@open-mercato/cli 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7

package/dist/agentic/guides/modules/security.md

@@ -1,90 +1,53 @@
 # security — module facts (generated, do not edit)
-<!-- generated from @open-mercato/enterprise 0.6.7-develop.6862.1.c11a64ce0a; core 0.6.7-develop.6862.1.c11a64ce0a — R1 staleness stamp -->
-Source root: [node_modules/@open-mercato/enterprise/src/modules/security](../../../node_modules/@open-mercato/enterprise/src/modules/security)
+<!-- generated from @open-mercato/core 0.6.7 — R1 staleness stamp -->
 
 ## Entities
 
-| Entity ID | Class | Table | Editable | CustomFields | Source |
-|---|---|---|---|---|---|
-| security:user_mfa_method | UserMfaMethod | user_mfa_methods | yes | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
-| security:mfa_recovery_code | MfaRecoveryCode | mfa_recovery_codes | no | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
-| security:mfa_enforcement_policy | MfaEnforcementPolicy | mfa_enforcement_policies | yes | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
-| security:sudo_challenge_config | SudoChallengeConfig | sudo_challenge_configs | yes | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
-| security:sudo_session | SudoSession | sudo_sessions | no | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
-| security:mfa_challenge | MfaChallenge | mfa_challenges | no | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
+| Entity ID | Class | Table | Editable | CustomFields |
+|---|---|---|---|---|
+| security:user_mfa_method | UserMfaMethod | user_mfa_methods | yes | no |
+| security:mfa_recovery_code | MfaRecoveryCode | mfa_recovery_codes | no | no |
+| security:mfa_enforcement_policy | MfaEnforcementPolicy | mfa_enforcement_policies | yes | no |
+| security:sudo_challenge_config | SudoChallengeConfig | sudo_challenge_configs | yes | no |
+| security:sudo_session | SudoSession | sudo_sessions | no | no |
+| security:mfa_challenge | MfaChallenge | mfa_challenges | no | no |
 
 ## Events  (20)
 
-| ID | Category | Entity | Browser transport | Source |
-|---|---|---|---|---|
-| security.password.changed | lifecycle | password | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.password.notification_requested | lifecycle | password | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.mfa.method.added | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.mfa.method.removed | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.mfa.enrolled | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.mfa.removed | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.mfa.verified | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.mfa.otp.sent | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.mfa.reset | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.recovery.regenerated | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.recovery.used | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.enforcement.created | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.enforcement.updated | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.enforcement.deadline_reminder_requested | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.sudo.challenged | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.sudo.verified | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.sudo.failed | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.sudo.config.created | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.sudo.config.updated | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
-| security.sudo.config.deleted | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| ID | Category | Entity |
+|---|---|---|
+| security.password.changed | lifecycle | password |
+| security.password.notification_requested | lifecycle | password |
+| security.mfa.method.added | lifecycle | — |
+| security.mfa.method.removed | lifecycle | — |
+| security.mfa.enrolled | lifecycle | — |
+| security.mfa.removed | lifecycle | — |
+| security.mfa.verified | lifecycle | — |
+| security.mfa.otp.sent | lifecycle | — |
+| security.mfa.reset | lifecycle | — |
+| security.recovery.regenerated | lifecycle | — |
+| security.recovery.used | lifecycle | — |
+| security.enforcement.created | lifecycle | — |
+| security.enforcement.updated | lifecycle | — |
+| security.enforcement.deadline_reminder_requested | lifecycle | — |
+| security.sudo.challenged | lifecycle | — |
+| security.sudo.verified | lifecycle | — |
+| security.sudo.failed | lifecycle | — |
+| security.sudo.config.created | lifecycle | — |
+| security.sudo.config.updated | lifecycle | — |
+| security.sudo.config.deleted | lifecycle | — |
 
 ## ACL features  (7)
 
-| Feature | Source |
-|---|---|
-| security.profile.view | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| security.profile.password | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| security.profile.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| security.mfa.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| security.admin.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| security.sudo.view | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| security.sudo.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+security.profile.view · security.profile.password · security.profile.manage · security.mfa.manage · security.admin.manage · security.sudo.view · security.sudo.manage
 
