quico 0.2.0 → 0.4.0

package/index.js

@@ -18,6 +18,8 @@ import { Agent, globalAgent } from './src/agent.js';
 import { IncomingMessage, ServerResponse, ClientRequest } from './src/streams.js';
 import { createSecureContext } from './src/tls_bridge.js';
 import { WebTransport } from './src/webtransport.js';
+import { createQuicServer } from './src/quic_server.js';
+import { createQuicClientSocket } from './src/quic_socket.js';
 
 export {
   createServer,
@@ -29,7 +31,9 @@ export {
   ServerResponse,
   ClientRequest,
   createSecureContext,
-  WebTransport
+  WebTransport,
+  createQuicServer,
+  createQuicClientSocket
 };
 
 export default {
@@ -42,5 +46,7 @@ export default {
   ServerResponse,
   ClientRequest,
   createSecureContext,
-  WebTransport
+  WebTransport,
+  createQuicServer,
+  createQuicClientSocket
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quico",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "A pure JavaScript implementation of QUIC, HTTP/3, QPACK, and WebTransport for Node.js",
   "type": "module",
   "main": "index.cjs",
@@ -78,6 +78,6 @@
   ],
   "dependencies": {
     "flat-ranges": "^2.0.0",
-    "lemon-tls": "^0.2.0"
+    "lemon-tls": "^0.6.0"
   }
 }

package/src/agent.js

@@ -56,6 +56,17 @@ class Agent extends EventEmitter {
     // Allows multiplexing multiple requests over one QUIC connection
     this._h3Pool = {};
 
+    // Connections still being ESTABLISHED: "host:port" → [waiter callbacks].
+    // Without this third state the pool only knows "have one" / "don't", so N
+    // requests issued in the same tick each see an empty pool and open N
+    // separate QUIC connections to the same origin — N handshakes, N
+    // congestion controllers, zero multiplexing (the QUIC interop runner's
+    // http3 test flags exactly this: "Expected exactly 1 handshake. Got: 3").
+    // The first request to miss the pool becomes the lead and creates the
+    // entry; requests arriving before it finishes park a callback here and
+    // are replayed once the lead settles.
+    this._h3Pending = {};
+
     // Active HTTP/2 sessions: "host:port" → http2.ClientHttp2Session
     this._h2Pool = {};
 
@@ -158,13 +169,49 @@ class Agent extends EventEmitter {
     var conn = this._h3Pool[key];
     if (!conn) return null;
     var state = conn.quic ? conn.quic.state : 'closed';
-    if (state === 'closed' || state === 'draining') {
+    if (state === 'closed' || state === 'draining' || state === 'closing') {
       delete this._h3Pool[key];
       return null;
     }
     return conn;
   }
 
+  /**
+   * Coalesce concurrent connection attempts to one origin.
+   *
+   * Returns false if the caller is the LEAD: no connection exists and nobody
+   * else is establishing one. The lead MUST eventually call
+   * resolveH3Pending(host, port, connOrNull) — on success, failure, or
+   * abandonment — or every later request to this origin parks forever.
+   *
+   * Returns true if the caller was parked as a follower; `cb` fires (with no
+   * arguments) once the lead settles, and the caller should simply retry its
+   * pool lookup: on success the connection is already registered, and on
+   * failure the retry becomes the next lead — serial retry, no thundering
+   * herd.
+   */
+  joinH3Pending(host, port, cb) {
+    var key = host + ':' + (port || 443);
+    if (this._h3Pending[key]) {
+      this._h3Pending[key].push(cb);
+      return true;
+    }
+    this._h3Pending[key] = [];
+    return false;
+  }
+
+  /** Lead's settlement. Registers the connection (if any) BEFORE waking the
+   *  waiters, so their retried pool lookups succeed synchronously. */
+  resolveH3Pending(host, port, conn) {
+    var key = host + ':' + (port || 443);
+    var waiters = this._h3Pending[key] || [];
+    delete this._h3Pending[key];
+    if (conn) this.setH3Connection(host, port, conn);
+    for (var i = 0; i < waiters.length; i++) {
+      try { waiters[i](); } catch (e) { /* a waiter's failure is its own */ }
+    }
+  }
+
   setH3Connection(host, port, conn) {
     var key = host + ':' + (port || 443);
     this._h3Pool[key] = conn;
@@ -173,6 +220,14 @@ class Agent extends EventEmitter {
         if (this._h3Pool[key] === conn) delete this._h3Pool[key];
       });
     }
+    // RFC 9114 §5.2: once the peer sends GOAWAY it won't accept new requests, so
+    // stop reusing this connection for new ones. In-flight requests keep running
+    // on it; they just won't be joined by new requests (which open a fresh conn).
+    if (conn.h3 && typeof conn.h3.on === 'function') {
+      conn.h3.on('goaway', () => {
+        if (this._h3Pool[key] === conn) delete this._h3Pool[key];
+      });
+    }
   }
 
