@forgezero/vault 0.1.12 → 0.1.14

package/README.md

@@ -35,12 +35,12 @@ Every row links to the detailed explanation and named-import/example area below.
 
 | public entry | short description | runtime | details |
 |---|---|---|---|
-| @forgezero/vault | One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer. | portable | [Details + example](#forgezero-vault) |
-| @forgezero/vault/schema | Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it. | portable | [Details + example](#forgezero-vault-schema) |
-| @forgezero/vault/config | Read `.fz/config.json` — which project, which environment, which secrets, and what to call them. | portable | [Details + example](#forgezero-vault-config) |
-| @forgezero/vault/env | Envless: fill `process.env` from the vault at boot, refusing to run during a build. | portable | [Details + example](#forgezero-vault-env) |
-| @forgezero/vault/frameworks | SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request. | portable | [Details + example](#forgezero-vault-frameworks) |
-| @forgezero/vault/providers | Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero. | portable | [Details + example](#forgezero-vault-providers) |
+| @forgezero/vault | One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer. | portable | [Reference + usage](#forgezero-vault) |
+| @forgezero/vault/schema | Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it. | portable | [Reference + usage](#forgezero-vault-schema) |
+| @forgezero/vault/config | Read `.fz/config.json` — which project, which environment, which secrets, and what to call them. | portable | [Reference + usage](#forgezero-vault-config) |
+| @forgezero/vault/env | Envless: fill `process.env` from the vault at boot, refusing to run during a build. | portable | [Reference + usage](#forgezero-vault-env) |
+| @forgezero/vault/frameworks | SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request. | portable | [Reference + usage](#forgezero-vault-frameworks) |
+| @forgezero/vault/providers | Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero. | portable | [Reference + usage](#forgezero-vault-providers) |
 
 ## Commands
 
@@ -53,14 +53,39 @@ bun add @forgezero/vault
 <a id="forgezero-vault"></a>
 ## @forgezero/vault
 
-One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer. Named value imports: DEFAULT_API_URL, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_SOCKET, ForgeZero, VERSION, VaultError, createVault, directCredentials, discover, managedAgentTransport, signerFromApiKey, systemdCredentials, vaultCredentials. Named type imports: AgentRequest, AgentResponse, AgentTransport, Change, Credential, CredentialMode, DiscoveryEnvironment, EntryMeta, SignRequest, Signer, SystemdCredentialOptions, VaultOptions. Import only the names used by this file.
+One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer. This entry exposes 13 named value exports and 12 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEFAULT_API_URL, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_SOCKET, ForgeZero, VERSION, VaultError } from '@forgezero/vault';
-import { createVault, directCredentials, discover, managedAgentTransport, signerFromApiKey, systemdCredentials } from '@forgezero/vault';
-import { vaultCredentials } from '@forgezero/vault';
-import type { AgentRequest, AgentResponse, AgentTransport, Change, Credential, CredentialMode } from '@forgezero/vault';
-import type { DiscoveryEnvironment, EntryMeta, SignRequest, Signer, SystemdCredentialOptions, VaultOptions } from '@forgezero/vault';
+import {
+  DEFAULT_API_URL,
+  DEFAULT_REQUEST_TIMEOUT_MS,
+  DEFAULT_SOCKET,
+  ForgeZero,
+  VERSION,
+  VaultError,
+  createVault,
+  directCredentials,
+  discover,
+  managedAgentTransport,
+  signerFromApiKey,
+  systemdCredentials,
+  vaultCredentials,
+} from '@forgezero/vault';
+
+import type {
+  AgentRequest,
+  AgentResponse,
+  AgentTransport,
+  Change,
+  Credential,
+  CredentialMode,
+  DiscoveryEnvironment,
+  EntryMeta,
+  SignRequest,
+  Signer,
+  SystemdCredentialOptions,
+  VaultOptions,
+} from '@forgezero/vault';
 ```
 
 ## @forgezero/vault — Read a scoped secret
@@ -68,7 +93,9 @@ import type { DiscoveryEnvironment, EntryMeta, SignRequest, Signer, SystemdCrede
 The same client discovers the managed Agent socket or uses an external API-key signer. Project and environment remain explicit.
 
