AlphaX 1.0

AlphaX 1.0 is the stable package line prepared from the published 1.0.0-rc.5
candidate. The source tree contains the final stable metadata; package
publication is a separate release action.

What AlphaX is

AlphaX is a transport-independent Dart HTTP client contract and policy layer.
Applications choose a deployment package or provide a custom
AlphaXTransport; the core does not require a particular networking engine.

Platform-native networking

alphax_native provides the native Flutter entry façade and selects the
existing platform transport. Android uses the available Cronet/HttpEngine
provider, Apple platforms use URLSession, and Linux/Windows use the Dart IO
fallback. alphax_web provides the browser Fetch entry façade.

Protocol visibility

Android and Apple providers may negotiate H1, H2, or H3 according to the
provider, operating system, server, proxy, and network. AlphaX reports the
actual protocol and fallback metadata where the provider can authoritatively
report them. Protocol preference may fall back; protocol requirements fail
closed. Dart IO is an H1-only fallback, and browser protocol details remain
browser-owned.

Security and policy

Secure platform TLS defaults, host-scoped pinning where supported, explicit
proxy policy, authentication middleware, cookies, caching, retries, and
resilience are composed through the frozen AlphaX client and transport
contracts. Unsupported security or proxy controls fail honestly rather than
silently weakening the request.

Streaming and files

AlphaX supports bounded response streaming, cancellation, multipart/file
transfers, and native file paths where the selected provider exposes them.
Progress is opt-in. alphax_transform remains an optional explicit one-shot
transform for already-buffered JSON payloads.

SSE and WebSocket

package:alphax/sse.dart provides an incremental SSE parser over an existing
AlphaX HTTP response stream. It surfaces data, event, ID, and retry fields;
reconnection and Last-Event-ID policy remain caller-owned.

package:alphax/websocket.dart provides a separate transport-neutral connector
and session lifecycle for ordered text and binary messages, subprotocols, and
close information. WebSocket connections do not automatically reconnect,
replay, or expose universal provider-specific controls.

Ecosystem compatibility

• Direct AlphaX, the native/Web façades, HTTP contracts, SSE, WebSocket, and
  the direct typed REST generator are FIRST_CLASS AlphaX capabilities.
• Dio, Retrofit through Dio, package:http, Chopper, GraphQL HTTP, and the
  validated injectable OpenAPI Dio/HTTP paths are
  SUPPORTED_VIA_ADAPTER.
• json_serializable, Freezed, and Protobuf are
  COMPATIBLE_CALLER_LAYER integrations. Protobuf is used as serialization;
  it is not gRPC.
• The direct OpenAPI template and GraphQL WebSocket/subscription caller bridge
  are PROOF_ONLY.
• gRPC is DEFERRED_POST_1_0.

Typed REST generation

alphax_generator is development-time tooling for direct typed REST clients.
Generated code calls AlphaXClient directly, borrows its lifecycle, and keeps
model serialization caller-owned. It does not require Dio or package:http at
runtime. The OpenAPI integration remains a bounded template proof, not a full
OpenAPI SDK generator.

Testing and transforms

alphax_test provides deterministic fakes and conformance helpers for tests.
alphax_transform is optional and performs explicit one-shot native isolate
transforms; it does not add a worker pool or automatic buffering threshold.

Supported platforms

Platform	Stable boundary
Android	Cronet/HttpEngine; provider/network-dependent H1/H2/H3
iOS	URLSession; H1/H2/H3 are provider and network dependent
macOS	URLSession; H1/H2/H3 are provider and network dependent
Linux	Dart IO H1 fallback
Windows	Dart IO H1 fallback
Web	Browser Fetch/WebSocket; browser owns TLS/CORS/proxy/origin/protocol

Windows remains classified as
WINDOWS_SUPPORTED_UNVERIFIED_IN_CURRENT_GATE.

Known boundaries

Protocol capabilities and buffering differ by provider. Browser WebSocket
headers, TLS, CORS, proxy, origin, and connection behavior are browser-owned.
The direct OpenAPI integration is proof-only; GraphQL WebSocket is a
caller-bridge proof. Protobuf interoperability does not imply gRPC support.
SSE and WebSocket reconnection, replay, and backoff are not automatic.
Provider-specific header, ping/pong, frame, message-size, and queue limits
remain provider concerns.

Migrating from rc.5

If an application already uses 1.0.0-rc.5, update the coordinated package
constraints to 1.0.0 after stable publication. No API or source migration is
required.

• Added the one-import createAlphaXClient() façade, delegating transport selection to the existing native factory while preserving explicit transport construction and client-owned close semantics.
• Re-exported the ordinary public AlphaX API and exposed the native WebSocket connector alongside the existing Dart IO, Android, Apple, and browser-boundary behavior.
• Validated native SSE response-stream parsing and the frozen WebSocket lifecycle contract without adding a second networking engine.

• Corrected Apple URLSession phase-duration conversion so reported millisecond metrics are scaled exactly once.
• Hardened Apple URLSession bounded response backpressure, cancellation, and completion ordering while preserving the 64 KiB × 4 delivery window and 256 KiB pending bound.
• Improved Apple native-file finalization with FileManager.replaceItemAt when replacing an existing destination; atomic replacement is not claimed.
• Suppressed native progress-event construction and delivery when an operation has no progress observer, while retaining authoritative byte accounting.
• Added createAlphaXTransport() for automatic Android Cronet/HttpEngine, Apple URLSession, and Dart IO selection without adding platform dependencies to alphax core.

• Added a runnable example using the Dart IO fallback transport and reading completion-time protocol metadata.

• Corrected the theme-aware README logo URLs to absolute repository assets so pub.dev and other Markdown renderers load both SVG variants.

• Added the platform transport integration boundary.
• Added the Dart IO fallback transport with HTTP/1.1 request/response streaming, file transfers, cancellation, timeouts, redirects, progress, normalized errors, and reusable-client lifecycle handling.
• Added the Android Cronet/HttpEngine adapter behind a reusable engine with actual protocol reporting, bounded response delivery, cancellation, progress, and native-capable file paths. Physical-device validation is complete for the accepted Phase 1C evidence.
• Added the shared iOS/macOS URLSession adapter with actual task-metric protocol reporting, bounded streaming, native file paths, progress, cancellation, redirects, and normalized errors. macOS and signed iPhone correctness evidence covers H1/H2/H3 and fallback behavior.
• Added release-hardening documentation for secure TLS/pinning, system-managed proxy behavior, cross-origin redirect credential stripping, and the 1.0 platform matrix.

Known limitations are provider-dependent H3 availability, Dart IO H1-only fallback, unsupported mTLS, selected-provider Android custom trust limits, unsupported Dart IO SPKI pinning, explicit HTTPS-proxy endpoint parity, and deferred Swift Package Manager packaging.