@forgezero/access 0.1.4 → 0.1.6

package/README.md

@@ -35,21 +35,21 @@ Every row links to the detailed explanation and named-import/example area below.
 
 | public entry | short description | runtime | details |
 |---|---|---|---|
-| @forgezero/access | Declare routes, factors and policies as orthogonal lists; authorise against them. | portable | [Details + example](#forgezero-access) |
-| @forgezero/access/conditions | The twelve guards every project writes into `before`, each with the status its refusal deserves. | portable | [Details + example](#forgezero-access-conditions) |
-| @forgezero/access/effects | Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. | portable | [Details + example](#forgezero-access-effects) |
-| @forgezero/access/security | Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. | portable | [Details + example](#forgezero-access-security) |
-| @forgezero/access/rate-limit | Request counters over a window — in memory, in Redis, or in a Durable Object. | portable | [Details + example](#forgezero-access-rate-limit) |
-| @forgezero/access/fetch | A Fetch-native adapter over the declared access pipeline. | portable | [Details + example](#forgezero-access-fetch) |
-| @forgezero/access/pipeline | The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. | portable | [Details + example](#forgezero-access-pipeline) |
-| @forgezero/access/elysia | Elysia integration over the same access pipeline and route declarations. | portable | [Details + example](#forgezero-access-elysia) |
-| @forgezero/access/client | Typed client helpers that fulfil factors without duplicating the security matrix. | portable | [Details + example](#forgezero-access-client) |
-| @forgezero/access/testing | Deterministic access-pipeline fixtures and assertions for consumer tests. | portable | [Details + example](#forgezero-access-testing) |
-| @forgezero/access/header | Strict configurable header-identity extraction with canonical names and bounded values. | portable | [Details + example](#forgezero-access-header) |
-| @forgezero/access/principal | Generic principal-source resolution for browser, API-key, attestation or future identity adapters. | portable | [Details + example](#forgezero-access-principal) |
-| @forgezero/access/principal-session | Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. | portable | [Details + example](#forgezero-access-principal-session) |
-| @forgezero/access/authenticator | Authentication-source contracts for adding identity mechanisms without changing route policy. | portable | [Details + example](#forgezero-access-authenticator) |
-| @forgezero/access/ceremony-modes | Named security-ceremony modes and their session/action fulfilment semantics. | portable | [Details + example](#forgezero-access-ceremony-modes) |
+| @forgezero/access | Declare routes, factors and policies as orthogonal lists; authorise against them. | portable | [Reference + usage](#forgezero-access) |
+| @forgezero/access/conditions | The twelve guards every project writes into `before`, each with the status its refusal deserves. | portable | [Reference + usage](#forgezero-access-conditions) |
+| @forgezero/access/effects | Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. | portable | [Reference + usage](#forgezero-access-effects) |
+| @forgezero/access/security | Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. | portable | [Reference + usage](#forgezero-access-security) |
+| @forgezero/access/rate-limit | Request counters over a window — in memory, in Redis, or in a Durable Object. | portable | [Reference + usage](#forgezero-access-rate-limit) |
+| @forgezero/access/fetch | A Fetch-native adapter over the declared access pipeline. | portable | [Reference + usage](#forgezero-access-fetch) |
+| @forgezero/access/pipeline | The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. | portable | [Reference + usage](#forgezero-access-pipeline) |
+| @forgezero/access/elysia | Elysia integration over the same access pipeline and route declarations. | portable | [Reference + usage](#forgezero-access-elysia) |
+| @forgezero/access/client | Typed client helpers that fulfil factors without duplicating the security matrix. | portable | [Reference + usage](#forgezero-access-client) |
+| @forgezero/access/testing | Deterministic access-pipeline fixtures and assertions for consumer tests. | portable | [Reference + usage](#forgezero-access-testing) |
+| @forgezero/access/header | Strict configurable header-identity extraction with canonical names and bounded values. | portable | [Reference + usage](#forgezero-access-header) |
+| @forgezero/access/principal | Generic principal-source resolution for browser, API-key, attestation or future identity adapters. | portable | [Reference + usage](#forgezero-access-principal) |
+| @forgezero/access/principal-session | Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. | portable | [Reference + usage](#forgezero-access-principal-session) |
+| @forgezero/access/authenticator | Authentication-source contracts for adding identity mechanisms without changing route policy. | portable | [Reference + usage](#forgezero-access-authenticator) |
+| @forgezero/access/ceremony-modes | Named security-ceremony modes and their session/action fulfilment semantics. | portable | [Reference + usage](#forgezero-access-ceremony-modes) |
 
