@cbortech/cbor 0.25.0 → 0.25.1

package/README.ja.md

@@ -326,37 +326,117 @@ console.log(text);
 
 ## オプション extension
 
+このパッケージには、デフォルト有効ではないものの本体に同梱されている
+extension があります。必要なものを `import` し、
+`extensions` オプションに渡して使います。
+
+### b32 / h32
+
+[RFC 4648](https://www.rfc-editor.org/rfc/rfc4648) の Base32 エンコードによるバイト列リテラルです。
+[RFC 8949](https://www.rfc-editor.org/rfc/rfc8949) §8 に記載があり、[draft-ietf-cbor-edn-literals](https://datatracker.ietf.org/doc/draft-ietf-cbor-edn-literals/25/) でも触れられています。
+
+- `b32` — §6 Base32（`A–Z 2–7` アルファベット）
+- `h32` — §7 Base32Hex（`0–9 A–V` アルファベット）
+
+```ts
+import { CBOR, b32, h32 } from '@cbortech/cbor';
+
+const v1 = CBOR.fromCDN("b32'AEBAGBA'", { extensions: [b32] });
+console.log(v1.toCDN({ appStrings: false }));
+// h'01020304'
+
+const v2 = CBOR.fromCDN("h32'00P00'", { extensions: [h32] });
+console.log(v2.toCDN({ appStrings: false }));
+// h'003200'
+```
+
+### float
+
+16 進数のビットパターンを IEEE 754 浮動小数点値として解釈します。
+[draft-bormann-cbor-edn-app-ext](https://datatracker.ietf.org/doc/draft-bormann-cbor-edn-app-ext/)
+に記載があり、[cbor-test-vectors](https://github.com/cbor-wg/cbor-test-vectors) でも使われています。
+
+```ts
+import { CBOR, float } from '@cbortech/cbor';
+
+const v = CBOR.fromCDN("float'7e00'", { extensions: [float] });
+console.log(v.toCDN({ appStrings: false }));
+// NaN
+
+// バイト列から解釈する場合
+const v2 = CBOR.fromCDN("float<<h'3f800000'>>", { extensions: [float] });
+console.log(v2.toCDN({ appStrings: false }));
+// 1.0_2
+```
+
+### same
+
+`same<<expr, expr, ...>>` は、シーケンス内のすべての要素が同一の CBOR
+バイト列になることを検証し、最初の要素を返す extension です。
+[draft-bormann-cbor-edn-app-ext](https://datatracker.ietf.org/doc/draft-bormann-cbor-edn-app-ext/)
+に記載があります。
+
+```ts
+import { CBOR, same } from '@cbortech/cbor';
+
+// すべての要素が同じバイト列かを検証し、最初の要素を返す
+const v = CBOR.fromCDN("same<<h'0102', h'0102'>>", { extensions: [same] });
+console.log(v.toCDN({ appStrings: false }));
+// h'0102'
+
+// 要素が 1 つでも有効（常にパスする）
+const v2 = CBOR.fromCDN('same<<42>>', { extensions: [same] });
+console.log(v2.toCDN({ appStrings: false }));
+// 42
+```
+
+---
+
 追加の application extension は別パッケージとして公開されています。必要なものを
 インストールし、`extensions` オプションに渡して使います。
 
-`hash` は CDN の仕様に含まれる application extension ですが、利用には
-外部パッケージが必要です。そのため、このパッケージ本体には含めず、
-`@cbortech/hash-extension` として提供しています。
+### hash
 
-`uuid` は CDN の仕様には定められていない、このライブラリ独自の
-application extension です。仕様上の標準機能と区別するため、
-`@cbortech/uuid-extension` として別パッケージで提供しています。
+`hash` は [draft-ietf-cbor-edn-literals](https://datatracker.ietf.org/doc/draft-ietf-cbor-edn-literals/25/) §3.3 で定義された標準の application extension です。
+ハッシュアルゴリズムと値を `hash'algorithm:value'` の形式で表現します。
+実装には外部の暗号ライブラリが必要なため、[@cbortech/hash-extension](https://www.npmjs.com/package/@cbortech/hash-extension) として
+別パッケージで提供しています。
 
 ```bash
-npm install @cbortech/hash-extension @cbortech/uuid-extension
+npm install @cbortech/hash-extension
 ```
 
 ```ts
 import { CBOR } from '@cbortech/cbor';
-import hashExtension from '@cbortech/hash-extension';
-import uuidExtension from '@cbortech/uuid-extension';
+import { hash } from '@cbortech/hash-extension';
 
-const cbor = new CBOR({
-  extensions: [hashExtension, uuidExtension],
-});
+const cbor = new CBOR({ extensions: [hash] });
+
+const digest = cbor.parse(
+  "hash'sha-256:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='"
+);
+// Uint8Array(32) [227, 176, 196, 66, 152, 252, 28, 20, 154, 251, 244, 200,
+//                 153, 111, 185, 36, 39, 174, 65, 228, 100, 155, 147, 76,
+//                 164, 149, 153, 27, 120, 82, 184, 85]
+```
+
+### uuid
+
+`uuid` はこのライブラリ独自の application extension です。
+[@cbortech/uuid-extension](https://www.npmjs.com/package/@cbortech/uuid-extension) として別パッケージで提供しています。
+
+```bash
+npm install @cbortech/uuid-extension
+```
+
+```ts
+import { CBOR } from '@cbortech/cbor';
+import { uuid } from '@cbortech/uuid-extension';
 
-const digest = cbor.fromCDN("hash'foo'");
-console.log(digest.toCDN());
-// hash'foo'
+const cbor = new CBOR({ extensions: [uuid] });
 
-const id = cbor.fromCDN("uuid'550e8400-e29b-41d4-a716-446655440000'");
-console.log(id.toCDN());
-// uuid'550e8400-e29b-41d4-a716-446655440000'
+const id = cbor.parse("uuid'550e8400-e29b-41d4-a716-446655440000'");
+// Uint8Array(16) [85, 14, 132, 0, 226, 155, 65, 212, 167, 22, 68, 102, 85, 68, 0, 0]
 ```
 
