@moqtap/codec 0.8.1 → 0.10.0

package/src/drafts/draft11/types.ts

@@ -24,7 +24,7 @@ export interface Draft11SetupParams {
 
 // Version-specific parameters — even/odd convention
 export interface Draft11Params {
-  authorization_token?: AuthorizationToken // 0x01 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x01 odd
   delivery_timeout?: bigint // 0x02 even
   max_cache_duration?: bigint // 0x04 even
   unknown?: UnknownParam[]

package/src/drafts/draft12/codec.ts

@@ -73,7 +73,7 @@ function encodeSetupParams(params: Draft12SetupParams, w: BufferWriter): void {
   let count = 0
   if (params.path !== undefined) count++
   if (params.max_request_id !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.unknown) count += params.unknown.length
 
   w.writeVarInt(count)
@@ -88,9 +88,9 @@ function encodeSetupParams(params: Draft12SetupParams, w: BufferWriter): void {
     w.writeVarInt(SETUP_PARAM_MAX_REQUEST_ID)
     w.writeVarInt(params.max_request_id)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     w.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
-    const at = params.authorization_token
+    const at = token
     const tmpW = new BufferWriter(64)
     tmpW.writeVarInt(at.alias_type)
     tmpW.writeVarInt(at.token_type)
@@ -148,11 +148,14 @@ function decodeSetupParams(r: BufferReader): Draft12SetupParams {
         const token_type = r.readVarInt()
         const tokenBytesLen = length - (r.offset - startOff)
         const tokenBytes = r.readBytes(tokenBytesLen)
-        result.authorization_token = {
-          alias_type,
-          token_type,
-          token_value: tokenBytes,
-        }
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          {
+            alias_type,
+            token_type,
+            token_value: tokenBytes,
+          },
+        ]
       } else {
         const bytes = r.readBytes(length)
         unknown.push({
@@ -174,7 +177,7 @@ function decodeSetupParams(r: BufferReader): Draft12SetupParams {
 function encodeParams(params: Draft12Params, w: BufferWriter): void {
   let count = params.unknown ? params.unknown.length : 0
   if (params.delivery_timeout !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.max_cache_duration !== undefined) count++
   w.writeVarInt(count)
 
@@ -183,10 +186,10 @@ function encodeParams(params: Draft12Params, w: BufferWriter): void {
     w.writeVarInt(PARAM_DELIVERY_TIMEOUT)
     w.writeVarInt(params.delivery_timeout)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     // AUTHORIZATION_TOKEN = 0x03 (odd → length-prefixed)
     w.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
-    const at = params.authorization_token
+    const at = token
     const tmpW = new BufferWriter(64)
     tmpW.writeVarInt(at.alias_type)
     tmpW.writeVarInt(at.token_type)
@@ -254,11 +257,14 @@ function decodeParams(r: BufferReader): Draft12Params {
         const token_type = r.readVarInt()
         const tokenBytesLen = length - (r.offset - startOff)
         const tokenBytes = r.readBytes(tokenBytesLen)
-        result.authorization_token = {
-          alias_type,
-          token_type,
-          token_value: tokenBytes,
-        }
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          {
+            alias_type,
+            token_type,
+            token_value: tokenBytes,
+          },
+        ]
       } else {
         const bytes = r.readBytes(length)
         unknown.push({

package/src/drafts/draft12/types.ts

@@ -19,14 +19,14 @@ export interface AuthorizationToken {
 export interface Draft12SetupParams {
   path?: string // 0x01 odd
   max_request_id?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   unknown?: UnknownParam[]
 }
 
 // Version-specific parameters — even/odd convention
 export interface Draft12Params {
   delivery_timeout?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   max_cache_duration?: bigint // 0x04 even
   unknown?: UnknownParam[]
 }

package/src/drafts/draft13/codec.ts

@@ -115,7 +115,7 @@ function encodeSetupParams(params: Draft13SetupParams, w: BufferWriter): void {
   let count = 0
   if (params.path !== undefined) count++
   if (params.max_request_id !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.max_auth_token_cache_size !== undefined) count++
   if (params.unknown) count += params.unknown.length
 
