@forgezero/access 0.1.4 → 0.1.5

package/README.md

@@ -62,18 +62,62 @@ bun add @forgezero/access
 <a id="forgezero-access"></a>
 ## @forgezero/access
 
-Declare routes, factors and policies as orthogonal lists; authorise against them. Named value imports: AccessError, Refusal, SCHEMA_VERSION, Settled, VERSION, action, assertReadable, authorise, codePolicy, defineAccessControl, defineFactors, defineRoutes, externalPolicy, fulfilledActionFactors, grantsRoute, impactOfDisabling, isRefusal, isSettled, page, resolveActionFactors, stemOf. Named type imports: AccessControl, AccessControlConfig, ActionPolicy, ActionRoute, AfterHandler, BeforeHandler, Binding, FactorContext, FactorKind, FactorRegistry, FactorSpec, GrantOptions, Method, Outcome, PageRoute, PolicySource, Problem, RatePolicy, RequestContext, Role, RouteBase, RouteContract, RouteRegistry, RouteSpec, SessionContext, SessionPolicy, Versioned. Import only the names used by this file.
+Declare routes, factors and policies as orthogonal lists; authorise against them. This entry exposes 21 named value exports and 27 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { AccessError, Refusal, SCHEMA_VERSION, Settled, VERSION, action } from '@forgezero/access';
-import { assertReadable, authorise, codePolicy, defineAccessControl, defineFactors, defineRoutes } from '@forgezero/access';
-import { externalPolicy, fulfilledActionFactors, grantsRoute, impactOfDisabling, isRefusal, isSettled } from '@forgezero/access';
-import { page, resolveActionFactors, stemOf } from '@forgezero/access';
-import type { AccessControl, AccessControlConfig, ActionPolicy, ActionRoute, AfterHandler, BeforeHandler } from '@forgezero/access';
-import type { Binding, FactorContext, FactorKind, FactorRegistry, FactorSpec, GrantOptions } from '@forgezero/access';
-import type { Method, Outcome, PageRoute, PolicySource, Problem, RatePolicy } from '@forgezero/access';
-import type { RequestContext, Role, RouteBase, RouteContract, RouteRegistry, RouteSpec } from '@forgezero/access';
-import type { SessionContext, SessionPolicy, Versioned } from '@forgezero/access';
+import {
+  AccessError,
+  Refusal,
+  SCHEMA_VERSION,
+  Settled,
+  VERSION,
+  action,
+  assertReadable,
+  authorise,
+  codePolicy,
+  defineAccessControl,
+  defineFactors,
+  defineRoutes,
+  externalPolicy,
+  fulfilledActionFactors,
+  grantsRoute,
+  impactOfDisabling,
+  isRefusal,
+  isSettled,
+  page,
+  resolveActionFactors,
+  stemOf,
+} from '@forgezero/access';
+
+import type {
+  AccessControl,
+  AccessControlConfig,
+  ActionPolicy,
+  ActionRoute,
+  AfterHandler,
+  BeforeHandler,
+  Binding,
+  FactorContext,
+  FactorKind,
+  FactorRegistry,
+  FactorSpec,
+  GrantOptions,
+  Method,
+  Outcome,
+  PageRoute,
+  PolicySource,
+  Problem,
+  RatePolicy,
+  RequestContext,
+  Role,
+  RouteBase,
+  RouteContract,
+  RouteRegistry,
+  RouteSpec,
+  SessionContext,
+  SessionPolicy,
+  Versioned,
+} from '@forgezero/access';
 ```
 
 ## @forgezero/access — Declare routes before handlers
@@ -81,7 +125,11 @@ import type { SessionContext, SessionPolicy, Versioned } from '@forgezero/access
 Routes and their access policy are data; Fetch and Elysia adapters enforce the same declaration.
 
