@open-mercato/cli 0.6.7-develop.6795.1.8a3f27921c → 0.6.7-develop.6824.1.21fff90682

package/dist/agentic/guides/modules/audit_logs.md

@@ -1,13 +1,13 @@
 # audit_logs — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.6.7-develop.6795.1.8a3f27921c; core 0.6.7-develop.6795.1.8a3f27921c — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.6.7-develop.6824.1.21fff90682; core 0.6.7-develop.6824.1.21fff90682 — R1 staleness stamp -->
 Source root: [node_modules/@open-mercato/core/src/modules/audit_logs](../../../node_modules/@open-mercato/core/src/modules/audit_logs)
 
 ## Entities
 
-| Entity ID | Class | Table | Editable | CustomFields |
-|---|---|---|---|---|
-| audit_logs:action_log | ActionLog | action_logs | yes | no |
-| audit_logs:access_log | AccessLog | access_logs | no | no |
+| Entity ID | Class | Table | Editable | CustomFields | Source |
+|---|---|---|---|---|---|
+| audit_logs:action_log | ActionLog | action_logs | yes | no | [node_modules/@open-mercato/core/src/modules/audit_logs/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/data/entities.ts) |
+| audit_logs:access_log | AccessLog | access_logs | no | no | [node_modules/@open-mercato/core/src/modules/audit_logs/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/data/entities.ts) |
 
 ## Events  (0)
 
@@ -15,7 +15,14 @@ _none_
 
 ## ACL features  (6)
 
-audit_logs.view_self · audit_logs.view_tenant · audit_logs.undo_self · audit_logs.undo_tenant · audit_logs.redo_self · audit_logs.redo_tenant
+| Feature | Source |
+|---|---|
+| audit_logs.view_self | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| audit_logs.view_tenant | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| audit_logs.undo_self | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| audit_logs.undo_tenant | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| audit_logs.redo_self | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| audit_logs.redo_tenant | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
 
 ## API routes
 
@@ -33,7 +40,10 @@ _none_
 
 ## DI service tokens
 
-actionLogService · accessLogService
+| Token | Source |
+|---|---|
+| actionLogService | [node_modules/@open-mercato/core/src/modules/audit_logs/di.ts:8](../../../node_modules/@open-mercato/core/src/modules/audit_logs/di.ts#L8) |
+| accessLogService | [node_modules/@open-mercato/core/src/modules/audit_logs/di.ts:12](../../../node_modules/@open-mercato/core/src/modules/audit_logs/di.ts#L12) |
 
 ## Search entities
 
@@ -46,33 +56,45 @@ _none_
 
 ## UMES hosts
 
-| ID / pattern | Family | Supports | Context | Stability |
-|---|---|---|---|---|
-| data-table:audit_logs.access.list | data-table | component-replacement | — | FROZEN |
-| data-table:audit_logs.access.list:bulk-actions | data-table | bulk-action | — | FROZEN |
-| data-table:audit_logs.access.list:columns | data-table | column-widget | — | FROZEN |
-| data-table:audit_logs.access.list:filters | data-table | filter-widget | — | FROZEN |
-| data-table:audit_logs.access.list:footer | data-table | render-widget | — | FROZEN |
-| data-table:audit_logs.access.list:header | data-table | render-widget | — | FROZEN |
-| data-table:audit_logs.access.list:row-actions | data-table | row-action | — | FROZEN |
-| data-table:audit_logs.access.list:search-trailing | data-table | render-widget | — | FROZEN |
-| data-table:audit_logs.access.list:toolbar | data-table | toolbar-widget | — | FROZEN |
-| data-table:audit_logs.actions.list | data-table | component-replacement | — | FROZEN |
-| data-table:audit_logs.actions.list:bulk-actions | data-table | bulk-action | — | FROZEN |
-| data-table:audit_logs.actions.list:columns | data-table | column-widget | — | FROZEN |
-| data-table:audit_logs.actions.list:filters | data-table | filter-widget | — | FROZEN |
-| data-table:audit_logs.actions.list:footer | data-table | render-widget | — | FROZEN |
-| data-table:audit_logs.actions.list:header | data-table | render-widget | — | FROZEN |
-| data-table:audit_logs.actions.list:row-actions | data-table | row-action | — | FROZEN |
-| data-table:audit_logs.actions.list:search-trailing | data-table | render-widget | — | FROZEN |
-| data-table:audit_logs.actions.list:toolbar | data-table | toolbar-widget | — | FROZEN |
-| audit_logs:access_log | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| audit_logs:action_log | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
+| ID / pattern | Family | Supports | Context | Stability | Source |
+|---|---|---|---|---|---|
+| data-table:audit_logs.access.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.access.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.access.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.access.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.access.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.access.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.access.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.access.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.access.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| data-table:audit_logs.actions.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/extension-points.ts) |
+| audit_logs:access_log | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:audit_logs:access_log |
+| audit_logs:action_log | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:audit_logs:action_log |
 
