@forgezero/runtime 0.1.7 → 0.1.8

package/README.md

@@ -1,7 +1,7 @@
 <!--
   GENERATED FILE — do not edit.
 
-  Change scripts/generate-guides.ts or its typed sources, run `bun run guides`,
+  Change tools/generate-guides.ts or its typed sources, run `bun run guides`,
   and commit the generator and rendered files together.
 -->
 
@@ -9,14 +9,77 @@
 
 The machinery behind a request handler — jobs, queues, an outbox, a hash-chained audit trail, mail, backups, schema validation and exact money. 44 public modules, each imported on its own.
 
-## Global package root and supported runtimes
+## Package overview
 
-Anyone running a service, for the work that happens outside a request. Separate from `access` because a Cloudflare Worker wants the request pipeline and cannot run a backup job. Supported runtimes: bun, node. The global base/root import is @forgezero/runtime. Every public import or command is listed below; the documentation inventory is checked in both directions against package.json exports.
+Anyone running a service, for the work that happens outside a request. Separate from `access` because a Cloudflare Worker wants the request pipeline and cannot run a backup job. Supported runtimes: bun, node. Package root: @forgezero/runtime. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
 
 ```text
-import * as root from '@forgezero/runtime';
+bun add @forgezero/runtime
 ```
 
+## ForgeZero package family
+
+The five packages are installation boundaries. Choose a package by who installs it; choose a subpath by the capability used in that file.
+
+| package | short description | runtimes | documentation |
+|---|---|---|---|
+| @forgezero/vault | Scoped secret access with Agent, API-key and systemd-credential sources. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/vault-package) |
+| @forgezero/access | Typed route, principal, factor, RBAC and request-pipeline contracts. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/access) |
+| @forgezero/providers | Typed external providers with priority, health and classified fallback. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/providers) |
+| @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
+| @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
+
+## @forgezero/runtime public imports and commands
+
+Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
+
+| public entry | short description | runtime | details |
+|---|---|---|---|
+| @forgezero/runtime/query | Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB. | portable | [Details + example](#forgezero-runtime-query) |
+| @forgezero/runtime/jobs | Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected. | portable | [Details + example](#forgezero-runtime-jobs) |
+| @forgezero/runtime/queue | Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting. | portable | [Details + example](#forgezero-runtime-queue) |
+| @forgezero/runtime/outbox | Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue. | portable | [Details + example](#forgezero-runtime-outbox) |
+| @forgezero/runtime/audit | Append-only records chained by hash, with a verifier that names the first altered entry. | portable | [Details + example](#forgezero-runtime-audit) |
+| @forgezero/runtime/backup | Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back. | portable | [Details + example](#forgezero-runtime-backup) |
+| @forgezero/runtime/notify | Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. | portable | [Details + example](#forgezero-runtime-notify) |
+| @forgezero/runtime/notify/templates | The six transactional messages ForgeZero sends. | portable | [Details + example](#forgezero-runtime-notify-templates) |
+| @forgezero/runtime/calendar | Billing periods computed from an anchor, working days, holidays and due dates. | portable | [Details + example](#forgezero-runtime-calendar) |
+| @forgezero/runtime/compliance | Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. | portable | [Details + example](#forgezero-runtime-compliance) |
+| @forgezero/runtime/totp | RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. | portable | [Details + example](#forgezero-runtime-totp) |
+| @forgezero/runtime/passkey | Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. | portable | [Details + example](#forgezero-runtime-passkey) |
+| @forgezero/runtime/phrase | BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. | portable | [Details + example](#forgezero-runtime-phrase) |
+| @forgezero/runtime/snp | Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade. | portable | [Details + example](#forgezero-runtime-snp) |
+| @forgezero/runtime/importers | Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error. | portable | [Details + example](#forgezero-runtime-importers) |
+| @forgezero/runtime/openssh | OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys. | portable | [Details + example](#forgezero-runtime-openssh) |
+| @forgezero/runtime/ssh-cert | OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out. | portable | [Details + example](#forgezero-runtime-ssh-cert) |
+| @forgezero/runtime/slip10 | SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond. | portable | [Details + example](#forgezero-runtime-slip10) |
+| @forgezero/runtime/identity | Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would. | portable | [Details + example](#forgezero-runtime-identity) |
+| @forgezero/runtime/schema | Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form. | portable | [Details + example](#forgezero-runtime-schema) |
+| @forgezero/runtime/schema/typebox | The TypeBox validator behind that interface. | portable | [Details + example](#forgezero-runtime-schema-typebox) |
+| @forgezero/runtime/finance/discounts | Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. | portable | [Details + example](#forgezero-runtime-finance-discounts) |
+| @forgezero/runtime/finance/money | Exact amounts in minor units with the asset attached, so two currencies cannot be added. | portable | [Details + example](#forgezero-runtime-finance-money) |
+| @forgezero/runtime/finance/venues | Trading venues, market types and symbols as data — spot, margin and futures behind one order model. | portable | [Details + example](#forgezero-runtime-finance-venues) |
+| @forgezero/runtime/finance/ledger | Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. | portable | [Details + example](#forgezero-runtime-finance-ledger) |
+| @forgezero/runtime/finance/commission | Profit net of flows, a high-water mark, the tier split and the referral share of our income. | portable | [Details + example](#forgezero-runtime-finance-commission) |
+| @forgezero/runtime/finance/rates | What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. | portable | [Details + example](#forgezero-runtime-finance-rates) |
+| @forgezero/runtime/finance/transfers | Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. | portable | [Details + example](#forgezero-runtime-finance-transfers) |
+| @forgezero/runtime/finance/chain | Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. | portable | [Details + example](#forgezero-runtime-finance-chain) |
+| @forgezero/runtime/finance/custody | Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. | portable | [Details + example](#forgezero-runtime-finance-custody) |
+| @forgezero/runtime/finance/derive | Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. | portable | [Details + example](#forgezero-runtime-finance-derive) |
+| @forgezero/runtime/finance/tax | Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. | portable | [Details + example](#forgezero-runtime-finance-tax) |
+| @forgezero/runtime/finance/storage | Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. | portable | [Details + example](#forgezero-runtime-finance-storage) |
+| @forgezero/runtime/realtime | Provider-neutral realtime audience, shard, event and delivery contracts. | portable | [Details + example](#forgezero-runtime-realtime) |
+| @forgezero/runtime/passkey-hybrid | Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. | portable | [Details + example](#forgezero-runtime-passkey-hybrid) |
+| @forgezero/runtime/otpauth | Parse and render otpauth URIs without binding enrolment to a UI framework. | portable | [Details + example](#forgezero-runtime-otpauth) |
+| @forgezero/runtime/pipeline | Typed ordered application-pipeline execution with explicit evidence. | portable | [Details + example](#forgezero-runtime-pipeline) |
+| @forgezero/runtime/finance/chain-addresses | Chain-address derivation records and validation independent of a node provider. | portable | [Details + example](#forgezero-runtime-finance-chain-addresses) |
+| @forgezero/runtime/finance/chain-deposits | Provider-neutral deposit observation, confirmation and credit transitions. | portable | [Details + example](#forgezero-runtime-finance-chain-deposits) |
+| @forgezero/runtime/finance/chain-withdrawals | Provider-neutral withdrawal approval, broadcast and finality transitions. | portable | [Details + example](#forgezero-runtime-finance-chain-withdrawals) |
+| @forgezero/runtime/finance/chain-reconcile | Deterministic reconciliation between chain observations and durable transfer state. | portable | [Details + example](#forgezero-runtime-finance-chain-reconcile) |
+| @forgezero/runtime/finance/market | Market order, fill and quote contracts independent of any exchange adapter. | portable | [Details + example](#forgezero-runtime-finance-market) |
+| @forgezero/runtime/custody-share | Threshold-share parsing, validation and reconstruction. | portable | [Details + example](#forgezero-runtime-custody-share) |
+| @forgezero/runtime/custody-crypto | Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. | portable | [Details + example](#forgezero-runtime-custody-crypto) |
+
 ## Commands
 