 ```text
-import { defineRoutes, action, page } from '@forgezero/access';
+import {
+  defineRoutes,
+  action,
+  page,
+} from '@forgezero/access';
 
 export const routes = defineRoutes({
   orders: page('Orders'),
@@ -92,153 +140,333 @@ export const routes = defineRoutes({
 <a id="forgezero-access-conditions"></a>
 ## @forgezero/access/conditions
 
-The twelve guards every project writes into `before`, each with the status its refusal deserves. Named value imports: assertDeclaredRefusals, loadTarget, refusalsFor, requireApproval, requireBalance, requireIdempotency, requireNotFrozen, requireOwner, requireQuota, requireService, requireState, requireTier, requireUnlocked, requireVersion. Named type imports: ApprovalState, Condition, IdempotencyStore, LoadTargetOptions, RefusalSpec, RequireApprovalOptions, RequireBalanceOptions, RequireIdempotencyOptions, RequireNotFrozenOptions, RequireOwnerOptions, RequireQuotaOptions, RequireServiceOptions, RequireStateOptions, RequireTierOptions, RequireUnlockedOptions, RequireVersionOptions. Import only the names used by this file.
+The twelve guards every project writes into `before`, each with the status its refusal deserves. This entry exposes 14 named value exports and 16 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { assertDeclaredRefusals, loadTarget, refusalsFor, requireApproval, requireBalance, requireIdempotency } from '@forgezero/access/conditions';
-import { requireNotFrozen, requireOwner, requireQuota, requireService, requireState, requireTier } from '@forgezero/access/conditions';
-import { requireUnlocked, requireVersion } from '@forgezero/access/conditions';
-import type { ApprovalState, Condition, IdempotencyStore, LoadTargetOptions, RefusalSpec, RequireApprovalOptions } from '@forgezero/access/conditions';
-import type { RequireBalanceOptions, RequireIdempotencyOptions, RequireNotFrozenOptions, RequireOwnerOptions, RequireQuotaOptions, RequireServiceOptions } from '@forgezero/access/conditions';
-import type { RequireStateOptions, RequireTierOptions, RequireUnlockedOptions, RequireVersionOptions } from '@forgezero/access/conditions';
+import {
+  assertDeclaredRefusals,
+  loadTarget,
+  refusalsFor,
+  requireApproval,
+  requireBalance,
+  requireIdempotency,
+  requireNotFrozen,
+  requireOwner,
+  requireQuota,
+  requireService,
+  requireState,
+  requireTier,
+  requireUnlocked,
+  requireVersion,
+} from '@forgezero/access/conditions';
+
+import type {
+  ApprovalState,
+  Condition,
+  IdempotencyStore,
+  LoadTargetOptions,
+  RefusalSpec,
+  RequireApprovalOptions,
+  RequireBalanceOptions,
+  RequireIdempotencyOptions,
+  RequireNotFrozenOptions,
+  RequireOwnerOptions,
+  RequireQuotaOptions,
+  RequireServiceOptions,
+  RequireStateOptions,
+  RequireTierOptions,
+  RequireUnlockedOptions,
+  RequireVersionOptions,
+} from '@forgezero/access/conditions';
 ```
 
 <a id="forgezero-access-effects"></a>
 ## @forgezero/access/effects
 
-Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. Named value imports: audit, emit, invalidate, meter, notify, settlementOf. Named type imports: AuditOptions, AuditRecord, AuditSink, CacheInvalidator, Effect, EmitOptions, InvalidateOptions, MeterOptions, Notification, Notifier, NotifyOptions, Outbox, OutboxEvent, Settlement, UsageMeter. Import only the names used by this file.
+Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. This entry exposes 6 named value exports and 15 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { audit, emit, invalidate, meter, notify, settlementOf } from '@forgezero/access/effects';
-import type { AuditOptions, AuditRecord, AuditSink, CacheInvalidator, Effect, EmitOptions } from '@forgezero/access/effects';
-import type { InvalidateOptions, MeterOptions, Notification, Notifier, NotifyOptions, Outbox } from '@forgezero/access/effects';
-import type { OutboxEvent, Settlement, UsageMeter } from '@forgezero/access/effects';
+import {
+  audit,
+  emit,
+  invalidate,
+  meter,
+  notify,
+  settlementOf,
+} from '@forgezero/access/effects';
+
+import type {
+  AuditOptions,
+  AuditRecord,
+  AuditSink,
+  CacheInvalidator,
+  Effect,
+  EmitOptions,
+  InvalidateOptions,
+  MeterOptions,
+  Notification,
+  Notifier,
+  NotifyOptions,
+  Outbox,
+  OutboxEvent,
+  Settlement,
+  UsageMeter,
+} from '@forgezero/access/effects';
 ```
 
