@forgezero/access 0.1.8 → 0.1.10

package/README.md

@@ -11,7 +11,7 @@ Declare your security posture as seven lists. Handlers hold business logic only.
 
 ## Package overview
 
-Anyone building a service on our request shape: one declared matrix of routes and factors, enforced by one pipeline whatever the framework. Imports no sibling at all, so it can be adopted on its own. Supported runtimes: bun, node, workers, deno. Package root: @forgezero/access. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
+Anyone building a service on our request shape: one declared matrix of routes and factors, enforced by one pipeline whatever the framework. Imports no sibling at all, so it can be adopted on its own. Supported runtimes: bun, node, workers, deno. Package root: @forgezero/access. Consumer documentation is curated with each module's explicit public flag; the complete internal/export inventory remains in the typed SSOT and declaration files.
 
 ```text
 bun add @forgezero/access
@@ -29,9 +29,9 @@ The five packages are installation boundaries. Choose a package by who installs
 | @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
 | @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
 
-## @forgezero/access public imports and commands
+## @forgezero/access supported imports and commands
 
-Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
+These are supported consumer entry points, not every internal module shipped for ForgeZero managed installation. Each row links to its task-oriented usage.
 
 | public entry | short description | runtime | details |
 |---|---|---|---|
@@ -62,61 +62,11 @@ bun add @forgezero/access
 <a id="forgezero-access"></a>
 ## @forgezero/access
 
-Declare routes, factors and policies as orthogonal lists; authorise against them. This entry exposes 21 named value exports and 27 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Declare routes, factors and policies as orthogonal lists; authorise against them. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   AccessError,
-  Refusal,
-  SCHEMA_VERSION,
-  Settled,
-  VERSION,
-  action,
-  assertReadable,
-  authorise,
-  codePolicy,
-  defineAccessControl,
-  defineFactors,
-  defineRoutes,
-  externalPolicy,
-  fulfilledActionFactors,
-  grantsRoute,
-  impactOfDisabling,
-  isRefusal,
-  isSettled,
-  page,
-  resolveActionFactors,
-  stemOf,
-} from '@forgezero/access';
-
-import type {
-  AccessControl,
-  AccessControlConfig,
-  ActionPolicy,
-  ActionRoute,
-  AfterHandler,
-  BeforeHandler,
-  Binding,
-  FactorContext,
-  FactorKind,
-  FactorRegistry,
-  FactorSpec,
-  GrantOptions,
-  Method,
-  Outcome,
-  PageRoute,
-  PolicySource,
-  Problem,
-  RatePolicy,
-  RequestContext,
-  Role,
-  RouteBase,
-  RouteContract,
-  RouteRegistry,
-  RouteSpec,
-  SessionContext,
-  SessionPolicy,
-  Versioned,
 } from '@forgezero/access';
 ```
 
@@ -140,43 +90,11 @@ export const routes = defineRoutes({
 <a id="forgezero-access-conditions"></a>
 ## @forgezero/access/conditions
 
-The twelve guards every project writes into `before`, each with the status its refusal deserves. This entry exposes 14 named value exports and 16 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+The twelve guards every project writes into `before`, each with the status its refusal deserves. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   assertDeclaredRefusals,
-  loadTarget,
-  refusalsFor,
-  requireApproval,
-  requireBalance,
-  requireIdempotency,
-  requireNotFrozen,
-  requireOwner,
-  requireQuota,
-  requireService,
-  requireState,
-  requireTier,
-  requireUnlocked,
-  requireVersion,
-} from '@forgezero/access/conditions';
-
-import type {
-  ApprovalState,
-  Condition,
-  IdempotencyStore,
-  LoadTargetOptions,
-  RefusalSpec,
-  RequireApprovalOptions,
-  RequireBalanceOptions,
-  RequireIdempotencyOptions,
-  RequireNotFrozenOptions,
-  RequireOwnerOptions,
-  RequireQuotaOptions,
-  RequireServiceOptions,
-  RequireStateOptions,
-  RequireTierOptions,
-  RequireUnlockedOptions,
-  RequireVersionOptions,
 } from '@forgezero/access/conditions';
 ```
 
@@ -195,34 +113,11 @@ export const selectedCapability = assertDeclaredRefusals;
 <a id="forgezero-access-effects"></a>
 ## @forgezero/access/effects
 
-Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. This entry exposes 6 named value exports and 15 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Audit, emit, meter, invalidate and notify — what happens after a request is decided, never failing it. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   audit,
-  emit,
-  invalidate,
-  meter,
-  notify,
-  settlementOf,
-} from '@forgezero/access/effects';
-
-import type {
-  AuditOptions,
-  AuditRecord,
-  AuditSink,
-  CacheInvalidator,
-  Effect,
-  EmitOptions,
-  InvalidateOptions,
-  MeterOptions,
-  Notification,
-  Notifier,
-  NotifyOptions,
-  Outbox,
-  OutboxEvent,
-  Settlement,
-  UsageMeter,
 } from '@forgezero/access/effects';
 ```
 
