quicsilver 0.4.0 → 0.5.0

data/lib/quicsilver/protocol/control_stream_parser.rb

@@ -21,6 +21,9 @@ module Quicsilver
       # Note: 0x08 (SETTINGS_ENABLE_CONNECT_PROTOCOL) is valid in HTTP/3 per RFC 9220
       HTTP2_SETTINGS = [0x00, 0x02, 0x03, 0x04, 0x05].freeze
 
+      # Returns the number of bytes consumed. A frame split across receives
+      # leaves its bytes unconsumed, and the caller must keep them buffered:
+      # control streams never send FIN, so a partial frame is normal.
       def parse_control_frames(data)
         first_frame = !@settings_received
 
@@ -59,7 +62,10 @@ module Quicsilver
               error_code: Protocol::H3_SETTINGS_ERROR)
           end
 
-          raise Protocol::FrameError, "Duplicate setting identifier 0x#{id.to_s(16)}" if seen.include?(id)
+          if seen.include?(id)
+            raise Protocol::FrameError.new("Duplicate setting identifier 0x#{id.to_s(16)}",
+              error_code: Protocol::H3_SETTINGS_ERROR)
+          end
           seen.add(id)
 
           settings[id] = value
@@ -88,6 +94,7 @@ module Quicsilver
         end
 
         @peer_goaway_id = stream_id
+        on_goaway_received(stream_id)
       end
 
       private
@@ -96,6 +103,10 @@ module Quicsilver
       def on_settings_received(settings)
       end
 
+      # Override in includer to react to GOAWAY. Default: no-op.
+      def on_goaway_received(stream_id)
+      end
+
       # Override in includer to handle additional frame types on the control stream.
       # Server handles FORBIDDEN_ON_CONTROL and PRIORITY_UPDATE here.
       # Client ignores unknown frames.

data/lib/quicsilver/protocol/datagram.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Quicsilver
+  module Protocol
+    # HTTP/3 DATAGRAM payload framing (RFC 9297).
+    #
+    # The DATAGRAM frame payload starts with a varint quarter stream ID, followed
+    # by the application payload. The quarter stream ID is the HTTP/3 stream ID
+    # divided by four, matching the client-initiated bidirectional request stream
+    # numbering pattern (0, 4, 8, ...).
+    module Datagram
+      STREAM_ID_DIVISOR = 4
+
+      class << self
+        def encode(stream_id, payload)
+          Protocol.encode_varint(quarter_stream_id(stream_id)) + payload.to_s.b
+        end
+
+        def decode(datagram)
+          quarter_stream_id, prefix_length = Protocol.decode_varint_str(datagram, 0)
+          return if prefix_length == 0
+
+          [stream_id(quarter_stream_id), payload(datagram, prefix_length)]
+        end
+
+        def quarter_stream_id(stream_id)
+          stream_id / STREAM_ID_DIVISOR
+        end
+
+        def stream_id(quarter_stream_id)
+          quarter_stream_id * STREAM_ID_DIVISOR
+        end
+
+        def payload(datagram, prefix_length)
+          datagram.byteslice(prefix_length..-1) || "".b
+        end
+      end
+    end
+  end
+end

data/lib/quicsilver/protocol/frame_parser.rb

@@ -19,8 +19,6 @@ module Quicsilver
       # Inject a custom decoder via decoder: kwarg for dynamic QPACK support.
       DEFAULT_DECODER = Qpack::HeaderBlockDecoder.default
 
-      CONTROL_ONLY_SET = Protocol::CONTROL_ONLY_FRAMES.each_with_object({}) { |f, h| h[f] = true }.freeze
-
       EMPTY_BODY = StringIO.new("".b).tap { |io| io.set_encoding(Encoding::ASCII_8BIT) }
 
       attr_reader :headers, :trailers, :bytes_consumed
@@ -69,14 +67,15 @@ module Quicsilver
 
