@open-mercato/cli 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/dist/agentic/guides/modules/security.md

@@ -1,53 +1,90 @@
 # security — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.6.7 — R1 staleness stamp -->
+<!-- generated from @open-mercato/enterprise 0.6.8-develop.6875.1.871a4afc94; core 0.6.8-develop.6875.1.871a4afc94 — R1 staleness stamp -->
+Source root: [node_modules/@open-mercato/enterprise/src/modules/security](../../../node_modules/@open-mercato/enterprise/src/modules/security)
 
 ## Entities
 
-| Entity ID | Class | Table | Editable | CustomFields |
-|---|---|---|---|---|
-| security:user_mfa_method | UserMfaMethod | user_mfa_methods | yes | no |
-| security:mfa_recovery_code | MfaRecoveryCode | mfa_recovery_codes | no | no |
-| security:mfa_enforcement_policy | MfaEnforcementPolicy | mfa_enforcement_policies | yes | no |
-| security:sudo_challenge_config | SudoChallengeConfig | sudo_challenge_configs | yes | no |
-| security:sudo_session | SudoSession | sudo_sessions | no | no |
-| security:mfa_challenge | MfaChallenge | mfa_challenges | no | no |
+| Entity ID | Class | Table | Editable | CustomFields | Source |
+|---|---|---|---|---|---|
+| security:user_mfa_method | UserMfaMethod | user_mfa_methods | yes | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
+| security:mfa_recovery_code | MfaRecoveryCode | mfa_recovery_codes | no | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
+| security:mfa_enforcement_policy | MfaEnforcementPolicy | mfa_enforcement_policies | yes | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
+| security:sudo_challenge_config | SudoChallengeConfig | sudo_challenge_configs | yes | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
+| security:sudo_session | SudoSession | sudo_sessions | no | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
+| security:mfa_challenge | MfaChallenge | mfa_challenges | no | no | [node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/data/entities.ts) |
 
 ## Events  (20)
 
-| ID | Category | Entity |
-|---|---|---|
-| security.password.changed | lifecycle | password |
-| security.password.notification_requested | lifecycle | password |
-| security.mfa.method.added | lifecycle | — |
-| security.mfa.method.removed | lifecycle | — |
-| security.mfa.enrolled | lifecycle | — |
-| security.mfa.removed | lifecycle | — |
-| security.mfa.verified | lifecycle | — |
-| security.mfa.otp.sent | lifecycle | — |
-| security.mfa.reset | lifecycle | — |
-| security.recovery.regenerated | lifecycle | — |
-| security.recovery.used | lifecycle | — |
-| security.enforcement.created | lifecycle | — |
-| security.enforcement.updated | lifecycle | — |
-| security.enforcement.deadline_reminder_requested | lifecycle | — |
-| security.sudo.challenged | lifecycle | — |
-| security.sudo.verified | lifecycle | — |
-| security.sudo.failed | lifecycle | — |
-| security.sudo.config.created | lifecycle | — |
-| security.sudo.config.updated | lifecycle | — |
-| security.sudo.config.deleted | lifecycle | — |
+| ID | Category | Entity | Browser transport | Source |
+|---|---|---|---|---|
+| security.password.changed | lifecycle | password | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.password.notification_requested | lifecycle | password | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.mfa.method.added | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.mfa.method.removed | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.mfa.enrolled | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.mfa.removed | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.mfa.verified | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.mfa.otp.sent | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.mfa.reset | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.recovery.regenerated | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.recovery.used | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.enforcement.created | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.enforcement.updated | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.enforcement.deadline_reminder_requested | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.sudo.challenged | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.sudo.verified | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.sudo.failed | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.sudo.config.created | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.sudo.config.updated | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
+| security.sudo.config.deleted | lifecycle | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/events.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/events.ts) |
 
