilesizeExceeded,
+    UseSslFailed,
+    SendFailRewind,
+    SslEngineInitfailed,
+    LoginDenied,
+    TftpNotfound,
+    TftpPerm,
+    RemoteDiskFull,
+    TftpIllegal,
+    TftpUnknownid,
+    RemoteFileExists,
+    TftpNosuchuser,
+    SslCacertBadfile,
+    RemoteFileNotFound,
+    Ssh,
+    SslShutdownFailed,
+    Again,
+    SslCrlBadfile,
+    SslIssuerError,
+    FtpPretFailed,
+    RtspCseqError,
+    RtspSessionError,
+    FtpBadFileList,
+    ChunkFailed,
+    NoConnectionAvailable,
+    SslPinnedpubkeynotmatch,
+    SslInvalidcertstatus,
+    Http2Stream,
+    RecursiveApiCall,
+    AuthError,
+    Http3,
+    QuicConnectError,
+    Proxy,
+    SslClientcert,
+    UnrecoverablePoll,
+    TooLarge,
+    Unknown,
+};
+
+pub fn fromCode(code: c.CURLcode) Error {
+    std.debug.assert(code != c.CURLE_OK);
+
+    return switch (code) {
+        c.CURLE_UNSUPPORTED_PROTOCOL => Error.UnsupportedProtocol,
+        c.CURLE_FAILED_INIT => Error.FailedInit,
+        c.CURLE_URL_MALFORMAT => Error.UrlMalformat,
+        c.CURLE_NOT_BUILT_IN => Error.NotBuiltIn,
+        c.CURLE_COULDNT_RESOLVE_PROXY => Error.CouldntResolveProxy,
+        c.CURLE_COULDNT_RESOLVE_HOST => Error.CouldntResolveHost,
+        c.CURLE_COULDNT_CONNECT => Error.CouldntConnect,
+        c.CURLE_WEIRD_SERVER_REPLY => Error.WeirdServerReply,
+        c.CURLE_REMOTE_ACCESS_DENIED => Error.RemoteAccessDenied,
+        c.CURLE_FTP_ACCEPT_FAILED => Error.FtpAcceptFailed,
+        c.CURLE_FTP_WEIRD_PASS_REPLY => Error.FtpWeirdPassReply,
+        c.CURLE_FTP_ACCEPT_TIMEOUT => Error.FtpAcceptTimeout,
+        c.CURLE_FTP_WEIRD_PASV_REPLY => Error.FtpWeirdPasvReply,
+        c.CURLE_FTP_WEIRD_227_FORMAT => Error.FtpWeird227Format,
+        c.CURLE_FTP_CANT_GET_HOST => Error.FtpCantGetHost,
+        c.CURLE_HTTP2 => Error.Http2,
+        c.CURLE_FTP_COULDNT_SET_TYPE => Error.FtpCouldntSetType,
+        c.CURLE_PARTIAL_FILE => Error.PartialFile,
+        c.CURLE_FTP_COULDNT_RETR_FILE => Error.FtpCouldntRetrFile,
+        c.CURLE_QUOTE_ERROR => Error.QuoteError,
+        c.CURLE_HTTP_RETURNED_ERROR => Error.HttpReturnedError,
+        c.CURLE_WRITE_ERROR => Error.WriteError,
+        c.CURLE_UPLOAD_FAILED => Error.UploadFailed,
+        c.CURLE_READ_ERROR => Error.ReadError,
+        c.CURLE_OUT_OF_MEMORY => Error.OutOfMemory,
+        c.CURLE_OPERATION_TIMEDOUT => Error.OperationTimedout,
