@forgezero/runtime 0.1.12 → 0.1.14

package/README.md

@@ -11,7 +11,7 @@ The machinery behind a request handler — jobs, queues, an outbox, a hash-chain
 
 ## Package overview
 
-Anyone running a service, for the work that happens outside a request. Separate from `access` because a Cloudflare Worker wants the request pipeline and cannot run a backup job. Supported runtimes: bun, node. Package root: @forgezero/runtime. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
+Anyone running a service, for the work that happens outside a request. Separate from `access` because a Cloudflare Worker wants the request pipeline and cannot run a backup job. Supported runtimes: bun, node. Package root: @forgezero/runtime. Consumer documentation is curated with each module's explicit public flag; the complete internal/export inventory remains in the typed SSOT and declaration files.
 
 ```text
 bun add @forgezero/runtime
@@ -29,9 +29,9 @@ The five packages are installation boundaries. Choose a package by who installs
 | @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
 | @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
 
-## @forgezero/runtime public imports and commands
+## @forgezero/runtime supported imports and commands
 
-Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
+These are supported consumer entry points, not every internal module shipped for ForgeZero managed installation. Each row links to its task-oriented usage.
 
 | public entry | short description | runtime | details |
 |---|---|---|---|
@@ -91,24 +91,11 @@ bun add @forgezero/runtime
 <a id="forgezero-runtime-query"></a>
 ## @forgezero/runtime/query
 
-Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB. This entry exposes 3 named value exports and 8 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   QueryContractError,
-  defineQuery,
-  implementQuery,
-} from '@forgezero/runtime/query';
-
-import type {
-  QueryCodec,
-  QueryContract,
-  QueryDecode,
-  QueryExecution,
-  QueryImplementation,
-  QueryInput,
-  QueryIssue,
-  QueryOutput,
 } from '@forgezero/runtime/query';
 ```
 
@@ -148,39 +135,11 @@ const order = await runFindOrder.execute(stores, { orderKey: 'ord_123' });
 <a id="forgezero-runtime-jobs"></a>
 ## @forgezero/runtime/jobs
 
-Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected. This entry exposes 12 named value exports and 14 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   JobFenceLostError,
-  VERSION,
-  createScheduler,
-  cursorJob,
-  defineJob,
-  everyMs,
-  forEachFenced,
-  memoryLock,
-  nextWallClockAt,
-  storeLock,
-  systemClock,
-  withJobFence,
-} from '@forgezero/runtime/jobs';
-
-import type {
-  Clock,
-  CursorBatch,
-  CursorJobSpec,
-  CursorStore,
-  JobContext,
-  JobLock,
-  JobReport,
-  JobResult,
-  JobSpec,
-  Lease,
-  LockStore,
-  Scheduler,
-  SchedulerOptions,
-  WallClockSchedule,
 } from '@forgezero/runtime/jobs';
 ```
 
@@ -199,24 +158,11 @@ export const selectedCapability = JobFenceLostError;
 <a id="forgezero-runtime-queue"></a>
 ## @forgezero/runtime/queue
 
-Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting. This entry exposes 5 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   QueueKeyStoppedError,
-  QueueStoppedError,
-  TaskCancelledError,
-  createQueue,
-  queueWidthFor,
-} from '@forgezero/runtime/queue';
-
-import type {
-  DrainReport,
-  Queue,
-  QueueOptions,
-  QueueResourcePolicy,
-  QueueTask,
-  RetryPolicy,
 } from '@forgezero/runtime/queue';
 ```
 
@@ -235,31 +181,11 @@ export const selectedCapability = QueueKeyStoppedError;
 <a id="forgezero-runtime-outbox"></a>
 ## @forgezero/runtime/outbox
 
-Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue. This entry exposes 8 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   DEFAULT_POLICY,
-  EVENT_STATES,
-  OutboxError,
-  VERSION,
-  backoffMs,
-  createOutbox,
-  memoryStore,
-  outboxJob,
-} from '@forgezero/runtime/outbox';
-
-import type {
-  DeliveryPolicy,
-  DeliveryResult,
-  DrainReport,
-  EventState,
-  Outbox,
-  OutboxEvent,
-  OutboxOptions,
-  OutboxStore,
-  PublishInput,
-  Transport,
 } from '@forgezero/runtime/outbox';
 ```
 
@@ -278,37 +204,11 @@ export const selectedCapability = DEFAULT_POLICY;
 <a id="forgezero-runtime-audit"></a>
 ## @forgezero/runtime/audit
 
-Append-only records chained by hash, with a verifier that names the first altered entry. This entry exposes 12 named value exports and 12 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Append-only records chained by hash, with a verifier that names the first altered entry. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   AuditChainError,
-  GENESIS_DIGEST,
-  VERSION,
-  appendRecord,
-  canonicalise,
-  createAuditChain,
-  exportRange,
-  hashDigester,
-  memoryStore,
-  sealedDigester,
-  verifyChain,
-  verifyExport,
-} from '@forgezero/runtime/audit';
-
-import type {
-  AppendOptions,
-  AuditChain,
-  AuditChainOptions,
-  AuditDigesterResolver,
-  AuditEntry,
-  AuditExport,
-  AuditRecord,
-  AuditStore,
-  AuditVerifyOptions,
-  ChainVerdict,
-  Digester,
-  EffectAuditRecord,
 } from '@forgezero/runtime/audit';
 ```
 
@@ -327,34 +227,11 @@ export const selectedCapability = AuditChainError;
 <a id="forgezero-runtime-backup"></a>
 ## @forgezero/runtime/backup
 
-Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back. This entry exposes 11 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   BackupError,
-  DEFAULT_RETENTION,
-  SNAPSHOT_FORMAT,
-  VERSION,
-  backupJob,
-  listSnapshots,
-  prune,
-  restore,
-  selectForDeletion,
-  snapshot,
-  verifySnapshot,
-} from '@forgezero/runtime/backup';
-
-import type {
-  ChunkRecord,
-  ObjectStore,
-  RestoreOptions,
-  RestoreReport,
-  RetentionPolicy,
-  RowSink,
-  RowSource,
-  SnapshotManifest,
-  SnapshotOptions,
-  VerifyReport,
 } from '@forgezero/runtime/backup';
 ```
 
@@ -373,32 +250,11 @@ export const selectedCapability = BackupError;
 <a id="forgezero-runtime-notify"></a>
 ## @forgezero/runtime/notify
 
-Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. This entry exposes 12 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   CHANNELS,
-  NotifyError,
-  VERSION,
-  assertHeaderSafe,
-  button,
-  codeBlock,
-  createNotifier,
-  defineTemplate,
-  escapeHtml,
-  layout,
-  preview,
-  render,
-} from '@forgezero/runtime/notify';
-
-import type {
-  Channel,
-  Notification,
-  Notifier,
-  NotifierOptions,
-  Rendered,
-  TemplateSpec,
-  Transport,
 } from '@forgezero/runtime/notify';
 ```
 
@@ -417,22 +273,11 @@ export const selectedCapability = CHANNELS;
 <a id="forgezero-runtime-notify-templates"></a>
 ## @forgezero/runtime/notify/templates
 
-The six transactional messages ForgeZero sends. This entry exposes 8 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+The six transactional messages ForgeZero sends. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   TEMPLATES,
-  ceremonyProposed,
-  custodianEnrolment,
-  escapeHtml,
-  invitation,
-  newDevice,
-  signInCode,
-  vaultLocked,
-} from '@forgezero/runtime/notify/templates';
-
-import type {
-  TemplateKey,
 } from '@forgezero/runtime/notify/templates';
 ```
 
@@ -451,32 +296,11 @@ export const selectedCapability = TEMPLATES;
 <a id="forgezero-runtime-calendar"></a>
 ## @forgezero/runtime/calendar
 
-Billing periods computed from an anchor, working days, holidays and due dates. This entry exposes 15 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Billing periods computed from an anchor, working days, holidays and due dates. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   CalendarError,
-  DAY_MS,
-  DEFAULT_WORKING_DAYS,
-  closedPeriods,
-  dayOfWeek,
-  daysOverdue,
-  fromDay,
-  isOverdue,
-  isWorkingDay,
-  nextWorkingDay,
-  periodAt,
-  periodIndexOn,
-  periodOn,
-  toDay,
-  workingDaysBetween,
-} from '@forgezero/runtime/calendar';
-
-import type {
-  BillingSchedule,
-  Calendar,
-  IsoDate,
-  Period,
 } from '@forgezero/runtime/calendar';
 ```
 
@@ -495,34 +319,11 @@ export const selectedCapability = CalendarError;
 <a id="forgezero-runtime-compliance"></a>
 ## @forgezero/runtime/compliance
 
-Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. This entry exposes 11 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   ComplianceError,
-  RISK_LEVELS,
-  VERIFICATION_TIERS,
-  combineLists,
-  countryRule,
-  newCounterpartyRule,
-  screen,
-  screeningStage,
-  staticList,
-  tierLimitRule,
-  unavailableList,
-} from '@forgezero/runtime/compliance';
-
-import type {
-  ListEntry,
-  RiskLevel,
-  Rule,
-  RuleHit,
-  ScreenOptions,
-  ScreeningList,
-  StageOptions,
-  Subject,
-  Verdict,
-  VerificationTier,
 } from '@forgezero/runtime/compliance';
 ```
 
@@ -541,29 +342,11 @@ export const selectedCapability = ComplianceError;
 <a id="forgezero-runtime-totp"></a>
 ## @forgezero/runtime/totp
 
-RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. This entry exposes 13 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   DEFAULT_DIGITS,
-  DEFAULT_STEP_SECONDS,
-  TotpError,
-  assertCode,
-  codeAt,
-  codeFor,
-  counterAt,
-  enrolmentUri,
-  fromBase32,
-  generateSecret,
-  secondsRemaining,
-  toBase32,
-  verifyCode,
-} from '@forgezero/runtime/totp';
-
-import type {
-  TotpOptions,
-  VerifyOptions,
-  VerifyResult,
 } from '@forgezero/runtime/totp';
 ```
 
@@ -582,27 +365,11 @@ export const selectedCapability = DEFAULT_DIGITS;
 <a id="forgezero-runtime-passkey"></a>
 ## @forgezero/runtime/passkey
 
-Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. This entry exposes 11 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   FLAG_BE,
-  FLAG_BS,
-  FLAG_UP,
-  FLAG_UV,
-  PasskeyError,
-  assertPasskey,
-  authenticatorData,
-  credentialIdFor,
-  passkeysFor,
-  rpIdMatches,
-  verifyAssertion,
-} from '@forgezero/runtime/passkey';
-
-import type {
-  Assertion,
-  AssertionRequest,
-  StoredPasskey,
 } from '@forgezero/runtime/passkey';
 ```
 
@@ -621,17 +388,11 @@ export const selectedCapability = FLAG_BE;
 <a id="forgezero-runtime-phrase"></a>
 ## @forgezero/runtime/phrase
 
-BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. This entry exposes 7 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   PHRASE_SALT_BYTES,
-  PHRASE_WORDS,
-  generatePhrase,
-  newSalt,
-  phraseToKey,
-  phraseVerifier,
-  validatePhrase,
 } from '@forgezero/runtime/phrase';
 ```
 
@@ -650,21 +411,11 @@ export const selectedCapability = PHRASE_SALT_BYTES;
 <a id="forgezero-runtime-snp"></a>
 ## @forgezero/runtime/snp
 
-Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade. This entry exposes 5 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   REPORT_BYTES,
-  SnpError,
-  bindsNonce,
-  parseSnpReport,
-  tcbAtLeast,
-} from '@forgezero/runtime/snp';
-
-import type {
-  GuestPolicy,
-  SnpReport,
-  TcbVersion,
 } from '@forgezero/runtime/snp';
 ```
 
@@ -683,24 +434,11 @@ export const selectedCapability = REPORT_BYTES;
 <a id="forgezero-runtime-importers"></a>
 ## @forgezero/runtime/importers
 
-Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error. This entry exposes 7 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   IMPORT_FORMATS,
-  normaliseName,
-  parseBitwarden,
-  parseCsv,
-  parseEnv,
-  parseImport,
-  parseOnePassword,
-} from '@forgezero/runtime/importers';
-
-import type {
-  ImportFormat,
-  ImportResult,
-  ImportedSecret,
-  Skipped,
 } from '@forgezero/runtime/importers';
 ```
 
@@ -719,16 +457,11 @@ export const selectedCapability = IMPORT_FORMATS;
 <a id="forgezero-runtime-openssh"></a>
 ## @forgezero/runtime/openssh
 
-OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys. This entry exposes 6 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   OpenSshError,
-  authorizedKey,
-  fingerprint,
-  parseAuthorizedKey,
-  publicKeyBlob,
-  signatureBlob,
 } from '@forgezero/runtime/openssh';
 ```
 
@@ -747,24 +480,11 @@ export const selectedCapability = OpenSshError;
 <a id="forgezero-runtime-ssh-cert"></a>
 ## @forgezero/runtime/ssh-cert
 
-OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out. This entry exposes 9 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   CERT_TYPE_HOST,
-  CERT_TYPE_USER,
-  DEFAULT_EXTENSIONS,
-  SshCertError,
-  caFingerprint,
-  caFromSecretKey,
-  caPublicKeyLine,
-  isCurrentlyValid,
-  signCertificate,
-} from '@forgezero/runtime/ssh-cert';
-
-import type {
-  CertificateAuthority,
-  CertificateRequest,
 } from '@forgezero/runtime/ssh-cert';
 ```
 