 ## ACL features  (7)
 
-security.profile.view · security.profile.password · security.profile.manage · security.mfa.manage · security.admin.manage · security.sudo.view · security.sudo.manage
+| Feature | Source |
+|---|---|
+| security.profile.view | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| security.profile.password | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| security.profile.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| security.mfa.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| security.admin.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| security.sudo.view | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| security.sudo.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
 
 ## API routes
 
 _none_
 
+## Backend pages
+
+| ID / path | Source |
+|---|---|
+| /backend/profile/security | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/page.tsx) |
+| /backend/profile/security/mfa | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/page.tsx) |
+| /backend/profile/security/mfa/[providername] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/[providername]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/[providername]/page.tsx) |
+| /backend/profile/security/mfa/recovery-codes | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/recovery-codes/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/recovery-codes/page.tsx) |
+| /backend/security/enforcement | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/page.tsx) |
+| /backend/security/enforcement/[id] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/[id]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/[id]/page.tsx) |
+| /backend/security/enforcement/create | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/create/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/create/page.tsx) |
+| /backend/security/sudo | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/page.tsx) |
+| /backend/security/sudo/[id]/edit | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/[id]/edit/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/[id]/edit/page.tsx) |
+| /backend/security/sudo/create | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/create/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/create/page.tsx) |
+| /backend/security/users | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/page.tsx) |
+| /backend/security/users/[id] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/[id]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/[id]/page.tsx) |
+
+## Frontend pages
+
+_none_
+
 ## DI service tokens
 
-passwordService · mfaService · mfaVerificationService · mfaEnforcementService · mfaAdminService · sudoChallengeService
+| Token | Source |
+|---|---|
+| passwordService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:30](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L30) |
+| mfaService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:31](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L31) |
+| mfaVerificationService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:32](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L32) |
+| mfaEnforcementService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:33](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L33) |
+| mfaAdminService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:34](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L34) |
+| sudoChallengeService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:35](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L35) |
 
 ## Search entities
 
@@ -58,10 +95,232 @@ _none_
 - Entity IDs: _none_
 - Table IDs: security.enforcement.list · security.sudo.list · security.users.list
 
