senml 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ef841f3fb72ceb0281f1d3436b14f35e9962ffa9561b2491f946740816f755b
-  data.tar.gz: e2af948829e3b3a4a64691f5f2cf0f9d4d5fa824be914bc87520291f212b732d
+  metadata.gz: be83f76fe8b28e2cf2f65dc7962438cb1d6b47404d4113e2515269340b721979
+  data.tar.gz: c6c5adbff865d71650f66d48006a2c6c260ee5ec5a787b55849d0f3d57a508eb
 SHA512:
-  metadata.gz: fe3bd198b38e2c030089840be2a1c8b5550c69942c93fc9be4594e17605ed67c7e47465c7dcb42e44a9e4f0c6d718cb8944a639438e96c57dec786a7213b282f
-  data.tar.gz: d1e18dc6e68b9c7aa704df707b954a5018af81e635784a0034cf3b6d464eef548e8a3c692bd3403203c53d3fd45c00cb13b5aba83f7d2e9b42508e2802c0469b
+  metadata.gz: d7102b0ef6fe437b595f777edd5c79639df2c273d679f9c0951eda498a93c1bb2cc85275ab4098375213bbcb9f94345e2ecf82fb3f92749d4cf2f067a731e4fa
+  data.tar.gz: 64c42ba085c82b2b969d1cfd425c539a40e0cdcbb8dc6b8b9b39b2d1cde420915af4a1b32b56d14685e3178e7753b3ff1d3824b90c89c8adbc275b9b482081e0

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.0 - 2026-10-12
+
+- Support CBOR on CRuby, JRuby, and TruffleRuby with a built-in Ruby codec; the separate `cbor` gem is no longer required.
+
 ## 0.1.0 - 2026-10-12
 
 Initial release.

data/README.md

@@ -1,16 +1,14 @@
 # SenML
 
-Read, validate, write, and resolve [RFC 8428](https://www.rfc-editor.org/rfc/rfc8428) sensor measurements in Ruby. Supports SenML JSON, incremental SenSML JSON, record fragments, and optional CBOR.
+Read, validate, write, and resolve [RFC 8428](https://www.rfc-editor.org/rfc/rfc8428) sensor measurements in Ruby. Supports SenML JSON, incremental SenSML JSON, record fragments, and CBOR.
 
 ## Installation
 
 ```ruby
 gem "senml"
-# Optional on CRuby 3.3–4.0 and TruffleRuby:
-gem "cbor", "~> 0.5"
 ```
 
-Requires Ruby 3.3 or later and JSON 2.19.4 or later, below version 4. JSON works on CRuby, JRuby, and TruffleRuby. The optional `cbor` native extension is tested on CRuby 3.3–4.0 and TruffleRuby; JRuby and Ruby 4.1 development builds run JSON features only. There are no dependencies on other measurement or JSON-format gems.
+Requires Ruby 3.3 or later and JSON 2.19.4 or later, below version 4. JSON and the built-in Ruby CBOR codec work on CRuby, JRuby, and TruffleRuby, including CRuby development builds. There are no dependencies on other measurement or JSON-format gems.
 
 ## Read and resolve
 
@@ -66,7 +64,7 @@ All APIs that construct packs or readers accept these positive integer limits:
 
 Native array construction and CBOR decoding also check the cumulative JSON representation size against `max_bytes`; the decoded representation may be larger than its CBOR input. Streams use record limits instead of a total byte limit. Exceeding `max_warnings` raises `LimitError` before yielding the next record; `reader.warnings` retains the diagnostics collected so far. Resolution checks `max_bytes` incrementally as base fields expand, before retaining an oversized resolved pack. Binary size is checked before decoding. `SenML::ParseError` reports malformed input or field types, `ValidationError` reports semantic problems with a `pointer`, `UnsupportedVersionError` identifies unknown versions, and `LimitError` reports exceeded bounds. A conversion that cannot preserve supported semantics raises `ConversionError`.
 