         @bytes_consumed = FrameReader.each(buffer) do |type, payload|
           if @max_frame_payload_size && payload.bytesize > @max_frame_payload_size
-            raise Protocol::FrameError, "Frame payload #{payload.bytesize} exceeds limit #{@max_frame_payload_size}"
+            raise Protocol::FrameError.new(
+              "Frame payload #{payload.bytesize} exceeds limit #{@max_frame_payload_size}",
+              error_code: Protocol::H3_EXCESSIVE_LOAD
+            )
           end
 
           (@frames ||= []) << { type: type, length: payload.bytesize, payload: payload }
 
-          if CONTROL_ONLY_SET.key?(type)
-            raise Protocol::FrameError, "Frame type 0x#{type.to_s(16)} not allowed on request streams"
-          end
+          Protocol.reject_unexpected_request_frame!(type)
 
           case type
           when 0x01 # HEADERS

data/lib/quicsilver/protocol/frame_reader.rb

@@ -3,7 +3,8 @@
 module Quicsilver
   module Protocol
     # Extracts HTTP/3 frames from a byte buffer.
-    # Yields [type, payload] pairs. No protocol semantics — just byte-level extraction.
+    # Yields (type, payload, offset) per frame. Returns total bytes consumed.
+    # Existing callers using |type, payload| are unaffected — offset is ignored.
     #
     # Usage:
     #   FrameReader.each(buffer) do |type, payload|
@@ -12,6 +13,10 @@ module Quicsilver
     #     when FRAME_DATA then ...
     #     end
     #   end
+    #
+    # With offset (for early exit via throw/catch):
+    #   strip = FrameReader.skip_while(data) { |type, payload| ... }
+    #   data = data.byteslice(strip..) if strip > 0
     module FrameReader
       def self.each(buffer)
         offset = 0
@@ -31,6 +36,7 @@ module Quicsilver
           end
 
           len_byte = buffer.getbyte(offset + type_len)
+          break unless len_byte
           if len_byte < 0x40
             length = len_byte
             length_len = 1
@@ -45,11 +51,34 @@ module Quicsilver
           payload = buffer.byteslice(offset + header_len, length)
           offset += header_len + length
 
-          yield type, payload
+          yield type, payload, offset
         end
 
         offset
       end
+
+      # Skip leading frames while the block returns true.
+      # Returns the byte offset of the first frame that returned false (or 0).
+      #
+      #   skip = FrameReader.skip_while(data) do |type, payload|
+      #     type == FRAME_HEADERS && informational?(payload)
+      #   end
+      #   data = data.byteslice(skip..) if skip > 0
+      def self.skip_while(buffer)
+        skip_to = 0
+
+        catch(:stop) do
+          each(buffer) do |type, payload, offset|
+            if yield(type, payload)
+              skip_to = offset
+            else
+              throw :stop
+            end
+          end
+        end
+
+        skip_to
+      end
     end
   end
 end

data/lib/quicsilver/protocol/frames.rb

@@ -12,8 +12,51 @@ module Quicsilver
     FRAME_MAX_PUSH_ID = 0x0d
     FRAME_PRIORITY_UPDATE = 0xF0700  # RFC 9218 — request stream priority update
 