+        c.CURLE_FTP_PORT_FAILED => Error.FtpPortFailed,
+        c.CURLE_FTP_COULDNT_USE_REST => Error.FtpCouldntUseRest,
+        c.CURLE_RANGE_ERROR => Error.RangeError,
+        c.CURLE_SSL_CONNECT_ERROR => Error.SslConnectError,
+        c.CURLE_BAD_DOWNLOAD_RESUME => Error.BadDownloadResume,
+        c.CURLE_FILE_COULDNT_READ_FILE => Error.FileCouldntReadFile,
+        c.CURLE_LDAP_CANNOT_BIND => Error.LdapCannotBind,
+        c.CURLE_LDAP_SEARCH_FAILED => Error.LdapSearchFailed,
+        c.CURLE_ABORTED_BY_CALLBACK => Error.AbortedByCallback,
+        c.CURLE_BAD_FUNCTION_ARGUMENT => Error.BadFunctionArgument,
+        c.CURLE_INTERFACE_FAILED => Error.InterfaceFailed,
+        c.CURLE_TOO_MANY_REDIRECTS => Error.TooManyRedirects,
+        c.CURLE_UNKNOWN_OPTION => Error.UnknownOption,
+        c.CURLE_SETOPT_OPTION_SYNTAX => Error.SetoptOptionSyntax,
+        c.CURLE_GOT_NOTHING => Error.GotNothing,
+        c.CURLE_SSL_ENGINE_NOTFOUND => Error.SslEngineNotfound,
+        c.CURLE_SSL_ENGINE_SETFAILED => Error.SslEngineSetfailed,
+        c.CURLE_SEND_ERROR => Error.SendError,
+        c.CURLE_RECV_ERROR => Error.RecvError,
+        c.CURLE_SSL_CERTPROBLEM => Error.SslCertproblem,
+        c.CURLE_SSL_CIPHER => Error.SslCipher,
+        c.CURLE_PEER_FAILED_VERIFICATION => Error.PeerFailedVerification,
+        c.CURLE_BAD_CONTENT_ENCODING => Error.BadContentEncoding,
+        c.CURLE_FILESIZE_EXCEEDED => Error.FilesizeExceeded,
+        c.CURLE_USE_SSL_FAILED => Error.UseSslFailed,
+        c.CURLE_SEND_FAIL_REWIND => Error.SendFailRewind,
+        c.CURLE_SSL_ENGINE_INITFAILED => Error.SslEngineInitfailed,
+        c.CURLE_LOGIN_DENIED => Error.LoginDenied,
+        c.CURLE_TFTP_NOTFOUND => Error.TftpNotfound,
+        c.CURLE_TFTP_PERM => Error.TftpPerm,
+        c.CURLE_REMOTE_DISK_FULL => Error.RemoteDiskFull,
+        c.CURLE_TFTP_ILLEGAL => Error.TftpIllegal,
+        c.CURLE_TFTP_UNKNOWNID => Error.TftpUnknownid,
+        c.CURLE_REMOTE_FILE_EXISTS => Error.RemoteFileExists,
+        c.CURLE_TFTP_NOSUCHUSER => Error.TftpNosuchuser,
+        c.CURLE_SSL_CACERT_BADFILE => Error.SslCacertBadfile,
+        c.CURLE_REMOTE_FILE_NOT_FOUND => Error.RemoteFileNotFound,
+        c.CURLE_SSH => Error.Ssh,
+        c.CURLE_SSL_SHUTDOWN_FAILED => Error.SslShutdownFailed,
+        c.CURLE_AGAIN => Error.Again,
+        c.CURLE_SSL_CRL_BADFILE => Error.SslCrlBadfile,
