@forgezero/runtime 0.1.6 → 0.1.8

package/README.md

@@ -1,155 +1,884 @@
+<!--
+  GENERATED FILE — do not edit.
+
+  Change tools/generate-guides.ts or its typed sources, run `bun run guides`,
+  and commit the generator and rendered files together.
+-->
+
 # @forgezero/runtime
 
-**The machinery behind a request handler.** Background jobs that never overlap
-themselves, keyed queues, a transactional outbox, a hash-chained audit trail,
-templated mail, encrypted backups, schema validation, and money that is never a
-floating-point number.
+The machinery behind a request handler — jobs, queues, an outbox, a hash-chained audit trail, mail, backups, schema validation and exact money. 44 public modules, each imported on its own.
+
+## Package overview
+
+Anyone running a service, for the work that happens outside a request. Separate from `access` because a Cloudflare Worker wants the request pipeline and cannot run a backup job. Supported runtimes: bun, node. Package root: @forgezero/runtime. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
 
-Thirty-four public modules. Each is its own entry point, so you install one package and
-your bundler includes only what you imported.
+```text
+bun add @forgezero/runtime
+```
 
-```bash
+## ForgeZero package family
+
+The five packages are installation boundaries. Choose a package by who installs it; choose a subpath by the capability used in that file.
+
+| package | short description | runtimes | documentation |
+|---|---|---|---|
+| @forgezero/vault | Scoped secret access with Agent, API-key and systemd-credential sources. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/vault-package) |
+| @forgezero/access | Typed route, principal, factor, RBAC and request-pipeline contracts. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/access) |
+| @forgezero/providers | Typed external providers with priority, health and classified fallback. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/providers) |
+| @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
+| @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
+
+## @forgezero/runtime public imports and commands
+
+Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
+
+| public entry | short description | runtime | details |
+|---|---|---|---|
+| @forgezero/runtime/query | Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB. | portable | [Details + example](#forgezero-runtime-query) |
+| @forgezero/runtime/jobs | Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected. | portable | [Details + example](#forgezero-runtime-jobs) |
+| @forgezero/runtime/queue | Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting. | portable | [Details + example](#forgezero-runtime-queue) |
+| @forgezero/runtime/outbox | Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue. | portable | [Details + example](#forgezero-runtime-outbox) |
+| @forgezero/runtime/audit | Append-only records chained by hash, with a verifier that names the first altered entry. | portable | [Details + example](#forgezero-runtime-audit) |
+| @forgezero/runtime/backup | Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back. | portable | [Details + example](#forgezero-runtime-backup) |
+| @forgezero/runtime/notify | Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. | portable | [Details + example](#forgezero-runtime-notify) |
+| @forgezero/runtime/notify/templates | The six transactional messages ForgeZero sends. | portable | [Details + example](#forgezero-runtime-notify-templates) |
+| @forgezero/runtime/calendar | Billing periods computed from an anchor, working days, holidays and due dates. | portable | [Details + example](#forgezero-runtime-calendar) |
+| @forgezero/runtime/compliance | Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. | portable | [Details + example](#forgezero-runtime-compliance) |
+| @forgezero/runtime/totp | RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. | portable | [Details + example](#forgezero-runtime-totp) |
+| @forgezero/runtime/passkey | Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. | portable | [Details + example](#forgezero-runtime-passkey) |
+| @forgezero/runtime/phrase | BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. | portable | [Details + example](#forgezero-runtime-phrase) |
+| @forgezero/runtime/snp | Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade. | portable | [Details + example](#forgezero-runtime-snp) |
+| @forgezero/runtime/importers | Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error. | portable | [Details + example](#forgezero-runtime-importers) |
+| @forgezero/runtime/openssh | OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys. | portable | [Details + example](#forgezero-runtime-openssh) |
+| @forgezero/runtime/ssh-cert | OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out. | portable | [Details + example](#forgezero-runtime-ssh-cert) |
+| @forgezero/runtime/slip10 | SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond. | portable | [Details + example](#forgezero-runtime-slip10) |
+| @forgezero/runtime/identity | Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would. | portable | [Details + example](#forgezero-runtime-identity) |
+| @forgezero/runtime/schema | Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form. | portable | [Details + example](#forgezero-runtime-schema) |
+| @forgezero/runtime/schema/typebox | The TypeBox validator behind that interface. | portable | [Details + example](#forgezero-runtime-schema-typebox) |
+| @forgezero/runtime/finance/discounts | Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. | portable | [Details + example](#forgezero-runtime-finance-discounts) |
+| @forgezero/runtime/finance/money | Exact amounts in minor units with the asset attached, so two currencies cannot be added. | portable | [Details + example](#forgezero-runtime-finance-money) |
+| @forgezero/runtime/finance/venues | Trading venues, market types and symbols as data — spot, margin and futures behind one order model. | portable | [Details + example](#forgezero-runtime-finance-venues) |
+| @forgezero/runtime/finance/ledger | Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. | portable | [Details + example](#forgezero-runtime-finance-ledger) |
+| @forgezero/runtime/finance/commission | Profit net of flows, a high-water mark, the tier split and the referral share of our income. | portable | [Details + example](#forgezero-runtime-finance-commission) |
+| @forgezero/runtime/finance/rates | What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. | portable | [Details + example](#forgezero-runtime-finance-rates) |
+| @forgezero/runtime/finance/transfers | Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. | portable | [Details + example](#forgezero-runtime-finance-transfers) |
+| @forgezero/runtime/finance/chain | Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. | portable | [Details + example](#forgezero-runtime-finance-chain) |
+| @forgezero/runtime/finance/custody | Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. | portable | [Details + example](#forgezero-runtime-finance-custody) |
+| @forgezero/runtime/finance/derive | Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. | portable | [Details + example](#forgezero-runtime-finance-derive) |
+| @forgezero/runtime/finance/tax | Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. | portable | [Details + example](#forgezero-runtime-finance-tax) |
+| @forgezero/runtime/finance/storage | Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. | portable | [Details + example](#forgezero-runtime-finance-storage) |
+| @forgezero/runtime/realtime | Provider-neutral realtime audience, shard, event and delivery contracts. | portable | [Details + example](#forgezero-runtime-realtime) |
+| @forgezero/runtime/passkey-hybrid | Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. | portable | [Details + example](#forgezero-runtime-passkey-hybrid) |
+| @forgezero/runtime/otpauth | Parse and render otpauth URIs without binding enrolment to a UI framework. | portable | [Details + example](#forgezero-runtime-otpauth) |
+| @forgezero/runtime/pipeline | Typed ordered application-pipeline execution with explicit evidence. | portable | [Details + example](#forgezero-runtime-pipeline) |