 ## UMES contributions
 
 _none_
 
+## Active extension bindings
+
+_none_
+
+## Incoming installed contributions
+
+_none_
+
+## Contribution resolutions
+
+_none_
+
 ## UMES diagnostics
 
 - unbound-helper: data-table:audit_logs.access.list:empty-state
@@ -95,3 +117,47 @@ _none_
 ## AI agents
 
 _none_
+
+## Exact override targets
+
+| Domain | Path / key | Supported modes | Referenced fact | Source |
+|---|---|---|---|---|
+| acl | `overrides.acl.features["audit_logs.redo_self"]` | disable-replace | aclFeatures:audit_logs.redo_self | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| acl | `overrides.acl.features["audit_logs.redo_tenant"]` | disable-replace | aclFeatures:audit_logs.redo_tenant | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| acl | `overrides.acl.features["audit_logs.undo_self"]` | disable-replace | aclFeatures:audit_logs.undo_self | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| acl | `overrides.acl.features["audit_logs.undo_tenant"]` | disable-replace | aclFeatures:audit_logs.undo_tenant | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| acl | `overrides.acl.features["audit_logs.view_self"]` | disable-replace | aclFeatures:audit_logs.view_self | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| acl | `overrides.acl.features["audit_logs.view_tenant"]` | disable-replace | aclFeatures:audit_logs.view_tenant | [node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/acl.ts) |
+| cli | `overrides.cli["projections:backfill"]` | disable-replace | cliCommands:projections:backfill | [node_modules/@open-mercato/core/src/modules/audit_logs/cli.ts](../../../node_modules/@open-mercato/core/src/modules/audit_logs/cli.ts) |
+| di | `overrides.di["accessLogService"]` | disable-replace | ownedContracts.di-registration:accessLogService | [node_modules/@open-mercato/core/src/modules/audit_logs/di.ts:12](../../../node_modules/@open-mercato/core/src/modules/audit_logs/di.ts#L12) |
+| di | `overrides.di["actionLogService"]` | disable-replace | ownedContracts.di-registration:actionLogService | [node_modules/@open-mercato/core/src/modules/audit_logs/di.ts:8](../../../node_modules/@open-mercato/core/src/modules/audit_logs/di.ts#L8) |
+| encryption | `overrides.encryption.maps["audit_logs:access_log"]` | disable-replace | ownedContracts.encryption:audit_logs:access_log | [node_modules/@open-mercato/core/src/modules/audit_logs/encryption.ts:16](../../../node_modules/@open-mercato/core/src/modules/audit_logs/encryption.ts#L16) |
+| encryption | `overrides.encryption.maps["audit_logs:action_log"]` | disable-replace | ownedContracts.encryption:audit_logs:action_log | [node_modules/@open-mercato/core/src/modules/audit_logs/encryption.ts:4](../../../node_modules/@open-mercato/core/src/modules/audit_logs/encryption.ts#L4) |
+| routes | `overrides.routes.pages["backend:/backend/audit-logs"]` | disable-replace | backendPages:/backend/audit-logs | [node_modules/@open-mercato/core/src/modules/audit_logs/backend/audit-logs/page.tsx](../../../node_modules/@open-mercato/core/src/modules/audit_logs/backend/audit-logs/page.tsx) |
+| setup | `overrides.setup.defaultRoleFeatures` | replace | ownedContracts.setup:audit_logs:setup | [node_modules/@open-mercato/core/src/modules/audit_logs/setup.ts:3](../../../node_modules/@open-mercato/core/src/modules/audit_logs/setup.ts#L3) |
+
+## Owned contract — module metadata
+
+| ID | Metadata | Source |
+|---|---|---|
+| audit_logs | name=audit_logs; version=0.1.0 | [node_modules/@open-mercato/core/src/modules/audit_logs/index.ts:3](../../../node_modules/@open-mercato/core/src/modules/audit_logs/index.ts#L3) |
+
+## Setup
+
+| ID | Metadata | Source |
+|---|---|---|
+| audit_logs:setup | roles=admin, employee | [node_modules/@open-mercato/core/src/modules/audit_logs/setup.ts:3](../../../node_modules/@open-mercato/core/src/modules/audit_logs/setup.ts#L3) |
+
+## Encryption
+
+| ID | Metadata | Source |
+|---|---|---|
+| audit_logs:access_log | fields=context_json, fields_json, resource_id | [node_modules/@open-mercato/core/src/modules/audit_logs/encryption.ts:16](../../../node_modules/@open-mercato/core/src/modules/audit_logs/encryption.ts#L16) |
+| audit_logs:action_log | fields=action_label, changes_json, command_id, command_payload, context_json, snapshot_after, snapshot_before | [node_modules/@open-mercato/core/src/modules/audit_logs/encryption.ts:4](../../../node_modules/@open-mercato/core/src/modules/audit_logs/encryption.ts#L4) |
+
+## DI registrations (rich)
+
+| Token | Kind | Lifetime | Injection | Provider | Source |
+|---|---|---|---|---|---|
+| accessLogService | class | scoped | — | AccessLogService | [node_modules/@open-mercato/core/src/modules/audit_logs/di.ts:12](../../../node_modules/@open-mercato/core/src/modules/audit_logs/di.ts#L12) |
+| actionLogService | class | scoped | — | ActionLogService | [node_modules/@open-mercato/core/src/modules/audit_logs/di.ts:8](../../../node_modules/@open-mercato/core/src/modules/audit_logs/di.ts#L8) |

