@getbourdon/conformance 0.3.0 → 0.4.0

package/fixtures/cursor_vectors.json

@@ -0,0 +1,98 @@
+{
+  "_doc": "Sealed pagination-cursor parity vectors. Envelope: 'v1.' + urlsafe_b64(payload) + '.' + urlsafe_b64(mac); payload is compact JSON (field order offset,since,agent,access; separators ',',':'); both base64 legs padded urlsafe; mac = HMAC-SHA256(key, context + 0x00 + payload). All tokens here are sealed under the fixed TEST key below; production keys come from BOURDON_CURSOR_KEY or a per-process default.",
+  "envelope_version": "v1",
+  "context": "bourdon-cursor-v1",
+  "test_key": "bourdon-conformance-cursor-fixed-test-key",
+  "mint": [
+    {
+      "name": "offset_only",
+      "fields": {
+        "offset": 0
+      },
+      "token": "v1.eyJvZmZzZXQiOjB9.O23LHICHKQMnyCchY2JObFFfEUmxkXHiJJOgvtKzAes="
+    },
+    {
+      "name": "offset_paged",
+      "fields": {
+        "offset": 40
+      },
+      "token": "v1.eyJvZmZzZXQiOjQwfQ==.tHYiB6G2_nevaLGCHNs9msqGER3dQmkE8NbkYn4qqK8="
+    },
+    {
+      "name": "with_since",
+      "fields": {
+        "offset": 20,
+        "since": "2026-06-01"
+      },
+      "token": "v1.eyJvZmZzZXQiOjIwLCJzaW5jZSI6IjIwMjYtMDYtMDEifQ==.YedXuS8RgmB7QLM5dkL6k1lSeBD7RrXxowshIw4ZKu0="
+    },
+    {
+      "name": "with_since_agent",
+      "fields": {
+        "offset": 3,
+        "since": "2026-06-01",
+        "agent": "claude-code"
+      },
+      "token": "v1.eyJvZmZzZXQiOjMsInNpbmNlIjoiMjAyNi0wNi0wMSIsImFnZW50IjoiY2xhdWRlLWNvZGUifQ==.18KRIPGR6SKF2wkzBTb9u7ZwK7Jfe61bZuSrlVG--cU="
+    },
+    {
+      "name": "fully_sealed",
+      "fields": {
+        "offset": 7,
+        "since": "2026-01-31",
+        "agent": "codex",
+        "access": "team"
+      },
+      "token": "v1.eyJvZmZzZXQiOjcsInNpbmNlIjoiMjAyNi0wMS0zMSIsImFnZW50IjoiY29kZXgiLCJhY2Nlc3MiOiJ0ZWFtIn0=.pfsyw9cnfF-efyMDQbDXS0LDWXz2kDqCJ242O9K9K3M="
+    },
+    {
+      "name": "boundary_offset",
+      "fields": {
+        "offset": 100000
+      },
+      "token": "v1.eyJvZmZzZXQiOjEwMDAwMH0=.m5lcihdSLILlvCU5wSpDqRxt48BO3J5yjJOjyBi-LFA="
+    }
+  ],
+  "reject": [
+    {
+      "name": "tampered_payload",
+      "token": "v1.eyJvZmZzZXQiOjB9.tHYiB6G2_nevaLGCHNs9msqGER3dQmkE8NbkYn4qqK8=",
+      "reason": "payload altered after sealing"
+    },
+    {
+      "name": "truncated_seal",
+      "token": "v1.eyJvZmZzZXQiOjQwfQ==.tHYiB6G2",
+      "reason": "seal leg truncated"
+    },
+    {
+      "name": "wrong_key",
+      "token": "v1.eyJvZmZzZXQiOjF9.MTVm4fQjNF6apa7Xtn1hmQB368lDgU757p8EYweNSZI=",
+      "reason": "sealed under a different key"
+    },
+    {
+      "name": "unknown_version",
+      "token": "v2.eyJvZmZzZXQiOjQwfQ==.tHYiB6G2_nevaLGCHNs9msqGER3dQmkE8NbkYn4qqK8=",
+      "reason": "unrecognized envelope version"
+    },
+    {
+      "name": "unsealed_legacy",
+      "token": "eyJvZmZzZXQiOjQwfQ==",
+      "reason": "pre-seal token format has no acceptance path"
+    },
+    {
+      "name": "sealed_unknown_field",
+      "token": "v1.eyJvZmZzZXQiOjAsImV2aWwiOnRydWV9.InPILvmi50rNO9SwE5Iv0nyl_yrWJYtow38xWL2F3fA=",
+      "reason": "seal verifies but the payload carries an unknown field"
+    },
+    {
+      "name": "sealed_negative_offset",
+      "token": "v1.eyJvZmZzZXQiOi0xfQ==.TeSILWl7vbNY75xoxmqEv0SLqaAGv_99Wv5fzLq3GL0=",
+      "reason": "seal verifies but the offset is negative"
+    },
+    {
+      "name": "sealed_offset_over_bound",
+      "token": "v1.eyJvZmZzZXQiOjEwMDAwMX0=.hWPH08t5lNmBLzAVG63azOgFJXxCVw2rJtQX9Xn5I1E=",
+      "reason": "seal verifies but the offset exceeds the pagination bound"
+    }
+  ]
+}

