@forgezero/access 0.1.3 → 0.1.5

package/README.md

@@ -1,7 +1,7 @@
 <!--
   GENERATED FILE — do not edit.
 
-  Change scripts/generate-guides.ts or its typed sources, run `bun run guides`,
+  Change tools/generate-guides.ts or its typed sources, run `bun run guides`,
   and commit the generator and rendered files together.
 -->
 
@@ -9,14 +9,48 @@
 
 Declare your security posture as seven lists. Handlers hold business logic only.
 
-## Global package root and supported runtimes
+## Package overview
 
-Anyone building a service on our request shape: one declared matrix of routes and factors, enforced by one pipeline whatever the framework. Imports no sibling at all, so it can be adopted on its own. Supported runtimes: bun, node, workers, deno. The global base/root import is @forgezero/access. Every public import or command is listed below; the documentation inventory is checked in both directions against package.json exports.
+Anyone building a service on our request shape: one declared matrix of routes and factors, enforced by one pipeline whatever the framework. Imports no sibling at all, so it can be adopted on its own. Supported runtimes: bun, node, workers, deno. Package root: @forgezero/access. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
 
 ```text
-import * as root from '@forgezero/access';
+bun add @forgezero/access
 ```
 
+## ForgeZero package family
+
+The five packages are installation boundaries. Choose a package by who installs it; choose a subpath by the capability used in that file.
+
+| package | short description | runtimes | documentation |
+|---|---|---|---|
+| @forgezero/vault | Scoped secret access with Agent, API-key and systemd-credential sources. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/vault-package) |
+| @forgezero/access | Typed route, principal, factor, RBAC and request-pipeline contracts. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/access) |
+| @forgezero/providers | Typed external providers with priority, health and classified fallback. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/providers) |
+| @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
+| @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
+
+## @forgezero/access public imports and commands
+
+Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
+
+| public entry | short description | runtime | details |
+|---|---|---|---|
+| @forgezero/access | Declare routes, factors and policies as orthogonal lists; authorise against them. | portable | [Details + example](#forgezero-access) |
+| @forgezero/access/conditions | The twelve guards every project writes into `before`, each with the status its refusal deserves. | portable | [Details + example](#forgezero-access-conditions) |
+| @forgezero/access/effects | Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. | portable | [Details + example](#forgezero-access-effects) |
+| @forgezero/access/security | Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. | portable | [Details + example](#forgezero-access-security) |
+| @forgezero/access/rate-limit | Request counters over a window — in memory, in Redis, or in a Durable Object. | portable | [Details + example](#forgezero-access-rate-limit) |
+| @forgezero/access/fetch | A Fetch-native adapter over the declared access pipeline. | portable | [Details + example](#forgezero-access-fetch) |
+| @forgezero/access/pipeline | The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. | portable | [Details + example](#forgezero-access-pipeline) |
+| @forgezero/access/elysia | Elysia integration over the same access pipeline and route declarations. | portable | [Details + example](#forgezero-access-elysia) |
+| @forgezero/access/client | Typed client helpers that fulfil factors without duplicating the security matrix. | portable | [Details + example](#forgezero-access-client) |
+| @forgezero/access/testing | Deterministic access-pipeline fixtures and assertions for consumer tests. | portable | [Details + example](#forgezero-access-testing) |
+| @forgezero/access/header | Strict configurable header-identity extraction with canonical names and bounded values. | portable | [Details + example](#forgezero-access-header) |
+| @forgezero/access/principal | Generic principal-source resolution for browser, API-key, attestation or future identity adapters. | portable | [Details + example](#forgezero-access-principal) |
+| @forgezero/access/principal-session | Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. | portable | [Details + example](#forgezero-access-principal-session) |
+| @forgezero/access/authenticator | Authentication-source contracts for adding identity mechanisms without changing route policy. | portable | [Details + example](#forgezero-access-authenticator) |
+| @forgezero/access/ceremony-modes | Named security-ceremony modes and their session/action fulfilment semantics. | portable | [Details + example](#forgezero-access-ceremony-modes) |
+
 ## Commands
 
