@moq-web/cat 0.1.0

package/dist/types.d.ts

@@ -0,0 +1,178 @@
+/**
+ * @fileoverview CAT/C4M Token Types
+ *
+ * Type definitions for CBOR, COSE, CWT, and MoQT-specific token structures.
+ */
+/**
+ * Represents any value that can be encoded/decoded as CBOR.
+ */
+export type CborValue = number | bigint | string | Uint8Array | boolean | null | CborValue[] | Map<number | string, CborValue>;
+/**
+ * CBOR tagged value.
+ */
+export interface CborTagged {
+    tag: number;
+    value: CborValue;
+}
+/**
+ * COSE algorithm identifiers.
+ * @see RFC 9053 Section 2.1
+ */
+export declare enum CoseAlgorithm {
+    /** ECDSA w/ SHA-256 on P-256 */
+    ES256 = -7,
+    /** ECDSA w/ SHA-384 on P-384 */
+    ES384 = -35,
+    /** ECDSA w/ SHA-512 on P-521 */
+    ES512 = -36,
+    /** HMAC w/ SHA-256 (full 256-bit tag) — COSE_Mac0 */
+    HMAC_256_256 = 5
+}
+/**
+ * COSE header parameter keys.
+ * @see RFC 9052 Section 3.1
+ */
+export declare enum CoseHeaderParam {
+    /** Algorithm identifier */
+    ALG = 1,
+    /** Content type */
+    CTY = 3,
+    /** Key ID */
+    KID = 4
+}
+/**
+ * COSE_Sign1 structure.
+ * @see RFC 9052 Section 4.2
+ */
+export interface CoseSign1 {
+    /** CBOR-encoded protected header (bstr) */
+    protectedHeader: Uint8Array;
+    /** Unprotected header (map) */
+    unprotectedHeader: Map<number, CborValue>;
+    /** Payload (bstr — CBOR-encoded CWT claims for CAT tokens) */
+    payload: Uint8Array;
+    /** Signature (bstr) */
+    signature: Uint8Array;
+}
+/**
+ * Maps CoseAlgorithm to WebCrypto parameters.
+ */
+/**
+ * COSE algorithm parameter details.
+ */
+export interface CoseAlgParams {
+    /** WebCrypto algorithm name */
+    name: string;
+    /** Hash algorithm */
+    hash: string;
+    /** EC named curve (ECDSA only) */
+    namedCurve?: string;
+    /** Expected signature/tag length in bytes */
+    sigLength: number;
+    /** Whether this is a MAC algorithm (COSE_Mac0) vs signing (COSE_Sign1) */
+    isMac: boolean;
+}
+export declare const COSE_ALG_PARAMS: Readonly<Record<CoseAlgorithm, Readonly<CoseAlgParams>>>;
+/**
+ * CWT claim keys (integer-based per RFC 8392 Section 4).
+ */
+export declare enum CwtClaimKey {
+    /** Issuer */
+    ISS = 1,
+    /** Subject */
+    SUB = 2,
+    /** Audience */
+    AUD = 3,
+    /** Expiration Time (NumericDate) */
+    EXP = 4,
+    /** Not Before (NumericDate) */
+    NBF = 5,
+    /** Issued At (NumericDate) */
+    IAT = 6,
+    /** CWT ID */
+    CTI = 7,
+    /** MoQT scopes (pending IANA assignment) */
+    MOQT = 327
+}
+/**
+ * CWT claims structure.
+ */
+export interface CwtClaims {
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    cti?: Uint8Array;
+    moqt?: MoqtScope[];
+    /** Additional claims keyed by integer */
+    additionalClaims?: Map<number, CborValue>;
+}
+/**
+ * MoQT action codes for token scopes.
+ * @see draft-ietf-moq-transport
+ */
+export declare enum MoqtAction {
+    ClientSetup = 0,
+    ServerSetup = 1,
+    PublishNamespace = 2,
+    SubscribeNamespace = 3,
+    Subscribe = 4,
+    RequestUpdate = 5,
+    Publish = 6,
+    Fetch = 7,
+    TrackStatus = 8
+}
+/**
+ * A single MoQT authorization scope.
+ */
+export interface MoqtScope {
+    /** Permitted actions */
+    actions: MoqtAction[];
+    /** Namespace prefix to match (optional — null means any) */
+    namespaceMatch?: (string | Uint8Array)[];
+    /** Track name to match (optional — null means any) */
+    trackMatch?: string | Uint8Array;
+}
+/**
+ * C4M token type identifier (ASCII "c4m").
+ */
+export declare const C4M_TOKEN_TYPE = 6501485;
+/**
+ * Decoded CAT token.
+ */
+export interface CatToken {
+    /** Decoded protected header as map */
+    header: Map<number, CborValue>;
+    /** Decoded CWT claims */
+    claims: CwtClaims;
+    /** Raw COSE_Sign1 structure */
+    coseSign1: CoseSign1;
+    /** Algorithm used for signing */
+    algorithm: CoseAlgorithm;
+}
+/**
+ * Result of CAT token validation.
+ */
+export interface CatValidationResult {
+    valid: boolean;
+    token?: CatToken;
+    error?: string;
+    expired?: boolean;
+}
+/**
+ * Options for CAT token validation.
+ */
+export interface CatValidationOptions {
+    /** Clock skew tolerance in seconds (default: 60) */
+    clockSkewSeconds?: number;
+    /** Required audience value */
+    requiredAudience?: string;
+    /** Override current time for testing (Unix timestamp seconds) */
+    now?: number;
+    /** Required algorithm — rejects tokens using a different algorithm */
+    requiredAlgorithm?: CoseAlgorithm;
+    /** Require exp claim to be present (default: true) */
+    requireExp?: boolean;
+}