 ## API routes
 
 _none_
 
-## Backend pages
-
-| ID / path | Source |
-|---|---|
-| /backend/profile/security | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/page.tsx) |
-| /backend/profile/security/mfa | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/page.tsx) |
-| /backend/profile/security/mfa/[providername] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/[providername]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/[providername]/page.tsx) |
-| /backend/profile/security/mfa/recovery-codes | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/recovery-codes/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/recovery-codes/page.tsx) |
-| /backend/security/enforcement | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/page.tsx) |
-| /backend/security/enforcement/[id] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/[id]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/[id]/page.tsx) |
-| /backend/security/enforcement/create | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/create/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/create/page.tsx) |
-| /backend/security/sudo | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/page.tsx) |
-| /backend/security/sudo/[id]/edit | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/[id]/edit/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/[id]/edit/page.tsx) |
-| /backend/security/sudo/create | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/create/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/create/page.tsx) |
-| /backend/security/users | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/page.tsx) |
-| /backend/security/users/[id] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/[id]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/[id]/page.tsx) |
-
-## Frontend pages
-
-_none_
-
 ## DI service tokens
 
-| Token | Source |
-|---|---|
-| passwordService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:30](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L30) |
-| mfaService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:31](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L31) |
-| mfaVerificationService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:32](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L32) |
-| mfaEnforcementService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:33](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L33) |
-| mfaAdminService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:34](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L34) |
-| sudoChallengeService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:35](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L35) |
+passwordService · mfaService · mfaVerificationService · mfaEnforcementService · mfaAdminService · sudoChallengeService
 
 ## Search entities
 
@@ -95,232 +58,10 @@ _none_
 - Entity IDs: _none_
 - Table IDs: security.enforcement.list · security.sudo.list · security.users.list
 
-## UMES hosts
-
-| ID / pattern | Family | Supports | Context | Stability | Source |
-|---|---|---|---|---|---|
-| data-table:security.enforcement.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.enforcement.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.enforcement.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.enforcement.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.enforcement.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.enforcement.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.enforcement.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.enforcement.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.enforcement.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.sudo.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| data-table:security.users.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| security.profile.sections | detail | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| security.profile.sidebar | detail | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
-| security:mfa_challenge | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:mfa_challenge |
-| security:mfa_enforcement_policy | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:mfa_enforcement_policy |
-| security:mfa_recovery_code | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:mfa_recovery_code |
-| security:sudo_challenge_config | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:sudo_challenge_config |
-| security:sudo_session | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:sudo_session |
-| security:user_mfa_method | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:user_mfa_method |
-| security.enforcement.created | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.enforcement.created |
-| security.enforcement.deadline_reminder_requested | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.enforcement.deadline_reminder_requested |
-| security.enforcement.updated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.enforcement.updated |
-| security.mfa.enrolled | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.enrolled |
-| security.mfa.method.added | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.method.added |
-| security.mfa.method.removed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.method.removed |
-| security.mfa.otp.sent | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.otp.sent |
-| security.mfa.removed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.removed |
-| security.mfa.reset | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.reset |
-| security.mfa.verified | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.verified |
-| security.password.changed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.password.changed |
-| security.password.notification_requested | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.password.notification_requested |
