@forgezero/runtime 0.1.7 → 0.1.9

package/README.md

@@ -1,7 +1,7 @@
 <!--
   GENERATED FILE — do not edit.
 
-  Change scripts/generate-guides.ts or its typed sources, run `bun run guides`,
+  Change tools/generate-guides.ts or its typed sources, run `bun run guides`,
   and commit the generator and rendered files together.
 -->
 
@@ -9,14 +9,77 @@
 
 The machinery behind a request handler — jobs, queues, an outbox, a hash-chained audit trail, mail, backups, schema validation and exact money. 44 public modules, each imported on its own.
 
-## Global package root and supported runtimes
+## Package overview
 
-Anyone running a service, for the work that happens outside a request. Separate from `access` because a Cloudflare Worker wants the request pipeline and cannot run a backup job. Supported runtimes: bun, node. The global base/root import is @forgezero/runtime. Every public import or command is listed below; the documentation inventory is checked in both directions against package.json exports.
+Anyone running a service, for the work that happens outside a request. Separate from `access` because a Cloudflare Worker wants the request pipeline and cannot run a backup job. Supported runtimes: bun, node. Package root: @forgezero/runtime. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
 
 ```text
-import * as root from '@forgezero/runtime';
+bun add @forgezero/runtime
 ```
 
+## ForgeZero package family
+
+The five packages are installation boundaries. Choose a package by who installs it; choose a subpath by the capability used in that file.
+
+| package | short description | runtimes | documentation |
+|---|---|---|---|
+| @forgezero/vault | Scoped secret access with Agent, API-key and systemd-credential sources. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/vault-package) |
+| @forgezero/access | Typed route, principal, factor, RBAC and request-pipeline contracts. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/access) |
+| @forgezero/providers | Typed external providers with priority, health and classified fallback. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/providers) |
+| @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
+| @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
+
+## @forgezero/runtime public imports and commands
+
+Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
+
+| public entry | short description | runtime | details |
+|---|---|---|---|
+| @forgezero/runtime/query | Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB. | portable | [Details + example](#forgezero-runtime-query) |
+| @forgezero/runtime/jobs | Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected. | portable | [Details + example](#forgezero-runtime-jobs) |
+| @forgezero/runtime/queue | Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting. | portable | [Details + example](#forgezero-runtime-queue) |
+| @forgezero/runtime/outbox | Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue. | portable | [Details + example](#forgezero-runtime-outbox) |
+| @forgezero/runtime/audit | Append-only records chained by hash, with a verifier that names the first altered entry. | portable | [Details + example](#forgezero-runtime-audit) |
+| @forgezero/runtime/backup | Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back. | portable | [Details + example](#forgezero-runtime-backup) |
+| @forgezero/runtime/notify | Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. | portable | [Details + example](#forgezero-runtime-notify) |
+| @forgezero/runtime/notify/templates | The six transactional messages ForgeZero sends. | portable | [Details + example](#forgezero-runtime-notify-templates) |
+| @forgezero/runtime/calendar | Billing periods computed from an anchor, working days, holidays and due dates. | portable | [Details + example](#forgezero-runtime-calendar) |
+| @forgezero/runtime/compliance | Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. | portable | [Details + example](#forgezero-runtime-compliance) |
+| @forgezero/runtime/totp | RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. | portable | [Details + example](#forgezero-runtime-totp) |
+| @forgezero/runtime/passkey | Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. | portable | [Details + example](#forgezero-runtime-passkey) |
+| @forgezero/runtime/phrase | BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. | portable | [Details + example](#forgezero-runtime-phrase) |
+| @forgezero/runtime/snp | Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade. | portable | [Details + example](#forgezero-runtime-snp) |
+| @forgezero/runtime/importers | Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error. | portable | [Details + example](#forgezero-runtime-importers) |
+| @forgezero/runtime/openssh | OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys. | portable | [Details + example](#forgezero-runtime-openssh) |
+| @forgezero/runtime/ssh-cert | OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out. | portable | [Details + example](#forgezero-runtime-ssh-cert) |
+| @forgezero/runtime/slip10 | SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond. | portable | [Details + example](#forgezero-runtime-slip10) |
+| @forgezero/runtime/identity | Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would. | portable | [Details + example](#forgezero-runtime-identity) |
+| @forgezero/runtime/schema | Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form. | portable | [Details + example](#forgezero-runtime-schema) |
+| @forgezero/runtime/schema/typebox | The TypeBox validator behind that interface. | portable | [Details + example](#forgezero-runtime-schema-typebox) |
+| @forgezero/runtime/finance/discounts | Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. | portable | [Details + example](#forgezero-runtime-finance-discounts) |
+| @forgezero/runtime/finance/money | Exact amounts in minor units with the asset attached, so two currencies cannot be added. | portable | [Details + example](#forgezero-runtime-finance-money) |
+| @forgezero/runtime/finance/venues | Trading venues, market types and symbols as data — spot, margin and futures behind one order model. | portable | [Details + example](#forgezero-runtime-finance-venues) |
+| @forgezero/runtime/finance/ledger | Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. | portable | [Details + example](#forgezero-runtime-finance-ledger) |
+| @forgezero/runtime/finance/commission | Profit net of flows, a high-water mark, the tier split and the referral share of our income. | portable | [Details + example](#forgezero-runtime-finance-commission) |
+| @forgezero/runtime/finance/rates | What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. | portable | [Details + example](#forgezero-runtime-finance-rates) |
+| @forgezero/runtime/finance/transfers | Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. | portable | [Details + example](#forgezero-runtime-finance-transfers) |
+| @forgezero/runtime/finance/chain | Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. | portable | [Details + example](#forgezero-runtime-finance-chain) |
+| @forgezero/runtime/finance/custody | Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. | portable | [Details + example](#forgezero-runtime-finance-custody) |
+| @forgezero/runtime/finance/derive | Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. | portable | [Details + example](#forgezero-runtime-finance-derive) |
+| @forgezero/runtime/finance/tax | Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. | portable | [Details + example](#forgezero-runtime-finance-tax) |
+| @forgezero/runtime/finance/storage | Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. | portable | [Details + example](#forgezero-runtime-finance-storage) |
+| @forgezero/runtime/realtime | Provider-neutral realtime audience, shard, event and delivery contracts. | portable | [Details + example](#forgezero-runtime-realtime) |
+| @forgezero/runtime/passkey-hybrid | Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. | portable | [Details + example](#forgezero-runtime-passkey-hybrid) |
+| @forgezero/runtime/otpauth | Parse and render otpauth URIs without binding enrolment to a UI framework. | portable | [Details + example](#forgezero-runtime-otpauth) |
+| @forgezero/runtime/pipeline | Typed ordered application-pipeline execution with explicit evidence. | portable | [Details + example](#forgezero-runtime-pipeline) |
+| @forgezero/runtime/finance/chain-addresses | Chain-address derivation records and validation independent of a node provider. | portable | [Details + example](#forgezero-runtime-finance-chain-addresses) |
+| @forgezero/runtime/finance/chain-deposits | Provider-neutral deposit observation, confirmation and credit transitions. | portable | [Details + example](#forgezero-runtime-finance-chain-deposits) |
+| @forgezero/runtime/finance/chain-withdrawals | Provider-neutral withdrawal approval, broadcast and finality transitions. | portable | [Details + example](#forgezero-runtime-finance-chain-withdrawals) |
+| @forgezero/runtime/finance/chain-reconcile | Deterministic reconciliation between chain observations and durable transfer state. | portable | [Details + example](#forgezero-runtime-finance-chain-reconcile) |
+| @forgezero/runtime/finance/market | Market order, fill and quote contracts independent of any exchange adapter. | portable | [Details + example](#forgezero-runtime-finance-market) |
+| @forgezero/runtime/custody-share | Threshold-share parsing, validation and reconstruction. | portable | [Details + example](#forgezero-runtime-custody-share) |
+| @forgezero/runtime/custody-crypto | Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. | portable | [Details + example](#forgezero-runtime-custody-crypto) |
+
 ## Commands
 