 <a id="forgezero-access-security"></a>
 ## @forgezero/access/security
 
-Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. Named value imports: fromBase64Url, fromHex, hashToken, hkdf, hmacSha256, isLive, nowSeconds, open, randomDigits, randomHex, randomInt, randomToken, redact, seal, secretFieldPattern, sha256, timingSafeEqual, toBase64Url, toHex, verifyHmac. Named type imports: Sealed. Import only the names used by this file.
+Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. This entry exposes 20 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { fromBase64Url, fromHex, hashToken, hkdf, hmacSha256, isLive } from '@forgezero/access/security';
-import { nowSeconds, open, randomDigits, randomHex, randomInt, randomToken } from '@forgezero/access/security';
-import { redact, seal, secretFieldPattern, sha256, timingSafeEqual, toBase64Url } from '@forgezero/access/security';
-import { toHex, verifyHmac } from '@forgezero/access/security';
-import type { Sealed } from '@forgezero/access/security';
+import {
+  fromBase64Url,
+  fromHex,
+  hashToken,
+  hkdf,
+  hmacSha256,
+  isLive,
+  nowSeconds,
+  open,
+  randomDigits,
+  randomHex,
+  randomInt,
+  randomToken,
+  redact,
+  seal,
+  secretFieldPattern,
+  sha256,
+  timingSafeEqual,
+  toBase64Url,
+  toHex,
+  verifyHmac,
+} from '@forgezero/access/security';
+
+import type {
+  Sealed,
+} from '@forgezero/access/security';
 ```
 
 <a id="forgezero-access-rate-limit"></a>
 ## @forgezero/access/rate-limit
 
-Request counters over a window — in memory, in Redis, or in a Durable Object. Named value imports: durableObjectStore, memoryStore, redisStore, slidingWindowStore. Named type imports: DurableStorageLike, RedisLike. Import only the names used by this file.
+Request counters over a window — in memory, in Redis, or in a Durable Object. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { durableObjectStore, memoryStore, redisStore, slidingWindowStore } from '@forgezero/access/rate-limit';
-import type { DurableStorageLike, RedisLike } from '@forgezero/access/rate-limit';
+import {
+  durableObjectStore,
+  memoryStore,
+  redisStore,
+  slidingWindowStore,
+} from '@forgezero/access/rate-limit';
+
+import type {
+  DurableStorageLike,
+  RedisLike,
+} from '@forgezero/access/rate-limit';
 ```
 
 <a id="forgezero-access-fetch"></a>
 ## @forgezero/access/fetch
 
-A Fetch-native adapter over the declared access pipeline. Named value imports: compileRoute, matchRoute, toFetch. Named type imports: FetchHandler. Import only the names used by this file.
+A Fetch-native adapter over the declared access pipeline. This entry exposes 3 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { compileRoute, matchRoute, toFetch } from '@forgezero/access/fetch';
-import type { FetchHandler } from '@forgezero/access/fetch';
+import {
+  compileRoute,
+  matchRoute,
+  toFetch,
+} from '@forgezero/access/fetch';
+
+import type {
+  FetchHandler,
+} from '@forgezero/access/fetch';
 ```
 
 <a id="forgezero-access-pipeline"></a>
 ## @forgezero/access/pipeline
 
-The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. Named value imports: createPipeline, defineHandlers, windowSeconds. Named type imports: Handler, HandlerRegistry, Pipeline, PipelineOptions, RateStore, SessionResolver, StepUpStore, Telemetry, Validator. Import only the names used by this file.
+The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. This entry exposes 3 named value exports and 9 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { createPipeline, defineHandlers, windowSeconds } from '@forgezero/access/pipeline';
-import type { Handler, HandlerRegistry, Pipeline, PipelineOptions, RateStore, SessionResolver } from '@forgezero/access/pipeline';
-import type { StepUpStore, Telemetry, Validator } from '@forgezero/access/pipeline';
+import {
+  createPipeline,
+  defineHandlers,
+  windowSeconds,
+} from '@forgezero/access/pipeline';
+
+import type {
+  Handler,
+  HandlerRegistry,
+  Pipeline,
+  PipelineOptions,
+  RateStore,
+  SessionResolver,
+  StepUpStore,
+  Telemetry,
+  Validator,
+} from '@forgezero/access/pipeline';
 ```
 