+    # Settings identifiers
+    SETTINGS_QPACK_MAX_TABLE_CAPACITY = 0x01
+    SETTINGS_QPACK_BLOCKED_STREAMS = 0x07
+    SETTINGS_ENABLE_CONNECT_PROTOCOL = 0x08  # RFC 9220
+    SETTINGS_H3_DATAGRAM = 0x33              # RFC 9297
+    SETTINGS_ENABLE_WEBTRANSPORT = 0x2b603742 # WebTransport draft-06
+    SETTINGS_WT_ENABLED = 0x2c7cf000          # WebTransport over HTTP/3
+    SETTINGS_WT_MAX_SESSIONS = 0x14e9cd29    # Legacy WebTransport session limit
+    SETTINGS_WT_INITIAL_MAX_DATA = 0x2b61
+    SETTINGS_WT_INITIAL_MAX_STREAMS_UNI = 0x2b64
+    SETTINGS_WT_INITIAL_MAX_STREAMS_BIDI = 0x2b65
+
+    # Declaring a non-zero value for any of these is how an endpoint opts into
+    # WebTransport session flow control (draft-16 §5.1). It is a promise to
+    # implement the whole of §5, so do not advertise one until the capsules
+    # and accounting exist.
+    # The session flow control window we advertise. 16 MiB leaves room for
+    # many children above the 1 MiB each queues, and 100 streams per direction
+    # bounds concurrency without being a limit an application trips over.
+    # Both are our choice; the draft only defines the mechanism.
+    WT_INITIAL_MAX_DATA = 16 * 1024 * 1024
+    WT_INITIAL_MAX_STREAMS = 100
+
+    WT_FLOW_CONTROL_SETTINGS = [
+      SETTINGS_WT_INITIAL_MAX_DATA,
+      SETTINGS_WT_INITIAL_MAX_STREAMS_UNI,
+      SETTINGS_WT_INITIAL_MAX_STREAMS_BIDI
+    ].freeze
+    SETTINGS_MAX_FIELD_SECTION_SIZE = 0x06   # RFC 9114 §7.2.4.1
+
     # Frame types forbidden on request streams (RFC 9114 Section 7.2.4, 7.2.6, 7.2.7)
     CONTROL_ONLY_FRAMES = [FRAME_CANCEL_PUSH, FRAME_SETTINGS, FRAME_GOAWAY, FRAME_MAX_PUSH_ID].freeze
+    CONTROL_ONLY_FRAME_SET = CONTROL_ONLY_FRAMES.to_h { |type| [type, true] }.freeze
+
+    # HTTP/2 frame types, reserved in HTTP/3 so that an HTTP/2 frame arriving
+    # here is rejected rather than mistaken for an extension (RFC 9114 7.2.8)
+    HTTP2_RESERVED_FRAME_SET = {0x02 => true, 0x06 => true, 0x08 => true, 0x09 => true}.freeze
+
+    # WT_STREAM is registered as a frame type to reserve the code point, but it
+    # carries no length and is only legal as the very first bytes of a request
+    # stream, where the server classifies it before any frame parsing. Anywhere
+    # else it is a connection error (draft-ietf-webtrans-http3-16 §4.3).
+    FRAME_WT_STREAM = 0x41
+    # HTTP/3 Datagram Error Code (RFC 9297 Section 5.2)
+    H3_DATAGRAM_ERROR = 0x33
 
     # HTTP/3 Error Codes (RFC 9114 Section 8.1)
     H3_NO_ERROR = 0x100
@@ -42,15 +85,20 @@ module Quicsilver
     # Protocol errors that carry an HTTP/3 error code for CONNECTION_CLOSE / RESET_STREAM.
     # FrameError → connection error (CONNECTION_CLOSE)
     # MessageError → stream error (RESET_STREAM) on request streams
-    class FrameError < StandardError
+    class FrameError < Quicsilver::Error
       attr_reader :error_code
+      # The default suits a frame that is valid but arrived somewhere it is not
+      # allowed (RFC 9114 4.1, 7.2.4), which is the common case. Anything else
+      # must pass its own code: callers that leave this implicit are asserting
+      # H3_FRAME_UNEXPECTED is correct, and the handler turns that into a
+      # connection error.
       def initialize(msg = nil, error_code: H3_FRAME_UNEXPECTED)
         @error_code = error_code
         super(msg)
       end
     end
 