 bun add @forgezero/runtime — Install runtime contracts; import the required subpath so unused capabilities stay out of the bundle.
@@ -25,382 +88,1272 @@ bun add @forgezero/runtime — Install runtime contracts; import the required su
 bun add @forgezero/runtime
 ```
 
+<a id="forgezero-runtime-query"></a>
 ## @forgezero/runtime/query
 
-Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB.
+Provider-neutral typed function contracts: decode untrusted input, run with caller-supplied services or storage, and strictly validate the result without coupling business logic to ForgeZero or ArangoDB. This entry exposes 3 named value exports and 8 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/query';
-```
-
-## @forgezero/runtime/jobs
+import {
+  QueryContractError,
+  defineQuery,
+  implementQuery,
+} from '@forgezero/runtime/query';
 
-Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected.
-
-```text
-import * as api from '@forgezero/runtime/jobs';
+import type {
+  QueryCodec,
+  QueryContract,
+  QueryDecode,
+  QueryExecution,
+  QueryImplementation,
+  QueryInput,
+  QueryIssue,
+  QueryOutput,
+} from '@forgezero/runtime/query';
 ```
 
-## @forgezero/runtime/queue
+## @forgezero/runtime/query — Define and implement a typed query
 
-Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting.
+Decode untrusted input and validate output around injected storage/services rather than embedding a database query in the route adapter.
 
 ```text
-import * as api from '@forgezero/runtime/queue';
-```
+import {
+  defineQuery,
+  implementQuery,
+} from '@forgezero/runtime/query';
+import {
+  T,
+  type Static,
+  typeboxQueryCodec,
+} from '@forgezero/runtime/schema/typebox';
 
-## @forgezero/runtime/outbox
+const OrderKey = T.Object({ orderKey: T.String({ minLength: 1 }) });
+const Order = T.Object({ orderKey: T.String(), total: T.String() });
+type OrderRow = Static<typeof Order>;
+type Stores = { orders: { find(key: string): Promise<OrderRow | null> } };
+declare const stores: Stores;
 
-Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue.
+const findOrder = defineQuery({
+  name: 'orders.find',
+  input: typeboxQueryCodec(OrderKey),
+  output: typeboxQueryCodec(T.Union([Order, T.Null()]))
+});
+export const runFindOrder = implementQuery(findOrder,
+  (context: Stores, input) => context.orders.find(input.orderKey)
+);
 
-```text
-import * as api from '@forgezero/runtime/outbox';
+const order = await runFindOrder.execute(stores, { orderKey: 'ord_123' });
 ```
 
-## @forgezero/runtime/audit
+<a id="forgezero-runtime-jobs"></a>
+## @forgezero/runtime/jobs
+
+Background work that never overlaps itself, advances a cursor only on success, and can be paused and inspected. This entry exposes 9 named value exports and 14 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  VERSION,
+  createScheduler,
+  cursorJob,
+  defineJob,
+  everyMs,
+  memoryLock,
+  nextWallClockAt,
+  storeLock,
+  systemClock,
+} from '@forgezero/runtime/jobs';
+
+import type {
+  Clock,
+  CursorBatch,
+  CursorJobSpec,
+  CursorStore,
+  JobContext,
+  JobLock,
+  JobReport,
+  JobResult,
+  JobSpec,
+  Lease,
+  LockStore,
+  Scheduler,
+  SchedulerOptions,
+  WallClockSchedule,
+} from '@forgezero/runtime/jobs';
+```
+
+<a id="forgezero-runtime-queue"></a>
+## @forgezero/runtime/queue
 
