@forgezero/access 0.1.5 → 0.1.7

package/README.md

@@ -35,21 +35,21 @@ Every row links to the detailed explanation and named-import/example area below.
 
 | public entry | short description | runtime | details |
 |---|---|---|---|
-| @forgezero/access | Declare routes, factors and policies as orthogonal lists; authorise against them. | portable | [Details + example](#forgezero-access) |
-| @forgezero/access/conditions | The twelve guards every project writes into `before`, each with the status its refusal deserves. | portable | [Details + example](#forgezero-access-conditions) |
-| @forgezero/access/effects | Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. | portable | [Details + example](#forgezero-access-effects) |
-| @forgezero/access/security | Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. | portable | [Details + example](#forgezero-access-security) |
-| @forgezero/access/rate-limit | Request counters over a window — in memory, in Redis, or in a Durable Object. | portable | [Details + example](#forgezero-access-rate-limit) |
-| @forgezero/access/fetch | A Fetch-native adapter over the declared access pipeline. | portable | [Details + example](#forgezero-access-fetch) |
-| @forgezero/access/pipeline | The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. | portable | [Details + example](#forgezero-access-pipeline) |
-| @forgezero/access/elysia | Elysia integration over the same access pipeline and route declarations. | portable | [Details + example](#forgezero-access-elysia) |
-| @forgezero/access/client | Typed client helpers that fulfil factors without duplicating the security matrix. | portable | [Details + example](#forgezero-access-client) |
-| @forgezero/access/testing | Deterministic access-pipeline fixtures and assertions for consumer tests. | portable | [Details + example](#forgezero-access-testing) |
-| @forgezero/access/header | Strict configurable header-identity extraction with canonical names and bounded values. | portable | [Details + example](#forgezero-access-header) |
-| @forgezero/access/principal | Generic principal-source resolution for browser, API-key, attestation or future identity adapters. | portable | [Details + example](#forgezero-access-principal) |
-| @forgezero/access/principal-session | Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. | portable | [Details + example](#forgezero-access-principal-session) |
-| @forgezero/access/authenticator | Authentication-source contracts for adding identity mechanisms without changing route policy. | portable | [Details + example](#forgezero-access-authenticator) |
-| @forgezero/access/ceremony-modes | Named security-ceremony modes and their session/action fulfilment semantics. | portable | [Details + example](#forgezero-access-ceremony-modes) |
+| @forgezero/access | Declare routes, factors and policies as orthogonal lists; authorise against them. | portable | [Reference + usage](#forgezero-access) |
+| @forgezero/access/conditions | The twelve guards every project writes into `before`, each with the status its refusal deserves. | portable | [Reference + usage](#forgezero-access-conditions) |
+| @forgezero/access/effects | Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. | portable | [Reference + usage](#forgezero-access-effects) |
+| @forgezero/access/security | Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. | portable | [Reference + usage](#forgezero-access-security) |
+| @forgezero/access/rate-limit | Request counters over a window — in memory, in Redis, or in a Durable Object. | portable | [Reference + usage](#forgezero-access-rate-limit) |
+| @forgezero/access/fetch | A Fetch-native adapter over the declared access pipeline. | portable | [Reference + usage](#forgezero-access-fetch) |
+| @forgezero/access/pipeline | The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. | portable | [Reference + usage](#forgezero-access-pipeline) |
+| @forgezero/access/elysia | Elysia integration over the same access pipeline and route declarations. | portable | [Reference + usage](#forgezero-access-elysia) |
+| @forgezero/access/client | Typed client helpers that fulfil factors without duplicating the security matrix. | portable | [Reference + usage](#forgezero-access-client) |
+| @forgezero/access/testing | Deterministic access-pipeline fixtures and assertions for consumer tests. | portable | [Reference + usage](#forgezero-access-testing) |
+| @forgezero/access/header | Strict configurable header-identity extraction with canonical names and bounded values. | portable | [Reference + usage](#forgezero-access-header) |
+| @forgezero/access/principal | Generic principal-source resolution for browser, API-key, attestation or future identity adapters. | portable | [Reference + usage](#forgezero-access-principal) |
+| @forgezero/access/principal-session | Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. | portable | [Reference + usage](#forgezero-access-principal-session) |
+| @forgezero/access/authenticator | Authentication-source contracts for adding identity mechanisms without changing route policy. | portable | [Reference + usage](#forgezero-access-authenticator) |
+| @forgezero/access/ceremony-modes | Named security-ceremony modes and their session/action fulfilment semantics. | portable | [Reference + usage](#forgezero-access-ceremony-modes) |
 
