@noy-db/test-sealer-conformance 0.8.0 → 0.9.0-pre.1

package/README.md

@@ -4,10 +4,16 @@ Contract tests for the `at-*` family port. Every `NoydbSealer` implementation
 
 ```ts
 import { runSealerConformanceTests } from '@noy-db/test-sealer-conformance'
-import { atEnv } from '@noy-db/at-env'
+import type { NoydbSealer } from '@noy-db/hub/at'
 
-runSealerConformanceTests('at-env', () => atEnv({ envVar: 'NOYDB_SEAL_A' }), {
-  other: () => atEnv({ envVar: 'NOYDB_SEAL_B' }),
+// Your provider's factory, imported in YOUR package — `atEnv` from
+// `@noy-db/at-env` (noy-db/at), or your own. ⛔ This kit depends on no `at-*`
+// provider and never can: every provider depends on the kit, so the edge only
+// runs one way.
+declare function makeSealer(envVar: string): NoydbSealer
+
+runSealerConformanceTests('at-env', () => makeSealer('NOYDB_SEAL_A'), {
+  other: () => makeSealer('NOYDB_SEAL_B'),
 })
 ```
 

package/dist/index.d.ts

@@ -1,79 +1 @@
-import { NoydbSealer } from '@noy-db/hub/at';
-
-/**
- * Parameterized conformance suite for the `at-*` family port.
- *
- * Every `NoydbSealer` implementation must pass these. The contract is three
- * members — `id`, `seal`, `unseal` — and almost all of the risk is in what
- * `unseal` does when it is handed something it should refuse.
- *
- * These assertions are not new: hub has tested them as
- * `describe('NoydbSealer — contract')` against `MemorySealer` since managed
- * mode landed. What was missing is that a REAL provider — `at-env`,
- * `at-aws-kms`, or a third party's — had no way to run the same suite, so
- * every implementation was checked against its own idea of the contract. This
- * package is that extraction, mirroring `@noy-db/test-adapter-conformance`
- * for stores.
- *
- * ⚠️ `at-*` is the one NON-zero-knowledge family: a host you control can
- * decrypt the slice it unseals. That is deliberate, and it is why the
- * `unseal`-must-refuse cases below matter more here than anywhere else — a
- * provider that silently returns garbage instead of throwing hands hub a
- * "secret" that was never sealed by anyone.
- *
- * NOTE ON IMPORTS: this suite binds `@noy-db/hub/at`, the family seam. It was
- * written against the root barrel because `/at` did not exist yet — the seam
- * follows the port, not the other way round. `/at` and its four siblings
- * shipped in 0.3.0 with nothing behind them and were removed in 0.4.0 for
- * "zero importers"; it returns now because this package is what stands behind
- * it, and the five `at-*` providers bind it.
- */
-declare function runSealerConformanceTests(name: string, factory: () => Promise<NoydbSealer> | NoydbSealer, opts: {
-    /**
-     * A SECOND, differently-identified provider. Required: the single most
-     * load-bearing property of a sealer is that its output is not portable to
-     * another one, and that cannot be checked with one instance.
-     */
-    readonly other: () => Promise<NoydbSealer> | NoydbSealer;
-    /**
-     * Skip the tamper case for providers whose backend authenticates
-     * out-of-band and cannot be handed a corrupted blob (e.g. a keychain that
-     * only ever returns what it stored). Defaults to running it.
-     */
-    readonly skipTamper?: boolean;
-}): void;
-/**
- * Obligations for a DELEGATING provider — one whose `seal` IS the service call.
- *
- * `runSealerConformanceTests` cannot be run against `at-aws-kms`,
- * `at-gcp-kms` or `at-azure-keyvault` without real credentials, because the
- * properties it asserts (refusing tampered, foreign or garbage input) are the
- * SERVICE's behaviour. Standing a fake KMS in front of them would test the
- * fake.
- *
- * Two obligations remain squarely the provider's, and a stub client covers
- * them honestly:
- *
- *   1. a service failure must SURFACE — never be swallowed into a resolved
- *      promise. hub reads a thrown error as "this provider cannot unlock this
- *      vault"; a provider that swallows one reports success for a vault it
- *      never opened.