 bun add @forgezero/runtime — Install runtime contracts; import the required subpath so unused capabilities stay out of the bundle.
@@ -25,382 +88,558 @@ bun add @forgezero/runtime — Install runtime contracts; import the required su
 bun add @forgezero/runtime
 ```
 
+<a id="forgezero-runtime-query"></a>
 ## @forgezero/runtime/query
 
-Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB.
+Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB. Named value imports: QueryContractError, defineQuery, implementQuery. Named type imports: QueryCodec, QueryContract, QueryDecode, QueryExecution, QueryImplementation, QueryInput, QueryIssue, QueryOutput. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/query';
+import { QueryContractError, defineQuery, implementQuery } from '@forgezero/runtime/query';
+import type { QueryCodec, QueryContract, QueryDecode, QueryExecution, QueryImplementation, QueryInput } from '@forgezero/runtime/query';
+import type { QueryIssue, QueryOutput } from '@forgezero/runtime/query';
 ```
 
+## @forgezero/runtime/query — Define and implement a typed query
+
+Decode untrusted input and validate output around injected storage/services rather than embedding a database query in the route adapter.
+
+```text
+import { defineQuery, implementQuery } from '@forgezero/runtime/query';
+import { T, type Static, typeboxQueryCodec } from '@forgezero/runtime/schema/typebox';
+
+const OrderKey = T.Object({ orderKey: T.String({ minLength: 1 }) });
+const Order = T.Object({ orderKey: T.String(), total: T.String() });
+type OrderRow = Static<typeof Order>;
+type Stores = { orders: { find(key: string): Promise<OrderRow | null> } };
+declare const stores: Stores;
+
+const findOrder = defineQuery({
+  name: 'orders.find',
+  input: typeboxQueryCodec(OrderKey),
+  output: typeboxQueryCodec(T.Union([Order, T.Null()]))
+});
+export const runFindOrder = implementQuery(findOrder,
+  (context: Stores, input) => context.orders.find(input.orderKey)
+);
+
+const order = await runFindOrder.execute(stores, { orderKey: 'ord_123' });
+```
+
+<a id="forgezero-runtime-jobs"></a>
 ## @forgezero/runtime/jobs
 
-Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected.
+Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected. Named value imports: VERSION, createScheduler, cursorJob, defineJob, everyMs, memoryLock, nextWallClockAt, storeLock, systemClock. Named type imports: Clock, CursorBatch, CursorJobSpec, CursorStore, JobContext, JobLock, JobReport, JobResult, JobSpec, Lease, LockStore, Scheduler, SchedulerOptions, WallClockSchedule. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/jobs';
+import { VERSION, createScheduler, cursorJob, defineJob, everyMs, memoryLock } from '@forgezero/runtime/jobs';
+import { nextWallClockAt, storeLock, systemClock } from '@forgezero/runtime/jobs';
+import type { Clock, CursorBatch, CursorJobSpec, CursorStore, JobContext, JobLock } from '@forgezero/runtime/jobs';
+import type { JobReport, JobResult, JobSpec, Lease, LockStore, Scheduler } from '@forgezero/runtime/jobs';
+import type { SchedulerOptions, WallClockSchedule } from '@forgezero/runtime/jobs';
 ```
 
+<a id="forgezero-runtime-queue"></a>
 ## @forgezero/runtime/queue
 
-Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting.
+Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting. Named value imports: QueueKeyStoppedError, QueueStoppedError, TaskCancelledError, createQueue, queueWidthFor. Named type imports: DrainReport, Queue, QueueOptions, QueueResourcePolicy, QueueTask, RetryPolicy. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/queue';
+import { QueueKeyStoppedError, QueueStoppedError, TaskCancelledError, createQueue, queueWidthFor } from '@forgezero/runtime/queue';
+import type { DrainReport, Queue, QueueOptions, QueueResourcePolicy, QueueTask, RetryPolicy } from '@forgezero/runtime/queue';
 ```
 
+<a id="forgezero-runtime-outbox"></a>
 ## @forgezero/runtime/outbox
 
-Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue.
+Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue. Named value imports: DEFAULT_POLICY, EVENT_STATES, OutboxError, VERSION, backoffMs, createOutbox, memoryStore, outboxJob. Named type imports: DeliveryPolicy, DeliveryResult, DrainReport, EventState, Outbox, OutboxEvent, OutboxOptions, OutboxStore, PublishInput, Transport. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/outbox';
+import { DEFAULT_POLICY, EVENT_STATES, OutboxError, VERSION, backoffMs, createOutbox } from '@forgezero/runtime/outbox';
+import { memoryStore, outboxJob } from '@forgezero/runtime/outbox';
+import type { DeliveryPolicy, DeliveryResult, DrainReport, EventState, Outbox, OutboxEvent } from '@forgezero/runtime/outbox';
+import type { OutboxOptions, OutboxStore, PublishInput, Transport } from '@forgezero/runtime/outbox';
 ```
 
+<a id="forgezero-runtime-audit"></a>
 ## @forgezero/runtime/audit
 
-Append-only records chained by hash, with a verifier that names the first altered entry.
+Append-only records chained by hash, with a verifier that names the first altered entry. Named value imports: AuditChainError, GENESIS_DIGEST, VERSION, appendRecord, canonicalise, createAuditChain, exportRange, hashDigester, memoryStore, sealedDigester, verifyChain, verifyExport. Named type imports: AppendOptions, AuditChain, AuditChainOptions, AuditEntry, AuditExport, AuditRecord, AuditStore, ChainVerdict, Digester, EffectAuditRecord. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/audit';
+import { AuditChainError, GENESIS_DIGEST, VERSION, appendRecord, canonicalise, createAuditChain } from '@forgezero/runtime/audit';
+import { exportRange, hashDigester, memoryStore, sealedDigester, verifyChain, verifyExport } from '@forgezero/runtime/audit';
+import type { AppendOptions, AuditChain, AuditChainOptions, AuditEntry, AuditExport, AuditRecord } from '@forgezero/runtime/audit';
+import type { AuditStore, ChainVerdict, Digester, EffectAuditRecord } from '@forgezero/runtime/audit';
 ```
 