 ## Commands
 
@@ -62,18 +62,62 @@ bun add @forgezero/access
 <a id="forgezero-access"></a>
 ## @forgezero/access
 
-Declare routes, factors and policies as orthogonal lists; authorise against them. Named value imports: AccessError, Refusal, SCHEMA_VERSION, Settled, VERSION, action, assertReadable, authorise, codePolicy, defineAccessControl, defineFactors, defineRoutes, externalPolicy, fulfilledActionFactors, grantsRoute, impactOfDisabling, isRefusal, isSettled, page, resolveActionFactors, stemOf. Named type imports: AccessControl, AccessControlConfig, ActionPolicy, ActionRoute, AfterHandler, BeforeHandler, Binding, FactorContext, FactorKind, FactorRegistry, FactorSpec, GrantOptions, Method, Outcome, PageRoute, PolicySource, Problem, RatePolicy, RequestContext, Role, RouteBase, RouteContract, RouteRegistry, RouteSpec, SessionContext, SessionPolicy, Versioned. Import only the names used by this file.
+Declare routes, factors and policies as orthogonal lists; authorise against them. This entry exposes 21 named value exports and 27 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { AccessError, Refusal, SCHEMA_VERSION, Settled, VERSION, action } from '@forgezero/access';
-import { assertReadable, authorise, codePolicy, defineAccessControl, defineFactors, defineRoutes } from '@forgezero/access';
-import { externalPolicy, fulfilledActionFactors, grantsRoute, impactOfDisabling, isRefusal, isSettled } from '@forgezero/access';
-import { page, resolveActionFactors, stemOf } from '@forgezero/access';
-import type { AccessControl, AccessControlConfig, ActionPolicy, ActionRoute, AfterHandler, BeforeHandler } from '@forgezero/access';
-import type { Binding, FactorContext, FactorKind, FactorRegistry, FactorSpec, GrantOptions } from '@forgezero/access';
-import type { Method, Outcome, PageRoute, PolicySource, Problem, RatePolicy } from '@forgezero/access';
-import type { RequestContext, Role, RouteBase, RouteContract, RouteRegistry, RouteSpec } from '@forgezero/access';
-import type { SessionContext, SessionPolicy, Versioned } from '@forgezero/access';
+import {
+  AccessError,
+  Refusal,
+  SCHEMA_VERSION,
+  Settled,
+  VERSION,
+  action,
+  assertReadable,
+  authorise,
+  codePolicy,
+  defineAccessControl,
+  defineFactors,
+  defineRoutes,
+  externalPolicy,
+  fulfilledActionFactors,
+  grantsRoute,
+  impactOfDisabling,
+  isRefusal,
+  isSettled,
+  page,
+  resolveActionFactors,
+  stemOf,
+} from '@forgezero/access';
+
+import type {
+  AccessControl,
+  AccessControlConfig,
+  ActionPolicy,
+  ActionRoute,
+  AfterHandler,
+  BeforeHandler,
+  Binding,
+  FactorContext,
+  FactorKind,
+  FactorRegistry,
+  FactorSpec,
+  GrantOptions,
+  Method,
+  Outcome,
+  PageRoute,
+  PolicySource,
+  Problem,
+  RatePolicy,
+  RequestContext,
+  Role,
+  RouteBase,
+  RouteContract,
+  RouteRegistry,
+  RouteSpec,
+  SessionContext,
+  SessionPolicy,
+  Versioned,
+} from '@forgezero/access';
 ```
 
 ## @forgezero/access — Declare routes before handlers
@@ -81,7 +125,11 @@ import type { SessionContext, SessionPolicy, Versioned } from '@forgezero/access
 Routes and their access policy are data; Fetch and Elysia adapters enforce the same declaration.
 