-Append-only records chained by hash, with a verifier that names the first altered entry.
+Memory-only keyed work queue — awaited results, parallel across keys and strictly sequential within one; clustered callers atomically claim ownership in their own business store before submitting. This entry exposes 5 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/audit';
+import {
+  QueueKeyStoppedError,
+  QueueStoppedError,
+  TaskCancelledError,
+  createQueue,
+  queueWidthFor,
+} from '@forgezero/runtime/queue';
+
+import type {
+  DrainReport,
+  Queue,
+  QueueOptions,
+  QueueResourcePolicy,
+  QueueTask,
+  RetryPolicy,
+} from '@forgezero/runtime/queue';
 ```
 
-## @forgezero/runtime/backup
+<a id="forgezero-runtime-outbox"></a>
+## @forgezero/runtime/outbox
 
-Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back.
+Write the event with the record, deliver it after, in order per key with backoff and a dead-letter queue. This entry exposes 8 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  DEFAULT_POLICY,
+  EVENT_STATES,
+  OutboxError,
+  VERSION,
+  backoffMs,
+  createOutbox,
+  memoryStore,
+  outboxJob,
+} from '@forgezero/runtime/outbox';
+
+import type {
+  DeliveryPolicy,
+  DeliveryResult,
+  DrainReport,
+  EventState,
+  Outbox,
+  OutboxEvent,
+  OutboxOptions,
+  OutboxStore,
+  PublishInput,
+  Transport,
+} from '@forgezero/runtime/outbox';
+```
+
+<a id="forgezero-runtime-audit"></a>
+## @forgezero/runtime/audit
 
-```text
-import * as api from '@forgezero/runtime/backup';
-```
+Append-only records chained by hash, with a verifier that names the first altered entry. This entry exposes 12 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  AuditChainError,
+  GENESIS_DIGEST,
+  VERSION,
+  appendRecord,
+  canonicalise,
+  createAuditChain,
+  exportRange,
+  hashDigester,
+  memoryStore,
+  sealedDigester,
+  verifyChain,
+  verifyExport,
+} from '@forgezero/runtime/audit';
+
+import type {
+  AppendOptions,
+  AuditChain,
+  AuditChainOptions,
+  AuditEntry,
+  AuditExport,
+  AuditRecord,
+  AuditStore,
+  ChainVerdict,
+  Digester,
+  EffectAuditRecord,
+} from '@forgezero/runtime/audit';
+```
+
+<a id="forgezero-runtime-backup"></a>
+## @forgezero/runtime/backup
 
+Encrypted, chunked, verified snapshots to object storage — and the restore that reads them back. This entry exposes 11 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  BackupError,
+  DEFAULT_RETENTION,
+  SNAPSHOT_FORMAT,
+  VERSION,
+  backupJob,
+  listSnapshots,
+  prune,
+  restore,
+  selectForDeletion,
+  snapshot,
+  verifySnapshot,
+} from '@forgezero/runtime/backup';
+
+import type {
+  ChunkRecord,
+  ObjectStore,
+  RestoreOptions,
+  RestoreReport,
+  RetentionPolicy,
+  RowSink,
+  RowSource,
+  SnapshotManifest,
+  SnapshotOptions,
+  VerifyReport,
+} from '@forgezero/runtime/backup';
+```
+
+<a id="forgezero-runtime-notify"></a>
 ## @forgezero/runtime/notify
 
-Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be.
-
-```text
-import * as api from '@forgezero/runtime/notify';
-```
-
+Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. This entry exposes 12 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  CHANNELS,
+  NotifyError,
+  VERSION,
+  assertHeaderSafe,
+  button,
+  codeBlock,
+  createNotifier,
+  defineTemplate,
+  escapeHtml,
+  layout,
+  preview,
+  render,
+} from '@forgezero/runtime/notify';
+
+import type {
+  Channel,
+  Notification,
+  Notifier,
+  NotifierOptions,
+  Rendered,
+  TemplateSpec,
+  Transport,
+} from '@forgezero/runtime/notify';
+```
+
+<a id="forgezero-runtime-notify-templates"></a>
 ## @forgezero/runtime/notify/templates
 
-The six transactional messages ForgeZero sends.
+The six transactional messages ForgeZero sends. This entry exposes 8 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/notify/templates';
+import {
+  TEMPLATES,
+  ceremonyProposed,
+  custodianEnrolment,
+  escapeHtml,
+  invitation,
+  newDevice,
+  signInCode,
+  vaultLocked,
+} from '@forgezero/runtime/notify/templates';
+
+import type {
+  TemplateKey,
+} from '@forgezero/runtime/notify/templates';
 ```
 
+<a id="forgezero-runtime-calendar"></a>
 ## @forgezero/runtime/calendar
 
-Billing periods computed from an anchor, working days, holidays and due dates.
-
-```text
-import * as api from '@forgezero/runtime/calendar';
-```
-
+Billing periods computed from an anchor, working days, holidays and due dates. This entry exposes 15 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  CalendarError,
+  DAY_MS,
+  DEFAULT_WORKING_DAYS,
+  closedPeriods,
+  dayOfWeek,
+  daysOverdue,
+  fromDay,
+  isOverdue,
+  isWorkingDay,
+  nextWorkingDay,
+  periodAt,
+  periodIndexOn,
+  periodOn,
+  toDay,
+  workingDaysBetween,
+} from '@forgezero/runtime/calendar';
+
+import type {
+  BillingSchedule,
+  Calendar,
+  IsoDate,
+  Period,
+} from '@forgezero/runtime/calendar';
+```
+
+<a id="forgezero-runtime-compliance"></a>
 ## @forgezero/runtime/compliance
 
-Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable.
-
-```text
-import * as api from '@forgezero/runtime/compliance';
-```
-
+Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. This entry exposes 11 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  ComplianceError,
+  RISK_LEVELS,
+  VERIFICATION_TIERS,
+  combineLists,
+  countryRule,
+  newCounterpartyRule,
+  screen,
+  screeningStage,
+  staticList,
+  tierLimitRule,
+  unavailableList,
+} from '@forgezero/runtime/compliance';
+
+import type {
+  ListEntry,
+  RiskLevel,
+  Rule,
+  RuleHit,
+  ScreenOptions,
+  ScreeningList,
+  StageOptions,
+  Subject,
+  Verdict,
+  VerificationTier,
+} from '@forgezero/runtime/compliance';
+```
+
+<a id="forgezero-runtime-totp"></a>
 ## @forgezero/runtime/totp
 
-RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller.
-
-```text
-import * as api from '@forgezero/runtime/totp';
-```
-
+RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. This entry exposes 13 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  DEFAULT_DIGITS,
+  DEFAULT_STEP_SECONDS,
+  TotpError,
+  assertCode,
+  codeAt,
+  codeFor,
+  counterAt,
+  enrolmentUri,
+  fromBase32,
+  generateSecret,
+  secondsRemaining,
+  toBase32,
+  verifyCode,
+} from '@forgezero/runtime/totp';
+
+import type {
+  TotpOptions,
+  VerifyOptions,
+  VerifyResult,
+} from '@forgezero/runtime/totp';
+```
+
+<a id="forgezero-runtime-passkey"></a>
 ## @forgezero/runtime/passkey
 
-Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site.
+Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. This entry exposes 11 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/passkey';
+import {
+  FLAG_BE,
+  FLAG_BS,
+  FLAG_UP,
+  FLAG_UV,
+  PasskeyError,
+  assertPasskey,
+  authenticatorData,
+  credentialIdFor,
+  passkeysFor,
+  rpIdMatches,
+  verifyAssertion,
+} from '@forgezero/runtime/passkey';
+
+import type {
+  Assertion,
+  AssertionRequest,
+  StoredPasskey,
+} from '@forgezero/runtime/passkey';
 ```
 
+<a id="forgezero-runtime-phrase"></a>
 ## @forgezero/runtime/phrase
 
-BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it.
+BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. This entry exposes 7 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/phrase';
+import {
+  PHRASE_SALT_BYTES,
+  PHRASE_WORDS,
+  generatePhrase,
+  newSalt,
+  phraseToKey,
+  phraseVerifier,
+  validatePhrase,
+} from '@forgezero/runtime/phrase';
 ```
 
+<a id="forgezero-runtime-snp"></a>
 ## @forgezero/runtime/snp
 
-Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade.
+Parse an AMD SEV-SNP attestation report at the firmware ABI offsets, and compare a TCB component by component so a microcode bump cannot mask a firmware downgrade. This entry exposes 5 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/snp';
+import {
+  REPORT_BYTES,
+  SnpError,
+  bindsNonce,
+  parseSnpReport,
+  tcbAtLeast,
+} from '@forgezero/runtime/snp';
+
+import type {
+  GuestPolicy,
+  SnpReport,
+  TcbVersion,
+} from '@forgezero/runtime/snp';
 ```
 
+<a id="forgezero-runtime-importers"></a>
 ## @forgezero/runtime/importers
 
-Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error.
+Read secrets out of a .env, a CSV, or a Bitwarden or 1Password export — skipping what cannot be understood rather than guessing, and never putting a value in an error. This entry exposes 7 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/importers';
+import {
+  IMPORT_FORMATS,
+  normaliseName,
+  parseBitwarden,
+  parseCsv,
+  parseEnv,
+  parseImport,
+  parseOnePassword,
+} from '@forgezero/runtime/importers';
+
+import type {
+  ImportFormat,
+  ImportResult,
+  ImportedSecret,
+  Skipped,
+} from '@forgezero/runtime/importers';
 ```
 
+<a id="forgezero-runtime-openssh"></a>
 ## @forgezero/runtime/openssh
 
-OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys.
+OpenSSH wire encoding, so a derived ed25519 key becomes a line that pastes into authorized_keys. This entry exposes 6 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/openssh';
+import {
+  OpenSshError,
+  authorizedKey,
+  fingerprint,
+  parseAuthorizedKey,
+  publicKeyBlob,
+  signatureBlob,
+} from '@forgezero/runtime/openssh';
 ```
 
+<a id="forgezero-runtime-ssh-cert"></a>
 ## @forgezero/runtime/ssh-cert
 
-OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out.
+OpenSSH certificates, so access expires instead of having to be hunted down. Takes a signing FUNCTION rather than a secret key, which is what lets the CA live in a vault that never hands it out. This entry exposes 9 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/ssh-cert';
+import {
+  CERT_TYPE_HOST,
+  CERT_TYPE_USER,
+  DEFAULT_EXTENSIONS,
+  SshCertError,
+  caFingerprint,
+  caFromSecretKey,
+  caPublicKeyLine,
+  isCurrentlyValid,
+  signCertificate,
+} from '@forgezero/runtime/ssh-cert';
+
+import type {
+  CertificateAuthority,
+  CertificateRequest,
+} from '@forgezero/runtime/ssh-cert';
 ```
 
+<a id="forgezero-runtime-slip10"></a>
 ## @forgezero/runtime/slip10
 
-SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond.
+SLIP-0010 derivation for ed25519, hardened-only — BIP-32 does not work on this curve and produces halves that do not correspond. This entry exposes 5 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/slip10';
+import {
+  HARDENED_OFFSET,
+  Slip10Error,
+  deriveChild,
+  derivePath,
+  masterFromSeed,
+} from '@forgezero/runtime/slip10';
+
+import type {
+  Slip10Node,
+} from '@forgezero/runtime/slip10';
 ```
 
+<a id="forgezero-runtime-identity"></a>
 ## @forgezero/runtime/identity
 
-Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would.
-
-```text
-import * as api from '@forgezero/runtime/identity';
-```
-
+Hybrid Ed25519 + ML-DSA-65 request signing. One canonical string, so the compute agent that signs inside a guest and the API that verifies cannot drift — which two implementations of it certainly would. This entry exposes 16 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  CLOCK_SKEW_SECONDS,
+  REQUEST_SIGNATURE_SUITE,
+  RESPONSE_KEY_HEADER,
+  RESPONSE_SEALING_SUITE,
+  canonicalString,
+  decodeSignatureHeader,
+  deriveKeysFromSeed,
+  derivePublicKeysFromSeed,
+  encodeSignatureHeader,
+  generateNodeKeys,
+  generateResponseRecipient,
+  openResponse,
+  sealResponse,
+  signRequest,
+  validResponsePublicKey,
+  verifyRequest,
+} from '@forgezero/runtime/identity';
+
+import type {
+  NodeKeyPair,
+  NodePublicKeys,
+  ResponseRecipient,
+  SealedResponse,
+  SignedEnvelope,
+  VerifyFailure,
+} from '@forgezero/runtime/identity';
+```
+
+<a id="forgezero-runtime-schema"></a>
 ## @forgezero/runtime/schema
 
-Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form.
+Validate against JSON Schema, restrict what a caller may declare, and describe a schema as a form. This entry exposes 8 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/schema';
+import {
+  DEFAULT_RESTRICTIONS,
+  SCHEMA_VERSION,
+  SchemaError,
+  VERSION,
+  describeJsonSchema,
+  readableFields,
+  restrictJsonSchema,
+  writeOnlyPaths,
+} from '@forgezero/runtime/schema';
+
+import type {
+  FieldKind,
+  FormField,
+  Restrictions,
+  SchemaValidator,
+  ValidationResult,
+} from '@forgezero/runtime/schema';
 ```
 