+        c.CURLE_SSL_ISSUER_ERROR => Error.SslIssuerError,
+        c.CURLE_FTP_PRET_FAILED => Error.FtpPretFailed,
+        c.CURLE_RTSP_CSEQ_ERROR => Error.RtspCseqError,
+        c.CURLE_RTSP_SESSION_ERROR => Error.RtspSessionError,
+        c.CURLE_FTP_BAD_FILE_LIST => Error.FtpBadFileList,
+        c.CURLE_CHUNK_FAILED => Error.ChunkFailed,
+        c.CURLE_NO_CONNECTION_AVAILABLE => Error.NoConnectionAvailable,
+        c.CURLE_SSL_PINNEDPUBKEYNOTMATCH => Error.SslPinnedpubkeynotmatch,
+        c.CURLE_SSL_INVALIDCERTSTATUS => Error.SslInvalidcertstatus,
+        c.CURLE_HTTP2_STREAM => Error.Http2Stream,
+        c.CURLE_RECURSIVE_API_CALL => Error.RecursiveApiCall,
+        c.CURLE_AUTH_ERROR => Error.AuthError,
+        c.CURLE_HTTP3 => Error.Http3,
+        c.CURLE_QUIC_CONNECT_ERROR => Error.QuicConnectError,
+        c.CURLE_PROXY => Error.Proxy,
+        c.CURLE_SSL_CLIENTCERT => Error.SslClientcert,
+        c.CURLE_UNRECOVERABLE_POLL => Error.UnrecoverablePoll,
+        c.CURLE_TOO_LARGE => Error.TooLarge,
+        else => Error.Unknown,
+    };
+}
+
+pub const Multi = error {
+    BadHandle,
+    BadEasyHandle,
+    OutOfMemory,
+    InternalError,
+    BadSocket,
+    UnknownOption,
+    AddedAlready,
+    RecursiveApiCall,
+    WakeupFailure,
+    BadFunctionArgument,
+    AbortedByCallback,
+    UnrecoverablePoll,
+    Unknown,
+};
+
+pub fn fromMCode(code: c.CURLMcode) Multi {
+    std.debug.assert(code != c.CURLM_OK);
+
+    return switch (code) {
+        c.CURLM_BAD_HANDLE => Multi.BadHandle,
+        c.CURLM_BAD_EASY_HANDLE => Multi.BadEasyHandle,
+        c.CURLM_OUT_OF_MEMORY => Multi.OutOfMemory,
+        c.CURLM_INTERNAL_ERROR => Multi.InternalError,
+        c.CURLM_BAD_SOCKET => Multi.BadSocket,
+        c.CURLM_UNKNOWN_OPTION => Multi.UnknownOption,
+        c.CURLM_ADDED_ALREADY => Multi.AddedAlready,
+        c.CURLM_RECURSIVE_API_CALL => Multi.RecursiveApiCall,
+        c.CURLM_WAKEUP_FAILURE => Multi.WakeupFailure,
+        c.CURLM_BAD_FUNCTION_ARGUMENT => Multi.BadFunctionArgument,
+        c.CURLM_ABORTED_BY_CALLBACK => Multi.AbortedByCallback,
+        c.CURLM_UNRECOVERABLE_POLL => Multi.UnrecoverablePoll,
+        else => Multi.Unknown,
+    };
+}
diff --git a/src/main.zig b/src/main.zig
index 5e49ecb5..abfca143 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -22,8 +22,8 @@ const Allocator = std.mem.Allocator;
 