@@ -131,9 +131,9 @@ function encodeSetupParams(params: Draft13SetupParams, w: BufferWriter): void {
     w.writeVarInt(SETUP_PARAM_MAX_REQUEST_ID)
     w.writeVarInt(params.max_request_id)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     w.writeVarInt(SETUP_PARAM_AUTHORIZATION_TOKEN)
-    encodeAuthorizationToken(params.authorization_token, w)
+    encodeAuthorizationToken(token, w)
   }
   if (params.max_auth_token_cache_size !== undefined) {
     w.writeVarInt(SETUP_PARAM_MAX_AUTH_TOKEN_CACHE_SIZE)
@@ -185,7 +185,10 @@ function decodeSetupParams(r: BufferReader): Draft13SetupParams {
         const bytes = r.readBytes(length)
         result.path = textDecoder.decode(bytes)
       } else if (paramType === SETUP_PARAM_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(r, length)
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          decodeAuthorizationToken(r, length),
+        ]
       } else {
         const bytes = r.readBytes(length)
         unknown.push({
@@ -207,7 +210,7 @@ function decodeSetupParams(r: BufferReader): Draft13SetupParams {
 function encodeParams(params: Draft13Params, w: BufferWriter): void {
   let count = params.unknown ? params.unknown.length : 0
   if (params.delivery_timeout !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.max_cache_duration !== undefined) count++
   w.writeVarInt(count)
 
@@ -216,10 +219,10 @@ function encodeParams(params: Draft13Params, w: BufferWriter): void {
     w.writeVarInt(PARAM_DELIVERY_TIMEOUT)
     w.writeVarInt(params.delivery_timeout)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     // AUTHORIZATION_TOKEN = 0x03 (odd → length-prefixed)
     w.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
-    encodeAuthorizationToken(params.authorization_token, w)
+    encodeAuthorizationToken(token, w)
   }
   if (params.max_cache_duration !== undefined) {
     // MAX_CACHE_DURATION = 0x04 (even → bare varint)
@@ -275,7 +278,10 @@ function decodeParams(r: BufferReader): Draft13Params {
       const length = Number(r.readVarInt())
 
       if (paramType === PARAM_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(r, length)
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          decodeAuthorizationToken(r, length),
+        ]
       } else {
         const bytes = r.readBytes(length)
         unknown.push({

package/src/drafts/draft13/types.ts

@@ -21,7 +21,7 @@ export interface AuthorizationToken {
 export interface Draft13SetupParams {
   path?: string // 0x01 odd
   max_request_id?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   max_auth_token_cache_size?: bigint // 0x04 even
   unknown?: UnknownParam[]
 }
@@ -29,7 +29,7 @@ export interface Draft13SetupParams {
 // Version-specific parameters — even/odd convention
 export interface Draft13Params {
   delivery_timeout?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   max_cache_duration?: bigint // 0x04 even
   unknown?: UnknownParam[]
 }

package/src/drafts/draft14/codec.ts

@@ -78,7 +78,7 @@ function encodeSetupParams(params: Draft14Params, writer: BufferWriter): void {
   if (params.role !== undefined) count++
   if (params.path !== undefined) count++
   if (params.max_request_id !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.authority !== undefined) count++
   if (params.max_auth_token_cache_size !== undefined) count++
   if (params.moqt_implementation !== undefined) count++
@@ -100,9 +100,9 @@ function encodeSetupParams(params: Draft14Params, writer: BufferWriter): void {
     writer.writeVarInt(PARAM_MAX_REQUEST_ID)
     writer.writeVarInt(params.max_request_id)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     writer.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
-    const tok = params.authorization_token
+    const tok = token
     const tmpWriter = new BufferWriter(64)
     tmpWriter.writeVarInt(tok.alias_type)
     if (tok.token_type !== undefined) {
@@ -187,7 +187,10 @@ function decodeSetupParams(reader: BufferReader): Draft14Params {
             tok.token_value = new Uint8Array(tokenValue)
           }
         }
-        result.authorization_token = tok as unknown as AuthorizationToken
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          tok as unknown as AuthorizationToken,
+        ]
       } else if (paramType === PARAM_AUTHORITY) {
         result.authority = textDecoder.decode(bytes)
       } else if (paramType === PARAM_MOQT_IMPLEMENTATION) {
@@ -209,7 +212,7 @@ function decodeSetupParams(reader: BufferReader): Draft14Params {
 function encodeMessageParams(params: Draft14Params, writer: BufferWriter): void {
   let count = 0
   if (params.delivery_timeout !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.max_cache_duration !== undefined) count++
   if (params.unknown) count += params.unknown.length
 