@@ -241,34 +136,11 @@ export const selectedCapability = audit;
 <a id="forgezero-access-security"></a>
 ## @forgezero/access/security
 
-Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. This entry exposes 20 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Constant-time comparison, CSPRNG tokens, HMAC, HKDF, AES-GCM sealing and redaction. Web Crypto only. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   fromBase64Url,
-  fromHex,
-  hashToken,
-  hkdf,
-  hmacSha256,
-  isLive,
-  nowSeconds,
-  open,
-  randomDigits,
-  randomHex,
-  randomInt,
-  randomToken,
-  redact,
-  seal,
-  secretFieldPattern,
-  sha256,
-  timingSafeEqual,
-  toBase64Url,
-  toHex,
-  verifyHmac,
-} from '@forgezero/access/security';
-
-import type {
-  Sealed,
 } from '@forgezero/access/security';
 ```
 
@@ -287,19 +159,11 @@ export const selectedCapability = fromBase64Url;
 <a id="forgezero-access-rate-limit"></a>
 ## @forgezero/access/rate-limit
 
-Request counters over a window — in memory, in Redis, or in a Durable Object. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Request counters over a window — in memory, in Redis, or in a Durable Object. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   durableObjectStore,
-  memoryStore,
-  redisStore,
-  slidingWindowStore,
-} from '@forgezero/access/rate-limit';
-
-import type {
-  DurableStorageLike,
-  RedisLike,
 } from '@forgezero/access/rate-limit';
 ```
 
@@ -318,17 +182,11 @@ export const selectedCapability = durableObjectStore;
 <a id="forgezero-access-fetch"></a>
 ## @forgezero/access/fetch
 
-A Fetch-native adapter over the declared access pipeline. This entry exposes 3 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+A Fetch-native adapter over the declared access pipeline. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   compileRoute,
-  matchRoute,
-  toFetch,
-} from '@forgezero/access/fetch';
-
-import type {
-  FetchHandler,
 } from '@forgezero/access/fetch';
 ```
 
@@ -347,25 +205,11 @@ export const selectedCapability = compileRoute;
 <a id="forgezero-access-pipeline"></a>
 ## @forgezero/access/pipeline
 
-The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. This entry exposes 3 named value exports and 9 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+The framework-neutral route, principal, factor, policy, rate-limit and effects pipeline. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   createPipeline,
-  defineHandlers,
-  windowSeconds,
-} from '@forgezero/access/pipeline';
-
-import type {
-  Handler,
-  HandlerRegistry,
-  Pipeline,
-  PipelineOptions,
-  RateStore,
-  SessionResolver,
-  StepUpStore,
-  Telemetry,
-  Validator,
 } from '@forgezero/access/pipeline';
 ```
 
@@ -384,19 +228,11 @@ export const selectedCapability = createPipeline;
 <a id="forgezero-access-elysia"></a>
 ## @forgezero/access/elysia
 
-Elysia integration over the same access pipeline and route declarations. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Elysia integration over the same access pipeline and route declarations. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   elysia,
-  forbiddenTelemetryAttribute,
-  telemetryFrom,
-  toElysiaPath,
-} from '@forgezero/access/elysia';
-
-import type {
-  ElysiaAdapterOptions,
-  OtelTracer,
 } from '@forgezero/access/elysia';
 ```
 
@@ -415,21 +251,11 @@ export const selectedCapability = elysia;
 <a id="forgezero-access-client"></a>
 ## @forgezero/access/client
 
-Typed client helpers that fulfil factors without duplicating the security matrix. This entry exposes 2 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Typed client helpers that fulfil factors without duplicating the security matrix. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   buildPath,
-  createClient,
-} from '@forgezero/access/client';
-
-import type {
-  ChallengeHandler,
-  ClientOptions,
-  ClientResult,
-  Problem,
-  RequestArgs,
-  SecurityChallenge,
 } from '@forgezero/access/client';
 ```
 
@@ -448,18 +274,11 @@ export const selectedCapability = buildPath;
 <a id="forgezero-access-testing"></a>
 ## @forgezero/access/testing
 
