@open-mercato/core 0.4.2-canary-ed15f2e753 → 0.4.2-canary-e2aeb1a7bf

package/src/modules/auth/lib/setup-app.ts

@@ -4,18 +4,15 @@ import { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/d
 import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { normalizeTenantId } from './tenantAccess'
-import { SalesSettings, SalesDocumentSequence } from '@open-mercato/core/modules/sales/data/entities'
-import {
-  DEFAULT_ORDER_NUMBER_FORMAT,
-  DEFAULT_QUOTE_NUMBER_FORMAT,
-} from '@open-mercato/core/modules/sales/lib/documentNumberTokens'
 import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
+import type { Module } from '@open-mercato/shared/modules/registry'
 import { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'
 import { DEFAULT_ENCRYPTION_MAPS } from '@open-mercato/core/modules/entities/lib/encryptionDefaults'
 import { createKmsService } from '@open-mercato/shared/lib/encryption/kms'
 import { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 
 const DEFAULT_ROLE_NAMES = ['employee', 'admin', 'superadmin'] as const
 const DEMO_SUPERADMIN_EMAIL = 'superadmin@acme.com'
@@ -87,6 +84,11 @@ type PrimaryUserInput = {
   confirm?: boolean
 }
 
+const DERIVED_EMAIL_ENV = {
+  admin: 'OM_INIT_ADMIN_EMAIL',
+  employee: 'OM_INIT_EMPLOYEE_EMAIL',
+} as const
+
 export type SetupInitialTenantOptions = {
   orgName: string
   primaryUser: PrimaryUserInput
@@ -95,6 +97,8 @@ export type SetupInitialTenantOptions = {
   failIfUserExists?: boolean
   primaryUserRoles?: string[]
   includeSuperadminRole?: boolean
+  /** Optional list of enabled modules. When provided, module setup hooks are called. */
+  modules?: Module[]
 }
 
 export type SetupInitialTenantResult = {
@@ -170,16 +174,28 @@ export async function setupInitialTenant(
   })
 
   if (!existingUser) {
-    const baseUsers: Array<{ email: string; roles: string[]; name?: string | null }> = [
+    const baseUsers: Array<{
+      email: string
+      roles: string[]
+      name?: string | null
+      passwordHash?: string | null
+    }> = [
       { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },
     ]
     if (includeDerivedUsers) {
-      const [local, domain] = String(primaryUser.email).split('@')
-      const isSuperadminLocal = (local || '').toLowerCase() === 'superadmin' && !!domain
-      if (isSuperadminLocal) {
-        baseUsers.push({ email: `admin@${domain}`, roles: ['admin'] })
-        baseUsers.push({ email: `employee@${domain}`, roles: ['employee'] })
-      }
+      const [, domain] = String(primaryUser.email).split('@')
+      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin)
+      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)
+      const adminEmail = adminOverride ?? (domain ? `admin@${domain}` : '')
+      const employeeEmail = employeeOverride ?? (domain ? `employee@${domain}` : '')
+      const adminPassword = readEnvValue('OM_INIT_ADMIN_PASSWORD') || 'secret'
+      const employeePassword = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD') || 'secret'
+      const adminPasswordHash = adminPassword ? await resolvePasswordHash({ email: adminEmail, password: adminPassword }) : null
+      const employeePasswordHash = employeePassword
+        ? await resolvePasswordHash({ email: employeeEmail, password: employeePassword })
+        : null
+      addUniqueBaseUser(baseUsers, { email: adminEmail, roles: ['admin'], passwordHash: adminPasswordHash })
+      addUniqueBaseUser(baseUsers, { email: employeeEmail, roles: ['employee'], passwordHash: employeePasswordHash })
     }
     const passwordHash = await resolvePasswordHash(primaryUser)
 