@@ -219,9 +222,9 @@ function encodeMessageParams(params: Draft14Params, writer: BufferWriter): void
     writer.writeVarInt(PARAM_DELIVERY_TIMEOUT)
     writer.writeVarInt(params.delivery_timeout)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     writer.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
-    const tok = params.authorization_token
+    const tok = token
     const tmpWriter = new BufferWriter(64)
     tmpWriter.writeVarInt(tok.alias_type)
     if (tok.token_type !== undefined) {
@@ -290,7 +293,10 @@ function decodeMessageParams(reader: BufferReader): Draft14Params {
             tok.token_value = new Uint8Array(tokenValue)
           }
         }
-        result.authorization_token = tok as unknown as AuthorizationToken
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          tok as unknown as AuthorizationToken,
+        ]
       } else {
         unknown.push({
           id: `0x${paramType.toString(16)}`,

package/src/drafts/draft14/types.ts

@@ -47,7 +47,7 @@ export interface Draft14Params {
   moqt_implementation?: string // 0x07 odd, length-prefixed UTF-8
   // Message parameters (SUBSCRIBE, PUBLISH, etc.)
   delivery_timeout?: bigint
-  authorization_token?: AuthorizationToken
+  authorization_token?: readonly AuthorizationToken[]
   max_cache_duration?: bigint
   // Unknown / extension
   unknown?: UnknownParam[]

package/src/drafts/draft15/codec.ts

@@ -63,7 +63,7 @@ function encodeSetupParams(params: Draft15SetupParams, writer: BufferWriter): vo
   let count = 0
   if (params.path !== undefined) count++
   if (params.max_request_id !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.max_auth_token_cache_size !== undefined) count++
   if (params.authority !== undefined) count++
   if (params.moqt_implementation !== undefined) count++
@@ -86,10 +86,10 @@ function encodeSetupParams(params: Draft15SetupParams, writer: BufferWriter): vo
   }
 
   // AUTHORIZATION_TOKEN (0x03) - odd, length-prefixed with nested structure
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     writer.writeVarInt(SETUP_PARAM_AUTHORIZATION_TOKEN)
     const tmpW = new BufferWriter(64)
-    encodeAuthorizationToken(params.authorization_token, tmpW)
+    encodeAuthorizationToken(token, tmpW)
     const raw = tmpW.finish()
     writer.writeVarInt(raw.byteLength)
     writer.writeBytes(raw)
@@ -170,7 +170,10 @@ function decodeSetupParams(reader: BufferReader): Draft15SetupParams {
       if (paramType === SETUP_PARAM_PATH) {
         result.path = textDecoder.decode(bytes)
       } else if (paramType === SETUP_PARAM_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(new BufferReader(bytes))
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          decodeAuthorizationToken(new BufferReader(bytes)),
+        ]
       } else if (paramType === SETUP_PARAM_AUTHORITY) {
         result.authority = textDecoder.decode(bytes)
       } else if (paramType === SETUP_PARAM_MOQT_IMPLEMENTATION) {
@@ -242,7 +245,7 @@ function encodeParams(params: Draft15Params, writer: BufferWriter): void {
   // Count known + unknown params
   let count = params.unknown ? params.unknown.length : 0
   if (params.delivery_timeout !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.max_cache_duration !== undefined) count++
   if (params.expires !== undefined) count++
   if (params.largest_object !== undefined) count++
@@ -260,10 +263,10 @@ function encodeParams(params: Draft15Params, writer: BufferWriter): void {
     writer.writeVarInt(PARAM_DELIVERY_TIMEOUT)
     writer.writeVarInt(params.delivery_timeout)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     writer.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
     const tmpW = new BufferWriter(64)
-    encodeAuthorizationToken(params.authorization_token, tmpW)
+    encodeAuthorizationToken(token, tmpW)
     const raw = tmpW.finish()
     writer.writeVarInt(raw.byteLength)
     writer.writeBytes(raw)
@@ -358,7 +361,10 @@ function decodeParams(reader: BufferReader): Draft15Params {
     } else if (paramType === PARAM_AUTHORIZATION_TOKEN) {
       const length = Number(reader.readVarInt())
       const tokenBytes = reader.readBytes(length)
-      result.authorization_token = decodeAuthorizationToken(new BufferReader(tokenBytes))
+      result.authorization_token = [
+        ...(result.authorization_token ?? []),
+        decodeAuthorizationToken(new BufferReader(tokenBytes)),
+      ]
     } else if (paramType === PARAM_MAX_CACHE_DURATION) {
       result.max_cache_duration = reader.readVarInt()
     } else if (paramType === PARAM_EXPIRES) {