package/dist/types.js

@@ -0,0 +1,91 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025 Cisco Systems
+// SPDX-License-Identifier: BSD-2-Clause
+// ============================================================================
+// COSE Types (RFC 9052)
+// ============================================================================
+/**
+ * COSE algorithm identifiers.
+ * @see RFC 9053 Section 2.1
+ */
+export var CoseAlgorithm;
+(function (CoseAlgorithm) {
+    /** ECDSA w/ SHA-256 on P-256 */
+    CoseAlgorithm[CoseAlgorithm["ES256"] = -7] = "ES256";
+    /** ECDSA w/ SHA-384 on P-384 */
+    CoseAlgorithm[CoseAlgorithm["ES384"] = -35] = "ES384";
+    /** ECDSA w/ SHA-512 on P-521 */
+    CoseAlgorithm[CoseAlgorithm["ES512"] = -36] = "ES512";
+    /** HMAC w/ SHA-256 (full 256-bit tag) — COSE_Mac0 */
+    CoseAlgorithm[CoseAlgorithm["HMAC_256_256"] = 5] = "HMAC_256_256";
+})(CoseAlgorithm || (CoseAlgorithm = {}));
+/**
+ * COSE header parameter keys.
+ * @see RFC 9052 Section 3.1
+ */
+export var CoseHeaderParam;
+(function (CoseHeaderParam) {
+    /** Algorithm identifier */
+    CoseHeaderParam[CoseHeaderParam["ALG"] = 1] = "ALG";
+    /** Content type */
+    CoseHeaderParam[CoseHeaderParam["CTY"] = 3] = "CTY";
+    /** Key ID */
+    CoseHeaderParam[CoseHeaderParam["KID"] = 4] = "KID";
+})(CoseHeaderParam || (CoseHeaderParam = {}));
+// Frozen to prevent runtime mutation of algorithm parameters
+export const COSE_ALG_PARAMS = Object.freeze({
+    [CoseAlgorithm.ES256]: Object.freeze({ name: 'ECDSA', hash: 'SHA-256', namedCurve: 'P-256', sigLength: 64, isMac: false }),
+    [CoseAlgorithm.ES384]: Object.freeze({ name: 'ECDSA', hash: 'SHA-384', namedCurve: 'P-384', sigLength: 96, isMac: false }),
+    [CoseAlgorithm.ES512]: Object.freeze({ name: 'ECDSA', hash: 'SHA-512', namedCurve: 'P-521', sigLength: 132, isMac: false }),
+    [CoseAlgorithm.HMAC_256_256]: Object.freeze({ name: 'HMAC', hash: 'SHA-256', sigLength: 32, isMac: true }),
+});
+// ============================================================================
+// CWT Types (RFC 8392)
+// ============================================================================
+/**
+ * CWT claim keys (integer-based per RFC 8392 Section 4).
+ */
+export var CwtClaimKey;
+(function (CwtClaimKey) {
+    /** Issuer */
+    CwtClaimKey[CwtClaimKey["ISS"] = 1] = "ISS";