 
@@ -254,6 +309,17 @@ class Agent extends EventEmitter {
   destroy() {
     if (this._sweepTimer) { clearInterval(this._sweepTimer); this._sweepTimer = null; }
 
+    // Wake anyone parked on an in-flight connection attempt; their retried
+    // pool lookup will find nothing and proceed (or fail) on its own.
+    for (var key in this._h3Pending) {
+      var waiters = this._h3Pending[key];
+      delete this._h3Pending[key];
+      for (var i = 0; i < waiters.length; i++) {
+        try { waiters[i](); } catch (e) {}
+      }
+    }
+    this._h3Pending = {};
+
     for (var key in this._h3Pool) {
       try { this._h3Pool[key].quic.close(0, 'agent destroy'); } catch (e) {}
     }

package/src/client.js

@@ -206,21 +206,53 @@ function request(url, options, callback) {
         port: port,
         path: path,
         method: method,
-        headers: Object.assign({}, headers)
+        headers: Object.assign({}, headers),
+        // The H2 and HTTPS fallbacks below honour this; dropping it here made
+        // H3 — alone of the three — unable to talk to self-signed or
+        // private-CA servers, and every such request silently fell back to
+        // TCP (or hung when the server was QUIC-only).
+        rejectUnauthorized: options.rejectUnauthorized,
+        ca: options.ca
       };
 
-      // Check Agent for existing QUIC connection (multiplexing)
+      // Check Agent for existing QUIC connection (multiplexing).
+      // With an agent, the connection's lifecycle is owned by the pool
+      // (sweep / idle timer / agent.destroy), so signal h3_client not to
+      // auto-close it when this request finishes — otherwise the first
+      // request would tear down a connection still pooled for reuse.
       if (agent) {
+        h3Opts._managed = true;
         var existing = agent.getH3Connection(hostname, port);
-        if (existing) h3Opts._connection = existing;
+        if (existing) {
+          h3Opts._connection = existing;
+        } else if (agent.joinH3Pending &&
+                   agent.joinH3Pending(hostname, port, function () {
+                     // The lead settled. Retry from the top: on success the
+                     // pool lookup now hits and we multiplex on the lead's
+                     // connection; on failure we become the next lead — a
+                     // serial retry, never a thundering herd.
+                     tryH3(onFail);
+                   })) {
+          return; // parked as a follower until the lead settles
+        }
+        // else: we are the LEAD for this origin. _settleH3Pending below MUST
+        // run on every exit path, or followers park forever.
+      }
+
+      var _pendingLead = !!(agent && !h3Opts._connection);
+      function _settleH3Pending(conn) {
+        if (!_pendingLead) return;
+        _pendingLead = false;
+        if (agent.resolveH3Pending) agent.resolveH3Pending(hostname, port, conn);
+        else if (conn) agent.setH3Connection(hostname, port, conn);
       }
 
       var h3Req = h3Request(h3Opts, function (h3Res) {
         if (responded) return;
 
-        // Store connection for future reuse
-        if (agent && h3Req._connection && !h3Opts._connection) {
-          agent.setH3Connection(hostname, port, h3Req._connection);
+        // Register the connection and wake coalesced followers.
+        if (h3Req._connection && !h3Opts._connection) {
+          _settleH3Pending(h3Req._connection);
         }
 
         var res = new IncomingMessage({
@@ -241,6 +273,7 @@ function request(url, options, callback) {
       });
 
       h3Req.on('error', function (err) {
+        _settleH3Pending(null);   // release followers before failing over
         onFail(err);
       });
 
@@ -249,6 +282,7 @@ function request(url, options, callback) {
       h3Req.end();
 