+| @forgezero/runtime/finance/chain-addresses | Chain-address derivation records and validation independent of a node provider. | portable | [Details + example](#forgezero-runtime-finance-chain-addresses) |
+| @forgezero/runtime/finance/chain-deposits | Provider-neutral deposit observation, confirmation and credit transitions. | portable | [Details + example](#forgezero-runtime-finance-chain-deposits) |
+| @forgezero/runtime/finance/chain-withdrawals | Provider-neutral withdrawal approval, broadcast and finality transitions. | portable | [Details + example](#forgezero-runtime-finance-chain-withdrawals) |
+| @forgezero/runtime/finance/chain-reconcile | Deterministic reconciliation between chain observations and durable transfer state. | portable | [Details + example](#forgezero-runtime-finance-chain-reconcile) |
+| @forgezero/runtime/finance/market | Market order, fill and quote contracts independent of any exchange adapter. | portable | [Details + example](#forgezero-runtime-finance-market) |
+| @forgezero/runtime/custody-share | Threshold-share parsing, validation and reconstruction. | portable | [Details + example](#forgezero-runtime-custody-share) |
+| @forgezero/runtime/custody-crypto | Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. | portable | [Details + example](#forgezero-runtime-custody-crypto) |
+
+## Commands
+
+bun add @forgezero/runtime — Install runtime contracts; import the required subpath so unused capabilities stay out of the bundle.
+
+```text
 bun add @forgezero/runtime
 ```
 
-```ts
+<a id="forgezero-runtime-query"></a>
+## @forgezero/runtime/query
+
+Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB. Named value imports: QueryContractError, defineQuery, implementQuery. Named type imports: QueryCodec, QueryContract, QueryDecode, QueryExecution, QueryImplementation, QueryInput, QueryIssue, QueryOutput. Import only the names used by this file.
+
+```text
+import { QueryContractError, defineQuery, implementQuery } from '@forgezero/runtime/query';
+import type { QueryCodec, QueryContract, QueryDecode, QueryExecution, QueryImplementation, QueryInput } from '@forgezero/runtime/query';
+import type { QueryIssue, QueryOutput } from '@forgezero/runtime/query';
+```
+
+## @forgezero/runtime/query — Define and implement a typed query
+
+Decode untrusted input and validate output around injected storage/services rather than embedding a database query in the route adapter.
+
+```text
+import { defineQuery, implementQuery } from '@forgezero/runtime/query';
+import { T, type Static, typeboxQueryCodec } from '@forgezero/runtime/schema/typebox';
+
+const OrderKey = T.Object({ orderKey: T.String({ minLength: 1 }) });
+const Order = T.Object({ orderKey: T.String(), total: T.String() });
+type OrderRow = Static<typeof Order>;
+type Stores = { orders: { find(key: string): Promise<OrderRow | null> } };
+declare const stores: Stores;
+
+const findOrder = defineQuery({
+  name: 'orders.find',
+  input: typeboxQueryCodec(OrderKey),
+  output: typeboxQueryCodec(T.Union([Order, T.Null()]))
+});
+export const runFindOrder = implementQuery(findOrder,
+  (context: Stores, input) => context.orders.find(input.orderKey)
+);
+
+const order = await runFindOrder.execute(stores, { orderKey: 'ord_123' });
+```
+
+<a id="forgezero-runtime-jobs"></a>
+## @forgezero/runtime/jobs
+
+Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected. Named value imports: VERSION, createScheduler, cursorJob, defineJob, everyMs, memoryLock, nextWallClockAt, storeLock, systemClock. Named type imports: Clock, CursorBatch, CursorJobSpec, CursorStore, JobContext, JobLock, JobReport, JobResult, JobSpec, Lease, LockStore, Scheduler, SchedulerOptions, WallClockSchedule. Import only the names used by this file.
+
+```text
+import { VERSION, createScheduler, cursorJob, defineJob, everyMs, memoryLock } from '@forgezero/runtime/jobs';
+import { nextWallClockAt, storeLock, systemClock } from '@forgezero/runtime/jobs';
+import type { Clock, CursorBatch, CursorJobSpec, CursorStore, JobContext, JobLock } from '@forgezero/runtime/jobs';
+import type { JobReport, JobResult, JobSpec, Lease, LockStore, Scheduler } from '@forgezero/runtime/jobs';
+import type { SchedulerOptions, WallClockSchedule } from '@forgezero/runtime/jobs';
+```
+
+<a id="forgezero-runtime-queue"></a>
+## @forgezero/runtime/queue
+
+Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting. Named value imports: QueueKeyStoppedError, QueueStoppedError, TaskCancelledError, createQueue, queueWidthFor. Named type imports: DrainReport, Queue, QueueOptions, QueueResourcePolicy, QueueTask, RetryPolicy. Import only the names used by this file.
+
+```text
+import { QueueKeyStoppedError, QueueStoppedError, TaskCancelledError, createQueue, queueWidthFor } from '@forgezero/runtime/queue';
+import type { DrainReport, Queue, QueueOptions, QueueResourcePolicy, QueueTask, RetryPolicy } from '@forgezero/runtime/queue';
+```
+
+<a id="forgezero-runtime-outbox"></a>
+## @forgezero/runtime/outbox
+
+Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue. Named value imports: DEFAULT_POLICY, EVENT_STATES, OutboxError, VERSION, backoffMs, createOutbox, memoryStore, outboxJob. Named type imports: DeliveryPolicy, DeliveryResult, DrainReport, EventState, Outbox, OutboxEvent, OutboxOptions, OutboxStore, PublishInput, Transport. Import only the names used by this file.
+
+```text
+import { DEFAULT_POLICY, EVENT_STATES, OutboxError, VERSION, backoffMs, createOutbox } from '@forgezero/runtime/outbox';
+import { memoryStore, outboxJob } from '@forgezero/runtime/outbox';
+import type { DeliveryPolicy, DeliveryResult, DrainReport, EventState, Outbox, OutboxEvent } from '@forgezero/runtime/outbox';
+import type { OutboxOptions, OutboxStore, PublishInput, Transport } from '@forgezero/runtime/outbox';
+```
+
+<a id="forgezero-runtime-audit"></a>
+## @forgezero/runtime/audit
+
+Append-only records chained by hash, with a verifier that names the first altered entry. Named value imports: AuditChainError, GENESIS_DIGEST, VERSION, appendRecord, canonicalise, createAuditChain, exportRange, hashDigester, memoryStore, sealedDigester, verifyChain, verifyExport. Named type imports: AppendOptions, AuditChain, AuditChainOptions, AuditEntry, AuditExport, AuditRecord, AuditStore, ChainVerdict, Digester, EffectAuditRecord. Import only the names used by this file.
+
+```text
+import { AuditChainError, GENESIS_DIGEST, VERSION, appendRecord, canonicalise, createAuditChain } from '@forgezero/runtime/audit';
+import { exportRange, hashDigester, memoryStore, sealedDigester, verifyChain, verifyExport } from '@forgezero/runtime/audit';
+import type { AppendOptions, AuditChain, AuditChainOptions, AuditEntry, AuditExport, AuditRecord } from '@forgezero/runtime/audit';
+import type { AuditStore, ChainVerdict, Digester, EffectAuditRecord } from '@forgezero/runtime/audit';
+```
+
+<a id="forgezero-runtime-backup"></a>
+## @forgezero/runtime/backup
+
+Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back. Named value imports: BackupError, DEFAULT_RETENTION, SNAPSHOT_FORMAT, VERSION, backupJob, listSnapshots, prune, restore, selectForDeletion, snapshot, verifySnapshot. Named type imports: ChunkRecord, ObjectStore, RestoreOptions, RestoreReport, RetentionPolicy, RowSink, RowSource, SnapshotManifest, SnapshotOptions, VerifyReport. Import only the names used by this file.
+
+```text
+import { BackupError, DEFAULT_RETENTION, SNAPSHOT_FORMAT, VERSION, backupJob, listSnapshots } from '@forgezero/runtime/backup';
+import { prune, restore, selectForDeletion, snapshot, verifySnapshot } from '@forgezero/runtime/backup';
+import type { ChunkRecord, ObjectStore, RestoreOptions, RestoreReport, RetentionPolicy, RowSink } from '@forgezero/runtime/backup';
+import type { RowSource, SnapshotManifest, SnapshotOptions, VerifyReport } from '@forgezero/runtime/backup';
+```
+
+<a id="forgezero-runtime-notify"></a>
+## @forgezero/runtime/notify
+
+Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. Named value imports: CHANNELS, NotifyError, VERSION, assertHeaderSafe, button, codeBlock, createNotifier, defineTemplate, escapeHtml, layout, preview, render. Named type imports: Channel, Notification, Notifier, NotifierOptions, Rendered, TemplateSpec, Transport. Import only the names used by this file.