+<a id="forgezero-runtime-backup"></a>
 ## @forgezero/runtime/backup
 
-Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back.
+Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back. Named value imports: BackupError, DEFAULT_RETENTION, SNAPSHOT_FORMAT, VERSION, backupJob, listSnapshots, prune, restore, selectForDeletion, snapshot, verifySnapshot. Named type imports: ChunkRecord, ObjectStore, RestoreOptions, RestoreReport, RetentionPolicy, RowSink, RowSource, SnapshotManifest, SnapshotOptions, VerifyReport. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/backup';
+import { BackupError, DEFAULT_RETENTION, SNAPSHOT_FORMAT, VERSION, backupJob, listSnapshots } from '@forgezero/runtime/backup';
+import { prune, restore, selectForDeletion, snapshot, verifySnapshot } from '@forgezero/runtime/backup';
+import type { ChunkRecord, ObjectStore, RestoreOptions, RestoreReport, RetentionPolicy, RowSink } from '@forgezero/runtime/backup';
+import type { RowSource, SnapshotManifest, SnapshotOptions, VerifyReport } from '@forgezero/runtime/backup';
 ```
 
+<a id="forgezero-runtime-notify"></a>
 ## @forgezero/runtime/notify
 
-Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be.
+Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. Named value imports: CHANNELS, NotifyError, VERSION, assertHeaderSafe, button, codeBlock, createNotifier, defineTemplate, escapeHtml, layout, preview, render. Named type imports: Channel, Notification, Notifier, NotifierOptions, Rendered, TemplateSpec, Transport. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/notify';
+import { CHANNELS, NotifyError, VERSION, assertHeaderSafe, button, codeBlock } from '@forgezero/runtime/notify';
+import { createNotifier, defineTemplate, escapeHtml, layout, preview, render } from '@forgezero/runtime/notify';
+import type { Channel, Notification, Notifier, NotifierOptions, Rendered, TemplateSpec } from '@forgezero/runtime/notify';
+import type { Transport } from '@forgezero/runtime/notify';
 ```
 
+<a id="forgezero-runtime-notify-templates"></a>
 ## @forgezero/runtime/notify/templates
 
-The six transactional messages ForgeZero sends.
+The six transactional messages ForgeZero sends. Named value imports: TEMPLATES, ceremonyProposed, custodianEnrolment, escapeHtml, invitation, newDevice, signInCode, vaultLocked. Named type imports: TemplateKey. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/notify/templates';
+import { TEMPLATES, ceremonyProposed, custodianEnrolment, escapeHtml, invitation, newDevice } from '@forgezero/runtime/notify/templates';
+import { signInCode, vaultLocked } from '@forgezero/runtime/notify/templates';
+import type { TemplateKey } from '@forgezero/runtime/notify/templates';
 ```
 
+<a id="forgezero-runtime-calendar"></a>
 ## @forgezero/runtime/calendar
 
-Billing periods computed from an anchor, working days, holidays and due dates.
+Billing periods computed from an anchor, working days, holidays and due dates. Named value imports: CalendarError, DAY_MS, DEFAULT_WORKING_DAYS, closedPeriods, dayOfWeek, daysOverdue, fromDay, isOverdue, isWorkingDay, nextWorkingDay, periodAt, periodIndexOn, periodOn, toDay, workingDaysBetween. Named type imports: BillingSchedule, Calendar, IsoDate, Period. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/calendar';
+import { CalendarError, DAY_MS, DEFAULT_WORKING_DAYS, closedPeriods, dayOfWeek, daysOverdue } from '@forgezero/runtime/calendar';
+import { fromDay, isOverdue, isWorkingDay, nextWorkingDay, periodAt, periodIndexOn } from '@forgezero/runtime/calendar';
+import { periodOn, toDay, workingDaysBetween } from '@forgezero/runtime/calendar';
+import type { BillingSchedule, Calendar, IsoDate, Period } from '@forgezero/runtime/calendar';
 ```
 
+<a id="forgezero-runtime-compliance"></a>
 ## @forgezero/runtime/compliance
 
-Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable.
+Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. Named value imports: ComplianceError, RISK_LEVELS, VERIFICATION_TIERS, combineLists, countryRule, newCounterpartyRule, screen, screeningStage, staticList, tierLimitRule, unavailableList. Named type imports: ListEntry, RiskLevel, Rule, RuleHit, ScreenOptions, ScreeningList, StageOptions, Subject, Verdict, VerificationTier. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/compliance';
+import { ComplianceError, RISK_LEVELS, VERIFICATION_TIERS, combineLists, countryRule, newCounterpartyRule } from '@forgezero/runtime/compliance';
+import { screen, screeningStage, staticList, tierLimitRule, unavailableList } from '@forgezero/runtime/compliance';
+import type { ListEntry, RiskLevel, Rule, RuleHit, ScreenOptions, ScreeningList } from '@forgezero/runtime/compliance';
+import type { StageOptions, Subject, Verdict, VerificationTier } from '@forgezero/runtime/compliance';
 ```
 
+<a id="forgezero-runtime-totp"></a>
 ## @forgezero/runtime/totp
 
-RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller.
+RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. Named value imports: DEFAULT_DIGITS, DEFAULT_STEP_SECONDS, TotpError, assertCode, codeAt, codeFor, counterAt, enrolmentUri, fromBase32, generateSecret, secondsRemaining, toBase32, verifyCode. Named type imports: TotpOptions, VerifyOptions, VerifyResult. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/totp';
+import { DEFAULT_DIGITS, DEFAULT_STEP_SECONDS, TotpError, assertCode, codeAt, codeFor } from '@forgezero/runtime/totp';
+import { counterAt, enrolmentUri, fromBase32, generateSecret, secondsRemaining, toBase32 } from '@forgezero/runtime/totp';
+import { verifyCode } from '@forgezero/runtime/totp';
+import type { TotpOptions, VerifyOptions, VerifyResult } from '@forgezero/runtime/totp';
 ```
 