 bun add @forgezero/access — Install the framework-neutral access contracts and adapters.
@@ -25,137 +59,414 @@ bun add @forgezero/access — Install the framework-neutral access contracts and
 bun add @forgezero/access
 ```
 
+<a id="forgezero-access"></a>
 ## @forgezero/access
 
-Declare routes, factors and policies as orthogonal lists; authorise against them.
+Declare routes, factors and policies as orthogonal lists; authorise against them. This entry exposes 21 named value exports and 27 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  AccessError,
+  Refusal,
+  SCHEMA_VERSION,
+  Settled,
+  VERSION,
+  action,
+  assertReadable,
+  authorise,
+  codePolicy,
+  defineAccessControl,
+  defineFactors,
+  defineRoutes,
+  externalPolicy,
+  fulfilledActionFactors,
+  grantsRoute,
+  impactOfDisabling,
+  isRefusal,
+  isSettled,
+  page,
+  resolveActionFactors,
+  stemOf,
+} from '@forgezero/access';
+
+import type {
+  AccessControl,
+  AccessControlConfig,
+  ActionPolicy,
+  ActionRoute,
+  AfterHandler,
+  BeforeHandler,
+  Binding,
+  FactorContext,
+  FactorKind,
+  FactorRegistry,
+  FactorSpec,
+  GrantOptions,
+  Method,
+  Outcome,
+  PageRoute,
+  PolicySource,
+  Problem,
+  RatePolicy,
+  RequestContext,
+  Role,
+  RouteBase,
+  RouteContract,
+  RouteRegistry,
+  RouteSpec,
+  SessionContext,
+  SessionPolicy,
+  Versioned,
+} from '@forgezero/access';
+```
+
+## @forgezero/access — Declare routes before handlers
+
+Routes and their access policy are data; Fetch and Elysia adapters enforce the same declaration.
 
 ```text
-import * as api from '@forgezero/access';
+import {
+  defineRoutes,
+  action,
+  page,
+} from '@forgezero/access';
+
+export const routes = defineRoutes({
+  orders: page('Orders'),
+  'api/orders': action('List orders', 'GET', { page: 'orders' })
+});
 ```
 
+<a id="forgezero-access-conditions"></a>
 ## @forgezero/access/conditions
 
-The twelve guards every project writes into `before`, each with the status its refusal deserves.
+The twelve guards every project writes into `before`, each with the status its refusal deserves. This entry exposes 14 named value exports and 16 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/conditions';
+import {
+  assertDeclaredRefusals,
+  loadTarget,
+  refusalsFor,
+  requireApproval,
+  requireBalance,
+  requireIdempotency,
+  requireNotFrozen,
+  requireOwner,
+  requireQuota,
+  requireService,
+  requireState,
+  requireTier,
+  requireUnlocked,
+  requireVersion,
+} from '@forgezero/access/conditions';
+
+import type {
+  ApprovalState,
+  Condition,
+  IdempotencyStore,
+  LoadTargetOptions,
+  RefusalSpec,
+  RequireApprovalOptions,
+  RequireBalanceOptions,
+  RequireIdempotencyOptions,
+  RequireNotFrozenOptions,
+  RequireOwnerOptions,
+  RequireQuotaOptions,
+  RequireServiceOptions,
+  RequireStateOptions,
+  RequireTierOptions,
+  RequireUnlockedOptions,
+  RequireVersionOptions,
+} from '@forgezero/access/conditions';
 ```
 
+<a id="forgezero-access-effects"></a>
 ## @forgezero/access/effects
 
-Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it.
+Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. This entry exposes 6 named value exports and 15 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/effects';
+import {
+  audit,
+  emit,
+  invalidate,
+  meter,
+  notify,
+  settlementOf,
+} from '@forgezero/access/effects';
+
+import type {
+  AuditOptions,
+  AuditRecord,
+  AuditSink,
+  CacheInvalidator,
+  Effect,
+  EmitOptions,
+  InvalidateOptions,
+  MeterOptions,
+  Notification,
+  Notifier,
+  NotifyOptions,
+  Outbox,
+  OutboxEvent,
+  Settlement,
+  UsageMeter,
+} from '@forgezero/access/effects';
 ```
 
+<a id="forgezero-access-security"></a>
 ## @forgezero/access/security
 
-Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only.
+Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. This entry exposes 20 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/security';
+import {
+  fromBase64Url,
+  fromHex,
+  hashToken,
+  hkdf,
+  hmacSha256,
+  isLive,
+  nowSeconds,
+  open,
+  randomDigits,
+  randomHex,
+  randomInt,
+  randomToken,
+  redact,
+  seal,
+  secretFieldPattern,
+  sha256,
+  timingSafeEqual,
+  toBase64Url,
+  toHex,
+  verifyHmac,
+} from '@forgezero/access/security';
+
+import type {
+  Sealed,
+} from '@forgezero/access/security';
 ```
 