package/src/drafts/draft15/types.ts

@@ -20,7 +20,7 @@ export interface AuthorizationToken {
 export interface Draft15SetupParams {
   path?: string // 0x01 odd
   max_request_id?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd (length-prefixed, nested)
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd (length-prefixed, nested)
   max_auth_token_cache_size?: bigint // 0x04 even
   authority?: string // 0x05 odd
   moqt_implementation?: string // 0x07 odd
@@ -44,7 +44,7 @@ export interface LargestObject {
 // Version-specific parameters (well-known + unknown)
 export interface Draft15Params {
   delivery_timeout?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd (length-prefixed, nested)
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd (length-prefixed, nested)
   max_cache_duration?: bigint // 0x04 even
   expires?: bigint // 0x08 even
   largest_object?: LargestObject // 0x09 odd (length-prefixed)

package/src/drafts/draft16/codec.ts

@@ -65,7 +65,7 @@ function encodeSetupParams(params: Draft16SetupParams, writer: BufferWriter): vo
   let count = 0
   if (params.path !== undefined) count++
   if (params.max_request_id !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.max_auth_token_cache_size !== undefined) count++
   if (params.authority !== undefined) count++
   if (params.moqt_implementation !== undefined) count++
@@ -88,10 +88,10 @@ function encodeSetupParams(params: Draft16SetupParams, writer: BufferWriter): vo
   }
 
   // AUTHORIZATION_TOKEN (0x03) - odd, length-prefixed with nested structure
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     writer.writeVarInt(SETUP_PARAM_AUTHORIZATION_TOKEN)
     const tmpW = new BufferWriter(64)
-    encodeAuthorizationToken(params.authorization_token, tmpW)
+    encodeAuthorizationToken(token, tmpW)
     const raw = tmpW.finish()
     writer.writeVarInt(raw.byteLength)
     writer.writeBytes(raw)
@@ -168,7 +168,10 @@ function decodeSetupParams(reader: BufferReader): Draft16SetupParams {
       if (paramType === SETUP_PARAM_PATH) {
         result.path = textDecoder.decode(bytes)
       } else if (paramType === SETUP_PARAM_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(new BufferReader(bytes))
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          decodeAuthorizationToken(new BufferReader(bytes)),
+        ]
       } else if (paramType === SETUP_PARAM_AUTHORITY) {
         result.authority = textDecoder.decode(bytes)
       } else if (paramType === SETUP_PARAM_MOQT_IMPLEMENTATION) {
@@ -324,12 +327,12 @@ function encodeParams(params: Draft16Params, writer: BufferWriter): void {
       encode: (w) => w.writeVarInt(params.delivery_timeout!),
     })
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     entries.push({
       type: PARAM_AUTHORIZATION_TOKEN,
       encode: (w) => {
         const tmpW = new BufferWriter(64)
-        encodeAuthorizationToken(params.authorization_token!, tmpW)
+        encodeAuthorizationToken(token, tmpW)
         const raw = tmpW.finish()
         w.writeVarInt(raw.byteLength)
         w.writeBytes(raw)
@@ -457,7 +460,10 @@ function decodeParams(reader: BufferReader): Draft16Params {
     } else if (paramType === PARAM_AUTHORIZATION_TOKEN) {
       const length = Number(reader.readVarInt())
       const tokenBytes = reader.readBytes(length)
-      result.authorization_token = decodeAuthorizationToken(new BufferReader(tokenBytes))
+      result.authorization_token = [
+        ...(result.authorization_token ?? []),
+        decodeAuthorizationToken(new BufferReader(tokenBytes)),
+      ]
     } else if (paramType === PARAM_MAX_CACHE_DURATION) {
       result.max_cache_duration = reader.readVarInt()
     } else if (paramType === PARAM_EXPIRES) {