@@ -271,13 +287,14 @@ export async function setupInitialTenant(
       }
 
       for (const base of baseUsers) {
+        const resolvedPasswordHash = base.passwordHash ?? passwordHash
         let user = await tem.findOne(User, { email: base.email })
         const confirm = primaryUser.confirm ?? true
         const encryptedPayload = encryptionService
           ? await encryptionService.encryptEntityPayload('auth:user', { email: base.email }, tenantId, organizationId)
           : { email: base.email, emailHash: computeEmailHash(base.email) }
         if (user) {
-          user.passwordHash = passwordHash
+          user.passwordHash = resolvedPasswordHash
           user.organizationId = organizationId
           user.tenantId = tenantId
           if (isTenantDataEncryptionEnabled()) {
@@ -292,7 +309,7 @@ export async function setupInitialTenant(
           user = tem.create(User, {
             email: (encryptedPayload as any).email ?? base.email,
             emailHash: isTenantDataEncryptionEnabled() ? (encryptedPayload as any).emailHash ?? computeEmailHash(base.email) : undefined,
-            passwordHash,
+            passwordHash: resolvedPasswordHash,
             organizationId,
             tenantId,
             name: base.name ?? undefined,
@@ -321,9 +338,16 @@ export async function setupInitialTenant(
     await rebuildHierarchyForTenant(em, tenantId)
   }
 
-  await ensureDefaultRoleAcls(em, tenantId, { includeSuperadminRole })
+  const resolvedModules = options.modules ?? tryGetModules()
+  await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole })
   await deactivateDemoSuperAdminIfSelfOnboardingEnabled(em)
-  await ensureSalesNumberingDefaults(em, { tenantId, organizationId })
+
+  // Call module onTenantCreated hooks
+  for (const mod of resolvedModules) {
+    if (mod.setup?.onTenantCreated) {
+      await mod.setup.onTenantCreated({ em, tenantId, organizationId })
+    }
+  }
 
   return {
     tenantId,
@@ -340,6 +364,34 @@ function resolvePrimaryName(input: PrimaryUserInput): string | null {
   return null
 }
 
+function readEnvValue(key: string): string | undefined {
+  const value = process.env[key]
+  if (typeof value !== 'string') return undefined
+  const trimmed = value.trim()
+  return trimmed.length > 0 ? trimmed : undefined
+}
+
+function addUniqueBaseUser(
+  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null }>,
+  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null },
+) {
+  if (!entry.email) return
+  const normalized = entry.email.toLowerCase()
+  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return
+  baseUsers.push(entry)
+}
+
+function isDemoModeEnabled(): boolean {
+  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')
+  return parsed === false ? false : true
+}
+
+function shouldKeepDemoSuperadminDuringInit(): boolean {
+  if (process.env.OM_INIT_FLOW !== 'true') return false
+  if (!readEnvValue('OM_INIT_SUPERADMIN_EMAIL')) return false
+  return isDemoModeEnabled()
+}
+
 async function resolvePasswordHash(input: PrimaryUserInput): Promise<string | null> {
   if (typeof input.hashedPassword === 'string') return input.hashedPassword
   if (input.password) return hash(input.password, 10)
@@ -349,6 +401,7 @@ async function resolvePasswordHash(input: PrimaryUserInput): Promise<string | nu
 async function ensureDefaultRoleAcls(
   em: EntityManager,
   tenantId: string,
+  modules: Module[],
   options: { includeSuperadminRole?: boolean } = {},
 ) {
   const includeSuperadminRole = options.includeSuperadminRole ?? true
@@ -357,84 +410,27 @@ async function ensureDefaultRoleAcls(
   const adminRole = await findRoleByName(em, 'admin', roleTenantId)
   const employeeRole = await findRoleByName(em, 'employee', roleTenantId)
 