 ## タグ

package/README.md

@@ -330,37 +330,118 @@ console.log(text);
 
 ## Optional Extensions
 
+This package includes several bundled extensions that are not enabled by
+default. Import what you need and pass it through the `extensions` option.
+
+### b32 / h32
+
+Byte-string literals using [RFC 4648](https://www.rfc-editor.org/rfc/rfc4648)
+Base32 encoding. These prefixes are described in §8 of
+[RFC 8949](https://www.rfc-editor.org/rfc/rfc8949) and also mentioned in
+[draft-ietf-cbor-edn-literals](https://datatracker.ietf.org/doc/draft-ietf-cbor-edn-literals/25/).
+
+- `b32` — §6 Base32 (`A–Z 2–7` alphabet)
+- `h32` — §7 Base32Hex (`0–9 A–V` alphabet)
+
+```ts
+import { CBOR, b32, h32 } from '@cbortech/cbor';
+
+const v1 = CBOR.fromCDN("b32'AEBAGBA'", { extensions: [b32] });
+console.log(v1.toCDN({ appStrings: false }));
+// h'01020304'
+
+const v2 = CBOR.fromCDN("h32'00P00'", { extensions: [h32] });
+console.log(v2.toCDN({ appStrings: false }));
+// h'003200'
+```
+
+### float
+
+Interprets a hex bit-pattern as an IEEE 754 floating-point value. This
+extension is described in
+[draft-bormann-cbor-edn-app-ext](https://datatracker.ietf.org/doc/draft-bormann-cbor-edn-app-ext/)
+and also used in [cbor-test-vectors](https://github.com/cbor-wg/cbor-test-vectors).
+
+```ts
+import { CBOR, float } from '@cbortech/cbor';
+
+const v = CBOR.fromCDN("float'7e00'", { extensions: [float] });
+console.log(v.toCDN({ appStrings: false }));
+// NaN
+
+// Interpret bytes as float bits
+const v2 = CBOR.fromCDN("float<<h'3f800000'>>", { extensions: [float] });
+console.log(v2.toCDN({ appStrings: false }));
+// 1.0_2
+```
+
+### same
+
+`same<<expr, expr, ...>>` verifies that every item in the sequence encodes to
+identical CBOR bytes and returns the first item. This extension is described in
+[draft-bormann-cbor-edn-app-ext](https://datatracker.ietf.org/doc/draft-bormann-cbor-edn-app-ext/).
+
+```ts
+import { CBOR, same } from '@cbortech/cbor';
+
+const v = CBOR.fromCDN("same<<h'0102', h'0102'>>", { extensions: [same] });
+console.log(v.toCDN({ appStrings: false }));
+// h'0102'
+
+// A single-item sequence always passes
+const v2 = CBOR.fromCDN('same<<42>>', { extensions: [same] });
+console.log(v2.toCDN({ appStrings: false }));
+// 42
+```
+
+---
+
 Additional application extensions are published as separate packages. Install
 the ones you need and pass them through the `extensions` option.
 
-`hash` is an application extension defined by the CDN specification, but
-it requires an external package. For that reason, it is not bundled with this
-package and is provided separately as `@cbortech/hash-extension`.
+### hash
 
-`uuid` is a library-specific application extension that is not defined by the
-CDN specification. To keep it distinct from standard CDN features, it
-is provided separately as `@cbortech/uuid-extension`.
+`hash` is an application extension defined in §3.3 of
+[draft-ietf-cbor-edn-literals](https://datatracker.ietf.org/doc/draft-ietf-cbor-edn-literals/25/).
+It represents cryptographic hash values in the form `hash'algorithm:value'`.
+Because it requires an external cryptographic library, it is provided separately
+as [@cbortech/hash-extension](https://www.npmjs.com/package/@cbortech/hash-extension).
 
 ```bash
-npm install @cbortech/hash-extension @cbortech/uuid-extension
+npm install @cbortech/hash-extension
 ```
 
 ```ts
 import { CBOR } from '@cbortech/cbor';
-import hashExtension from '@cbortech/hash-extension';
-import uuidExtension from '@cbortech/uuid-extension';
+import { hash } from '@cbortech/hash-extension';
 
-const cbor = new CBOR({
-  extensions: [hashExtension, uuidExtension],
-});
+const cbor = new CBOR({ extensions: [hash] });
+
+const digest = cbor.parse(
+  "hash'sha-256:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='"
+);
+// Uint8Array(32) [227, 176, 196, 66, 152, 252, 28, 20, 154, 251, 244, 200,
+//                 153, 111, 185, 36, 39, 174, 65, 228, 100, 155, 147, 76,
+//                 164, 149, 153, 27, 120, 82, 184, 85]
+```
+
+### uuid
+
+`uuid` is a library-specific application extension, provided separately as
+[@cbortech/uuid-extension](https://www.npmjs.com/package/@cbortech/uuid-extension).
+
+```bash
+npm install @cbortech/uuid-extension
+```
+
+```ts
+import { CBOR } from '@cbortech/cbor';
+import { uuid } from '@cbortech/uuid-extension';
 
-const digest = cbor.fromCDN("hash'foo'");
-console.log(digest.toCDN());
-// hash'foo'
+const cbor = new CBOR({ extensions: [uuid] });
 
-const id = cbor.fromCDN("uuid'550e8400-e29b-41d4-a716-446655440000'");
-console.log(id.toCDN());
-// uuid'550e8400-e29b-41d4-a716-446655440000'
+const id = cbor.parse("uuid'550e8400-e29b-41d4-a716-446655440000'");
+// Uint8Array(16) [85, 14, 132, 0, 226, 155, 65, 212, 167, 22, 68, 102, 85, 68, 0, 0]
 ```
 
