CBOR codec

A bounded, deterministic CBOR codec (RFC 8949). CBOR is the binary serialization underneath COSE (RFC 9052), CWT, SCITT, and WebAuthn attestation — a foundational substrate the framework needs in-tree to build signed-statement primitives without a third-party parser. Like every parser the framework ships, it is bounded by default: a binary decoder is attack surface, so the defaults refuse the shapes a hostile encoder uses to exhaust memory or stack.

Decoder defences (all on by default): - maxDepth — nesting cap (refuses stack exhaustion). - maxBytes — total input cap; a declared string / array / map length that exceeds the remaining bytes is refused before any allocation (no length-prefix memory bomb). - Indefinite-length items refused (major-type additional-info 31) — they are a streaming-complexity / DoS vector and are forbidden by deterministic encoding (§4.2.1). - Reserved additional-info (28–30) refused. - Tags refused unless allowlisted (allowedTags) — a tag triggers semantic reprocessing; an un-vetted tag is a confused-deputy vector. - Duplicate map keys refused (§5.6 — ambiguous). - Trailing bytes refused — the buffer must be exactly one CBOR data item.

Encoder emits Deterministically Encoded CBOR (§4.2): shortest-form integer / length heads, definite lengths, map keys sorted by their encoded bytes (bytewise lexicographic), no indefinite-length items. Two semantically equal values encode to byte-identical output — the property COSE signatures and SCITT receipts depend on.

decode(buf, { requireDeterministic: true }) additionally asserts the input was itself deterministically encoded (it decodes, re-encodes, and refuses on any byte difference) — use it on the verify side of a signature where a non-canonical re-encoding would otherwise be a malleability vector.

Maps decode to a Map (CBOR map keys may be integers, not just strings — COSE header labels are integers); encode accepts a Map or a plain object (string keys). Tagged items are produced / consumed via b.cbor.Tag.

b.cbor.Tag(tag, value) #

A tagged CBOR item (major type 6) — tag is the non-negative integer tag number, value the tagged content. encode accepts a Tag; decode returns one when the tag number is in allowedTags. Construct with or without new.

var dt = new b.cbor.Tag(0, "2026-05-24T00:00:00Z");   // RFC 8949 §3.4.1
var bytes = b.cbor.encode(dt);
var back = b.cbor.decode(bytes, { allowedTags: [0] });
// → b.cbor.Tag { tag: 0, value: "2026-05-24T00:00:00Z" }

b.cbor.encode(value, opts?) #

{
  {
    allowNonFinite?: boolean,   // default false — NaN / Infinity refused
  }
}

Encode a JavaScript value to Deterministically Encoded CBOR (RFC 8949 §4.2): shortest-form integer / length heads, definite lengths, map keys sorted by their encoded bytes, no indefinite- length items. Two semantically-equal values produce byte-identical output. Accepts numbers (integers + float64), bigint (64-bit range), strings, Buffer / Uint8Array, arrays, Map or plain objects, b.cbor.Tag, and true / false / null / undefined.

b.cbor.encode({ b: 2, a: 1 }).toString("hex");   // → "a2616101616202" (keys sorted)

b.cbor.decode(buffer, opts?) #

{
  {
    maxDepth?:             number,    // default 64, ceiling 256 — nesting cap
    maxBytes?:             number,    // default 16 MiB, ceiling 64 MiB
    allowedTags?:          number[],  // default [] — tag numbers permitted
    requireDeterministic?: boolean,   // default false — assert canonical encoding
  }
}

Decode one CBOR data item from a buffer, bounded by default. Maps decode to a Map (CBOR keys may be integers); byte strings to Buffer. Refuses indefinite-length items, reserved additional-info (28–30), tags not in allowedTags, duplicate map keys, and trailing bytes.

var m = b.cbor.decode(bytes, { allowedTags: [0], requireDeterministic: true });

Last updated 2026-08-08T16:39:49.652Z by seeder.