package/src/drafts/draft16/types.ts

@@ -20,7 +20,7 @@ export interface AuthorizationToken {
 export interface Draft16SetupParams {
   path?: string // 0x01 odd
   max_request_id?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   max_auth_token_cache_size?: bigint // 0x04 even
   authority?: string // 0x05 odd
   moqt_implementation?: string // 0x07 odd
@@ -52,7 +52,7 @@ export interface Draft16TrackExtensions {
 // Version-specific parameters (well-known + unknown)
 export interface Draft16Params {
   delivery_timeout?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   max_cache_duration?: bigint // 0x04 even
   expires?: bigint // 0x08 even
   largest_object?: LargestObject // 0x09 odd (length-prefixed)

package/src/drafts/draft17/codec.ts

@@ -68,12 +68,12 @@ function encodeSetupOptions(opts: Draft17SetupOptions, writer: BufferWriter): vo
       },
     })
   }
-  if (opts.authorization_token !== undefined) {
+  for (const token of opts.authorization_token ?? []) {
     entries.push({
       type: SETUP_OPT_AUTHORIZATION_TOKEN,
       encode: (w) => {
         const tmpW = new BufferWriter(64)
-        encodeAuthorizationToken(opts.authorization_token!, tmpW)
+        encodeAuthorizationToken(token, tmpW)
         const raw = tmpW.finish()
         w.writeVarInt(BigInt(raw.byteLength))
         w.writeBytes(raw)
@@ -168,7 +168,10 @@ function decodeSetupOptions(reader: BufferReader, payloadEnd: number): Draft17Se
       if (optType === SETUP_OPT_PATH) {
         result.path = textDecoder.decode(bytes)
       } else if (optType === SETUP_OPT_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(new BufferReader(bytes))
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          decodeAuthorizationToken(new BufferReader(bytes)),
+        ]
       } else if (optType === SETUP_OPT_AUTHORITY) {
         result.authority = textDecoder.decode(bytes)
       } else if (optType === SETUP_OPT_MOQT_IMPLEMENTATION) {
@@ -283,12 +286,12 @@ function encodeParams(params: Draft17Params, writer: BufferWriter): void {
       encode: (w) => w.writeVarInt(params.delivery_timeout!),
     })
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     entries.push({
       type: PARAM_AUTHORIZATION_TOKEN,
       encode: (w) => {
         const tmpW = new BufferWriter(64)
-        encodeAuthorizationToken(params.authorization_token!, tmpW)
+        encodeAuthorizationToken(token, tmpW)
         const raw = tmpW.finish()
         w.writeVarInt(BigInt(raw.byteLength))
         w.writeBytes(raw)
@@ -411,7 +414,10 @@ function decodeParams(reader: BufferReader, messageType: string): Draft17Params
     } else if (paramType === PARAM_AUTHORIZATION_TOKEN) {
       const length = Number(reader.readVarInt())
       const bytes = reader.readBytes(length)
-      result.authorization_token = decodeAuthorizationToken(new BufferReader(bytes))
+      result.authorization_token = [
+        ...(result.authorization_token ?? []),
+        decodeAuthorizationToken(new BufferReader(bytes)),
+      ]
     } else if (paramType === PARAM_RENDEZVOUS_TIMEOUT) {
       result.rendezvous_timeout = reader.readVarInt()
     } else if (paramType === PARAM_EXPIRES) {

package/src/drafts/draft17/types.ts

@@ -18,7 +18,7 @@ export interface AuthorizationToken {
 // Setup options (KVP encoding, no count prefix)
 export interface Draft17SetupOptions {
   path?: string // 0x01 odd
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   max_auth_token_cache_size?: bigint // 0x04 even
   authority?: string // 0x05 odd
   moqt_implementation?: string // 0x07 odd
@@ -42,7 +42,7 @@ export interface LargestObject {
 // Version-specific parameters (delta-encoded types, count-prefixed)
 export interface Draft17Params {
   delivery_timeout?: bigint // 0x02 varint
-  authorization_token?: AuthorizationToken // 0x03 length-prefixed nested
+  authorization_token?: readonly AuthorizationToken[] // 0x03 length-prefixed nested
   rendezvous_timeout?: bigint // 0x04 varint
   expires?: bigint // 0x08 varint
   largest_object?: LargestObject // 0x09 Location (2 bare varints)