 ## Tags

package/dist/ast/CborAppSeqResult.d.ts

@@ -0,0 +1,20 @@
+import { ToCDNOptions, ToCBOROptions, ToJSOptions } from '../types';
+import { CborItem } from './CborItem';
+/**
+ * Wraps a resolved app-sequence result and preserves the original EDN source
+ * text for round-trip fidelity.
+ *
+ * When `appStrings !== false`, `_toCDN` returns the stored source text verbatim.
+ * Otherwise it delegates to the wrapped item so the caller gets a plain value.
+ *
+ * CBOR encoding and JS conversion always delegate to the inner item so the
+ * wrapper is fully transparent for those operations.
+ */
+export declare class CborAppSeqResult extends CborItem {
+    readonly inner: CborItem;
+    readonly ednSource: string;
+    constructor(inner: CborItem, ednSource: string);
+    _toCBOR(options?: ToCBOROptions): Uint8Array;
+    _toCDN(options: ToCDNOptions | undefined, depth: number): string;
+    _toJS(options?: ToJSOptions): unknown;
+}

package/dist/ast/CborFloat.d.ts

@@ -18,6 +18,12 @@ export declare class CborFloat extends CborItem {
      * - `undefined`: encoder auto-selects the smallest lossless size.
      */
     readonly precision: FloatPrecision | undefined;
+    /**
+     * Original app-string source (e.g. `float'7e00'`), set by the parser when
+     * this float is the result of a `float'...'` app-string.  Used by toCDN()
+     * to round-trip the literal when `appStrings` is not false.
+     */
+    ednSource?: string;
     constructor(value: number, options?: {
         precision?: FloatPrecision;
     });

package/dist/ast/CborItem.d.ts

@@ -1,4 +1,4 @@
-import { CBOROptions, ToCDNOptions, ToJSOptions, ToHexDumpOptions, ToCBOROptions, CborComments } from '../types';
+import { CBOROptions, ToCDNOptions, ToJSOptions, ToHexDumpOptions, ToCBOROptions, CborComments, DecodeWarning, ParseWarning } from '../types';
 /** @internal One line of an annotated hex dump. */
 export interface AnnotatedLine {
     depth: number;
@@ -30,6 +30,12 @@ export declare abstract class CborItem {
      * They do not affect CBOR bytes or JS conversion.
      */
     comments?: CborComments;
+    /**
+     * Validity violations detected while decoding or parsing this node.
+     * Populated when `strict: false` is set in `FromCBOROptions` or
+     * `FromCDNOptions`.
+     */
+    warnings?: (DecodeWarning | ParseWarning)[];
     /**
      * Default options bound by a {@link CBOR} instance factory method.
      * Per-call options always take precedence.

package/dist/ast/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../mapEntries-CNxwMt7o.cjs`);exports.CborArray=e.p,exports.CborBigNint=e.c,exports.CborBigUint=e.l,exports.CborByteString=e.g,exports.CborEmbeddedCBOR=e.u,exports.CborFloat=e.v,exports.CborIndefiniteByteString=e.h,exports.CborIndefiniteTextString=e.m,exports.CborItem=e.x,exports.CborMap=e.f,exports.CborNint=e.y,exports.CborSimple=e.d,exports.CborTag=e._,exports.CborTextString=e.o,exports.CborUint=e.b;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../mapEntries-BccT62HT.cjs");exports.CborArray=e.p,exports.CborBigNint=e.c,exports.CborBigUint=e.l,exports.CborByteString=e.g,exports.CborEmbeddedCBOR=e.u,exports.CborFloat=e.v,exports.CborIndefiniteByteString=e.h,exports.CborIndefiniteTextString=e.m,exports.CborItem=e.S,exports.CborMap=e.f,exports.CborNint=e.y,exports.CborSimple=e.d,exports.CborTag=e._,exports.CborTextString=e.o,exports.CborUint=e.b;

package/dist/ast/index.js

@@ -1,2 +1,2 @@
-import { _ as e, b as t, c as n, d as r, f as i, g as a, h as o, l as s, m as c, o as l, p as u, u as d, v as f, x as p, y as m } from "../mapEntries-Da-2HMRf.js";
-export { u as CborArray, n as CborBigNint, s as CborBigUint, a as CborByteString, d as CborEmbeddedCBOR, f as CborFloat, o as CborIndefiniteByteString, c as CborIndefiniteTextString, p as CborItem, i as CborMap, m as CborNint, r as CborSimple, e as CborTag, l as CborTextString, t as CborUint };
+import { S as e, _ as t, b as n, c as r, d as i, f as a, g as o, h as s, l as c, m as l, o as u, p as d, u as f, v as p, y as m } from "../mapEntries-ZR8QJ0Yj.js";
+export { d as CborArray, r as CborBigNint, c as CborBigUint, o as CborByteString, f as CborEmbeddedCBOR, p as CborFloat, s as CborIndefiniteByteString, l as CborIndefiniteTextString, e as CborItem, a as CborMap, m as CborNint, i as CborSimple, t as CborTag, u as CborTextString, n as CborUint };

package/dist/cdn/serialize-utils.d.ts

@@ -1,4 +1,4 @@
-import { CborComments, ToCDNOptions } from '../types';
+import { CborComment, CborComments, ToCDNOptions } from '../types';
 /** Resolve indent option to a string, or null for single-line output. */
 export declare function resolveIndent(options: ToCDNOptions | undefined): string | null;
 /** Build the indent prefix for a given depth. */
@@ -8,9 +8,22 @@ export interface Commented {
 }
 export declare function hasPreservedComments(item: Commented): boolean;
 export declare function hasContainerLayoutComments(item: Commented): boolean;
-export declare function formatLeadingComments(item: Commented, indent: string): string[];
-export declare function formatTrailingComments(item: Commented): string;
-export declare function formatDanglingComments(item: Commented, indent: string): string[];
+/**
+ * Convert a single comment's text to the requested marker style.
+ *
+ * Conversion table:
+ *   c-style  : `#` → `//`, `/ … /` → `/* … *\/`
+ *   cdn-style: `//` → `#`, `/* … *\/` → `/ … /`
+ *
+ * Special case for cdn-style: when the inner content of `/* … *\/` starts
+ * with `*` or `/` the result would look like `/*…` or `//…` — a different
+ * comment form.  A single space is inserted after the opening `/` to prevent
+ * this (e.g. `/**…*\/` → `/ *…/`).
+ */
+export declare function convertCommentText(comment: CborComment, style: 'c-style' | 'cdn-style' | undefined): string;
+export declare function formatLeadingComments(item: Commented, indent: string, style?: 'c-style' | 'cdn-style' | undefined): string[];
+export declare function formatTrailingComments(item: Commented, style?: 'c-style' | 'cdn-style' | undefined): string;
+export declare function formatDanglingComments(item: Commented, indent: string, style?: 'c-style' | 'cdn-style' | undefined): string[];
 /**
  * Resolve separator options into concrete strings.
  *