@@ -783,19 +503,11 @@ export const selectedCapability = CERT_TYPE_HOST;
 <a id="forgezero-runtime-slip10"></a>
 ## @forgezero/runtime/slip10
 
-SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond. This entry exposes 5 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   HARDENED_OFFSET,
-  Slip10Error,
-  deriveChild,
-  derivePath,
-  masterFromSeed,
-} from '@forgezero/runtime/slip10';
-
-import type {
-  Slip10Node,
 } from '@forgezero/runtime/slip10';
 ```
 
@@ -814,35 +526,11 @@ export const selectedCapability = HARDENED_OFFSET;
 <a id="forgezero-runtime-identity"></a>
 ## @forgezero/runtime/identity
 
-Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would. This entry exposes 16 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   CLOCK_SKEW_SECONDS,
-  REQUEST_SIGNATURE_SUITE,
-  RESPONSE_KEY_HEADER,
-  RESPONSE_SEALING_SUITE,
-  canonicalString,
-  decodeSignatureHeader,
-  deriveKeysFromSeed,
-  derivePublicKeysFromSeed,
-  encodeSignatureHeader,
-  generateNodeKeys,
-  generateResponseRecipient,
-  openResponse,
-  sealResponse,
-  signRequest,
-  validResponsePublicKey,
-  verifyRequest,
-} from '@forgezero/runtime/identity';
-
-import type {
-  NodeKeyPair,
-  NodePublicKeys,
-  ResponseRecipient,
-  SealedResponse,
-  SignedEnvelope,
-  VerifyFailure,
 } from '@forgezero/runtime/identity';
 ```
 
@@ -861,26 +549,11 @@ export const selectedCapability = CLOCK_SKEW_SECONDS;
 <a id="forgezero-runtime-schema"></a>
 ## @forgezero/runtime/schema
 
-Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form. This entry exposes 8 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   DEFAULT_RESTRICTIONS,
-  SCHEMA_VERSION,
-  SchemaError,
-  VERSION,
-  describeJsonSchema,
-  readableFields,
-  restrictJsonSchema,
-  writeOnlyPaths,
-} from '@forgezero/runtime/schema';
-
-import type {
-  FieldKind,
-  FormField,
-  Restrictions,
-  SchemaValidator,
-  ValidationResult,
 } from '@forgezero/runtime/schema';
 ```
 
@@ -910,19 +583,11 @@ const secretFields = writeOnlyPaths(fields);
 <a id="forgezero-runtime-schema-typebox"></a>
 ## @forgezero/runtime/schema/typebox
 
-The TypeBox validator behind that interface. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+The TypeBox validator behind that interface. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   T,
-  parse,
-  typebox,
-  typeboxQueryCodec,
-} from '@forgezero/runtime/schema/typebox';
-
-import type {
-  Static,
-  TSchema,
 } from '@forgezero/runtime/schema/typebox';
 ```
 
@@ -950,24 +615,11 @@ const codec = typeboxQueryCodec(User);
 <a id="forgezero-runtime-finance-discounts"></a>
 ## @forgezero/runtime/finance/discounts
 
-Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. This entry exposes 7 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   DiscountError,
-  assertCode,
-  assertWindow,
-  bestDiscount,
-  discountFor,
-  ineligibility,
-  normaliseCode,
-} from '@forgezero/runtime/finance/discounts';
-
-import type {
-  AppliedDiscount,
-  DiscountKind,
-  Ineligibility,
-  Promotion,
 } from '@forgezero/runtime/finance/discounts';
 ```
 
@@ -986,38 +638,11 @@ export const selectedCapability = DiscountError;
 <a id="forgezero-runtime-finance-money"></a>
 ## @forgezero/runtime/finance/money
 
-Exact amounts in minor units with the asset attached, so two currencies cannot be added. This entry exposes 22 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Exact amounts in minor units with the asset attached, so two currencies cannot be added. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   ASSETS,
-  MoneyError,
-  ROUNDING,
-  VERSION,
-  abs,
-  add,
-  allocate,
-  assetSpec,
-  compare,
-  convert,
-  defineAsset,
-  equals,
-  formatAmount,
-  isNegative,
-  isZero,
-  money,
-  mulRate,
-  negate,
-  parseAmount,
-  subtract,
-  toStep,
-  zero,
-} from '@forgezero/runtime/finance/money';
-
-import type {
-  AssetSpec,
-  Money,
-  Rounding,
 } from '@forgezero/runtime/finance/money';
 ```
 
