@noy-db/hub 0.7.0-pre.7 → 0.7.0-pre.8

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog — hub
 
+## 0.7.0-pre.8
+
+### Patch Changes
+
+- Say what is actually true about runtime dependencies (#1227).
+
+  Four places claimed zero runtime dependencies. Measured across all 57 packages, **51 have none** — but six do, and four of those are third-party:
+
+  | package                             | runtime dependency                                         |
+  | ----------------------------------- | ---------------------------------------------------------- |
+  | `@noy-db/as-xml`, `@noy-db/as-xlsx` | `fast-xml-parser`                                          |
+  | `@noy-db/in-devtools-tui`           | `ink`, `react`                                             |
+  | `create-noy-db`                     | its scaffolder toolchain                                   |
+  | `@noy-db/hub`                       | `@noy-db/attestation` — a sibling on the same version line |
+  | `@noy-db/in-nuxt`                   | `@noy-db/in-devtools` — likewise                           |
+
+  Corrected:
+
+  - **`@noy-db/hub`** — "Zero runtime dependencies" → _no third-party runtime dependencies to install_, naming `@noy-db/attestation` as the one runtime dependency. Also states plainly that `zod` is **vendored into the bundle** for the optional persisted-schema converter, loaded lazily, never executing unless you use that path — and that it will not appear in your lockfile. That last clause is the one an SBOM or audit process needs, and no manifest field carries it.
+  - **`@noy-db/as-xlsx`** — "Zero runtime dependencies" was **flatly false**; it depends on `fast-xml-parser`. The intent was "no heavyweight spreadsheet library", which is true and is now what it says.
+
+  Two other claims were checked and left alone because they are correct: `@noy-db/as-zip` and `@noy-db/on-totp` genuinely have no dependencies.
+
+  Documentation only. No code, dependency, or behaviour change — the manifests already said this; only the prose disagreed with them.
+
 ## 0.7.0-pre.6
 
 ### Patch Changes

package/README.md

@@ -76,7 +76,10 @@ const all = await invoices.list()
 - **Multi-user access control** — owner, admin, operator, viewer, client roles
 - **Offline-first sync** — push/pull with optimistic concurrency on encrypted envelopes
 - **Audit history** — full-copy snapshots with `history()`, `diff()`, `revert()`, `pruneHistory()`
-- **Zero runtime dependencies**
+- **No third-party runtime dependencies to install** — the only runtime dependency is
+  `@noy-db/attestation`, on the same version line. (`zod` is vendored into the bundle for the
+  optional persisted-schema converter and loaded lazily; it never executes unless you use that
+  path, and it does not appear in your lockfile.)
 
 ## Cross-vault queries
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.7.0-pre.7",
+  "version": "0.7.0-pre.8",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -233,14 +233,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.7.0-pre.7"
+    "@noy-db/attestation": "0.7.0-pre.8"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.7.0-pre.7"
+    "@noy-db/on-shamir": "0.7.0-pre.8"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"