 <a id="forgezero-access-elysia"></a>
 ## @forgezero/access/elysia
 
-Elysia integration over the same access pipeline and route declarations. Named value imports: elysia, forbiddenTelemetryAttribute, telemetryFrom, toElysiaPath. Named type imports: ElysiaAdapterOptions, OtelTracer. Import only the names used by this file.
+Elysia integration over the same access pipeline and route declarations. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { elysia, forbiddenTelemetryAttribute, telemetryFrom, toElysiaPath } from '@forgezero/access/elysia';
-import type { ElysiaAdapterOptions, OtelTracer } from '@forgezero/access/elysia';
+import {
+  elysia,
+  forbiddenTelemetryAttribute,
+  telemetryFrom,
+  toElysiaPath,
+} from '@forgezero/access/elysia';
+
+import type {
+  ElysiaAdapterOptions,
+  OtelTracer,
+} from '@forgezero/access/elysia';
 ```
 
 <a id="forgezero-access-client"></a>
 ## @forgezero/access/client
 
-Typed client helpers that fulfil factors without duplicating the security matrix. Named value imports: buildPath, createClient. Named type imports: ChallengeHandler, ClientOptions, ClientResult, Problem, RequestArgs, SecurityChallenge. Import only the names used by this file.
+Typed client helpers that fulfil factors without duplicating the security matrix. This entry exposes 2 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { buildPath, createClient } from '@forgezero/access/client';
-import type { ChallengeHandler, ClientOptions, ClientResult, Problem, RequestArgs, SecurityChallenge } from '@forgezero/access/client';
+import {
+  buildPath,
+  createClient,
+} from '@forgezero/access/client';
+
+import type {
+  ChallengeHandler,
+  ClientOptions,
+  ClientResult,
+  Problem,
+  RequestArgs,
+  SecurityChallenge,
+} from '@forgezero/access/client';
 ```
 
 <a id="forgezero-access-testing"></a>
 ## @forgezero/access/testing
 
-Deterministic access-pipeline fixtures and assertions for consumer tests. Named value imports: reachableRoutes, simulate, unreachableRoutes. Named type imports: SimulateArgs, Verdict. Import only the names used by this file.
+Deterministic access-pipeline fixtures and assertions for consumer tests. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { reachableRoutes, simulate, unreachableRoutes } from '@forgezero/access/testing';
-import type { SimulateArgs, Verdict } from '@forgezero/access/testing';
+import {
+  reachableRoutes,
+  simulate,
+  unreachableRoutes,
+} from '@forgezero/access/testing';
+
+import type {
+  SimulateArgs,
+  Verdict,
+} from '@forgezero/access/testing';
 ```
 
 <a id="forgezero-access-header"></a>
 ## @forgezero/access/header
 
-Strict configurable header-identity extraction with canonical names and bounded values. Named value imports: defineHeaderIdentitySources, headerIdentityResolver. Named type imports: HeaderAssignmentResolver, HeaderIdentity, HeaderIdentitySource, HeaderPrincipal. Import only the names used by this file.
+Strict configurable header-identity extraction with canonical names and bounded values. This entry exposes 2 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { defineHeaderIdentitySources, headerIdentityResolver } from '@forgezero/access/header';
-import type { HeaderAssignmentResolver, HeaderIdentity, HeaderIdentitySource, HeaderPrincipal } from '@forgezero/access/header';
+import {
+  defineHeaderIdentitySources,
+  headerIdentityResolver,
+} from '@forgezero/access/header';
+
+import type {
+  HeaderAssignmentResolver,
+  HeaderIdentity,
+  HeaderIdentitySource,
+  HeaderPrincipal,
+} from '@forgezero/access/header';
 ```
 