package/src/drafts/draft18/codec.ts

@@ -71,12 +71,12 @@ function encodeSetupOptions(opts: Draft18SetupOptions, writer: BufferWriter): vo
       },
     })
   }
-  if (opts.authorization_token !== undefined) {
+  for (const token of opts.authorization_token ?? []) {
     entries.push({
       type: SETUP_OPT_AUTHORIZATION_TOKEN,
       encode: (w) => {
         const tmpW = new BufferWriter(64)
-        encodeAuthorizationToken(opts.authorization_token!, tmpW)
+        encodeAuthorizationToken(token, tmpW)
         const raw = tmpW.finish()
         w.writeVarInt(BigInt(raw.byteLength))
         w.writeBytes(raw)
@@ -171,7 +171,10 @@ function decodeSetupOptions(reader: BufferReader, payloadEnd: number): Draft18Se
       if (optType === SETUP_OPT_PATH) {
         result.path = textDecoder.decode(bytes)
       } else if (optType === SETUP_OPT_AUTHORIZATION_TOKEN) {
-        result.authorization_token = decodeAuthorizationToken(new BufferReader(bytes))
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          decodeAuthorizationToken(new BufferReader(bytes)),
+        ]
       } else if (optType === SETUP_OPT_AUTHORITY) {
         result.authority = textDecoder.decode(bytes)
       } else if (optType === SETUP_OPT_MOQT_IMPLEMENTATION) {
@@ -315,12 +318,12 @@ function encodeParams(params: Draft18Params, writer: BufferWriter): void {
       encode: (w) => w.writeVarInt(params.object_delivery_timeout!),
     })
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     entries.push({
       type: PARAM_AUTHORIZATION_TOKEN,
       encode: (w) => {
         const tmpW = new BufferWriter(64)
-        encodeAuthorizationToken(params.authorization_token!, tmpW)
+        encodeAuthorizationToken(token, tmpW)
         const raw = tmpW.finish()
         w.writeVarInt(BigInt(raw.byteLength))
         w.writeBytes(raw)
@@ -469,7 +472,10 @@ function decodeParams(reader: BufferReader, messageType: string): Draft18Params
     } else if (paramType === PARAM_AUTHORIZATION_TOKEN) {
       const length = Number(reader.readVarInt())
       const bytes = reader.readBytes(length)
-      result.authorization_token = decodeAuthorizationToken(new BufferReader(bytes))
+      result.authorization_token = [
+        ...(result.authorization_token ?? []),
+        decodeAuthorizationToken(new BufferReader(bytes)),
+      ]
     } else if (paramType === PARAM_RENDEZVOUS_TIMEOUT) {
       result.rendezvous_timeout = reader.readVarInt()
     } else if (paramType === PARAM_SUBGROUP_DELIVERY_TIMEOUT) {

package/src/drafts/draft18/types.ts

@@ -18,7 +18,7 @@ export interface AuthorizationToken {
 // Setup options (KVP encoding, no count prefix)
 export interface Draft18SetupOptions {
   path?: string // 0x01 odd
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   max_auth_token_cache_size?: bigint // 0x04 even
   authority?: string // 0x05 odd
   moqt_implementation?: string // 0x07 odd
@@ -42,7 +42,7 @@ export interface LargestObject {
 // Version-specific parameters (delta-encoded types, count-prefixed)
 export interface Draft18Params {
   object_delivery_timeout?: bigint // 0x02 varint (renamed from delivery_timeout in draft-17)
-  authorization_token?: AuthorizationToken // 0x03 length-prefixed nested
+  authorization_token?: readonly AuthorizationToken[] // 0x03 length-prefixed nested
   rendezvous_timeout?: bigint // 0x04 varint
   subgroup_delivery_timeout?: bigint // 0x06 varint (NEW in draft-18)
   expires?: bigint // 0x08 varint