+<a id="forgezero-runtime-passkey"></a>
 ## @forgezero/runtime/passkey
 
-Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site.
+Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. Named value imports: FLAG_BE, FLAG_BS, FLAG_UP, FLAG_UV, PasskeyError, assertPasskey, authenticatorData, credentialIdFor, passkeysFor, rpIdMatches, verifyAssertion. Named type imports: Assertion, AssertionRequest, StoredPasskey. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/passkey';
+import { FLAG_BE, FLAG_BS, FLAG_UP, FLAG_UV, PasskeyError, assertPasskey } from '@forgezero/runtime/passkey';
+import { authenticatorData, credentialIdFor, passkeysFor, rpIdMatches, verifyAssertion } from '@forgezero/runtime/passkey';
+import type { Assertion, AssertionRequest, StoredPasskey } from '@forgezero/runtime/passkey';
 ```
 
+<a id="forgezero-runtime-phrase"></a>
 ## @forgezero/runtime/phrase
 
-BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it.
+BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. Named value imports: PHRASE_SALT_BYTES, PHRASE_WORDS, generatePhrase, newSalt, phraseToKey, phraseVerifier, validatePhrase. Named type imports: none. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/phrase';
+import { PHRASE_SALT_BYTES, PHRASE_WORDS, generatePhrase, newSalt, phraseToKey, phraseVerifier } from '@forgezero/runtime/phrase';
+import { validatePhrase } from '@forgezero/runtime/phrase';
 ```
 
+<a id="forgezero-runtime-snp"></a>
 ## @forgezero/runtime/snp
 
-Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade.
+Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade. Named value imports: REPORT_BYTES, SnpError, bindsNonce, parseSnpReport, tcbAtLeast. Named type imports: GuestPolicy, SnpReport, TcbVersion. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/snp';
+import { REPORT_BYTES, SnpError, bindsNonce, parseSnpReport, tcbAtLeast } from '@forgezero/runtime/snp';
+import type { GuestPolicy, SnpReport, TcbVersion } from '@forgezero/runtime/snp';
 ```
 
+<a id="forgezero-runtime-importers"></a>
 ## @forgezero/runtime/importers
 
-Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error.
+Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error. Named value imports: IMPORT_FORMATS, normaliseName, parseBitwarden, parseCsv, parseEnv, parseImport, parseOnePassword. Named type imports: ImportFormat, ImportResult, ImportedSecret, Skipped. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/importers';
+import { IMPORT_FORMATS, normaliseName, parseBitwarden, parseCsv, parseEnv, parseImport } from '@forgezero/runtime/importers';
+import { parseOnePassword } from '@forgezero/runtime/importers';
+import type { ImportFormat, ImportResult, ImportedSecret, Skipped } from '@forgezero/runtime/importers';
 ```
 
+<a id="forgezero-runtime-openssh"></a>
 ## @forgezero/runtime/openssh
 
-OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys.
+OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys. Named value imports: OpenSshError, authorizedKey, fingerprint, parseAuthorizedKey, publicKeyBlob, signatureBlob. Named type imports: none. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/openssh';
+import { OpenSshError, authorizedKey, fingerprint, parseAuthorizedKey, publicKeyBlob, signatureBlob } from '@forgezero/runtime/openssh';
 ```
 
+<a id="forgezero-runtime-ssh-cert"></a>
 ## @forgezero/runtime/ssh-cert
 
-OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out.
+OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out. Named value imports: CERT_TYPE_HOST, CERT_TYPE_USER, DEFAULT_EXTENSIONS, SshCertError, caFingerprint, caFromSecretKey, caPublicKeyLine, isCurrentlyValid, signCertificate. Named type imports: CertificateAuthority, CertificateRequest. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/ssh-cert';
+import { CERT_TYPE_HOST, CERT_TYPE_USER, DEFAULT_EXTENSIONS, SshCertError, caFingerprint, caFromSecretKey } from '@forgezero/runtime/ssh-cert';
+import { caPublicKeyLine, isCurrentlyValid, signCertificate } from '@forgezero/runtime/ssh-cert';
+import type { CertificateAuthority, CertificateRequest } from '@forgezero/runtime/ssh-cert';
 ```
 
+<a id="forgezero-runtime-slip10"></a>
 ## @forgezero/runtime/slip10
 
-SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond.
+SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond. Named value imports: HARDENED_OFFSET, Slip10Error, deriveChild, derivePath, masterFromSeed. Named type imports: Slip10Node. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/slip10';
+import { HARDENED_OFFSET, Slip10Error, deriveChild, derivePath, masterFromSeed } from '@forgezero/runtime/slip10';
+import type { Slip10Node } from '@forgezero/runtime/slip10';
 ```
 
+<a id="forgezero-runtime-identity"></a>
 ## @forgezero/runtime/identity
 
-Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would.
+Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would. Named value imports: CLOCK_SKEW_SECONDS, REQUEST_SIGNATURE_SUITE, RESPONSE_KEY_HEADER, RESPONSE_SEALING_SUITE, canonicalString, decodeSignatureHeader, deriveKeysFromSeed, derivePublicKeysFromSeed, encodeSignatureHeader, generateNodeKeys, generateResponseRecipient, openResponse, sealResponse, signRequest, validResponsePublicKey, verifyRequest. Named type imports: NodeKeyPair, NodePublicKeys, ResponseRecipient, SealedResponse, SignedEnvelope, VerifyFailure. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/identity';
+import { CLOCK_SKEW_SECONDS, REQUEST_SIGNATURE_SUITE, RESPONSE_KEY_HEADER, RESPONSE_SEALING_SUITE, canonicalString, decodeSignatureHeader } from '@forgezero/runtime/identity';
+import { deriveKeysFromSeed, derivePublicKeysFromSeed, encodeSignatureHeader, generateNodeKeys, generateResponseRecipient, openResponse } from '@forgezero/runtime/identity';
+import { sealResponse, signRequest, validResponsePublicKey, verifyRequest } from '@forgezero/runtime/identity';
+import type { NodeKeyPair, NodePublicKeys, ResponseRecipient, SealedResponse, SignedEnvelope, VerifyFailure } from '@forgezero/runtime/identity';
 ```
 
