@@ -5,6 +5,35 @@ All notable changes to the zigeth library will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2026-07-07
+
+### ✨ Working HTTP(S) JSON-RPC transport
+
+`HttpTransport.send` is now implemented on top of Zig 0.16's
+`std.http.Client` (driven by a `std.Io.Threaded` loop), replacing the
+`error.NotImplemented` stub. TLS is handled by the client, so `https://`
+RPC endpoints work out of the box. The whole provider surface
+(`provider.getEth().chainId()` / `blockNumber()` / `getLogs(filter)` …)
+now performs real network calls.
+
+Verified live against Arbitrum Sepolia: `eth_chainId`, `eth_blockNumber`,
+and `eth_getLogs` all round-trip over HTTPS with no leaks.
+
+### 🐛 Fixes surfaced by exercising the RPC path
+
+These were latent since the 0.15 → 0.16 migration — the code paths only
+compiled once a real transport forced their analysis:
+
+- `eth.zig` — `filterOptionsToJson` / `callParamsToJson` /
+  `transactionParamsToJson` results are bound with `var` so their
+  `deinit` (which takes `*self`) type-checks.
+- `eth.zig` `getLogs` — the errdefer `logs.deinit()` now passes the
+  allocator (`std.ArrayList` is unmanaged in 0.16).
+- `free_json.zig` — `ObjectMap.deinit` now passes the allocator.
+- `JsonObjectWrapper.deinit` — recursively frees value data, fixing a
+  leak of the hex strings inside a `topics` filter array (regression
+  test added).
+
 ## [0.5.1] - 2026-07-07
 
 ### 🔧 CI + cross-platform
 
@@ -1 +1 @@
-0.5.1
+0.6.0
@@ -2,7 +2,7 @@
     .name = .zigeth,
 
     // Semantic version
-    .version = "0.5.1",
+    .version = "0.6.0",
 
     // Unique package identifier
     // DO NOT change this unless forking the project
 
@@ -100,28 +100,51 @@ pub const RpcClient = struct {
     }
 };
 
-/// HTTP transport for RPC client.
+/// Errors surfaced by the HTTP transport.
+pub const TransportError = error{
+    /// The underlying std.http.Client.fetch call failed (DNS, TCP, TLS,
+    /// timeout, etc.).
+    HttpRequestFailed,
+    /// The server responded with a non-2xx status.
+    HttpStatusError,
+} || std.mem.Allocator.Error;
+
+/// HTTP(S) transport for the JSON-RPC client.
 ///
-/// Zig 0.16 rewrote std.http.Client around the new Io interface and
-/// dropped the response_writer field this used to plug into. Until the
-/// transport is ported to the new API, this is a compile-time stub —
-/// send() returns error.NotImplemented so consumers surface the gap
-/// rather than silently succeed.
+/// Built on `std.http.Client` (which performs TLS for `https://`
+/// endpoints) driven by a `std.Io.Threaded` event loop. Each transport
+/// owns its own client + loop; `RpcClient.call` currently constructs one
+/// per request, so the connection is not pooled across calls — fine for a
+/// low-frequency polling consumer. A future optimization is to hoist the
+/// client into `RpcClient` and reuse it (keep-alive) across calls.
 pub const HttpTransport = struct {
     allocator: std.mem.Allocator,
     url: []const u8,
     headers: std.StringHashMap([]const u8),
+    threaded: *std.Io.Threaded,
+    client: std.http.Client,
 
     pub fn init(allocator: std.mem.Allocator, url: []const u8) !HttpTransport {
         const url_copy = try allocator.dupe(u8, url);
+        errdefer allocator.free(url_copy);
+
+        const threaded = try allocator.create(std.Io.Threaded);
+        errdefer allocator.destroy(threaded);
+        threaded.* = std.Io.Threaded.init(allocator, .{});
+
         return .{
             .allocator = allocator,
             .url = url_copy,
             .headers = std.StringHashMap([]const u8).init(allocator),
+            .threaded = threaded,
+            .client = .{ .allocator = allocator, .io = threaded.io() },
         };
     }
 
     pub fn deinit(self: *HttpTransport) void {
+        self.client.deinit();
+        self.threaded.deinit();
+        self.allocator.destroy(self.threaded);
         self.allocator.free(self.url);
 
         var it = self.headers.iterator();
@@ -138,10 +161,34 @@ pub const HttpTransport = struct {
         try self.headers.put(key_copy, value_copy);
     }
 