+## UMES hosts
+
+| ID / pattern | Family | Supports | Context | Stability | Source |
+|---|---|---|---|---|---|
+| data-table:security.enforcement.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.enforcement.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.enforcement.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.enforcement.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.enforcement.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.enforcement.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.enforcement.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.enforcement.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.enforcement.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.sudo.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list | data-table | component-replacement | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list:bulk-actions | data-table | bulk-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list:columns | data-table | column-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list:filters | data-table | filter-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list:footer | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list:header | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list:row-actions | data-table | row-action | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list:search-trailing | data-table | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| data-table:security.users.list:toolbar | data-table | toolbar-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| security.profile.sections | detail | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| security.profile.sidebar | detail | render-widget | — | FROZEN | [node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/extension-points.ts) |
+| security:mfa_challenge | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:mfa_challenge |
+| security:mfa_enforcement_policy | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:mfa_enforcement_policy |
+| security:mfa_recovery_code | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:mfa_recovery_code |
+| security:sudo_challenge_config | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:sudo_challenge_config |
+| security:sudo_session | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:sudo_session |
+| security:user_mfa_method | entity | response-enricher, query-enricher, mutation-guard, entity-extension | tenant-and-organization | STABLE | entities:security:user_mfa_method |
+| security.enforcement.created | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.enforcement.created |
+| security.enforcement.deadline_reminder_requested | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.enforcement.deadline_reminder_requested |
+| security.enforcement.updated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.enforcement.updated |
+| security.mfa.enrolled | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.enrolled |
+| security.mfa.method.added | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.method.added |
+| security.mfa.method.removed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.method.removed |
+| security.mfa.otp.sent | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.otp.sent |
+| security.mfa.removed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.removed |
+| security.mfa.reset | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.reset |
+| security.mfa.verified | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.mfa.verified |
+| security.password.changed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.password.changed |
+| security.password.notification_requested | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.password.notification_requested |
+| security.recovery.regenerated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.recovery.regenerated |
+| security.recovery.used | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.recovery.used |
+| security.sudo.challenged | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.challenged |
+| security.sudo.config.created | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.config.created |
+| security.sudo.config.deleted | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.config.deleted |
+| security.sudo.config.updated | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.config.updated |
+| security.sudo.failed | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.failed |
+| security.sudo.verified | event | async-subscriber, sync-subscriber | tenant-organization-and-audience | STABLE | events:security.sudo.verified |
+
+## UMES contributions
+
+| ID | Kind | Target | Phase / operations | Contract | Resolution | Source |
+|---|---|---|---|---|---|---|
+| security.auth.login.mfa-challenge | api-interceptor | auth/login | after | activation=crud-pipeline; failurePosture=fallback; methods=POST; phases=after; route=auth/login; timeoutMs=2000 | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts) |
+| security.block-legacy-self-password-change | command-interceptor | auth.users.update | before-execute | phases=before-execute; targetCommand=auth.users.update | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts) |
+| security.component-override.0:section:auth.login.form | component-override | section:auth.login.form | — | handle=section:auth.login.form; mode=replace; propsContract=component-props-schema | optional-external | [node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts) |
+| notification:security.mfa.enforcement_deadline | specialized-registry | security.mfa.enforcement_deadline | — | registry=notification; registryId=security.mfa.enforcement_deadline; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notification:security.mfa.enrolled | specialized-registry | security.mfa.enrolled | — | registry=notification; registryId=security.mfa.enrolled; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notification:security.mfa.reset | specialized-registry | security.mfa.reset | — | registry=notification; registryId=security.mfa.reset; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notification:security.password.changed | specialized-registry | security.password.changed | — | registry=notification; registryId=security.password.changed; specialistRoute=notifications | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| security:enforcement-deadline-notification | subscriber | security.enforcement.created | async-delivery | event=security.enforcement.created; persistent=true; subscriberId=security:enforcement-deadline-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts) |
+| security:enforcement-updated-notification | subscriber | security.enforcement.updated | async-delivery | event=security.enforcement.updated; persistent=true; subscriberId=security:enforcement-updated-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts) |
+| security:mfa-enrolled-notification | subscriber | security.mfa.enrolled | async-delivery | event=security.mfa.enrolled; persistent=true; subscriberId=security:mfa-enrolled-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts) |
+| security:mfa-reset-notification | subscriber | security.mfa.reset | async-delivery | event=security.mfa.reset; persistent=true; subscriberId=security:mfa-reset-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts) |
+| security:password-change-notification | subscriber | security.password.notification_requested | async-delivery | event=security.password.notification_requested; persistent=true; subscriberId=security:password-change-notification; sync=false | fact-ref | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts) |
+
+## Active extension bindings
+
+_none_
+
+## Incoming installed contributions
+
+_none_
+
+## Contribution resolutions
+
+| Contribution | Target | Resolution | Activations | Source |
+|---|---|---|---|---|
+| notification:security.mfa.enforcement_deadline | module:security.mfa.enforcement_deadline | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notification:security.mfa.enrolled | module:security.mfa.enrolled @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notification:security.mfa.reset | module:security.mfa.reset @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notification:security.password.changed | module:security.password.changed @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| security:enforcement-deadline-notification | event:security.enforcement.created @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts) |
+| security:enforcement-updated-notification | event:security.enforcement.updated @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts) |
+| security:mfa-enrolled-notification | event:security.mfa.enrolled @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts) |
+| security:mfa-reset-notification | event:security.mfa.reset @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts) |
+| security:password-change-notification | event:security.password.notification_requested @security | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts) |
+| security.auth.login.mfa-challenge | api-route:auth/login | capability-only | — | [node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts) |
+| security.block-legacy-self-password-change | command:auth.users.update @auth | bound | command:auth.users.update:command-interceptor-bridge | [node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts) |
+| security.component-override.0:section:auth.login.form | component:section:auth.login.form | optional-target-missing | — | [node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts) |
+
+## UMES diagnostics
+
+- unbound-helper: data-table:security.enforcement.list:empty-state
+- unbound-helper: data-table:security.sudo.list:empty-state
+- unbound-helper: data-table:security.users.list:empty-state
+
 ## Notifications
 