-## @forgezero/runtime/schema/typebox
+## @forgezero/runtime/schema — Restrict an untrusted JSON Schema before storing it
 
-The TypeBox validator behind that interface.
+Tenant-supplied schemas are data, not executable code. Restriction rejects references, remote identifiers, unsupported keywords, excessive depth/size, and arrays without a bounded maxItems. Form metadata is derived from the accepted schema; write-only fields remain identifiable for secret handling.
 
 ```text
-import * as api from '@forgezero/runtime/schema/typebox';
+import {
+  restrictJsonSchema,
+  describeJsonSchema,
+  writeOnlyPaths,
+} from '@forgezero/runtime/schema';
+
+const schema = restrictJsonSchema({
+  type: 'object', additionalProperties: false,
+  properties: {
+    recipients: { type: 'array', maxItems: 100, items: { type: 'string' } },
+    apiKey: { type: 'string', title: 'API key', writeOnly: true }
+  },
+  required: ['apiKey']
+});
+const fields = describeJsonSchema(schema);
+const secretFields = writeOnlyPaths(fields);
 ```
 
-## @forgezero/runtime/finance/discounts
+<a id="forgezero-runtime-schema-typebox"></a>
+## @forgezero/runtime/schema/typebox
 
-Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever.
+The TypeBox validator behind that interface. This entry exposes 4 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/discounts';
+import {
+  T,
+  parse,
+  typebox,
+  typeboxQueryCodec,
+} from '@forgezero/runtime/schema/typebox';
+
+import type {
+  Static,
+  TSchema,
+} from '@forgezero/runtime/schema/typebox';
 ```
 
-## @forgezero/runtime/finance/money
+## @forgezero/runtime/schema/typebox — One TypeBox shape for runtime validation and static types
 
-Exact amounts in minor units with the asset attached, so two currencies cannot be added.
+TypeBox is an optional peer. Its schema is JSON Schema, so the same restriction and form layer applies. The query codec validates both untrusted input and returned output; malformed values fail instead of being coerced.
 
 ```text
-import * as api from '@forgezero/runtime/finance/money';
+import {
+  T,
+  type Static,
+  parse,
+  typeboxQueryCodec,
+} from '@forgezero/runtime/schema/typebox';
+
+const User = T.Object({
+  userKey: T.String({ minLength: 1 }),
+  roles: T.Array(T.String(), { maxItems: 32 })
+}, { additionalProperties: false });
+type User = Static<typeof User>;
+const user: User = parse(User, unknownInput);
+const codec = typeboxQueryCodec(User);
 ```
 
-## @forgezero/runtime/finance/venues
+<a id="forgezero-runtime-finance-discounts"></a>
+## @forgezero/runtime/finance/discounts
 
-Trading venues, market types and symbols as data — spot, margin and futures behind one order model.
+Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. This entry exposes 7 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/venues';
+import {
+  DiscountError,
+  assertCode,
+  assertWindow,
+  bestDiscount,
+  discountFor,
+  ineligibility,
+  normaliseCode,
+} from '@forgezero/runtime/finance/discounts';
+
+import type {
+  AppliedDiscount,
+  DiscountKind,
+  Ineligibility,
+  Promotion,
+} from '@forgezero/runtime/finance/discounts';
 ```
 
-## @forgezero/runtime/finance/ledger
+<a id="forgezero-runtime-finance-money"></a>
+## @forgezero/runtime/finance/money
 
-Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering.
+Exact amounts in minor units with the asset attached, so two currencies cannot be added. This entry exposes 22 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  ASSETS,
+  MoneyError,
+  ROUNDING,
+  VERSION,
+  abs,
+  add,
+  allocate,
+  assetSpec,
+  compare,
+  convert,
+  defineAsset,
+  equals,
+  formatAmount,
+  isNegative,
+  isZero,
+  money,
+  mulRate,
+  negate,
+  parseAmount,
+  subtract,
+  toStep,
+  zero,
+} from '@forgezero/runtime/finance/money';
+
+import type {
+  AssetSpec,
+  Money,
+  Rounding,
+} from '@forgezero/runtime/finance/money';
+```
+
+<a id="forgezero-runtime-finance-venues"></a>
+## @forgezero/runtime/finance/venues
 
-```text
-import * as api from '@forgezero/runtime/finance/ledger';
-```
+Trading venues, market types and symbols as data — spot, margin and futures behind one order model. This entry exposes 14 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  MARKET_TYPES,
+  ORDER_SIDES,
+  ORDER_TYPES,
+  TIME_IN_FORCE,
+  VENUES,
+  VERSION,
+  VenueError,
+  notionalOf,
+  parseSymbol,
+  submitOrder,
+  symbolOf,
+  validateOrder,
+  venue,
+  venuesFor,
+} from '@forgezero/runtime/finance/venues';
+
+import type {
+  MarketSpec,
+  MarketType,
+  OrderRequest,
+  OrderResult,
+  OrderSide,
+  OrderStatus,
+  OrderType,
+  TimeInForce,
+  VenueAdapter,
+  VenueSpec,
+} from '@forgezero/runtime/finance/venues';
+```
+
+<a id="forgezero-runtime-finance-ledger"></a>
+## @forgezero/runtime/finance/ledger
 
+Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. This entry exposes 21 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  ACCOUNT_KINDS,
+  BUCKETS,
+  LedgerError,
+  MAX_LEDGER_ENTRIES,
+  VERSION,
+  accountId,
+  assertAvailable,
+  assertBalanced,
+  availableOf,
+  balanceOf,
+  balancesFrom,
+  captureHold,
+  heldOf,
+  parseAccount,
+  placeHold,
+  queueKeyFor,
+  releaseHold,
+  statement,
+  totalOf,
+  transfer,
+  trialBalance,
+} from '@forgezero/runtime/finance/ledger';
+
+import type {
+  AccountKind,
+  AccountRef,
+  Bucket,
+  Entry,
+  Transaction,
+  TrialBalance,
+} from '@forgezero/runtime/finance/ledger';
+```
+
+<a id="forgezero-runtime-finance-commission"></a>
 ## @forgezero/runtime/finance/commission
 