@@ -1036,37 +661,11 @@ export const selectedCapability = ASSETS;
 <a id="forgezero-runtime-finance-venues"></a>
 ## @forgezero/runtime/finance/venues
 
-Trading venues, market types and symbols as data — spot, margin and futures behind one order model. This entry exposes 14 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Trading venues, market types and symbols as data — spot, margin and futures behind one order model. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   MARKET_TYPES,
-  ORDER_SIDES,
-  ORDER_TYPES,
-  TIME_IN_FORCE,
-  VENUES,
-  VERSION,
-  VenueError,
-  notionalOf,
-  parseSymbol,
-  submitOrder,
-  symbolOf,
-  validateOrder,
-  venue,
-  venuesFor,
-} from '@forgezero/runtime/finance/venues';
-
-import type {
-  MarketSpec,
-  MarketType,
-  OrderRequest,
-  OrderResult,
-  OrderSide,
-  OrderStatus,
-  OrderType,
-  TimeInForce,
-  VenueAdapter,
-  VenueSpec,
 } from '@forgezero/runtime/finance/venues';
 ```
 
@@ -1085,40 +684,11 @@ export const selectedCapability = MARKET_TYPES;
 <a id="forgezero-runtime-finance-ledger"></a>
 ## @forgezero/runtime/finance/ledger
 
-Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. This entry exposes 21 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   ACCOUNT_KINDS,
-  BUCKETS,
-  LedgerError,
-  MAX_LEDGER_ENTRIES,
-  VERSION,
-  accountId,
-  assertAvailable,
-  assertBalanced,
-  availableOf,
-  balanceOf,
-  balancesFrom,
-  captureHold,
-  heldOf,
-  parseAccount,
-  placeHold,
-  queueKeyFor,
-  releaseHold,
-  statement,
-  totalOf,
-  transfer,
-  trialBalance,
-} from '@forgezero/runtime/finance/ledger';
-
-import type {
-  AccountKind,
-  AccountRef,
-  Bucket,
-  Entry,
-  Transaction,
-  TrialBalance,
 } from '@forgezero/runtime/finance/ledger';
 ```
 
@@ -1137,28 +707,11 @@ export const selectedCapability = ACCOUNT_KINDS;
 <a id="forgezero-runtime-finance-commission"></a>
 ## @forgezero/runtime/finance/commission
 
-Profit net of flows, a high-water mark, the tier split and the referral share of our income. This entry exposes 9 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Profit net of flows, a high-water mark, the tier split and the referral share of our income. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   CommissionError,
-  allocate,
-  chargeableProfit,
-  commissionTransaction,
-  nextHighWaterMark,
-  periodProfit,
-  projectPrepay,
-  splitCommission,
-  splitReferrals,
-} from '@forgezero/runtime/finance/commission';
-
-import type {
-  CommissionInput,
-  CommissionSplit,
-  PeriodPerformance,
-  Prepay,
-  PrepayInput,
-  ReferralShare,
 } from '@forgezero/runtime/finance/commission';
 ```
 
@@ -1177,31 +730,11 @@ export const selectedCapability = CommissionError;
 <a id="forgezero-runtime-finance-rates"></a>
 ## @forgezero/runtime/finance/rates
 
-What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. This entry exposes 11 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   BASE_ASSET,
-  RATE_SOURCES,
-  RateError,
-  assertRate,
-  createRateTable,
-  describeRate,
-  isRegistered,
-  peg,
-  rateRefreshJob,
-  refreshRates,
-  registerAsset,
-} from '@forgezero/runtime/finance/rates';
-
-import type {
-  AssetEntry,
-  AssetRate,
-  RateFetcher,
-  RateSource,
-  RateTable,
-  RateTableOptions,
-  RefreshReport,
 } from '@forgezero/runtime/finance/rates';
 ```
 
@@ -1220,28 +753,11 @@ export const selectedCapability = BASE_ASSET;
 <a id="forgezero-runtime-finance-transfers"></a>
 ## @forgezero/runtime/finance/transfers
 
-Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. This entry exposes 9 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   DIRECTIONS,
-  PipelineError,
-  SCREENING_ORDER,
-  approvalStage,
-  balanceStage,
-  createTransferPipeline,
-  limitsStage,
-  notFrozenStage,
-  screeningStage,
-} from '@forgezero/runtime/finance/transfers';
-
-import type {
-  Direction,
-  PipelineResult,
-  Stage,
-  StageOutcome,
-  Transfer,
-  TransferPipeline,
 } from '@forgezero/runtime/finance/transfers';
 ```
 
@@ -1260,27 +776,11 @@ export const selectedCapability = DIRECTIONS;
 <a id="forgezero-runtime-finance-chain"></a>
 ## @forgezero/runtime/finance/chain
 
-Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. This entry exposes 9 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   ADDRESS_SCHEMES,
-  ChainError,
-  SEED_CHAINS,
-  SEED_CHAIN_ASSETS,
-  assertChain,
-  confirmationsFor,
-  createChainRegistry,
-  estimatedSeconds,
-  validateAddress,
-} from '@forgezero/runtime/finance/chain';
-
-import type {
-  AddressScheme,
-  ChainAsset,
-  ChainRegistry,
-  ChainSpec,
-  ConfirmationBand,
 } from '@forgezero/runtime/finance/chain';
 ```
 
@@ -1299,18 +799,11 @@ export const selectedCapability = ADDRESS_SCHEMES;
 <a id="forgezero-runtime-finance-custody"></a>
 ## @forgezero/runtime/finance/custody
 
-Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. This entry exposes 8 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   CustodyError,
-  VERSION,
-  depositAddress,
-  domainSeparator,
-  orderSignatures,
-  saltFor,
-  toChecksumAddress,
-  withdrawDigest,
 } from '@forgezero/runtime/finance/custody';
 ```
 
@@ -1329,28 +822,11 @@ export const selectedCapability = CustodyError;
 <a id="forgezero-runtime-finance-derive"></a>
 ## @forgezero/runtime/finance/derive
 
-Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. This entry exposes 11 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   CUSTODY,
-  DERIVE_KEYWORD,
-  DeriveError,
-  SCHEMES,
-  assertDeriveSpec,
-  custodyOf,
-  deriveSpecOf,
-  derivedFields,
-  derivedPaths,
-  pathFor,
-  suppliedPaths,
-} from '@forgezero/runtime/finance/derive';
-
-import type {
-  Custody,
-  DeriveSpec,
-  DerivedField,
-  Scheme,
 } from '@forgezero/runtime/finance/derive';
 ```
 
@@ -1369,28 +845,11 @@ export const selectedCapability = CUSTODY;
 <a id="forgezero-runtime-finance-tax"></a>
 ## @forgezero/runtime/finance/tax
 
-Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. This entry exposes 9 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   TREATMENTS,
-  TaxError,
-  applyTax,
-  assertTaxRate,
-  decideTax,
-  describeTax,
-  parseRate,
-  percent,
-  totalWithTax,
-} from '@forgezero/runtime/finance/tax';
-
-import type {
-  Customer,
-  Supplier,
-  TaxAmounts,
-  TaxDecision,
-  TaxRate,
-  Treatment,
 } from '@forgezero/runtime/finance/tax';
 ```
 
@@ -1409,22 +868,11 @@ export const selectedCapability = TREATMENTS;
 <a id="forgezero-runtime-finance-storage"></a>
 ## @forgezero/runtime/finance/storage
 
-Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. This entry exposes 8 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   SORT_FIELD,
-  fromStored,
-  rangeBounds,
-  sortExact,
-  sortKey,
-  storeAmount,
-  toStored,
-  withinRange,
-} from '@forgezero/runtime/finance/storage';
-
-import type {
-  StoredMoney,
 } from '@forgezero/runtime/finance/storage';
 ```
 
@@ -1443,33 +891,11 @@ export const selectedCapability = SORT_FIELD;
 <a id="forgezero-runtime-realtime"></a>
 ## @forgezero/runtime/realtime
 