-security.password.changed · security.mfa.enrolled · security.mfa.reset · security.mfa.enforcement_deadline
+| Notification ID | Source |
+|---|---|
+| security.password.changed | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| security.mfa.enrolled | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| security.mfa.reset | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| security.mfa.enforcement_deadline | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
 
-## CLI
+## CLI commands
 
 _none_
+
+## AI tools / MCP capabilities
+
+_none_
+
+## AI agents
+
+_none_
+
+## Exact override targets
+
+| Domain | Path / key | Supported modes | Referenced fact | Source |
+|---|---|---|---|---|
+| acl | `overrides.acl.features["security.admin.manage"]` | disable-replace | aclFeatures:security.admin.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| acl | `overrides.acl.features["security.mfa.manage"]` | disable-replace | aclFeatures:security.mfa.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| acl | `overrides.acl.features["security.profile.manage"]` | disable-replace | aclFeatures:security.profile.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| acl | `overrides.acl.features["security.profile.password"]` | disable-replace | aclFeatures:security.profile.password | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| acl | `overrides.acl.features["security.profile.view"]` | disable-replace | aclFeatures:security.profile.view | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| acl | `overrides.acl.features["security.sudo.manage"]` | disable-replace | aclFeatures:security.sudo.manage | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| acl | `overrides.acl.features["security.sudo.view"]` | disable-replace | aclFeatures:security.sudo.view | [node_modules/@open-mercato/enterprise/src/modules/security/acl.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/acl.ts) |
+| commandInterceptors | `overrides.commandInterceptors["security.block-legacy-self-password-change"]` | disable-replace | extensionSurfaces.contributions:security.block-legacy-self-password-change | [node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/interceptors.ts) |
+| di | `overrides.di["mfaAdminService"]` | disable-replace | ownedContracts.di-registration:mfaAdminService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:34](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L34) |
+| di | `overrides.di["mfaEnforcementService"]` | disable-replace | ownedContracts.di-registration:mfaEnforcementService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:33](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L33) |
+| di | `overrides.di["mfaProviderRegistry"]` | disable-replace | ownedContracts.di-registration:mfaProviderRegistry | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:29](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L29) |
+| di | `overrides.di["mfaService"]` | disable-replace | ownedContracts.di-registration:mfaService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:31](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L31) |
+| di | `overrides.di["mfaVerificationService"]` | disable-replace | ownedContracts.di-registration:mfaVerificationService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:32](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L32) |
+| di | `overrides.di["passwordService"]` | disable-replace | ownedContracts.di-registration:passwordService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:30](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L30) |
+| di | `overrides.di["sudoChallengeService"]` | disable-replace | ownedContracts.di-registration:sudoChallengeService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:35](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L35) |
+| events | `overrides.events.subscribers["security:enforcement-deadline-notification"]` | disable-replace | extensionSurfaces.contributions:security:enforcement-deadline-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-deadline-notification.ts) |
+| events | `overrides.events.subscribers["security:enforcement-updated-notification"]` | disable-replace | extensionSurfaces.contributions:security:enforcement-updated-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/enforcement-updated-notification.ts) |
+| events | `overrides.events.subscribers["security:mfa-enrolled-notification"]` | disable-replace | extensionSurfaces.contributions:security:mfa-enrolled-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/notification.ts) |
+| events | `overrides.events.subscribers["security:mfa-reset-notification"]` | disable-replace | extensionSurfaces.contributions:security:mfa-reset-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/mfa-reset-notification.ts) |
+| events | `overrides.events.subscribers["security:password-change-notification"]` | disable-replace | extensionSurfaces.contributions:security:password-change-notification | [node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/subscribers/audit.ts) |
+| guards | `overrides.guards["security.backend.legacy-profile-password-redirect"]` | disable-replace | ownedContracts.page-middleware:security.backend.legacy-profile-password-redirect | [node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts:9](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts#L9) |