- *   2. a response with no ciphertext/plaintext must THROW — never be
- *      fabricated into empty bytes. Returning `new Uint8Array(0)` for a failed
- *      Decrypt hands hub a "secret" nobody sealed.
- *
- * The caller supplies the providers, because each SDK's client shape differs
- * and this package should not know about any of them.
- *
- * NOTE: at time of writing all wired providers already satisfy both. These
- * tests PIN the behaviour rather than having found it missing — which is worth
- * saying, so nobody reads a green run as evidence a bug was caught.
- */
-declare function runDelegatingSealerObligations(name: string, providers: {
-    /** Built with a client whose calls REJECT. */
-    readonly rejecting: () => Promise<NoydbSealer> | NoydbSealer;
-    /** Built with a client that RESOLVES but returns no ciphertext/plaintext. */
-    readonly empty: () => Promise<NoydbSealer> | NoydbSealer;
-}): void;
-
-export { runDelegatingSealerObligations, runSealerConformanceTests };
+export * from '@noy-db/ports/at';

package/dist/index.js

@@ -1,95 +1,3 @@
 // src/index.ts
-import { describe, it, expect } from "vitest";
-function runSealerConformanceTests(name, factory, opts) {
-  const make = async () => await factory();
-  const makeOther = async () => await opts.other();
-  describe(`NoydbSealer conformance: ${name}`, () => {
-    it("seal \u2192 unseal round-trips the exact bytes", async () => {
-      const sealer = await make();
-      const secret = new Uint8Array([1, 2, 3, 4, 5, 250, 251, 252]);
-      const out = await sealer.unseal(await sealer.seal(secret));
-      expect(Array.from(out)).toEqual(Array.from(secret));
-    });
-    it("round-trips an empty secret", async () => {
-      const sealer = await make();
-      const out = await sealer.unseal(await sealer.seal(new Uint8Array(0)));
-      expect(out.length).toBe(0);
-    });
-    it("round-trips a secret larger than one block", async () => {
-      const sealer = await make();
-      const secret = new Uint8Array(4096).map((_, i) => i % 256);
-      const out = await sealer.unseal(await sealer.seal(secret));
-      expect(Array.from(out)).toEqual(Array.from(secret));
-    });
-    it("produces output that is NOT the plaintext", async () => {
-      const sealer = await make();
-      const secret = new TextEncoder().encode("a recognisable secret");
-      const sealed = await sealer.seal(secret);
-      expect(Buffer.from(sealed).includes(Buffer.from(secret))).toBe(false);
-    });
-    it("THROWS when another provider tries to unseal its output", async () => {
-      const a = await make();
-      const b = await makeOther();
-      expect(a.id).not.toEqual(b.id);
-      await expect(b.unseal(await a.seal(new Uint8Array([9, 9, 9])))).rejects.toThrow();
-    });
-    it("THROWS on unsealing bytes that were never sealed", async () => {
-      const sealer = await make();
-      await expect(sealer.unseal(new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7]))).rejects.toThrow();
-    });
-    it("THROWS on unsealing an empty buffer", async () => {
-      const sealer = await make();
-      await expect(sealer.unseal(new Uint8Array(0))).rejects.toThrow();
-    });
-    it.skipIf(opts.skipTamper)("THROWS on a tampered sealed blob", async () => {
-      const sealer = await make();
-      const sealed = await sealer.seal(new TextEncoder().encode("tamper me"));
-      const corrupted = Uint8Array.from(sealed);
-      const last = corrupted.length - 1;
-      corrupted[last] = (corrupted[last] ?? 0) ^ 255;
-      await expect(sealer.unseal(corrupted)).rejects.toThrow();
-    });
-    it("exposes a non-empty `id`", async () => {
-      const sealer = await make();
-      expect(typeof sealer.id).toBe("string");
-      expect(sealer.id.length).toBeGreaterThan(0);
-    });
-    it("keeps `id` stable across calls \u2014 hub persists it in the envelope", async () => {