+    /** Subject */
+    CwtClaimKey[CwtClaimKey["SUB"] = 2] = "SUB";
+    /** Audience */
+    CwtClaimKey[CwtClaimKey["AUD"] = 3] = "AUD";
+    /** Expiration Time (NumericDate) */
+    CwtClaimKey[CwtClaimKey["EXP"] = 4] = "EXP";
+    /** Not Before (NumericDate) */
+    CwtClaimKey[CwtClaimKey["NBF"] = 5] = "NBF";
+    /** Issued At (NumericDate) */
+    CwtClaimKey[CwtClaimKey["IAT"] = 6] = "IAT";
+    /** CWT ID */
+    CwtClaimKey[CwtClaimKey["CTI"] = 7] = "CTI";
+    /** MoQT scopes (pending IANA assignment) */
+    CwtClaimKey[CwtClaimKey["MOQT"] = 327] = "MOQT";
+})(CwtClaimKey || (CwtClaimKey = {}));
+// ============================================================================
+// MoQT Auth Types
+// ============================================================================
+/**
+ * MoQT action codes for token scopes.
+ * @see draft-ietf-moq-transport
+ */
+export var MoqtAction;
+(function (MoqtAction) {
+    MoqtAction[MoqtAction["ClientSetup"] = 0] = "ClientSetup";
+    MoqtAction[MoqtAction["ServerSetup"] = 1] = "ServerSetup";
+    MoqtAction[MoqtAction["PublishNamespace"] = 2] = "PublishNamespace";
+    MoqtAction[MoqtAction["SubscribeNamespace"] = 3] = "SubscribeNamespace";
+    MoqtAction[MoqtAction["Subscribe"] = 4] = "Subscribe";
+    MoqtAction[MoqtAction["RequestUpdate"] = 5] = "RequestUpdate";
+    MoqtAction[MoqtAction["Publish"] = 6] = "Publish";
+    MoqtAction[MoqtAction["Fetch"] = 7] = "Fetch";
+    MoqtAction[MoqtAction["TrackStatus"] = 8] = "TrackStatus";
+})(MoqtAction || (MoqtAction = {}));
+// ============================================================================
+// CAT Token Types
+// ============================================================================
+/**
+ * C4M token type identifier (ASCII "c4m").
+ */
+export const C4M_TOKEN_TYPE = 0x63346d;

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@moq-web/cat",
+  "version": "0.1.0",
+  "description": "Common Access Token (CAT/C4M) for MoQ Transport — CBOR/COSE/CWT token library",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint src --ext .ts",
+    "clean": "rm -rf dist"
+  },
+  "devDependencies": {
+    "vitest": "^4.0.18"
+  },
+  "keywords": [
+    "moqt",
+    "cat",
+    "cose",
+    "cwt",
+    "cbor",
+    "auth",
+    "token"
+  ],
+  "license": "BSD-2-Clause"
+}