-## Optional CBOR
+## CBOR
 
 ```ruby
 require "senml/cbor"
@@ -76,7 +74,7 @@ SenML.parse_cbor(bytes)
 SenML.parse_cbor(stream_bytes, streaming: true)
 ```
 
-CBOR maps the RFC's integer labels and binary data values, preserves JSON-compatible extension fields, and supports decimal-fraction tag 4 with exponents from -400 to 400. A preflight scan checks lengths, nesting, duplicate map keys, and allowed types before the native decoder runs. Unknown integer labels, non-JSON binary extension values, other tags, indefinite strings, and lossy conversion of large integers fail explicitly. JSON nonintegral values use Float; conversion of arbitrary decimal fractions can round to binary64.
+CBOR maps the RFC's integer labels and binary data values, preserves JSON-compatible extension fields, and supports decimal-fraction tag 4 with exponents from -400 to 400. The decoder checks lengths, nesting, UTF-8, duplicate map keys, and allowed types while reading. No separate CBOR gem is required. Unknown integer labels, non-JSON binary extension values, other tags, indefinite strings, and lossy conversion of large integers fail explicitly. JSON nonintegral values use Float; conversion of arbitrary decimal fractions can round to binary64.
 
 ## Scope and reference data
 
@@ -84,14 +82,14 @@ CBOR maps the RFC's integer labels and binary data values, preserves JSON-compat
 | --- | --- |
 | SenML and incremental SenSML JSON | XML and EXI |
 | Base resolution and record fragments | Unit conversion and CoAP transport |
-| Optional CBOR on the runtimes listed above | Incremental CBOR decoding |
+| CBOR on the runtimes listed above | Incremental CBOR decoding |
 | RFC 8428 version rules and registered labels | FETCH/PATCH and RFC 9100 feature versions |
 
-The implementation supports RFC 8428 sections 4–6 and 9: SenML/SenSML JSON, base resolution, optional CBOR, and record fragments. It recognizes the IANA unit identifiers and registered labels checked on 2026-10-11, including `vlo` and the `ct`/`bct` labels from [RFC 9193](https://www.rfc-editor.org/rfc/rfc9193). Content-format strings are preserved opaquely, and `bct` resolves onto binary measurements. Unknown base labels stop resolution and fragment selection because their inheritance rules are unknown, including when resolving a later record that inherits the unsupported base.
+The implementation supports RFC 8428 sections 4–6 and 9: SenML/SenSML JSON, base resolution, CBOR, and record fragments. It recognizes the IANA unit identifiers and registered labels checked on 2026-10-11, including `vlo` and the `ct`/`bct` labels from [RFC 9193](https://www.rfc-editor.org/rfc/rfc9193). Content-format strings are preserved opaquely, and `bct` resolves onto binary measurements. Unknown base labels stop resolution and fragment selection because their inheritance rules are unknown, including when resolving a later record that inherits the unsupported base.
 
 XML, EXI, unit conversion, CoAP transport, FETCH/PATCH variants, and feature-version negotiation from RFC 9100 are outside this release. The library makes no network requests when parsing or resolving measurements.
 
-Only independently authored identifier/type metadata is shipped in `data/`. RFC text, examples, grammars, IANA source files, and external implementation code are never committed or packaged. Development scripts fetch checksum-pinned references into ignored `tmp/` directories, retain notices, and extract test fixtures there. See [IANA terms](https://www.iana.org/help/licensing-terms), [IETF terms](https://trustee.ietf.org/license-info), and `script/sources.json` for sources and checksums.
+The identifier/type metadata in `data/` records the supported protocol fields. RFC text, examples, grammars, IANA source files, and external implementation code are never committed or packaged. Development scripts fetch checksum-pinned references into ignored `tmp/` directories, retain notices, and extract test fixtures there. See [IANA terms](https://www.iana.org/help/licensing-terms), [IETF terms](https://trustee.ietf.org/license-info), and `script/sources.json` for sources and checksums.
 