package/dist/agentic/guides/modules/auth.md

@@ -1,43 +1,52 @@
 # auth — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.6.7-develop.6795.1.8a3f27921c; core 0.6.7-develop.6795.1.8a3f27921c — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.6.7-develop.6824.1.21fff90682; core 0.6.7-develop.6824.1.21fff90682 — R1 staleness stamp -->
 Source root: [node_modules/@open-mercato/core/src/modules/auth](../../../node_modules/@open-mercato/core/src/modules/auth)
 
 ## Entities
 
-| Entity ID | Class | Table | Editable | CustomFields |
-|---|---|---|---|---|
-| auth:user | User | users | yes | no |
-| auth:role | Role | roles | yes | no |
-| auth:user_sidebar_preference | UserSidebarPreference | user_sidebar_preferences | yes | no |
-| auth:role_sidebar_preference | RoleSidebarPreference | role_sidebar_preferences | yes | no |
-| auth:sidebar_variant | SidebarVariant | sidebar_variants | yes | no |
-| auth:user_role | UserRole | user_roles | no | no |
-| auth:session | Session | sessions | no | no |
-| auth:password_reset | PasswordReset | password_resets | no | no |
-| auth:role_acl | RoleAcl | role_acls | yes | no |
-| auth:user_acl | UserAcl | user_acls | yes | no |
-| auth:user_consent | UserConsent | user_consents | yes | no |
+| Entity ID | Class | Table | Editable | CustomFields | Source |
+|---|---|---|---|---|---|
+| auth:user | User | users | yes | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:role | Role | roles | yes | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:user_sidebar_preference | UserSidebarPreference | user_sidebar_preferences | yes | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:role_sidebar_preference | RoleSidebarPreference | role_sidebar_preferences | yes | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:sidebar_variant | SidebarVariant | sidebar_variants | yes | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:user_role | UserRole | user_roles | no | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:session | Session | sessions | no | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:password_reset | PasswordReset | password_resets | no | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:role_acl | RoleAcl | role_acls | yes | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:user_acl | UserAcl | user_acls | yes | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
+| auth:user_consent | UserConsent | user_consents | yes | no | [node_modules/@open-mercato/core/src/modules/auth/data/entities.ts](../../../node_modules/@open-mercato/core/src/modules/auth/data/entities.ts) |
 
 ## Events  (12)
 
-| ID | Category | Entity | Browser transport |
-|---|---|---|---|
-| auth.user.created | crud | user | — |
-| auth.user.updated | crud | user | — |
-| auth.user.deleted | crud | user | — |
-| auth.role.created | crud | role | — |
-| auth.role.updated | crud | role | — |
-| auth.role.deleted | crud | role | — |
-| auth.login.success | lifecycle | — | — |
-| auth.login.failed | lifecycle | — | — |
-| auth.logout | lifecycle | — | — |
-| auth.password.changed | lifecycle | — | — |
-| auth.password.reset.requested | lifecycle | — | — |
-| auth.password.reset.completed | lifecycle | — | — |
+| ID | Category | Entity | Browser transport | Source |
+|---|---|---|---|---|
+| auth.user.created | crud | user | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.user.updated | crud | user | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.user.deleted | crud | user | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.role.created | crud | role | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.role.updated | crud | role | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.role.deleted | crud | role | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.login.success | lifecycle | — | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.login.failed | lifecycle | — | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.logout | lifecycle | — | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.password.changed | lifecycle | — | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.password.reset.requested | lifecycle | — | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
+| auth.password.reset.completed | lifecycle | — | — | [node_modules/@open-mercato/core/src/modules/auth/events.ts](../../../node_modules/@open-mercato/core/src/modules/auth/events.ts) |
 