package/dist/cdn/test-vectors/runner.d.ts

@@ -0,0 +1,22 @@
+import { CborExtension } from '../../extensions/types';
+export declare function hexToBytes(hex: string): Uint8Array;
+/** Decode an h]-prefixed input: hex bytes → UTF-8 string (may contain control chars). */
+export declare function decodeInput(raw: string): string;
+/**
+ * Minimal RFC 4180 CSV parser.
+ * Returns rows as [op, input, output] triples; comment rows (op starts with #)
+ * and the header row are excluded.
+ */
+export declare function parseCSV(text: string): [string, string, string][];
+/**
+ * Register Vitest tests for one CSV file.
+ *
+ * @param text            - Raw CSV content (already read from disk).
+ * @param knownSkip       - Map of test label → reason; matching tests are skipped.
+ * @param strictNegative  - When true (default), a `-` test whose output field
+ *                          cannot be parsed fails rather than passes silently.
+ *                          Set to false only when the corpus is known to include
+ *                          intentionally unparseable output values (corpus-conflict
+ *                          cases should be listed in knownSkip instead).
+ */
+export declare function registerTests(text: string, knownSkip?: Map<string, string>, strictNegative?: boolean, extensions?: CborExtension[]): void;

package/dist/cdn/tokenizer.d.ts

@@ -4,7 +4,7 @@
  * Used by parser.ts for parsing and by CborTextString serialization to collect
  * source offsets after parseCDN() has already validated embedded CDN.
  */
-export type TokenType = 'INTEGER' | 'FLOAT' | 'TSTR' | 'SQSTR' | 'RAWSTRING' | 'BYTES_HEX' | 'BYTES_HEX_ELIDED' | 'BYTES_B64' | 'BYTES_B32' | 'BYTES_H32' | 'APP_STRING' | 'APP_SEQUENCE' | 'EMPTY_INDEF_BYTES' | 'EMPTY_INDEF_TEXT' | 'TRUE' | 'FALSE' | 'NULL' | 'UNDEFINED' | 'SIMPLE' | 'LBRACKET' | 'RBRACKET' | 'LBRACE' | 'RBRACE' | 'LPAREN' | 'RPAREN' | 'COLON' | 'COMMA' | 'PLUS' | 'UNDERSCORE' | 'ENCODING_INDICATOR' | 'LT_LT' | 'GT_GT' | 'ELLIPSIS' | 'EOF';
+export type TokenType = 'INTEGER' | 'FLOAT' | 'TSTR' | 'SQSTR' | 'RAWSTRING' | 'BYTES_HEX' | 'BYTES_HEX_ELIDED' | 'BYTES_B64' | 'APP_STRING' | 'APP_SEQUENCE' | 'EMPTY_INDEF_BYTES' | 'EMPTY_INDEF_TEXT' | 'TRUE' | 'FALSE' | 'NULL' | 'UNDEFINED' | 'SIMPLE' | 'LBRACKET' | 'RBRACKET' | 'LBRACE' | 'RBRACE' | 'LPAREN' | 'RPAREN' | 'COLON' | 'COMMA' | 'PLUS' | 'UNDERSCORE' | 'ENCODING_INDICATOR' | 'LT_LT' | 'GT_GT' | 'ELLIPSIS' | 'EOF';
 export interface Token {
     type: TokenType;
     /** Processed value: decoded string content, raw number text, raw byte content, etc. */
@@ -42,18 +42,26 @@ export declare class Tokenizer {
     private _lastConsumedEndOffset;
     /** Comments encountered while scanning, appended in source order. */
     readonly comments: EdnComment[];
+    /**
+     * When set, non-standard-but-JS-valid escape sequences are accepted instead
+     * of throwing.  The callback receives a message and the position of the `\`
+     * (offset, line, column) so the parser can forward it as a ParseWarning.
+     */
+    onEscapeWarning?: (msg: string, offset: number, line: number, col: number) => void;
     constructor(input: string, options?: TokenizerOptions);
     peek(): Token;
     consume(): Token;
     /** Character offset just past the last character of the most recently consumed token. */
     get lastEndOffset(): number;
+    /** The full source text supplied to this tokenizer. */
+    get source(): string;
     private _ch;
     private _eof;
     private _advance;
     private _fail;
     private _skipWS;
     /**
-     * Skip a comment in a quoted byte string literal (h'', b32'', h32'').
+     * Skip a comment in a quoted byte string literal (h'', b64'').
      * Returns true if a comment was consumed, false if the current char is not a
      * comment start. `quote` is the closing delimiter character.
      *
@@ -61,7 +69,16 @@ export declare class Tokenizer {
      */
     private _skipByteStringComment;
     /**
-     * Skip a comment in a raw byte string (h``, b32``, h32``).
+     * Validate a `\uXXXX` or `\u{N}` escape inside a hex-string comment.
+     *
+     * Called immediately after the `u` character has been consumed.  Rejects
+     * lone surrogates and invalid surrogate pairs; tolerates truncated/
+     * non-hex sequences (comments are informational, but surrogates are
+     * always illegal).
+     */
+    private _validateHexCommentUnicodeEscape;
+    /**
+     * Skip a comment in a raw byte string (h``, b64``).
      * Called with `i` pointing at the comment-start character.
      * Returns the index after the comment, or -1 if no comment was found.
      *
@@ -80,13 +97,13 @@ export declare class Tokenizer {
      * - Literal LF (U+000A) is allowed; all other C0 controls and U+007F are rejected.
      * - Literal CR (U+000D) is silently stripped (source-level CRLF normalisation).
      * - Only spec-defined escape sequences are accepted; `\q` etc. throw SyntaxError.
-     * - `\/` is valid in both single- and double-quoted strings.
-     * - `\\` (backslash) is always a valid escape.
+     * - `\/` is valid only in double-quoted strings (not in escapable-s, §5.1).
+     * - `\\` (backslash) is valid in both single- and double-quoted strings.
      * - `\uXXXX` for a high surrogate must be immediately followed by `\uXXXX` for
      *   the corresponding low surrogate; lone surrogates are rejected.
      * - `\u{N}` … `\u{10FFFF}` extended syntax is supported; surrogates are rejected.
      * - In single-quoted strings, `\u` escapes to printable ASCII (U+0020–U+007E)
-     *   are forbidden (hexchar-s restriction, draft §2.5.2 / §5.1).
+     *   are forbidden (hexchar-s restriction, draft-25 §5.1).
      */
     private _readStringContent;
     /**
@@ -101,9 +118,8 @@ export declare class Tokenizer {
      *   which is then decoded into the corresponding non-BMP code point.
      *
      * In single-quoted strings (`quote === "'"`), `\u` escapes that resolve to
-     * printable ASCII (U+0020–U+007E) are rejected per draft §2.5.2 / §5.1
-     * hexchar-s, except for backslash (U+005C) and single-quote (U+0027), which
-     * require escaping and cannot be written literally.
+     * printable ASCII (U+0020–U+007E) are rejected per draft-25 §5.1 hexchar-s.
+     * Use `\\` for backslash (U+005C) and `\'` for the single-quote delimiter.
      */
     private _readUnicodeEscape;
     /**
@@ -142,13 +158,6 @@ export declare class Tokenizer {
      * Returns the stripped base64 string.
      */
     private _processRawB64Content;
-    /**
-     * Post-process raw base32/base32hex content from `b32``…``\` / `h32``…``\` raw strings.
-     *
-     * Supports all comment forms (§2.2): `/ ... /`, `/*...*\/`, `//`, `#`.
-     * HT is still forbidden (rawchars excludes %x09).
-     */
-    private _processRawB32Content;
     /**
      * Read raw byte-string content between `quote` chars (b64 / b64url).
      *
@@ -156,12 +165,6 @@ export declare class Tokenizer {
      * `/` is NOT treated as a comment delimiter because it is a valid base64 character.
      */
     private _readByteContent;
-    /**
-     * Read base32 / base32hex byte-string content (`b32'...'` / `h32'...'`).
-     *
-     * Supports all comment forms (§2.2): `/ ... /`, `/*...*\/`, `//`, `#`.
-     */
-    private _readB32Content;
     /**
      * Read hex byte-string content, recognising `...` ellipsis sequences (§4.2).
      *