+| guards | `overrides.guards["security.backend.mfa-enrollment-redirect"]` | disable-replace | ownedContracts.page-middleware:security.backend.mfa-enrollment-redirect | [node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts:20](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts#L20) |
+| guards | `overrides.guards["security.frontend.mfa-enrollment-redirect"]` | disable-replace | ownedContracts.page-middleware:security.frontend.mfa-enrollment-redirect | [node_modules/@open-mercato/enterprise/src/modules/security/frontend/middleware.ts:8](../../../node_modules/@open-mercato/enterprise/src/modules/security/frontend/middleware.ts#L8) |
+| interceptors | `overrides.interceptors["security.auth.login.mfa-challenge"]` | disable-replace | extensionSurfaces.contributions:security.auth.login.mfa-challenge | [node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/api/interceptors.ts) |
+| notifications | `overrides.notifications.types["security.mfa.enforcement_deadline"]` | disable-replace | notifications:security.mfa.enforcement_deadline | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notifications | `overrides.notifications.types["security.mfa.enrolled"]` | disable-replace | notifications:security.mfa.enrolled | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notifications | `overrides.notifications.types["security.mfa.reset"]` | disable-replace | notifications:security.mfa.reset | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| notifications | `overrides.notifications.types["security.password.changed"]` | disable-replace | notifications:security.password.changed | [node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/notifications.ts) |
+| routes | `overrides.routes.pages["backend:/backend/profile/security"]` | disable-replace | backendPages:/backend/profile/security | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/profile/security/mfa"]` | disable-replace | backendPages:/backend/profile/security/mfa | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/profile/security/mfa/[providername]"]` | disable-replace | backendPages:/backend/profile/security/mfa/[providername] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/[providername]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/[providername]/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/profile/security/mfa/recovery-codes"]` | disable-replace | backendPages:/backend/profile/security/mfa/recovery-codes | [node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/recovery-codes/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/profile/security/mfa/recovery-codes/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/security/enforcement"]` | disable-replace | backendPages:/backend/security/enforcement | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/security/enforcement/[id]"]` | disable-replace | backendPages:/backend/security/enforcement/[id] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/[id]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/[id]/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/security/enforcement/create"]` | disable-replace | backendPages:/backend/security/enforcement/create | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/create/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/enforcement/create/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/security/sudo"]` | disable-replace | backendPages:/backend/security/sudo | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/security/sudo/[id]/edit"]` | disable-replace | backendPages:/backend/security/sudo/[id]/edit | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/[id]/edit/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/[id]/edit/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/security/sudo/create"]` | disable-replace | backendPages:/backend/security/sudo/create | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/create/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/sudo/create/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/security/users"]` | disable-replace | backendPages:/backend/security/users | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/page.tsx) |
+| routes | `overrides.routes.pages["backend:/backend/security/users/[id]"]` | disable-replace | backendPages:/backend/security/users/[id] | [node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/[id]/page.tsx](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/security/users/[id]/page.tsx) |
+| setup | `overrides.setup.defaultRoleFeatures` | replace | ownedContracts.setup:security:setup | [node_modules/@open-mercato/enterprise/src/modules/security/setup.ts:3](../../../node_modules/@open-mercato/enterprise/src/modules/security/setup.ts#L3) |
+| widgets | `overrides.widgets.components["section:auth.login.form"]` | disable-replace | extensionSurfaces.contributions:security.component-override.0:section:auth.login.form | [node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/widgets/components.ts) |
+
+## Owned contract — module metadata
+
+| ID | Metadata | Source |
+|---|---|---|