 ## ACL features  (8)
 
-auth.users.list · auth.users.create · auth.users.edit · auth.users.delete · auth.roles.list · auth.roles.manage · auth.acl.manage · auth.sidebar.manage
+| Feature | Source |
+|---|---|
+| auth.users.list | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| auth.users.create | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| auth.users.edit | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| auth.users.delete | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| auth.roles.list | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| auth.roles.manage | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| auth.acl.manage | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| auth.sidebar.manage | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
 
 ## API routes
 
@@ -69,7 +78,10 @@ _none_
 
 ## DI service tokens
 
-authService · rbacService
+| Token | Source |
+|---|---|
+| authService | [node_modules/@open-mercato/core/src/modules/auth/di.ts:17](../../../node_modules/@open-mercato/core/src/modules/auth/di.ts#L17) |
+| rbacService | [node_modules/@open-mercato/core/src/modules/auth/di.ts:27](../../../node_modules/@open-mercato/core/src/modules/auth/di.ts#L27) |
 
 ## Search entities
 
@@ -82,62 +94,93 @@ _none_
 
 ## UMES hosts
 
-| ID / pattern | Family | Supports | Context | Stability |
-|---|---|---|---|---|
-| data-table:auth.roles.list | data-table | component-replacement | — | FROZEN |
-| data-table:auth.roles.list:bulk-actions | data-table | bulk-action | — | FROZEN |
-| data-table:auth.roles.list:columns | data-table | column-widget | — | FROZEN |
-| data-table:auth.roles.list:filters | data-table | filter-widget | — | FROZEN |
-| data-table:auth.roles.list:footer | data-table | render-widget | — | FROZEN |
-| data-table:auth.roles.list:header | data-table | render-widget | — | FROZEN |
-| data-table:auth.roles.list:row-actions | data-table | row-action | — | FROZEN |
-| data-table:auth.roles.list:search-trailing | data-table | render-widget | — | FROZEN |
-| data-table:auth.roles.list:toolbar | data-table | toolbar-widget | — | FROZEN |
-| data-table:auth.users.list | data-table | component-replacement | — | FROZEN |
-| data-table:auth.users.list:bulk-actions | data-table | bulk-action | — | FROZEN |
-| data-table:auth.users.list:columns | data-table | column-widget | — | FROZEN |
-| data-table:auth.users.list:filters | data-table | filter-widget | — | FROZEN |
-| data-table:auth.users.list:footer | data-table | render-widget | — | FROZEN |
-| data-table:auth.users.list:header | data-table | render-widget | — | FROZEN |
-| data-table:auth.users.list:row-actions | data-table | row-action | — | FROZEN |
-| data-table:auth.users.list:search-trailing | data-table | render-widget | — | FROZEN |
-| data-table:auth.users.list:toolbar | data-table | toolbar-widget | — | FROZEN |
-| auth:password_reset | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:role | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:role_acl | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:role_sidebar_preference | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:session | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:sidebar_variant | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:user | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:user_acl | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:user_consent | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:user_role | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth:user_sidebar_preference | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE |
-| auth.user | entity | response-enricher, query-enricher, mutation-guard | tenant-and-organization | STABLE |
-| auth.login.failed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.login.success | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.logout | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.password.changed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.password.reset.completed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.password.reset.requested | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.role.created | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.role.deleted | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.role.updated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.user.created | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.user.deleted | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.user.updated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE |
-| auth.login:form | generic | render-widget | auth.login-form.v1 | FROZEN |
+| ID / pattern | Family | Supports | Context | Stability | Source |
+|---|---|---|---|---|---|
+| data-table:auth.roles.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.roles.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.roles.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.roles.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.roles.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.roles.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.roles.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.roles.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.roles.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| data-table:auth.users.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+| auth:password_reset | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:password_reset |
+| auth:role | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:role |
+| auth:role_acl | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:role_acl |
+| auth:role_sidebar_preference | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:role_sidebar_preference |
+| auth:session | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:session |
+| auth:sidebar_variant | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:sidebar_variant |
+| auth:user | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:user |
+| auth:user_acl | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:user_acl |
+| auth:user_consent | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:user_consent |
+| auth:user_role | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:user_role |
+| auth:user_sidebar_preference | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:auth:user_sidebar_preference |
+| auth.user | entity | response-enricher, query-enricher, mutation-guard | tenant-and-organization | STABLE | [node_modules/@open-mercato/core/src/modules/auth/api/users/resend-invite/route.ts](../../../node_modules/@open-mercato/core/src/modules/auth/api/users/resend-invite/route.ts) |
+| auth.login.failed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.login.failed |
+| auth.login.success | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.login.success |
+| auth.logout | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.logout |
+| auth.password.changed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.password.changed |
+| auth.password.reset.completed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.password.reset.completed |
+| auth.password.reset.requested | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.password.reset.requested |
+| auth.role.created | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.role.created |
+| auth.role.deleted | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.role.deleted |
+| auth.role.updated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.role.updated |
+| auth.user.created | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.user.created |
+| auth.user.deleted | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.user.deleted |
+| auth.user.updated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:auth.user.updated |
+| auth.login:form | generic | render-widget | auth.login-form.v1 | FROZEN | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
 