-      const sealer = await make();
-      const first = sealer.id;
-      await sealer.seal(new Uint8Array([1]));
-      expect(sealer.id).toBe(first);
-    });
-    it("does not leak the secret through `id`", async () => {
-      const sealer = await make();
-      const secret = new TextEncoder().encode("super-secret-value");
-      await sealer.seal(secret);
-      expect(sealer.id).not.toContain("super-secret-value");
-    });
-  });
-}
-function runDelegatingSealerObligations(name, providers) {
-  describe(`Delegating-sealer obligations: ${name}`, () => {
-    it("seal THROWS when the service call rejects \u2014 never swallows it", async () => {
-      const s = await providers.rejecting();
-      await expect(s.seal(new Uint8Array([1, 2, 3]))).rejects.toThrow();
-    });
-    it("unseal THROWS when the service call rejects \u2014 never swallows it", async () => {
-      const s = await providers.rejecting();
-      await expect(s.unseal(new Uint8Array([1, 2, 3]))).rejects.toThrow();
-    });
-    it("seal THROWS when the service returns no ciphertext \u2014 never fabricates", async () => {
-      const s = await providers.empty();
-      await expect(s.seal(new Uint8Array([1, 2, 3]))).rejects.toThrow();
-    });
-    it("unseal THROWS when the service returns no plaintext \u2014 never fabricates", async () => {
-      const s = await providers.empty();
-      await expect(s.unseal(new Uint8Array([1, 2, 3]))).rejects.toThrow();
-    });
-  });
-}
-export {
-  runDelegatingSealerObligations,
-  runSealerConformanceTests
-};
+export * from "@noy-db/ports/at";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport type { NoydbSealer } from '@noy-db/hub/at'\n\n/**\n * Parameterized conformance suite for the `at-*` family port.\n *\n * Every `NoydbSealer` implementation must pass these. The contract is three\n * members — `id`, `seal`, `unseal` — and almost all of the risk is in what\n * `unseal` does when it is handed something it should refuse.\n *\n * These assertions are not new: hub has tested them as\n * `describe('NoydbSealer — contract')` against `MemorySealer` since managed\n * mode landed. What was missing is that a REAL provider — `at-env`,\n * `at-aws-kms`, or a third party's — had no way to run the same suite, so\n * every implementation was checked against its own idea of the contract. This\n * package is that extraction, mirroring `@noy-db/test-adapter-conformance`\n * for stores.\n *\n * ⚠️ `at-*` is the one NON-zero-knowledge family: a host you control can\n * decrypt the slice it unseals. That is deliberate, and it is why the\n * `unseal`-must-refuse cases below matter more here than anywhere else — a\n * provider that silently returns garbage instead of throwing hands hub a\n * \"secret\" that was never sealed by anyone.\n *\n * NOTE ON IMPORTS: this suite binds `@noy-db/hub/at`, the family seam. It was\n * written against the root barrel because `/at` did not exist yet — the seam\n * follows the port, not the other way round. `/at` and its four siblings\n * shipped in 0.3.0 with nothing behind them and were removed in 0.4.0 for\n * \"zero importers\"; it returns now because this package is what stands behind\n * it, and the five `at-*` providers bind it.\n */\nexport function runSealerConformanceTests(\n  name: string,\n  factory: () => Promise<NoydbSealer> | NoydbSealer,\n  opts: {\n    /**\n     * A SECOND, differently-identified provider. Required: the single most\n     * load-bearing property of a sealer is that its output is not portable to\n     * another one, and that cannot be checked with one instance.\n     */\n    readonly other: () => Promise<NoydbSealer> | NoydbSealer\n    /**\n     * Skip the tamper case for providers whose backend authenticates\n     * out-of-band and cannot be handed a corrupted blob (e.g. a keychain that\n     * only ever returns what it stored). Defaults to running it.