@moqtap/codec 0.8.1 → 0.10.0

package/CHANGELOG.md

@@ -0,0 +1,75 @@
+# Changelog
+
+All notable changes to `@moqtap/codec` will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+This file starts at 0.9.0. Earlier releases are in the git history.
+
+## [0.10.0] - 2026-09-03
+
+### Changed
+
+- **Breaking.** `authorization_token` is `readonly AuthorizationToken[]` on
+  drafts 11 through 20, on message parameters and on setup options. A single
+  token is a one-element array.
+
+  Section 10.2.2 and its equivalents: "The AUTHORIZATION TOKEN parameter MAY be
+  repeated within a message as long as the combination of Token Type and Token
+  Value are unique after resolving any aliases."
+
+- **Breaking.** `subgroup_filter`, `objectid_filter`, `priority_filter`,
+  `object_property_filter` and `track_property_filter` are
+  `readonly RangeFilter[]` on drafts 19 and 20, on message parameters and on
+  draft-20's `FILL_PARAMETERS`. A single filter is a one-element array.
+
+  Section 5.1.3 on draft-19 and 5.1.4 on draft-20: "All other filter parameters
+  MAY appear multiple times in a FETCH, SUBSCRIBE, SUBSCRIBE_TRACKS, or
+  REQUEST_UPDATE". One filter parameter carries one SetID and the sets are ORed,
+  so two alternatives over the same field need two parameters.
+
+- `@moqtap/test-vectors` raised to `^0.15.0`, where a `decoded` message spells
+  each Key-Value-Pair block as a list of entries in wire order rather than as a
+  map keyed by parameter name.
+
+## [0.9.0] - 2026-09-03
+
+Draft-20 support, and a fix to draft-19 that changes which state machine a
+draft-19 session runs.
+
+### Added
+
+- **Draft-20**: codec, message and data-stream tables, wire rules, error codes
+  and session FSM, exported as `@moqtap/codec/draft20` and
+  `@moqtap/codec/draft20/session`. `createCodec({ draft: '20' })` and
+  `createDraft20Codec()` both reach it.
+- `PUBLISH_STATE_NOTIFY` (`0x22`), the one control message draft-20 adds. It is
+  unilateral and not subject to `MAX_REQUEST_UPDATES`.
+- Draft-20's rewritten `FETCH`. The message keeps codepoint `0x16` but drops the
+  Fetch Type discriminator, carries Track Namespace and Track Name inline, and
+  moves its range into a `LOCATION_FILTER` parameter. Nothing on the wire
+  distinguishes it from a draft-19 `FETCH` at the type byte, so a session
+  decoded under the wrong draft will silently misparse it — pick the draft from
+  the negotiated `moqt-NN` protocol string, not from message content.
+- `INCLUDE_PROPERTIES` (`0x35`), a uint8 boolean defaulting to `1`.
+
+### Fixed
+
+- **`createDraft19Codec()` reported `draft: '18'`.** Since `createSessionState()`
+  keys off `codec.draft`, every draft-19 session was validated by the draft-18
+  FSM. Draft-19 sessions now run the draft-19 FSM, which enforces rules the
+  draft-18 one does not — a session that passed validation on 0.8.1 may now be
+  rejected, correctly.
+
+### Changed
+
+- Draft-20 ranges are **inclusive**. An end location names the last object, not
+  one past it; do not carry a draft-19 `+ 1` forward.
+- Retired error codes decode rather than being refused. Draft-20 Section 14
+  requires an unknown error code in any error context to be treated as
+  `INTERNAL_ERROR`, and forbids closing the session over one in `REQUEST_ERROR`
+  or `PUBLISH_DONE`. The `RETIRED_*` sets remain exported as advisory
+  diagnostics — useful for "this peer looks like draft-19" — but are no longer
+  decode gates.
+- `@moqtap/test-vectors` dependency raised to `^0.13.0` for the draft-20 corpus.

package/README.md

@@ -2,7 +2,7 @@
 
 MoQT (Media over QUIC Transport) wire-format codec and session state machine for JavaScript/TypeScript.
 