 ## UMES contributions
 
-| ID | Kind | Target | Phase / operations | Contract | Resolution |
+| ID | Kind | Target | Phase / operations | Contract | Resolution | Source |
+|---|---|---|---|---|---|---|
+| notification:auth.account.locked | specialized-registry | auth.account.locked | — | registry=notification; registryId=auth.account.locked; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.login.new_device | specialized-registry | auth.login.new_device | — | registry=notification; registryId=auth.login.new_device; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.password_reset.completed | specialized-registry | auth.password_reset.completed | — | registry=notification; registryId=auth.password_reset.completed; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.password_reset.requested | specialized-registry | auth.password_reset.requested | — | registry=notification; registryId=auth.password_reset.requested; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.role.assigned | specialized-registry | auth.role.assigned | — | registry=notification; registryId=auth.role.assigned; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.role.revoked | specialized-registry | auth.role.revoked | — | registry=notification; registryId=auth.role.revoked; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+
+## Active extension bindings
+
+| Activation | Kind | Host | Contribution kinds | Phases | Bridge | Source |
+|---|---|---|---|---|---|---|
+| command:auth.users.update:command-interceptor-bridge | command-interceptor-bridge | command:auth.users.update @auth | command-interceptor | — | ownedContracts.command:auth.users.update | [node_modules/@open-mercato/core/src/modules/auth/commands/users.ts](../../../node_modules/@open-mercato/core/src/modules/auth/commands/users.ts) |
+| entity:auth.user:mutation-guard | mutation-guard | entity:auth.user @auth | mutation-guard | — | — | [node_modules/@open-mercato/core/src/modules/auth/api/users/resend-invite/route.ts:119](../../../node_modules/@open-mercato/core/src/modules/auth/api/users/resend-invite/route.ts#L119) |
+| widget-spot:auth.login:form:widget-injection-consumer | widget-injection-consumer | widget-spot:auth.login:form @auth | widget, data-table, crud-form | — | hosts:loginForm | [node_modules/@open-mercato/core/src/modules/auth/extension-points.ts](../../../node_modules/@open-mercato/core/src/modules/auth/extension-points.ts) |
+
+## Incoming installed contributions
+
+| Contributor | Kind | Target | Resolution | Activation | Contribution · Source |
 |---|---|---|---|---|---|
-| notification:auth.account.locked | specialized-registry | auth.account.locked | — | registry=notification; registryId=auth.account.locked; specialistRoute=notifications | fact-ref |
-| notification:auth.login.new_device | specialized-registry | auth.login.new_device | — | registry=notification; registryId=auth.login.new_device; specialistRoute=notifications | fact-ref |
-| notification:auth.password_reset.completed | specialized-registry | auth.password_reset.completed | — | registry=notification; registryId=auth.password_reset.completed; specialistRoute=notifications | fact-ref |
-| notification:auth.password_reset.requested | specialized-registry | auth.password_reset.requested | — | registry=notification; registryId=auth.password_reset.requested; specialistRoute=notifications | fact-ref |
-| notification:auth.role.assigned | specialized-registry | auth.role.assigned | — | registry=notification; registryId=auth.role.assigned; specialistRoute=notifications | fact-ref |
-| notification:auth.role.revoked | specialized-registry | auth.role.revoked | — | registry=notification; registryId=auth.role.revoked; specialistRoute=notifications | fact-ref |
+| communication_channels | subscriber | event:auth.user.deleted @auth | capability-only | — | communication_channels:user-deleted-cascade · [node_modules/@open-mercato/core/src/modules/communication_channels/subscribers/user-deleted-cascade.ts](../../../node_modules/@open-mercato/core/src/modules/communication_channels/subscribers/user-deleted-cascade.ts) |
+| communication_channels | entity-extension | entity:auth:user @auth | capability-only | — | communication_channels.entity-extension.2:auth:user->communication_channels:external_conversation · [node_modules/@open-mercato/core/src/modules/communication_channels/data/extensions.ts](../../../node_modules/@open-mercato/core/src/modules/communication_channels/data/extensions.ts) |
+| communication_channels | entity-extension | entity:auth:user @auth | capability-only | — | communication_channels.entity-extension.4:auth:user->communication_channels:communication_channel · [node_modules/@open-mercato/core/src/modules/communication_channels/data/extensions.ts](../../../node_modules/@open-mercato/core/src/modules/communication_channels/data/extensions.ts) |
+| communication_channels | entity-extension | entity:auth:user @auth | capability-only | — | communication_channels.entity-extension.5:auth:user->integrations:integration_credentials · [node_modules/@open-mercato/core/src/modules/communication_channels/data/extensions.ts](../../../node_modules/@open-mercato/core/src/modules/communication_channels/data/extensions.ts) |
+| security | command-interceptor | command:auth.users.update @auth | bound | command:auth.users.update:command-interceptor-bridge | security.block-legacy-self-password-change · [node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts) |
+| sso | subscriber | event:auth.user.deleted @auth | capability-only | — | sso:user-deleted-cleanup · [node_modules/@open-mercato/enterprise/src/modules/sso/subscribers/user-deleted-cleanup.ts](../../../node_modules/@open-mercato/enterprise/src/modules/sso/subscribers/user-deleted-cleanup.ts) |
+| sso | widget | widget-spot:auth.login:form @auth | bound | widget-spot:auth.login:form:widget-injection-consumer | sso.injection.login-sso@auth.login:form · [node_modules/@open-mercato/enterprise/src/modules/sso/widgets/injection-table.ts](../../../node_modules/@open-mercato/enterprise/src/modules/sso/widgets/injection-table.ts) |
+
+## Contribution resolutions
+
+| Contribution | Target | Resolution | Activations | Source |
+|---|---|---|---|---|
+| notification:auth.account.locked | module:auth.account.locked | capability-only | — | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.login.new_device | module:auth.login.new_device | capability-only | — | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.password_reset.completed | module:auth.password_reset.completed | capability-only | — | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.password_reset.requested | module:auth.password_reset.requested | capability-only | — | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.role.assigned | module:auth.role.assigned | capability-only | — | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notification:auth.role.revoked | module:auth.role.revoked | capability-only | — | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
 