 ```text
-import { defineRoutes, action, page } from '@forgezero/access';
+import {
+  defineRoutes,
+  action,
+  page,
+} from '@forgezero/access';
 
 export const routes = defineRoutes({
   orders: page('Orders'),
@@ -92,153 +140,501 @@ export const routes = defineRoutes({
 <a id="forgezero-access-conditions"></a>
 ## @forgezero/access/conditions
 
-The twelve guards every project writes into `before`, each with the status its refusal deserves. Named value imports: assertDeclaredRefusals, loadTarget, refusalsFor, requireApproval, requireBalance, requireIdempotency, requireNotFrozen, requireOwner, requireQuota, requireService, requireState, requireTier, requireUnlocked, requireVersion. Named type imports: ApprovalState, Condition, IdempotencyStore, LoadTargetOptions, RefusalSpec, RequireApprovalOptions, RequireBalanceOptions, RequireIdempotencyOptions, RequireNotFrozenOptions, RequireOwnerOptions, RequireQuotaOptions, RequireServiceOptions, RequireStateOptions, RequireTierOptions, RequireUnlockedOptions, RequireVersionOptions. Import only the names used by this file.
+The twelve guards every project writes into `before`, each with the status its refusal deserves. This entry exposes 14 named value exports and 16 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { assertDeclaredRefusals, loadTarget, refusalsFor, requireApproval, requireBalance, requireIdempotency } from '@forgezero/access/conditions';
-import { requireNotFrozen, requireOwner, requireQuota, requireService, requireState, requireTier } from '@forgezero/access/conditions';
-import { requireUnlocked, requireVersion } from '@forgezero/access/conditions';
-import type { ApprovalState, Condition, IdempotencyStore, LoadTargetOptions, RefusalSpec, RequireApprovalOptions } from '@forgezero/access/conditions';
-import type { RequireBalanceOptions, RequireIdempotencyOptions, RequireNotFrozenOptions, RequireOwnerOptions, RequireQuotaOptions, RequireServiceOptions } from '@forgezero/access/conditions';
-import type { RequireStateOptions, RequireTierOptions, RequireUnlockedOptions, RequireVersionOptions } from '@forgezero/access/conditions';
+import {
+  assertDeclaredRefusals,
+  loadTarget,
+  refusalsFor,
+  requireApproval,
+  requireBalance,
+  requireIdempotency,
+  requireNotFrozen,
+  requireOwner,
+  requireQuota,
+  requireService,
+  requireState,
+  requireTier,
+  requireUnlocked,
+  requireVersion,
+} from '@forgezero/access/conditions';
+
+import type {
+  ApprovalState,
+  Condition,
+  IdempotencyStore,
+  LoadTargetOptions,
+  RefusalSpec,
+  RequireApprovalOptions,
+  RequireBalanceOptions,
+  RequireIdempotencyOptions,
+  RequireNotFrozenOptions,
+  RequireOwnerOptions,
+  RequireQuotaOptions,
+  RequireServiceOptions,
+  RequireStateOptions,
+  RequireTierOptions,
+  RequireUnlockedOptions,
+  RequireVersionOptions,
+} from '@forgezero/access/conditions';
+```
+
+## @forgezero/access/conditions — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  assertDeclaredRefusals,
+} from '@forgezero/access/conditions';
+
+export const selectedCapability = assertDeclaredRefusals;
 ```
 
 <a id="forgezero-access-effects"></a>
 ## @forgezero/access/effects
 
-Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. Named value imports: audit, emit, invalidate, meter, notify, settlementOf. Named type imports: AuditOptions, AuditRecord, AuditSink, CacheInvalidator, Effect, EmitOptions, InvalidateOptions, MeterOptions, Notification, Notifier, NotifyOptions, Outbox, OutboxEvent, Settlement, UsageMeter. Import only the names used by this file.
+Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. This entry exposes 6 named value exports and 15 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { audit, emit, invalidate, meter, notify, settlementOf } from '@forgezero/access/effects';
-import type { AuditOptions, AuditRecord, AuditSink, CacheInvalidator, Effect, EmitOptions } from '@forgezero/access/effects';
-import type { InvalidateOptions, MeterOptions, Notification, Notifier, NotifyOptions, Outbox } from '@forgezero/access/effects';
-import type { OutboxEvent, Settlement, UsageMeter } from '@forgezero/access/effects';
+import {
+  audit,
+  emit,
+  invalidate,
+  meter,
+  notify,
+  settlementOf,
+} from '@forgezero/access/effects';
+
+import type {
+  AuditOptions,
+  AuditRecord,
+  AuditSink,
+  CacheInvalidator,
+  Effect,
+  EmitOptions,
+  InvalidateOptions,
+  MeterOptions,
+  Notification,
+  Notifier,
+  NotifyOptions,
+  Outbox,
+  OutboxEvent,
+  Settlement,
+  UsageMeter,
+} from '@forgezero/access/effects';
+```
+
+## @forgezero/access/effects — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  audit,
+} from '@forgezero/access/effects';
+
+export const selectedCapability = audit;
 ```
 