     } catch (err) {
+      if (typeof _settleH3Pending === 'function') _settleH3Pending(null);
       onFail(err);
     }
   }

package/src/crypto.js

@@ -60,8 +60,16 @@ var INITIAL_SALTS = {
 // ============================================================
 
 /**
- * Derive Initial encryption keys from the client DCID.
- * direction: 'read' = client keys, 'write' = server keys
+ * Derive an Initial-packet secret + keys from the client's original DCID.
+ *
+ * `direction` selects WHICH endpoint's Initial secret to derive — it is NOT
+ * "the keys I read/write with" in the obvious sense:
+ *   'read'  → the client's secret  (TLS label "client in")
+ *   'write' → the server's secret  (TLS label "server in")
+ * Each role then maps these to its own read/write keys: a client WRITES with
+ * the "client in" secret and READS with "server in"; a server is the mirror.
+ * So callers pass 'read' to get the client-side keys and 'write' for the
+ * server-side keys, and assign them to initial_read / initial_write per role.
  */
 function quic_derive_init_secrets(client_dcid, version, direction) {
   var hashName = 'sha256';
@@ -237,8 +245,10 @@ function expandPacketNumber(truncated, pnLen, largestReceived) {
 
 function decode_packet_number(array, offset, pnLength) {
   var value = 0;
+  // Use *256 (not <<8): a 4-byte packet number whose leading byte has the high
+  // bit set would overflow JS's 32-bit signed bitwise math and go negative.
   for (var i = 0; i < pnLength; i++) {
-    value = (value << 8) | array[offset + i];
+    value = value * 256 + array[offset + i];
   }
   return value;
 }
@@ -354,10 +364,32 @@ function encrypt_quic_packet(packetType, encodedFrames, writeKey, writeIv, write
 
 /**
  * Decrypt a QUIC packet (raw bytes → plaintext frames).
+ *
+ * `ownCid` is the connection ID by which the receiver is addressed. It is used
+ * ONLY for short (1-RTT) headers, which carry no DCID-length field — the
+ * receiver must already know its own CID length to locate the packet number.
+ * Long headers encode the DCID length on the wire, so `ownCid` is ignored there.
  */
-function decrypt_quic_packet(array, readKey, readIv, readHp, dcid, largestPn) {
+function decrypt_quic_packet(array, readKey, readIv, readHp, ownCid, largestPn) {
   if (!(array instanceof Uint8Array)) throw new Error('Invalid input');
 
+  // Work on a private copy — this function must not mutate its input.
+  //
+  // remove_header_protection XORs the first byte and the packet-number bytes
+  // IN PLACE. That is fine for exactly one decryption attempt, but the key
+  // update path retries this function on the same packet with derived keys
+  // (RFC 9001 §6): the second call re-applies the (unchanged) HP mask to a
+  // header that is already unprotected, re-scrambling it — and reads pnLength
+  // from the scrambled byte, so it may even XOR the wrong number of bytes.
+  // The retry then fails even with the correct keys, every phase-flipped
+  // packet is dropped, and the connection goes permanently deaf in that
+  // direction. Measured against quic-go (which key-updates shortly after
+  // handshake confirmation): ACK processing died at t≈2s, BBR froze mid-
+  // startup, and the sender spent 58s retransmitting one 8 KB band 29 times.
+  //
+  // One ≤1500 B copy per decryption attempt is noise next to the AEAD itself.
+  array = array.slice();
+
   var firstByte = array[0];
   var isShort = (firstByte & 0x80) === 0;
 
@@ -405,7 +437,7 @@ function decrypt_quic_packet(array, readKey, readIv, readHp, dcid, largestPn) {
 
   } else {
     // Short Header
-    var dcidLen = dcid.length;
+    var dcidLen = ownCid.length;
     pnOffset = 1 + dcidLen;
 
     pnLength = remove_header_protection(array, pnOffset, readHp, true);

package/src/h3.js

@@ -13,10 +13,12 @@
  */
 
 import {
+  DEBUG,
   Emitter,
   concatUint8Arrays,
   writeVarInt,
-  readVarInt
+  readVarInt,
+  wt_stream_header
 } from './utils.js';
 
 
@@ -156,26 +158,30 @@ function huffDecode(buf) {
 //  QPACK parse/build helpers
 // ============================================================
 