-    class MessageError < StandardError
+    class MessageError < Quicsilver::Error
       attr_reader :error_code
       def initialize(msg = nil, error_code: H3_MESSAGE_ERROR)
         @error_code = error_code
@@ -185,6 +233,27 @@ module Quicsilver
     MAX_STREAM_ID = (2**62) - 4
 
     class << self
+      # Frame types a request stream may carry. Unknown types are extensions and
+      # must be ignored (RFC 9114 9), so only the two reserved sets raise.
+      # Both the buffered parser and the streaming body reader validate here.
+      def reject_unexpected_request_frame!(type)
+        if CONTROL_ONLY_FRAME_SET.key?(type)
+          raise FrameError, "Frame type 0x#{type.to_s(16)} not allowed on request streams"
+        end
+
+        if HTTP2_RESERVED_FRAME_SET.key?(type)
+          raise FrameError.new("Reserved HTTP/2 frame type 0x#{type.to_s(16)} not allowed in HTTP/3",
+            error_code: H3_FRAME_UNEXPECTED)
+        end
+
+        # Reaching here means the stream already parsed as HTTP/3, so this
+        # WT_STREAM is not at the front of the stream (draft-16 §4.3).
+        if type == FRAME_WT_STREAM
+          raise FrameError.new("WT_STREAM is only allowed as the first bytes of a request stream",
+            error_code: H3_FRAME_ERROR)
+        end
+      end
+
       # Precomputed varint encodings for single-byte values (0-63)
       VARINT_SMALL = Array.new(64) { |v| [v].pack('C').freeze }.freeze
       VARINT_MED = Array.new(16384 - 64) { |i| v = i + 64; [0x40 | (v >> 8), v & 0xFF].pack('C*').freeze }.freeze
@@ -231,29 +300,76 @@ module Quicsilver
         frame_type + frame_length + payload
       end
 
-      # Generate a random GREASE ID (RFC 9297): 31 * n + 33
+      # Generate a random GREASE ID (RFC 9114 §7.2.4.1): 0x1f * N + 0x21
       def grease_id
         31 * rand(0..20) + 33
       end
 
-      # Build control stream data
+      # Has this endpoint declared intent to use session flow control? Both
+      # endpoints must, for it to be enabled.
+      def wt_flow_control_opt_in?(settings)
+        WT_FLOW_CONTROL_SETTINGS.any? { |id| settings[id].to_i > 0 }
+      end
+
+      # The SETTINGS we advertise. Kept separate from the frame so a connection
+      # can ask what it promised the peer without re-parsing the wire.
+      #
       # @param max_field_section_size [Integer, nil] Advertise SETTINGS_MAX_FIELD_SECTION_SIZE (0x06)
       #   to the peer (RFC 9114 §4.2.2 / §7.2.4.1). nil = don't advertise.
-      def build_control_stream(max_field_section_size: nil)
-        stream_type = [0x00].pack('C')  # Control stream type
-        settings_hash = {
-          0x01 => 0,           # QPACK_MAX_TABLE_CAPACITY = 0 (no dynamic table)
-          0x07 => 0,           # QPACK_BLOCKED_STREAMS = 0
-          0x08 => 1,           # SETTINGS_ENABLE_CONNECT_PROTOCOL (RFC 9220)
+      def control_stream_settings(max_field_section_size: nil, datagram_receive_enabled: true)
+        settings = {
+          SETTINGS_QPACK_MAX_TABLE_CAPACITY => 0,
+          SETTINGS_QPACK_BLOCKED_STREAMS => 0,
+          SETTINGS_ENABLE_CONNECT_PROTOCOL => 1,
+          SETTINGS_H3_DATAGRAM => datagram_receive_enabled ? 1 : 0,
+          SETTINGS_ENABLE_WEBTRANSPORT => 1,
+          SETTINGS_WT_ENABLED => 1,
+          # Declaring these enables session flow control when the peer also
+          # does (§5.1): the initial limits a session grants its peer, raised
+          # by capsules as we consume data and close streams.
+          #
+          # The data window sits well above the 1 MiB a single child stream
+          # queues, so one stream cannot exhaust a session's credit, in the
+          # same spirit as QUIC keeping its connection window above any one
+          # stream's. Both values are ours to choose; the draft defines only
+          # the mechanism.
+          SETTINGS_WT_INITIAL_MAX_DATA => WT_INITIAL_MAX_DATA,
+          SETTINGS_WT_INITIAL_MAX_STREAMS_BIDI => WT_INITIAL_MAX_STREAMS,
+          SETTINGS_WT_INITIAL_MAX_STREAMS_UNI => WT_INITIAL_MAX_STREAMS,
+          # Still one session per connection. Flow control now permits more
+          # (§5.1), but sharing a connection between sessions is a separate
+          # change.
+          SETTINGS_WT_MAX_SESSIONS => 1
         }
-        settings_hash[0x06] = max_field_section_size if max_field_section_size  # SETTINGS_MAX_FIELD_SECTION_SIZE
-        settings_hash[grease_id] = grease_id  # GREASE setting (RFC 9297)
+        settings[SETTINGS_MAX_FIELD_SECTION_SIZE] = max_field_section_size if max_field_section_size
+        settings
+      end
+
+      # Build control stream data.
+      def build_control_stream(max_field_section_size: nil, datagram_receive_enabled: true)
+        stream_type = [0x00].pack("C")  # Control stream type
+        settings_hash = control_stream_settings(
+          max_field_section_size: max_field_section_size,
+          datagram_receive_enabled: datagram_receive_enabled
+        )
+        settings_hash[grease_id] = grease_id  # GREASE setting (RFC 9114 §7.2.4.1)
 