package/dist/extensions/b32.d.ts

@@ -0,0 +1,5 @@
+import { CborExtension } from './types';
+/** RFC 4648 §6 Base32 (A–Z 2–7) app-string extension. */
+export declare const b32: CborExtension;
+/** RFC 4648 §7 Base32Hex (0–9 A–V) app-string extension. */
+export declare const h32: CborExtension;

package/dist/extensions/dt.d.ts

@@ -19,16 +19,7 @@ import { EncodingWidth } from '../cbor/encode';
  * used so that the float64 value is faithfully represented.
  */
 export declare function epochToRfc3339(epochSeconds: number): string;
-/**
- * Parse an RFC 3339 string and produce the appropriate epoch CborItem subclass.
- * Integer seconds → CborEpochDtExtUint or CborEpochDtExtNint.
- * Fractional seconds → CborEpochDtExtFloat.
- *
- * Fractional seconds are extracted from the string directly (via parseFloat)
- * before passing the remainder to Date.parse, so sub-millisecond precision
- * is preserved rather than being rounded to the nearest millisecond.
- */
-export declare function parseDtAppString(str: string): CborEpochDtExtUint | CborEpochDtExtNint | CborEpochDtExtFloat;
+export declare function parseDtAppString(str: string, onError?: (msg: string) => void): CborEpochDtExtUint | CborEpochDtExtNint | CborEpochDtExtFloat;
 export declare const PREFIX_DT = "dt";
 export declare const PREFIX_DT_TAGGED = "DT";
 export declare const TAG_EPOCH = 1n;

package/dist/extensions/float.d.ts

@@ -0,0 +1,7 @@
+import { CborExtension } from './types';
+/**
+ * Extension object for `float'...'` / `float<<...>>`.
+ * Pass to `parseCDN(..., { extensions: [float] })`.
+ */
+export declare const float: CborExtension;
+export default float;

package/dist/extensions/same.d.ts

@@ -0,0 +1,7 @@
+import { CborExtension } from './types';
+/**
+ * Extension object for `same<<...>>`.
+ * Pass to `parseCDN(..., { extensions: [same] })`.
+ */
+export declare const same: CborExtension;
+export default same;