-function decodeQpackVarInt(buf, prefixBits, pos) {
+// Read a QPACK/HPACK prefixed integer at buf[pos]. Returns { value, next } or
+// null if the buffer ends mid-integer (truncated). Used by both the header
+// block parser and the encoder-instruction parser.
+function readPrefixedInt(buf, prefixBits, pos) {
+  if (pos >= buf.length) return null;
   var max = (1 << prefixBits) - 1;
   var value = buf[pos] & max;
   pos++;
   if (value < max) return { value: value, next: pos };
   var m = 0;
-  while (true) {
+  while (pos < buf.length) {
     var byte = buf[pos++];
     value += (byte & 0x7f) << m;
-    if ((byte & 0x80) === 0) break;
+    if ((byte & 0x80) === 0) return { value: value, next: pos };
     m += 7;
   }
-  return { value: value, next: pos };
+  return null; // truncated mid-integer
 }
 
 function parseQpackHeaderBlock(buf, dynamicTable, baseIndex) {
   var pos = 0;
-  var ric = decodeQpackVarInt(buf, 8, pos); pos = ric.next;
+  var ric = readPrefixedInt(buf, 8, pos); if (!ric) return {}; pos = ric.next;
   var postBase = (buf[pos] & 0x80) !== 0;
-  var db = decodeQpackVarInt(buf, 7, pos); pos = db.next;
+  var db = readPrefixedInt(buf, 7, pos); if (!db) return {}; pos = db.next;
   var bi = postBase ? ric.value + db.value : ric.value - db.value;
 
   var headers = {};
@@ -185,7 +191,7 @@ function parseQpackHeaderBlock(buf, dynamicTable, baseIndex) {
     if ((byte & 0x80) === 0x80) {
       // Indexed
       var fromStatic = (byte & 0x40) !== 0;
-      var idx = decodeQpackVarInt(buf, 6, pos); pos = idx.next;
+      var idx = readPrefixedInt(buf, 6, pos); if (!idx) break; pos = idx.next;
       if (fromStatic && idx.value < QPACK_STATIC.length) {
         headers[QPACK_STATIC[idx.value][0]] = QPACK_STATIC[idx.value][1];
       } else if (!fromStatic && dynamicTable) {
@@ -198,9 +204,9 @@ function parseQpackHeaderBlock(buf, dynamicTable, baseIndex) {
     } else if ((byte & 0xc0) === 0x40) {
       // Literal with name ref
       var fromStatic = (byte & 0x10) !== 0;
-      var nameIdx = decodeQpackVarInt(buf, 4, pos); pos = nameIdx.next;
+      var nameIdx = readPrefixedInt(buf, 4, pos); if (!nameIdx) break; pos = nameIdx.next;
       var valH = (buf[pos] & 0x80) !== 0;
-      var valLen = decodeQpackVarInt(buf, 7, pos); pos = valLen.next;
+      var valLen = readPrefixedInt(buf, 7, pos); if (!valLen) break; pos = valLen.next;
       var valBytes = buf.slice(pos, pos + valLen.value); pos += valLen.value;
       var value = valH ? huffDecode(valBytes) : new TextDecoder().decode(valBytes);
 
@@ -216,11 +222,11 @@ function parseQpackHeaderBlock(buf, dynamicTable, baseIndex) {
     } else if ((byte & 0xe0) === 0x20) {
       // Literal with literal name
       var nameH = (byte & 0x08) !== 0;
-      var nameLen = decodeQpackVarInt(buf, 3, pos); pos = nameLen.next;
+      var nameLen = readPrefixedInt(buf, 3, pos); if (!nameLen) break; pos = nameLen.next;
       var nameBytes = buf.slice(pos, pos + nameLen.value); pos += nameLen.value;
       var name = nameH ? huffDecode(nameBytes) : new TextDecoder().decode(nameBytes);
       var valH = (buf[pos] & 0x80) !== 0;
-      var valLen = decodeQpackVarInt(buf, 7, pos); pos = valLen.next;
+      var valLen = readPrefixedInt(buf, 7, pos); if (!valLen) break; pos = valLen.next;
       var valBytes = buf.slice(pos, pos + valLen.value); pos += valLen.value;
       var value = valH ? huffDecode(valBytes) : new TextDecoder().decode(valBytes);
       headers[name] = value;
@@ -421,22 +427,13 @@ function parseQpackEncoderInstructions(chunks, fromOffset) {
   var pos = 0;
   var instructions = [];
 