         stream_type + build_settings_frame(settings_hash)
       end
 
       # Build GOAWAY frame (RFC 9114 Section 7.2.6)
       # stream_id: The last client-initiated bidirectional stream ID the server will process
+      # Build an HTTP/3 frame: varint type + varint length + payload.
+      def build_frame(type, payload)
+        payload = payload.to_s.b
+        encode_varint(type) + encode_varint(payload.bytesize) + payload
+      end
+
+      # Build a HEADERS frame from key-value pairs via QPACK.
+      def build_headers_frame(pairs, encoder: Qpack::Encoder.new)
+        build_frame(FRAME_HEADERS, encoder.encode(pairs))
+      end
+
       def build_goaway_frame(stream_id)
         frame_type = encode_varint(FRAME_GOAWAY)
         payload = encode_varint(stream_id)

data/lib/quicsilver/protocol/priority.rb

@@ -30,6 +30,15 @@ module Quicsilver
 
       # Parse a priority header value (RFC 9218 §4, Structured Field Values).
       # Returns a Priority with defaults for missing or invalid values.
+      # RFC 9218 §4: Encode as Structured Field Value.
+      # e.g. "u=0, i" or "u=5" or "u=3" (default)
+      def to_s
+        parts = []
+        parts << "u=#{@urgency}" if @urgency != DEFAULT_URGENCY
+        parts << "i" if @incremental
+        parts.empty? ? "u=#{DEFAULT_URGENCY}" : parts.join(", ")
+      end
+
       def self.parse(value)
         return new unless value && !value.empty?
 

data/lib/quicsilver/protocol/qpack/decoder.rb

@@ -38,42 +38,12 @@ module Quicsilver
           [str, len_bytes + length]
         end
 
-        # Cache for decode_qpack_string
-        DQS_CACHE = {}        # array-content → [str, consumed]
-        DQS_OID_CACHE = {}    # object_id|offset → [str, consumed]
-        DQS_CACHE_MAX = 128
-
-        # 2-slot last-result cache for decode_qpack_string
-        DQS_LAST_A = [nil, nil, nil] # [bytes, offset, result]
-        DQS_LAST_B = [nil, nil, nil]
-
+        # Byte-array variant. Results are not cached: the input is mutable, so
+        # keying on identity or object_id returns a stale decode after an
+        # in-place edit. Production decoding uses the String variant above.
         def decode_qpack_string(bytes, offset)
-          # 2-slot equal? fast path (covers alternating-object patterns)
-          return DQS_LAST_A[2] if bytes.equal?(DQS_LAST_A[0]) && offset == DQS_LAST_A[1]
-          return DQS_LAST_B[2] if bytes.equal?(DQS_LAST_B[0]) && offset == DQS_LAST_B[1]
-
-          # Object-id cache
-          oid_key = (bytes.object_id << 16) | offset
-          cached = DQS_OID_CACHE[oid_key]
-          if cached
-            # Rotate 2-slot cache
-            DQS_LAST_B[0], DQS_LAST_B[1], DQS_LAST_B[2] = DQS_LAST_A[0], DQS_LAST_A[1], DQS_LAST_A[2]
-            DQS_LAST_A[0], DQS_LAST_A[1], DQS_LAST_A[2] = bytes, offset, cached
-            return cached
-          end
-
-          # Dispatch to string variant if given a String
           return decode_qpack_string_from_str(bytes, offset) if bytes.is_a?(String)
 