-Profit net of flows, a high-water mark, the tier split and the referral share of our income.
+Profit net of flows, a high-water mark, the tier split and the referral share of our income. This entry exposes 9 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/commission';
+import {
+  CommissionError,
+  allocate,
+  chargeableProfit,
+  commissionTransaction,
+  nextHighWaterMark,
+  periodProfit,
+  projectPrepay,
+  splitCommission,
+  splitReferrals,
+} from '@forgezero/runtime/finance/commission';
+
+import type {
+  CommissionInput,
+  CommissionSplit,
+  PeriodPerformance,
+  Prepay,
+  PrepayInput,
+  ReferralShare,
+} from '@forgezero/runtime/finance/commission';
 ```
 
+<a id="forgezero-runtime-finance-rates"></a>
 ## @forgezero/runtime/finance/rates
 
-What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does.
-
-```text
-import * as api from '@forgezero/runtime/finance/rates';
-```
-
+What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. This entry exposes 11 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  BASE_ASSET,
+  RATE_SOURCES,
+  RateError,
+  assertRate,
+  createRateTable,
+  describeRate,
+  isRegistered,
+  peg,
+  rateRefreshJob,
+  refreshRates,
+  registerAsset,
+} from '@forgezero/runtime/finance/rates';
+
+import type {
+  AssetEntry,
+  AssetRate,
+  RateFetcher,
+  RateSource,
+  RateTable,
+  RateTableOptions,
+  RefreshReport,
+} from '@forgezero/runtime/finance/rates';
+```
+
+<a id="forgezero-runtime-finance-transfers"></a>
 ## @forgezero/runtime/finance/transfers
 
-Deposits and withdrawals as ordered pipelines, with screening reserved at position zero.
+Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. This entry exposes 9 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/transfers';
+import {
+  DIRECTIONS,
+  PipelineError,
+  SCREENING_ORDER,
+  approvalStage,
+  balanceStage,
+  createTransferPipeline,
+  limitsStage,
+  notFrozenStage,
+  screeningStage,
+} from '@forgezero/runtime/finance/transfers';
+
+import type {
+  Direction,
+  PipelineResult,
+  Stage,
+  StageOutcome,
+  Transfer,
+  TransferPipeline,
+} from '@forgezero/runtime/finance/transfers';
 ```
 
+<a id="forgezero-runtime-finance-chain"></a>
 ## @forgezero/runtime/finance/chain
 
-Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits.
+Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. This entry exposes 9 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain';
+import {
+  ADDRESS_SCHEMES,
+  ChainError,
+  SEED_CHAINS,
+  SEED_CHAIN_ASSETS,
+  assertChain,
+  confirmationsFor,
+  createChainRegistry,
+  estimatedSeconds,
+  validateAddress,
+} from '@forgezero/runtime/finance/chain';
+
+import type {
+  AddressScheme,
+  ChainAsset,
+  ChainRegistry,
+  ChainSpec,
+  ConfirmationBand,
+} from '@forgezero/runtime/finance/chain';
 ```
 
+<a id="forgezero-runtime-finance-custody"></a>
 ## @forgezero/runtime/finance/custody
 
-Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node.
+Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. This entry exposes 8 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/custody';
+import {
+  CustodyError,
+  VERSION,
+  depositAddress,
+  domainSeparator,
+  orderSignatures,
+  saltFor,
+  toChecksumAddress,
+  withdrawDigest,
+} from '@forgezero/runtime/finance/custody';
 ```
 
+<a id="forgezero-runtime-finance-derive"></a>
 ## @forgezero/runtime/finance/derive
 
-Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key.
+Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. This entry exposes 11 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/derive';
+import {
+  CUSTODY,
+  DERIVE_KEYWORD,
+  DeriveError,
+  SCHEMES,
+  assertDeriveSpec,
+  custodyOf,
+  deriveSpecOf,
+  derivedFields,
+  derivedPaths,
+  pathFor,
+  suppliedPaths,
+} from '@forgezero/runtime/finance/derive';
+
+import type {
+  Custody,
+  DeriveSpec,
+  DerivedField,
+  Scheme,
+} from '@forgezero/runtime/finance/derive';
 ```
 
+<a id="forgezero-runtime-finance-tax"></a>
 ## @forgezero/runtime/finance/tax
 
-Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data.
+Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. This entry exposes 9 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/tax';
+import {
+  TREATMENTS,
+  TaxError,
+  applyTax,
+  assertTaxRate,
+  decideTax,
+  describeTax,
+  parseRate,
+  percent,
+  totalWithTax,
+} from '@forgezero/runtime/finance/tax';
+
+import type {
+  Customer,
+  Supplier,
+  TaxAmounts,
+  TaxDecision,
+  TaxRate,
+  Treatment,
+} from '@forgezero/runtime/finance/tax';
 ```
 
+<a id="forgezero-runtime-finance-storage"></a>
 ## @forgezero/runtime/finance/storage
 
-Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index.
+Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. This entry exposes 8 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/storage';
+import {
+  SORT_FIELD,
+  fromStored,
+  rangeBounds,
+  sortExact,
+  sortKey,
+  storeAmount,
+  toStored,
+  withinRange,
+} from '@forgezero/runtime/finance/storage';
+
+import type {
+  StoredMoney,
+} from '@forgezero/runtime/finance/storage';
 ```
 
+<a id="forgezero-runtime-realtime"></a>
 ## @forgezero/runtime/realtime
 
-Provider-neutral realtime audience, shard, event and delivery contracts.
-
-```text
-import * as api from '@forgezero/runtime/realtime';
-```
-
+Provider-neutral realtime audience, shard, event and delivery contracts. This entry exposes 15 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  REALTIME_MAX_BATCH_BYTES,
+  REALTIME_MAX_EVENTS,
+  REALTIME_MAX_EVENT_BYTES,
+  REALTIME_MAX_SHARDS_PER_TOPIC,
+  REALTIME_MAX_SOCKETS_PER_SHARD,
+  canReceiveRealtimeAudience,
+  issueRealtimeSubscriptionTicket,
+  realtimeBatchBytes,
+  realtimeHmac,
+  realtimeShardKey,
+  validateRealtimeAudience,
+  validateRealtimeBatch,
+  validateRealtimeSubscriptionTicket,
+  verifyRealtimeHmac,
+  verifyRealtimeSubscriptionToken,
+} from '@forgezero/runtime/realtime';
+
+import type {
+  RealtimeAudience,
+  RealtimeBatch,
+  RealtimeEvent,
+  RealtimePrincipalKind,
+  RealtimeSubscriptionTicket,
+} from '@forgezero/runtime/realtime';
+```
+
+<a id="forgezero-runtime-passkey-hybrid"></a>
 ## @forgezero/runtime/passkey-hybrid
 
-Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification.
+Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. This entry exposes 8 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/passkey-hybrid';
+import {
+  PASSKEY_HYBRID_SUITE,
+  PASSKEY_HYBRID_VERSION,
+  PASSKEY_ML_DSA_PUBLIC_KEY_BYTES,
+  PASSKEY_ML_DSA_SIGNATURE_BYTES,
+  PASSKEY_PRF_SALT,
+  createPasskeyHybridProof,
+  passkeyHybridMessage,
+  verifyPasskeyHybridProof,
+} from '@forgezero/runtime/passkey-hybrid';
+
+import type {
+  PasskeyHybridBinding,
+  PasskeyHybridProof,
+  PasskeyHybridPurpose,
+  PasskeyHybridRegistrationProof,
+} from '@forgezero/runtime/passkey-hybrid';
 ```
 
+<a id="forgezero-runtime-otpauth"></a>
 ## @forgezero/runtime/otpauth
 
-Parse and render otpauth URIs without binding enrolment to a UI framework.
+Parse and render otpauth URIs without binding enrolment to a UI framework. This entry exposes 4 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/otpauth';
+import {
+  formatOtpAuth,
+  fromManualSecret,
+  newOtpAuth,
+  parseOtpAuth,
+} from '@forgezero/runtime/otpauth';
+
+import type {
+  OtpAuth,
+} from '@forgezero/runtime/otpauth';
 ```
 
+<a id="forgezero-runtime-pipeline"></a>
 ## @forgezero/runtime/pipeline
 
-Typed ordered application-pipeline execution with explicit evidence.
+Typed ordered application-pipeline execution with explicit evidence. This entry exposes 6 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/pipeline';
+import {
+  GIT_PROVIDERS,
+  PipelineError,
+  parsePush,
+  shouldDeploy,
+  verifyWebhook,
+  webhookPath,
+} from '@forgezero/runtime/pipeline';
+
+import type {
+  DeployTrigger,
+  GitProvider,
+  PushEvent,
+} from '@forgezero/runtime/pipeline';
 ```
 
+<a id="forgezero-runtime-finance-chain-addresses"></a>
 ## @forgezero/runtime/finance/chain-addresses
 
-Chain-address derivation records and validation independent of a node provider.
+Chain-address derivation records and validation independent of a node provider. This entry exposes 10 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain-addresses';
+import {
+  AddressError,
+  COUNTERFACTUAL_SCHEMES,
+  assertDerivationMatches,
+  create2Address,
+  depositAddressBook,
+  depositSaltFor,
+  deriveDepositAddress,
+  ownerOfAddress,
+  toChecksumAddress,
+  validateAddress,
+} from '@forgezero/runtime/finance/chain-addresses';
+
+import type {
+  AddressScheme,
+  ChainDeployment,
+} from '@forgezero/runtime/finance/chain-addresses';
 ```
 
+<a id="forgezero-runtime-finance-chain-deposits"></a>
 ## @forgezero/runtime/finance/chain-deposits
 
-Provider-neutral deposit observation, confirmation and credit transitions.
+Provider-neutral deposit observation, confirmation and credit transitions. This entry exposes 8 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain-deposits';
+import {
+  DepositError,
+  creditDeposit,
+  cursorFrom,
+  depositReference,
+  describeScan,
+  isConfirmed,
+  rescanRange,
+  scanOnce,
+} from '@forgezero/runtime/finance/chain-deposits';
+
+import type {
+  ChainReader,
+  ChainTransfer,
+  DepositCursor,
+  ScanContext,
+  ScanReport,
+} from '@forgezero/runtime/finance/chain-deposits';
 ```
 
+<a id="forgezero-runtime-finance-chain-withdrawals"></a>
 ## @forgezero/runtime/finance/chain-withdrawals
 
-Provider-neutral withdrawal approval, broadcast and finality transitions.
-
-```text
-import * as api from '@forgezero/runtime/finance/chain-withdrawals';
-```
-
+Provider-neutral withdrawal approval, broadcast and finality transitions. This entry exposes 14 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  WITHDRAWAL_STATES,
+  WithdrawalError,
+  approveWithdrawal,
+  broadcastKeyFor,
+  canTransition,
+  confirmWithdrawal,
+  describeSweep,
+  holdReference,
+  markFailed,
+  processOnce,
+  refundFailed,
+  rejectWithdrawal,
+  requestWithdrawal,
+  sweepForPayout,
+} from '@forgezero/runtime/finance/chain-withdrawals';
+
+import type {
+  Broadcaster,
+  SweepCandidate,
+  SweepPlan,
+  Withdrawal,
+  WithdrawalState,
+} from '@forgezero/runtime/finance/chain-withdrawals';
+```
+
+<a id="forgezero-runtime-finance-chain-reconcile"></a>
 ## @forgezero/runtime/finance/chain-reconcile
 
-Deterministic reconciliation between chain observations and durable transfer state.
+Deterministic reconciliation between chain observations and durable transfer state. This entry exposes 5 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/chain-reconcile';
+import {
+  DISCREPANCY_KINDS,
+  ReconcileError,
+  reconcileOnce,
+  reconcileReport,
+  shortfallUsd,
+} from '@forgezero/runtime/finance/chain-reconcile';
+
+import type {
+  Discrepancy,
+  DiscrepancyKind,
+  LedgerLiability,
+  OnChainHolding,
+  ReconcileReport,
+} from '@forgezero/runtime/finance/chain-reconcile';
 ```
 
+<a id="forgezero-runtime-finance-market"></a>
 ## @forgezero/runtime/finance/market
 
-Market order, fill and quote contracts independent of any exchange adapter.
+Market order, fill and quote contracts independent of any exchange adapter. This entry exposes 8 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/finance/market';
+import {
+  MarketError,
+  createFeed,
+  disagreementOf,
+  isStale,
+  lastPrice,
+  limitFor,
+  stalenessOf,
+  subscribe,
+} from '@forgezero/runtime/finance/market';
+
+import type {
+  Feed,
+  FeedEvent,
+  FeedOptions,
+  PriceResult,
+  Quote,
+  StalenessPolicy,
+  VenueSource,
+} from '@forgezero/runtime/finance/market';
 ```
 