 const log = @import("log.zig");
 const server = @import("server.zig");
-const App = @import("app.zig").App;
 const http = @import("http/client.zig");
+const App = @import("app.zig").App;
 const Platform = @import("runtime/js.zig").Platform;
 const Browser = @import("browser/browser.zig").Browser;
 
@@ -107,8 +107,8 @@ fn run(alloc: Allocator) !void {
             };
         },
         .fetch => |opts| {
-            log.debug(.app, "startup", .{ .mode = "fetch", .dump = opts.dump, .url = opts.url });
-            const url = try @import("url.zig").URL.parse(opts.url, null);
+            const url = opts.url;
+            log.debug(.app, "startup", .{ .mode = "fetch", .dump = opts.dump, .url = url });
 
             // browser
             var browser = try Browser.init(app);
@@ -130,7 +130,7 @@ fn run(alloc: Allocator) !void {
                 },
             };
 
-            try page.wait(std.time.ns_per_s * 3);
+            try page.wait(5); // 5 seconds
 
             // dump
             if (opts.dump) {
@@ -633,7 +633,7 @@ test "tests:beforeAll" {
     log.opts.level = .err;
     log.opts.format = .logfmt;
 
-    test_wg.startMany(3);
+    test_wg.startMany(2);
     const platform = try Platform.init();
 
     {
@@ -642,12 +642,6 @@ test "tests:beforeAll" {
         thread.detach();
     }
 
-    {
-        const address = try std.net.Address.parseIp("127.0.0.1", 9581);
-        const thread = try std.Thread.spawn(.{}, serveHTTPS, .{address});
-        thread.detach();
-    }
-
     {
         const address = try std.net.Address.parseIp("127.0.0.1", 9583);
         const thread = try std.Thread.spawn(.{}, serveCDP, .{ address, &platform });
@@ -759,79 +753,6 @@ fn serveHTTP(address: std.net.Address) !void {
     }
 }
 
-// This is a lot of work for testing TLS, but the TLS (async) code is complicated
-// This "server" is written specifically to test the client. It assumes the client
-// isn't a jerk.
-fn serveHTTPS(address: std.net.Address) !void {
-    const tls = @import("tls");
-
-    var listener = try address.listen(.{ .reuse_address = true });
-    defer listener.deinit();
-
-    test_wg.finish();
-
-    var seed: u64 = undefined;
-    std.posix.getrandom(std.mem.asBytes(&seed)) catch unreachable;
-    var r = std.Random.DefaultPrng.init(seed);
-    const rand = r.random();
-
-    var read_buffer: [1024]u8 = undefined;
-    while (true) {
-        const stream = blk: {
-            const conn = try listener.accept();
-            break :blk conn.stream;
-        };
-        defer stream.close();
-
-        var conn = try tls.server(stream, .{ .auth = null });
-        defer conn.close() catch {};
-
-        var pos: usize = 0;
-        while (true) {
-            const n = try conn.read(read_buffer[pos..]);
-            if (n == 0) {
-                break;
-            }
-            pos += n;
-            const header_end = std.mem.indexOf(u8, read_buffer[0..pos], "\r\n\r\n") orelse {
-                continue;
-            };
-            var it = std.mem.splitScalar(u8, read_buffer[0..header_end], ' ');
-            _ = it.next() orelse unreachable; // method
-            const path = it.next() orelse unreachable;
-
-            var fragment = false;
-            var response: []const u8 = undefined;
-            if (std.mem.eql(u8, path, "/http_client/simple")) {
-                fragment = true;
-                response = "HTTP/1.1 200 \r\nContent-Length: 0\r\nConnection: Close\r\n\r\n";
-            } else if (std.mem.eql(u8, path, "/http_client/body")) {
-                fragment = true;
-                response = "HTTP/1.1 201 CREATED\r\nContent-Length: 20\r\nConnection: Close\r\n   Another :  HEaDer  \r\n\r\n1234567890abcdefhijk";
-            } else if (std.mem.eql(u8, path, "/http_client/redirect/insecure")) {
-                fragment = true;
-                response = "HTTP/1.1 307 GOTO\r\nLocation: http://127.0.0.1:9582/http_client/redirect\r\nConnection: Close\r\n\r\n";
-            } else if (std.mem.eql(u8, path, "/xhr")) {
-                response = "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 100\r\nConnection: Close\r\n\r\n" ++ ("1234567890" ** 10);
-            } else if (std.mem.eql(u8, path, "/xhr/json")) {
-                response = "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 18\r\nConnection: Close\r\n\r\n{\"over\":\"9000!!!\"}";
-            } else {
-                // should not have an unknown path
-                unreachable;
-            }
-
-            var unsent = response;
-            while (unsent.len > 0) {
-                const to_send = if (fragment) rand.intRangeAtMost(usize, 1, unsent.len) else unsent.len;
-                const sent = try conn.write(unsent[0..to_send]);
-                unsent = unsent[sent..];
-                std.time.sleep(std.time.ns_per_us * 5);
-            }
-            break;
-        }
-    }
-}
-
 fn serveCDP(address: std.net.Address, platform: *const Platform) !void {
     var gpa: std.heap.GeneralPurposeAllocator(.{}) = .init;
     var app = try App.init(gpa.allocator(), .{
diff --git a/src/notification.zig b/src/notification.zig
index e3170231..9b33d783 100644
--- a/src/notification.zig
+++ b/src/notification.zig
@@ -2,8 +2,8 @@ const std = @import("std");
 