+  // Merge features from all enabled modules' setup configs
+  const superadminFeatures: string[] = []
+  const adminFeatures: string[] = []
+  const employeeFeatures: string[] = []
+
+  for (const mod of modules) {
+    const roleFeatures = mod.setup?.defaultRoleFeatures
+    if (!roleFeatures) continue
+    if (roleFeatures.superadmin) superadminFeatures.push(...roleFeatures.superadmin)
+    if (roleFeatures.admin) adminFeatures.push(...roleFeatures.admin)
+    if (roleFeatures.employee) employeeFeatures.push(...roleFeatures.employee)
+  }
+
   if (includeSuperadminRole && superadminRole) {
-    await ensureRoleAclFor(em, superadminRole, tenantId, ['directory.tenants.*'], { isSuperAdmin: true })
+    await ensureRoleAclFor(em, superadminRole, tenantId, superadminFeatures, { isSuperAdmin: true })
   }
   if (adminRole) {
-    const adminFeatures = [
-      'auth.*',
-      'entities.*',
-      'attachments.*',
-      'attachments.view',
-      'attachments.manage',
-      'query_index.*',
-      'search.*',
-      'vector.*',
-      'feature_toggles.*',
-      'configs.system_status.view',
-      'configs.cache.view',
-      'configs.cache.manage',
-      'configs.manage',
-      'catalog.*',
-      'catalog.variants.manage',
-      'catalog.pricing.manage',
-      'sales.*',
-      'audit_logs.*',
-      'directory.organizations.view',
-      'directory.organizations.manage',
-      'customers.*',
-      'customers.people.view',
-      'customers.people.manage',
-      'customers.companies.view',
-      'customers.companies.manage',
-      'customers.deals.view',
-      'customers.deals.manage',
-      'dictionaries.view',
-      'dictionaries.manage',
-      'example.*',
-      'dashboards.*',
-      'dashboards.admin.assign-widgets',
-      'analytics.view',
-      'api_keys.*',
-      'perspectives.use',
-      'perspectives.role_defaults',
-      'business_rules.*',
-      'workflows.*',
-      'currencies.*',
-      'staff.*',
-      'staff.leave_requests.manage',
-      'resources.*',
-      'planner.*',
-    ]
-    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures, { remove: ['directory.organizations.*', 'directory.tenants.*'] })
+    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures)
   }
   if (employeeRole) {
-    await ensureRoleAclFor(em, employeeRole, tenantId, [
-      'customers.*',
-      'customers.people.view',
-      'customers.people.manage',
-      'customers.companies.view',
-      'customers.companies.manage',
-      'vector.*',
-      'catalog.*',
-      'catalog.variants.manage',
-      'catalog.pricing.manage',
-      'sales.*',
-      'dictionaries.view',
-      'example.*',
-      'example.widgets.*',
-      'dashboards.view',
-      'dashboards.configure',
-      'analytics.view',
-      'audit_logs.undo_self',
-      'perspectives.use',
-      'staff.leave_requests.send',
-      'staff.my_availability.view',
-      'staff.my_availability.manage',
-      'staff.my_leave_requests.view',
-      'staff.my_leave_requests.send',
-      'planner.view',
-    ])
+    await ensureRoleAclFor(em, employeeRole, tenantId, employeeFeatures)
   }
 }
 
@@ -443,7 +439,7 @@ async function ensureRoleAclFor(
   role: Role,
   tenantId: string,
   features: string[],
-  options: { isSuperAdmin?: boolean; remove?: string[] } = {},
+  options: { isSuperAdmin?: boolean } = {},
 ) {
   const existing = await em.findOne(RoleAcl, { role, tenantId })
   if (!existing) {
@@ -459,24 +455,10 @@ async function ensureRoleAclFor(
   }
   const currentFeatures = Array.isArray(existing.featuresJson) ? existing.featuresJson : []
   const merged = Array.from(new Set([...currentFeatures, ...features]))
-  const removeSet = new Set(options.remove ?? [])
-  const sanitized =
-    removeSet.size
-      ? merged.filter((value) => {
-        if (removeSet.has(value)) return false
-        for (const entry of removeSet) {
-          if (entry.endsWith('.*')) {
-            const prefix = entry.slice(0, -1) // keep trailing dot
-            if (value === entry || value.startsWith(prefix)) return false
-          }
-        }
-        return true
-      })
-      : merged
   const changed =
-    sanitized.length !== currentFeatures.length ||
-    sanitized.some((value, index) => value !== currentFeatures[index])
-  if (changed) existing.featuresJson = sanitized
+    merged.length !== currentFeatures.length ||
+    merged.some((value, index) => value !== currentFeatures[index])
+  if (changed) existing.featuresJson = merged
   if (options.isSuperAdmin && !existing.isSuperAdmin) {
     existing.isSuperAdmin = true
   }
@@ -487,6 +469,7 @@ async function ensureRoleAclFor(
 
 async function deactivateDemoSuperAdminIfSelfOnboardingEnabled(em: EntityManager) {
   if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return
+  if (shouldKeepDemoSuperadminDuringInit()) return
   try {
     const user = await em.findOne(User, { email: DEMO_SUPERADMIN_EMAIL })
     if (!user) return
@@ -507,84 +490,12 @@ async function deactivateDemoSuperAdminIfSelfOnboardingEnabled(em: EntityManager
   }
 }
 