 The RFC's explicitly unfinished section 5.1.2 stream is closed after its final complete measurement for whole-pack tests. The first section 5.1.7 thermostat example starts with a base-only record, conflicting with section 4.2's value-or-sum requirement; strict parsing rejects the original, and its base name is moved into the first measurement for the roundtrip fixture. Original excerpts and corrections remain together in ignored fixture storage. [Erratum 6728](https://www.rfc-editor.org/errata/eid6728), held for document update, concerns an XML/CDDL comma and does not change the supported encodings.
 
@@ -101,14 +99,12 @@ The RFC's explicitly unfinished section 5.1.2 stream is closed after its final c
 bundle install
 bundle exec rake test
 COVERAGE=1 bundle exec rake test
-bundle exec rubocop
 bundle exec rbs -I sig validate
-bundle exec ruby script/interop.rb  # Go and unzip required
 bundle exec ruby script/benchmark.rb
 ```
 
-Tests cover all 14 RFC JSON examples, the full CBOR hex example, all five fragment examples, MUST violations, malformed and random CBOR, random numeric roundtrips, and a generated 100,000-record stream. CI compares normalization with pinned `farshidtz/senml` v2.0.0 (MIT), retaining its license in temporary storage. The IANA checker fails on unexpected registry changes; review updated sources and checksums before running `bundle exec ruby script/update_registry.rb --write`.
+Tests cover all 14 RFC JSON examples, the full CBOR hex example, all five fragment examples, MUST violations, malformed and random CBOR, random numeric roundtrips, and a generated 100,000-record stream. Normalization tests use original examples with explicit expected measurements; CBOR tests run on every supported Ruby engine without external codec or language tools. The IANA checker fails on unexpected registry changes; review updated sources and checksums before running `bundle exec ruby script/update_registry.rb --write`.
 
 ## License
 
-MIT. See [LICENSE.txt](LICENSE.txt).
+Project code is MIT licensed; see [LICENSE.txt](LICENSE.txt). Added library dependencies are limited to MIT-licensed libraries. Ruby implementations and standard/default libraries (including JSON) are exceptions and retain their own licenses. Downloaded standards material is test reference data under its source terms and is neither committed nor packaged. These statements do not relicense third-party material.

data/SECURITY.md

@@ -2,7 +2,7 @@
 
 Report vulnerabilities privately through [GitHub security advisories](https://github.com/ydah/senml/security/advisories/new).
 
-Parsing does not perform network requests or execute measurement content. Inputs have configurable byte, record, depth, and binary-data limits. Streaming applies per-record limits before retaining further bytes. CBOR is optional and uses a native extension after a bounded structural preflight scan; keep that dependency up to date.
+Parsing does not perform network requests or execute measurement content. Inputs have configurable byte, record, depth, and binary-data limits. Streaming applies per-record limits before retaining further bytes. The built-in Ruby CBOR decoder checks structural limits while reading, rejects duplicate map keys, and never evaluates tags as application code.
 
 Unknown critical labels and unsupported or mixed format versions fail even in lenient mode. Noncritical extension data is retained without interpretation. Applications must decide which sensor names, units, content formats, values, and timestamps they trust. Conversion and resolution do not authenticate measurements.
 

data/lib/senml/binary_cbor.rb

@@ -0,0 +1,285 @@
+# frozen_string_literal: true
+
+module SenML
+  # Internal wire codec. RFC 8949 sections 3.1–3.4 define the byte format;
+  # application-specific tag meanings belong to the caller.
+  module BinaryCBOR
+    class Error < StandardError; end
+    class LimitError < Error; end
+    class UnsupportedError < Error; end
+    Tagged = Struct.new(:tag, :value)
+    Simple = Struct.new(:value)
+    Float32 = Struct.new(:value)
+
+    def self.decode(bytes, **options)