 const log = @import("log.zig");
 const URL = @import("url.zig").URL;
+const http = @import("http/client.zig");
 const page = @import("browser/page.zig");
-const http_client = @import("http/client.zig");
 
 const Allocator = std.mem.Allocator;
 
@@ -94,8 +94,7 @@ pub const Notification = struct {
         arena: Allocator,
         id: usize,
         url: *const std.Uri,
-        method: http_client.Request.Method,
-        headers: *std.ArrayListUnmanaged(std.http.Header),
+        method: http.Method,
         has_body: bool,
     };
 
@@ -109,7 +108,6 @@ pub const Notification = struct {
         id: usize,
         url: *const std.Uri,
         status: u16,
-        headers: []http_client.Header,
     };
 
     pub fn init(allocator: Allocator, parent: ?*Notification) !*Notification {
diff --git a/src/runtime/loop.zig b/src/runtime/loop.zig
index 71cd7f8a..c2c76645 100644
--- a/src/runtime/loop.zig
+++ b/src/runtime/loop.zig
@@ -121,6 +121,10 @@ pub const Loop = struct {
         }
     }
 
+    pub fn hasPendingTimeout(self: *Self) bool {
+        return self.pending_timeout_count > 0;
+    }
+
     // JS callbacks APIs
     // -----------------
 
diff --git a/src/telemetry/lightpanda.zig b/src/telemetry/lightpanda.zig
index cb7df2df..d9b45abe 100644
--- a/src/telemetry/lightpanda.zig
+++ b/src/telemetry/lightpanda.zig
@@ -7,8 +7,8 @@ const Allocator = std.mem.Allocator;
 
 const log = @import("../log.zig");
 const App = @import("../app.zig").App;
+const http = @import("../http/client.zig");
 const telemetry = @import("telemetry.zig");
-const HttpClient = @import("../http/client.zig").Client;
 
 const URL = "https://telemetry.lightpanda.io";
 const MAX_BATCH_SIZE = 20;
@@ -21,7 +21,7 @@ pub const LightPanda = struct {
     allocator: Allocator,
     mutex: std.Thread.Mutex,
     cond: Thread.Condition,
-    client: *HttpClient,
+    client: *http.Client,
     node_pool: std.heap.MemoryPool(List.Node),
 
     const List = std.DoublyLinkedList(LightPandaEvent);
diff --git a/src/testing.zig b/src/testing.zig
index 65d24f8d..634dece5 100644
--- a/src/testing.zig
+++ b/src/testing.zig
@@ -406,8 +406,8 @@ pub const JsRunner = struct {
             .url = try page.url.toWebApi(page.arena),
         });
 
