@getbourdon/conformance 0.8.0 → 0.10.0-rc.2

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\nimport { createHash } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * Typed loaders for the language-neutral parity fixtures produced by the Python\n * oracle (`~/repos/bourdon/tools/gen_conformance.py`). Python is the source of\n * truth; the @getbourdon/* TypeScript mirror asserts against these exact bytes.\n *\n * Resolution order:\n *   1. `BOURDON_CONFORMANCE_DIR` env var — the oracle checkout (parity tests +\n *      oracle dev use this; highest priority so a build always asserts against\n *      the live oracle).\n *   2. the fixtures BUNDLED in this package (`<pkg>/fixtures`, shipped in the\n *      tarball) — what an installed `@getbourdon/conformance` consumer gets.\n *   3. the sibling Python checkout `../../bourdon/conformance` — dev fallback.\n *\n * The bundled copy is a vendored snapshot refreshed from the oracle by\n * `pnpm --filter @getbourdon/conformance sync-fixtures` (and in the release\n * workflow before publish), so the published package is self-contained.\n */\n\n// `import.meta.url` in ESM; esbuild empties it in the CJS bundle, where the\n// native `__dirname` global is the real directory — fall back to it.\ndeclare const __dirname: string | undefined;\nfunction moduleDir(): string {\n  if (typeof import.meta !== \"undefined\" && import.meta.url) {\n    return dirname(fileURLToPath(import.meta.url));\n  }\n  return typeof __dirname !== \"undefined\" ? __dirname : process.cwd();\n}\n\nexport interface RedactionSecretCase {\n  /** Joined at load (`assembleSecret`) so no contiguous secret literal lands in git. */\n  fragments: string[];\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBenignCase {\n  text: string;\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBattery {\n  redacted_sentinel: string;\n  benign_limit: number;\n  secrets: RedactionSecretCase[];\n  benign: RedactionBenignCase[];\n}\n\nexport interface ConformanceFixtureMeta {\n  path: string;\n  sha256: string;\n  producer: string;\n}\n\nexport interface ConformanceManifest {\n  conformance_version: string;\n  produced_against: { bourdon_version: string };\n  fixtures: ConformanceFixtureMeta[];\n}\n\nexport function conformanceDir(): string {\n  const override = process.env.BOURDON_CONFORMANCE_DIR;\n  if (override) return override;\n  // Bundled snapshot: <pkg>/fixtures, one level up from src/ or dist/.\n  const bundled = resolve(moduleDir(), \"..\", \"fixtures\");\n  if (existsSync(resolve(bundled, \"manifest.json\"))) return bundled;\n  // Dev fallback: the sibling Python oracle checkout.\n  return resolve(process.cwd(), \"..\", \"..\", \"bourdon\", \"conformance\");\n}\n\nfunction loadJson<T>(name: string): T {\n  return JSON.parse(readFileSync(resolve(conformanceDir(), name), \"utf8\")) as T;\n}\n\nexport function loadManifest(): ConformanceManifest {\n  return loadJson<ConformanceManifest>(\"manifest.json\");\n}\n\nexport interface FixturePin {\n  conformance_version: string;\n  manifest_sha256: string;\n}\n\n/** The recorded fixture pin committed beside this package: which contract\n * version the vendored snapshot is, and the sha256 the manifest must hash to. */\nexport function loadPin(): FixturePin {\n  return JSON.parse(\n    readFileSync(resolve(moduleDir(), \"..\", \"fixtures.pin.json\"), \"utf8\"),\n  ) as FixturePin;\n}\n\n/** sha256 hex of one file's raw bytes. */\nexport function sha256File(path: string): string {\n  return createHash(\"sha256\").update(readFileSync(path)).digest(\"hex\");\n}\n\nexport interface FixtureMismatch {\n  path: string;\n  expected: string;\n  actual: string;\n}\n\n/** Verify every fixture in `dir` against the sha256 its manifest stamps.\n * Returns the mismatches — an empty array is the only passing result. The\n * same routine backs the parity gate AND its mutation test, so the check\n * that guards releases is itself provably able to fail. */\nexport function verifyFixtureHashes(dir: string = conformanceDir()): FixtureMismatch[] {\n  const manifest = JSON.parse(\n    readFileSync(resolve(dir, \"manifest.json\"), \"utf8\"),\n  ) as ConformanceManifest;\n  const mismatches: FixtureMismatch[] = [];\n  for (const fixture of manifest.fixtures) {\n    const actual = sha256File(resolve(dir, fixture.path));\n    if (actual !