+      Decoder.new(bytes, **options).read
+    end
+
+    def self.encode(value, **options)
+      Encoder.new(**options).write(value)
+    end
+
+    class Decoder
+      DEFAULTS = { max_input_size: 16_777_216, max_depth: 32, max_nodes: 1_000_000, max_collection_size: 200_000,
+                   max_string_size: 16_777_216, max_binary_size: 16_777_216, allowed_tags: nil, allow_indefinite_strings: true,
+                   max_records: nil, max_record_bytes: nil }.freeze
+
+      def initialize(bytes, **options)
+        @limits = DEFAULTS.merge(options)
+        raise Error, "CBOR input must be a String" unless bytes.is_a?(String)
+        raise LimitError, "CBOR exceeds max_input_size" if bytes.bytesize > @limits[:max_input_size]
+
+        @bytes = bytes
+        @offset = 0
+        @nodes = 0
+      end
+
+      def read
+        value = read_value(0)
+        raise Error, "trailing CBOR input" unless @offset == @bytes.bytesize
+
+        value
+      end
+
+      private
+
+      def take(size)
+        raise Error, "truncated CBOR input" if size > @bytes.bytesize - @offset
+        if @record_start && @limits[:max_record_bytes] && @offset + size - @record_start > @limits[:max_record_bytes]
+          raise LimitError, "CBOR record exceeds max_record_bytes"
+        end
+
+        result = @bytes.byteslice(@offset, size)
+        @offset += size
+        result
+      end
+
+      def argument(info)
+        return info if info < 24
+        return nil if info == 31
+
+        format = { 24 => [1, "C"], 25 => [2, "n"], 26 => [4, "N"], 27 => [8, "Q>"] }[info]
+        raise Error, "reserved CBOR additional information" unless format
+
+        take(format[0]).unpack1(format[1])
+      end
+
+      def read_value(depth)
+        @nodes += 1
+        raise LimitError, "CBOR exceeds max_nodes" if @nodes > @limits[:max_nodes]
+        raise LimitError, "CBOR exceeds max_depth" if depth > @limits[:max_depth]
+
+        initial = take(1).getbyte(0)
+        major, info = initial.divmod(32)
+        return read_simple(info) if major == 7
+
+        size = argument(info)
+        raise Error, "indefinite CBOR integer or tag" if size.nil? && [0, 1, 6].include?(major)
+
+        case major
+        when 0 then size
+        when 1 then -1 - size
+        when 2, 3 then read_string(major, size, depth)
+        when 4, 5 then read_collection(major, size, depth)
+        when 6
+          raise UnsupportedError, "unsupported CBOR tag" if @limits[:allowed_tags] && !@limits[:allowed_tags].include?(size)
+
+          Tagged.new(size, read_value(depth + 1))
+        end
+      end
+
+      def read_string(major, size, depth)
+        limit = @limits[:max_string_size]
+        limit = [limit, @limits[:max_binary_size]].min if major == 2
+        if size
+          raise LimitError, "CBOR string exceeds #{major == 2 ? "max_binary_size" : "max_string_size"}" if size > limit
+
+          value = take(size).dup
+          value.force_encoding(major == 2 ? Encoding::BINARY : Encoding::UTF_8)
+          raise Error, "invalid CBOR UTF-8 text" unless value.valid_encoding?
+
+          return value
+        end
+        raise Error, "CBOR strings must have definite length" unless @limits[:allow_indefinite_strings]
+
+        result = String.new(encoding: major == 2 ? Encoding::BINARY : Encoding::UTF_8)
+        until @bytes.getbyte(@offset) == 255
+          initial = @bytes.getbyte(@offset)
+          raise Error, "invalid indefinite CBOR string chunk" unless initial && initial.div(32) == major && (initial & 31) < 28
+
+          chunk = read_value(depth + 1)
+          raise LimitError, "CBOR string exceeds byte limit" if result.bytesize + chunk.bytesize > limit
+
+          result << chunk
+        end
+        take(1)
+        result
+      end
+
+      def read_collection(major, size, depth)
+        limit = @limits[:max_collection_size]
+        limit = [limit, @limits[:max_records]].min if depth.zero? && @limits[:max_records]
+        raise LimitError, "CBOR exceeds collection limit" if size && size > limit
+
+        result = major == 4 ? [] : {}
