@forgezero/vault 0.1.11 → 0.1.13

package/README.md

@@ -1,7 +1,7 @@
 <!--
   GENERATED FILE — do not edit.
 
-  Change scripts/generate-guides.ts or its typed sources, run `bun run guides`,
+  Change tools/generate-guides.ts or its typed sources, run `bun run guides`,
   and commit the generator and rendered files together.
 -->
 
@@ -9,14 +9,39 @@
 
 One scoped contract over platform-direct, managed-agent and external API-key trust paths.
 
-## Global package root and supported runtimes
+## Package overview
 
-The scoped vault facade. A tenant application uses its local agent or an API key; trusted platform code injects a direct realm backend instead of calling itself. The one package that ends up in somebody else's production dependency tree, which is why it stays alone and stays small. Supported runtimes: bun, node, workers, deno. The global base/root import is @forgezero/vault. Every public import or command is listed below; the documentation inventory is checked in both directions against package.json exports.
+The scoped vault facade. A tenant application uses its local agent or an API key; trusted platform code injects a direct realm backend instead of calling itself. The one package that ends up in somebody else's production dependency tree, which is why it stays alone and stays small. Supported runtimes: bun, node, workers, deno. Package root: @forgezero/vault. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
 
 ```text
-import * as root from '@forgezero/vault';
+bun add @forgezero/vault
 ```
 
+## ForgeZero package family
+
+The five packages are installation boundaries. Choose a package by who installs it; choose a subpath by the capability used in that file.
+
+| package | short description | runtimes | documentation |
+|---|---|---|---|
+| @forgezero/vault | Scoped secret access with Agent, API-key and systemd-credential sources. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/vault-package) |
+| @forgezero/access | Typed route, principal, factor, RBAC and request-pipeline contracts. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/access) |
+| @forgezero/providers | Typed external providers with priority, health and classified fallback. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/providers) |
+| @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
+| @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
+
+## @forgezero/vault public imports and commands
+
+Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
+
+| public entry | short description | runtime | details |
+|---|---|---|---|
+| @forgezero/vault | One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer. | portable | [Details + example](#forgezero-vault) |
+| @forgezero/vault/schema | Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it. | portable | [Details + example](#forgezero-vault-schema) |
+| @forgezero/vault/config | Read `.fz/config.json` — which project, which environment, which secrets, and what to call them. | portable | [Details + example](#forgezero-vault-config) |
+| @forgezero/vault/env | Envless: fill `process.env` from the vault at boot, refusing to run during a build. | portable | [Details + example](#forgezero-vault-env) |
+| @forgezero/vault/frameworks | SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request. | portable | [Details + example](#forgezero-vault-frameworks) |
+| @forgezero/vault/providers | Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero. | portable | [Details + example](#forgezero-vault-providers) |
+
 ## Commands
 
 bun add @forgezero/vault — Install the scoped Vault client and its public subpaths.
@@ -25,63 +50,185 @@ bun add @forgezero/vault — Install the scoped Vault client and its public subp
 bun add @forgezero/vault
 ```
 
+<a id="forgezero-vault"></a>
 ## @forgezero/vault
 
-One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer.
+One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer. This entry exposes 13 named value exports and 12 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/vault';
+import {
+  DEFAULT_API_URL,
+  DEFAULT_REQUEST_TIMEOUT_MS,
+  DEFAULT_SOCKET,
+  ForgeZero,
+  VERSION,
+  VaultError,
+  createVault,
+  directCredentials,
+  discover,
+  managedAgentTransport,
+  signerFromApiKey,
+  systemdCredentials,
+  vaultCredentials,
+} from '@forgezero/vault';
+
+import type {
+  AgentRequest,
+  AgentResponse,
+  AgentTransport,
+  Change,
+  Credential,
+  CredentialMode,
+  DiscoveryEnvironment,
+  EntryMeta,
+  SignRequest,
+  Signer,
+  SystemdCredentialOptions,
+  VaultOptions,
+} from '@forgezero/vault';
 ```
 
-## @forgezero/vault/schema
+## @forgezero/vault — Read a scoped secret
 
-Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it.
+The same client discovers the managed Agent socket or uses an external API-key signer. Project and environment remain explicit.
 
 ```text
-import * as api from '@forgezero/vault/schema';
+import {
+  createVault,
+} from '@forgezero/vault';
+
+const vault = createVault({ project: 'payments', environment: 'production' });
+const token = await vault.get('STRIPE_KEY');
 ```
 
-## @forgezero/vault/config
+<a id="forgezero-vault-schema"></a>
+## @forgezero/vault/schema
 
-Read `.fz/config.json` — which project, which environment, which secrets, and what to call them.
+Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/vault/config';
+import {
+  localSchemas,
+  managedSchemas,
+  preferManaged,
+} from '@forgezero/vault/schema';
+
+import type {
+  SchemaRef,
+  SchemaSource,
+} from '@forgezero/vault/schema';
 ```
 
-## @forgezero/vault/env
+## @forgezero/vault/schema — Managed schema with a local fallback
 
-Envless: fill `process.env` from the vault at boot, refusing to run during a build.
+Managed schemas let ForgeZero render and validate a provider form. Local schemas keep tenant-owned extensions independent. Managed wins when both define the same name; the version travels with the shape and no credential value is stored in the schema.
 