-          # Content-based cache for offset=0
-          if offset == 0
-            cached = DQS_CACHE[bytes]
-            if cached
-              DQS_OID_CACHE[oid_key] = cached
-              return cached
-            end
-          end
-
           first = bytes[offset]
           huffman = (first & 0x80) != 0
 
@@ -100,15 +70,7 @@ module Quicsilver
             raw
           end
 
-          result = [str, len_bytes + length].freeze
-
-          # Cache for offset=0 (common case: standalone decode)
-          if offset == 0 && DQS_CACHE.size < DQS_CACHE_MAX
-            DQS_CACHE[bytes.frozen? ? bytes : bytes.dup.freeze] = result
-          end
-          DQS_OID_CACHE[oid_key] = result if DQS_OID_CACHE.size < DQS_CACHE_MAX
-
-          result
+          [str, len_bytes + length].freeze
         end
 
         # String-based prefix integer decoding

data/lib/quicsilver/protocol/qpack/encoder.rb

@@ -26,37 +26,27 @@ module Quicsilver
           @huffman = huffman
           @field_cache = {}
           @block_cache = {}
-          @oid_cache = {}
         end
 
+        # Caches are keyed by header content, never by identity or object_id:
+        # callers may reuse and mutate the same array, and an identity hit
+        # would return the previous encoding.
+        #
+        # Caching a whole field block is only sound because encoding is
+        # static-table-only: Required Insert Count is always zero, so the bytes
+        # never depend on connection state. Implementing the dynamic table
+        # would invalidate @block_cache, since indices are relative to a Base.
         def encode(headers)
-          # Fastest path: exact same object as last call
-          return @last_result if headers.equal?(@last_headers)
-
-          # Fast path: check object_id cache (same array object reused)
-          oid = headers.object_id
-          cached = @oid_cache[oid]
-          if cached
-            @last_headers = headers
-            @last_result = cached
-            return cached
-          end
-
           if headers.is_a?(Array) && headers.size <= 16
             # Content-based caching for small header sets
             block_key = headers.map { |n, v| "#{n}\0#{v}" }.join("\x01")
             cached_block = @block_cache[block_key]
-            if cached_block
-              @oid_cache[oid] = cached_block if @oid_cache.size < BLOCK_CACHE_MAX
-              return cached_block
-            end
+            return cached_block if cached_block
 
-            result = encode_fields(headers)
-            result_frozen = result.freeze
+            result_frozen = encode_fields(headers).freeze
             if @block_cache.size < BLOCK_CACHE_MAX
               @block_cache[block_key.freeze] = result_frozen
             end
-            @oid_cache[oid] = result_frozen if @oid_cache.size < BLOCK_CACHE_MAX
             return result_frozen
           end
 

data/lib/quicsilver/protocol/qpack/huffman.rb

@@ -364,8 +364,8 @@ module Quicsilver
 
             result = encode_uncached(data)
 
-            # Cache short strings (frozen)
-            if data.bytesize <= 128 && HUFF_ENCODE_CACHE.size < CACHE_MAX
+            # Cache encoded results (frozen) — includes large headers like CSP
+            if HUFF_ENCODE_CACHE.size < CACHE_MAX
               HUFF_ENCODE_MUTEX.synchronize do
                 HUFF_ENCODE_CACHE[data.frozen? ? data : data.dup.freeze] = result.freeze if HUFF_ENCODE_CACHE.size < CACHE_MAX
               end
@@ -410,8 +410,8 @@ module Quicsilver
 
             result = decode_uncached(encoded_data)
 