+        count = 0
+        until size ? count == size : @bytes.getbyte(@offset) == 255
+          raise LimitError, "CBOR exceeds collection limit" if count >= limit
+
+          @record_start = @offset if depth.zero? && @limits[:max_record_bytes]
+          if major == 4
+            result << read_value(depth + 1)
+          else
+            key = read_value(depth + 1)
+            unless key.is_a?(Integer) || (key.is_a?(String) && key.encoding == Encoding::UTF_8)
+              raise UnsupportedError, "CBOR map keys must be text or integers"
+            end
+            raise Error, "duplicate CBOR map key" if result.key?(key)
+
+            result[key] = read_value(depth + 1)
+          end
+          @record_start = nil if depth.zero?
+          count += 1
+        end
+        take(1) unless size
+        result
+      end
+
+      def read_simple(info)
+        case info
+        when 20 then false
+        when 21 then true
+        when 22 then nil
+        when 0..19, 23 then Simple.new(info)
+        when 24
+          value = take(1).getbyte(0)
+          raise Error, "reserved CBOR simple value" if value < 32
+
+          Simple.new(value)
+        when 25 then half(take(2).unpack1("n"))
+        when 26 then take(4).unpack1("g")
+        when 27 then take(8).unpack1("G")
+        else raise Error, "reserved CBOR value or unexpected break"
+        end
+      end
+
+      def half(bits)
+        exponent = (bits >> 10) & 31
+        fraction = bits & 1023
+        magnitude = if exponent == 31
+                      fraction.zero? ? Float::INFINITY : Float::NAN
+                    elsif exponent.zero?
+                      Math.ldexp(fraction.to_f, -24)
+                    else
+                      Math.ldexp((1024 + fraction).to_f, exponent - 25)
+                    end
+        bits[15].zero? ? magnitude : -magnitude
+      end
+    end
+
+    class Encoder
+      def initialize(max_output_size: 16_777_216, max_depth: 128)
+        @max_output_size = max_output_size
+        @max_depth = max_depth
+        @buffer = String.new(encoding: Encoding::BINARY)
+      end
+
+      def write(value)
+        append_value(value, 0)
+        @buffer
+      end
+
+      private
+
+      def append(bytes)
+        raise LimitError, "CBOR output exceeds max_input_size" if @buffer.bytesize + bytes.bytesize > @max_output_size
+
+        @buffer << bytes.b
+      end
+
+      def header(major, number)
+        raise Error, "CBOR argument outside unsigned 64-bit range" unless number.is_a?(Integer) && number.between?(0, (2**64) - 1)
+
+        case number
+        when 0...24 then append([(major << 5) | number].pack("C"))
+        when 24..255 then append([(major << 5) | 24, number].pack("CC"))
+        when 256..65_535 then append([(major << 5) | 25, number].pack("Cn"))
+        when 65_536..4_294_967_295 then append([(major << 5) | 26, number].pack("CN"))
+        else append([(major << 5) | 27, number].pack("CQ>"))
+        end
+      end
+
+      def append_value(value, depth)
+        raise LimitError, "CBOR output exceeds max_depth" if depth > @max_depth
+
+        case value
+        when Integer then append_integer(value)
+        when Float then append_float(value)
+        when Float32 then append("\xfa".b + [value.value].pack("g"))
+        when String then append_string(value)
+        when Array
+          header(4, value.length)
+          value.each { |item| append_value(item, depth + 1) }
+        when Hash
+          header(5, value.length)
+          value.each { |key, item| append_value(key, depth + 1); append_value(item, depth + 1) }
+        when Tagged
+          header(6, value.tag)
+          append_value(value.value, depth + 1)
+        when Simple
+          raise Error, "invalid CBOR simple value" unless value.value.is_a?(Integer) && (value.value.between?(0, 23) || value.value.between?(32, 255))
+
+          header(7, value.value)
+        when TrueClass then append("\xf5".b)
+        when FalseClass then append("\xf4".b)
+        when NilClass then append("\xf6".b)