-Provider-neutral realtime audience, shard, event and delivery contracts. This entry exposes 15 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Provider-neutral realtime audience, shard, event and delivery contracts. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   REALTIME_MAX_BATCH_BYTES,
-  REALTIME_MAX_EVENTS,
-  REALTIME_MAX_EVENT_BYTES,
-  REALTIME_MAX_SHARDS_PER_TOPIC,
-  REALTIME_MAX_SOCKETS_PER_SHARD,
-  canReceiveRealtimeAudience,
-  issueRealtimeSubscriptionTicket,
-  realtimeBatchBytes,
-  realtimeHmac,
-  realtimeShardKey,
-  validateRealtimeAudience,
-  validateRealtimeBatch,
-  validateRealtimeSubscriptionTicket,
-  verifyRealtimeHmac,
-  verifyRealtimeSubscriptionToken,
-} from '@forgezero/runtime/realtime';
-
-import type {
-  RealtimeAudience,
-  RealtimeBatch,
-  RealtimeEvent,
-  RealtimePrincipalKind,
-  RealtimeSubscriptionTicket,
 } from '@forgezero/runtime/realtime';
 ```
 
@@ -1488,25 +914,11 @@ export const selectedCapability = REALTIME_MAX_BATCH_BYTES;
 <a id="forgezero-runtime-passkey-hybrid"></a>
 ## @forgezero/runtime/passkey-hybrid
 
-Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. This entry exposes 8 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   PASSKEY_HYBRID_SUITE,
-  PASSKEY_HYBRID_VERSION,
-  PASSKEY_ML_DSA_PUBLIC_KEY_BYTES,
-  PASSKEY_ML_DSA_SIGNATURE_BYTES,
-  PASSKEY_PRF_SALT,
-  createPasskeyHybridProof,
-  passkeyHybridMessage,
-  verifyPasskeyHybridProof,
-} from '@forgezero/runtime/passkey-hybrid';
-
-import type {
-  PasskeyHybridBinding,
-  PasskeyHybridProof,
-  PasskeyHybridPurpose,
-  PasskeyHybridRegistrationProof,
 } from '@forgezero/runtime/passkey-hybrid';
 ```
 
@@ -1525,18 +937,11 @@ export const selectedCapability = PASSKEY_HYBRID_SUITE;
 <a id="forgezero-runtime-otpauth"></a>
 ## @forgezero/runtime/otpauth
 
-Parse and render otpauth URIs without binding enrolment to a UI framework. This entry exposes 4 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Parse and render otpauth URIs without binding enrolment to a UI framework. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   formatOtpAuth,
-  fromManualSecret,
-  newOtpAuth,
-  parseOtpAuth,
-} from '@forgezero/runtime/otpauth';
-
-import type {
-  OtpAuth,
 } from '@forgezero/runtime/otpauth';
 ```
 
@@ -1555,22 +960,11 @@ export const selectedCapability = formatOtpAuth;
 <a id="forgezero-runtime-pipeline"></a>
 ## @forgezero/runtime/pipeline
 
-Typed ordered application-pipeline execution with explicit evidence. This entry exposes 6 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Typed ordered application-pipeline execution with explicit evidence. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   GIT_PROVIDERS,
-  PipelineError,
-  parsePush,
-  shouldDeploy,
-  verifyWebhook,
-  webhookPath,
-} from '@forgezero/runtime/pipeline';
-
-import type {
-  DeployTrigger,
-  GitProvider,
-  PushEvent,
 } from '@forgezero/runtime/pipeline';
 ```
 
@@ -1589,25 +983,11 @@ export const selectedCapability = GIT_PROVIDERS;
 <a id="forgezero-runtime-finance-chain-addresses"></a>
 ## @forgezero/runtime/finance/chain-addresses
 
-Chain-address derivation records and validation independent of a node provider. This entry exposes 10 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Chain-address derivation records and validation independent of a node provider. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   AddressError,
-  COUNTERFACTUAL_SCHEMES,
-  assertDerivationMatches,
-  create2Address,
-  depositAddressBook,
-  depositSaltFor,
-  deriveDepositAddress,
-  ownerOfAddress,
-  toChecksumAddress,
-  validateAddress,
-} from '@forgezero/runtime/finance/chain-addresses';
-
-import type {
-  AddressScheme,
-  ChainDeployment,
 } from '@forgezero/runtime/finance/chain-addresses';
 ```
 
@@ -1626,26 +1006,11 @@ export const selectedCapability = AddressError;
 <a id="forgezero-runtime-finance-chain-deposits"></a>
 ## @forgezero/runtime/finance/chain-deposits
 
-Provider-neutral deposit observation, confirmation and credit transitions. This entry exposes 8 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Provider-neutral deposit observation, confirmation and credit transitions. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   DepositError,
-  creditDeposit,
-  cursorFrom,
-  depositReference,
-  describeScan,
-  isConfirmed,
-  rescanRange,
-  scanOnce,
-} from '@forgezero/runtime/finance/chain-deposits';
-
-import type {
-  ChainReader,
-  ChainTransfer,
-  DepositCursor,
-  ScanContext,
-  ScanReport,
 } from '@forgezero/runtime/finance/chain-deposits';
 ```
 