package/fixtures/manifest.json

@@ -1,6 +1,6 @@
 {
   "_doc": "Index of cross-impl parity fixtures. conformance_version bumps on any fixture change (patch=added cases, minor=new family, major=changed expected-output = a reviewed behavior change). Python is the oracle; this file is generated by tools/gen_conformance.py.",
-  "conformance_version": "2.1.0",
+  "conformance_version": "2.2.0",
   "produced_against": {
     "bourdon_version": "0.13.0"
   },
@@ -115,6 +115,11 @@
       "sha256": "9753ad1fd4a092bdf4110b3b24576f2bfe7001d6d6758ef55047ee5da851e25c",
       "producer": "tools/gen_conformance.py::tier_matrix"
     },
+    {
+      "path": "cursor_vectors.json",
+      "sha256": "433e7a1c8f87f5544b8a0a3a8df1be89b6f53199f0295a458564bf53a9bf8029",
+      "producer": "tools/gen_conformance.py::cursor_vectors"
+    },
     {
       "path": "on_disk/federation.yaml",
       "sha256": "7a3795961d369ec57a6caa6af15e250d016c98e883077e82d7d103bd0c016cfe",
@@ -327,7 +332,7 @@
     },
     {
       "path": "mcp_snapshots/_normalizer.json",
-      "sha256": "7b9eef3ee22267274657117243086ea52403d33ceb2509f7be314d025fd0872b",
+      "sha256": "438071a3b1de83fb23083fd9ad2d4a734a27032d84faabf9d5772f14779a1721",
       "producer": "tools/gen_conformance.py::mcp_snapshots"
     },
     {

package/fixtures/mcp_snapshots/_normalizer.json

@@ -84,7 +84,7 @@
       }
     },
     {
-      "_doc": "decodes a base64 next_cursor to its {offset} payload; null cursor drops",
+      "_doc": "decodes a sealed next_cursor to its {offset} payload (token sealed under the conformance test key from cursor_vectors.json; replaying this case requires injecting that key); null cursor drops",
       "normalized": {
         "has_more": true,
         "next_cursor": {
@@ -93,7 +93,7 @@
       },
       "raw": {
         "has_more": true,
-        "next_cursor": "eyJvZmZzZXQiOjJ9"
+        "next_cursor": "v1.eyJvZmZzZXQiOjJ9.Kq1CqjJ2bx9GKxUve6An2fcBMxcGu9Ledn3C1V_6oZI="
       }
     },
     {

package/fixtures.pin.json

@@ -1,5 +1,5 @@
 {
   "_doc": "The recorded fixture pin. CI and the package tests assert the vendored fixtures/manifest.json hashes to exactly this value, so the fixture set in any build is provably the reviewed one. Refresh via the re-pin ritual in README.md.",
-  "conformance_version": "2.1.0",
-  "manifest_sha256": "f854d2a75d4616554e97e5c746f5ca9ae30ff23ed21a6d023424922e2e70813e"
+  "conformance_version": "2.2.0",
+  "manifest_sha256": "4854fbdf12003fc8f7bc198fa98e83636293d0bfbee91116335614cd1abc0518"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getbourdon/conformance",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Language-neutral cross-implementation parity fixtures for Bourdon. Python (pip install bourdon) is the oracle; the @getbourdon/* TypeScript mirror asserts against these exact bytes.",
   "license": "Apache-2.0",
   "type": "module",