@noy-db/hub 0.7.0-pre.0 → 0.7.0-pre.2

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog — hub
 
+## 0.7.0-pre.2
+
+### Patch Changes
+
+- **The conformance kit covers both entry-point shapes and both gates (#1209).**
+
+  `0.7.0-pre.0`'s `/as` inversion silently blinded `@noy-db/test-format-conformance`:
+  it denied by proxying the vault, which the inverted method-on-vault shape
+  (`vault.export(asCsv())`) bypasses — `this` inside `Vault.export` is the real,
+  unproxied object. The four inverted formats' fixtures had been deleted rather
+  than migrated, so coverage dropped from nine formats to five with nothing
+  turning red.
+
+  The kit now **patches the instance** instead: own-property assignment shadows
+  the prototype method at call time, intercepting the argument shape, the
+  inverted shape, and hub's internal delegation. Denials are matched on the
+  kit's own error class rather than "it threw", every entry point gets an
+  ungated-success guard, and the **import gate (`assertCanImport`) is covered
+  for the first time** — a format shipping a `decode` with no declared import
+  entries gets a loud `SKIPPED` line.
+
+  All four fixtures are restored, and a new architecture rule
+  (`as-conformance-fixture`) makes a silent fixture deletion impossible.
+
+## 0.7.0-pre.1
+
+### Patch Changes
+
+- **The `at-*` options types now follow their factories.**
+
+  `0.7.0-pre.0` renamed every `at-*` factory to `at<Pkg>()` and left four of the
+  five options types carrying the retired `SealingProvider` vocabulary — so it
+  shipped `atAwsKms()` taking an `AwsKmsSealingProviderOptions`. `at-env` had
+  already renamed both halves, which is what makes this a gap rather than a
+  decision.
+
+  | before                                | after                    |
+  | ------------------------------------- | ------------------------ |
+  | `AwsKmsSealingProviderOptions`        | `AtAwsKmsOptions`        |
+  | `GcpKmsSealingProviderOptions`        | `AtGcpKmsOptions`        |
+  | `AzureKeyVaultSealingProviderOptions` | `AtAzureKeyvaultOptions` |
+  | `MacosKeychainSealingProviderOptions` | `AtMacosKeychainOptions` |
+
+  Four rows added to `@noy-db/hub/codemods/0.7.0-pre.json`. `AwsKmsRecipientSealerOptions`
+  is deliberately unchanged — it belongs to a different factory that was not renamed.
+
+  Also corrects a doc comment in `vault.ts` that named two capability gates,
+  `canExportPlaintext` and `canExportBundle`, **neither of which has ever
+  existed**. The gate is `assertCanExport('plaintext', fmt)` /
+  `assertCanExport('bundle')`. That comment ships as JSDoc in the `.d.ts` and had
+  propagated into the docs site.
+
 ## 0.7.0-pre.0
 
 ### Minor Changes

package/codemods/0.7.0-pre.json

@@ -245,6 +245,42 @@
         "./by",
         "./cargo"
       ]
+    },
+    {
+      "from": "AwsKmsSealingProviderOptions",
+      "to": "AtAwsKmsOptions",
+      "kind": "type",
+      "package": "@noy-db/at-aws-kms",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "The options type for the renamed factory. `at-env` renamed its pair together (EnvSealingProviderOptions -> AtEnvOptions); these four renamed the FACTORY and left the options type carrying the retired `SealingProvider` vocabulary, so 0.7.0-pre.0 shipped `atAwsKms()` taking an `AwsKmsSealingProviderOptions`. Convention: `at<Pkg>()` takes `At<Pkg>Options` (#1204)."
+    },
+    {
+      "from": "GcpKmsSealingProviderOptions",
+      "to": "AtGcpKmsOptions",
+      "kind": "type",
+      "package": "@noy-db/at-gcp-kms",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "The options type for the renamed factory. `at-env` renamed its pair together (EnvSealingProviderOptions -> AtEnvOptions); these four renamed the FACTORY and left the options type carrying the retired `SealingProvider` vocabulary, so 0.7.0-pre.0 shipped `atAwsKms()` taking an `AwsKmsSealingProviderOptions`. Convention: `at<Pkg>()` takes `At<Pkg>Options` (#1204)."
+    },
+    {
+      "from": "AzureKeyVaultSealingProviderOptions",
+      "to": "AtAzureKeyvaultOptions",
+      "kind": "type",
+      "package": "@noy-db/at-azure-keyvault",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "The options type for the renamed factory. `at-env` renamed its pair together (EnvSealingProviderOptions -> AtEnvOptions); these four renamed the FACTORY and left the options type carrying the retired `SealingProvider` vocabulary, so 0.7.0-pre.0 shipped `atAwsKms()` taking an `AwsKmsSealingProviderOptions`. Convention: `at<Pkg>()` takes `At<Pkg>Options` (#1204)."
+    },
+    {
+      "from": "MacosKeychainSealingProviderOptions",
+      "to": "AtMacosKeychainOptions",
+      "kind": "type",
+      "package": "@noy-db/at-macos-keychain",
+      "safeGlobalReplace": true,
+      "section": "at-port",
+      "note": "The options type for the renamed factory. `at-env` renamed its pair together (EnvSealingProviderOptions -> AtEnvOptions); these four renamed the FACTORY and left the options type carrying the retired `SealingProvider` vocabulary, so 0.7.0-pre.0 shipped `atAwsKms()` taking an `AwsKmsSealingProviderOptions`. Convention: `at<Pkg>()` takes `At<Pkg>Options` (#1204)."
     }
   ],
   "unretired": [

package/dist/cargo/index.js

@@ -5,7 +5,7 @@ import {
   describeExtraction,
   unsealDeks,
   withCargo
-} from "../chunk-YKPGQJFU.js";
+} from "../chunk-H3VG6XBC.js";
 import {
   extractPartition,
   walkClosure

package/dist/{chunk-Y3YLJORD.js → chunk-3SMSERQU.js}

@@ -10676,9 +10676,9 @@ var Vault = class {
    *   - The keyring must already carry a wrap for the target tier on
    *     at least one collection (or be `owner` / `admin`, who can
    *     auto-mint). Otherwise throws {@link TierNotGrantedError}.
-   *   - Per-collection capability gates (`assertCanExport`,
-   *     `canExportBundle`) are NOT bypassed — elevation is a tier
-   *     projection, not a privilege escalation path.
+   *   - The export gates (`assertCanExport('plaintext', fmt)` and
+   *     `assertCanExport('bundle')`) are NOT bypassed — elevation is a
+   *     tier projection, not a privilege escalation path.
    *   - Only one elevation can be active per vault at a time.
    *     Calling `elevate(...)` while another is live throws
    *     {@link AlreadyElevatedError}.
@@ -14690,4 +14690,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-Y3YLJORD.js.map
+//# sourceMappingURL=chunk-3SMSERQU.js.map