 <a id="forgezero-access-security"></a>
 ## @forgezero/access/security
 
-Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. Named value imports: fromBase64Url, fromHex, hashToken, hkdf, hmacSha256, isLive, nowSeconds, open, randomDigits, randomHex, randomInt, randomToken, redact, seal, secretFieldPattern, sha256, timingSafeEqual, toBase64Url, toHex, verifyHmac. Named type imports: Sealed. Import only the names used by this file.
+Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. This entry exposes 20 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  fromBase64Url,
+  fromHex,
+  hashToken,
+  hkdf,
+  hmacSha256,
+  isLive,
+  nowSeconds,
+  open,
+  randomDigits,
+  randomHex,
+  randomInt,
+  randomToken,
+  redact,
+  seal,
+  secretFieldPattern,
+  sha256,
+  timingSafeEqual,
+  toBase64Url,
+  toHex,
+  verifyHmac,
+} from '@forgezero/access/security';
+
+import type {
+  Sealed,
+} from '@forgezero/access/security';
+```
+
+## @forgezero/access/security — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
 
 ```text
-import { fromBase64Url, fromHex, hashToken, hkdf, hmacSha256, isLive } from '@forgezero/access/security';
-import { nowSeconds, open, randomDigits, randomHex, randomInt, randomToken } from '@forgezero/access/security';
-import { redact, seal, secretFieldPattern, sha256, timingSafeEqual, toBase64Url } from '@forgezero/access/security';
-import { toHex, verifyHmac } from '@forgezero/access/security';
-import type { Sealed } from '@forgezero/access/security';
+import {
+  fromBase64Url,
+} from '@forgezero/access/security';
+
+export const selectedCapability = fromBase64Url;
 ```
 
 <a id="forgezero-access-rate-limit"></a>
 ## @forgezero/access/rate-limit
 
-Request counters over a window — in memory, in Redis, or in a Durable Object. Named value imports: durableObjectStore, memoryStore, redisStore, slidingWindowStore. Named type imports: DurableStorageLike, RedisLike. Import only the names used by this file.
+Request counters over a window — in memory, in Redis, or in a Durable Object. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  durableObjectStore,
+  memoryStore,
+  redisStore,
+  slidingWindowStore,
+} from '@forgezero/access/rate-limit';
+
+import type {
+  DurableStorageLike,
+  RedisLike,
+} from '@forgezero/access/rate-limit';
+```
+
+## @forgezero/access/rate-limit — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
 
 ```text
-import { durableObjectStore, memoryStore, redisStore, slidingWindowStore } from '@forgezero/access/rate-limit';
-import type { DurableStorageLike, RedisLike } from '@forgezero/access/rate-limit';
+import {
+  durableObjectStore,
+} from '@forgezero/access/rate-limit';
+
+export const selectedCapability = durableObjectStore;
 ```
 