+
+```text
+import { CHANNELS, NotifyError, VERSION, assertHeaderSafe, button, codeBlock } from '@forgezero/runtime/notify';
+import { createNotifier, defineTemplate, escapeHtml, layout, preview, render } from '@forgezero/runtime/notify';
+import type { Channel, Notification, Notifier, NotifierOptions, Rendered, TemplateSpec } from '@forgezero/runtime/notify';
+import type { Transport } from '@forgezero/runtime/notify';
+```
+
+<a id="forgezero-runtime-notify-templates"></a>
+## @forgezero/runtime/notify/templates
+
+The six transactional messages ForgeZero sends. Named value imports: TEMPLATES, ceremonyProposed, custodianEnrolment, escapeHtml, invitation, newDevice, signInCode, vaultLocked. Named type imports: TemplateKey. Import only the names used by this file.
+
+```text
+import { TEMPLATES, ceremonyProposed, custodianEnrolment, escapeHtml, invitation, newDevice } from '@forgezero/runtime/notify/templates';
+import { signInCode, vaultLocked } from '@forgezero/runtime/notify/templates';
+import type { TemplateKey } from '@forgezero/runtime/notify/templates';
+```
+
+<a id="forgezero-runtime-calendar"></a>
+## @forgezero/runtime/calendar
+
+Billing periods computed from an anchor, working days, holidays and due dates. Named value imports: CalendarError, DAY_MS, DEFAULT_WORKING_DAYS, closedPeriods, dayOfWeek, daysOverdue, fromDay, isOverdue, isWorkingDay, nextWorkingDay, periodAt, periodIndexOn, periodOn, toDay, workingDaysBetween. Named type imports: BillingSchedule, Calendar, IsoDate, Period. Import only the names used by this file.
+
+```text
+import { CalendarError, DAY_MS, DEFAULT_WORKING_DAYS, closedPeriods, dayOfWeek, daysOverdue } from '@forgezero/runtime/calendar';
+import { fromDay, isOverdue, isWorkingDay, nextWorkingDay, periodAt, periodIndexOn } from '@forgezero/runtime/calendar';
+import { periodOn, toDay, workingDaysBetween } from '@forgezero/runtime/calendar';
+import type { BillingSchedule, Calendar, IsoDate, Period } from '@forgezero/runtime/calendar';
+```
+
+<a id="forgezero-runtime-compliance"></a>
+## @forgezero/runtime/compliance
+
+Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. Named value imports: ComplianceError, RISK_LEVELS, VERIFICATION_TIERS, combineLists, countryRule, newCounterpartyRule, screen, screeningStage, staticList, tierLimitRule, unavailableList. Named type imports: ListEntry, RiskLevel, Rule, RuleHit, ScreenOptions, ScreeningList, StageOptions, Subject, Verdict, VerificationTier. Import only the names used by this file.
+
+```text
+import { ComplianceError, RISK_LEVELS, VERIFICATION_TIERS, combineLists, countryRule, newCounterpartyRule } from '@forgezero/runtime/compliance';
+import { screen, screeningStage, staticList, tierLimitRule, unavailableList } from '@forgezero/runtime/compliance';
+import type { ListEntry, RiskLevel, Rule, RuleHit, ScreenOptions, ScreeningList } from '@forgezero/runtime/compliance';
+import type { StageOptions, Subject, Verdict, VerificationTier } from '@forgezero/runtime/compliance';
+```
+
+<a id="forgezero-runtime-totp"></a>
+## @forgezero/runtime/totp
+
+RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. Named value imports: DEFAULT_DIGITS, DEFAULT_STEP_SECONDS, TotpError, assertCode, codeAt, codeFor, counterAt, enrolmentUri, fromBase32, generateSecret, secondsRemaining, toBase32, verifyCode. Named type imports: TotpOptions, VerifyOptions, VerifyResult. Import only the names used by this file.
+
+```text
+import { DEFAULT_DIGITS, DEFAULT_STEP_SECONDS, TotpError, assertCode, codeAt, codeFor } from '@forgezero/runtime/totp';
+import { counterAt, enrolmentUri, fromBase32, generateSecret, secondsRemaining, toBase32 } from '@forgezero/runtime/totp';
+import { verifyCode } from '@forgezero/runtime/totp';
+import type { TotpOptions, VerifyOptions, VerifyResult } from '@forgezero/runtime/totp';
+```
+
+<a id="forgezero-runtime-passkey"></a>
+## @forgezero/runtime/passkey
+
+Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. Named value imports: FLAG_BE, FLAG_BS, FLAG_UP, FLAG_UV, PasskeyError, assertPasskey, authenticatorData, credentialIdFor, passkeysFor, rpIdMatches, verifyAssertion. Named type imports: Assertion, AssertionRequest, StoredPasskey. Import only the names used by this file.
+
+```text
+import { FLAG_BE, FLAG_BS, FLAG_UP, FLAG_UV, PasskeyError, assertPasskey } from '@forgezero/runtime/passkey';
+import { authenticatorData, credentialIdFor, passkeysFor, rpIdMatches, verifyAssertion } from '@forgezero/runtime/passkey';
+import type { Assertion, AssertionRequest, StoredPasskey } from '@forgezero/runtime/passkey';
+```
+
+<a id="forgezero-runtime-phrase"></a>
+## @forgezero/runtime/phrase
+
+BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. Named value imports: PHRASE_SALT_BYTES, PHRASE_WORDS, generatePhrase, newSalt, phraseToKey, phraseVerifier, validatePhrase. Named type imports: none. Import only the names used by this file.
+
+```text
+import { PHRASE_SALT_BYTES, PHRASE_WORDS, generatePhrase, newSalt, phraseToKey, phraseVerifier } from '@forgezero/runtime/phrase';
+import { validatePhrase } from '@forgezero/runtime/phrase';
+```
+
+<a id="forgezero-runtime-snp"></a>
+## @forgezero/runtime/snp
+
+Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade. Named value imports: REPORT_BYTES, SnpError, bindsNonce, parseSnpReport, tcbAtLeast. Named type imports: GuestPolicy, SnpReport, TcbVersion. Import only the names used by this file.
+
+```text
+import { REPORT_BYTES, SnpError, bindsNonce, parseSnpReport, tcbAtLeast } from '@forgezero/runtime/snp';
+import type { GuestPolicy, SnpReport, TcbVersion } from '@forgezero/runtime/snp';
+```
+
+<a id="forgezero-runtime-importers"></a>
+## @forgezero/runtime/importers
+
+Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error. Named value imports: IMPORT_FORMATS, normaliseName, parseBitwarden, parseCsv, parseEnv, parseImport, parseOnePassword. Named type imports: ImportFormat, ImportResult, ImportedSecret, Skipped. Import only the names used by this file.
+
+```text
+import { IMPORT_FORMATS, normaliseName, parseBitwarden, parseCsv, parseEnv, parseImport } from '@forgezero/runtime/importers';
+import { parseOnePassword } from '@forgezero/runtime/importers';
+import type { ImportFormat, ImportResult, ImportedSecret, Skipped } from '@forgezero/runtime/importers';
+```
+
+<a id="forgezero-runtime-openssh"></a>
+## @forgezero/runtime/openssh
+
+OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys. Named value imports: OpenSshError, authorizedKey, fingerprint, parseAuthorizedKey, publicKeyBlob, signatureBlob. Named type imports: none. Import only the names used by this file.
+
+```text
+import { OpenSshError, authorizedKey, fingerprint, parseAuthorizedKey, publicKeyBlob, signatureBlob } from '@forgezero/runtime/openssh';
+```
+
+<a id="forgezero-runtime-ssh-cert"></a>
+## @forgezero/runtime/ssh-cert
+
+OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out. Named value imports: CERT_TYPE_HOST, CERT_TYPE_USER, DEFAULT_EXTENSIONS, SshCertError, caFingerprint, caFromSecretKey, caPublicKeyLine, isCurrentlyValid, signCertificate. Named type imports: CertificateAuthority, CertificateRequest. Import only the names used by this file.
+
+```text
+import { CERT_TYPE_HOST, CERT_TYPE_USER, DEFAULT_EXTENSIONS, SshCertError, caFingerprint, caFromSecretKey } from '@forgezero/runtime/ssh-cert';
+import { caPublicKeyLine, isCurrentlyValid, signCertificate } from '@forgezero/runtime/ssh-cert';
+import type { CertificateAuthority, CertificateRequest } from '@forgezero/runtime/ssh-cert';
+```
+
+<a id="forgezero-runtime-slip10"></a>
+## @forgezero/runtime/slip10
+
+SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond. Named value imports: HARDENED_OFFSET, Slip10Error, deriveChild, derivePath, masterFromSeed. Named type imports: Slip10Node. Import only the names used by this file.
+
+```text
+import { HARDENED_OFFSET, Slip10Error, deriveChild, derivePath, masterFromSeed } from '@forgezero/runtime/slip10';
+import type { Slip10Node } from '@forgezero/runtime/slip10';
+```
+
+<a id="forgezero-runtime-identity"></a>