-- Multi-draft support (drafts 07 through 19)
+- Multi-draft support (drafts 07 through 20)
 - Stateless encode/decode of all MoQT control messages and data streams
 - Protocol session state machine with FSM-based validation per draft
 - Zero runtime dependencies
@@ -43,10 +43,11 @@ Or use the factory if your application supports multiple drafts:
 ```typescript
 import { createCodec, DRAFT_VERSIONS } from '@moqtap/codec'
 
-const codec = createCodec({ draft: '19' }) // '07' through '19'
+const codec = createCodec({ draft: '20' }) // '07' through '20'
 
-// DRAFT_VERSIONS provides wire version numbers under short aliases:
-//   DRAFT_VERSIONS['07'] — 0xff000007n
+// DRAFT_VERSIONS provides version identifiers under short aliases:
+//   DRAFT_VERSIONS['07'] — 0xff000007n, a real draft-07 wire value
+//   DRAFT_VERSIONS['20'] — 0xff000014n, derived; see the note below
 ```
 
 ## Subpath Exports
@@ -69,10 +70,21 @@ Each draft is available as a subpath import with its own codec and session state
 | `@moqtap/codec/draft17`          | Draft-17 codec                                    |
 | `@moqtap/codec/draft18`          | Draft-18 codec                                    |
 | `@moqtap/codec/draft19`          | Draft-19 codec                                    |
+| `@moqtap/codec/draft20`          | Draft-20 codec                                    |
 | `@moqtap/codec/draft{N}/session` | Session state machine for draft N                 |
 
 > **Note:** A default (versionless) codec will be available once the MoQT specification reaches RFC status. Until then, always specify a draft version.
 
+`DRAFT_VERSIONS` is a table of numeric keys, and only the entries up to `'14'` are values a peer
+ever puts on the wire. From draft-15 the version is negotiated by ALPN (raw QUIC) or
+`WT-Available-Protocols` (WebTransport) as the string `moqt-NN`, and no version number is sent at
+all — so `DRAFT_VERSIONS['20']` is a derived identifier, not something observed. Each draft module
+from 15 on exports the real one:
+
+```typescript
+import { PROTOCOL_STRING } from '@moqtap/codec/draft20' // 'moqt-20'
+```
+
 ## Draft-Specific Imports
 
 For applications targeting a single draft version:

package/dist/{chunk-KCH4BQXK.cjs → chunk-AQ445VV7.cjs}

@@ -1,4 +1,4 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
 
@@ -411,7 +411,7 @@ function encodeSetupParams(params, w) {
   let count = 0;
   if (params.path !== void 0) count++;
   if (params.max_request_id !== void 0) count++;
-  if (params.authorization_token !== void 0) count++;
+  count += _nullishCoalesce(_optionalChain([params, 'access', _2 => _2.authorization_token, 'optionalAccess', _3 => _3.length]), () => ( 0));
   if (params.max_auth_token_cache_size !== void 0) count++;
   if (params.unknown) count += params.unknown.length;
   w.writeVarInt(count);
@@ -425,9 +425,9 @@ function encodeSetupParams(params, w) {
     w.writeVarInt(SETUP_PARAM_MAX_REQUEST_ID);
     w.writeVarInt(params.max_request_id);
   }
-  if (params.authorization_token !== void 0) {
+  for (const token of _nullishCoalesce(params.authorization_token, () => ( []))) {
     w.writeVarInt(SETUP_PARAM_AUTHORIZATION_TOKEN);
-    encodeAuthorizationToken(params.authorization_token, w);
+    encodeAuthorizationToken(token, w);
   }
   if (params.max_auth_token_cache_size !== void 0) {
     w.writeVarInt(SETUP_PARAM_MAX_AUTH_TOKEN_CACHE_SIZE);
@@ -477,7 +477,10 @@ function decodeSetupParams(r) {
         const bytes = r.readBytes(length);
         result.path = textDecoder.decode(bytes);
       } else if (paramType === SETUP_PARAM_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(r, length);
+        result.authorization_token = [
+          ..._nullishCoalesce(result.authorization_token, () => ( [])),
+          decodeAuthorizationToken(r, length)
+        ];
       } else {
         const bytes = r.readBytes(length);
         unknown.push({
@@ -494,16 +497,16 @@ function decodeSetupParams(r) {
 function encodeParams(params, w) {
   let count = params.unknown ? params.unknown.length : 0;
   if (params.delivery_timeout !== void 0) count++;
-  if (params.authorization_token !== void 0) count++;
+  count += _nullishCoalesce(_optionalChain([params, 'access', _4 => _4.authorization_token, 'optionalAccess', _5 => _5.length]), () => ( 0));
   if (params.max_cache_duration !== void 0) count++;
   w.writeVarInt(count);
   if (params.delivery_timeout !== void 0) {
     w.writeVarInt(PARAM_DELIVERY_TIMEOUT);
     w.writeVarInt(params.delivery_timeout);
   }
-  if (params.authorization_token !== void 0) {
+  for (const token of _nullishCoalesce(params.authorization_token, () => ( []))) {
     w.writeVarInt(PARAM_AUTHORIZATION_TOKEN);
-    encodeAuthorizationToken(params.authorization_token, w);
+    encodeAuthorizationToken(token, w);
   }
   if (params.max_cache_duration !== void 0) {
     w.writeVarInt(PARAM_MAX_CACHE_DURATION);
@@ -550,7 +553,10 @@ function decodeParams(r) {
     } else {
       const length = Number(r.readVarInt());
       if (paramType === PARAM_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(r, length);
+        result.authorization_token = [
+          ..._nullishCoalesce(result.authorization_token, () => ( [])),
+          decodeAuthorizationToken(r, length)
+        ];
       } else {
         const bytes = r.readBytes(length);
         unknown.push({