 <a id="forgezero-access-principal"></a>
 ## @forgezero/access/principal
 
-Generic principal-source resolution for browser, API-key, attestation or future identity adapters. Named value imports: assignmentIsActive, decidePrincipalAccess, defineRbacPrincipal, touchPrincipalAssignment. Named type imports: PrincipalAccessDecision, PrincipalAssignment, RbacPrincipal. Import only the names used by this file.
+Generic principal-source resolution for browser, API-key, attestation or future identity adapters. This entry exposes 4 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { assignmentIsActive, decidePrincipalAccess, defineRbacPrincipal, touchPrincipalAssignment } from '@forgezero/access/principal';
-import type { PrincipalAccessDecision, PrincipalAssignment, RbacPrincipal } from '@forgezero/access/principal';
+import {
+  assignmentIsActive,
+  decidePrincipalAccess,
+  defineRbacPrincipal,
+  touchPrincipalAssignment,
+} from '@forgezero/access/principal';
+
+import type {
+  PrincipalAccessDecision,
+  PrincipalAssignment,
+  RbacPrincipal,
+} from '@forgezero/access/principal';
 ```
 
 <a id="forgezero-access-principal-session"></a>
 ## @forgezero/access/principal-session
 
-Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. Named value imports: DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS, DEFAULT_PRINCIPAL_IDLE_TTL_MS, MAX_PRINCIPAL_ABSOLUTE_TTL_MS, MAX_PRINCIPAL_IDLE_TTL_MS, authenticatePrincipalSession, issuePrincipalSession, principalSessionIsActive, touchPrincipalSession. Named type imports: IssuedPrincipalSession, PrincipalSessionRecord. Import only the names used by this file.
+Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. This entry exposes 8 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS, DEFAULT_PRINCIPAL_IDLE_TTL_MS, MAX_PRINCIPAL_ABSOLUTE_TTL_MS, MAX_PRINCIPAL_IDLE_TTL_MS, authenticatePrincipalSession, issuePrincipalSession } from '@forgezero/access/principal-session';
-import { principalSessionIsActive, touchPrincipalSession } from '@forgezero/access/principal-session';
-import type { IssuedPrincipalSession, PrincipalSessionRecord } from '@forgezero/access/principal-session';
+import {
+  DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS,
+  DEFAULT_PRINCIPAL_IDLE_TTL_MS,
+  MAX_PRINCIPAL_ABSOLUTE_TTL_MS,
+  MAX_PRINCIPAL_IDLE_TTL_MS,
+  authenticatePrincipalSession,
+  issuePrincipalSession,
+  principalSessionIsActive,
+  touchPrincipalSession,
+} from '@forgezero/access/principal-session';
+
+import type {
+  IssuedPrincipalSession,
+  PrincipalSessionRecord,
+} from '@forgezero/access/principal-session';
 ```
 
 <a id="forgezero-access-authenticator"></a>
 ## @forgezero/access/authenticator
 
-Authentication-source contracts for adding identity mechanisms without changing route policy. Named value imports: createAuthenticator, encoding. Named type imports: AuthenticationOptions, AuthenticationResponse, Authenticator, AuthenticatorOptions, Credential, RegistrationOptions, RegistrationResponse. Import only the names used by this file.
+Authentication-source contracts for adding identity mechanisms without changing route policy. This entry exposes 2 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { createAuthenticator, encoding } from '@forgezero/access/authenticator';
-import type { AuthenticationOptions, AuthenticationResponse, Authenticator, AuthenticatorOptions, Credential, RegistrationOptions } from '@forgezero/access/authenticator';
-import type { RegistrationResponse } from '@forgezero/access/authenticator';
+import {
+  createAuthenticator,
+  encoding,
+} from '@forgezero/access/authenticator';
+
+import type {
+  AuthenticationOptions,
+  AuthenticationResponse,
+  Authenticator,
+  AuthenticatorOptions,
+  Credential,
+  RegistrationOptions,
+  RegistrationResponse,
+} from '@forgezero/access/authenticator';
 ```
 
 <a id="forgezero-access-ceremony-modes"></a>
 ## @forgezero/access/ceremony-modes
 
-Named security-ceremony modes and their session/action fulfilment semantics. Named value imports: MAX_CUSTODIANS, THRESHOLD_MODES, thresholdMode. Named type imports: ThresholdMode, ThresholdModeId. Import only the names used by this file.
+Named security-ceremony modes and their session/action fulfilment semantics. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { MAX_CUSTODIANS, THRESHOLD_MODES, thresholdMode } from '@forgezero/access/ceremony-modes';
-import type { ThresholdMode, ThresholdModeId } from '@forgezero/access/ceremony-modes';
+import {
+  MAX_CUSTODIANS,
+  THRESHOLD_MODES,
+  thresholdMode,
+} from '@forgezero/access/ceremony-modes';
+
+import type {
+  ThresholdMode,
+  ThresholdModeId,
+} from '@forgezero/access/ceremony-modes';
 ```
 