== fixture.sha256) {\n      mismatches.push({ path: fixture.path, expected: fixture.sha256, actual });\n    }\n  }\n  return mismatches;\n}\n\nexport function loadRedactionBattery(): RedactionBattery {\n  return loadJson<RedactionBattery>(\"redaction_battery.json\");\n}\n\n/** Reconstruct a secret case's runtime string from its fragments. */\nexport function assembleSecret(secret: RedactionSecretCase): string {\n  return secret.fragments.join(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,yBAA2B;AAC3B,qBAAyC;AACzC,uBAAiC;AACjC,sBAA8B;AAJ9B;AA2BA,SAAS,YAAoB;AAC3B,MAAI,OAAO,gBAAgB,eAAe,YAAY,KAAK;AACzD,eAAO,8BAAQ,+BAAc,YAAY,GAAG,CAAC;AAAA,EAC/C;AACA,SAAO,OAAO,cAAc,cAAc,YAAY,QAAQ,IAAI;AACpE;AAkCO,SAAS,iBAAyB;AACvC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO;AAErB,QAAM,cAAU,0BAAQ,UAAU,GAAG,MAAM,UAAU;AACrD,UAAI,+BAAW,0BAAQ,SAAS,eAAe,CAAC,EAAG,QAAO;AAE1D,aAAO,0BAAQ,QAAQ,IAAI,GAAG,MAAM,MAAM,WAAW,aAAa;AACpE;AAEA,SAAS,SAAY,MAAiB;AACpC,SAAO,KAAK,UAAM,iCAAa,0BAAQ,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AACzE;AAEO,SAAS,eAAoC;AAClD,SAAO,SAA8B,eAAe;AACtD;AASO,SAAS,UAAsB;AACpC,SAAO,KAAK;AAAA,QACV,iCAAa,0BAAQ,UAAU,GAAG,MAAM,mBAAmB,GAAG,MAAM;AAAA,EACtE;AACF;AAGO,SAAS,WAAW,MAAsB;AAC/C,aAAO,+BAAW,QAAQ,EAAE,WAAO,6BAAa,IAAI,CAAC,EAAE,OAAO,KAAK;AACrE;AAYO,SAAS,oBAAoB,MAAc,eAAe,GAAsB;AACrF,QAAM,WAAW,KAAK;AAAA,QACpB,iCAAa,0BAAQ,KAAK,eAAe,GAAG,MAAM;AAAA,EACpD;AACA,QAAM,aAAgC,CAAC;AACvC,aAAW,WAAW,SAAS,UAAU;AACvC,UAAM,SAAS,eAAW,0BAAQ,KAAK,QAAQ,IAAI,CAAC;AACpD,QAAI,WAAW,QAAQ,QAAQ;AAC7B,iBAAW,KAAK,EAAE,MAAM,QAAQ,MAAM,UAAU,QAAQ,QAAQ,OAAO,CAAC;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,uBAAyC;AACvD,SAAO,SAA2B,wBAAwB;AAC5D;AAGO,SAAS,eAAe,QAAqC;AAClE,SAAO,OAAO,UAAU,KAAK,EAAE;AACjC;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\nimport { createHash } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * Typed loaders for the language-neutral parity fixtures produced by the Python\n * oracle (`~/repos/bourdon/tools/gen_conformance.py`). Python is the source of\n * truth; the @getbourdon/* TypeScript mirror asserts against these exact bytes.\n *\n * Resolution order:\n *   1. `BOURDON_CONFORMANCE_DIR` env var — the oracle checkout (parity tests +\n *      oracle dev use this; highest priority so a build always asserts against\n *      the live oracle).\n *   2. the fixtures BUNDLED in this package (`<pkg>/fixtures`, shipped in the\n *      tarball) — what an installed `@getbourdon/conformance` consumer gets.\n *   3. the sibling Python checkout `../../bourdon/conformance` — dev fallback.\n *\n * The bundled copy is a vendored snapshot refreshed from the oracle by\n * `pnpm --filter @getbourdon/conformance sync-fixtures` (and in the release\n * workflow before publish), so the published package is self-contained.\n */\n\n// `import.meta.url` in ESM; esbuild empties it in the CJS bundle, where the\n// native `__dirname` global is the real directory — fall back to it.\ndeclare const __dirname: string | undefined;\nfunction moduleDir(): string {\n  if (typeof import.meta !== \"undefined\" && import.meta.url) {\n    return dirname(fileURLToPath(import.meta.url));\n  }\n  return typeof __dirname !== \"undefined\" ? __dirname : process.cwd();\n}\n\nexport interface RedactionSecretCase {\n  /** Joined at load (`assembleSecret`) so no contiguous secret literal lands in git. */\n  fragments: string[];\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBenignCase {\n  text: string;\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBattery {\n  redacted_sentinel: string;\n  benign_limit: number;\n  secrets: RedactionSecretCase[];\n  benign: RedactionBenignCase[];\n  truncation_cases: { text: string; limit: number; expect_redacted: string }[];\n}\n\nexport interface ConformanceFixtureMeta {\n  path: string;\n  sha256: string;\n  producer: string;\n}\n\nexport interface ConformanceManifest {\n  conformance_version: string;\n  produced_against: { bourdon_version: string };\n  fixtures: ConformanceFixtureMeta[];\n}\n\nexport function conformanceDir(): string {\n  const override = process.env.BOURDON_CONFORMANCE_DIR;\n  if (override) return override;\n  // Bundled snapshot: <pkg>/fixtures, one level up from src/ or dist/.