 ```text
-import * as api from '@forgezero/vault/env';
+import {
+  managedSchemas,
+  localSchemas,
+  preferManaged,
+} from '@forgezero/vault/schema';
+import {
+  createVault,
+} from '@forgezero/vault';
+
+const vault = createVault({ project: 'payments', environment: 'production' });
+const schemas = preferManaged(
+  managedSchemas(vault),
+  localSchemas({
+    postmark: { version: 1, schema: {
+      type: 'object', additionalProperties: false,
+      properties: { apiKey: { type: 'string', title: 'API key', writeOnly: true } },
+      required: ['apiKey']
+    } }
+  })
+);
+const { schema, version } = await schemas.get('postmark');
 ```
 
-## @forgezero/vault/frameworks
+<a id="forgezero-vault-config"></a>
+## @forgezero/vault/config
 
-SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request.
+Read `.fz/config.json` — which project, which environment, which secrets, and what to call them. This entry exposes 8 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/vault/frameworks';
+import {
+  CONFIG_PATHS,
+  ConfigError,
+  assertNoSecrets,
+  bindingsOf,
+  exampleConfig,
+  loadConfig,
+  parseConfig,
+  resolveConfig,
+} from '@forgezero/vault/config';
+
+import type {
+  FzConfig,
+  LoadOptions,
+  SecretBinding,
+} from '@forgezero/vault/config';
 ```
 
-## @forgezero/vault/providers
+<a id="forgezero-vault-env"></a>
+## @forgezero/vault/env
 
-Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero.
+Envless: fill `process.env` from the vault at boot, refusing to run during a build. This entry exposes 5 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import * as api from '@forgezero/vault/providers';
+import {
+  EnvError,
+  clearEnv,
+  describeReport,
+  hydrateEnv,
+  isBuildTime,
+} from '@forgezero/vault/env';
+
+import type {
+  HydrateOptions,
+  HydrateReport,
+  SecretReader,
+} from '@forgezero/vault/env';
 ```
 
-## Read a scoped secret
+<a id="forgezero-vault-frameworks"></a>
+## @forgezero/vault/frameworks
 
-The same client discovers the managed Agent socket or uses an external API-key signer. Project and environment remain explicit.
+SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request. This entry exposes 6 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { createVault } from '@forgezero/vault';
+import {
+  bootstrapEnv,
+  forgeZeroHandle,
+  forgeZeroInit,
+  forgeZeroRegister,
+  resetHydration,
+  setupEnv,
+} from '@forgezero/vault/frameworks';
+
+import type {
+  SetupOptions,
+  SvelteKitHandleEvent,
+} from '@forgezero/vault/frameworks';
+```
 
-const vault = createVault({ project: 'payments', environment: 'production' });
-const token = await vault.get('STRIPE_KEY');
+<a id="forgezero-vault-providers"></a>
+## @forgezero/vault/providers
+
+Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero. This entry exposes 2 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  vaultConfig,
+  vaultCredentials,
+} from '@forgezero/vault/providers';
+
+import type {
+  StoredProviderInstance,
+  StoredServiceMethodAttachment,
+  VaultConfigOptions,
+} from '@forgezero/vault/providers';
 ```
 
 ## Three paths, and why they stay explicit
@@ -111,7 +258,9 @@ bun add @forgezero/vault
 The project and environment are explicit application scope. Managed compute uses the local Agent socket; external runtimes use the stable API origin and their scoped key.
 
 ```text
-import { ForgeZero } from '@forgezero/vault';
+import {
+  ForgeZero,
+} from '@forgezero/vault';
 
 const fz = new ForgeZero({ project: 'altpilot', environment: 'production' });
 

package/dist/index.d.ts

@@ -282,4 +282,4 @@ export declare function systemdCredentials(options?: SystemdCredentialOptions):
     readonly name: 'systemd';
     get(reference: string, field: string): Promise<string>;
 };
-export declare const VERSION = "0.1.11";
+export declare const VERSION = "0.1.13";

package/dist/index.js

@@ -382,7 +382,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.11";
+var VERSION = "0.1.13";
 export {
   vaultCredentials,
   systemdCredentials,

package/dist/providers.js

@@ -382,7 +382,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.11";
+var VERSION = "0.1.13";
 
 // src/providers.ts
 var MISSING = new Set(["ENTRY_NOT_FOUND", "VERSION_NOT_FOUND"]);

package/dist/schema.js

@@ -382,7 +382,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.11";
+var VERSION = "0.1.13";
 
 // src/schema.ts
 function managedSchemas(vault, options = {}) {

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@forgezero/vault",
-	"version": "0.1.11",
+  "version": "0.1.13",
   "type": "module",
-	"publishConfig": {
-		"access": "public",
-		"provenance": true
+  "publishConfig": {
+    "access": "public",
+    "provenance": false
   },
   "exports": {
     ".": {
@@ -32,18 +32,17 @@
       "default": "./dist/providers.js"
     }
   },
-	"scripts": {
-		"check": "tsc --noEmit",
-		"prebuild": "rm -rf dist",
-    "build": "bun build src/index.ts src/config.ts src/schema.ts src/env.ts src/frameworks.ts src/providers.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
-    "prepublishOnly": "bun run check && bun run build"
+  "scripts": {
+    "check": "tsc --noEmit",
+    "build": "bun ../tools/package-task.ts build vault",
+    "prepublishOnly": "bun ../tools/package-task.ts prepublish vault"
   },
   "devDependencies": {
     "typescript": "^5.6.0",
     "@types/bun": "latest"
   },
   "dependencies": {
-	"@forgezero/runtime": "^0.1.7"
+    "@forgezero/runtime": "^0.1.9"
   },
   "peerDependencies": {
     "@noble/curves": "^2.2.0",