 ```text
-import { createVault } from '@forgezero/vault';
+import {
+  createVault,
+} from '@forgezero/vault';
 
 const vault = createVault({ project: 'payments', environment: 'production' });
 const token = await vault.get('STRIPE_KEY');
@@ -77,11 +104,19 @@ const token = await vault.get('STRIPE_KEY');
 <a id="forgezero-vault-schema"></a>
 ## @forgezero/vault/schema
 
-Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it. Named value imports: localSchemas, managedSchemas, preferManaged. Named type imports: SchemaRef, SchemaSource. Import only the names used by this file.
+Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it. This entry exposes 3 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { localSchemas, managedSchemas, preferManaged } from '@forgezero/vault/schema';
-import type { SchemaRef, SchemaSource } from '@forgezero/vault/schema';
+import {
+  localSchemas,
+  managedSchemas,
+  preferManaged,
+} from '@forgezero/vault/schema';
+
+import type {
+  SchemaRef,
+  SchemaSource,
+} from '@forgezero/vault/schema';
 ```
 
 ## @forgezero/vault/schema — Managed schema with a local fallback
@@ -89,8 +124,14 @@ import type { SchemaRef, SchemaSource } from '@forgezero/vault/schema';
 Managed schemas let ForgeZero render and validate a provider form. Local schemas keep tenant-owned extensions independent. Managed wins when both define the same name; the version travels with the shape and no credential value is stored in the schema.
 
 ```text
-import { managedSchemas, localSchemas, preferManaged } from '@forgezero/vault/schema';
-import { createVault } from '@forgezero/vault';
+import {
+  managedSchemas,
+  localSchemas,
+  preferManaged,
+} from '@forgezero/vault/schema';
+import {
+  createVault,
+} from '@forgezero/vault';
 
 const vault = createVault({ project: 'payments', environment: 'production' });
 const schemas = preferManaged(
@@ -109,42 +150,133 @@ const { schema, version } = await schemas.get('postmark');
 <a id="forgezero-vault-config"></a>
 ## @forgezero/vault/config
 
-Read `.fz/config.json` — which project, which environment, which secrets, and what to call them. Named value imports: CONFIG_PATHS, ConfigError, assertNoSecrets, bindingsOf, exampleConfig, loadConfig, parseConfig, resolveConfig. Named type imports: FzConfig, LoadOptions, SecretBinding. Import only the names used by this file.
+Read `.fz/config.json` — which project, which environment, which secrets, and what to call them. This entry exposes 8 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { CONFIG_PATHS, ConfigError, assertNoSecrets, bindingsOf, exampleConfig, loadConfig } from '@forgezero/vault/config';
-import { parseConfig, resolveConfig } from '@forgezero/vault/config';
-import type { FzConfig, LoadOptions, SecretBinding } from '@forgezero/vault/config';
+import {
+  CONFIG_PATHS,
+  ConfigError,
+  assertNoSecrets,
+  bindingsOf,
+  exampleConfig,
+  loadConfig,
+  parseConfig,
+  resolveConfig,
+} from '@forgezero/vault/config';
+
+import type {
+  FzConfig,
+  LoadOptions,
+  SecretBinding,
+} from '@forgezero/vault/config';
+```
+
+## @forgezero/vault/config — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  CONFIG_PATHS,
+} from '@forgezero/vault/config';
+
+export const selectedCapability = CONFIG_PATHS;
 ```
 
 <a id="forgezero-vault-env"></a>
 ## @forgezero/vault/env
 
-Envless: fill `process.env` from the vault at boot, refusing to run during a build. Named value imports: EnvError, clearEnv, describeReport, hydrateEnv, isBuildTime. Named type imports: HydrateOptions, HydrateReport, SecretReader. Import only the names used by this file.
+Envless: fill `process.env` from the vault at boot, refusing to run during a build. This entry exposes 5 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { EnvError, clearEnv, describeReport, hydrateEnv, isBuildTime } from '@forgezero/vault/env';
-import type { HydrateOptions, HydrateReport, SecretReader } from '@forgezero/vault/env';
+import {
+  EnvError,
+  clearEnv,
+  describeReport,
+  hydrateEnv,
+  isBuildTime,
+} from '@forgezero/vault/env';
+
+import type {
+  HydrateOptions,
+  HydrateReport,
+  SecretReader,
+} from '@forgezero/vault/env';
+```
+
+## @forgezero/vault/env — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  EnvError,
+} from '@forgezero/vault/env';
+
+export const selectedCapability = EnvError;
 ```
 