\n  const bundled = resolve(moduleDir(), \"..\", \"fixtures\");\n  if (existsSync(resolve(bundled, \"manifest.json\"))) return bundled;\n  // Dev fallback: the sibling Python oracle checkout.\n  return resolve(process.cwd(), \"..\", \"..\", \"bourdon\", \"conformance\");\n}\n\nfunction loadJson<T>(name: string): T {\n  return JSON.parse(readFileSync(resolve(conformanceDir(), name), \"utf8\")) as T;\n}\n\nexport function loadManifest(): ConformanceManifest {\n  return loadJson<ConformanceManifest>(\"manifest.json\");\n}\n\nexport interface FixturePin {\n  conformance_version: string;\n  manifest_sha256: string;\n}\n\n/** The recorded fixture pin committed beside this package: which contract\n * version the vendored snapshot is, and the sha256 the manifest must hash to. */\nexport function loadPin(): FixturePin {\n  return JSON.parse(\n    readFileSync(resolve(moduleDir(), \"..\", \"fixtures.pin.json\"), \"utf8\"),\n  ) as FixturePin;\n}\n\n/** sha256 hex of one file's raw bytes. */\nexport function sha256File(path: string): string {\n  return createHash(\"sha256\").update(readFileSync(path)).digest(\"hex\");\n}\n\nexport interface FixtureMismatch {\n  path: string;\n  expected: string;\n  actual: string;\n}\n\n/** Verify every fixture in `dir` against the sha256 its manifest stamps.\n * Returns the mismatches — an empty array is the only passing result. The\n * same routine backs the parity gate AND its mutation test, so the check\n * that guards releases is itself provably able to fail. */\nexport function verifyFixtureHashes(dir: string = conformanceDir()): FixtureMismatch[] {\n  const manifest = JSON.parse(\n    readFileSync(resolve(dir, \"manifest.json\"), \"utf8\"),\n  ) as ConformanceManifest;\n  const mismatches: FixtureMismatch[] = [];\n  for (const fixture of manifest.fixtures) {\n    const actual = sha256File(resolve(dir, fixture.path));\n    if (actual !== fixture.sha256) {\n      mismatches.push({ path: fixture.path, expected: fixture.sha256, actual });\n    }\n  }\n  return mismatches;\n}\n\nexport function loadRedactionBattery(): RedactionBattery {\n  return loadJson<RedactionBattery>(\"redaction_battery.json\");\n}\n\n/** Reconstruct a secret case's runtime string from its fragments. */\nexport function assembleSecret(secret: RedactionSecretCase): string {\n  return secret.fragments.join(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,yBAA2B;AAC3B,qBAAyC;AACzC,uBAAiC;AACjC,sBAA8B;AAJ9B;AA2BA,SAAS,YAAoB;AAC3B,MAAI,OAAO,gBAAgB,eAAe,YAAY,KAAK;AACzD,eAAO,8BAAQ,+BAAc,YAAY,GAAG,CAAC;AAAA,EAC/C;AACA,SAAO,OAAO,cAAc,cAAc,YAAY,QAAQ,IAAI;AACpE;AAmCO,SAAS,iBAAyB;AACvC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO;AAErB,QAAM,cAAU,0BAAQ,UAAU,GAAG,MAAM,UAAU;AACrD,UAAI,+BAAW,0BAAQ,SAAS,eAAe,CAAC,EAAG,QAAO;AAE1D,aAAO,0BAAQ,QAAQ,IAAI,GAAG,MAAM,MAAM,WAAW,aAAa;AACpE;AAEA,SAAS,SAAY,MAAiB;AACpC,SAAO,KAAK,UAAM,iCAAa,0BAAQ,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AACzE;AAEO,SAAS,eAAoC;AAClD,SAAO,SAA8B,eAAe;AACtD;AASO,SAAS,UAAsB;AACpC,SAAO,KAAK;AAAA,QACV,iCAAa,0BAAQ,UAAU,GAAG,MAAM,mBAAmB,GAAG,MAAM;AAAA,EACtE;AACF;AAGO,SAAS,WAAW,MAAsB;AAC/C,aAAO,+BAAW,QAAQ,EAAE,WAAO,6BAAa,IAAI,CAAC,EAAE,OAAO,KAAK;AACrE;AAYO,SAAS,oBAAoB,MAAc,eAAe,GAAsB;AACrF,QAAM,WAAW,KAAK;AAAA,QACpB,iCAAa,0BAAQ,KAAK,eAAe,GAAG,MAAM;AAAA,EACpD;AACA,QAAM,aAAgC,CAAC;AACvC,aAAW,WAAW,SAAS,UAAU;AACvC,UAAM,SAAS,eAAW,0BAAQ,KAAK,QAAQ,IAAI,CAAC;AACpD,QAAI,WAAW,QAAQ,QAAQ;AAC7B,iBAAW,KAAK,EAAE,MAAM,QAAQ,MAAM,UAAU,QAAQ,QAAQ,OAAO,CAAC;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,uBAAyC;AACvD,SAAO,SAA2B,wBAAwB;AAC5D;AAGO,SAAS,eAAe,QAAqC;AAClE,SAAO,OAAO,UAAU,KAAK,EAAE;AACjC;","names":[]}