+<a id="forgezero-access-rate-limit"></a>
 ## @forgezero/access/rate-limit
 
-Request counters over a window — in memory, in Redis, or in a Durable Object.
+Request counters over a window — in memory, in Redis, or in a Durable Object. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/rate-limit';
+import {
+  durableObjectStore,
+  memoryStore,
+  redisStore,
+  slidingWindowStore,
+} from '@forgezero/access/rate-limit';
+
+import type {
+  DurableStorageLike,
+  RedisLike,
+} from '@forgezero/access/rate-limit';
 ```
 
+<a id="forgezero-access-fetch"></a>
 ## @forgezero/access/fetch
 
-A Fetch-native adapter over the declared access pipeline.
+A Fetch-native adapter over the declared access pipeline. This entry exposes 3 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/fetch';
+import {
+  compileRoute,
+  matchRoute,
+  toFetch,
+} from '@forgezero/access/fetch';
+
+import type {
+  FetchHandler,
+} from '@forgezero/access/fetch';
 ```
 
+<a id="forgezero-access-pipeline"></a>
 ## @forgezero/access/pipeline
 
-The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline.
+The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. This entry exposes 3 named value exports and 9 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/pipeline';
+import {
+  createPipeline,
+  defineHandlers,
+  windowSeconds,
+} from '@forgezero/access/pipeline';
+
+import type {
+  Handler,
+  HandlerRegistry,
+  Pipeline,
+  PipelineOptions,
+  RateStore,
+  SessionResolver,
+  StepUpStore,
+  Telemetry,
+  Validator,
+} from '@forgezero/access/pipeline';
 ```
 
+<a id="forgezero-access-elysia"></a>
 ## @forgezero/access/elysia
 
-Elysia integration over the same access pipeline and route declarations.
+Elysia integration over the same access pipeline and route declarations. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/elysia';
+import {
+  elysia,
+  forbiddenTelemetryAttribute,
+  telemetryFrom,
+  toElysiaPath,
+} from '@forgezero/access/elysia';
+
+import type {
+  ElysiaAdapterOptions,
+  OtelTracer,
+} from '@forgezero/access/elysia';
 ```
 
+<a id="forgezero-access-client"></a>
 ## @forgezero/access/client
 
-Typed client helpers that fulfil factors without duplicating the security matrix.
+Typed client helpers that fulfil factors without duplicating the security matrix. This entry exposes 2 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/client';
+import {
+  buildPath,
+  createClient,
+} from '@forgezero/access/client';
+
+import type {
+  ChallengeHandler,
+  ClientOptions,
+  ClientResult,
+  Problem,
+  RequestArgs,
+  SecurityChallenge,
+} from '@forgezero/access/client';
 ```
 
+<a id="forgezero-access-testing"></a>
 ## @forgezero/access/testing
 
-Deterministic access-pipeline fixtures and assertions for consumer tests.
+Deterministic access-pipeline fixtures and assertions for consumer tests. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/testing';
+import {
+  reachableRoutes,
+  simulate,
+  unreachableRoutes,
+} from '@forgezero/access/testing';
+
+import type {
+  SimulateArgs,
+  Verdict,
+} from '@forgezero/access/testing';
 ```
 