+  // Thin wrapper over the shared readPrefixedInt that advances the local `pos`
+  // and returns the value (or null on truncation), preserving call-site usage.
   function safeVarInt(prefixBits) {
-    if (pos >= combined.length) return null;
-    var max = (1 << prefixBits) - 1;
-    var value = combined[pos] & max;
-    var startPos = pos;
-    pos++;
-    if (value < max) return value;
-    var m = 0;
-    while (pos < combined.length) {
-      var b = combined[pos++];
-      value += (b & 0x7f) << m;
-      if ((b & 0x80) === 0) return value;
-      m += 7;
-    }
-    pos = startPos;
-    return null;
+    var r = readPrefixedInt(combined, prefixBits, pos);
+    if (!r) return null;
+    pos = r.next;
+    return r.value;
   }
 
   while (pos < combined.length) {
@@ -624,8 +621,8 @@ function H3Connection(options) {
     var encId   = context.isServer ? 7 : 6;
     var decId   = context.isServer ? 11 : 10;
 
-    console.log('[h3] sendControlStreams ctrl=' + ctrlId + ' enc=' + encId + ' dec=' + decId);
-    console.log('[h3] SETTINGS hex: ' + Array.from(controlFrame).map(function(b){ return b.toString(16).padStart(2,'0'); }).join(' '));
+    if (DEBUG) console.log('[h3] sendControlStreams ctrl=' + ctrlId + ' enc=' + encId + ' dec=' + decId);
+    if (DEBUG) console.log('[h3] SETTINGS hex: ' + Array.from(controlFrame).map(function(b){ return b.toString(16).padStart(2,'0'); }).join(' '));
 
     // Send type byte + SETTINGS together as one chunk (some implementations need this)
     var ctrlData = new Uint8Array(1 + controlFrame.byteLength);
@@ -637,6 +634,17 @@ function H3Connection(options) {
   }
 
 
+  // ---- Graceful shutdown: GOAWAY (RFC 9114 §5.2) ----
+
+  function sendGoaway(id) {
+    sendControlStreams();  // idempotent — ensures the control stream + its type byte exist
+    var ctrlId = context.isServer ? 3 : 2;
+    var frame = buildH3Frames([{ frame_type: 0x07, payload: writeVarInt(id || 0) }]);
+    if (DEBUG) console.log('[h3] → GOAWAY id=' + (id || 0));
+    quic.sendStream(ctrlId, frame, false);
+  }
+
+
   // ---- Incoming stream data ----
 
   var _claimedStreams = new Set(); // streams owned by WebTransport (skip H3 processing)
@@ -655,7 +663,7 @@ function H3Connection(options) {
     }
 
     if (_claimedStreams.has(sid)) return; // owned by WebTransport client
-    console.log('[h3] stream ' + streamId + ' data=' + data.byteLength + ' fin=' + fin);
+    if (DEBUG) console.log('[h3] stream ' + streamId + ' data=' + data.byteLength + ' fin=' + fin);
     if (!(streamId in context.streams)) {
       context.streams[streamId] = { chunks: [], from_offset: 0, type: null, fin_received: false };
     }
@@ -671,7 +679,7 @@ function H3Connection(options) {
       // ---- WT stream detection ----
       if (context.local_webtransport && _wtSessions.size > 0) {
         var allData = concatUint8Arrays(s.chunks);
-        console.log('[h3] WT check: stream=' + sid + ' firstByte=0x' + (allData[0] || 0).toString(16) + ' len=' + allData.byteLength + ' sessions=' + Array.from(_wtSessions));
+        if (DEBUG) console.log('[h3] WT check: stream=' + sid + ' firstByte=0x' + (allData[0] || 0).toString(16) + ' len=' + allData.byteLength + ' sessions=' + Array.from(_wtSessions));
         if (allData.byteLength >= 2 && allData[0] === 0x40) {
           var typeResult = readVarInt(allData, 0);
           if (typeResult) {
@@ -689,7 +697,7 @@ function H3Connection(options) {
                 _wtStreams[sid] = { sessionId: sessionId, isBidi: !isUni };
                 delete context.streams[streamId];
 