package/dist/{chunk-UZO5Z2XT.cjs → chunk-BIBMDTU5.cjs}

@@ -935,12 +935,12 @@ function encodeSetupOptions(opts, writer) {
       }
     });
   }
-  if (opts.authorization_token !== void 0) {
+  for (const token of _nullishCoalesce(opts.authorization_token, () => ( []))) {
     entries.push({
       type: SETUP_OPT_AUTHORIZATION_TOKEN,
       encode: (w) => {
         const tmpW = new (0, _chunk4XLYCT5Qcjs.MoqtBufferWriter)(64);
-        encodeAuthorizationToken(opts.authorization_token, tmpW);
+        encodeAuthorizationToken(token, tmpW);
         const raw = tmpW.finish();
         w.writeVarInt(BigInt(raw.byteLength));
         w.writeBytes(raw);
@@ -1028,7 +1028,10 @@ function decodeSetupOptions(reader, payloadEnd) {
       if (optType === SETUP_OPT_PATH) {
         result.path = textDecoder.decode(bytes);
       } else if (optType === SETUP_OPT_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(new (0, _chunk4XLYCT5Qcjs.MoqtBufferReader)(bytes));
+        result.authorization_token = [
+          ..._nullishCoalesce(result.authorization_token, () => ( [])),
+          decodeAuthorizationToken(new (0, _chunk4XLYCT5Qcjs.MoqtBufferReader)(bytes))
+        ];
       } else if (optType === SETUP_OPT_AUTHORITY) {
         result.authority = textDecoder.decode(bytes);
       } else if (optType === SETUP_OPT_MOQT_IMPLEMENTATION) {
@@ -1138,12 +1141,12 @@ function encodeParams(params, writer) {
       encode: (w) => w.writeVarInt(params.object_delivery_timeout)
     });
   }
-  if (params.authorization_token !== void 0) {
+  for (const token of _nullishCoalesce(params.authorization_token, () => ( []))) {
     entries.push({
       type: PARAM_AUTHORIZATION_TOKEN,
       encode: (w) => {
         const tmpW = new (0, _chunk4XLYCT5Qcjs.MoqtBufferWriter)(64);
-        encodeAuthorizationToken(params.authorization_token, tmpW);
+        encodeAuthorizationToken(token, tmpW);
         const raw = tmpW.finish();
         w.writeVarInt(BigInt(raw.byteLength));
         w.writeBytes(raw);
@@ -1283,7 +1286,10 @@ function decodeParams(reader, messageType) {
     } else if (paramType === PARAM_AUTHORIZATION_TOKEN) {
       const length = Number(reader.readVarInt());
       const bytes = reader.readBytes(length);
-      result.authorization_token = decodeAuthorizationToken(new (0, _chunk4XLYCT5Qcjs.MoqtBufferReader)(bytes));
+      result.authorization_token = [
+        ..._nullishCoalesce(result.authorization_token, () => ( [])),
+        decodeAuthorizationToken(new (0, _chunk4XLYCT5Qcjs.MoqtBufferReader)(bytes))
+      ];
     } else if (paramType === PARAM_RENDEZVOUS_TIMEOUT) {
       result.rendezvous_timeout = reader.readVarInt();
     } else if (paramType === PARAM_SUBGROUP_DELIVERY_TIMEOUT) {