 ## UMES diagnostics
 
@@ -146,7 +189,14 @@ _none_
 
 ## Notifications
 
-auth.password_reset.requested · auth.password_reset.completed · auth.account.locked · auth.login.new_device · auth.role.assigned · auth.role.revoked
+| Notification ID | Source |
+|---|---|
+| auth.password_reset.requested | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| auth.password_reset.completed | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| auth.account.locked | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| auth.login.new_device | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| auth.role.assigned | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| auth.role.revoked | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
 
 ## CLI commands
 
@@ -170,3 +220,88 @@ _none_
 ## AI agents
 
 _none_
+
+## Exact override targets
+
+| Domain | Path / key | Supported modes | Referenced fact | Source |
+|---|---|---|---|---|
+| acl | `overrides.acl.features["auth.acl.manage"]` | disable-replace | aclFeatures:auth.acl.manage | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| acl | `overrides.acl.features["auth.roles.list"]` | disable-replace | aclFeatures:auth.roles.list | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| acl | `overrides.acl.features["auth.roles.manage"]` | disable-replace | aclFeatures:auth.roles.manage | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| acl | `overrides.acl.features["auth.sidebar.manage"]` | disable-replace | aclFeatures:auth.sidebar.manage | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| acl | `overrides.acl.features["auth.users.create"]` | disable-replace | aclFeatures:auth.users.create | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| acl | `overrides.acl.features["auth.users.delete"]` | disable-replace | aclFeatures:auth.users.delete | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| acl | `overrides.acl.features["auth.users.edit"]` | disable-replace | aclFeatures:auth.users.edit | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| acl | `overrides.acl.features["auth.users.list"]` | disable-replace | aclFeatures:auth.users.list | [node_modules/@open-mercato/core/src/modules/auth/acl.ts](../../../node_modules/@open-mercato/core/src/modules/auth/acl.ts) |
+| cli | `overrides.cli["add-org"]` | disable-replace | cliCommands:add-org | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["add-user"]` | disable-replace | cliCommands:add-user | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["list-orgs"]` | disable-replace | cliCommands:list-orgs | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["list-tenants"]` | disable-replace | cliCommands:list-tenants | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["list-users"]` | disable-replace | cliCommands:list-users | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["rotate-encryption-key"]` | disable-replace | cliCommands:rotate-encryption-key | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["seed-roles"]` | disable-replace | cliCommands:seed-roles | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["set-password"]` | disable-replace | cliCommands:set-password | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["setup"]` | disable-replace | cliCommands:setup | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| cli | `overrides.cli["sync-role-acls"]` | disable-replace | cliCommands:sync-role-acls | [node_modules/@open-mercato/core/src/modules/auth/cli.ts](../../../node_modules/@open-mercato/core/src/modules/auth/cli.ts) |
+| di | `overrides.di["authService"]` | disable-replace | ownedContracts.di-registration:authService | [node_modules/@open-mercato/core/src/modules/auth/di.ts:17](../../../node_modules/@open-mercato/core/src/modules/auth/di.ts#L17) |
+| di | `overrides.di["rbacService"]` | disable-replace | ownedContracts.di-registration:rbacService | [node_modules/@open-mercato/core/src/modules/auth/di.ts:27](../../../node_modules/@open-mercato/core/src/modules/auth/di.ts#L27) |