-Deterministic access-pipeline fixtures and assertions for consumer tests. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Deterministic access-pipeline fixtures and assertions for consumer tests. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   reachableRoutes,
-  simulate,
-  unreachableRoutes,
-} from '@forgezero/access/testing';
-
-import type {
-  SimulateArgs,
-  Verdict,
 } from '@forgezero/access/testing';
 ```
 
@@ -478,19 +297,11 @@ export const selectedCapability = reachableRoutes;
 <a id="forgezero-access-header"></a>
 ## @forgezero/access/header
 
-Strict configurable header-identity extraction with canonical names and bounded values. This entry exposes 2 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Strict configurable header-identity extraction with canonical names and bounded values. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   defineHeaderIdentitySources,
-  headerIdentityResolver,
-} from '@forgezero/access/header';
-
-import type {
-  HeaderAssignmentResolver,
-  HeaderIdentity,
-  HeaderIdentitySource,
-  HeaderPrincipal,
 } from '@forgezero/access/header';
 ```
 
@@ -509,20 +320,11 @@ export const selectedCapability = defineHeaderIdentitySources;
 <a id="forgezero-access-principal"></a>
 ## @forgezero/access/principal
 
-Generic principal-source resolution for browser, API-key, attestation or future identity adapters. This entry exposes 4 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Generic principal-source resolution for browser, API-key, attestation or future identity adapters. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   assignmentIsActive,
-  decidePrincipalAccess,
-  defineRbacPrincipal,
-  touchPrincipalAssignment,
-} from '@forgezero/access/principal';
-
-import type {
-  PrincipalAccessDecision,
-  PrincipalAssignment,
-  RbacPrincipal,
 } from '@forgezero/access/principal';
 ```
 
@@ -541,23 +343,11 @@ export const selectedCapability = assignmentIsActive;
 <a id="forgezero-access-principal-session"></a>
 ## @forgezero/access/principal-session
 
-Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. This entry exposes 8 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Short-lived scope-bound delegated-principal sessions with sliding and absolute expiry. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS,
-  DEFAULT_PRINCIPAL_IDLE_TTL_MS,
-  MAX_PRINCIPAL_ABSOLUTE_TTL_MS,
-  MAX_PRINCIPAL_IDLE_TTL_MS,
-  authenticatePrincipalSession,
-  issuePrincipalSession,
-  principalSessionIsActive,
-  touchPrincipalSession,
-} from '@forgezero/access/principal-session';
-
-import type {
-  IssuedPrincipalSession,
-  PrincipalSessionRecord,
 } from '@forgezero/access/principal-session';
 ```
 
@@ -576,22 +366,11 @@ export const selectedCapability = DEFAULT_PRINCIPAL_ABSOLUTE_TTL_MS;
 <a id="forgezero-access-authenticator"></a>
 ## @forgezero/access/authenticator
 
-Authentication-source contracts for adding identity mechanisms without changing route policy. This entry exposes 2 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Authentication-source contracts for adding identity mechanisms without changing route policy. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   createAuthenticator,
-  encoding,
-} from '@forgezero/access/authenticator';
-
-import type {
-  AuthenticationOptions,
-  AuthenticationResponse,
-  Authenticator,
-  AuthenticatorOptions,
-  Credential,
-  RegistrationOptions,
-  RegistrationResponse,
 } from '@forgezero/access/authenticator';
 ```
 
@@ -610,18 +389,11 @@ export const selectedCapability = createAuthenticator;
 <a id="forgezero-access-ceremony-modes"></a>
 ## @forgezero/access/ceremony-modes
 
-Named security-ceremony modes and their session/action fulfilment semantics. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Named security-ceremony modes and their session/action fulfilment semantics. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   MAX_CUSTODIANS,
-  THRESHOLD_MODES,
-  thresholdMode,
-} from '@forgezero/access/ceremony-modes';
-
-import type {
-  ThresholdMode,
-  ThresholdModeId,
 } from '@forgezero/access/ceremony-modes';
 ```
 

package/dist/conditions.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/conditions.ts
 function define(condition, routes, refusals, run) {

package/dist/effects.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/elysia.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/fetch.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/header.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;

package/dist/index.d.ts

@@ -379,4 +379,4 @@ export declare function impactOfDisabling<R extends RouteRegistry>(access: Acces
     available: number;
     required: number;
 }[];
-export declare const VERSION = "0.1.8";
+export declare const VERSION = "0.1.10";

package/dist/index.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 export {
   stemOf,
   resolveActionFactors,

package/dist/pipeline.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/pipeline.ts
 function defineHandlers(routes, handlers) {

package/dist/principal-session.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/security.ts
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));

package/dist/principal.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/principal.ts
 var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;

package/dist/testing.js

@@ -275,7 +275,7 @@ function impactOfDisabling(access, enabledAfter) {
   }
   return broken;
 }
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 
 // src/testing.ts
 function nameOf(policies, route) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/access",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "type": "module",
   "publishConfig": {
     "access": "public",