Reject negative array indices in JSON pointers

referencing/_core.py

@@ -265,6 +265,12 @@ def pointer(self, pointer: str, resolver: Resolver[D]) -> Resolved[D]:
         for segment in unquote(pointer[1:]).split("/"):
             if isinstance(contents, Sequence):
                 segment = int(segment)
+                # 2026-10-08: JSON array indices cannot count from the end.
+                if segment < 0:
+                    raise exceptions.PointerToNowhere(
+                        ref=pointer,
+                        resource=self,
+                    )
             else:
                 segment = segment.replace("~1", "/").replace("~0", "~")
             try:

referencing/tests/test_core.py

@@ -762,6 +762,25 @@ def test_lookup_non_existent_pointer_to_array_index(self):
             resource=resource,
         )
 
+    @pytest.mark.parametrize("index", [-1, -2, -4])
+    def test_lookup_negative_array_index(self, index):
+        # 2026-10-08: JSON arrays have no negative-index members.
+        resource = Resource.opaque([1, 2, 4, 8])
+        resolver = Registry({"http://example.com/1": resource}).resolver()
+        pointer = f"/{index}"
+        with pytest.raises(exceptions.PointerToNowhere) as exc:
+            resolver.lookup(f"http://example.com/1#{pointer}")
+        assert exc.value == exceptions.PointerToNowhere(
+            ref=pointer,
+            resource=resource,
+        )
+
+    def test_lookup_negative_integer_object_key(self):
+        # 2026-10-08: Object member names remain literal strings.
+        resource = Resource.opaque({"-1": "value"})
+        resolver = Registry().resolver_with_root(resource)
+        assert resolver.lookup("#/-1").contents == "value"
+
     def test_lookup_pointer_to_empty_string(self):
         resolver = Registry().resolver_with_root(Resource.opaque({"": {}}))
         assert resolver.lookup("#/").contents == {}