+| encryption | `overrides.encryption.maps["auth:user"]` | disable-replace | ownedContracts.encryption:auth:user | [node_modules/@open-mercato/core/src/modules/auth/encryption.ts:4](../../../node_modules/@open-mercato/core/src/modules/auth/encryption.ts#L4) |
+| encryption | `overrides.encryption.maps["auth:user_consent"]` | disable-replace | ownedContracts.encryption:auth:user_consent | [node_modules/@open-mercato/core/src/modules/auth/encryption.ts:11](../../../node_modules/@open-mercato/core/src/modules/auth/encryption.ts#L11) |
+| notifications | `overrides.notifications.types["auth.account.locked"]` | disable-replace | notifications:auth.account.locked | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notifications | `overrides.notifications.types["auth.login.new_device"]` | disable-replace | notifications:auth.login.new_device | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notifications | `overrides.notifications.types["auth.password_reset.completed"]` | disable-replace | notifications:auth.password_reset.completed | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notifications | `overrides.notifications.types["auth.password_reset.requested"]` | disable-replace | notifications:auth.password_reset.requested | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notifications | `overrides.notifications.types["auth.role.assigned"]` | disable-replace | notifications:auth.role.assigned | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| notifications | `overrides.notifications.types["auth.role.revoked"]` | disable-replace | notifications:auth.role.revoked | [node_modules/@open-mercato/core/src/modules/auth/notifications.ts](../../../node_modules/@open-mercato/core/src/modules/auth/notifications.ts) |
+| routes | `overrides.routes.pages["backend:/backend/auth/profile"]` | disable-replace | backendPages:/backend/auth/profile | [node_modules/@open-mercato/core/src/modules/auth/backend/auth/profile/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/auth/profile/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/profile"]` | disable-replace | backendPages:/backend/profile | [node_modules/@open-mercato/core/src/modules/auth/backend/profile/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/profile/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/profile/change-password"]` | disable-replace | backendPages:/backend/profile/change-password | [node_modules/@open-mercato/core/src/modules/auth/backend/profile/change-password/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/profile/change-password/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/roles"]` | disable-replace | backendPages:/backend/roles | [node_modules/@open-mercato/core/src/modules/auth/backend/roles/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/roles/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/roles/[id]/edit"]` | disable-replace | backendPages:/backend/roles/[id]/edit | [node_modules/@open-mercato/core/src/modules/auth/backend/roles/[id]/edit/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/roles/[id]/edit/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/roles/create"]` | disable-replace | backendPages:/backend/roles/create | [node_modules/@open-mercato/core/src/modules/auth/backend/roles/create/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/roles/create/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/settings"]` | disable-replace | backendPages:/backend/settings | [node_modules/@open-mercato/core/src/modules/auth/backend/settings/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/settings/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/sidebar-customization"]` | disable-replace | backendPages:/backend/sidebar-customization | [node_modules/@open-mercato/core/src/modules/auth/backend/sidebar-customization/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/sidebar-customization/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/users"]` | disable-replace | backendPages:/backend/users | [node_modules/@open-mercato/core/src/modules/auth/backend/users/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/users/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/users/[id]/edit"]` | disable-replace | backendPages:/backend/users/[id]/edit | [node_modules/@open-mercato/core/src/modules/auth/backend/users/[id]/edit/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/users/[id]/edit/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/users/create"]` | disable-replace | backendPages:/backend/users/create | [node_modules/@open-mercato/core/src/modules/auth/backend/users/create/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/backend/users/create/page.tsx) |