 ## 1. Install
@@ -254,7 +482,12 @@ bun add @forgezero/access
 Routes carry their contract — label, method, and the shapes they accept and return. WHO may reach them is a separate list, because the two change for different reasons and on different schedules.
 
 ```text
-import { defineRoutes, defineAccessControl, page, action } from '@forgezero/access';
+import {
+  defineRoutes,
+  defineAccessControl,
+  page,
+  action,
+} from '@forgezero/access';
 
 export const ROUTES = defineRoutes({
   orders:                    page('Orders'),
@@ -278,11 +511,15 @@ One line per runtime. The pipeline is written once and shared, so an adapter nev
 
 ```text
 // anywhere fetch exists — Workers, Deno, Node, Bun
-import { toFetch } from '@forgezero/access/fetch';
+import {
+  toFetch,
+} from '@forgezero/access/fetch';
 export default { fetch: toFetch({ access: ACCESS, handlers: HANDLERS }) };
 
 // Elysia
-import { elysia } from '@forgezero/access/elysia';
+import {
+  elysia,
+} from '@forgezero/access/elysia';
 app.use(elysia({ access: ACCESS, handlers: HANDLERS, Elysia }));
 ```
 
@@ -328,7 +565,10 @@ impactOfDisabling(ACCESS, ['passkey'])
 simulate() reports which policy decided, which a browser 403 never tells you. reachableRoutes() answers what a role can actually do — worth running, because stem inheritance grants more than a grant list reads like.
 
 ```text
-import { simulate, reachableRoutes } from '@forgezero/access/testing';
+import {
+  simulate,
+  reachableRoutes,
+} from '@forgezero/access/testing';
 
 simulate(ACCESS, { route: 'api/settings', roles, as: 'member' });
 // { allowed: false, status: 403, reason: 'ACCESS_DENIED', sessionPolicy: 'admin' }
@@ -379,7 +619,11 @@ assertDeclaredRefusals({ routes: ROUTES, conditions: CONDITIONS });
 Audit, emit, meter, invalidate and notify. None can fail the request — a dead audit sink must not turn a completed transfer into a 500. Audit records denials as well as successes, because a run of 403s from one session is the signal an incident is reconstructed from. Every payload is redacted first.
 
 ```text
-import { audit, emit, meter } from '@forgezero/access/effects';
+import {
+  audit,
+  emit,
+  meter,
+} from '@forgezero/access/effects';
 
 afterHandlers: {
   trail: audit({ routes: [...], sink }),

package/dist/conditions.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/conditions.ts
 function define(condition, routes, refusals, run) {

package/dist/effects.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/elysia.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/fetch.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/header.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;

package/dist/index.d.ts

@@ -379,4 +379,4 @@ export declare function impactOfDisabling<R extends RouteRegistry>(access: Acces
     available: number;
     required: number;
 }[];
-export declare const VERSION = "0.1.4";
+export declare const VERSION = "0.1.5";

package/dist/index.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 export {
   stemOf,
   resolveActionFactors,

package/dist/pipeline.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/principal-session.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/principal.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;

package/dist/testing.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 
 // src/testing.ts
 function nameOf(policies, route) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/access",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "publishConfig": {
     "access": "public",