+<a id="forgezero-runtime-custody-share"></a>
 ## @forgezero/runtime/custody-share
 
-Threshold-share parsing, validation and reconstruction.
+Threshold-share parsing, validation and reconstruction. This entry exposes 13 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/runtime/custody-share';
-```
-
-## @forgezero/runtime/custody-crypto
+import {
+  PROBE_BYTES,
+  factorWrapAad,
+  joinProbeAndShare,
+  openFactorEnvelope,
+  openSealedToFactor,
+  openShareWithPasskey,
+  openShareWithPhrase,
+  passkeyWrappingKey,
+  phraseWrappingKey,
+  sealShare,
+  shareIndexOf,
+  splitProbeAndShare,
+  wrappingKeysFor,
+} from '@forgezero/runtime/custody-share';
 
-Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening.
-
-```text
-import * as api from '@forgezero/runtime/custody-crypto';
+import type {
+  SealedShare,
+  WrappingKeys,
+} from '@forgezero/runtime/custody-share';
 ```
 
-## Define and implement a typed query
+<a id="forgezero-runtime-custody-crypto"></a>
+## @forgezero/runtime/custody-crypto
 
-Decode untrusted input and validate output around injected storage/services rather than embedding a database query in the route adapter.
+Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. This entry exposes 6 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { defineQuery, implementQuery } from '@forgezero/runtime/query';
-import { T, type Static, typeboxQueryCodec } from '@forgezero/runtime/schema/typebox';
+import {
+  deriveKey,
+  openFromKey,
+  openWithKey,
+  sealToKey,
+  sealWithKey,
+  wrappingKeyPair,
+} from '@forgezero/runtime/custody-crypto';
 
-const OrderKey = T.Object({ orderKey: T.String({ minLength: 1 }) });
-const Order = T.Object({ orderKey: T.String(), total: T.String() });
-type OrderRow = Static<typeof Order>;
-type Stores = { orders: { find(key: string): Promise<OrderRow | null> } };
-declare const stores: Stores;
-
-const findOrder = defineQuery({
-  name: 'orders.find',
-  input: typeboxQueryCodec(OrderKey),
-  output: typeboxQueryCodec(T.Union([Order, T.Null()]))
-});
-export const runFindOrder = implementQuery(findOrder,
-  (context: Stores, input) => context.orders.find(input.orderKey)
-);
-
-const order = await runFindOrder.execute(stores, { orderKey: 'ord_123' });
+import type {
+  CipherBox,
+  SealedToKey,
+} from '@forgezero/runtime/custody-crypto';
 ```
 
 ## 1. Install, then import a subpath
@@ -410,8 +1363,12 @@ There is no root export, and that is deliberate. `import from "@forgezero/runtim
 ```text
 bun add @forgezero/runtime
 
-import { parseAmount } from '@forgezero/runtime/finance/money';
-import { createScheduler } from '@forgezero/runtime/jobs';
+import {
+  parseAmount,
+} from '@forgezero/runtime/finance/money';
+import {
+  createScheduler,
+} from '@forgezero/runtime/jobs';
 
 // This throws. It is supposed to.
 // import { anything } from '@forgezero/runtime';
@@ -472,8 +1429,15 @@ bun add @sinclair/typebox
 An amount is minor units as a bigint with its asset attached, so two currencies cannot be added by accident and a rounding mode is always stated. A database needs a second thing the bigint cannot give it — an ORDER BY that works — so `finance/storage` writes both: the authoritative string, and a lossy double used for sorting and range filters only. One ETH is 10^18 minor units and a signed 64-bit column overflows at about nine ETH, which is why the exact value is never the sortable one.
 
 ```text
-import { parseAmount, mulRate, formatAmount } from '@forgezero/runtime/finance/money';
-import { toStored, rangeBounds } from '@forgezero/runtime/finance/storage';
+import {
+  parseAmount,
+  mulRate,
+  formatAmount,
+} from '@forgezero/runtime/finance/money';
+import {
+  toStored,
+  rangeBounds,
+} from '@forgezero/runtime/finance/storage';
 
 const fee = mulRate(parseAmount('1250.00', 'USD'), '0.015', 'down');
 formatAmount(fee);                    // '18.75' — never 18.749999999
@@ -502,7 +1466,11 @@ node_modules/@forgezero/runtime/contracts/src/
 The lock and the cursor store are interfaces, so this runs against a database, Redis, or nothing at all in a test.
 
 ```text
-import { createScheduler, defineJob, cursorJob } from '@forgezero/runtime/jobs';
+import {
+  createScheduler,
+  defineJob,
+  cursorJob,
+} from '@forgezero/runtime/jobs';
 ```
 
 ## Never setInterval
@@ -572,7 +1540,10 @@ scheduler.status();
 TypeBox is a peer dependency and optional. A project on Zod pulls none of it, because the interface is what the other packages depend on.
 
 ```text
-import { validate, describeForm } from '@forgezero/runtime/schema';
+import {
+  validate,
+  describeForm,
+} from '@forgezero/runtime/schema';
 
 // only if you validate with TypeBox
 bun add @sinclair/typebox
@@ -583,7 +1554,10 @@ bun add @sinclair/typebox
 Query strings are entirely strings, so values are converted before checking — otherwise ?port=587 fails a schema expecting a number on a perfectly well-formed request.
 
 ```text
-import { typebox, T } from '@forgezero/runtime/schema/typebox';
+import {
+  typebox,
+  T,
+} from '@forgezero/runtime/schema/typebox';
 
 const Config = T.Object(
   { host: T.String(), port: T.Integer() },