-            # Cache short encoded data (frozen)
-            if encoded_data.bytesize <= 128 && result && HUFF_DECODE_CACHE.size < CACHE_MAX
+            # Cache decoded results (frozen)
+            if result && HUFF_DECODE_CACHE.size < CACHE_MAX
               HUFF_DECODE_MUTEX.synchronize do
                 key = encoded_data.frozen? ? encoded_data : encoded_data.dup.freeze
                 HUFF_DECODE_CACHE[key] = result.freeze if HUFF_DECODE_CACHE.size < CACHE_MAX

data/lib/quicsilver/protocol/request_encoder.rb

@@ -3,7 +3,8 @@
 module Quicsilver
   module Protocol
     class RequestEncoder
-      def initialize(method:, path:, scheme: "https", authority: "localhost:4433", headers: {}, body: nil, encoder: Qpack::Encoder.new)
+      def initialize(method:, path:, scheme: "https", authority: "localhost:4433", headers: {}, body: nil, priority: nil, encoder: Qpack::Encoder.new)
+        @priority = priority
         @method = method.upcase
         @path = path
         @scheme = scheme
@@ -36,11 +37,13 @@ module Quicsilver
           headers << [":authority", @authority]
           headers << [":path", @path]
         end
-        headers + @headers.map { |k, v| [k.to_s, v.to_s] }
+        pairs = headers + @headers.map { |k, v| [k.to_s, v.to_s] }
+        pairs << ["priority", @priority.to_s] if @priority
+        pairs
       end
 
       def build_frame(type, payload)
-        Protocol.encode_varint(type) + Protocol.encode_varint(payload.bytesize) + payload
+        Protocol.build_frame(type, payload)
       end
     end
   end

data/lib/quicsilver/protocol/request_parser.rb

@@ -142,8 +142,13 @@ module Quicsilver
           raise Protocol::MessageError, "Request missing required pseudo-header :scheme" unless @headers[":scheme"]
           raise Protocol::MessageError, "Request missing required pseudo-header :path" unless @headers[":path"]
 
-          # RFC 9114 §4.3.1: schemes with mandatory authority (http/https) require :authority or host
+          # RFC 9114 §4.3.1: :path MUST NOT be empty for http or https URIs
           scheme = @headers[":scheme"]
+          if %w[http https].include?(scheme) && @headers[":path"].empty?
+            raise Protocol::MessageError, ":path must not be empty for #{scheme} requests"
+          end
+
+          # RFC 9114 §4.3.1: schemes with mandatory authority (http/https) require :authority or host
           if %w[http https].include?(scheme) && !@headers[":authority"] && !@headers["host"]
             raise Protocol::MessageError, "Request with #{scheme} scheme must include :authority or host"
           end
@@ -162,7 +167,11 @@ module Quicsilver
 
         method = @headers[":method"]
 
-        if method == METHOD_CONNECT
+        if method == METHOD_CONNECT && @headers[":protocol"]
+          # Extended CONNECT (RFC 9220) — has :scheme, :path, :authority, :protocol
+          return nil unless @headers[":scheme"] && @headers[":path"] && @headers[":authority"]
+        elsif method == METHOD_CONNECT
+          # Regular CONNECT (RFC 9114 §4.4)
           return nil unless @headers[":authority"]
         else
           return nil unless method && @headers[":scheme"] && @headers[":path"]
@@ -198,6 +207,11 @@ module Quicsilver
           env["HTTP_HOST"] = @headers[":authority"]
         end
 