+## @forgezero/runtime/identity
+
+Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would. Named value imports: CLOCK_SKEW_SECONDS, REQUEST_SIGNATURE_SUITE, RESPONSE_KEY_HEADER, RESPONSE_SEALING_SUITE, canonicalString, decodeSignatureHeader, deriveKeysFromSeed, derivePublicKeysFromSeed, encodeSignatureHeader, generateNodeKeys, generateResponseRecipient, openResponse, sealResponse, signRequest, validResponsePublicKey, verifyRequest. Named type imports: NodeKeyPair, NodePublicKeys, ResponseRecipient, SealedResponse, SignedEnvelope, VerifyFailure. Import only the names used by this file.
+
+```text
+import { CLOCK_SKEW_SECONDS, REQUEST_SIGNATURE_SUITE, RESPONSE_KEY_HEADER, RESPONSE_SEALING_SUITE, canonicalString, decodeSignatureHeader } from '@forgezero/runtime/identity';
+import { deriveKeysFromSeed, derivePublicKeysFromSeed, encodeSignatureHeader, generateNodeKeys, generateResponseRecipient, openResponse } from '@forgezero/runtime/identity';
+import { sealResponse, signRequest, validResponsePublicKey, verifyRequest } from '@forgezero/runtime/identity';
+import type { NodeKeyPair, NodePublicKeys, ResponseRecipient, SealedResponse, SignedEnvelope, VerifyFailure } from '@forgezero/runtime/identity';
+```
+
+<a id="forgezero-runtime-schema"></a>
+## @forgezero/runtime/schema
+
+Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form. Named value imports: DEFAULT_RESTRICTIONS, SCHEMA_VERSION, SchemaError, VERSION, describeJsonSchema, readableFields, restrictJsonSchema, writeOnlyPaths. Named type imports: FieldKind, FormField, Restrictions, SchemaValidator, ValidationResult. Import only the names used by this file.
+
+```text
+import { DEFAULT_RESTRICTIONS, SCHEMA_VERSION, SchemaError, VERSION, describeJsonSchema, readableFields } from '@forgezero/runtime/schema';
+import { restrictJsonSchema, writeOnlyPaths } from '@forgezero/runtime/schema';
+import type { FieldKind, FormField, Restrictions, SchemaValidator, ValidationResult } from '@forgezero/runtime/schema';
+```
+
+## @forgezero/runtime/schema — Restrict an untrusted JSON Schema before storing it
+
+Tenant-supplied schemas are data, not executable code. Restriction rejects references, remote identifiers, unsupported keywords, excessive depth/size, and arrays without a bounded maxItems. Form metadata is derived from the accepted schema; write-only fields remain identifiable for secret handling.
+
+```text
+import { restrictJsonSchema, describeJsonSchema, writeOnlyPaths } from '@forgezero/runtime/schema';
+
+const schema = restrictJsonSchema({
+  type: 'object', additionalProperties: false,
+  properties: {
+    recipients: { type: 'array', maxItems: 100, items: { type: 'string' } },
+    apiKey: { type: 'string', title: 'API key', writeOnly: true }
+  },
+  required: ['apiKey']
+});
+const fields = describeJsonSchema(schema);
+const secretFields = writeOnlyPaths(fields);
+```
+
+<a id="forgezero-runtime-schema-typebox"></a>
+## @forgezero/runtime/schema/typebox
+
+The TypeBox validator behind that interface. Named value imports: T, parse, typebox, typeboxQueryCodec. Named type imports: Static, TSchema. Import only the names used by this file.
+
+```text
+import { T, parse, typebox, typeboxQueryCodec } from '@forgezero/runtime/schema/typebox';
+import type { Static, TSchema } from '@forgezero/runtime/schema/typebox';
+```
+
+## @forgezero/runtime/schema/typebox — One TypeBox shape for runtime validation and static types
+
+TypeBox is an optional peer. Its schema is JSON Schema, so the same restriction and form layer applies. The query codec validates both untrusted input and returned output; malformed values fail instead of being coerced.
+
+```text
+import { T, type Static, parse, typeboxQueryCodec } from '@forgezero/runtime/schema/typebox';
+
+const User = T.Object({
+  userKey: T.String({ minLength: 1 }),
+  roles: T.Array(T.String(), { maxItems: 32 })
+}, { additionalProperties: false });
+type User = Static<typeof User>;
+const user: User = parse(User, unknownInput);
+const codec = typeboxQueryCodec(User);
+```
+
+<a id="forgezero-runtime-finance-discounts"></a>
+## @forgezero/runtime/finance/discounts
+
+Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. Named value imports: DiscountError, assertCode, assertWindow, bestDiscount, discountFor, ineligibility, normaliseCode. Named type imports: AppliedDiscount, DiscountKind, Ineligibility, Promotion. Import only the names used by this file.
+
+```text
+import { DiscountError, assertCode, assertWindow, bestDiscount, discountFor, ineligibility } from '@forgezero/runtime/finance/discounts';
+import { normaliseCode } from '@forgezero/runtime/finance/discounts';
+import type { AppliedDiscount, DiscountKind, Ineligibility, Promotion } from '@forgezero/runtime/finance/discounts';
+```
+
+<a id="forgezero-runtime-finance-money"></a>
+## @forgezero/runtime/finance/money
+
+Exact amounts in minor units with the asset attached, so two currencies cannot be added. Named value imports: ASSETS, MoneyError, ROUNDING, VERSION, abs, add, allocate, assetSpec, compare, convert, defineAsset, equals, formatAmount, isNegative, isZero, money, mulRate, negate, parseAmount, subtract, toStep, zero. Named type imports: AssetSpec, Money, Rounding. Import only the names used by this file.
+
+```text
+import { ASSETS, MoneyError, ROUNDING, VERSION, abs, add } from '@forgezero/runtime/finance/money';
+import { allocate, assetSpec, compare, convert, defineAsset, equals } from '@forgezero/runtime/finance/money';
+import { formatAmount, isNegative, isZero, money, mulRate, negate } from '@forgezero/runtime/finance/money';
+import { parseAmount, subtract, toStep, zero } from '@forgezero/runtime/finance/money';
+import type { AssetSpec, Money, Rounding } from '@forgezero/runtime/finance/money';
+```
+
+<a id="forgezero-runtime-finance-venues"></a>
+## @forgezero/runtime/finance/venues
+
+Trading venues, market types and symbols as data — spot, margin and futures behind one order model. Named value imports: MARKET_TYPES, ORDER_SIDES, ORDER_TYPES, TIME_IN_FORCE, VENUES, VERSION, VenueError, notionalOf, parseSymbol, submitOrder, symbolOf, validateOrder, venue, venuesFor. Named type imports: MarketSpec, MarketType, OrderRequest, OrderResult, OrderSide, OrderStatus, OrderType, TimeInForce, VenueAdapter, VenueSpec. Import only the names used by this file.
+
+```text
+import { MARKET_TYPES, ORDER_SIDES, ORDER_TYPES, TIME_IN_FORCE, VENUES, VERSION } from '@forgezero/runtime/finance/venues';
+import { VenueError, notionalOf, parseSymbol, submitOrder, symbolOf, validateOrder } from '@forgezero/runtime/finance/venues';
+import { venue, venuesFor } from '@forgezero/runtime/finance/venues';
+import type { MarketSpec, MarketType, OrderRequest, OrderResult, OrderSide, OrderStatus } from '@forgezero/runtime/finance/venues';
+import type { OrderType, TimeInForce, VenueAdapter, VenueSpec } from '@forgezero/runtime/finance/venues';
+```
+
+<a id="forgezero-runtime-finance-ledger"></a>
+## @forgezero/runtime/finance/ledger
+
+Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. Named value imports: ACCOUNT_KINDS, BUCKETS, LedgerError, MAX_LEDGER_ENTRIES, VERSION, accountId, assertAvailable, assertBalanced, availableOf, balanceOf, balancesFrom, captureHold, heldOf, parseAccount, placeHold, queueKeyFor, releaseHold, statement, totalOf, transfer, trialBalance. Named type imports: AccountKind, AccountRef, Bucket, Entry, Transaction, TrialBalance. Import only the names used by this file.
+
+```text
+import { ACCOUNT_KINDS, BUCKETS, LedgerError, MAX_LEDGER_ENTRIES, VERSION, accountId } from '@forgezero/runtime/finance/ledger';
+import { assertAvailable, assertBalanced, availableOf, balanceOf, balancesFrom, captureHold } from '@forgezero/runtime/finance/ledger';
+import { heldOf, parseAccount, placeHold, queueKeyFor, releaseHold, statement } from '@forgezero/runtime/finance/ledger';
+import { totalOf, transfer, trialBalance } from '@forgezero/runtime/finance/ledger';
+import type { AccountKind, AccountRef, Bucket, Entry, Transaction, TrialBalance } from '@forgezero/runtime/finance/ledger';
+```
+
+<a id="forgezero-runtime-finance-commission"></a>
+## @forgezero/runtime/finance/commission
+