@@ -1664,32 +1029,11 @@ export const selectedCapability = DepositError;
 <a id="forgezero-runtime-finance-chain-withdrawals"></a>
 ## @forgezero/runtime/finance/chain-withdrawals
 
-Provider-neutral withdrawal approval, broadcast and finality transitions. This entry exposes 14 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Provider-neutral withdrawal approval, broadcast and finality transitions. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   WITHDRAWAL_STATES,
-  WithdrawalError,
-  approveWithdrawal,
-  broadcastKeyFor,
-  canTransition,
-  confirmWithdrawal,
-  describeSweep,
-  holdReference,
-  markFailed,
-  processOnce,
-  refundFailed,
-  rejectWithdrawal,
-  requestWithdrawal,
-  sweepForPayout,
-} from '@forgezero/runtime/finance/chain-withdrawals';
-
-import type {
-  Broadcaster,
-  SweepCandidate,
-  SweepPlan,
-  Withdrawal,
-  WithdrawalState,
 } from '@forgezero/runtime/finance/chain-withdrawals';
 ```
 
@@ -1708,23 +1052,11 @@ export const selectedCapability = WITHDRAWAL_STATES;
 <a id="forgezero-runtime-finance-chain-reconcile"></a>
 ## @forgezero/runtime/finance/chain-reconcile
 
-Deterministic reconciliation between chain observations and durable transfer state. This entry exposes 5 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Deterministic reconciliation between chain observations and durable transfer state. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   DISCREPANCY_KINDS,
-  ReconcileError,
-  reconcileOnce,
-  reconcileReport,
-  shortfallUsd,
-} from '@forgezero/runtime/finance/chain-reconcile';
-
-import type {
-  Discrepancy,
-  DiscrepancyKind,
-  LedgerLiability,
-  OnChainHolding,
-  ReconcileReport,
 } from '@forgezero/runtime/finance/chain-reconcile';
 ```
 
@@ -1743,28 +1075,11 @@ export const selectedCapability = DISCREPANCY_KINDS;
 <a id="forgezero-runtime-finance-market"></a>
 ## @forgezero/runtime/finance/market
 
-Market order, fill and quote contracts independent of any exchange adapter. This entry exposes 8 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Market order, fill and quote contracts independent of any exchange adapter. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   MarketError,
-  createFeed,
-  disagreementOf,
-  isStale,
-  lastPrice,
-  limitFor,
-  stalenessOf,
-  subscribe,
-} from '@forgezero/runtime/finance/market';
-
-import type {
-  Feed,
-  FeedEvent,
-  FeedOptions,
-  PriceResult,
-  Quote,
-  StalenessPolicy,
-  VenueSource,
 } from '@forgezero/runtime/finance/market';
 ```
 
@@ -1783,28 +1098,11 @@ export const selectedCapability = MarketError;
 <a id="forgezero-runtime-custody-share"></a>
 ## @forgezero/runtime/custody-share
 
-Threshold-share parsing, validation and reconstruction. This entry exposes 13 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Threshold-share parsing, validation and reconstruction. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   PROBE_BYTES,
-  factorWrapAad,
-  joinProbeAndShare,
-  openFactorEnvelope,
-  openSealedToFactor,
-  openShareWithPasskey,
-  openShareWithPhrase,
-  passkeyWrappingKey,
-  phraseWrappingKey,
-  sealShare,
-  shareIndexOf,
-  splitProbeAndShare,
-  wrappingKeysFor,
-} from '@forgezero/runtime/custody-share';
-
-import type {
-  SealedShare,
-  WrappingKeys,
 } from '@forgezero/runtime/custody-share';
 ```
 
@@ -1823,21 +1121,11 @@ export const selectedCapability = PROBE_BYTES;
 <a id="forgezero-runtime-custody-crypto"></a>
 ## @forgezero/runtime/custody-crypto
 
-Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. This entry exposes 6 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   deriveKey,
-  openFromKey,
-  openWithKey,
-  sealToKey,
-  sealWithKey,
-  wrappingKeyPair,
-} from '@forgezero/runtime/custody-crypto';
-
-import type {
-  CipherBox,
-  SealedToKey,
 } from '@forgezero/runtime/custody-crypto';
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/runtime",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -190,7 +190,7 @@
     "prepublishOnly": "bun ../tools/package-task.ts prepublish runtime"
   },
   "dependencies": {
-    "@forgezero/access": "^0.1.7"
+    "@forgezero/access": "^0.1.9"
   },
   "peerDependencies": {
     "@noble/ciphers": "^2.2.0",