package/dist/extensions/types.d.ts

@@ -1,5 +1,5 @@
 import { CborItem } from '../ast/CborItem';
-import { FromJSOptions } from '../types';
+import { FromCBOROptions, FromJSOptions } from '../types';
 /**
  * Plugin that extends EDN parsing, CBOR decoding, and `fromJS()` for specific
  * application-string prefixes or CBOR tag numbers.
@@ -33,20 +33,42 @@ export interface CborExtension {
      * Parse an app-string literal: `prefix'content'` or `prefix"content"`.
      * Receives the matched `prefix` and the decoded string `content`.
      * Throw `SyntaxError` to report invalid content.
+     *
+     * The CDN parser always passes an `onError` callback.  Extensions may call
+     * `onError(msg)` instead of throwing to emit a recoverable violation; the
+     * callback emits a warning and, in strict mode, also throws.  Extensions
+     * that ignore `onError` and throw directly always hard-fail regardless of
+     * the `strict` setting.
      */
-    parseAppString?(prefix: string, content: string): CborItem;
+    parseAppString?(prefix: string, content: string, onError?: (msg: string) => void): CborItem;
     /**
      * Parse an app-sequence literal: `prefix<<item, ...>>`.
      * Receives the matched `prefix` and the array of parsed CBOR values.
      * If omitted, the `<<...>>` form is rejected with a `SyntaxError`.
+     * The `onError` callback follows the same contract as in `parseAppString`.
      */
-    parseAppSequence?(prefix: string, items: CborItem[]): CborItem;
+    parseAppSequence?(prefix: string, items: CborItem[], onError?: (msg: string) => void): CborItem;
+    /**
+     * When `true`, the CDN parser wraps the result of `parseAppSequence` in a
+     * `CborAppSeqResult` so that `toCDN()` round-trips the original
+     * `prefix<<...>>` notation when `appStrings !== false`.
+     *
+     * Extensions whose result is already a subclass that handles source
+     * preservation itself (e.g. `CborFloat` via its `ednSource` property) should
+     * leave this unset.
+     */
+    readonly preserveAppSeqSource?: boolean;
     /**
      * Called when a `CborTag` is encountered during CBOR decode (`fromCBOR`)
      * or EDN integer-tag parsing (`fromCDN`).
      * Return `undefined` to fall back to the default `CborTag` representation.
+     *
+     * `options` is supplied only from the binary CBOR decoder; it is `undefined`
+     * when called from the CDN parser.  Extensions that perform nested CBOR
+     * decoding (e.g. tag 24) should forward these options to propagate
+     * `strict`, `onWarning`, and `silent` into the inner decode.
      */
-    parseTag?(tag: bigint, value: CborItem): CborItem | undefined;
+    parseTag?(tag: bigint, value: CborItem, options?: FromCBOROptions): CborItem | undefined;
     /**
      * Called during `fromJS()` for every value before the default conversion
      * logic.  Return `undefined` to fall through to the default behaviour.