package/dist/index.d.cts

@@ -14,6 +14,11 @@ interface RedactionBattery {
     benign_limit: number;
     secrets: RedactionSecretCase[];
     benign: RedactionBenignCase[];
+    truncation_cases: {
+        text: string;
+        limit: number;
+        expect_redacted: string;
+    }[];
 }
 interface ConformanceFixtureMeta {
     path: string;

package/dist/index.d.ts

@@ -14,6 +14,11 @@ export interface RedactionBattery {
     benign_limit: number;
     secrets: RedactionSecretCase[];
     benign: RedactionBenignCase[];
+    truncation_cases: {
+        text: string;
+        limit: number;
+        expect_redacted: string;
+    }[];
 }
 export interface ConformanceFixtureMeta {
     path: string;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\nimport { createHash } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * Typed loaders for the language-neutral parity fixtures produced by the Python\n * oracle (`~/repos/bourdon/tools/gen_conformance.py`). Python is the source of\n * truth; the @getbourdon/* TypeScript mirror asserts against these exact bytes.\n *\n * Resolution order:\n *   1. `BOURDON_CONFORMANCE_DIR` env var — the oracle checkout (parity tests +\n *      oracle dev use this; highest priority so a build always asserts against\n *      the live oracle).\n *   2. the fixtures BUNDLED in this package (`<pkg>/fixtures`, shipped in the\n *      tarball) — what an installed `@getbourdon/conformance` consumer gets.\n *   3. the sibling Python checkout `../../bourdon/conformance` — dev fallback.\n *\n * The bundled copy is a vendored snapshot refreshed from the oracle by\n * `pnpm --filter @getbourdon/conformance sync-fixtures` (and in the release\n * workflow before publish), so the published package is self-contained.\n */\n\n// `import.meta.url` in ESM; esbuild empties it in the CJS bundle, where the\n// native `__dirname` global is the real directory — fall back to it.\ndeclare const __dirname: string | undefined;\nfunction moduleDir(): string {\n  if (typeof import.meta !== \"undefined\" && import.meta.url) {\n    return dirname(fileURLToPath(import.meta.url));\n  }\n  return typeof __dirname !== \"undefined\" ? __dirname : process.cwd();\n}\n\nexport interface RedactionSecretCase {\n  /** Joined at load (`assembleSecret`) so no contiguous secret literal lands in git. */\n  fragments: string[];\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBenignCase {\n  text: string;\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBattery {\n  redacted_sentinel: string;\n  benign_limit: number;\n  secrets: RedactionSecretCase[];\n  benign: RedactionBenignCase[];\n}\n\nexport interface ConformanceFixtureMeta {\n  path: string;\n  sha256: string;\n  producer: string;\n}\n\nexport interface ConformanceManifest {\n  conformance_version: string;\n  produced_against: { bourdon_version: string };\n  fixtures: ConformanceFixtureMeta[];\n}\n\nexport function conformanceDir(): string {\n  const override = process.env.BOURDON_CONFORMANCE_DIR;\n  if (override) return override;\n  // Bundled snapshot: <pkg>/fixtures, one level up from src/ or dist/.\n  const bundled = resolve(moduleDir(), \"..\", \"fixtures\");\n  if (existsSync(resolve(bundled, \"manifest.json\"))) return bundled;\n  // Dev fallback: the sibling Python oracle checkout.\n  return resolve(process.cwd(), \"..\", \"..\", \"bourdon\", \"conformance\");\n}\n\nfunction loadJson<T>(name: string): T {\n  return JSON.parse(readFileSync(resolve(conformanceDir(), name), \"utf8\")) as T;\n}\n\nexport function loadManifest(): ConformanceManifest {\n  return loadJson<ConformanceManifest>(\"manifest.json\");\n}\n\nexport interface FixturePin {\n  conformance_version: string;\n  manifest_sha256: string;\n}\n\n/** The recorded fixture pin committed beside this package: which contract\n * version the vendored snapshot is, and the sha256 the manifest must hash to. */\nexport function loadPin(): FixturePin {\n  return JSON.parse(\n    readFileSync(resolve(moduleDir(), \"..\", \"fixtures.pin.json\"), \"utf8\"),\n  ) as FixturePin;\n}\n\n/** sha256 hex of one file's raw bytes. */\nexport function sha256File(path: string): string {\n  return createHash(\"sha256\").update(readFileSync(path)).digest(\"hex\");\n}\n\nexport interface FixtureMismatch {\n  path: string;\n  expected: string;\n  actual: string;\n}\n\n/** Verify every fixture in `dir` against the sha256 its manifest stamps.