-        var html = std.io.fixedBufferStream(opts.html);
-        try page.loadHTMLDoc(html.reader(), "UTF-8");
+        const html_doc = try parser.documentHTMLParseFromStr(opts.html);
+        try page.setDocument(html_doc);
 
         return .{
             .app = app,
diff --git a/src/url.zig b/src/url.zig
index 7b097473..21fbff54 100644
--- a/src/url.zig
+++ b/src/url.zig
@@ -87,6 +87,7 @@ pub const URL = struct {
 
     const StitchOpts = struct {
         alloc: AllocWhen = .always,
+        null_terminated: bool = false,
 
         const AllocWhen = enum {
             always,
@@ -102,9 +103,13 @@ pub const URL = struct {
         allocator: Allocator,
         path: []const u8,
         base: []const u8,
-        opts: StitchOpts,
-    ) ![]const u8 {
+        comptime opts: StitchOpts,
+    ) !StitchReturn(opts) {
         if (base.len == 0 or isComleteHTTPUrl(path)) {
+            if (comptime opts.null_terminated) {
+                return allocator.dupeZ(u8, path);
+            }
+
             if (opts.alloc == .always) {
                 return allocator.dupe(u8, path);
             }
@@ -112,6 +117,10 @@ pub const URL = struct {
         }
 
         if (path.len == 0) {
+            if (comptime opts.null_terminated) {
+                return allocator.dupeZ(u8, base);
+            }
+
             if (opts.alloc == .always) {
                 return allocator.dupe(u8, base);
             }
@@ -126,6 +135,9 @@ pub const URL = struct {
 
         if (path[0] == '/') {
             const pos = std.mem.indexOfScalarPos(u8, base, protocol_end, '/') orelse base.len;
+            if (comptime opts.null_terminated) {
+                return std.fmt.allocPrintZ(allocator, "{s}{s}", .{ base[0..pos], path });
+            }
             return std.fmt.allocPrint(allocator, "{s}{s}", .{ base[0..pos], path });
         }
 
@@ -134,17 +146,22 @@ pub const URL = struct {
             normalized_base = base[0 .. pos + protocol_end];
         }
 
-        var out = try std.fmt.allocPrint(allocator, "{s}/{s}", .{
+        // that extra spacelets us handle opts.null_terminated. If we end up
+        // not trimming anything, it ensures that we have 1 extra byte to store
+        // our null terminator.
+        var out = try std.fmt.allocPrint(allocator, "{s}/{s}" ++ if (comptime opts.null_terminated) " " else "", .{
             normalized_base,
             path,
         });
 
+        const end = if (comptime opts.null_terminated) out.len - 1 else out.len;
+
         // Strip out ./ and ../. This is done in-place, because doing so can
         // only ever make `out` smaller. After this, `out` cannot be freed by
         // an allocator, which is ok, because we expect allocator to be an arena.
         var in_i: usize = 0;
         var out_i: usize = 0;
-        while (in_i < out.len) {
+        while (in_i < end) {
             if (std.mem.startsWith(u8, out[in_i..], "./")) {
                 in_i += 2;
                 continue;
@@ -165,9 +182,19 @@ pub const URL = struct {
             in_i += 1;
             out_i += 1;
         }
+
+        if (comptime opts.null_terminated) {
+            // we always have an extra space
+            out[out_i] = 0;
+            return out[0..out_i :0];
+        }
         return out[0..out_i];
     }
 
+    fn StitchReturn(comptime opts: StitchOpts) type {
+        return if (opts.null_terminated) [:0]const u8 else []const u8;
+    }
+
     pub fn concatQueryString(arena: Allocator, url: []const u8, query_string: []const u8) ![]const u8 {
         std.debug.assert(url.len != 0);
 