 <a id="forgezero-access-fetch"></a>
 ## @forgezero/access/fetch
 
-A Fetch-native adapter over the declared access pipeline. Named value imports: compileRoute, matchRoute, toFetch. Named type imports: FetchHandler. Import only the names used by this file.
+A Fetch-native adapter over the declared access pipeline. This entry exposes 3 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { compileRoute, matchRoute, toFetch } from '@forgezero/access/fetch';
-import type { FetchHandler } from '@forgezero/access/fetch';
+import {
+  compileRoute,
+  matchRoute,
+  toFetch,
+} from '@forgezero/access/fetch';
+
+import type {
+  FetchHandler,
+} from '@forgezero/access/fetch';
+```
+
+## @forgezero/access/fetch — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  compileRoute,
+} from '@forgezero/access/fetch';
+
+export const selectedCapability = compileRoute;
 ```
 
 <a id="forgezero-access-pipeline"></a>
 ## @forgezero/access/pipeline
 
-The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. Named value imports: createPipeline, defineHandlers, windowSeconds. Named type imports: Handler, HandlerRegistry, Pipeline, PipelineOptions, RateStore, SessionResolver, StepUpStore, Telemetry, Validator. Import only the names used by this file.
+The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. This entry exposes 3 named value exports and 9 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { createPipeline, defineHandlers, windowSeconds } from '@forgezero/access/pipeline';
-import type { Handler, HandlerRegistry, Pipeline, PipelineOptions, RateStore, SessionResolver } from '@forgezero/access/pipeline';
-import type { StepUpStore, Telemetry, Validator } from '@forgezero/access/pipeline';
+import {
+  createPipeline,
+  defineHandlers,
+  windowSeconds,
+} from '@forgezero/access/pipeline';
+
+import type {
+  Handler,
+  HandlerRegistry,
+  Pipeline,
+  PipelineOptions,
+  RateStore,
+  SessionResolver,
+  StepUpStore,
+  Telemetry,
+  Validator,
+} from '@forgezero/access/pipeline';
+```
+
+## @forgezero/access/pipeline — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  createPipeline,
+} from '@forgezero/access/pipeline';
+
+export const selectedCapability = createPipeline;
 ```
 
 <a id="forgezero-access-elysia"></a>
 ## @forgezero/access/elysia
 
-Elysia integration over the same access pipeline and route declarations. Named value imports: elysia, forbiddenTelemetryAttribute, telemetryFrom, toElysiaPath. Named type imports: ElysiaAdapterOptions, OtelTracer. Import only the names used by this file.
+Elysia integration over the same access pipeline and route declarations. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  elysia,
+  forbiddenTelemetryAttribute,
+  telemetryFrom,
+  toElysiaPath,
+} from '@forgezero/access/elysia';
+
+import type {
+  ElysiaAdapterOptions,
+  OtelTracer,
+} from '@forgezero/access/elysia';
+```
+
+## @forgezero/access/elysia — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
 
 ```text
-import { elysia, forbiddenTelemetryAttribute, telemetryFrom, toElysiaPath } from '@forgezero/access/elysia';
-import type { ElysiaAdapterOptions, OtelTracer } from '@forgezero/access/elysia';
+import {
+  elysia,
+} from '@forgezero/access/elysia';
+
+export const selectedCapability = elysia;
 ```
 
 <a id="forgezero-access-client"></a>
 ## @forgezero/access/client
 
-Typed client helpers that fulfil factors without duplicating the security matrix. Named value imports: buildPath, createClient. Named type imports: ChallengeHandler, ClientOptions, ClientResult, Problem, RequestArgs, SecurityChallenge. Import only the names used by this file.
+Typed client helpers that fulfil factors without duplicating the security matrix. This entry exposes 2 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { buildPath, createClient } from '@forgezero/access/client';
-import type { ChallengeHandler, ClientOptions, ClientResult, Problem, RequestArgs, SecurityChallenge } from '@forgezero/access/client';
+import {
+  buildPath,
+  createClient,
+} from '@forgezero/access/client';
+
+import type {
+  ChallengeHandler,
+  ClientOptions,
+  ClientResult,
+  Problem,
+  RequestArgs,
+  SecurityChallenge,
+} from '@forgezero/access/client';
+```
+
+## @forgezero/access/client — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  buildPath,
+} from '@forgezero/access/client';
+
+export const selectedCapability = buildPath;
 ```
 
 <a id="forgezero-access-testing"></a>
 ## @forgezero/access/testing
 
-Deterministic access-pipeline fixtures and assertions for consumer tests. Named value imports: reachableRoutes, simulate, unreachableRoutes. Named type imports: SimulateArgs, Verdict. Import only the names used by this file.
+Deterministic access-pipeline fixtures and assertions for consumer tests. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { reachableRoutes, simulate, unreachableRoutes } from '@forgezero/access/testing';
-import type { SimulateArgs, Verdict } from '@forgezero/access/testing';
+import {
+  reachableRoutes,
+  simulate,
+  unreachableRoutes,
+} from '@forgezero/access/testing';
+
+import type {
+  SimulateArgs,
+  Verdict,
+} from '@forgezero/access/testing';
+```
+
+## @forgezero/access/testing — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  reachableRoutes,
+} from '@forgezero/access/testing';
+
+export const selectedCapability = reachableRoutes;
 ```
 
