[AustinBenoit]

Summary

Modernizes the desktop HTTP/REST transport (app/rest/) by replacing the legacy 50 ms select() + curl_multi_fdset() polling loop with an event-driven process-wide CurlIoLoop (curl_multi_poll() + curl_multi_wakeup()), off-thread async completion delivery (CompletionQueue), thread-safe transfer control (TransferControl), and HTTP/2 multiplexing support.

Architecture & Key Changes

1. Event-Driven HTTP Loop (app/rest/curl/curl_io_loop.{h,cc})

• Replaces curl_multi_fdset() + select() + 33–50 ms polling sleeps with curl_multi_poll() + curl_multi_wakeup().
• Eliminates the FD_SETSIZE = 1024 Cliff: Under select(), any socket with fd >= 1024 (common in Unreal/Unity desktop games with open asset packs) was invisible to fd_set, causing multi-second stalls when paired with a low-FD transfer or degrading into polling ticks. curl_multi_poll() uses OS poll()/WSAPoll() with no descriptor ceiling.
• Zero Idle CPU & Sub-Millisecond Wakeups: When idle, the I/O thread blocks up to kIdlePollWaitMs (60 s) with 0% CPU wakeups; new transfers, pauses, resumes, and cancellations wake the loop immediately via curl_multi_wakeup().

2. Off-Thread Asynchronous Completion Delivery (CompletionQueue)

• Delivers asynchronous Response::MarkCompleted() and Response::MarkFailed() callbacks on a dedicated CompletionQueue worker thread rather than inline on the CurlIoLoop thread.
• Prevents application callbacks, chained Future continuations, or synchronous token refresh RPCs from blocking or deadlocking the shared network I/O thread.
• CleanupTransportCurl() drains all queued completions before returning, preserving deterministic teardown semantics.

3. Thread-Safe ControllerCurl & TransferControl

• Replaces raw cross-thread pointer sharing between ControllerCurl and TransportCurl with a shared std::shared_ptr<TransferControl> state block.
• Sticky Pause Before First Byte: Calling Controller::Pause() immediately after Perform() (before libcurl has opened a socket) latches paused state and returns CURL_WRITEFUNC_PAUSE / CURL_READFUNC_PAUSE on the first data callback instead of being lost as a no-op.
• Immediate Cancellation & Exact Progress: Controller::Cancel() wakes the loop immediately and aborts via CURLOPT_XFERINFOFUNCTION, which also keeps BytesTransferred() and TransferSize() exact through 100% completion.

4. HTTP/2 & RFC 9110 Response Parsing

• Enables CURL_HTTP_VERSION_2TLS (HTTP/2 over TLS with automatic HTTP/1.1 fallback) when LibcurlSupportsHttp2() is true, and builds bundled libcurl alongside nghttp2.
• Updates Response::ParseHeader() to parse HTTP/2 and HTTP/3 status lines (HTTP/2 200, HTTP/3 204), reasonless status lines (HTTP/1.1 200), and intermediate 100 Continue responses, with case-insensitive RFC 9110 header lookup.

[gemini-code-assist]

Code Review

This pull request replaces the legacy uWebSockets and libuv WebSocket transport with a libcurl-based implementation on desktop platforms, consolidating all REST and Realtime Database WebSocket traffic onto a single shared, event-driven I/O thread. It also centralizes the TLS policy configuration and removes the libuv and uWebSockets dependencies. The review feedback highlights potential unsigned integer underflow risks in web_socket_client_impl.cc when performing bounds checks on incoming PING and message payloads, recommending that these subtraction-based checks be rewritten using addition.

[gemini-code-assist]

To prevent potential unsigned integer underflow when checking the bounds of the incoming PING frame payload, rewrite the subtraction checks using addition. This is a safer, more defensive programming practice.

Suggested change

	if ((meta->flags & CURLWS_CONT) != 0 ||
	rlen > kMaxPingPayloadBytes - incoming_ping_buffer_.size() ||
	frame_remaining >
	kMaxPingPayloadBytes - (incoming_ping_buffer_.size() + rlen)) {
	if ((meta->flags & CURLWS_CONT) != 0 ||
	incoming_ping_buffer_.size() + rlen > kMaxPingPayloadBytes ||
	incoming_ping_buffer_.size() + rlen + frame_remaining >
	kMaxPingPayloadBytes) {

[AustinBenoit]

Note: incoming_ping_buffer_.size() <= kMaxPingPayloadBytes is an invariant enforced before every append(), so kMaxPingPayloadBytes - incoming_ping_buffer_.size() cannot underflow, whereas incoming_ping_buffer_.size() + rlen + frame_remaining could overflow uint64_t if a peer sent a header with bytesleft near INT64_MAX. Also note database/ now lives in base PR #1959 (0 lines touched in #1956).

[gemini-code-assist]

Similarly, to prevent potential unsigned integer underflow when checking the bounds of the incoming message payload, rewrite the subtraction checks using addition.

      if (incoming_message_buffer_.size() + rlen > kMaxMessagePayloadBytes ||
          incoming_message_buffer_.size() + rlen + frame_remaining >
              kMaxMessagePayloadBytes) {

[AustinBenoit]

Same as above: incoming_message_buffer_.size() <= kMaxMessagePayloadBytes is an invariant so the subtraction form avoids uint64_t addition overflow against untrusted frame_remaining.

[AustinBenoit]

📚 Stacked PR Navigation

• Part 1 of 2 (Base PR): database: replace uWebSockets and libuv with libcurl WebSockets #1959 — database: replace uWebSockets and libuv with libcurl WebSockets (main ← libcurl-websockets)
  • 👉 Part 2 of 2 (This PR): rest: replace select() polling with event-driven CurlIoLoop and support HTTP/2 #1956 — rest: replace select() polling with event-driven CurlIoLoop and support HTTP/2 (libcurl-websockets ← libcurl-http2-polish)