\n * Returns the mismatches — an empty array is the only passing result. The\n * same routine backs the parity gate AND its mutation test, so the check\n * that guards releases is itself provably able to fail. */\nexport function verifyFixtureHashes(dir: string = conformanceDir()): FixtureMismatch[] {\n  const manifest = JSON.parse(\n    readFileSync(resolve(dir, \"manifest.json\"), \"utf8\"),\n  ) as ConformanceManifest;\n  const mismatches: FixtureMismatch[] = [];\n  for (const fixture of manifest.fixtures) {\n    const actual = sha256File(resolve(dir, fixture.path));\n    if (actual !== fixture.sha256) {\n      mismatches.push({ path: fixture.path, expected: fixture.sha256, actual });\n    }\n  }\n  return mismatches;\n}\n\nexport function loadRedactionBattery(): RedactionBattery {\n  return loadJson<RedactionBattery>(\"redaction_battery.json\");\n}\n\n/** Reconstruct a secret case's runtime string from its fragments. */\nexport function assembleSecret(secret: RedactionSecretCase): string {\n  return secret.fragments.join(\"\");\n}\n"],"mappings":";AACA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,oBAAoB;AACzC,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;AAuB9B,SAAS,YAAoB;AAC3B,MAAI,OAAO,gBAAgB,eAAe,YAAY,KAAK;AACzD,WAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AAAA,EAC/C;AACA,SAAO,OAAO,cAAc,cAAc,YAAY,QAAQ,IAAI;AACpE;AAkCO,SAAS,iBAAyB;AACvC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO;AAErB,QAAM,UAAU,QAAQ,UAAU,GAAG,MAAM,UAAU;AACrD,MAAI,WAAW,QAAQ,SAAS,eAAe,CAAC,EAAG,QAAO;AAE1D,SAAO,QAAQ,QAAQ,IAAI,GAAG,MAAM,MAAM,WAAW,aAAa;AACpE;AAEA,SAAS,SAAY,MAAiB;AACpC,SAAO,KAAK,MAAM,aAAa,QAAQ,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AACzE;AAEO,SAAS,eAAoC;AAClD,SAAO,SAA8B,eAAe;AACtD;AASO,SAAS,UAAsB;AACpC,SAAO,KAAK;AAAA,IACV,aAAa,QAAQ,UAAU,GAAG,MAAM,mBAAmB,GAAG,MAAM;AAAA,EACtE;AACF;AAGO,SAAS,WAAW,MAAsB;AAC/C,SAAO,WAAW,QAAQ,EAAE,OAAO,aAAa,IAAI,CAAC,EAAE,OAAO,KAAK;AACrE;AAYO,SAAS,oBAAoB,MAAc,eAAe,GAAsB;AACrF,QAAM,WAAW,KAAK;AAAA,IACpB,aAAa,QAAQ,KAAK,eAAe,GAAG,MAAM;AAAA,EACpD;AACA,QAAM,aAAgC,CAAC;AACvC,aAAW,WAAW,SAAS,UAAU;AACvC,UAAM,SAAS,WAAW,QAAQ,KAAK,QAAQ,IAAI,CAAC;AACpD,QAAI,WAAW,QAAQ,QAAQ;AAC7B,iBAAW,KAAK,EAAE,MAAM,QAAQ,MAAM,UAAU,QAAQ,QAAQ,OAAO,CAAC;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,uBAAyC;AACvD,SAAO,SAA2B,wBAAwB;AAC5D;AAGO,SAAS,eAAe,QAAqC;AAClE,SAAO,OAAO,UAAU,KAAK,EAAE;AACjC;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\nimport { createHash } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * Typed loaders for the language-neutral parity fixtures produced by the Python\n * oracle (`~/repos/bourdon/tools/gen_conformance.py`). Python is the source of\n * truth; the @getbourdon/* TypeScript mirror asserts against these exact bytes.\n *\n * Resolution order:\n *   1. `BOURDON_CONFORMANCE_DIR` env var — the oracle checkout (parity tests +\n *      oracle dev use this; highest priority so a build always asserts against\n *      the live oracle).\n *   2. the fixtures BUNDLED in this package (`<pkg>/fixtures`, shipped in the\n *      tarball) — what an installed `@getbourdon/conformance` consumer gets.\n *   3. the sibling Python checkout `../../bourdon/conformance` — dev fallback.\n *\n * The bundled copy is a vendored snapshot refreshed from the oracle by\n * `pnpm --filter @getbourdon/conformance sync-fixtures` (and in the release\n * workflow before publish), so the published package is self-contained.\n */\n\n// `import.meta.url` in ESM; esbuild empties it in the CJS bundle, where the\n// native `__dirname` global is the real directory — fall back to it.\ndeclare const __dirname: string | undefined;\nfunction moduleDir(): string {\n  if (typeof import.meta !== \"undefined\" && import.meta.url) {\n    return dirname(fileURLToPath(import.meta.url));\n  }\n  return typeof __dirname !