-| security.recovery.regenerated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.recovery.regenerated |
-| security.recovery.used | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.recovery.used |
-| security.sudo.challenged | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.challenged |
-| security.sudo.config.created | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.config.created |
-| security.sudo.config.deleted | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.config.deleted |
-| security.sudo.config.updated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.config.updated |
-| security.sudo.failed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.failed |
-| security.sudo.verified | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.verified |
-
-## UMES contributions
-
-| ID | Kind | Target | Phase / operations | Contract | Resolution | Source |
-|---|---|---|---|---|---|---|
-| security.auth.login.mfa-challenge | api-interceptor | auth/login | after | activation=crud-pipeline; failurePosture=fallback; methods=POST; phases=after; route=auth/login; timeoutMs=2000 | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts) |
-| security.block-legacy-self-password-change | command-interceptor | auth.users.update | before-execute | phases=before-execute; targetCommand=auth.users.update | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts) |
-| security.component-override.0:section:auth.login.form | component-override | section:auth.login.form | — | handle=section:auth.login.form; mode=replace; propsContract=component-props-schema | optional-external | [node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts) |
-| notification:security.mfa.enforcement_deadline | specialized-registry | security.mfa.enforcement_deadline | — | registry=notification; registryId=security.mfa.enforcement_deadline; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notification:security.mfa.enrolled | specialized-registry | security.mfa.enrolled | — | registry=notification; registryId=security.mfa.enrolled; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notification:security.mfa.reset | specialized-registry | security.mfa.reset | — | registry=notification; registryId=security.mfa.reset; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notification:security.password.changed | specialized-registry | security.password.changed | — | registry=notification; registryId=security.password.changed; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| security:enforcement-deadline-notification | subscriber | security.enforcement.created | async-delivery | event=security.enforcement.created; persistent=true; subscriberId=security:enforcement-deadline-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts) |
-| security:enforcement-updated-notification | subscriber | security.enforcement.updated | async-delivery | event=security.enforcement.updated; persistent=true; subscriberId=security:enforcement-updated-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts) |
-| security:mfa-enrolled-notification | subscriber | security.mfa.enrolled | async-delivery | event=security.mfa.enrolled; persistent=true; subscriberId=security:mfa-enrolled-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts) |
-| security:mfa-reset-notification | subscriber | security.mfa.reset | async-delivery | event=security.mfa.reset; persistent=true; subscriberId=security:mfa-reset-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts) |
-| security:password-change-notification | subscriber | security.password.notification_requested | async-delivery | event=security.password.notification_requested; persistent=true; subscriberId=security:password-change-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts) |
-
-## Active extension bindings
-
-_none_
-
-## Incoming installed contributions
-
-_none_
-
-## Contribution resolutions
-
-| Contribution | Target | Resolution | Activations | Source |
-|---|---|---|---|---|
-| notification:security.mfa.enforcement_deadline | module:security.mfa.enforcement_deadline | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notification:security.mfa.enrolled | module:security.mfa.enrolled @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notification:security.mfa.reset | module:security.mfa.reset @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notification:security.password.changed | module:security.password.changed @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| security:enforcement-deadline-notification | event:security.enforcement.created @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts) |
-| security:enforcement-updated-notification | event:security.enforcement.updated @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts) |
-| security:mfa-enrolled-notification | event:security.mfa.enrolled @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts) |
-| security:mfa-reset-notification | event:security.mfa.reset @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts) |
-| security:password-change-notification | event:security.password.notification_requested @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts) |
-| security.auth.login.mfa-challenge | api-route:auth/login | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts) |
-| security.block-legacy-self-password-change | command:auth.users.update @auth | bound | command:auth.users.update:command-interceptor-bridge | [node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts) |
-| security.component-override.0:section:auth.login.form | component:section:auth.login.form | optional-target-missing | — | [node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts) |
-
-## UMES diagnostics
-
-- unbound-helper: data-table:security.enforcement.list:empty-state
-- unbound-helper: data-table:security.sudo.list:empty-state
-- unbound-helper: data-table:security.users.list:empty-state
-
 ## Notifications
 