+        else raise Error, "unsupported CBOR value type"
+        end
+      end
+
+      def append_integer(value)
+        magnitude = value.negative? ? -1 - value : value
+        return header(value.negative? ? 1 : 0, magnitude) if magnitude < 2**64
+
+        header(6, value.negative? ? 3 : 2)
+        hex = magnitude.to_s(16)
+        hex = "0#{hex}" if hex.length.odd?
+        append_string([hex].pack("H*"))
+      end
+
+      def append_float(value)
+        half = half_bits(value)
+        return append("\xf9".b + [half].pack("n")) if half
+
+        single = [value].pack("g")
+        append(single.unpack1("g") == value ? "\xfa".b + single : "\xfb".b + [value].pack("G"))
+      end
+
+      def half_bits(value)
+        return 0x7e00 if value.nan?
+
+        sign = value.negative? || (value.zero? && (1.0 / value).negative?) ? 0x8000 : 0
+        return sign | 0x7c00 if value.infinite?
+        return sign if value.zero?
+
+        significand, exponent = Math.frexp(value.abs)
+        if exponent < -13
+          fraction = Math.ldexp(value.abs, 24)
+          return sign | fraction.to_i if fraction == fraction.to_i
+        elsif exponent <= 16
+          fraction = significand * 2048 - 1024
+          return sign | ((exponent + 14) << 10) | fraction.to_i if fraction == fraction.to_i
+        end
+        nil
+      end
+
+      def append_string(value)
+        binary = value.encoding == Encoding::BINARY
+        raise Error, "invalid CBOR UTF-8 text" unless binary || (value.valid_encoding? && (value.encoding == Encoding::UTF_8 || value.ascii_only?))
+
+        header(binary ? 2 : 3, value.bytesize)
+        append(value)
+      end
+    end
+  end
+end

data/lib/senml/cbor.rb

@@ -1,96 +1,18 @@
 # frozen_string_literal: true
 
 require_relative "../senml"
-require "cbor"
+require_relative "binary_cbor"
 module SenML
   module CBORCodec
     KEYS = LABELS.to_h { |label, spec| [spec.fetch("cbor", label), label] }.freeze
-    # Bound nesting and allocations, and reject duplicate keys before the native decoder loses them.
-    class Guard
-      def initialize(bytes, limits, streaming)
-        @bytes = bytes
-        @limits = limits
-        @streaming = streaming
-        @offset = 0
-      end
-
-      def check
-        raise ParseError, "CBOR pack must be an array" unless @bytes.getbyte(0)&.div(32) == 4
-        raise ParseError, "SenML CBOR requires a definite-length array" if @bytes.getbyte(0) == 159 && !@streaming
-
-        scan(0)
-        raise ParseError, "trailing CBOR data" unless @offset == @bytes.bytesize
-      end
-
-      private
-
-      def take(size)
-        raise ParseError, "truncated CBOR" if size > @bytes.bytesize - @offset
-
-        result = @bytes.byteslice(@offset, size)
-        @offset += size
-        result
-      end
-
-      def scan(depth)
-        raise LimitError, "CBOR exceeds max_depth" if depth > @limits[:max_depth]
-
-        initial = take(1).getbyte(0)
-        major = initial >> 5
-        info = initial & 31
-        size = case info
-               when 0..23 then info
-               when 24 then take(1).unpack1("C")
-               when 25 then take(2).unpack1("n")
-               when 26 then take(4).unpack1("N")
-               when 27 then take(8).unpack1("Q>")
-               when 31 then nil
-               else raise ParseError, "reserved CBOR argument"
-               end
-        case major
-        when 0, 1 then raise ParseError, "indefinite CBOR integer" unless size
-        when 2, 3
-          raise ParseError, "CBOR strings must have definite length" unless size
-          raise LimitError, "CBOR string exceeds record bound" if size > @limits[:max_record_bytes]
-
-          take(size)
-        when 4, 5
-          raise LimitError, "CBOR container exceeds input size" if size && size > @bytes.bytesize
-          raise LimitError, "CBOR pack exceeds max_records" if depth.zero? && size && size > @limits[:max_records]
-
-          count = 0
-          keys = {}
-          until size ? count == size : @bytes.getbyte(@offset) == 255
-            start = @offset
-            if major == 5