\n     */\n    readonly skipTamper?: boolean\n  },\n): void {\n  const make = async () => await factory()\n  const makeOther = async () => await opts.other()\n\n  describe(`NoydbSealer conformance: ${name}`, () => {\n    it('seal → unseal round-trips the exact bytes', async () => {\n      const sealer = await make()\n      const secret = new Uint8Array([1, 2, 3, 4, 5, 250, 251, 252])\n      const out = await sealer.unseal(await sealer.seal(secret))\n      expect(Array.from(out)).toEqual(Array.from(secret))\n    })\n\n    it('round-trips an empty secret', async () => {\n      // Zero-length is the boundary a length-prefixed or padded format is\n      // most likely to get wrong, and hub never guarantees a minimum size.\n      const sealer = await make()\n      const out = await sealer.unseal(await sealer.seal(new Uint8Array(0)))\n      expect(out.length).toBe(0)\n    })\n\n    it('round-trips a secret larger than one block', async () => {\n      const sealer = await make()\n      const secret = new Uint8Array(4096).map((_, i) => i % 256)\n      const out = await sealer.unseal(await sealer.seal(secret))\n      expect(Array.from(out)).toEqual(Array.from(secret))\n    })\n\n    it('produces output that is NOT the plaintext', async () => {\n      // Catches a no-op or pass-through implementation, which round-trips\n      // perfectly and seals nothing.\n      const sealer = await make()\n      const secret = new TextEncoder().encode('a recognisable secret')\n      const sealed = await sealer.seal(secret)\n      expect(Buffer.from(sealed).includes(Buffer.from(secret))).toBe(false)\n    })\n\n    it('THROWS when another provider tries to unseal its output', async () => {\n      // The property hub relies on: `providerId` is audit metadata, not a\n      // guard, so the only thing stopping a wrong-provider open is unseal\n      // refusing. A provider that succeeds here silently unlocks vaults it\n      // has no claim to.\n      const a = await make()\n      const b = await makeOther()\n      expect(a.id).not.toEqual(b.id)\n      await expect(b.unseal(await a.seal(new Uint8Array([9, 9, 9])))).rejects.toThrow()\n    })\n\n    it('THROWS on unsealing bytes that were never sealed', async () => {\n      const sealer = await make()\n      await expect(sealer.unseal(new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7]))).rejects.toThrow()\n    })\n\n    it('THROWS on unsealing an empty buffer', async () => {\n      const sealer = await make()\n      await expect(sealer.unseal(new Uint8Array(0))).rejects.toThrow()\n    })\n\n    it.skipIf(opts.skipTamper)('THROWS on a tampered sealed blob', async () => {\n      const sealer = await make()\n      const sealed = await sealer.seal(new TextEncoder().encode('tamper me'))\n      const corrupted = Uint8Array.from(sealed)\n      const last = corrupted.length - 1\n      corrupted[last] = (corrupted[last] ?? 0) ^ 0xff\n      await expect(sealer.unseal(corrupted)).rejects.toThrow()\n    })\n\n    it('exposes a non-empty `id`', async () => {\n      const sealer = await make()\n      expect(typeof sealer.id).toBe('string')\n      expect(sealer.id.length).toBeGreaterThan(0)\n    })\n\n    it('keeps `id` stable across calls — hub persists it in the envelope', async () => {\n      const sealer = await make()\n      const first = sealer.id\n      await sealer.seal(new Uint8Array([1]))\n      expect(sealer.id).toBe(first)\n    })\n\n    it('does not leak the secret through `id`', async () => {\n      // `id` is documented NOT secret and \"fine to log\". A provider that\n      // derives it from the material it protects makes that documentation\n      // false for every consumer that believed it.\n      const sealer = await make()\n      const secret = new TextEncoder().encode('super-secret-value')\n      await sealer.seal(secret)\n      expect(sealer.id).not.toContain('super-secret-value')\n    })\n  })\n}\n\n/**\n * Obligations for a DELEGATING provider — one whose `seal` IS the service call.