@cbortech/cbor 0.26.0 → 0.26.2

package/dist/types.d.ts

@@ -147,6 +147,26 @@ export interface FromCBOROptions {
      * `CborTag` node.
      */
     extensions?: CborExtension[];
+    /**
+     * Override the default set of bundled application-oriented extensions
+     * (`dt`, `ip`, `cri`, `t1`, `b1`, `ilbs`, `ilts`, `float`).
+     *
+     * - omitted (default): use the standard bundled set.
+     * - array: replace the bundled set with exactly these extensions.
+     * - `false`: disable all of them.
+     *
+     * `bignum` (tags 2/3) and embedded-CBOR (tag 24) support are core RFC 8949
+     * representation features, not application-oriented extensions, and are
+     * always active regardless of this option.
+     *
+     * `dt`, `ip`, `t1`, and `b1` are mandatory-to-implement per §2.1 of
+     * draft-ietf-cbor-edn-literals-26; disabling them produces a decoder that
+     * no longer conforms to that recommendation. This is intended for
+     * allowlisting scenarios (see §7 Security considerations of the same
+     * draft) where an application wants explicit control over which
+     * extensions it accepts.
+     */
+    builtinExtensions?: CborExtension[] | false;
     /**
      * Controls how CBOR validity violations are handled.
      *
@@ -193,6 +213,11 @@ export interface FromHexDumpOptions {
      * returning a non-`undefined` value replaces the default `CborTag` node.
      */
     extensions?: CborExtension[];
+    /**
+     * Override the default set of bundled application-oriented extensions.
+     * Mirrors `FromCBOROptions.builtinExtensions`.
+     */
+    builtinExtensions?: CborExtension[] | false;
     /**
      * Controls how CBOR validity violations are handled during hex-dump decoding.
      * Mirrors `FromCBOROptions.strict`. With `strict: false`, trailing bytes after
@@ -256,6 +281,28 @@ export interface FromCDNOptions {
      * extension for the same prefix.
      */
     extensions?: CborExtension[];
+    /**
+     * Override the default set of bundled application-oriented extensions
+     * (`dt`, `ip`, `cri`, `t1`, `b1`, `ilbs`, `ilts`, `float`).
+     *
+     * - omitted (default): use the standard bundled set.
+     * - array: replace the bundled set with exactly these extensions.
+     * - `false`: disable all of them; app-string literals using their
+     *   prefixes then fall through to `unresolvedExtension` handling.
+     *
+     * `dt`, `ip`, `t1`, and `b1` are mandatory-to-implement per §2.1 of
+     * draft-ietf-cbor-edn-literals-26; disabling them produces a parser that
+     * no longer conforms to that recommendation. This is intended for
+     * allowlisting scenarios (see §7 Security considerations of the same
+     * draft) where an application wants explicit control over which
+     * extensions it accepts from untrusted CDN input.
+     *
+     * @example
+     * // Only accept dt/DT — everything else becomes an Unresolved (tag 999) node.
+     * import { CBOR, dt } from '@cbortech/cbor';
+     * CBOR.fromCDN(text, { builtinExtensions: [dt] });
+     */
+    builtinExtensions?: CborExtension[] | false;
     /**
      * How to handle unrecognised application-extension identifiers
      * (§4.1 of draft-ietf-cbor-edn-literals-25).
@@ -338,6 +385,14 @@ export interface FromJSOptions {
      * Extensions with `fromJS()` are given first chance to convert each value.
      */
     extensions?: CborExtension[];
+    /**
+     * Override the default set of bundled application-oriented extensions.
+     * Mirrors `FromCDNOptions.builtinExtensions`. Only affects builtins that
+     * implement `fromJS()` / `parseTag()` (none of the bundled application
+     * extensions implement `fromJS()` by default — use `dt_as_Date` via
+     * `extensions` for `Date` round-tripping).
+     */
+    builtinExtensions?: CborExtension[] | false;
     /**
      * How to encode integer-valued JS `number`s.
      * - `'int'`: encode as CborUint / CborNint

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cbortech/cbor",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Convert between CBOR, CDN (CBOR-EDN), and JavaScript values",
   "keywords": [
     "cbor",
@@ -104,16 +104,16 @@
   },
   "devDependencies": {
     "@types/node": "^24.13.2",
-    "@vitest/browser": "^4.1.9",
-    "@vitest/browser-playwright": "^4.1.9",
-    "@vitest/coverage-v8": "^4.1.9",
-    "@vitest/ui": "^4.1.9",
+    "@vitest/browser": "^4.1.10",
+    "@vitest/browser-playwright": "^4.1.10",
+    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/ui": "^4.1.10",
     "cross-env": "^10.1.0",
     "playwright": "^1.61.1",
     "prettier": "^3.9.4",
     "typescript": "^5.9.3",
-    "vite": "^8.1.2",
+    "vite": "^8.1.3",
     "vite-plugin-dts": "^4.5.4",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
   }
 }