 ## Commands
 
@@ -180,6 +180,18 @@ import type {
 } from '@forgezero/access/conditions';
 ```
 
+## @forgezero/access/conditions — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  assertDeclaredRefusals,
+} from '@forgezero/access/conditions';
+
+export const selectedCapability = assertDeclaredRefusals;
+```
+
 <a id="forgezero-access-effects"></a>
 ## @forgezero/access/effects
 
@@ -214,6 +226,18 @@ import type {
 } from '@forgezero/access/effects';
 ```
 
+## @forgezero/access/effects — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  audit,
+} from '@forgezero/access/effects';
+
+export const selectedCapability = audit;
+```
+
 <a id="forgezero-access-security"></a>
 ## @forgezero/access/security
 
@@ -248,6 +272,18 @@ import type {
 } from '@forgezero/access/security';
 ```
 
+## @forgezero/access/security — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  fromBase64Url,
+} from '@forgezero/access/security';
+
+export const selectedCapability = fromBase64Url;
+```
+
 <a id="forgezero-access-rate-limit"></a>
 ## @forgezero/access/rate-limit
 
@@ -267,6 +303,18 @@ import type {
 } from '@forgezero/access/rate-limit';
 ```
 
+## @forgezero/access/rate-limit — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  durableObjectStore,
+} from '@forgezero/access/rate-limit';
+
+export const selectedCapability = durableObjectStore;
+```
+
 <a id="forgezero-access-fetch"></a>
 ## @forgezero/access/fetch
 
@@ -284,6 +332,18 @@ import type {
 } from '@forgezero/access/fetch';
 ```
 
+## @forgezero/access/fetch — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  compileRoute,
+} from '@forgezero/access/fetch';
+
+export const selectedCapability = compileRoute;
+```
+
 <a id="forgezero-access-pipeline"></a>
 ## @forgezero/access/pipeline
 
@@ -309,6 +369,18 @@ import type {
 } from '@forgezero/access/pipeline';
 ```
 
+## @forgezero/access/pipeline — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  createPipeline,
+} from '@forgezero/access/pipeline';
+
+export const selectedCapability = createPipeline;
+```
+
 <a id="forgezero-access-elysia"></a>
 ## @forgezero/access/elysia
 
@@ -328,6 +400,18 @@ import type {
 } from '@forgezero/access/elysia';
 ```
 
+## @forgezero/access/elysia — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  elysia,
+} from '@forgezero/access/elysia';
+
+export const selectedCapability = elysia;
+```
+
 <a id="forgezero-access-client"></a>
 ## @forgezero/access/client
 
@@ -349,6 +433,18 @@ import type {
 } from '@forgezero/access/client';
 ```
 
+## @forgezero/access/client — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  buildPath,
+} from '@forgezero/access/client';
+
+export const selectedCapability = buildPath;
+```
+
 <a id="forgezero-access-testing"></a>
 ## @forgezero/access/testing
 
@@ -367,6 +463,18 @@ import type {
 } from '@forgezero/access/testing';
 ```
 
+## @forgezero/access/testing — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  reachableRoutes,
+} from '@forgezero/access/testing';
+
+export const selectedCapability = reachableRoutes;
+```
+
 <a id="forgezero-access-header"></a>
 ## @forgezero/access/header
 
@@ -386,6 +494,18 @@ import type {
 } from '@forgezero/access/header';
 ```
 
+## @forgezero/access/header — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  defineHeaderIdentitySources,
+} from '@forgezero/access/header';
+
+export const selectedCapability = defineHeaderIdentitySources;
+```
+
 <a id="forgezero-access-principal"></a>
 ## @forgezero/access/principal
 