+<a id="forgezero-access-header"></a>
 ## @forgezero/access/header
 
-Strict configurable header-identity extraction with canonical names and bounded values.
+Strict configurable header-identity extraction with canonical names and bounded values. This entry exposes 2 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/header';
+import {
+  defineHeaderIdentitySources,
+  headerIdentityResolver,
+} from '@forgezero/access/header';
+
+import type {
+  HeaderAssignmentResolver,
+  HeaderIdentity,
+  HeaderIdentitySource,
+  HeaderPrincipal,
+} from '@forgezero/access/header';
 ```
 
+<a id="forgezero-access-principal"></a>
 ## @forgezero/access/principal
 
-Generic principal-source resolution for browser, API-key, attestation or future identity adapters.
+Generic principal-source resolution for browser, API-key, attestation or future identity adapters. This entry exposes 4 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/principal';
+import {
+  assignmentIsActive,
+  decidePrincipalAccess,
+  defineRbacPrincipal,
+  touchPrincipalAssignment,
+} from '@forgezero/access/principal';
+
+import type {
+  PrincipalAccessDecision,
+  PrincipalAssignment,
+  RbacPrincipal,
+} from '@forgezero/access/principal';
 ```
 
+<a id="forgezero-access-principal-session"></a>
 ## @forgezero/access/principal-session
 
-Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry.
+Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. This entry exposes 8 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/principal-session';
+import {
+  DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS,
+  DEFAULT_PRINCIPAL_IDLE_TTL_MS,
+  MAX_PRINCIPAL_ABSOLUTE_TTL_MS,
+  MAX_PRINCIPAL_IDLE_TTL_MS,
+  authenticatePrincipalSession,
+  issuePrincipalSession,
+  principalSessionIsActive,
+  touchPrincipalSession,
+} from '@forgezero/access/principal-session';
+
+import type {
+  IssuedPrincipalSession,
+  PrincipalSessionRecord,
+} from '@forgezero/access/principal-session';
 ```
 
+<a id="forgezero-access-authenticator"></a>
 ## @forgezero/access/authenticator
 
-Authentication-source contracts for adding identity mechanisms without changing route policy.
+Authentication-source contracts for adding identity mechanisms without changing route policy. This entry exposes 2 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/access/authenticator';
+import {
+  createAuthenticator,
+  encoding,
+} from '@forgezero/access/authenticator';
+
+import type {
+  AuthenticationOptions,
+  AuthenticationResponse,
+  Authenticator,
+  AuthenticatorOptions,
+  Credential,
+  RegistrationOptions,
+  RegistrationResponse,
+} from '@forgezero/access/authenticator';
 ```
 
+<a id="forgezero-access-ceremony-modes"></a>
 ## @forgezero/access/ceremony-modes
 
-Named security-ceremony modes and their session/action fulfilment semantics.
-
-```text
-import * as api from '@forgezero/access/ceremony-modes';
-```
-
-## Declare routes before handlers
-
-Routes and their access policy are data; Fetch and Elysia adapters enforce the same declaration.
+Named security-ceremony modes and their session/action fulfilment semantics. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { defineRoutes, action, page } from '@forgezero/access';
-
-export const routes = defineRoutes({
-  orders: page('Orders'),
-  'api/orders': action('List orders', 'GET', { page: 'orders' })
-});
+import {
+  MAX_CUSTODIANS,
+  THRESHOLD_MODES,
+  thresholdMode,
+} from '@forgezero/access/ceremony-modes';
+
+import type {
+  ThresholdMode,
+  ThresholdModeId,
+} from '@forgezero/access/ceremony-modes';
 ```
 
 ## 1. Install
@@ -171,7 +482,12 @@ bun add @forgezero/access
 Routes carry their contract — label, method, and the shapes they accept and return. WHO may reach them is a separate list, because the two change for different reasons and on different schedules.
 
 ```text
-import { defineRoutes, defineAccessControl, page, action } from '@forgezero/access';
+import {
+  defineRoutes,
+  defineAccessControl,
+  page,
+  action,
+} from '@forgezero/access';
 
 export const ROUTES = defineRoutes({
   orders:                    page('Orders'),
@@ -195,11 +511,15 @@ One line per runtime. The pipeline is written once and shared, so an adapter nev
 
 ```text
 // anywhere fetch exists — Workers, Deno, Node, Bun
-import { toFetch } from '@forgezero/access/fetch';
+import {
+  toFetch,
+} from '@forgezero/access/fetch';
 export default { fetch: toFetch({ access: ACCESS, handlers: HANDLERS }) };
 
 // Elysia
-import { elysia } from '@forgezero/access/elysia';
+import {
+  elysia,
+} from '@forgezero/access/elysia';
 app.use(elysia({ access: ACCESS, handlers: HANDLERS, Elysia }));
 ```
 