+Profit net of flows, a high-water mark, the tier split and the referral share of our income. Named value imports: CommissionError, allocate, chargeableProfit, commissionTransaction, nextHighWaterMark, periodProfit, projectPrepay, splitCommission, splitReferrals. Named type imports: CommissionInput, CommissionSplit, PeriodPerformance, Prepay, PrepayInput, ReferralShare. Import only the names used by this file.
+
+```text
+import { CommissionError, allocate, chargeableProfit, commissionTransaction, nextHighWaterMark, periodProfit } from '@forgezero/runtime/finance/commission';
+import { projectPrepay, splitCommission, splitReferrals } from '@forgezero/runtime/finance/commission';
+import type { CommissionInput, CommissionSplit, PeriodPerformance, Prepay, PrepayInput, ReferralShare } from '@forgezero/runtime/finance/commission';
+```
+
+<a id="forgezero-runtime-finance-rates"></a>
+## @forgezero/runtime/finance/rates
+
+What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. Named value imports: BASE_ASSET, RATE_SOURCES, RateError, assertRate, createRateTable, describeRate, isRegistered, peg, rateRefreshJob, refreshRates, registerAsset. Named type imports: AssetEntry, AssetRate, RateFetcher, RateSource, RateTable, RateTableOptions, RefreshReport. Import only the names used by this file.
+
+```text
+import { BASE_ASSET, RATE_SOURCES, RateError, assertRate, createRateTable, describeRate } from '@forgezero/runtime/finance/rates';
+import { isRegistered, peg, rateRefreshJob, refreshRates, registerAsset } from '@forgezero/runtime/finance/rates';
+import type { AssetEntry, AssetRate, RateFetcher, RateSource, RateTable, RateTableOptions } from '@forgezero/runtime/finance/rates';
+import type { RefreshReport } from '@forgezero/runtime/finance/rates';
+```
+
+<a id="forgezero-runtime-finance-transfers"></a>
+## @forgezero/runtime/finance/transfers
+
+Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. Named value imports: DIRECTIONS, PipelineError, SCREENING_ORDER, approvalStage, balanceStage, createTransferPipeline, limitsStage, notFrozenStage, screeningStage. Named type imports: Direction, PipelineResult, Stage, StageOutcome, Transfer, TransferPipeline. Import only the names used by this file.
+
+```text
+import { DIRECTIONS, PipelineError, SCREENING_ORDER, approvalStage, balanceStage, createTransferPipeline } from '@forgezero/runtime/finance/transfers';
+import { limitsStage, notFrozenStage, screeningStage } from '@forgezero/runtime/finance/transfers';
+import type { Direction, PipelineResult, Stage, StageOutcome, Transfer, TransferPipeline } from '@forgezero/runtime/finance/transfers';
+```
+
+<a id="forgezero-runtime-finance-chain"></a>
+## @forgezero/runtime/finance/chain
+
+Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. Named value imports: ADDRESS_SCHEMES, ChainError, SEED_CHAINS, SEED_CHAIN_ASSETS, assertChain, confirmationsFor, createChainRegistry, estimatedSeconds, validateAddress. Named type imports: AddressScheme, ChainAsset, ChainRegistry, ChainSpec, ConfirmationBand. Import only the names used by this file.
+
+```text
+import { ADDRESS_SCHEMES, ChainError, SEED_CHAINS, SEED_CHAIN_ASSETS, assertChain, confirmationsFor } from '@forgezero/runtime/finance/chain';
+import { createChainRegistry, estimatedSeconds, validateAddress } from '@forgezero/runtime/finance/chain';
+import type { AddressScheme, ChainAsset, ChainRegistry, ChainSpec, ConfirmationBand } from '@forgezero/runtime/finance/chain';
+```
+
+<a id="forgezero-runtime-finance-custody"></a>
+## @forgezero/runtime/finance/custody
+
+Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. Named value imports: CustodyError, VERSION, depositAddress, domainSeparator, orderSignatures, saltFor, toChecksumAddress, withdrawDigest. Named type imports: none. Import only the names used by this file.
+
+```text
+import { CustodyError, VERSION, depositAddress, domainSeparator, orderSignatures, saltFor } from '@forgezero/runtime/finance/custody';
+import { toChecksumAddress, withdrawDigest } from '@forgezero/runtime/finance/custody';
+```
+
+<a id="forgezero-runtime-finance-derive"></a>
+## @forgezero/runtime/finance/derive
+
+Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. Named value imports: CUSTODY, DERIVE_KEYWORD, DeriveError, SCHEMES, assertDeriveSpec, custodyOf, deriveSpecOf, derivedFields, derivedPaths, pathFor, suppliedPaths. Named type imports: Custody, DeriveSpec, DerivedField, Scheme. Import only the names used by this file.
+
+```text
+import { CUSTODY, DERIVE_KEYWORD, DeriveError, SCHEMES, assertDeriveSpec, custodyOf } from '@forgezero/runtime/finance/derive';
+import { deriveSpecOf, derivedFields, derivedPaths, pathFor, suppliedPaths } from '@forgezero/runtime/finance/derive';
+import type { Custody, DeriveSpec, DerivedField, Scheme } from '@forgezero/runtime/finance/derive';
+```
+
+<a id="forgezero-runtime-finance-tax"></a>
+## @forgezero/runtime/finance/tax
+
+Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. Named value imports: TREATMENTS, TaxError, applyTax, assertTaxRate, decideTax, describeTax, parseRate, percent, totalWithTax. Named type imports: Customer, Supplier, TaxAmounts, TaxDecision, TaxRate, Treatment. Import only the names used by this file.
+
+```text
+import { TREATMENTS, TaxError, applyTax, assertTaxRate, decideTax, describeTax } from '@forgezero/runtime/finance/tax';
+import { parseRate, percent, totalWithTax } from '@forgezero/runtime/finance/tax';
+import type { Customer, Supplier, TaxAmounts, TaxDecision, TaxRate, Treatment } from '@forgezero/runtime/finance/tax';
+```
+
+<a id="forgezero-runtime-finance-storage"></a>
+## @forgezero/runtime/finance/storage
+
+Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. Named value imports: SORT_FIELD, fromStored, rangeBounds, sortExact, sortKey, storeAmount, toStored, withinRange. Named type imports: StoredMoney. Import only the names used by this file.
+
+```text
+import { SORT_FIELD, fromStored, rangeBounds, sortExact, sortKey, storeAmount } from '@forgezero/runtime/finance/storage';
+import { toStored, withinRange } from '@forgezero/runtime/finance/storage';
+import type { StoredMoney } from '@forgezero/runtime/finance/storage';
+```
+
+<a id="forgezero-runtime-realtime"></a>
+## @forgezero/runtime/realtime
+
+Provider-neutral realtime audience, shard, event and delivery contracts. Named value imports: REALTIME_MAX_BATCH_BYTES, REALTIME_MAX_EVENTS, REALTIME_MAX_EVENT_BYTES, REALTIME_MAX_SHARDS_PER_TOPIC, REALTIME_MAX_SOCKETS_PER_SHARD, canReceiveRealtimeAudience, issueRealtimeSubscriptionTicket, realtimeBatchBytes, realtimeHmac, realtimeShardKey, validateRealtimeAudience, validateRealtimeBatch, validateRealtimeSubscriptionTicket, verifyRealtimeHmac, verifyRealtimeSubscriptionToken. Named type imports: RealtimeAudience, RealtimeBatch, RealtimeEvent, RealtimePrincipalKind, RealtimeSubscriptionTicket. Import only the names used by this file.
+
+```text
+import { REALTIME_MAX_BATCH_BYTES, REALTIME_MAX_EVENTS, REALTIME_MAX_EVENT_BYTES, REALTIME_MAX_SHARDS_PER_TOPIC, REALTIME_MAX_SOCKETS_PER_SHARD, canReceiveRealtimeAudience } from '@forgezero/runtime/realtime';
+import { issueRealtimeSubscriptionTicket, realtimeBatchBytes, realtimeHmac, realtimeShardKey, validateRealtimeAudience, validateRealtimeBatch } from '@forgezero/runtime/realtime';
+import { validateRealtimeSubscriptionTicket, verifyRealtimeHmac, verifyRealtimeSubscriptionToken } from '@forgezero/runtime/realtime';
+import type { RealtimeAudience, RealtimeBatch, RealtimeEvent, RealtimePrincipalKind, RealtimeSubscriptionTicket } from '@forgezero/runtime/realtime';
+```
+
+<a id="forgezero-runtime-passkey-hybrid"></a>
+## @forgezero/runtime/passkey-hybrid
+
+Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. Named value imports: PASSKEY_HYBRID_SUITE, PASSKEY_HYBRID_VERSION, PASSKEY_ML_DSA_PUBLIC_KEY_BYTES, PASSKEY_ML_DSA_SIGNATURE_BYTES, PASSKEY_PRF_SALT, createPasskeyHybridProof, passkeyHybridMessage, verifyPasskeyHybridProof. Named type imports: PasskeyHybridBinding, PasskeyHybridProof, PasskeyHybridPurpose, PasskeyHybridRegistrationProof. Import only the names used by this file.
+
+```text
+import { PASSKEY_HYBRID_SUITE, PASSKEY_HYBRID_VERSION, PASSKEY_ML_DSA_PUBLIC_KEY_BYTES, PASSKEY_ML_DSA_SIGNATURE_BYTES, PASSKEY_PRF_SALT, createPasskeyHybridProof } from '@forgezero/runtime/passkey-hybrid';