+| security | version=0.1.0 | [node_modules/@open-mercato/enterprise/src/modules/security/index.ts:1](../../../node_modules/@open-mercato/enterprise/src/modules/security/index.ts#L1) |
+
+## Domain commands
+
+| ID | Metadata | Source |
+|---|---|---|
+| security.admin.mfa.reset | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/resetUserMfa.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/resetUserMfa.ts) |
+| security.enforcement.create | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/createEnforcementPolicy.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/createEnforcementPolicy.ts) |
+| security.enforcement.delete | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/deleteEnforcementPolicy.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/deleteEnforcementPolicy.ts) |
+| security.enforcement.update | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/updateEnforcementPolicy.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/updateEnforcementPolicy.ts) |
+| security.mfa.method.remove | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/removeMfaMethod.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/removeMfaMethod.ts) |
+| security.mfa.recovery_codes.regenerate | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/regenerateRecoveryCodes.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/regenerateRecoveryCodes.ts) |
+| security.password.change | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/changePassword.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/changePassword.ts) |
+| security.sudo.config.create | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/createSudoConfig.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/createSudoConfig.ts) |
+| security.sudo.config.delete | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/deleteSudoConfig.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/deleteSudoConfig.ts) |
+| security.sudo.config.update | — | [node_modules/@open-mercato/enterprise/src/modules/security/commands/updateSudoConfig.ts](../../../node_modules/@open-mercato/enterprise/src/modules/security/commands/updateSudoConfig.ts) |
+
+## Page middleware
+
+| ID | Metadata | Source |
+|---|---|---|
+| security.backend.legacy-profile-password-redirect | mode=backend; priority=10; surface=backend | [node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts:9](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts#L9) |
+| security.backend.mfa-enrollment-redirect | mode=backend; priority=50; surface=backend | [node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts:20](../../../node_modules/@open-mercato/enterprise/src/modules/security/backend/middleware.ts#L20) |
+| security.frontend.mfa-enrollment-redirect | mode=frontend; priority=50; surface=frontend | [node_modules/@open-mercato/enterprise/src/modules/security/frontend/middleware.ts:8](../../../node_modules/@open-mercato/enterprise/src/modules/security/frontend/middleware.ts#L8) |
+
+## Setup
+
+| ID | Metadata | Source |
+|---|---|---|
+| security:setup | roles=admin, employee, superadmin | [node_modules/@open-mercato/enterprise/src/modules/security/setup.ts:3](../../../node_modules/@open-mercato/enterprise/src/modules/security/setup.ts#L3) |
+
+## DI registrations (rich)
+
+| Token | Kind | Lifetime | Injection | Provider | Source |
+|---|---|---|---|---|---|
+| mfaAdminService | class | scoped | — | MfaAdminService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:34](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L34) |
+| mfaEnforcementService | class | scoped | — | MfaEnforcementService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:33](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L33) |
+| mfaProviderRegistry | value | — | — | — | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:29](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L29) |
+| mfaService | class | scoped | — | MfaService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:31](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L31) |
+| mfaVerificationService | class | scoped | — | MfaVerificationService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:32](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L32) |
+| passwordService | class | scoped | — | PasswordService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:30](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L30) |
+| sudoChallengeService | class | scoped | — | SudoChallengeService | [node_modules/@open-mercato/enterprise/src/modules/security/di.ts:35](../../../node_modules/@open-mercato/enterprise/src/modules/security/di.ts#L35) |
+
+## Generator plugins
+
+| ID | Metadata | Source |
+|---|---|---|
+| security.mfa-providers | conventionFile=security.mfa-providers.ts; outputFileName=security-mfa-providers.generated.ts | [node_modules/@open-mercato/enterprise/src/modules/security/generators.ts:28](../../../node_modules/@open-mercato/enterprise/src/modules/security/generators.ts#L28) |
+| security.sudo | conventionFile=security.sudo.ts; outputFileName=security-sudo.generated.ts | [node_modules/@open-mercato/enterprise/src/modules/security/generators.ts:45](../../../node_modules/@open-mercato/enterprise/src/modules/security/generators.ts#L45) |