@@ -245,7 +565,10 @@ impactOfDisabling(ACCESS, ['passkey'])
 simulate() reports which policy decided, which a browser 403 never tells you. reachableRoutes() answers what a role can actually do — worth running, because stem inheritance grants more than a grant list reads like.
 
 ```text
-import { simulate, reachableRoutes } from '@forgezero/access/testing';
+import {
+  simulate,
+  reachableRoutes,
+} from '@forgezero/access/testing';
 
 simulate(ACCESS, { route: 'api/settings', roles, as: 'member' });
 // { allowed: false, status: 403, reason: 'ACCESS_DENIED', sessionPolicy: 'admin' }
@@ -296,7 +619,11 @@ assertDeclaredRefusals({ routes: ROUTES, conditions: CONDITIONS });
 Audit, emit, meter, invalidate and notify. None can fail the request — a dead audit sink must not turn a completed transfer into a 500. Audit records denials as well as successes, because a run of 403s from one session is the signal an incident is reconstructed from. Every payload is redacted first.
 
 ```text
-import { audit, emit, meter } from '@forgezero/access/effects';
+import {
+  audit,
+  emit,
+  meter,
+} from '@forgezero/access/effects';
 
 afterHandlers: {
   trail: audit({ routes: [...], sink }),

package/dist/ceremony-modes.d.ts

@@ -26,46 +26,7 @@ export interface ThresholdMode {
      *  cannot read it uniformly across the set. */
     recommended: boolean;
 }
-export declare const THRESHOLD_MODES: readonly [{
-    readonly id: "1-of-2";
-    readonly threshold: 1;
-    readonly total: 2;
-    readonly label: "1 of 2";
-    readonly description: "Either custodian can unlock alone. Survives losing one person, but a single compromised custodian is enough to open the vault.";
-    readonly replicated: true;
-    readonly recommended: false;
-}, {
-    readonly id: "1-of-3";
-    readonly threshold: 1;
-    readonly total: 3;
-    readonly label: "1 of 3";
-    readonly description: "Any custodian can unlock alone. Maximum availability, minimum protection against an insider.";
-    readonly replicated: true;
-    readonly recommended: false;
-}, {
-    readonly id: "2-of-3";
-    readonly threshold: 2;
-    readonly total: 3;
-    readonly label: "2 of 3";
-    readonly description: "Two of three must convene. Survives losing one custodian, and no single person can unlock. The smallest genuinely split arrangement.";
-    readonly replicated: false;
-    readonly recommended: true;
-}, {
-    readonly id: "3-of-5";
-    readonly threshold: 3;
-    readonly total: 5;
-    readonly label: "3 of 5";
-    readonly description: "Three of five must convene. Survives losing two custodians.";
-    readonly replicated: false;
-    readonly recommended: false;
-}, {
-    readonly id: "4-of-7";
-    readonly threshold: 4;
-    readonly total: 7;
-    readonly label: "4 of 7";
-    readonly description: "Four of seven must convene. For larger governance groups.";
-    readonly replicated: false;
-    readonly recommended: false;
-}];
-export type ThresholdModeId = (typeof THRESHOLD_MODES)[number]['id'];
+export declare const MAX_CUSTODIANS = 32;
+export declare const THRESHOLD_MODES: readonly ThresholdMode[];
+export type ThresholdModeId = `${number}-of-${number}`;
 export declare function thresholdMode(id: string): ThresholdMode | undefined;