+<a id="forgezero-runtime-schema"></a>
 ## @forgezero/runtime/schema
 
-Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form.
+Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form. Named value imports: DEFAULT_RESTRICTIONS, SCHEMA_VERSION, SchemaError, VERSION, describeJsonSchema, readableFields, restrictJsonSchema, writeOnlyPaths. Named type imports: FieldKind, FormField, Restrictions, SchemaValidator, ValidationResult. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/schema';
+import { DEFAULT_RESTRICTIONS, SCHEMA_VERSION, SchemaError, VERSION, describeJsonSchema, readableFields } from '@forgezero/runtime/schema';
+import { restrictJsonSchema, writeOnlyPaths } from '@forgezero/runtime/schema';
+import type { FieldKind, FormField, Restrictions, SchemaValidator, ValidationResult } from '@forgezero/runtime/schema';
 ```
 
+## @forgezero/runtime/schema — Restrict an untrusted JSON Schema before storing it
+
+Tenant-supplied schemas are data, not executable code. Restriction rejects references, remote identifiers, unsupported keywords, excessive depth/size, and arrays without a bounded maxItems. Form metadata is derived from the accepted schema; write-only fields remain identifiable for secret handling.
+
+```text
+import { restrictJsonSchema, describeJsonSchema, writeOnlyPaths } from '@forgezero/runtime/schema';
+
+const schema = restrictJsonSchema({
+  type: 'object', additionalProperties: false,
+  properties: {
+    recipients: { type: 'array', maxItems: 100, items: { type: 'string' } },
+    apiKey: { type: 'string', title: 'API key', writeOnly: true }
+  },
+  required: ['apiKey']
+});
+const fields = describeJsonSchema(schema);
+const secretFields = writeOnlyPaths(fields);
+```
+
+<a id="forgezero-runtime-schema-typebox"></a>
 ## @forgezero/runtime/schema/typebox
 
-The TypeBox validator behind that interface.
+The TypeBox validator behind that interface. Named value imports: T, parse, typebox, typeboxQueryCodec. Named type imports: Static, TSchema. Import only the names used by this file.
+
+```text
+import { T, parse, typebox, typeboxQueryCodec } from '@forgezero/runtime/schema/typebox';
+import type { Static, TSchema } from '@forgezero/runtime/schema/typebox';
+```
+
+## @forgezero/runtime/schema/typebox — One TypeBox shape for runtime validation and static types
+
+TypeBox is an optional peer. Its schema is JSON Schema, so the same restriction and form layer applies. The query codec validates both untrusted input and returned output; malformed values fail instead of being coerced.
 
 ```text
-import * as api from '@forgezero/runtime/schema/typebox';
+import { T, type Static, parse, typeboxQueryCodec } from '@forgezero/runtime/schema/typebox';
+
+const User = T.Object({
+  userKey: T.String({ minLength: 1 }),
+  roles: T.Array(T.String(), { maxItems: 32 })
+}, { additionalProperties: false });
+type User = Static<typeof User>;
+const user: User = parse(User, unknownInput);
+const codec = typeboxQueryCodec(User);
 ```
 
+<a id="forgezero-runtime-finance-discounts"></a>
 ## @forgezero/runtime/finance/discounts
 
-Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever.
+Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. Named value imports: DiscountError, assertCode, assertWindow, bestDiscount, discountFor, ineligibility, normaliseCode. Named type imports: AppliedDiscount, DiscountKind, Ineligibility, Promotion. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/discounts';
+import { DiscountError, assertCode, assertWindow, bestDiscount, discountFor, ineligibility } from '@forgezero/runtime/finance/discounts';
+import { normaliseCode } from '@forgezero/runtime/finance/discounts';
+import type { AppliedDiscount, DiscountKind, Ineligibility, Promotion } from '@forgezero/runtime/finance/discounts';
 ```
 
+<a id="forgezero-runtime-finance-money"></a>
 ## @forgezero/runtime/finance/money
 
-Exact amounts in minor units with the asset attached, so two currencies cannot be added.
+Exact amounts in minor units with the asset attached, so two currencies cannot be added. Named value imports: ASSETS, MoneyError, ROUNDING, VERSION, abs, add, allocate, assetSpec, compare, convert, defineAsset, equals, formatAmount, isNegative, isZero, money, mulRate, negate, parseAmount, subtract, toStep, zero. Named type imports: AssetSpec, Money, Rounding. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/money';
+import { ASSETS, MoneyError, ROUNDING, VERSION, abs, add } from '@forgezero/runtime/finance/money';
+import { allocate, assetSpec, compare, convert, defineAsset, equals } from '@forgezero/runtime/finance/money';
+import { formatAmount, isNegative, isZero, money, mulRate, negate } from '@forgezero/runtime/finance/money';
+import { parseAmount, subtract, toStep, zero } from '@forgezero/runtime/finance/money';
+import type { AssetSpec, Money, Rounding } from '@forgezero/runtime/finance/money';
 ```
 
+<a id="forgezero-runtime-finance-venues"></a>
 ## @forgezero/runtime/finance/venues
 
-Trading venues, market types and symbols as data — spot, margin and futures behind one order model.
+Trading venues, market types and symbols as data — spot, margin and futures behind one order model. Named value imports: MARKET_TYPES, ORDER_SIDES, ORDER_TYPES, TIME_IN_FORCE, VENUES, VERSION, VenueError, notionalOf, parseSymbol, submitOrder, symbolOf, validateOrder, venue, venuesFor. Named type imports: MarketSpec, MarketType, OrderRequest, OrderResult, OrderSide, OrderStatus, OrderType, TimeInForce, VenueAdapter, VenueSpec. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/venues';
+import { MARKET_TYPES, ORDER_SIDES, ORDER_TYPES, TIME_IN_FORCE, VENUES, VERSION } from '@forgezero/runtime/finance/venues';
+import { VenueError, notionalOf, parseSymbol, submitOrder, symbolOf, validateOrder } from '@forgezero/runtime/finance/venues';
+import { venue, venuesFor } from '@forgezero/runtime/finance/venues';
+import type { MarketSpec, MarketType, OrderRequest, OrderResult, OrderSide, OrderStatus } from '@forgezero/runtime/finance/venues';
+import type { OrderType, TimeInForce, VenueAdapter, VenueSpec } from '@forgezero/runtime/finance/venues';
 ```
 
+<a id="forgezero-runtime-finance-ledger"></a>
 ## @forgezero/runtime/finance/ledger
 
-Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering.
+Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. Named value imports: ACCOUNT_KINDS, BUCKETS, LedgerError, MAX_LEDGER_ENTRIES, VERSION, accountId, assertAvailable, assertBalanced, availableOf, balanceOf, balancesFrom, captureHold, heldOf, parseAccount, placeHold, queueKeyFor, releaseHold, statement, totalOf, transfer, trialBalance. Named type imports: AccountKind, AccountRef, Bucket, Entry, Transaction, TrialBalance. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/ledger';
+import { ACCOUNT_KINDS, BUCKETS, LedgerError, MAX_LEDGER_ENTRIES, VERSION, accountId } from '@forgezero/runtime/finance/ledger';
+import { assertAvailable, assertBalanced, availableOf, balanceOf, balancesFrom, captureHold } from '@forgezero/runtime/finance/ledger';
+import { heldOf, parseAccount, placeHold, queueKeyFor, releaseHold, statement } from '@forgezero/runtime/finance/ledger';
+import { totalOf, transfer, trialBalance } from '@forgezero/runtime/finance/ledger';
+import type { AccountKind, AccountRef, Bucket, Entry, Transaction, TrialBalance } from '@forgezero/runtime/finance/ledger';
 ```
 
+<a id="forgezero-runtime-finance-commission"></a>
 ## @forgezero/runtime/finance/commission
 
-Profit net of flows, a high-water mark, the tier split and the referral share of our income.
+Profit net of flows, a high-water mark, the tier split and the referral share of our income. Named value imports: CommissionError, allocate, chargeableProfit, commissionTransaction, nextHighWaterMark, periodProfit, projectPrepay, splitCommission, splitReferrals. Named type imports: CommissionInput, CommissionSplit, PeriodPerformance, Prepay, PrepayInput, ReferralShare. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/commission';
+import { CommissionError, allocate, chargeableProfit, commissionTransaction, nextHighWaterMark, periodProfit } from '@forgezero/runtime/finance/commission';
+import { projectPrepay, splitCommission, splitReferrals } from '@forgezero/runtime/finance/commission';
+import type { CommissionInput, CommissionSplit, PeriodPerformance, Prepay, PrepayInput, ReferralShare } from '@forgezero/runtime/finance/commission';
 ```
 
+<a id="forgezero-runtime-finance-rates"></a>
 ## @forgezero/runtime/finance/rates
 
-What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does.
+What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. Named value imports: BASE_ASSET, RATE_SOURCES, RateError, assertRate, createRateTable, describeRate, isRegistered, peg, rateRefreshJob, refreshRates, registerAsset. Named type imports: AssetEntry, AssetRate, RateFetcher, RateSource, RateTable, RateTableOptions, RefreshReport. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/rates';
+import { BASE_ASSET, RATE_SOURCES, RateError, assertRate, createRateTable, describeRate } from '@forgezero/runtime/finance/rates';
+import { isRegistered, peg, rateRefreshJob, refreshRates, registerAsset } from '@forgezero/runtime/finance/rates';
+import type { AssetEntry, AssetRate, RateFetcher, RateSource, RateTable, RateTableOptions } from '@forgezero/runtime/finance/rates';
+import type { RefreshReport } from '@forgezero/runtime/finance/rates';
 ```
 
+<a id="forgezero-runtime-finance-transfers"></a>
 ## @forgezero/runtime/finance/transfers
 
-Deposits and withdrawals as ordered pipelines, with screening reserved at position zero.
+Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. Named value imports: DIRECTIONS, PipelineError, SCREENING_ORDER, approvalStage, balanceStage, createTransferPipeline, limitsStage, notFrozenStage, screeningStage. Named type imports: Direction, PipelineResult, Stage, StageOutcome, Transfer, TransferPipeline. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/transfers';
+import { DIRECTIONS, PipelineError, SCREENING_ORDER, approvalStage, balanceStage, createTransferPipeline } from '@forgezero/runtime/finance/transfers';
+import { limitsStage, notFrozenStage, screeningStage } from '@forgezero/runtime/finance/transfers';
+import type { Direction, PipelineResult, Stage, StageOutcome, Transfer, TransferPipeline } from '@forgezero/runtime/finance/transfers';
 ```
 
+<a id="forgezero-runtime-finance-chain"></a>
 ## @forgezero/runtime/finance/chain
 
-Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits.
+Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. Named value imports: ADDRESS_SCHEMES, ChainError, SEED_CHAINS, SEED_CHAIN_ASSETS, assertChain, confirmationsFor, createChainRegistry, estimatedSeconds, validateAddress. Named type imports: AddressScheme, ChainAsset, ChainRegistry, ChainSpec, ConfirmationBand. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain';
+import { ADDRESS_SCHEMES, ChainError, SEED_CHAINS, SEED_CHAIN_ASSETS, assertChain, confirmationsFor } from '@forgezero/runtime/finance/chain';
+import { createChainRegistry, estimatedSeconds, validateAddress } from '@forgezero/runtime/finance/chain';
+import type { AddressScheme, ChainAsset, ChainRegistry, ChainSpec, ConfirmationBand } from '@forgezero/runtime/finance/chain';
 ```
 
+<a id="forgezero-runtime-finance-custody"></a>
 ## @forgezero/runtime/finance/custody
 
-Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node.
+Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. Named value imports: CustodyError, VERSION, depositAddress, domainSeparator, orderSignatures, saltFor, toChecksumAddress, withdrawDigest. Named type imports: none. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/custody';
+import { CustodyError, VERSION, depositAddress, domainSeparator, orderSignatures, saltFor } from '@forgezero/runtime/finance/custody';
+import { toChecksumAddress, withdrawDigest } from '@forgezero/runtime/finance/custody';
 ```
 
+<a id="forgezero-runtime-finance-derive"></a>
 ## @forgezero/runtime/finance/derive
 
-Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key.
+Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. Named value imports: CUSTODY, DERIVE_KEYWORD, DeriveError, SCHEMES, assertDeriveSpec, custodyOf, deriveSpecOf, derivedFields, derivedPaths, pathFor, suppliedPaths. Named type imports: Custody, DeriveSpec, DerivedField, Scheme. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/derive';
+import { CUSTODY, DERIVE_KEYWORD, DeriveError, SCHEMES, assertDeriveSpec, custodyOf } from '@forgezero/runtime/finance/derive';
+import { deriveSpecOf, derivedFields, derivedPaths, pathFor, suppliedPaths } from '@forgezero/runtime/finance/derive';
+import type { Custody, DeriveSpec, DerivedField, Scheme } from '@forgezero/runtime/finance/derive';
 ```
 
+<a id="forgezero-runtime-finance-tax"></a>
 ## @forgezero/runtime/finance/tax
 
-Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data.
+Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. Named value imports: TREATMENTS, TaxError, applyTax, assertTaxRate, decideTax, describeTax, parseRate, percent, totalWithTax. Named type imports: Customer, Supplier, TaxAmounts, TaxDecision, TaxRate, Treatment. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/tax';
+import { TREATMENTS, TaxError, applyTax, assertTaxRate, decideTax, describeTax } from '@forgezero/runtime/finance/tax';
+import { parseRate, percent, totalWithTax } from '@forgezero/runtime/finance/tax';
+import type { Customer, Supplier, TaxAmounts, TaxDecision, TaxRate, Treatment } from '@forgezero/runtime/finance/tax';
 ```
 
+<a id="forgezero-runtime-finance-storage"></a>
 ## @forgezero/runtime/finance/storage
 
-Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index.
+Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. Named value imports: SORT_FIELD, fromStored, rangeBounds, sortExact, sortKey, storeAmount, toStored, withinRange. Named type imports: StoredMoney. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/storage';
+import { SORT_FIELD, fromStored, rangeBounds, sortExact, sortKey, storeAmount } from '@forgezero/runtime/finance/storage';
+import { toStored, withinRange } from '@forgezero/runtime/finance/storage';
+import type { StoredMoney } from '@forgezero/runtime/finance/storage';
 ```
 
+<a id="forgezero-runtime-realtime"></a>
 ## @forgezero/runtime/realtime
 
-Provider-neutral realtime audience, shard, event and delivery contracts.
+Provider-neutral realtime audience, shard, event and delivery contracts. Named value imports: REALTIME_MAX_BATCH_BYTES, REALTIME_MAX_EVENTS, REALTIME_MAX_EVENT_BYTES, REALTIME_MAX_SHARDS_PER_TOPIC, REALTIME_MAX_SOCKETS_PER_SHARD, canReceiveRealtimeAudience, issueRealtimeSubscriptionTicket, realtimeBatchBytes, realtimeHmac, realtimeShardKey, validateRealtimeAudience, validateRealtimeBatch, validateRealtimeSubscriptionTicket, verifyRealtimeHmac, verifyRealtimeSubscriptionToken. Named type imports: RealtimeAudience, RealtimeBatch, RealtimeEvent, RealtimePrincipalKind, RealtimeSubscriptionTicket. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/realtime';
+import { REALTIME_MAX_BATCH_BYTES, REALTIME_MAX_EVENTS, REALTIME_MAX_EVENT_BYTES, REALTIME_MAX_SHARDS_PER_TOPIC, REALTIME_MAX_SOCKETS_PER_SHARD, canReceiveRealtimeAudience } from '@forgezero/runtime/realtime';
+import { issueRealtimeSubscriptionTicket, realtimeBatchBytes, realtimeHmac, realtimeShardKey, validateRealtimeAudience, validateRealtimeBatch } from '@forgezero/runtime/realtime';
+import { validateRealtimeSubscriptionTicket, verifyRealtimeHmac, verifyRealtimeSubscriptionToken } from '@forgezero/runtime/realtime';
+import type { RealtimeAudience, RealtimeBatch, RealtimeEvent, RealtimePrincipalKind, RealtimeSubscriptionTicket } from '@forgezero/runtime/realtime';
 ```
 
+<a id="forgezero-runtime-passkey-hybrid"></a>
 ## @forgezero/runtime/passkey-hybrid
 
-Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification.
+Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. Named value imports: PASSKEY_HYBRID_SUITE, PASSKEY_HYBRID_VERSION, PASSKEY_ML_DSA_PUBLIC_KEY_BYTES, PASSKEY_ML_DSA_SIGNATURE_BYTES, PASSKEY_PRF_SALT, createPasskeyHybridProof, passkeyHybridMessage, verifyPasskeyHybridProof. Named type imports: PasskeyHybridBinding, PasskeyHybridProof, PasskeyHybridPurpose, PasskeyHybridRegistrationProof. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/passkey-hybrid';
+import { PASSKEY_HYBRID_SUITE, PASSKEY_HYBRID_VERSION, PASSKEY_ML_DSA_PUBLIC_KEY_BYTES, PASSKEY_ML_DSA_SIGNATURE_BYTES, PASSKEY_PRF_SALT, createPasskeyHybridProof } from '@forgezero/runtime/passkey-hybrid';
+import { passkeyHybridMessage, verifyPasskeyHybridProof } from '@forgezero/runtime/passkey-hybrid';
+import type { PasskeyHybridBinding, PasskeyHybridProof, PasskeyHybridPurpose, PasskeyHybridRegistrationProof } from '@forgezero/runtime/passkey-hybrid';
 ```
 
+<a id="forgezero-runtime-otpauth"></a>
 ## @forgezero/runtime/otpauth
 
-Parse and render otpauth URIs without binding enrolment to a UI framework.
+Parse and render otpauth URIs without binding enrolment to a UI framework. Named value imports: formatOtpAuth, fromManualSecret, newOtpAuth, parseOtpAuth. Named type imports: OtpAuth. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/otpauth';
+import { formatOtpAuth, fromManualSecret, newOtpAuth, parseOtpAuth } from '@forgezero/runtime/otpauth';
+import type { OtpAuth } from '@forgezero/runtime/otpauth';
 ```
 
+<a id="forgezero-runtime-pipeline"></a>
 ## @forgezero/runtime/pipeline
 
-Typed ordered application-pipeline execution with explicit evidence.
+Typed ordered application-pipeline execution with explicit evidence. Named value imports: GIT_PROVIDERS, PipelineError, parsePush, shouldDeploy, verifyWebhook, webhookPath. Named type imports: DeployTrigger, GitProvider, PushEvent. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/pipeline';
+import { GIT_PROVIDERS, PipelineError, parsePush, shouldDeploy, verifyWebhook, webhookPath } from '@forgezero/runtime/pipeline';
+import type { DeployTrigger, GitProvider, PushEvent } from '@forgezero/runtime/pipeline';
 ```
 
+<a id="forgezero-runtime-finance-chain-addresses"></a>
 ## @forgezero/runtime/finance/chain-addresses
 
-Chain-address derivation records and validation independent of a node provider.
+Chain-address derivation records and validation independent of a node provider. Named value imports: AddressError, COUNTERFACTUAL_SCHEMES, assertDerivationMatches, create2Address, depositAddressBook, depositSaltFor, deriveDepositAddress, ownerOfAddress, toChecksumAddress, validateAddress. Named type imports: AddressScheme, ChainDeployment. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain-addresses';
+import { AddressError, COUNTERFACTUAL_SCHEMES, assertDerivationMatches, create2Address, depositAddressBook, depositSaltFor } from '@forgezero/runtime/finance/chain-addresses';
+import { deriveDepositAddress, ownerOfAddress, toChecksumAddress, validateAddress } from '@forgezero/runtime/finance/chain-addresses';
+import type { AddressScheme, ChainDeployment } from '@forgezero/runtime/finance/chain-addresses';
 ```
 
+<a id="forgezero-runtime-finance-chain-deposits"></a>
 ## @forgezero/runtime/finance/chain-deposits
 