-                console.log('[h3] WT stream detected: stream=' + sid + ' session=' + sessionId + ' bidi=' + !isUni + ' dataLen=' + remaining.byteLength);
+                if (DEBUG) console.log('[h3] WT stream detected: stream=' + sid + ' session=' + sessionId + ' bidi=' + !isUni + ' dataLen=' + remaining.byteLength);
                 ev.emit('wt_stream', sessionId, sid, remaining, fin, !isUni);
                 if (fin) delete _wtStreams[sid];
                 return;
@@ -739,7 +747,7 @@ function H3Connection(options) {
 
   function processControlStream(s) {
     var ext = extractH3Frames(s.chunks, s.from_offset);
-    console.log('[h3] control: extracted ' + ext.frames.length + ' H3 frames');
+    if (DEBUG) console.log('[h3] control: extracted ' + ext.frames.length + ' H3 frames');
     if (ext.frames.length === 0) return;
     s.from_offset = ext.new_from_offset;
 
@@ -761,7 +769,12 @@ function H3Connection(options) {
         set_context(updates);
 
       } else if (ext.frames[i].frame_type === 0x07) {
-        // GOAWAY — TODO
+        // GOAWAY (RFC 9114 §5.2): the peer will not process requests/pushes
+        // with an identifier >= this value. Surface it so consumers (e.g. the
+        // agent) can stop sending new requests on this connection.
+        var gp = readVarInt(ext.frames[i].payload, 0);
+        if (DEBUG) console.log('[h3] ← GOAWAY id=' + (gp ? gp.value : '?'));
+        ev.emit('goaway', gp ? gp.value : 0);
       }
     }
   }
@@ -801,7 +814,7 @@ function H3Connection(options) {
 
   function processBidiStream(streamId, s) {
     var ext = extractH3Frames(s.chunks, s.from_offset);
-    console.log('[h3] bidi stream ' + streamId + ': extracted ' + ext.frames.length + ' H3 frames, types=' + ext.frames.map(function(f){ return '0x' + f.frame_type.toString(16); }).join(','));
+    if (DEBUG) console.log('[h3] bidi stream ' + streamId + ': extracted ' + ext.frames.length + ' H3 frames, types=' + ext.frames.map(function(f){ return '0x' + f.frame_type.toString(16); }).join(','));
 
     if (ext.frames.length > 0) {
       s.from_offset = ext.new_from_offset;
@@ -836,12 +849,12 @@ function H3Connection(options) {
   function sendHeaders(streamId, headers, fin) {
     var payload = buildQpackHeaderBlock(headers);
     var frame = buildH3Frames([{ frame_type: 1, payload: payload }]);
-    console.log('[h3] sendHeaders stream=' + streamId + ' len=' + frame.byteLength + ' fin=' + !!fin);
+    if (DEBUG) console.log('[h3] sendHeaders stream=' + streamId + ' len=' + frame.byteLength + ' fin=' + !!fin);
     quic.sendStream(streamId, frame, !!fin);
   }
 
   function sendBody(streamId, data, fin) {
-    console.log('[h3] sendBody stream=' + streamId + ' data=' + (data ? data.byteLength : 'null') + ' fin=' + fin);
+    if (DEBUG) console.log('[h3] sendBody stream=' + streamId + ' data=' + (data ? data.byteLength : 'null') + ' fin=' + fin);
     if (data === null || data === undefined) {
       // Just set FIN on the stream (no additional H3 frame needed for empty body)
       quic.sendStream(streamId, new Uint8Array(0), true);
@@ -864,6 +877,7 @@ function H3Connection(options) {
     sendHeaders: sendHeaders,
     sendBody: sendBody,
     sendControlStreams: sendControlStreams,
+    sendGoaway: sendGoaway,
     claimStream: function (streamId) { _claimedStreams.add(Number(streamId)); },
 
     // WebTransport server-side API
@@ -887,12 +901,7 @@ function H3Connection(options) {
       }
 
       // Send WT prefix: VarInt(type) + VarInt(session_id)
-      var typePrefix = writeVarInt(isBidi ? 0x41 : 0x54);
-      var sessionPrefix = writeVarInt(sessionId);
-      var header = new Uint8Array(typePrefix.length + sessionPrefix.length);
-      header.set(typePrefix, 0);
-      header.set(sessionPrefix, typePrefix.length);
-      quic.sendStream(streamId, header, false);
+      quic.sendStream(streamId, wt_stream_header(isBidi, sessionId), false);
 
       _claimedStreams.add(streamId);
       _wtStreams[streamId] = { sessionId: sessionId, isBidi: isBidi };