+import { passkeyHybridMessage, verifyPasskeyHybridProof } from '@forgezero/runtime/passkey-hybrid';
+import type { PasskeyHybridBinding, PasskeyHybridProof, PasskeyHybridPurpose, PasskeyHybridRegistrationProof } from '@forgezero/runtime/passkey-hybrid';
+```
+
+<a id="forgezero-runtime-otpauth"></a>
+## @forgezero/runtime/otpauth
+
+Parse and render otpauth URIs without binding enrolment to a UI framework. Named value imports: formatOtpAuth, fromManualSecret, newOtpAuth, parseOtpAuth. Named type imports: OtpAuth. Import only the names used by this file.
+
+```text
+import { formatOtpAuth, fromManualSecret, newOtpAuth, parseOtpAuth } from '@forgezero/runtime/otpauth';
+import type { OtpAuth } from '@forgezero/runtime/otpauth';
+```
+
+<a id="forgezero-runtime-pipeline"></a>
+## @forgezero/runtime/pipeline
+
+Typed ordered application-pipeline execution with explicit evidence. Named value imports: GIT_PROVIDERS, PipelineError, parsePush, shouldDeploy, verifyWebhook, webhookPath. Named type imports: DeployTrigger, GitProvider, PushEvent. Import only the names used by this file.
+
+```text
+import { GIT_PROVIDERS, PipelineError, parsePush, shouldDeploy, verifyWebhook, webhookPath } from '@forgezero/runtime/pipeline';
+import type { DeployTrigger, GitProvider, PushEvent } from '@forgezero/runtime/pipeline';
+```
+
+<a id="forgezero-runtime-finance-chain-addresses"></a>
+## @forgezero/runtime/finance/chain-addresses
+
+Chain-address derivation records and validation independent of a node provider. Named value imports: AddressError, COUNTERFACTUAL_SCHEMES, assertDerivationMatches, create2Address, depositAddressBook, depositSaltFor, deriveDepositAddress, ownerOfAddress, toChecksumAddress, validateAddress. Named type imports: AddressScheme, ChainDeployment. Import only the names used by this file.
+
+```text
+import { AddressError, COUNTERFACTUAL_SCHEMES, assertDerivationMatches, create2Address, depositAddressBook, depositSaltFor } from '@forgezero/runtime/finance/chain-addresses';
+import { deriveDepositAddress, ownerOfAddress, toChecksumAddress, validateAddress } from '@forgezero/runtime/finance/chain-addresses';
+import type { AddressScheme, ChainDeployment } from '@forgezero/runtime/finance/chain-addresses';
+```
+
+<a id="forgezero-runtime-finance-chain-deposits"></a>
+## @forgezero/runtime/finance/chain-deposits
+
+Provider-neutral deposit observation, confirmation and credit transitions. Named value imports: DepositError, creditDeposit, cursorFrom, depositReference, describeScan, isConfirmed, rescanRange, scanOnce. Named type imports: ChainReader, ChainTransfer, DepositCursor, ScanContext, ScanReport. Import only the names used by this file.
+
+```text
+import { DepositError, creditDeposit, cursorFrom, depositReference, describeScan, isConfirmed } from '@forgezero/runtime/finance/chain-deposits';
+import { rescanRange, scanOnce } from '@forgezero/runtime/finance/chain-deposits';
+import type { ChainReader, ChainTransfer, DepositCursor, ScanContext, ScanReport } from '@forgezero/runtime/finance/chain-deposits';
+```
+
+<a id="forgezero-runtime-finance-chain-withdrawals"></a>
+## @forgezero/runtime/finance/chain-withdrawals
+
+Provider-neutral withdrawal approval, broadcast and finality transitions. Named value imports: WITHDRAWAL_STATES, WithdrawalError, approveWithdrawal, broadcastKeyFor, canTransition, confirmWithdrawal, describeSweep, holdReference, markFailed, processOnce, refundFailed, rejectWithdrawal, requestWithdrawal, sweepForPayout. Named type imports: Broadcaster, SweepCandidate, SweepPlan, Withdrawal, WithdrawalState. Import only the names used by this file.
+
+```text
+import { WITHDRAWAL_STATES, WithdrawalError, approveWithdrawal, broadcastKeyFor, canTransition, confirmWithdrawal } from '@forgezero/runtime/finance/chain-withdrawals';
+import { describeSweep, holdReference, markFailed, processOnce, refundFailed, rejectWithdrawal } from '@forgezero/runtime/finance/chain-withdrawals';
+import { requestWithdrawal, sweepForPayout } from '@forgezero/runtime/finance/chain-withdrawals';
+import type { Broadcaster, SweepCandidate, SweepPlan, Withdrawal, WithdrawalState } from '@forgezero/runtime/finance/chain-withdrawals';
+```
+
+<a id="forgezero-runtime-finance-chain-reconcile"></a>
+## @forgezero/runtime/finance/chain-reconcile
+
+Deterministic reconciliation between chain observations and durable transfer state. Named value imports: DISCREPANCY_KINDS, ReconcileError, reconcileOnce, reconcileReport, shortfallUsd. Named type imports: Discrepancy, DiscrepancyKind, LedgerLiability, OnChainHolding, ReconcileReport. Import only the names used by this file.
+
+```text
+import { DISCREPANCY_KINDS, ReconcileError, reconcileOnce, reconcileReport, shortfallUsd } from '@forgezero/runtime/finance/chain-reconcile';
+import type { Discrepancy, DiscrepancyKind, LedgerLiability, OnChainHolding, ReconcileReport } from '@forgezero/runtime/finance/chain-reconcile';
+```
+
+<a id="forgezero-runtime-finance-market"></a>
+## @forgezero/runtime/finance/market
+
+Market order, fill and quote contracts independent of any exchange adapter. Named value imports: MarketError, createFeed, disagreementOf, isStale, lastPrice, limitFor, stalenessOf, subscribe. Named type imports: Feed, FeedEvent, FeedOptions, PriceResult, Quote, StalenessPolicy, VenueSource. Import only the names used by this file.
+
+```text
+import { MarketError, createFeed, disagreementOf, isStale, lastPrice, limitFor } from '@forgezero/runtime/finance/market';
+import { stalenessOf, subscribe } from '@forgezero/runtime/finance/market';
+import type { Feed, FeedEvent, FeedOptions, PriceResult, Quote, StalenessPolicy } from '@forgezero/runtime/finance/market';
+import type { VenueSource } from '@forgezero/runtime/finance/market';
+```
+
+<a id="forgezero-runtime-custody-share"></a>
+## @forgezero/runtime/custody-share
+
+Threshold-share parsing, validation and reconstruction. Named value imports: PROBE_BYTES, factorWrapAad, joinProbeAndShare, openFactorEnvelope, openSealedToFactor, openShareWithPasskey, openShareWithPhrase, passkeyWrappingKey, phraseWrappingKey, sealShare, shareIndexOf, splitProbeAndShare, wrappingKeysFor. Named type imports: SealedShare, WrappingKeys. Import only the names used by this file.
+
+```text
+import { PROBE_BYTES, factorWrapAad, joinProbeAndShare, openFactorEnvelope, openSealedToFactor, openShareWithPasskey } from '@forgezero/runtime/custody-share';
+import { openShareWithPhrase, passkeyWrappingKey, phraseWrappingKey, sealShare, shareIndexOf, splitProbeAndShare } from '@forgezero/runtime/custody-share';
+import { wrappingKeysFor } from '@forgezero/runtime/custody-share';
+import type { SealedShare, WrappingKeys } from '@forgezero/runtime/custody-share';
+```
+
+<a id="forgezero-runtime-custody-crypto"></a>
+## @forgezero/runtime/custody-crypto
+
+Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. Named value imports: deriveKey, openFromKey, openWithKey, sealToKey, sealWithKey, wrappingKeyPair. Named type imports: CipherBox, SealedToKey. Import only the names used by this file.
+
+```text
+import { deriveKey, openFromKey, openWithKey, sealToKey, sealWithKey, wrappingKeyPair } from '@forgezero/runtime/custody-crypto';
+import type { CipherBox, SealedToKey } from '@forgezero/runtime/custody-crypto';
+```
+
+## 1. Install, then import a subpath
+
+There is no root export, and that is deliberate. `import from "@forgezero/runtime"` is meant to fail rather than resolve to whichever module happened to be listed first — a bare import that silently works is how a project ends up depending on the whole package to use one function. Every module is its own entry point, so a bundler includes what you imported and nothing else.
+
+```text
+bun add @forgezero/runtime
+
 import { parseAmount } from '@forgezero/runtime/finance/money';
 import { createScheduler } from '@forgezero/runtime/jobs';
 
-// There is no root export. `import from '@forgezero/runtime'` is meant to fail
-// rather than resolve to whichever module happened to be listed first.
+// This throws. It is supposed to.
+// import { anything } from '@forgezero/runtime';
 ```
 