-| Notification ID | Source |
-|---|---|
-| security.password.changed | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| security.mfa.enrolled | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| security.mfa.reset | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| security.mfa.enforcement_deadline | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+security.password.changed · security.mfa.enrolled · security.mfa.reset · security.mfa.enforcement_deadline
 
-## CLI commands
+## CLI
 
 _none_
-
-## AI tools / MCP capabilities
-
-_none_
-
-## AI agents
-
-_none_
-
-## Exact override targets
-
-| Domain | Path / key | Supported modes | Referenced fact | Source |
-|---|---|---|---|---|
-| acl | `overrides.acl.features["security.admin.manage"]` | disable-replace | aclFeatures:security.admin.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| acl | `overrides.acl.features["security.mfa.manage"]` | disable-replace | aclFeatures:security.mfa.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| acl | `overrides.acl.features["security.profile.manage"]` | disable-replace | aclFeatures:security.profile.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| acl | `overrides.acl.features["security.profile.password"]` | disable-replace | aclFeatures:security.profile.password | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| acl | `overrides.acl.features["security.profile.view"]` | disable-replace | aclFeatures:security.profile.view | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| acl | `overrides.acl.features["security.sudo.manage"]` | disable-replace | aclFeatures:security.sudo.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| acl | `overrides.acl.features["security.sudo.view"]` | disable-replace | aclFeatures:security.sudo.view | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
-| commandInterceptors | `overrides.commandInterceptors["security.block-legacy-self-password-change"]` | disable-replace | extensionSurfaces.contributions:security.block-legacy-self-password-change | [node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts) |
-| di | `overrides.di["mfaAdminService"]` | disable-replace | ownedContracts.di-registration:mfaAdminService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:34](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L34) |
-| di | `overrides.di["mfaEnforcementService"]` | disable-replace | ownedContracts.di-registration:mfaEnforcementService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:33](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L33) |
-| di | `overrides.di["mfaProviderRegistry"]` | disable-replace | ownedContracts.di-registration:mfaProviderRegistry | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:29](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L29) |
-| di | `overrides.di["mfaService"]` | disable-replace | ownedContracts.di-registration:mfaService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:31](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L31) |
-| di | `overrides.di["mfaVerificationService"]` | disable-replace | ownedContracts.di-registration:mfaVerificationService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:32](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L32) |
-| di | `overrides.di["passwordService"]` | disable-replace | ownedContracts.di-registration:passwordService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:30](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L30) |
-| di | `overrides.di["sudoChallengeService"]` | disable-replace | ownedContracts.di-registration:sudoChallengeService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:35](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L35) |
-| events | `overrides.events.subscribers["security:enforcement-deadline-notification"]` | disable-replace | extensionSurfaces.contributions:security:enforcement-deadline-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts) |
-| events | `overrides.events.subscribers["security:enforcement-updated-notification"]` | disable-replace | extensionSurfaces.contributions:security:enforcement-updated-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts) |
-| events | `overrides.events.subscribers["security:mfa-enrolled-notification"]` | disable-replace | extensionSurfaces.contributions:security:mfa-enrolled-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts) |
-| events | `overrides.events.subscribers["security:mfa-reset-notification"]` | disable-replace | extensionSurfaces.contributions:security:mfa-reset-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts) |
-| events | `overrides.events.subscribers["security:password-change-notification"]` | disable-replace | extensionSurfaces.contributions:security:password-change-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts) |
-| guards | `overrides.guards["security.backend.legacy-profile-password-redirect"]` | disable-replace | ownedContracts.page-middleware:security.backend.legacy-profile-password-redirect | [node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts:9](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts#L9) |
-| guards | `overrides.guards["security.backend.mfa-enrollment-redirect"]` | disable-replace | ownedContracts.page-middleware:security.backend.mfa-enrollment-redirect | [node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts:20](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts#L20) |
-| guards | `overrides.guards["security.frontend.mfa-enrollment-redirect"]` | disable-replace | ownedContracts.page-middleware:security.frontend.mfa-enrollment-redirect | [node_modules/@open-mercato/enterprise/src/modules/security/frontend/middleware.ts:8](../../../node_modules/@open-mercato/enterprise/src/modules/security/frontend/middleware.ts#L8) |
-| interceptors | `overrides.interceptors["security.auth.login.mfa-challenge"]` | disable-replace | extensionSurfaces.contributions:security.auth.login.mfa-challenge | [node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts) |
-| notifications | `overrides.notifications.types["security.mfa.enforcement_deadline"]` | disable-replace | notifications:security.mfa.enforcement_deadline | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notifications | `overrides.notifications.types["security.mfa.enrolled"]` | disable-replace | notifications:security.mfa.enrolled | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notifications | `overrides.notifications.types["security.mfa.reset"]` | disable-replace | notifications:security.mfa.reset | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| notifications | `overrides.notifications.types["security.password.changed"]` | disable-replace | notifications:security.password.changed | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