package/dist/index.cjs

@@ -1,3 +1,6 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require(`./mapEntries-CNxwMt7o.cjs`);var t=class t{static OMIT=e.C;static TAG=e.w;static Tag=e.E;static Simple=e.S;static MapEntries=e.t;static dt_as_Date=e.a;#e;constructor(e){this.#e=e??{}}#t(e){return{...this.#e,...e??{}}}fromCBOR(e,n){let r=t.fromCBOR(e,this.#t(n));return r._defaults=this.#e,r}fromCDN(e,n){let r=t.fromCDN(e,this.#t(n));return r._defaults=this.#e,r}fromEDN(e,t){return this.fromCDN(e,t)}fromJS(e,n){let r=t.fromJS(e,this.#t(n));return r._defaults=this.#e,r}fromHexDump(e,n){let r=t.fromHexDump(e,this.#t(n));return r._defaults=this.#e,r}decode(e,n){return t.decode(e,this.#t(n))}encode(e,n){return t.encode(e,this.#t(n))}cborToCborEdn(e,t){return this.cborToCdn(e,t)}cborToCdn(e,n){return t.cborToCdn(e,this.#t(n))}cborEdnToCbor(e,t){return this.cdnToCbor(e,t)}cdnToCbor(e,n){return t.cdnToCbor(e,this.#t(n))}parse(e,n){if(typeof n==`function`){let r=this.#t({reviver:n});return t.fromCDN(e,r).toJS(r)}let r=this.#t(n);return t.fromCDN(e,r).toJS(r)}stringify(e,n,r){if(typeof n==`function`||Array.isArray(n)||n===null||n===void 0&&r!==void 0){let i={...this.#e};return n===null?i.replacer=void 0:(typeof n==`function`||Array.isArray(n))&&(i.replacer=n),r!==void 0&&(i.indent=a(r)),t.stringify(e,i)}return t.stringify(e,this.#t(n??void 0))}format(e,n){return t.format(e,this.#t(n))}static fromCBOR(t,n){return e.i(t,n)}static fromCDN(t,n){return e.s(t,n)}static fromEDN(e,n){return t.fromCDN(e,n)}static fromJS(t,n){return e.r(t,n)}static fromHexDump(t,r){let i=[],a=n(t).trim().split(/\s+/).filter(Boolean);for(let e of a){if(!/^[0-9A-Fa-f]{2}$/.test(e))throw SyntaxError(`Invalid hex token in dump: ${JSON.stringify(e)}`);i.push(parseInt(e,16))}return e.i(new Uint8Array(i),r)}static decode(e,n){return t.fromCBOR(e,n).toJS(n)}static encode(e,n){return t.fromJS(e,n).toCBOR(n)}static cborToCdn(e,n){return t.fromCBOR(e,n).toCDN(n)}static cborToCborEdn(e,n){return t.cborToCdn(e,n)}static cdnToCbor(e,n){return t.fromCDN(e,n).toCBOR(n)}static cborEdnToCbor(e,n){return t.cdnToCbor(e,n)}static parse(e,n){return typeof n==`function`?t.fromCDN(e).toJS({reviver:n}):t.fromCDN(e,n).toJS(n)}static stringify(t,n,r){if(typeof n==`function`||Array.isArray(n)||n===null||n===void 0&&r!==void 0){let i=typeof n==`function`||Array.isArray(n)?n:void 0,o=a(r);if(i){let n=e.n(t,i);return n===void 0||n===e.C?void 0:e.r(n).toCDN(o===void 0?void 0:{indent:o})}return e.r(t).toCDN(o===void 0?void 0:{indent:o})}let i=n;if(i?.replacer){let n=e.n(t,i.replacer,i.extensions,i.undefinedOmits);if(n===void 0||n===e.C)return;let{replacer:r,...a}=i;return e.r(n,Object.keys(a).length>0?a:void 0).toCDN(i)}return e.r(t,i).toCDN(i)}static format(e,n){return t.fromCDN(e,n).toCDN(n)}};function n(e){let t=``,n=0;for(;n<e.length;){let a=e[n],o=e[n+1]??``;if(a===`-`&&o===`-`){n=r(e,n+2),t+=` `;continue}if(a===`#`){n=r(e,n+1),t+=` `;continue}if(a===`/`&&o===`/`){n=r(e,n+2),t+=` `;continue}if(a===`/`&&o===`*`){let r=e.indexOf(`*/`,n+2);if(r<0)throw SyntaxError(`Unterminated comment in hex dump`);t+=i(e.slice(n,r+2)),n=r+2;continue}if(a===`/`){let r=e.indexOf(`/`,n+1);if(r<0)throw SyntaxError(`Unterminated comment in hex dump`);t+=i(e.slice(n,r+1)),n=r+1;continue}t+=a,n++}return t}function r(e,t){let n=e.indexOf(`
-`,t);return n<0?e.length:n}function i(e){return e.replace(/[^\r\n]/g,` `)}function a(e){if(typeof e==`number`){let t=Math.floor(Math.min(10,Math.max(0,e)));return t===0?void 0:t}if(typeof e==`string`)return e.slice(0,10)||void 0}exports.CBOR=t,exports.default=t,exports.CBOR_OMIT=e.C,exports.CBOR_TAG=e.w,exports.MapEntries=e.t,exports.Null=e.T,exports.Simple=e.S,exports.Tag=e.E,exports.Undefined=e.D,exports.dt_as_Date=e.a;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("./mapEntries-BccT62HT.cjs");function t(e){let t=``,n=0;for(;n<e.length;){let r=e[n];if(r===` `||r===`
+`||r===`\r`){n++;continue}if(r===`#`){for(;n<e.length&&e[n]!==`
+`;)n++;continue}if(r===`/`){let t=e[n+1]??``;if(t===`/`){for(;n<e.length&&e[n]!==`
+`;)n++;continue}if(t===`*`){for(n+=2;n<e.length&&!(e[n]===`*`&&(e[n+1]??``)===`/`);)n++;if(n>=e.length)throw SyntaxError(`unterminated block comment`);n+=2;continue}for(n++;n<e.length&&e[n]!==`/`;)n++;if(n>=e.length)throw SyntaxError(`unterminated block comment`);n++;continue}t+=r,n++}return t}var n=`ABCDEFGHIJKLMNOPQRSTUVWXYZ234567`,r=`0123456789ABCDEFGHIJKLMNOPQRSTUV`;function i(e){let t=e.length;for(;t>0&&e.charCodeAt(t-1)===61;)t--;return e.slice(0,t)}function a(e,t,n){let r=i(e).toUpperCase(),a=r.length%8;if(a===1||a===3||a===6)throw SyntaxError(`invalid base32 length: ${r.length} characters`);let o=new Uint8Array(128).fill(255);for(let e=0;e<t.length;e++)o[t.charCodeAt(e)]=e;let s=new Uint8Array(Math.floor(r.length*5/8)),c=0,l=0,u=0;for(let e of r){let t=e.charCodeAt(0),n=t<128?o[t]:255;if(n===255)throw SyntaxError(`invalid character in byte string: ${JSON.stringify(e)}`);c=c<<5|n,l+=5,l>=8&&(l-=8,s[u++]=c>>l&255)}if(l>0&&c&(1<<l)-1){let e=`non-zero trailing bits in base32 input`;if(n)n(e);else throw SyntaxError(e)}return s}var o={appStringPrefixes:[`b32`],parseAppString(r,i,o){return new e.g(a(t(i),n,o),{ednEncoding:`base32`})}},s={appStringPrefixes:[`h32`],parseAppString(n,i,o){return new e.g(a(t(i),r,o),{ednEncoding:`base32hex`})}},c=typeof Uint8Array.fromHex==`function`?e=>Uint8Array.fromHex(e):e=>{let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=parseInt(e.slice(n,n+2),16);return t},l=class extends