 ## What is in it
 
-| | |
-|---|---|
-| **Spine** | `query` `jobs` `queue` `outbox` |
-| **Record** | `audit` `backup` `compliance` `calendar` |
-| **Identity** | `identity` `totp` `notify` `notify/templates` `schema` `schema/typebox` |
-| **Finance** | `finance/money` `finance/storage` `finance/ledger` `finance/commission` `finance/rates` `finance/transfers` `finance/tax` `finance/chain` `finance/custody` `finance/derive` `finance/venues` `finance/binance` |
+Four groups. The service spine is what a process needs to keep working after the response is sent; the record keeps evidence; the finance modules are the ones that must never be approximated. Nothing here knows what your product does — a tenant binds its own business rules to these, it does not fork them.
+
+```text
+SPINE      jobs        scheduled work submitted through the common queue
+           queue       awaited result; parallel keys, sequential within one
+           outbox      business-owned durability, drained through handlers
+
+RECORD     audit       append-only, hash-chained, names the first altered row
+           backup      encrypted, chunked, verified snapshots + the restore
+           compliance  screening as a decision record, failing closed
+           calendar    billing periods, working days, holidays, due dates
+
+IDENTITY   identity    hybrid Ed25519 + ML-DSA-65 request signing
+           totp        RFC 6238, asymmetric window, replay rejected
+           notify      named templates to text and HTML, escaped per part
+           schema      JSON Schema validation, restricted and describable
+
+FINANCE    money       minor units with the asset attached
+           storage      the same amount, exact AND sortable in a database
+           ledger      double-entry postings and derived balances
+           commission  profit net of flows, high-water mark, referral split
+           rates       what an asset is worth, and how old that answer is
+           transfers   deposits and withdrawals as ordered pipelines
+           tax         who may tax a sale, and who accounts for it
+           chain       chains, assets, confirmation depth by value band
+           custody     CREATE2 deposit addresses and EIP-712 digests
+           derive      declare a key ForgeZero generates, not the tenant
+           venues      trading venues, market types and symbols as data
+           binance     Binance behind the venue adapter
+```
+
+## Optional peers — install only what your subpath needs
 
-None of it knows what your product does. You bind your own rules to these; you
-do not fork them.
+Nothing third-party is bundled. Vendoring a crypto library means a fix for it never reaches you until this package is republished, so the imports stay real and the dependency stays yours. Most subpaths need nothing; four of them do, and the failure is a plain module-not-found rather than a silently wrong result.
 
-## Typed function queries
+```text
+# most subpaths: nothing to add
 
-`query` binds typed input/output codecs to an ordinary function and any context
-you choose. It has no database or ForgeZero realm dependency. Inputs may decode
-wire values; outputs are checked strictly so a wrong handler result cannot be
-coerced into looking correct.
+# finance/custody  — CREATE2 and EIP-712 digests
+bun add @noble/hashes
 
-```ts
-import { defineQuery, implementQuery } from '@forgezero/runtime/query';
-import { typeboxQueryCodec, T } from '@forgezero/runtime/schema/typebox';
+# identity         — hybrid post-quantum signing
+bun add @noble/curves @noble/post-quantum
 
-const contract = defineQuery({
-  name: 'invoice.by-reference',
-  input: typeboxQueryCodec(T.Object({ reference: T.String() })),
-  output: typeboxQueryCodec(T.Object({ total: T.String() }))
-});
+# schema/typebox   — only if you validate with TypeBox
+bun add @sinclair/typebox
+```
 
-const findInvoice = implementQuery(contract, async (services: MyServices, input, { signal }) =>
-  services.invoices.find(input.reference, { signal })
-);
+## Money is never a number
+
+An amount is minor units as a bigint with its asset attached, so two currencies cannot be added by accident and a rounding mode is always stated. A database needs a second thing the bigint cannot give it — an ORDER BY that works — so `finance/storage` writes both: the authoritative string, and a lossy double used for sorting and range filters only. One ETH is 10^18 minor units and a signed 64-bit column overflows at about nine ETH, which is why the exact value is never the sortable one.
+
+```text
+import { parseAmount, mulRate, formatAmount } from '@forgezero/runtime/finance/money';
+import { toStored, rangeBounds } from '@forgezero/runtime/finance/storage';
+
+const fee = mulRate(parseAmount('1250.00', 'USD'), '0.015', 'down');
+formatAmount(fee);                    // '18.75' — never 18.749999999
+
+const row = toStored(fee);
+// { units: '1875', value: '18.75', asset: 'USD', sort: 18.75 }
+//   units → what you pay out.  sort → what you ORDER BY.
+
+rangeBounds(parseAmount('10', 'USD'), null);   // { gte: 10 }
 ```
 
-## One reusable async queue
+## The contracts ship with it
+
+The Solidity behind `finance/custody` is in the package rather than in a repository you have to go find. `finance/custody` computes the counterfactual address; `DepositFactory` is what makes that address real on first sweep, and `ColdVault` is the M-of-N EIP-712 approval the digests are built for. Address arithmetic without the contract that honours it is half an answer.
 
-`queue` is deliberately memory-only: it accepts a function, returns that
-function's value through a Promise, runs one key sequentially, and runs
-different keys in parallel. Persistence and cluster ownership remain in the
-business layer that knows what a pending request means; ForgeZero uses an
-ArangoDB unique claim, while another caller may use any database or no database.
+```text
+node_modules/@forgezero/runtime/contracts/src/
+  DepositProxy.sol      lazily deployed at first sweep — no key, no gas per address
+  DepositFactory.sol    CREATE2, salt opaque to the contract
+  ColdVault.sol         M-of-N, signatures ordered by ascending signer
+  SafeTransferLib.sol   tokens that do not return a bool
+```
 
-```ts
-import { createQueue } from '@forgezero/runtime/queue';
+## Jobs — background work that never overlaps
 
-// Default admission is 60% of reported logical CPUs (with one reserved).
-// Use `width` for an exact ceiling, or an explicit dynamic resource policy:
-const queue = createQueue({ resources: { percent: 60, reserve: 1, max: 32 } });
-const task = queue.run('tenant-a:wallet-7', transfer, amount, destination);
-const receipt = await task.result;
+The lock and the cursor store are interfaces, so this runs against a database, Redis, or nothing at all in a test.
 
-queue.pauseKey('tenant-a:wallet-7');
-queue.resumeKey('tenant-a:wallet-7');
-queue.stopKey('tenant-a:wallet-7'); // running finishes; pending is rejected
-queue.startKey('tenant-a:wallet-7');
-queue.cancel(task.id);               // pending task only
-await queue.stop(30_000);            // close intake and drain all work
+```text
+import { createScheduler, defineJob, cursorJob } from '@forgezero/runtime/jobs';
 ```
 
-Different async keys overlap immediately. CPU-heavy JavaScript does not become
-multi-core merely by entering a queue: put that handler in Bun/standard Workers
-and await the Worker result from the queue.
+## Never setInterval
 
-Jobs accept intervals down to seconds or a local wall-clock schedule with an
-IANA timezone and weekday filter. `overlap: 'wait'` (the default) schedules the
-next run after completion; `overlap: 'skip'` keeps clock cadence and drops a tick
-when the same key is still busy. Same-key overlap is never allowed.
+An interval fires whether or not the previous run finished, so work that takes longer than its period ends up running twice over the same data. The next run is scheduled after the current one completes, which makes the overlap impossible rather than unlikely.
 