+| routes | `overrides.routes.pages["frontend:/login"]` | disable-replace | frontendPages:/login | [node_modules/@open-mercato/core/src/modules/auth/frontend/login.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/frontend/login.tsx) |
+| routes | `overrides.routes.pages["frontend:/reset"]` | disable-replace | frontendPages:/reset | [node_modules/@open-mercato/core/src/modules/auth/frontend/reset.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/frontend/reset.tsx) |
+| routes | `overrides.routes.pages["frontend:/reset/[token]"]` | disable-replace | frontendPages:/reset/[token] | [node_modules/@open-mercato/core/src/modules/auth/frontend/reset/[token]/page.tsx](../../../node_modules/@open-mercato/core/src/modules/auth/frontend/reset/[token]/page.tsx) |
+| setup | `overrides.setup.defaultRoleFeatures` | replace | ownedContracts.setup:auth:setup | [node_modules/@open-mercato/core/src/modules/auth/setup.ts:3](../../../node_modules/@open-mercato/core/src/modules/auth/setup.ts#L3) |
+
+## Owned contract — module metadata
+
+| ID | Metadata | Source |
+|---|---|---|
+| auth | name=auth; version=0.1.0 | [node_modules/@open-mercato/core/src/modules/auth/index.ts:3](../../../node_modules/@open-mercato/core/src/modules/auth/index.ts#L3) |
+
+## Domain commands
+
+| ID | Metadata | Source |
+|---|---|---|
+| auth.roles.create | — | [node_modules/@open-mercato/core/src/modules/auth/commands/roles.ts](../../../node_modules/@open-mercato/core/src/modules/auth/commands/roles.ts) |
+| auth.roles.delete | — | [node_modules/@open-mercato/core/src/modules/auth/commands/roles.ts](../../../node_modules/@open-mercato/core/src/modules/auth/commands/roles.ts) |
+| auth.roles.update | — | [node_modules/@open-mercato/core/src/modules/auth/commands/roles.ts](../../../node_modules/@open-mercato/core/src/modules/auth/commands/roles.ts) |
+| auth.users.create | — | [node_modules/@open-mercato/core/src/modules/auth/commands/users.ts](../../../node_modules/@open-mercato/core/src/modules/auth/commands/users.ts) |
+| auth.users.delete | — | [node_modules/@open-mercato/core/src/modules/auth/commands/users.ts](../../../node_modules/@open-mercato/core/src/modules/auth/commands/users.ts) |
+| auth.users.update | — | [node_modules/@open-mercato/core/src/modules/auth/commands/users.ts](../../../node_modules/@open-mercato/core/src/modules/auth/commands/users.ts) |
+
+## Setup
+
+| ID | Metadata | Source |
+|---|---|---|
+| auth:setup | roles=admin | [node_modules/@open-mercato/core/src/modules/auth/setup.ts:3](../../../node_modules/@open-mercato/core/src/modules/auth/setup.ts#L3) |
+
+## Encryption
+
+| ID | Metadata | Source |
+|---|---|---|
+| auth:user | fields=email, name | [node_modules/@open-mercato/core/src/modules/auth/encryption.ts:4](../../../node_modules/@open-mercato/core/src/modules/auth/encryption.ts#L4) |
+| auth:user_consent | fields=ip_address, source | [node_modules/@open-mercato/core/src/modules/auth/encryption.ts:11](../../../node_modules/@open-mercato/core/src/modules/auth/encryption.ts#L11) |
+
+## DI registrations (rich)
+
+| Token | Kind | Lifetime | Injection | Provider | Source |
+|---|---|---|---|---|---|
+| authService | class | scoped | — | AuthService | [node_modules/@open-mercato/core/src/modules/auth/di.ts:17](../../../node_modules/@open-mercato/core/src/modules/auth/di.ts#L17) |
+| rbacService | function | scoped | — | — | [node_modules/@open-mercato/core/src/modules/auth/di.ts:27](../../../node_modules/@open-mercato/core/src/modules/auth/di.ts#L27) |