 <a id="forgezero-access-header"></a>
 ## @forgezero/access/header
 
-Strict configurable header-identity extraction with canonical names and bounded values. Named value imports: defineHeaderIdentitySources, headerIdentityResolver. Named type imports: HeaderAssignmentResolver, HeaderIdentity, HeaderIdentitySource, HeaderPrincipal. Import only the names used by this file.
+Strict configurable header-identity extraction with canonical names and bounded values. This entry exposes 2 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  defineHeaderIdentitySources,
+  headerIdentityResolver,
+} from '@forgezero/access/header';
+
+import type {
+  HeaderAssignmentResolver,
+  HeaderIdentity,
+  HeaderIdentitySource,
+  HeaderPrincipal,
+} from '@forgezero/access/header';
+```
+
+## @forgezero/access/header — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
 
 ```text
-import { defineHeaderIdentitySources, headerIdentityResolver } from '@forgezero/access/header';
-import type { HeaderAssignmentResolver, HeaderIdentity, HeaderIdentitySource, HeaderPrincipal } from '@forgezero/access/header';
+import {
+  defineHeaderIdentitySources,
+} from '@forgezero/access/header';
+
+export const selectedCapability = defineHeaderIdentitySources;
 ```
 
 <a id="forgezero-access-principal"></a>
 ## @forgezero/access/principal
 
-Generic principal-source resolution for browser, API-key, attestation or future identity adapters. Named value imports: assignmentIsActive, decidePrincipalAccess, defineRbacPrincipal, touchPrincipalAssignment. Named type imports: PrincipalAccessDecision, PrincipalAssignment, RbacPrincipal. Import only the names used by this file.
+Generic principal-source resolution for browser, API-key, attestation or future identity adapters. This entry exposes 4 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  assignmentIsActive,
+  decidePrincipalAccess,
+  defineRbacPrincipal,
+  touchPrincipalAssignment,
+} from '@forgezero/access/principal';
+
+import type {
+  PrincipalAccessDecision,
+  PrincipalAssignment,
+  RbacPrincipal,
+} from '@forgezero/access/principal';
+```
+
+## @forgezero/access/principal — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
 
 ```text
-import { assignmentIsActive, decidePrincipalAccess, defineRbacPrincipal, touchPrincipalAssignment } from '@forgezero/access/principal';
-import type { PrincipalAccessDecision, PrincipalAssignment, RbacPrincipal } from '@forgezero/access/principal';
+import {
+  assignmentIsActive,
+} from '@forgezero/access/principal';
+
+export const selectedCapability = assignmentIsActive;
 ```
 
 <a id="forgezero-access-principal-session"></a>
 ## @forgezero/access/principal-session
 
-Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. Named value imports: DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS, DEFAULT_PRINCIPAL_IDLE_TTL_MS, MAX_PRINCIPAL_ABSOLUTE_TTL_MS, MAX_PRINCIPAL_IDLE_TTL_MS, authenticatePrincipalSession, issuePrincipalSession, principalSessionIsActive, touchPrincipalSession. Named type imports: IssuedPrincipalSession, PrincipalSessionRecord. Import only the names used by this file.
+Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. This entry exposes 8 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS, DEFAULT_PRINCIPAL_IDLE_TTL_MS, MAX_PRINCIPAL_ABSOLUTE_TTL_MS, MAX_PRINCIPAL_IDLE_TTL_MS, authenticatePrincipalSession, issuePrincipalSession } from '@forgezero/access/principal-session';
-import { principalSessionIsActive, touchPrincipalSession } from '@forgezero/access/principal-session';
-import type { IssuedPrincipalSession, PrincipalSessionRecord } from '@forgezero/access/principal-session';
+import {
+  DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS,
+  DEFAULT_PRINCIPAL_IDLE_TTL_MS,
+  MAX_PRINCIPAL_ABSOLUTE_TTL_MS,
+  MAX_PRINCIPAL_IDLE_TTL_MS,
+  authenticatePrincipalSession,
+  issuePrincipalSession,
+  principalSessionIsActive,
+  touchPrincipalSession,
+} from '@forgezero/access/principal-session';
+
+import type {
+  IssuedPrincipalSession,
+  PrincipalSessionRecord,
+} from '@forgezero/access/principal-session';
+```
+
+## @forgezero/access/principal-session — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS,
+} from '@forgezero/access/principal-session';
+
+export const selectedCapability = DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS;
 ```
 
 <a id="forgezero-access-authenticator"></a>
 ## @forgezero/access/authenticator
 
-Authentication-source contracts for adding identity mechanisms without changing route policy. Named value imports: createAuthenticator, encoding. Named type imports: AuthenticationOptions, AuthenticationResponse, Authenticator, AuthenticatorOptions, Credential, RegistrationOptions, RegistrationResponse. Import only the names used by this file.
+Authentication-source contracts for adding identity mechanisms without changing route policy. This entry exposes 2 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { createAuthenticator, encoding } from '@forgezero/access/authenticator';
-import type { AuthenticationOptions, AuthenticationResponse, Authenticator, AuthenticatorOptions, Credential, RegistrationOptions } from '@forgezero/access/authenticator';
-import type { RegistrationResponse } from '@forgezero/access/authenticator';
+import {
+  createAuthenticator,
+  encoding,
+} from '@forgezero/access/authenticator';
+
+import type {
+  AuthenticationOptions,
+  AuthenticationResponse,
+  Authenticator,
+  AuthenticatorOptions,
+  Credential,
+  RegistrationOptions,
+  RegistrationResponse,
+} from '@forgezero/access/authenticator';
+```
+
+## @forgezero/access/authenticator — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  createAuthenticator,
+} from '@forgezero/access/authenticator';
+
+export const selectedCapability = createAuthenticator;
 ```
 
 <a id="forgezero-access-ceremony-modes"></a>
 ## @forgezero/access/ceremony-modes
 
-Named security-ceremony modes and their session/action fulfilment semantics. Named value imports: MAX_CUSTODIANS, THRESHOLD_MODES, thresholdMode. Named type imports: ThresholdMode, ThresholdModeId. Import only the names used by this file.
+Named security-ceremony modes and their session/action fulfilment semantics. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  MAX_CUSTODIANS,
+  THRESHOLD_MODES,
+  thresholdMode,
+} from '@forgezero/access/ceremony-modes';
+
+import type {
+  ThresholdMode,
+  ThresholdModeId,
+} from '@forgezero/access/ceremony-modes';
+```
+
+## @forgezero/access/ceremony-modes — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
 
 ```text
-import { MAX_CUSTODIANS, THRESHOLD_MODES, thresholdMode } from '@forgezero/access/ceremony-modes';
-import type { ThresholdMode, ThresholdModeId } from '@forgezero/access/ceremony-modes';
+import {
+  MAX_CUSTODIANS,
+} from '@forgezero/access/ceremony-modes';
+
+export const selectedCapability = MAX_CUSTODIANS;
 ```
 
 ## 1. Install
@@ -254,7 +650,12 @@ bun add @forgezero/access
 Routes carry their contract — label, method, and the shapes they accept and return. WHO may reach them is a separate list, because the two change for different reasons and on different schedules.
 
 ```text
-import { defineRoutes, defineAccessControl, page, action } from '@forgezero/access';
+import {
+  defineRoutes,
+  defineAccessControl,
+  page,
+  action,
+} from '@forgezero/access';
 
 export const ROUTES = defineRoutes({
   orders:                    page('Orders'),
@@ -278,11 +679,15 @@ One line per runtime. The pipeline is written once and shared, so an adapter nev
 
 ```text
 // anywhere fetch exists — Workers, Deno, Node, Bun
-import { toFetch } from '@forgezero/access/fetch';
+import {
+  toFetch,
+} from '@forgezero/access/fetch';
 export default { fetch: toFetch({ access: ACCESS, handlers: HANDLERS }) };
 
 // Elysia
-import { elysia } from '@forgezero/access/elysia';
+import {
+  elysia,
+} from '@forgezero/access/elysia';
 app.use(elysia({ access: ACCESS, handlers: HANDLERS, Elysia }));
 ```
 
@@ -328,7 +733,10 @@ impactOfDisabling(ACCESS, ['passkey'])
 simulate() reports which policy decided, which a browser 403 never tells you. reachableRoutes() answers what a role can actually do — worth running, because stem inheritance grants more than a grant list reads like.
 