-```ts
-defineJob({
-  key: 'tenant:acme:invoice',
-  label: 'Monthly invoice preparation',
-  schedule: { timezone: 'Asia/Kolkata', time: '00:00:15', weekdays: [1] },
-  overlap: 'skip',
-  run: async ({ signal }) => generateInvoices({ signal })
+```text
+const scheduler = createScheduler({
+  jobs: [
+    defineJob({ key: 'reap-sessions', label: 'Reap sessions', every: '5m', run: reap }),
+    defineJob({ key: 'probe-providers', label: 'Probe providers', every: '30s', run: probe })
+  ],
+  lock: storeLock(lockStore)
 });
+
+scheduler.start();
 ```
 
-## Three things worth knowing before you use it
+## A lease, not a mutex
 
-**Money is never a number.** An amount is minor units as a `bigint` with its
-asset attached, so two currencies cannot be added by accident and a rounding
-mode is always stated. `finance/storage` writes the same amount twice — the
-authoritative string, and a lossy double used for `ORDER BY` only. One ETH is
-10^18 minor units and a signed 64-bit column overflows around nine ETH, which is
-why the exact value is never the sortable one.
+A process that dies holding a mutex blocks its job for ever, and somebody clears it by hand at three in the morning. A lease expires on its own. The fence number rises each time the lock is granted, so a run that stalled past its lease and woke up finds its fence stale and stops before writing.
 
-```ts
-const fee = mulRate(parseAmount('1250.00', 'USD'), '0.015', 'down');
-formatAmount(fee);   // '18.75' — never 18.749999999
-toStored(fee);       // { units: '1875', value: '18.75', asset: 'USD', sort: 18.75 }
+```text
+const lease = await lock.acquire('scan', 60_000);   // undefined if held
+await lock.renew('scan', lease.fence, 60_000);      // false once superseded
 ```
 
-**A scheduler, never `setInterval`.** An interval fires whether or not the last
-run finished, so work slower than its period runs twice over the same data. The
-next run is scheduled after the current one completes. The lock is a lease with
-a fence, not a mutex — a process that dies does not block its job for ever.
+## The cursor advances only on a complete batch
 
-**The cursor advances only on a complete batch.** Fetch, process every item,
-then write the cursor — never per item, never before. Item three of ten throwing
-retries the whole batch from the same position, which means `process` must be
-idempotent, and idempotent retries beat records nobody ever looks at again.
+Fetch a batch, process every item, then write the cursor — never per item and never before. If item three of ten throws, the whole batch is retried from the same position. That means process must be idempotent, and idempotent retries are strictly better than the alternative, which is records nobody ever looks at again.
 
-## Optional peers
+```text
+cursorJob({
+  key: 'scan-deposits',
+  label: 'Scan deposits',
+  every: '15s',
+  store: cursors,
+  from: '0',
+  fetch: (cursor) => fetchBlocks(cursor),
+  process: (transfer) => credit(transfer)   // keyed, so a retry is free
+});
+```
 
-Nothing third-party is bundled — vendoring a crypto library means a fix for it
-never reaches you until this package republishes. Most subpaths need nothing:
+## Stop waits
 
-```bash
-bun add @noble/hashes                      # finance/custody
-bun add @noble/curves @noble/post-quantum  # identity
-bun add @sinclair/typebox                  # schema/typebox
+Returning from stop() before in-flight work settles is how a deploy leaves a record half-written and the next boot finds state nothing explains. Timers are cleared, the abort signal fires so long runs can cut themselves short, and then it awaits what is still running.
+
+```text
+await scheduler.stop();       // clears timers, aborts, awaits in-flight
+scheduler.pause();            // stop scheduling, let in-flight finish
+await scheduler.runNow('scan-deposits');
 ```
 
-## The Solidity ships with it
+## Status somebody can read during an incident
 
-`finance/custody` computes counterfactual CREATE2 deposit addresses; the
-contracts that make those addresses real are in the tarball, not in a repository
-you have to go find.
+Last run, duration, result, error and consecutive failures per job. Without it a job that has been failing for a week looks exactly like a job that has been succeeding.
 
+```text
+scheduler.status();
+// [{ key: 'scan-deposits', state: 'idle', runs: 412,
+//    lastDurationMs: 840, lastResult: { processed: 17, batches: 2 },
+//    consecutiveFailures: 0, skippedLocked: 0 }]
 ```
-node_modules/@forgezero/runtime/contracts/src/
-  DepositProxy.sol     deployed lazily at first sweep — no key, no gas per address
-  DepositFactory.sol   CREATE2, salt opaque to the contract
-  ColdVault.sol        M-of-N EIP-712, signatures ordered by ascending signer
+
+## Schema — validation you can also render
+
+TypeBox is a peer dependency and optional. A project on Zod pulls none of it, because the interface is what the other packages depend on.
+
+```text
+import { validate, describeForm } from '@forgezero/runtime/schema';
+
+// only if you validate with TypeBox
+bun add @sinclair/typebox
 ```
 
-Full documentation: **https://www.forgezero.net/docs/runtime**
+## 2. Validate
+
+Query strings are entirely strings, so values are converted before checking — otherwise ?port=587 fails a schema expecting a number on a perfectly well-formed request.
+
+```text
+import { typebox, T } from '@forgezero/runtime/schema/typebox';
+
+const Config = T.Object(
+  { host: T.String(), port: T.Integer() },
+  { additionalProperties: false }
+);
+
+typebox.validate(Config, { host: 'mail', port: '587' });
+// { ok: true, value: { host: 'mail', port: 587 } }
+```
+
+## 3. Render a form from it
+
+describeForm turns a schema into flat, framework-agnostic fields. This is what lets an admin screen render provider credentials and security factors with no per-feature UI code.
 
-## Licence
+```text
+typebox.describeForm(Config);
+// [{ path: 'host', label: 'Host', kind: 'string', required: true }, ...]
+```
+
+## The restrictions are a security boundary
+
+A schema authored in your own source is trusted. One submitted by a tenant is not, and these limits are the only thing between the two. $ref would let a schema point validation at a document you do not control; unbounded depth is a denial-of-service; and an object accepting unknown properties is one that lets an unvalidated field ride into an envelope.
+
+```text
+typebox.restrict(schema)
+
+  $ref · $id · $defs      refused
+  depth > 4               refused
+  more than 100 fields    refused
+  larger than 64 KiB      refused
+  additionalProperties    must be false
+```
+
+## writeOnly is the vault boundary
+
+A field marked writeOnly is never returned to a browser. readableFields strips them at any depth, and writeOnlyPaths lists exactly what must be routed to secret storage instead.
+
+```text
+const fields = typebox.describeForm(schema);
+
+readableFields(fields);   // safe to serialise
+writeOnlyPaths(fields);   // ['apiKey', 'nested.secret']
+```
+
+## Adding another validator
+
+Implement four functions. toJsonSchema is what keeps the ecosystem from fragmenting: stored config, the admin UI and the wire all speak JSON Schema, so a Zod project and a TypeBox project produce identical documents and either can read the other.
+
+```text
+interface SchemaValidator<S> {
+  name: string;
+  validate(schema: S, value: unknown): ValidationResult;
+  describeForm(schema: S): FormField[];
+  toJsonSchema(schema: S): Record<string, unknown>;
+  restrict(schema: S, limits?: Restrictions): S;
+}
+```
 
-MIT. Part of [ForgeZero](https://www.forgezero.net) — secrets, attested compute and
-deploys — and usable entirely on its own, with no ForgeZero account.
+Full rendered documentation: https://www.forgezero.net/docs/runtime