-async function ensureSalesNumberingDefaults(
-  em: EntityManager,
-  scope: { tenantId: string; organizationId: string },
-) {
-  const repo = (em as any).getRepository?.(SalesSettings)
-  const findSettings = async () =>
-    repo?.findOne({
-      tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
-    }) ??
-    (em as any).findOne?.(SalesSettings, {
-      tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
-    })
-
-  const exists = await findSettings()
-  if (!exists) {
-    const settings =
-      repo?.create?.({
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        orderNumberFormat: DEFAULT_ORDER_NUMBER_FORMAT,
-        quoteNumberFormat: DEFAULT_QUOTE_NUMBER_FORMAT,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      }) ??
-      (em as any).create?.(SalesSettings, {
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        orderNumberFormat: DEFAULT_ORDER_NUMBER_FORMAT,
-        quoteNumberFormat: DEFAULT_QUOTE_NUMBER_FORMAT,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      })
-    if (settings && (em as any).persist) {
-      em.persist(settings)
-    }
-  }
-
-  const sequenceRepo = (em as any).getRepository?.(SalesDocumentSequence)
-  const kinds: Array<'order' | 'quote'> = ['order', 'quote']
-  for (const kind of kinds) {
-    const seq =
-      sequenceRepo?.findOne({
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        documentKind: kind,
-      }) ??
-      (em as any).findOne?.(SalesDocumentSequence, {
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        documentKind: kind,
-      })
-    if (!seq) {
-      const entry =
-        sequenceRepo?.create?.({
-          tenantId: scope.tenantId,
-          organizationId: scope.organizationId,
-          documentKind: kind,
-          currentValue: 0,
-          createdAt: new Date(),
-          updatedAt: new Date(),
-        }) ??
-        (em as any).create?.(SalesDocumentSequence, {
-          tenantId: scope.tenantId,
-          organizationId: scope.organizationId,
-          documentKind: kind,
-          currentValue: 0,
-          createdAt: new Date(),
-          updatedAt: new Date(),
-        })
-      if (entry && (em as any).persist) {
-        em.persist(entry)
-      }
-    }
-  }
-
-  if ((em as any).flush) {
-    await em.flush()
+/** Try to get modules from runtime registry; returns empty array if not yet registered. */
+function tryGetModules(): Module[] {
+  try {
+    const { getModules } = require('@open-mercato/shared/lib/modules/registry')
+    return getModules()
+  } catch {
+    return []
   }
 }

package/src/modules/auth/notifications.ts

@@ -0,0 +1,109 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'auth.password_reset.requested',
+    module: 'auth',
+    titleKey: 'auth.notifications.passwordReset.requested.title',
+    bodyKey: 'auth.notifications.passwordReset.requested.body',
+    icon: 'key',
+    severity: 'info',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 24,
+  },
+  {
+    type: 'auth.password_reset.completed',
+    module: 'auth',
+    titleKey: 'auth.notifications.passwordReset.completed.title',
+    bodyKey: 'auth.notifications.passwordReset.completed.body',
+    icon: 'check-circle',
+    severity: 'success',
+    actions: [],
+    expiresAfterHours: 72,
+  },
+  {
+    type: 'auth.account.locked',
+    module: 'auth',
+    titleKey: 'auth.notifications.account.locked.title',
+    bodyKey: 'auth.notifications.account.locked.body',
+    icon: 'lock',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'contact_support',
+        labelKey: 'auth.actions.contactSupport',
+        variant: 'default',
+        href: '/backend/support',
+        icon: 'mail',
+      },
+    ],
+    linkHref: '/backend/support',
+  },
+  {
+    type: 'auth.login.new_device',
+    module: 'auth',
+    titleKey: 'auth.notifications.login.newDevice.title',
+    bodyKey: 'auth.notifications.login.newDevice.body',
+    icon: 'smartphone',
+    severity: 'info',
+    actions: [
+      {
+        id: 'view_sessions',
+        labelKey: 'auth.actions.viewSessions',
+        variant: 'outline',
+        href: '/backend/auth/sessions',
+        icon: 'list',
+      },
+    ],
+    linkHref: '/backend/auth/sessions',
+    expiresAfterHours: 168, // 7 days
+  },
+  {
+    type: 'auth.role.assigned',
+    module: 'auth',
+    titleKey: 'auth.notifications.role.assigned.title',
+    bodyKey: 'auth.notifications.role.assigned.body',
+    icon: 'user-plus',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view_permissions',
+        labelKey: 'auth.actions.viewPermissions',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+        icon: 'shield',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'auth.role.revoked',
+    module: 'auth',
+    titleKey: 'auth.notifications.role.revoked.title',
+    bodyKey: 'auth.notifications.role.revoked.body',
+    icon: 'user-minus',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view_profile',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 168,
+  },
+]
+
+export default notificationTypes