+        # Extended CONNECT (RFC 9220) — expose :protocol as rack.protocol
+        if @headers[":protocol"]
+          env["rack.protocol"] = @headers[":protocol"]
+        end
+
         @headers.each do |name, value|
           next if name.start_with?(":")
           key = name.upcase.tr("-", "_")

data/lib/quicsilver/protocol/response_encoder.rb

@@ -10,11 +10,7 @@ module Quicsilver
 
         pairs = [[":status", status.to_s]]
         headers.each { |name, value| pairs << [name.to_s.downcase, value.to_s] }
-        encoded = encoder.encode(pairs)
-
-        Protocol.encode_varint(FRAME_HEADERS) +
-          Protocol.encode_varint(encoded.bytesize) +
-          encoded
+        Protocol.build_headers_frame(pairs, encoder: encoder)
       end
 
       def initialize(status, headers, body, encoder: Qpack::Encoder.new, head_request: false, trailers: nil)
@@ -37,7 +33,8 @@ module Quicsilver
         end
         frames << build_frame(FRAME_HEADERS, @encoder.encode(trailer_headers)) if @trailers&.any?
         @body.close if @body.respond_to?(:close)
-        frames
+        # Frozen so send_stream can hand MsQuic the bytes without a copy.
+        frames.freeze
       end
 
       # Streaming encode - yields frames as they're ready
@@ -73,12 +70,26 @@ module Quicsilver
 
       def all_headers
         headers = [[":status", @status.to_s]]
+        has_content_length = false
         @headers.each do |name, value|
           downcased = name.to_s.downcase
           next if downcased.start_with?("rack.")
           next if FORBIDDEN_HEADERS.include?(downcased)
+          has_content_length = true if downcased == "content-length"
           headers << [downcased, value.to_s]
         end
+
+        # RFC 9110 §8.6: Auto-set content-length for known-size bodies when not already present.
+        # Skip for 1xx, 204, 304 (no body) and HEAD responses.
+        if !has_content_length && !@head_request && @status >= 200 && @status != 204 && @status != 304
+          if @body.respond_to?(:to_ary)
+            length = @body.to_ary.sum { |chunk| chunk.to_s.bytesize }
+            headers << ["content-length", length.to_s] if length > 0
+          elsif @body.respond_to?(:length) && @body.length
+            headers << ["content-length", @body.length.to_s]
+          end
+        end
+
         headers
       end
 
@@ -87,8 +98,7 @@ module Quicsilver
       end
 
       def build_frame(type, payload)
-        payload = payload.to_s.b
-        Protocol.encode_varint(type) + Protocol.encode_varint(payload.bytesize) + payload
+        Protocol.build_frame(type, payload)
       end
 
 

data/lib/quicsilver/protocol/response_parser.rb

@@ -7,6 +7,12 @@ module Quicsilver
     class ResponseParser < FrameParser
       attr_reader :status
 
+      # Validate response semantics per RFC 9114 §4.3.2.
+      # Call after parse to check :status is present.
+      def validate_response!
+        raise Protocol::MessageError, "Response missing required :status pseudo-header" unless @status
+      end
+
       def initialize(data, **opts)
         decoder = opts.delete(:decoder) || DEFAULT_DECODER
         super(decoder: decoder, max_body_size: opts[:max_body_size],

data/lib/quicsilver/protocol/stream_input.rb

@@ -21,12 +21,12 @@ module Quicsilver
     # - Read timeout for slow client protection
     #
     class StreamInput < ::Protocol::HTTP::Body::Writable
-      class ReadTimeout < StandardError; end
+      class ReadTimeout < Quicsilver::Error; end
 
       # @param length [Integer, nil] The content-length if known from headers.
       # @param queue_size [Integer, nil] Maximum buffered chunks for back-pressure.
-      #   nil (default) = unbounded. When bounded, write blocks if queue is full,
-      #   which naturally maps to QUIC flow control.
+      #   nil (default) = unbounded. When bounded, write blocks if queue is full.
+      #   A bounded queue must not block the MsQuic poll thread.
       # @param read_timeout [Numeric, nil] Seconds to wait for data before raising
       #   ReadTimeout. nil (default) = wait forever.
       def initialize(length = nil, queue_size: nil, read_timeout: nil)