== \"undefined\" ? __dirname : process.cwd();\n}\n\nexport interface RedactionSecretCase {\n  /** Joined at load (`assembleSecret`) so no contiguous secret literal lands in git. */\n  fragments: string[];\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBenignCase {\n  text: string;\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBattery {\n  redacted_sentinel: string;\n  benign_limit: number;\n  secrets: RedactionSecretCase[];\n  benign: RedactionBenignCase[];\n  truncation_cases: { text: string; limit: number; expect_redacted: string }[];\n}\n\nexport interface ConformanceFixtureMeta {\n  path: string;\n  sha256: string;\n  producer: string;\n}\n\nexport interface ConformanceManifest {\n  conformance_version: string;\n  produced_against: { bourdon_version: string };\n  fixtures: ConformanceFixtureMeta[];\n}\n\nexport function conformanceDir(): string {\n  const override = process.env.BOURDON_CONFORMANCE_DIR;\n  if (override) return override;\n  // Bundled snapshot: <pkg>/fixtures, one level up from src/ or dist/.\n  const bundled = resolve(moduleDir(), \"..\", \"fixtures\");\n  if (existsSync(resolve(bundled, \"manifest.json\"))) return bundled;\n  // Dev fallback: the sibling Python oracle checkout.\n  return resolve(process.cwd(), \"..\", \"..\", \"bourdon\", \"conformance\");\n}\n\nfunction loadJson<T>(name: string): T {\n  return JSON.parse(readFileSync(resolve(conformanceDir(), name), \"utf8\")) as T;\n}\n\nexport function loadManifest(): ConformanceManifest {\n  return loadJson<ConformanceManifest>(\"manifest.json\");\n}\n\nexport interface FixturePin {\n  conformance_version: string;\n  manifest_sha256: string;\n}\n\n/** The recorded fixture pin committed beside this package: which contract\n * version the vendored snapshot is, and the sha256 the manifest must hash to. */\nexport function loadPin(): FixturePin {\n  return JSON.parse(\n    readFileSync(resolve(moduleDir(), \"..\", \"fixtures.pin.json\"), \"utf8\"),\n  ) as FixturePin;\n}\n\n/** sha256 hex of one file's raw bytes. */\nexport function sha256File(path: string): string {\n  return createHash(\"sha256\").update(readFileSync(path)).digest(\"hex\");\n}\n\nexport interface FixtureMismatch {\n  path: string;\n  expected: string;\n  actual: string;\n}\n\n/** Verify every fixture in `dir` against the sha256 its manifest stamps.\n * Returns the mismatches — an empty array is the only passing result. The\n * same routine backs the parity gate AND its mutation test, so the check\n * that guards releases is itself provably able to fail. */\nexport function verifyFixtureHashes(dir: string = conformanceDir()): FixtureMismatch[] {\n  const manifest = JSON.parse(\n    readFileSync(resolve(dir, \"manifest.json\"), \"utf8\"),\n  ) as ConformanceManifest;\n  const mismatches: FixtureMismatch[] = [];\n  for (const fixture of manifest.fixtures) {\n    const actual = sha256File(resolve(dir, fixture.path));\n    if (actual !== fixture.sha256) {\n      mismatches.push({ path: fixture.path, expected: fixture.sha256, actual });\n    }\n  }\n  return mismatches;\n}\n\nexport function loadRedactionBattery(): RedactionBattery {\n  return loadJson<RedactionBattery>(\"redaction_battery.json\");\n}\n\n/** Reconstruct a secret case's runtime string from its fragments. */\nexport function assembleSecret(secret: RedactionSecretCase): string {\n  return secret.fragments.join(\"\");\n}\n"],"mappings":";AACA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,oBAAoB;AACzC,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;AAuB9B,SAAS,YAAoB;AAC3B,MAAI,OAAO,gBAAgB,eAAe,YAAY,KAAK;AACzD,WAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AAAA,EAC/C;AACA,SAAO,OAAO,cAAc,cAAc,YAAY,QAAQ,IAAI;AACpE;AAmCO,SAAS,iBAAyB;AACvC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO;AAErB,QAAM,UAAU,QAAQ,UAAU,GAAG,MAAM,UAAU;AACrD,MAAI,WAAW,QAAQ,SAAS,eAAe,CAAC,EAAG,QAAO;AAE1D,SAAO,QAAQ,QAAQ,IAAI,GAAG,MAAM,MAAM,WAAW,aAAa;AACpE;AAEA,SAAS,SAAY,MAAiB;AACpC,SAAO,KAAK,MAAM,aAAa,QAAQ,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AACzE;AAEO,SAAS,eAAoC;AAClD,SAAO,SAA8B,eAAe;AACtD;AASO,SAAS,UAAsB;AACpC,SAAO,KAAK;AAAA,IACV,aAAa,QAAQ,UAAU,GAAG,MAAM,mBAAmB,GAAG,MAAM;AAAA,EACtE;AACF;AAGO,SAAS,WAAW,MAAsB;AAC/C,SAAO,WAAW,QAAQ,EAAE,OAAO,aAAa,IAAI,CAAC,EAAE,OAAO,KAAK;AACrE;AAYO,SAAS,oBAAoB,MAAc,eAAe,GAAsB;AACrF,QAAM,WAAW,KAAK;AAAA,IACpB,aAAa,QAAQ,KAAK,eAAe,GAAG,MAAM;AAAA,EACpD;AACA,QAAM,aAAgC,CAAC;AACvC,aAAW,WAAW,SAAS,UAAU;AACvC,UAAM,SAAS,WAAW,QAAQ,KAAK,QAAQ,IAAI,CAAC;AACpD,QAAI,WAAW,QAAQ,QAAQ;AAC7B,iBAAW,KAAK,EAAE,MAAM,QAAQ,MAAM,UAAU,QAAQ,QAAQ,OAAO,CAAC;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,uBAAyC;AACvD,SAAO,SAA2B,wBAAwB;AAC5D;AAGO,SAAS,eAAe,QAAqC;AAClE,SAAO,OAAO,UAAU,KAAK,EAAE;AACjC;","names":[]}