package/dist/ceremony-modes.js

@@ -1,5 +1,28 @@
 // src/ceremony-modes.ts
+var MAX_CUSTODIANS = 32;
+var majorityPreset = (threshold) => {
+  const total = threshold * 2 - 1;
+  return {
+    id: `${threshold}-of-${total}`,
+    threshold,
+    total,
+    label: `${threshold} of ${total}`,
+    description: `${threshold} of ${total} custodians must convene. Survives losing ${total - threshold} custodians.`,
+    replicated: false,
+    recommended: threshold === 2
+  };
+};
+var MAJORITY_PRESETS = Array.from({ length: 15 }, (_, index) => majorityPreset(index + 2));
 var THRESHOLD_MODES = [
+  {
+    id: "1-of-1",
+    threshold: 1,
+    total: 1,
+    label: "1 of 1",
+    description: "Bootstrap only: the first platform custodian brings custody online alone, then rotates to the long-term quorum.",
+    replicated: true,
+    recommended: false
+  },
   {
     id: "1-of-2",
     threshold: 1,
@@ -18,38 +41,31 @@ var THRESHOLD_MODES = [
     replicated: true,
     recommended: false
   },
-  {
-    id: "2-of-3",
-    threshold: 2,
-    total: 3,
-    label: "2 of 3",
-    description: "Two of three must convene. Survives losing one custodian, and no single person can unlock. The smallest genuinely split arrangement.",
-    replicated: false,
-    recommended: true
-  },
-  {
-    id: "3-of-5",
-    threshold: 3,
-    total: 5,
-    label: "3 of 5",
-    description: "Three of five must convene. Survives losing two custodians.",
-    replicated: false,
-    recommended: false
-  },
-  {
-    id: "4-of-7",
-    threshold: 4,
-    total: 7,
-    label: "4 of 7",
-    description: "Four of seven must convene. For larger governance groups.",
-    replicated: false,
-    recommended: false
-  }
+  ...MAJORITY_PRESETS
 ];
 function thresholdMode(id) {
-  return THRESHOLD_MODES.find((mode) => mode.id === id);
+  const preset = THRESHOLD_MODES.find((mode) => mode.id === id);
+  if (preset)
+    return preset;
+  const match = /^(\d{1,2})-of-(\d{1,2})$/.exec(id);
+  if (!match)
+    return;
+  const threshold = Number(match[1]);
+  const total = Number(match[2]);
+  if (!Number.isSafeInteger(threshold) || !Number.isSafeInteger(total) || threshold < 1 || total < 1 || threshold > total || total > MAX_CUSTODIANS)
+    return;
+  return {
+    id: `${threshold}-of-${total}`,
+    threshold,
+    total,
+    label: `${threshold} of ${total}`,
+    description: threshold === 1 ? `Any one of ${total} custodians can unlock alone.` : `${threshold} of ${total} custodians must convene.`,
+    replicated: threshold === 1,
+    recommended: false
+  };
 }
 export {
   thresholdMode,
-  THRESHOLD_MODES
+  THRESHOLD_MODES,
+  MAX_CUSTODIANS
 };

package/dist/conditions.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/conditions.ts
 function define(condition, routes, refusals, run) {

package/dist/effects.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/elysia.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/fetch.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/header.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;

package/dist/index.d.ts

@@ -379,4 +379,4 @@ export declare function impactOfDisabling<R extends RouteRegistry>(access: Acces
     available: number;
     required: number;
 }[];
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.1.5";

package/dist/index.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 export {
   stemOf,
   resolveActionFactors,

package/dist/pipeline.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/principal-session.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/principal.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;

package/dist/testing.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.0";
+var VERSION = "0.1.5";
 
 // src/testing.ts
 function nameOf(policies, route) {

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@forgezero/access",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "publishConfig": {
     "access": "public",
-    "provenance": true
+    "provenance": false
   },
   "exports": {
     ".": {
@@ -68,17 +68,16 @@
       "default": "./dist/ceremony-modes.js"
     }
   },
-	"scripts": {
-		"check": "tsc --noEmit",
-		"prebuild": "rm -rf dist",
-    "build": "bun build src/index.ts src/fetch.ts src/pipeline.ts src/elysia.ts src/client.ts src/testing.ts src/rate-limit.ts src/security.ts src/header.ts src/principal.ts src/principal-session.ts src/conditions.ts src/effects.ts src/authenticator.ts src/ceremony-modes.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
-    "prepublishOnly": "bun run check && bun run build"
+  "scripts": {
+    "check": "tsc --noEmit",
+    "build": "bun ../tools/package-task.ts build access",
+    "prepublishOnly": "bun ../tools/package-task.ts prepublish access"
   },
   "devDependencies": {
     "typescript": "^5.6.0",
     "@types/bun": "latest"
   },
-  "description": "Route matrix, RBAC and security factors. Zero runtime dependencies \u2014 runs anywhere fetch does.",
+  "description": "Route matrix, RBAC and security factors. Zero runtime dependencies — runs anywhere fetch does.",
   "keywords": [
     "rbac",
     "authorization",