-Provider-neutral deposit observation, confirmation and credit transitions.
+Provider-neutral deposit observation, confirmation and credit transitions. Named value imports: DepositError, creditDeposit, cursorFrom, depositReference, describeScan, isConfirmed, rescanRange, scanOnce. Named type imports: ChainReader, ChainTransfer, DepositCursor, ScanContext, ScanReport. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain-deposits';
+import { DepositError, creditDeposit, cursorFrom, depositReference, describeScan, isConfirmed } from '@forgezero/runtime/finance/chain-deposits';
+import { rescanRange, scanOnce } from '@forgezero/runtime/finance/chain-deposits';
+import type { ChainReader, ChainTransfer, DepositCursor, ScanContext, ScanReport } from '@forgezero/runtime/finance/chain-deposits';
 ```
 
+<a id="forgezero-runtime-finance-chain-withdrawals"></a>
 ## @forgezero/runtime/finance/chain-withdrawals
 
-Provider-neutral withdrawal approval, broadcast and finality transitions.
+Provider-neutral withdrawal approval, broadcast and finality transitions. Named value imports: WITHDRAWAL_STATES, WithdrawalError, approveWithdrawal, broadcastKeyFor, canTransition, confirmWithdrawal, describeSweep, holdReference, markFailed, processOnce, refundFailed, rejectWithdrawal, requestWithdrawal, sweepForPayout. Named type imports: Broadcaster, SweepCandidate, SweepPlan, Withdrawal, WithdrawalState. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain-withdrawals';
+import { WITHDRAWAL_STATES, WithdrawalError, approveWithdrawal, broadcastKeyFor, canTransition, confirmWithdrawal } from '@forgezero/runtime/finance/chain-withdrawals';
+import { describeSweep, holdReference, markFailed, processOnce, refundFailed, rejectWithdrawal } from '@forgezero/runtime/finance/chain-withdrawals';
+import { requestWithdrawal, sweepForPayout } from '@forgezero/runtime/finance/chain-withdrawals';
+import type { Broadcaster, SweepCandidate, SweepPlan, Withdrawal, WithdrawalState } from '@forgezero/runtime/finance/chain-withdrawals';
 ```
 
+<a id="forgezero-runtime-finance-chain-reconcile"></a>
 ## @forgezero/runtime/finance/chain-reconcile
 
-Deterministic reconciliation between chain observations and durable transfer state.
+Deterministic reconciliation between chain observations and durable transfer state. Named value imports: DISCREPANCY_KINDS, ReconcileError, reconcileOnce, reconcileReport, shortfallUsd. Named type imports: Discrepancy, DiscrepancyKind, LedgerLiability, OnChainHolding, ReconcileReport. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain-reconcile';
+import { DISCREPANCY_KINDS, ReconcileError, reconcileOnce, reconcileReport, shortfallUsd } from '@forgezero/runtime/finance/chain-reconcile';
+import type { Discrepancy, DiscrepancyKind, LedgerLiability, OnChainHolding, ReconcileReport } from '@forgezero/runtime/finance/chain-reconcile';
 ```
 
+<a id="forgezero-runtime-finance-market"></a>
 ## @forgezero/runtime/finance/market
 
-Market order, fill and quote contracts independent of any exchange adapter.
+Market order, fill and quote contracts independent of any exchange adapter. Named value imports: MarketError, createFeed, disagreementOf, isStale, lastPrice, limitFor, stalenessOf, subscribe. Named type imports: Feed, FeedEvent, FeedOptions, PriceResult, Quote, StalenessPolicy, VenueSource. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/market';
+import { MarketError, createFeed, disagreementOf, isStale, lastPrice, limitFor } from '@forgezero/runtime/finance/market';
+import { stalenessOf, subscribe } from '@forgezero/runtime/finance/market';
+import type { Feed, FeedEvent, FeedOptions, PriceResult, Quote, StalenessPolicy } from '@forgezero/runtime/finance/market';
+import type { VenueSource } from '@forgezero/runtime/finance/market';
 ```
 
+<a id="forgezero-runtime-custody-share"></a>
 ## @forgezero/runtime/custody-share
 
-Threshold-share parsing, validation and reconstruction.
+Threshold-share parsing, validation and reconstruction. Named value imports: PROBE_BYTES, factorWrapAad, joinProbeAndShare, openFactorEnvelope, openSealedToFactor, openShareWithPasskey, openShareWithPhrase, passkeyWrappingKey, phraseWrappingKey, sealShare, shareIndexOf, splitProbeAndShare, wrappingKeysFor. Named type imports: SealedShare, WrappingKeys. Import only the names used by this file.
 
 ```text
-import * as api from '@forgezero/runtime/custody-share';
+import { PROBE_BYTES, factorWrapAad, joinProbeAndShare, openFactorEnvelope, openSealedToFactor, openShareWithPasskey } from '@forgezero/runtime/custody-share';
+import { openShareWithPhrase, passkeyWrappingKey, phraseWrappingKey, sealShare, shareIndexOf, splitProbeAndShare } from '@forgezero/runtime/custody-share';
+import { wrappingKeysFor } from '@forgezero/runtime/custody-share';
+import type { SealedShare, WrappingKeys } from '@forgezero/runtime/custody-share';
 ```
 
+<a id="forgezero-runtime-custody-crypto"></a>
 ## @forgezero/runtime/custody-crypto
 
-Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening.
-
-```text
-import * as api from '@forgezero/runtime/custody-crypto';
-```
-
-## Define and implement a typed query
-
-Decode untrusted input and validate output around injected storage/services rather than embedding a database query in the route adapter.
+Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. Named value imports: deriveKey, openFromKey, openWithKey, sealToKey, sealWithKey, wrappingKeyPair. Named type imports: CipherBox, SealedToKey. Import only the names used by this file.
 
 ```text
-import { defineQuery, implementQuery } from '@forgezero/runtime/query';
-import { T, type Static, typeboxQueryCodec } from '@forgezero/runtime/schema/typebox';
-
-const OrderKey = T.Object({ orderKey: T.String({ minLength: 1 }) });
-const Order = T.Object({ orderKey: T.String(), total: T.String() });
-type OrderRow = Static<typeof Order>;
-type Stores = { orders: { find(key: string): Promise<OrderRow | null> } };
-declare const stores: Stores;
-
-const findOrder = defineQuery({
-  name: 'orders.find',
-  input: typeboxQueryCodec(OrderKey),
-  output: typeboxQueryCodec(T.Union([Order, T.Null()]))
-});
-export const runFindOrder = implementQuery(findOrder,
-  (context: Stores, input) => context.orders.find(input.orderKey)
-);
-
-const order = await runFindOrder.execute(stores, { orderKey: 'ord_123' });
+import { deriveKey, openFromKey, openWithKey, sealToKey, sealWithKey, wrappingKeyPair } from '@forgezero/runtime/custody-crypto';
+import type { CipherBox, SealedToKey } from '@forgezero/runtime/custody-crypto';
 ```
 
 ## 1. Install, then import a subpath