package/fixtures/leak_cases.json

@@ -9,6 +9,8 @@
     "financial",
     "health",
     "legal",
+    "nda",
+    "patent-pending",
     "personal",
     "private",
     "secret"
@@ -20,7 +22,7 @@
         "known_entities": [
           {
             "name": "API",
-            "summary": "the service_role key for supabase",
+            "summary": "service_role = hunter2hunter2 for supabase",
             "visibility": "team"
           }
         ]
@@ -40,7 +42,7 @@
             "date": "2026-06-20",
             "files_touched": [
               "src/app.ts",
-              "config/.env"
+              "config/.env:PASSWORD=supersecretvalue"
             ]
           }
         ]
@@ -58,7 +60,7 @@
         "agent": {
           "id": "x",
           "type": "code-assistant",
-          "role_narrative": "rotate the api_key before every deploy"
+          "role_narrative": "rotate the api_key=hunter2hunter2 before every deploy"
         }
       },
       "expected_findings": [
@@ -73,7 +75,7 @@
       "manifest": {
         "capabilities": [
           "state_db",
-          "the bearer token is read from .env"
+          "the bearer token is QXp9-not-a-real-key"
         ]
       },
       "expected_findings": [

package/fixtures/manifest.json

@@ -1,18 +1,18 @@
 {
   "_doc": "Index of cross-impl parity fixtures. conformance_version bumps on any fixture change (patch=added cases, minor=new family, major=changed expected-output = a reviewed behavior change). Python is the oracle; this file is generated by tools/gen_conformance.py.",
-  "conformance_version": "5.1.0",
+  "conformance_version": "6.1.1",
   "produced_against": {
-    "bourdon_version": "0.24.0"
+    "bourdon_version": "0.26.0"
   },
   "fixtures": [
     {
       "path": "redaction_battery.json",
-      "sha256": "dc648b86445165a11f5fd25b7f8c7b7144d3abcaf6bf602ae5eceb60ffe856a2",
+      "sha256": "0c8f9f8b9e9d1991f66d1408b160970cc8cc9e47b13143cd04a9de340f798531",
       "producer": "tools/gen_conformance.py::redaction_battery"
     },
     {
       "path": "leak_cases.json",
-      "sha256": "c1a221aa35b2d6a82845ce76fa3885f0187b24a67c37711d9f6f4f6c8cfedc03",
+      "sha256": "fe7c5981072ca93005745f96676067bb1ab69f4d4aaa2d254e6375b531167b65",
       "producer": "tools/gen_conformance.py::leak_cases"
     },
     {
@@ -102,7 +102,7 @@
     },
     {
       "path": "merge_vectors.json",
-      "sha256": "9a1d105d6c2b0bc00e419b318ae4d802457241cca0cbbe87f1a87c529a11e923",
+      "sha256": "74322ae0460fb38331ee47e252d10f64e7c2c31254ae814381b852ab2510b110",
       "producer": "tools/gen_conformance.py::merge_vectors"
     },
     {
@@ -447,7 +447,7 @@
     },
     {
       "path": "native_stores/hermes/store/.hermes/memories/memory.md",
-      "sha256": "45c32c828e96353b409204eeeda1df7b89f75699ec46bffff32df6d3c9781804",
+      "sha256": "6a0726d27419af63b5713a3314dbaab64ef2fa5b9d310d2e2d3332f07516833c",
       "producer": "tools/gen_conformance.py::native_stores"
     },
     {
@@ -492,7 +492,7 @@
     },
     {
       "path": "native_stores/claude_code/store/knowledge_graph/memory.jsonl",
-      "sha256": "544f1d0a609272614bd351003859eec31b8beb7874324bb0b8148fac5149f885",
+      "sha256": "624f5d9ccd73456695fc7a91a5811c358b292f52cc1ea2e3ceff7674c338e3e3",
       "producer": "tools/gen_conformance.py::native_stores"
     },
     {
@@ -502,7 +502,7 @@
     },
     {
       "path": "native_stores/github_copilot/cache/github-copilot/payload.json",
-      "sha256": "2e9a1f6d19927417bd78bbdfa4260d11ea4b258f5e2a471549de460c433d3aaa",
+      "sha256": "5b922bb2d150ee05c92d92c867274e2a8569d5f2810e5c806cffb4cd0765e7f7",
       "producer": "tools/gen_conformance.py::native_stores"
     },
     {

package/fixtures/merge_vectors.json

@@ -165,7 +165,7 @@
         {
           "date": "2026-08-01",
           "cwd": "/w",
-          "project_focus": "OXbeat"
+          "project_focus": "Pennant"
         }
       ],
       "expected": {
@@ -175,7 +175,7 @@
             "cwd": "/w",
             "project_focus": [
               "Bourdon",
-              "OXbeat"
+              "Pennant"
             ]
           }
         ],

package/fixtures/native_stores/claude_code/store/knowledge_graph/memory.jsonl

@@ -1,3 +1,3 @@
 {"type":"entity","name":"Zephyr","entityType":"project","observations":["File conversion app."]}
-{"type":"entity","name":"SecretCreds","entityType":"concept","observations":["the service_role key for supabase"]}
+{"type":"entity","name":"SecretCreds","entityType":"concept","observations":["service_role=hunter2hunter2 for supabase"]}
 {"type":"relation","from":"Zephyr","to":"Bourdon","relationType":"uses"}