 <a id="forgezero-vault-frameworks"></a>
 ## @forgezero/vault/frameworks
 
-SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request. Named value imports: bootstrapEnv, forgeZeroHandle, forgeZeroInit, forgeZeroRegister, resetHydration, setupEnv. Named type imports: SetupOptions, SvelteKitHandleEvent. Import only the names used by this file.
+SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request. This entry exposes 6 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { bootstrapEnv, forgeZeroHandle, forgeZeroInit, forgeZeroRegister, resetHydration, setupEnv } from '@forgezero/vault/frameworks';
-import type { SetupOptions, SvelteKitHandleEvent } from '@forgezero/vault/frameworks';
+import {
+  bootstrapEnv,
+  forgeZeroHandle,
+  forgeZeroInit,
+  forgeZeroRegister,
+  resetHydration,
+  setupEnv,
+} from '@forgezero/vault/frameworks';
+
+import type {
+  SetupOptions,
+  SvelteKitHandleEvent,
+} from '@forgezero/vault/frameworks';
+```
+
+## @forgezero/vault/frameworks — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  bootstrapEnv,
+} from '@forgezero/vault/frameworks';
+
+export const selectedCapability = bootstrapEnv;
 ```
 
 <a id="forgezero-vault-providers"></a>
 ## @forgezero/vault/providers
 
-Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero. Named value imports: vaultConfig, vaultCredentials. Named type imports: StoredProviderInstance, StoredServiceMethodAttachment, VaultConfigOptions. Import only the names used by this file.
+Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero. This entry exposes 2 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { vaultConfig, vaultCredentials } from '@forgezero/vault/providers';
-import type { StoredProviderInstance, StoredServiceMethodAttachment, VaultConfigOptions } from '@forgezero/vault/providers';
+import {
+  vaultConfig,
+  vaultCredentials,
+} from '@forgezero/vault/providers';
+
+import type {
+  StoredProviderInstance,
+  StoredServiceMethodAttachment,
+  VaultConfigOptions,
+} from '@forgezero/vault/providers';
+```
+
+## @forgezero/vault/providers — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  vaultConfig,
+} from '@forgezero/vault/providers';
+
+export const selectedCapability = vaultConfig;
 ```
 
 ## Three paths, and why they stay explicit
@@ -174,7 +306,9 @@ bun add @forgezero/vault
 The project and environment are explicit application scope. Managed compute uses the local Agent socket; external runtimes use the stable API origin and their scoped key.
 
 ```text
-import { ForgeZero } from '@forgezero/vault';
+import {
+  ForgeZero,
+} from '@forgezero/vault';
 
 const fz = new ForgeZero({ project: 'altpilot', environment: 'production' });
 

package/dist/index.d.ts

@@ -282,4 +282,4 @@ export declare function systemdCredentials(options?: SystemdCredentialOptions):
     readonly name: 'systemd';
     get(reference: string, field: string): Promise<string>;
 };
-export declare const VERSION = "0.1.12";
+export declare const VERSION = "0.1.14";

package/dist/index.js

@@ -382,7 +382,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.12";
+var VERSION = "0.1.14";
 export {
   vaultCredentials,
   systemdCredentials,

package/dist/providers.js

@@ -382,7 +382,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.12";
+var VERSION = "0.1.14";
 
 // src/providers.ts
 var MISSING = new Set(["ENTRY_NOT_FOUND", "VERSION_NOT_FOUND"]);

package/dist/schema.js

@@ -382,7 +382,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.12";
+var VERSION = "0.1.14";
 
 // src/schema.ts
 function managedSchemas(vault, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/vault",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -42,7 +42,7 @@
     "@types/bun": "latest"
   },
   "dependencies": {
-    "@forgezero/runtime": "^0.1.8"
+    "@forgezero/runtime": "^0.1.10"
   },
   "peerDependencies": {
     "@noble/curves": "^2.2.0",