\n *\n * `runSealerConformanceTests` cannot be run against `at-aws-kms`,\n * `at-gcp-kms` or `at-azure-keyvault` without real credentials, because the\n * properties it asserts (refusing tampered, foreign or garbage input) are the\n * SERVICE's behaviour. Standing a fake KMS in front of them would test the\n * fake.\n *\n * Two obligations remain squarely the provider's, and a stub client covers\n * them honestly:\n *\n *   1. a service failure must SURFACE — never be swallowed into a resolved\n *      promise. hub reads a thrown error as \"this provider cannot unlock this\n *      vault\"; a provider that swallows one reports success for a vault it\n *      never opened.\n *   2. a response with no ciphertext/plaintext must THROW — never be\n *      fabricated into empty bytes. Returning `new Uint8Array(0)` for a failed\n *      Decrypt hands hub a \"secret\" nobody sealed.\n *\n * The caller supplies the providers, because each SDK's client shape differs\n * and this package should not know about any of them.\n *\n * NOTE: at time of writing all wired providers already satisfy both. These\n * tests PIN the behaviour rather than having found it missing — which is worth\n * saying, so nobody reads a green run as evidence a bug was caught.\n */\nexport function runDelegatingSealerObligations(\n  name: string,\n  providers: {\n    /** Built with a client whose calls REJECT. */\n    readonly rejecting: () => Promise<NoydbSealer> | NoydbSealer\n    /** Built with a client that RESOLVES but returns no ciphertext/plaintext. */\n    readonly empty: () => Promise<NoydbSealer> | NoydbSealer\n  },\n): void {\n  describe(`Delegating-sealer obligations: ${name}`, () => {\n    it('seal THROWS when the service call rejects — never swallows it', async () => {\n      const s = await providers.rejecting()\n      await expect(s.seal(new Uint8Array([1, 2, 3]))).rejects.toThrow()\n    })\n\n    it('unseal THROWS when the service call rejects — never swallows it', async () => {\n      const s = await providers.rejecting()\n      await expect(s.unseal(new Uint8Array([1, 2, 3]))).rejects.toThrow()\n    })\n\n    it('seal THROWS when the service returns no ciphertext — never fabricates', async () => {\n      const s = await providers.empty()\n      await expect(s.seal(new Uint8Array([1, 2, 3]))).rejects.toThrow()\n    })\n\n    it('unseal THROWS when the service returns no plaintext — never fabricates', async () => {\n      const s = await providers.empty()\n      await expect(s.unseal(new Uint8Array([1, 2, 3]))).rejects.toThrow()\n    })\n  })\n}\n"],"mappings":";AAAA,SAAS,UAAU,IAAI,cAAc;AA+B9B,SAAS,0BACd,MACA,SACA,MAcM;AACN,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,QAAM,YAAY,YAAY,MAAM,KAAK,MAAM;AAE/C,WAAS,4BAA4B,IAAI,IAAI,MAAM;AACjD,OAAG,kDAA6C,YAAY;AAC1D,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,SAAS,IAAI,WAAW,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,KAAK,KAAK,GAAG,CAAC;AAC5D,YAAM,MAAM,MAAM,OAAO,OAAO,MAAM,OAAO,KAAK,MAAM,CAAC;AACzD,aAAO,MAAM,KAAK,GAAG,CAAC,EAAE,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,IACpD,CAAC;AAED,OAAG,+BAA+B,YAAY;AAG5C,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,MAAM,MAAM,OAAO,OAAO,MAAM,OAAO,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC;AACpE,aAAO,IAAI,MAAM,EAAE,KAAK,CAAC;AAAA,IAC3B,CAAC;AAED,OAAG,8CAA8C,YAAY;AAC3D,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,SAAS,IAAI,WAAW,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,IAAI,GAAG;AACzD,YAAM,MAAM,MAAM,OAAO,OAAO,MAAM,OAAO,KAAK,MAAM,CAAC;AACzD,aAAO,MAAM,KAAK,GAAG,CAAC,EAAE,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,IACpD,CAAC;AAED,OAAG,6CAA6C,YAAY;AAG1D,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,SAAS,IAAI,YAAY,EAAE,OAAO,uBAAuB;AAC/D,YAAM,SAAS,MAAM,OAAO,KAAK,MAAM;AACvC,aAAO,OAAO,KAAK,MAAM,EAAE,SAAS,OAAO,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,KAAK;AAAA,IACtE,CAAC;AAED,OAAG,2DAA2D,YAAY;AAKxE,YAAM,IAAI,MAAM,KAAK;AACrB,YAAM,IAAI,MAAM,UAAU;AAC1B,aAAO,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,EAAE;AAC7B,YAAM,OAAO,EAAE,OAAO,MAAM,EAAE,KAAK,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,IAClF,CAAC;AAED,OAAG,oDAAoD,YAAY;AACjE,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,OAAO,OAAO,OAAO,IAAI,WAAW,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,IACxF,CAAC;AAED,OAAG,uCAAuC,YAAY;AACpD,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,OAAO,OAAO,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,IACjE,CAAC;AAED,OAAG,OAAO,KAAK,UAAU,EAAE,oCAAoC,YAAY;AACzE,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AACtE,YAAM,YAAY,WAAW,KAAK,MAAM;AACxC,YAAM,OAAO,UAAU,SAAS;AAChC,gBAAU,IAAI,KAAK,UAAU,IAAI,KAAK,KAAK;AAC3C,YAAM,OAAO,OAAO,OAAO,SAAS,CAAC,EAAE,QAAQ,QAAQ;AAAA,IACzD,CAAC;AAED,OAAG,4BAA4B,YAAY;AACzC,YAAM,SAAS,MAAM,KAAK;AAC1B,aAAO,OAAO,OAAO,EAAE,EAAE,KAAK,QAAQ;AACtC,aAAO,OAAO,GAAG,MAAM,EAAE,gBAAgB,CAAC;AAAA,IAC5C,CAAC;AAED,OAAG,yEAAoE,YAAY;AACjF,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,QAAQ,OAAO;AACrB,YAAM,OAAO,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;AACrC,aAAO,OAAO,EAAE,EAAE,KAAK,KAAK;AAAA,IAC9B,CAAC;AAED,OAAG,yCAAyC,YAAY;AAItD,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,SAAS,IAAI,YAAY,EAAE,OAAO,oBAAoB;AAC5D,YAAM,OAAO,KAAK,MAAM;AACxB,aAAO,OAAO,EAAE,EAAE,IAAI,UAAU,oBAAoB;AAAA,IACtD,CAAC;AAAA,EACH,CAAC;AACH;AA6BO,SAAS,+BACd,MACA,WAMM;AACN,WAAS,kCAAkC,IAAI,IAAI,MAAM;AACvD,OAAG,sEAAiE,YAAY;AAC9E,YAAM,IAAI,MAAM,UAAU,UAAU;AACpC,YAAM,OAAO,EAAE,KAAK,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,IAClE,CAAC;AAED,OAAG,wEAAmE,YAAY;AAChF,YAAM,IAAI,MAAM,UAAU,UAAU;AACpC,YAAM,OAAO,EAAE,OAAO,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,IACpE,CAAC;AAED,OAAG,8EAAyE,YAAY;AACtF,YAAM,IAAI,MAAM,UAAU,MAAM;AAChC,YAAM,OAAO,EAAE,KAAK,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,IAClE,CAAC;AAED,OAAG,+EAA0E,YAAY;AACvF,YAAM,IAAI,MAAM,UAAU,MAAM;AAChC,YAAM,OAAO,EAAE,OAAO,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,IACpE,CAAC;AAAA,EACH,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@noy-db/test-sealer-conformance` is now a re-export of `@noy-db/ports/at` — the six\n * conformance kits were consolidated into one package with one subpath per\n * hub port (2026-09-21). Function names are unchanged; only the specifier\n * moved. This name stays published for consumers still pinning it and is\n * deprecated in favour of `@noy-db/ports/at`.\n */\nexport * from '@noy-db/ports/at'\n"],"mappings":";AAOA,cAAc;","names":[]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@noy-db/test-sealer-conformance",
-  "version": "0.8.0",
-  "description": "Parameterized contract tests for noy-db sealing-key providers — the conformance suite every NoydbSealer implementation must pass",
+  "version": "0.9.0-pre.1",
+  "description": "Parameterized contract tests for noy-db sealing-key providers — the conformance suite every NoydbSealer implementation must pass — now a re-export of @noy-db/ports/at; deprecated in favour of it",
   "license": "Apache-2.0",
   "author": "vLannaAi <vicio@lanna.ai>",
   "homepage": "https://github.com/noy-db/core/tree/main/packages/test-sealer-conformance#readme",
@@ -34,11 +34,11 @@
   },
   "peerDependencies": {
     "vitest": "^3.0.0",
-    "@noy-db/hub": "^0.8.0"
+    "@noy-db/hub": "^0.9.0-pre.1"
   },
   "devDependencies": {
     "vitest": "^3.0.0",
-    "@noy-db/hub": "0.8.0"
+    "@noy-db/hub": "0.9.0-pre.1"
   },
   "keywords": [
     "noy-db",
@@ -50,9 +50,12 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "@noy-db/ports": "^0.9.0-pre.1"
+  },
   "scripts": {
     "build": "tsup",
-    "test": "vitest run --passWithNoTests",
+    "test": "vitest run",
     "typecheck": "tsc --noEmit"
   }
 }