e.v{_bits;constructor(t){super(e.x(t),{precision:`half`}),this._bits=t&65535}_toCBOR(){return new Uint8Array([249,this._bits>>8&255,this._bits&255])}},u=class extends e.v{_raw;constructor(e){super(new DataView(e.buffer,e.byteOffset).getFloat32(0,!1),{precision:`single`}),this._raw=e.slice()}_toCBOR(){let e=new Uint8Array(5);return e[0]=250,e.set(this._raw,1),e}},d=class extends e.v{_raw;constructor(e){super(new DataView(e.buffer,e.byteOffset).getFloat64(0,!1),{precision:`double`}),this._raw=e.slice()}_toCBOR(){let e=new Uint8Array(9);return e[0]=251,e.set(this._raw,1),e}};function f(e){if(e.length===2)return new l(e[0]<<8|e[1]);if(e.length===4)return new u(e);if(e.length===8)return new d(e);throw SyntaxError(`float'...' requires 4, 8, or 16 hex digits (2, 4, or 8 bytes); got ${e.length} bytes`)}var p={appStringPrefixes:[`float`],parseAppString(e,n){let r=t(n);if(!/^[0-9a-fA-F]*$/.test(r))throw SyntaxError(`float'...' contains non-hex characters`);if(r.length%2!=0)throw SyntaxError(`float'...' hex content has odd length (${r.length} digits)`);return f(c(r))},parseAppSequence(t,n,r){if(n.length===0)throw SyntaxError(`float<<...>> requires exactly one byte-string item`);if(n.length>1){let e=`float<<...>> expects 1 item; got ${n.length} — using first`;if(r)r(e);else throw SyntaxError(e)}if(!(n[0]instanceof e.g))throw SyntaxError(`float<<...>> item must be a byte string`);return f(n[0].value)}};function m(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var h={appStringPrefixes:[`same`],preserveAppSeqSource:!0,parseAppSequence(e,t,n){if(t.length===0)throw SyntaxError(`same<<...>> requires at least one item`);let r=t[0],i=r.toCBOR();for(let e=1;e<t.length;e++)if(!m(i,t[e].toCBOR())){let t=`same<<...>>: item ${e} produces different CBOR bytes than item 0`;if(n)n(t);else throw SyntaxError(t)}return r}},g=class t{static OMIT=e.w;static TAG=e.T;static Tag=e.D;static Simple=e.C;static MapEntries=e.t;static dt_as_Date=e.a;#e;constructor(e){this.#e=e??{}}#t(e){return{...this.#e,...e??{}}}fromCBOR(e,n){let r=t.fromCBOR(e,this.#t(n));return r._defaults=this.#e,r}fromCDN(e,n){let r=t.fromCDN(e,this.#t(n));return r._defaults=this.#e,r}fromEDN(e,t){return this.fromCDN(e,t)}fromJS(e,n){let r=t.fromJS(e,this.#t(n));return r._defaults=this.#e,r}fromHexDump(e,n){let r=t.fromHexDump(e,this.#t(n));return r._defaults=this.#e,r}decode(e,n){return t.decode(e,this.#t(n))}encode(e,n){return t.encode(e,this.#t(n))}cborToCborEdn(e,t){return this.cborToCdn(e,t)}cborToCdn(e,n){return t.cborToCdn(e,this.#t(n))}cborEdnToCbor(e,t){return this.cdnToCbor(e,t)}cdnToCbor(e,n){return t.cdnToCbor(e,this.#t(n))}parse(e,n){if(typeof n==`function`){let r=this.#t({reviver:n});return t.fromCDN(e,r).toJS(r)}let r=this.#t(n);return t.fromCDN(e,r).toJS(r)}stringify(e,n,r){if(typeof n==`function`||Array.isArray(n)||n===null||n===void 0&&r!==void 0){let i={...this.#e};return n===null?i.replacer=void 0:(typeof n==`function`||Array.isArray(n))&&(i.replacer=n),r!==void 0&&(i.indent=b(r)),t.stringify(e,i)}return t.stringify(e,this.#t(n??void 0))}format(e,n){return t.format(e,this.#t(n))}static fromCBOR(t,n){return e.i(t,n)}static fromCDN(t,n){return e.s(t,n)}static fromEDN(e,n){return t.fromCDN(e,n)}static fromJS(t,n){return e.r(t,n)}static fromHexDump(t,n){let r=[],i=_(t).trim().split(/\s+/).filter(Boolean);for(let e of i){if(!/^[0-9A-Fa-f]{2}$/.test(e))throw SyntaxError(`Invalid hex token in dump: ${JSON.stringify(e)}`);r.push(parseInt(e,16))}return e.i(new Uint8Array(r),n)}static decode(e,n){return t.fromCBOR(e,n).toJS(n)}static encode(e,n){return t.fromJS(e,n).toCBOR(n)}static cborToCdn(e,n){return t.fromCBOR(e,n).toCDN(n)}static cborToCborEdn(e,n){return t.cborToCdn(e,n)}static cdnToCbor(e,n){return t.fromCDN(e,n).toCBOR(n)}static cborEdnToCbor(e,n){return t.cdnToCbor(e,n)}static parse(e,n){return typeof n==`function`?t.fromCDN(e).toJS({reviver:n}):t.fromCDN(e,n).toJS(n)}static stringify(t,n,r){if(typeof n==`function`||Array.isArray(n)||n===null||n===void 0&&r!==void 0){let i=typeof n==`function`||Array.isArray(n)?n:void 0,a=b(r);if(i){let n=e.n(t,i);return n===void 0||n===e.w?void 0:e.r(n).toCDN(a===void 0?void 0:{indent:a})}return e.r(t).toCDN(a===void 0?void 0:{indent:a})}let i=n;if(i?.replacer){let n=e.n(t,i.replacer,i.extensions,i.undefinedOmits);if(n===void 0||n===e.w)return;let{replacer:r,...a}=i;return e.r(n,Object.keys(a).length>0?a:void 0).toCDN(i)}return e.r(t,i).toCDN(i)}static format(e,n){return t.fromCDN(e,n).toCDN(n)}};function _(e){let t=``,n=0;for(;n<e.length;){let r=e[n],i=e[n+1]??``;if(r===`-`&&i===`-`){n=v(e,n+2),t+=` `;continue}if(r===`#`){n=v(e,n+1),t+=` `;continue}if(r===`/`&&i===`/`){n=v(e,n+2),t+=` `;continue}if(r===`/`&&i===`*`){let r=e.indexOf(`*/`,n+2);if(r<0)throw SyntaxError(`Unterminated comment in hex dump`);t+=y(e.slice(n,r+2)),n=r+2;continue}if(r===`/`){let r=e.indexOf(`/`,n+1);if(r<0)throw SyntaxError(`Unterminated comment in hex dump`);t+=y(e.slice(n,r+1)),n=r+1;continue}t+=r,n++}return t}function v(e,t){let n=e.indexOf(`
+`,t);return n<0?e.length:n}function y(e){return e.replace(/[^\r\n]/g,` `)}function b(e){if(typeof e==`number`){let t=Math.floor(Math.min(10,Math.max(0,e)));return t===0?void 0:t}if(typeof e==`string`)return e.slice(0,10)||void 0}exports.CBOR=g,exports.default=g,exports.CBOR_OMIT=e.w,exports.CBOR_TAG=e.T,exports.MapEntries=e.t,exports.Null=e.E,exports.Simple=e.C,exports.Tag=e.D,exports.Undefined=e.O,exports.b32=o,exports.dt_as_Date=e.a,exports.float=p,exports.h32=s,exports.same=h;
 //# sourceMappingURL=index.cjs.map