-              kind = @bytes.getbyte(@offset)&.div(32)
-              raise ParseError, "CBOR map keys must be integers or text" unless [0, 1, 3].include?(kind)
-
-              scan(depth + 1)
-              key = CBOR.decode(@bytes.byteslice(start, @offset - start))
-              raise ParseError, "duplicate CBOR map key" if keys.key?(key)
-
-              keys[key] = true
-            end
-            scan(depth + 1)
-            count += 1
-            raise LimitError, "CBOR record exceeds max_record_bytes" if depth.zero? && @offset - start > @limits[:max_record_bytes]
-            raise LimitError, "CBOR pack exceeds max_records" if depth.zero? && count > @limits[:max_records]
-          end
-          take(1) unless size
-        when 6
-          raise ParseError, "unsupported CBOR tag" unless size == 4
-
-          scan(depth + 1)
-        when 7
-          raise ParseError, "unsupported CBOR simple value" unless [20, 21, 22, 25, 26, 27].include?(info)
-        end
-      end
-    end
-
     def self.decode(bytes, limits, streaming)
-      Guard.new(bytes, limits, streaming).check
-      raw = CBOR.decode(bytes)
+      raise ParseError, "CBOR pack must be an array" unless bytes.getbyte(0)&.div(32) == 4
+      raise ParseError, "SenML CBOR requires a definite-length array" if bytes.getbyte(0) == 159 && !streaming
+
+      raw = BinaryCBOR.decode(bytes, max_input_size: limits[:max_bytes], max_depth: limits[:max_depth], max_nodes: limits[:max_bytes],
+                             max_collection_size: limits[:max_bytes], max_string_size: limits[:max_record_bytes],
+                             max_binary_size: limits[:max_record_bytes], max_records: limits[:max_records],
+                             max_record_bytes: limits[:max_record_bytes], allowed_tags: [4], allow_indefinite_strings: false)
       raw.map do |record|
         raise ParseError, "CBOR record must be a map" unless record.is_a?(Hash)
 
@@ -114,19 +36,22 @@ module SenML
 
         mapped
       end
-    rescue CBOR::UnpackError => e
+    rescue BinaryCBOR::LimitError => e
+      raise LimitError, e.message
+    rescue BinaryCBOR::Error => e
       raise ParseError, e.message
     end
 
     def self.json_value(value)
       case value
-      when CBOR::Tagged
+      when BinaryCBOR::Tagged
         raise ParseError, "invalid decimal fraction" unless value.tag == 4 && value.value.is_a?(Array) && value.value.length == 2 && value.value.all?(Integer)
 
         exponent, mantissa = value.value
         raise ParseError, "decimal fraction exponent outside supported range" unless exponent.between?(-400, 400)
 
         (mantissa * (10.to_r**exponent)).to_f
+      when BinaryCBOR::Simple then raise ParseError, "unsupported CBOR simple value"
       when Hash then value.transform_values { |v| json_value(v) }
       when Array then value.map { |v| json_value(v) }
       when String
@@ -144,8 +69,10 @@ module SenML
           [LABELS.fetch(label, {}).fetch("cbor", label), value]
         end
       end
-      CBOR.encode(values)
-    rescue CBOR::TypeError, RangeError => e
+      BinaryCBOR.encode(values, max_output_size: limits[:max_bytes])
+    rescue BinaryCBOR::LimitError => e
+      raise LimitError, e.message
+    rescue BinaryCBOR::Error, RangeError => e
       raise ConversionError, e.message
     end
 

data/lib/senml/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Senml
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: senml
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Yudai Takada
@@ -30,7 +30,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '4'
 description: RFC 8428 SenML JSON, base-value resolution, incremental SenSML streams,
-  fragments, and optional CBOR.
+  fragments, and CBOR.
 email:
 - t.yudai92@gmail.com
 executables: []
@@ -44,6 +44,7 @@ files:
 - data/labels.yml
 - data/units.yml
 - lib/senml.rb
+- lib/senml/binary_cbor.rb
 - lib/senml/cbor.rb
 - lib/senml/json_codec.rb
 - lib/senml/labels.rb
@@ -75,7 +76,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Read, validate, and resolve SenML sensor measurements
 test_files: []