@@ -406,6 +526,18 @@ import type {
 } from '@forgezero/access/principal';
 ```
 
+## @forgezero/access/principal — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  assignmentIsActive,
+} from '@forgezero/access/principal';
+
+export const selectedCapability = assignmentIsActive;
+```
+
 <a id="forgezero-access-principal-session"></a>
 ## @forgezero/access/principal-session
 
@@ -429,6 +561,18 @@ import type {
 } from '@forgezero/access/principal-session';
 ```
 
+## @forgezero/access/principal-session — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS,
+} from '@forgezero/access/principal-session';
+
+export const selectedCapability = DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS;
+```
+
 <a id="forgezero-access-authenticator"></a>
 ## @forgezero/access/authenticator
 
@@ -451,6 +595,18 @@ import type {
 } from '@forgezero/access/authenticator';
 ```
 
+## @forgezero/access/authenticator — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  createAuthenticator,
+} from '@forgezero/access/authenticator';
+
+export const selectedCapability = createAuthenticator;
+```
+
 <a id="forgezero-access-ceremony-modes"></a>
 ## @forgezero/access/ceremony-modes
 
@@ -469,6 +625,18 @@ import type {
 } from '@forgezero/access/ceremony-modes';
 ```
 
+## @forgezero/access/ceremony-modes — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  MAX_CUSTODIANS,
+} from '@forgezero/access/ceremony-modes';
+
+export const selectedCapability = MAX_CUSTODIANS;
+```
+
 ## 1. Install
 
 Zero runtime dependencies. The core is fetch types plus plain JSON Schema, so it runs on Bun, Node 18+, Cloudflare Workers, Deno and every edge runtime.
@@ -582,8 +750,12 @@ reachableRoutes(ACCESS, roles, ['member']);
 Every project writes the same dozen checks into its before-handlers. These are those checks, each declaring the status it refuses with. requireOwner answers 404 rather than 403 on purpose — a 403 confirms the record exists, which turns sequential identifiers into an enumeration oracle.
 
 ```text
-import { loadTarget, requireOwner, requireState, requireBalance }
-  from '@forgezero/access/conditions';
+import {
+  loadTarget,
+  requireOwner,
+  requireState,
+  requireBalance,
+} from '@forgezero/access/conditions';
 
 beforeHandlers: {
   load:    loadTarget({ routes: ['api/orders/[id]/refund'], load: findOrder }),

package/dist/conditions.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/conditions.ts
 function define(condition, routes, refusals, run) {

package/dist/effects.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/elysia.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/fetch.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/header.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;
@@ -374,7 +374,15 @@ function defineHeaderIdentitySources(sources) {
     if (!KEY.test(source.key) || !HEADER.test(header)) {
       throw new AccessError("HEADER_SOURCE_INVALID", "Header identity source keys and names must be bounded atoms.");
     }
-    if (["cookie", "authorization", "x-fz-key", "x-fz-node", "x-fz-signature"].includes(header)) {
+    if ([
+      "cookie",
+      "authorization",
+      "x-fz-key",
+      "x-fz-node",
+      "x-fz-signature",
+      "x-fz-delegated-session",
+      "x-fz-delegated-binding"
+    ].includes(header)) {
       throw new AccessError("HEADER_SOURCE_RESERVED", `Header identity source "${source.key}" uses a reserved credential header.`);
     }
     if (keys.has(source.key) || headers.has(header)) {

package/dist/index.d.ts

@@ -379,4 +379,4 @@ export declare function impactOfDisabling<R extends RouteRegistry>(access: Acces
     available: number;
     required: number;
 }[];
-export declare const VERSION = "0.1.5";
+export declare const VERSION = "0.1.7";

package/dist/index.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 export {
   stemOf,
   resolveActionFactors,

package/dist/pipeline.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/principal-session.d.ts

@@ -18,7 +18,7 @@ export interface PrincipalSessionRecord {
     absoluteExpiresAtMs: number;
 }
 export interface IssuedPrincipalSession {
-    /** Returned once. Store in an HttpOnly Secure cookie, never localStorage. */
+    /** Returned once. Keep in memory or an HttpOnly Secure cookie; never localStorage. */
     credential: string;
     record: PrincipalSessionRecord;
 }

package/dist/principal-session.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/principal.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;

package/dist/testing.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 
 // src/testing.ts
 function nameOf(policies, route) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/access",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "type": "module",
   "publishConfig": {
     "access": "public",