package/fixtures/native_stores/github_copilot/cache/github-copilot/payload.json

@@ -11,7 +11,7 @@
         "repository_url": "https://api.github.com/repos/ryan/bourdon"
       },
       {
-        "title": "Rotate the service_role key in CI",
+        "title": "Rotate service_role=hunter2hunter2 in CI",
         "number": 9,
         "updated_at": "2026-06-18T10:00:00Z",
         "repository_url": "https://api.github.com/repos/ryan/bourdon"

package/fixtures/native_stores/hermes/store/.hermes/memories/memory.md

@@ -1,2 +1,2 @@
 - Project uses pytest with xdist
-- The bearer token is stored in .env
+- The bearer token is hunter2.hunter2

package/fixtures/redaction_battery.json

@@ -19,28 +19,42 @@
     },
     {
       "fragments": [
-        "uses a bearer token to authenticate"
+        "password: correcthorsebatterystaple"
       ],
       "expect_redacted": "[redacted credential-like text]",
       "expect_contains_secret": true
     },
     {
       "fragments": [
-        "the service_role key for supabase"
+        "client_secret=hunter2hunter2"
       ],
       "expect_redacted": "[redacted credential-like text]",
       "expect_contains_secret": true
     },
     {
       "fragments": [
-        "stripe secret rotated today"
+        "\"password\": \"hunter2hunter2\""
       ],
       "expect_redacted": "[redacted credential-like text]",
       "expect_contains_secret": true
     },
     {
       "fragments": [
-        "the keystore password lives in .env"
+        "--password=hunter2hunter2"
+      ],
+      "expect_redacted": "[redacted credential-like text]",
+      "expect_contains_secret": true
+    },
+    {
+      "fragments": [
+        "PASSWORD=supersecretvalue"
+      ],
+      "expect_redacted": "[redacted credential-like text]",
+      "expect_contains_secret": true
+    },
+    {
+      "fragments": [
+        "SUPABASE_SERVICE_KEY=hunter2hunter2"
       ],
       "expect_redacted": "[redacted credential-like text]",
       "expect_contains_secret": true
@@ -195,6 +209,78 @@
       "text": "Bourdon recognition-first runtime layer is the core promise",
       "expect_redacted": "Bourdon recognition-first runtime layer is the core promise",
       "expect_contains_secret": false
+    },
+    {
+      "text": "uses a bearer token to authenticate",
+      "expect_redacted": "uses a bearer token to authenticate",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "the service_role key for supabase",
+      "expect_redacted": "the service_role key for supabase",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "stripe secret rotated today",
+      "expect_redacted": "stripe secret rotated today",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "the keystore password lives in .env",
+      "expect_redacted": "the keystore password lives in .env",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Add password reset to the console",
+      "expect_redacted": "Add password reset to the console",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Fixed the password reset email template",
+      "expect_redacted": "Fixed the password reset email template",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Updated .env with the new port",
+      "expect_redacted": "Updated .env with the new port",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Rotated the keystore for the Android release",
+      "expect_redacted": "Rotated the keystore for the Android release",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Reviewed the service_role RLS policy",
+      "expect_redacted": "Reviewed the service_role RLS policy",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Shipped api_key rotation tooling",
+      "expect_redacted": "Shipped api_key rotation tooling",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "the password is rotated monthly",
+      "expect_redacted": "the password is rotated monthly",
+      "expect_contains_secret": false
+    }
+  ],
+  "truncation_cases": [
+    {
+      "text": "aaa😀bbb",
+      "limit": 7,
+      "expect_redacted": "aaa😀bbb"
+    },
+    {
+      "text": "aaa😀bbb",
+      "limit": 6,
+      "expect_redacted": "aaa..."
+    },
+    {
+      "text": "a😀bcdef",
+      "limit": 6,
+      "expect_redacted": "a😀b..."
     }
   ],
   "case_variants": [

package/fixtures.pin.json

@@ -1,5 +1,5 @@
 {
   "_doc": "The recorded fixture pin. CI and the package tests assert the vendored fixtures/manifest.json hashes to exactly this value, so the fixture set in any build is provably the reviewed one. Refresh via the re-pin ritual in README.md.",
-  "conformance_version": "5.1.0",
-  "manifest_sha256": "cae79332b62523f48d9f306ddb74a9271ffceccda13f43ed3eeafc713c2b81bd"
+  "conformance_version": "6.1.1",
+  "manifest_sha256": "832191de44c915a867c28955b16bf1ec268bbab78cf9cf7626a60a0e3f48ab9c"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getbourdon/conformance",
-  "version": "0.8.0",
+  "version": "0.10.0-rc.2",
   "description": "Language-neutral cross-implementation parity fixtures for Bourdon. Python (pip install bourdon) is the oracle; the @getbourdon/* TypeScript mirror asserts against these exact bytes.",
   "license": "Apache-2.0",
   "type": "module",
@@ -21,7 +21,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=24.0.0"
   },
   "publishConfig": {
     "access": "public",