@@ -362,6 +389,124 @@ test "URL: stitch" {
     );
 }
 
+test "URL: stitch null terminated" {
+    defer testing.reset();
+
+    const Case = struct {
+        base: []const u8,
+        path: []const u8,
+        expected: []const u8,
+    };
+
+    const cases = [_]Case{
+        .{
+            .base = "https://lightpanda.io/xyz/abc/123",
+            .path = "something.js",
+            .expected = "https://lightpanda.io/xyz/abc/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io/xyz/abc/123",
+            .path = "/something.js",
+            .expected = "https://lightpanda.io/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io/",
+            .path = "something.js",
+            .expected = "https://lightpanda.io/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io/",
+            .path = "/something.js",
+            .expected = "https://lightpanda.io/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io",
+            .path = "something.js",
+            .expected = "https://lightpanda.io/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io",
+            .path = "abc/something.js",
+            .expected = "https://lightpanda.io/abc/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io/nested",
+            .path = "abc/something.js",
+            .expected = "https://lightpanda.io/abc/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io/nested/",
+            .path = "abc/something.js",
+            .expected = "https://lightpanda.io/nested/abc/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io/nested/",
+            .path = "/abc/something.js",
+            .expected = "https://lightpanda.io/abc/something.js",
+        },
+        .{
+            .base = "https://lightpanda.io/nested/",
+            .path = "http://www.github.com/lightpanda-io/",
+            .expected = "http://www.github.com/lightpanda-io/",
+        },
+        .{
+            .base = "https://lightpanda.io/nested/",
+            .path = "",
+            .expected = "https://lightpanda.io/nested/",
+        },
+        .{
+            .base = "https://lightpanda.io/abc/aaa",
+            .path = "./hello/./world",
+            .expected = "https://lightpanda.io/abc/hello/world",
+        },
+        .{
+            .base = "https://lightpanda.io/abc/aaa/",
+            .path = "../hello",
+            .expected = "https://lightpanda.io/abc/hello",
+        },
+        .{
+            .base = "https://lightpanda.io/abc/aaa",
+            .path = "../hello",
+            .expected = "https://lightpanda.io/hello",
+        },
+        .{
+            .base = "https://lightpanda.io/abc/aaa/",
+            .path = "./.././.././hello",
+            .expected = "https://lightpanda.io/hello",
+        },
+        .{
+            .base = "some/page",
+            .path = "hello",
+            .expected = "some/hello",
+        },
+        .{
+            .base = "some/page/",
+            .path = "hello",
+            .expected = "some/page/hello",
+        },
+
+        .{
+            .base = "some/page/other",
+            .path = ".././hello",
+            .expected = "some/hello",
+        },
+    };
+
+    for (cases) |case| {
+        const result = try stitch(testing.arena_allocator, case.path, case.base, .{ .null_terminated = true });
+        try testing.expectString(case.expected, result);
+    }
+
+    try testing.expectError(
+        error.InvalidURL,
+        stitch(testing.arena_allocator, "../hello", "https://lightpanda.io/", .{ .null_terminated = true }),
+    );
+    try testing.expectError(
+        error.InvalidURL,
+        stitch(testing.arena_allocator, "../hello", "http://lightpanda.io/", .{ .null_terminated = true }),
+    );
+}
+
 test "URL: concatQueryString" {
     defer testing.reset();
     const arena = testing.arena_allocator;
diff --git a/vendor/curl b/vendor/curl
new file mode 160000
index 00000000..6845533e
--- /dev/null
+++ b/vendor/curl
@@ -0,0 +1 @@
+Subproject commit 6845533e24f6febc7a006224b8991de5da328667
diff --git a/vendor/mbedtls b/vendor/mbedtls
new file mode 160000
index 00000000..c765c831
--- /dev/null
+++ b/vendor/mbedtls
@@ -0,0 +1 @@
+Subproject commit c765c831e5c2a0971410692f92f7a81d6ec65ec2
diff --git a/vendor/nghttp2 b/vendor/nghttp2
new file mode 160000
index 00000000..ac22e0ef
--- /dev/null
+++ b/vendor/nghttp2
@@ -0,0 +1 @@
+Subproject commit ac22e0efe3f82f43c1366961c89a50ee821cfba3
diff --git a/vendor/zlib b/vendor/zlib
new file mode 160000
index 00000000..51b7f2ab
--- /dev/null
+++ b/vendor/zlib
@@ -0,0 +1 @@
+Subproject commit 51b7f2abdade71cd9bb0e7a373ef2610ec6f9daf