+    /// POST `request` to the endpoint and return the response body. Caller
+    /// owns the returned slice.
     pub fn send(self: *HttpTransport, request: []const u8) ![]u8 {
-        _ = self;
-        _ = request;
-        return error.NotImplemented;
+        // Build the extra-headers slice from the configured headers.
+        var extra = try self.allocator.alloc(std.http.Header, self.headers.count());
+        defer self.allocator.free(extra);
+        var it = self.headers.iterator();
+        var i: usize = 0;
+        while (it.next()) |entry| : (i += 1) {
+            extra[i] = .{ .name = entry.key_ptr.*, .value = entry.value_ptr.* };
+        }
+
+        var resp = std.Io.Writer.Allocating.init(self.allocator);
+        defer resp.deinit();
+
+        const result = self.client.fetch(.{
+            .location = .{ .url = self.url },
+            .method = .POST,
+            .payload = request,
+            .response_writer = &resp.writer,
+            .extra_headers = extra,
+        }) catch return error.HttpRequestFailed;
+
+        // Accept any 2xx.
+        const code = @intFromEnum(result.status);
+        if (code < 200 or code >= 300) return error.HttpStatusError;
+
+        return try self.allocator.dupe(u8, resp.written());
     }
 };
 
 
@@ -169,7 +169,7 @@ pub const EthNamespace = struct {
 
     /// eth_call - Executes a message call (doesn't create a transaction)
     pub fn call(self: EthNamespace, params: types.CallParams, block: types.BlockParameter) ![]u8 {
-        const call_obj = try callParamsToJson(self.client.allocator, params);
+        var call_obj = try callParamsToJson(self.client.allocator, params);
         defer call_obj.deinit();
 
         const block_param = try blockParameterToString(self.client.allocator, block);
@@ -193,7 +193,7 @@ pub const EthNamespace = struct {
 
     /// eth_estimateGas - Estimates gas needed for a transaction
     pub fn estimateGas(self: EthNamespace, params: types.CallParams) !u64 {
-        const call_obj = try callParamsToJson(self.client.allocator, params);
+        var call_obj = try callParamsToJson(self.client.allocator, params);
         defer call_obj.deinit();
 
         var rpc_params = [_]std.json.Value{
@@ -318,7 +318,7 @@ pub const EthNamespace = struct {
 
     /// eth_getLogs - Returns an array of logs matching the filter
     pub fn getLogs(self: EthNamespace, filter: types.FilterOptions) ![]Log {
-        const filter_obj = try filterOptionsToJson(self.client.allocator, filter);
+        var filter_obj = try filterOptionsToJson(self.client.allocator, filter);
         defer filter_obj.deinit();
 
         var params = [_]std.json.Value{
@@ -337,7 +337,7 @@ pub const EthNamespace = struct {
             for (logs.items) |log| {
                 log.deinit();
             }
-            logs.deinit();
+            logs.deinit(self.client.allocator);
         }
 
         for (result.array.items) |log_json| {
@@ -373,7 +373,7 @@ pub const EthNamespace = struct {
 
     /// eth_sendTransaction - Creates and sends a transaction
     pub fn sendTransaction(self: EthNamespace, params: types.TransactionParams) !Hash {
-        const tx_obj = try transactionParamsToJson(self.client.allocator, params);
+        var tx_obj = try transactionParamsToJson(self.client.allocator, params);
         defer tx_obj.deinit();
 
         var rpc_params = [_]std.json.Value{
@@ -537,7 +537,7 @@ pub const EthNamespace = struct {
 