 ```text
-import { simulate, reachableRoutes } from '@forgezero/access/testing';
+import {
+  simulate,
+  reachableRoutes,
+} from '@forgezero/access/testing';
 
 simulate(ACCESS, { route: 'api/settings', roles, as: 'member' });
 // { allowed: false, status: 403, reason: 'ACCESS_DENIED', sessionPolicy: 'admin' }
@@ -342,8 +750,12 @@ reachableRoutes(ACCESS, roles, ['member']);
 Every project writes the same dozen checks into its before-handlers. These are those checks, each declaring the status it refuses with. requireOwner answers 404 rather than 403 on purpose — a 403 confirms the record exists, which turns sequential identifiers into an enumeration oracle.
 
 ```text
-import { loadTarget, requireOwner, requireState, requireBalance }
-  from '@forgezero/access/conditions';
+import {
+  loadTarget,
+  requireOwner,
+  requireState,
+  requireBalance,
+} from '@forgezero/access/conditions';
 
 beforeHandlers: {
   load:    loadTarget({ routes: ['api/orders/[id]/refund'], load: findOrder }),
@@ -379,7 +791,11 @@ assertDeclaredRefusals({ routes: ROUTES, conditions: CONDITIONS });
 Audit, emit, meter, invalidate and notify. None can fail the request — a dead audit sink must not turn a completed transfer into a 500. Audit records denials as well as successes, because a run of 403s from one session is the signal an incident is reconstructed from. Every payload is redacted first.
 
 ```text
-import { audit, emit, meter } from '@forgezero/access/effects';
+import {
+  audit,
+  emit,
+  meter,
+} from '@forgezero/access/effects';
 
 afterHandlers: {
   trail: audit({ routes: [...], sink }),

package/dist/conditions.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/conditions.ts
 function define(condition, routes, refusals, run) {

package/dist/effects.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/elysia.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/fetch.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/header.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;
@@ -374,7 +374,15 @@ function defineHeaderIdentitySources(sources) {
     if (!KEY.test(source.key) || !HEADER.test(header)) {
       throw new AccessError("HEADER_SOURCE_INVALID", "Header identity source keys and names must be bounded atoms.");
     }
-    if (["cookie", "authorization", "x-fz-key", "x-fz-node", "x-fz-signature"].includes(header)) {
+    if ([
+      "cookie",
+      "authorization",
+      "x-fz-key",
+      "x-fz-node",
+      "x-fz-signature",
+      "x-fz-delegated-session",
+      "x-fz-delegated-binding"
+    ].includes(header)) {
       throw new AccessError("HEADER_SOURCE_RESERVED", `Header identity source "${source.key}" uses a reserved credential header.`);
     }
     if (keys.has(source.key) || headers.has(header)) {

package/dist/index.d.ts

@@ -379,4 +379,4 @@ export declare function impactOfDisabling<R extends RouteRegistry>(access: Acces
     available: number;
     required: number;
 }[];
-export declare const VERSION = "0.1.4";
+export declare const VERSION = "0.1.6";

package/dist/index.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 export {
   stemOf,
   resolveActionFactors,

package/dist/pipeline.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/principal-session.d.ts

@@ -18,7 +18,7 @@ export interface PrincipalSessionRecord {
     absoluteExpiresAtMs: number;
 }
 export interface IssuedPrincipalSession {
-    /** Returned once. Store in an HttpOnly Secure cookie, never localStorage. */
+    /** Returned once. Keep in memory or an HttpOnly Secure cookie; never localStorage. */
     credential: string;
     record: PrincipalSessionRecord;
 }

package/dist/principal-session.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/principal.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;

package/dist/testing.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.4";
+var VERSION = "0.1.6";
 
 // src/testing.ts
 function nameOf(policies, route) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/access",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "publishConfig": {
     "access": "public",