nx_https_url_connect.nx

nx_https_url_connect.nx -- step 2 of the nx_https_client orchestrator wiring arc. Takes an already-validated NxHttpsTarget (from nx_https_url_for_fetch step 1) PLUS the URL buffer it was parsed from, resolves the host via DNS, builds a sockaddr, and TCP-connects to host:port. Returns a connected file descriptor ready for the TLS handshake (step 3). Composes 3 shipped primitives: nx_https_url_for_fetch (c0117caa) -- already-parsed target nx_dns_resolve_default -- hostname -> packed IPv4 sys_socket / sys_connect / sys_close -- BSD socket primitives Public API: nx_https_url_connect(target, url_buf, now_unix, out_fd) -> verdict nx_https_connect_verdict_is_valid(v) -> 0|1 Why the url_buf parameter is separate: NxHttpsTarget.url.host_off is an OFFSET into the URL string the caller originally passed to nx_https_url_for_fetch. This primitive needs the resolved host bytes, so the caller must pass the same url_buf. An alternative API would have NxHttpsTarget carry the url_buf pointer itself -- that's a refactor for a future commit; for now we keep the explicit parameter to avoid breaking step 1's existing API. Sealed verdict enum: NX_HTTPS_CONNECT_OK socket connected; *out_fd valid NX_HTTPS_CONNECT_DNS_FAIL DNS resolution returned no IPv4 NX_HTTPS_CONNECT_SOCKET_FAIL sys_socket returned negative NX_HTTPS_CONNECT_CONNECT_FAIL sys_connect returned negative On any non-OK return, *out_fd is set to -1 and any socket already allocated is closed. Callers don't need to clean up on failure verdicts. Per Cardinals 9 (single-responsibility -- step 2 only; TLS + HTTP are separate primitives), 12 (defensive at boundaries -- close fd on every failure path to avoid descriptor leaks), 23