-| routes | `overrides.routes.pages["backend:/backend/profile/security"]` | disable-replace | backendPages:/backend/profile/security | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/profile/security/mfa"]` | disable-replace | backendPages:/backend/profile/security/mfa | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/profile/security/mfa/[providername]"]` | disable-replace | backendPages:/backend/profile/security/mfa/[providername] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/[providername]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/[providername]/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/profile/security/mfa/recovery-codes"]` | disable-replace | backendPages:/backend/profile/security/mfa/recovery-codes | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/recovery-codes/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/recovery-codes/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/security/enforcement"]` | disable-replace | backendPages:/backend/security/enforcement | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/security/enforcement/[id]"]` | disable-replace | backendPages:/backend/security/enforcement/[id] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/[id]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/[id]/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/security/enforcement/create"]` | disable-replace | backendPages:/backend/security/enforcement/create | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/create/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/create/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/security/sudo"]` | disable-replace | backendPages:/backend/security/sudo | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/security/sudo/[id]/edit"]` | disable-replace | backendPages:/backend/security/sudo/[id]/edit | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/[id]/edit/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/[id]/edit/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/security/sudo/create"]` | disable-replace | backendPages:/backend/security/sudo/create | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/create/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/create/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/security/users"]` | disable-replace | backendPages:/backend/security/users | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/page.tsx) |
-| routes | `overrides.routes.pages["backend:/backend/security/users/[id]"]` | disable-replace | backendPages:/backend/security/users/[id] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/[id]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/[id]/page.tsx) |
-| setup | `overrides.setup.defaultRoleFeatures` | replace | ownedContracts.setup:security:setup | [node_modules/@open-mercato/enterprise/src/modules/security/setup.ts:3](../../../node_modules/@open-mercato/enterprise/src/modules/security/setup.ts#L3) |
-| widgets | `overrides.widgets.components["section:auth.login.form"]` | disable-replace | extensionSurfaces.contributions:security.component-override.0:section:auth.login.form | [node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts) |
-
-## Owned contract — module metadata
-
-| ID | Metadata | Source |
-|---|---|---|
-| security | version=0.1.0 | [node_modules/@open-mercato/enterprise/src/modules/security/index.ts:1](../../../node_modules/@open-mercato/enterprise/src/modules/security/index.ts#L1) |
-
-## Domain commands
-
-| ID | Metadata | Source |
-|---|---|---|
-| security.admin.mfa.reset | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/resetUserMfa.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/resetUserMfa.ts) |
-| security.enforcement.create | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/createEnforcementPolicy.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/createEnforcementPolicy.ts) |
-| security.enforcement.delete | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/deleteEnforcementPolicy.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/deleteEnforcementPolicy.ts) |
-| security.enforcement.update | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/updateEnforcementPolicy.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/updateEnforcementPolicy.ts) |
-| security.mfa.method.remove | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/removeMfaMethod.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/removeMfaMethod.ts) |
-| security.mfa.recovery_codes.regenerate | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/regenerateRecoveryCodes.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/regenerateRecoveryCodes.ts) |
-| security.password.change | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/changePassword.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/changePassword.ts) |
-| security.sudo.config.create | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/createSudoConfig.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/createSudoConfig.ts) |
-| security.sudo.config.delete | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/deleteSudoConfig.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/deleteSudoConfig.ts) |
-| security.sudo.config.update | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/updateSudoConfig.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/updateSudoConfig.ts) |
-
-## Page middleware
-
-| ID | Metadata | Source |
-|---|---|---|
-| security.backend.legacy-profile-password-redirect | mode=backend; priority=10; surface=backend | [node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts:9](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts#L9) |
-| security.backend.mfa-enrollment-redirect | mode=backend; priority=50; surface=backend | [node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts:20](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts#L20) |
-| security.frontend.mfa-enrollment-redirect | mode=frontend; priority=50; surface=frontend | [node_modules/@open-mercato/enterprise/src/modules/security/frontend/middleware.ts:8](../../../node_modules/@open-mercato/enterprise/src/modules/security/frontend/middleware.ts#L8) |
-
-## Setup
-
-| ID | Metadata | Source |
-|---|---|---|
-| security:setup | roles=admin, employee, superadmin | [node_modules/@open-mercato/enterprise/src/modules/security/setup.ts:3](../../../node_modules/@open-mercato/enterprise/src/modules/security/setup.ts#L3) |
-
-## DI registrations (rich)
-
-| Token | Kind | Lifetime | Injection | Provider | Source |
-|---|---|---|---|---|---|
-| mfaAdminService | class | scoped | — | MfaAdminService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:34](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L34) |
-| mfaEnforcementService | class | scoped | — | MfaEnforcementService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:33](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L33) |
-| mfaProviderRegistry | value | — | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:29](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L29) |
-| mfaService | class | scoped | — | MfaService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:31](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L31) |
-| mfaVerificationService | class | scoped | — | MfaVerificationService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:32](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L32) |
-| passwordService | class | scoped | — | PasswordService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:30](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L30) |
-| sudoChallengeService | class | scoped | — | SudoChallengeService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:35](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L35) |
-
-## Generator plugins
-
-| ID | Metadata | Source |
-|---|---|---|
-| security.mfa-providers | conventionFile=security.mfa-providers.ts; outputFileName=security-mfa-providers.generated.ts | [node_modules/@open-mercato/enterprise/src/modules/security/generators.ts:28](../../../node_modules/@open-mercato/enterprise/src/modules/security/generators.ts#L28) |
-| security.sudo | conventionFile=security.sudo.ts; outputFileName=security-sudo.generated.ts | [node_modules/@open-mercato/enterprise/src/modules/security/generators.ts:45](../../../node_modules/@open-mercato/enterprise/src/modules/security/generators.ts#L45) |