     /// eth_signTransaction - Signs a transaction
     pub fn signTransaction(self: EthNamespace, params: types.TransactionParams) ![]u8 {
-        const tx_obj = try transactionParamsToJson(self.client.allocator, params);
+        var tx_obj = try transactionParamsToJson(self.client.allocator, params);
         defer tx_obj.deinit();
 
         var rpc_params = [_]std.json.Value{
@@ -585,16 +585,36 @@ const JsonObjectWrapper = struct {
 
     fn deinit(self: *JsonObjectWrapper) void {
         if (self.value == .object) {
-            // Free all string values that were allocated
+            // Object keys here are string literals (never allocated); the
+            // values are heap-allocated (hex strings, or arrays of them, as
+            // in a `topics` filter). Recursively free the values so nested
+            // arrays don't leak, then drop the map itself.
             var iter = self.value.object.iterator();
             while (iter.next()) |entry| {
-                if (entry.value_ptr.* == .string) {
-                    self.allocator.free(entry.value_ptr.string);
-                }
+                freeValue(self.allocator, entry.value_ptr.*);
             }
             self.value.object.deinit(self.allocator);
         }
     }
+
+    /// Recursively free a JSON value's allocated data. Object keys are left
+    /// untouched — this wrapper only ever builds objects with literal keys.
+    fn freeValue(allocator: std.mem.Allocator, value: std.json.Value) void {
+        switch (value) {
+            .string => |s| allocator.free(s),
+            .number_string => |ns| allocator.free(ns),
+            .array => |arr| {
+                for (arr.items) |item| freeValue(allocator, item);
+                @constCast(&arr).deinit();
+            },
+            .object => |obj| {
+                var it = obj.iterator();
+                while (it.next()) |e| freeValue(allocator, e.value_ptr.*);
+                @constCast(&obj).deinit(allocator);
+            },
+            else => {},
+        }
+    }
 };
 
 /// Convert CallParams to JSON object
@@ -1334,3 +1354,26 @@ test "call params to json" {
     try std.testing.expect(json_obj.value.object.contains("to"));
     try std.testing.expect(json_obj.value.object.contains("gas"));
 }
+
+test "filter options with topics to json frees cleanly" {
+    // Guards the JsonObjectWrapper.deinit leak fix: the topics array's hex
+    // strings must be freed, not just top-level string members. Runs under
+    // testing.allocator, which fails the test on any leak.
+    const allocator = std.testing.allocator;
+
+    const topic = Hash.fromBytes([_]u8{0xAB} ** 32);
+    var topics = [_]?Hash{topic};
+    const filter = types.FilterOptions{
+        .from_block = .{ .number = 100 },
+        .to_block = .{ .number = 200 },
+        .address = Address.fromBytes([_]u8{0xCD} ** 20),
+        .topics = topics[0..],
+    };
+
+    var obj = try filterOptionsToJson(allocator, filter);
+    defer obj.deinit();
+
+    try std.testing.expect(obj.value == .object);
+    try std.testing.expect(obj.value.object.contains("topics"));
+    try std.testing.expect(obj.value.object.contains("address"));
+}
@@ -19,7 +19,7 @@ pub fn freeJsonValue(allocator: std.mem.Allocator, value: std.json.Value) void {
                 allocator.free(entry.key_ptr.*);
                 freeJsonValue(allocator, entry.value_ptr.*);
             }
-            @constCast(&obj).deinit();
+            @constCast(&obj).deinit(allocator);
         },
     }
 }
Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ pub fn freeJsonValue(allocator: std.mem.Allocator, value: std.json.Value) void {`
`19`	`19`	`allocator.free(entry.key_ptr.*);`
`20`	`20`	`freeJsonValue(allocator, entry.value_ptr.*);`
`21`	`21`	`}`
`22`		`- @constCast(&obj).deinit();`
	`22`	`+ @constCast(&obj).deinit(allocator);`
`23`	`23`	`},`
`24`	`24`	`}`
`25`	`25`	`}`