package/src/modules/auth/services/authService.ts

@@ -18,6 +18,29 @@ export class AuthService {
     } as any)
   }
 
+  async findUsersByEmail(email: string) {
+    const emailHash = computeEmailHash(email)
+    return this.em.find(User, {
+      deletedAt: null,
+      $or: [
+        { email },
+        { emailHash },
+      ],
+    } as any)
+  }
+
+  async findUserByEmailAndTenant(email: string, tenantId: string) {
+    const emailHash = computeEmailHash(email)
+    return this.em.findOne(User, {
+      tenantId,
+      deletedAt: null,
+      $or: [
+        { email },
+        { emailHash },
+      ],
+    } as any)
+  }
+
   async verifyPassword(user: User, password: string) {
     if (!user.passwordHash) return false
     return compare(password, user.passwordHash)
@@ -75,15 +98,15 @@ export class AuthService {
     return { user, token }
   }
 
-  async confirmPasswordReset(token: string, newPassword: string) {
+  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {
     const now = new Date()
     const row = await this.em.findOne(PasswordReset, { token })
-    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return false
+    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null
     const user = await this.em.findOne(User, { id: row.user.id })
-    if (!user) return false
+    if (!user) return null
     user.passwordHash = await hash(newPassword, 10)
     row.usedAt = new Date()
     await this.em.flush()
-    return true
+    return user
   }
 }

package/src/modules/auth/setup.ts

@@ -0,0 +1,9 @@
+import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+
+export const setup: ModuleSetupConfig = {
+  defaultRoleFeatures: {
+    admin: ['auth.*'],
+  },
+}
+
+export default setup

package/src/modules/business_rules/api/execute/route.ts

@@ -4,6 +4,7 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
+import type { EventBus } from '@open-mercato/events'
 import { ruleEngineContextSchema } from '../../data/validators'
 import * as ruleEngine from '../../lib/rule-engine'
 
@@ -46,6 +47,12 @@ export async function POST(req: Request) {
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
+  let eventBus: EventBus | null = null
+  try {
+    eventBus = container.resolve('eventBus') as EventBus
+  } catch {
+    eventBus = null
+  }
 
   let body: any
   try {
@@ -85,7 +92,7 @@ export async function POST(req: Request) {
   }
 
   try {
-    const result = await ruleEngine.executeRules(em, context)
+    const result = await ruleEngine.executeRules(em, context, { eventBus })
 
     const response = {
       allowed: result.allowed,

package/src/modules/business_rules/backend/rules/page.tsx

@@ -264,14 +264,17 @@ export default function RulesListPage() {
         <RowActions
           items={[
             {
+              id: 'edit',
               label: t('common.edit'),
               href: `/backend/rules/${row.original.id}`,
             },
             {
+              id: row.original.enabled ? 'disable' : 'enable',
               label: row.original.enabled ? t('common.disable') : t('common.enable'),
               onSelect: () => handleToggleEnabled(row.original.id, row.original.enabled),
             },
             {
+              id: 'duplicate',
               label: t('common.duplicate'),
               onSelect: () => {
                 // TODO: Implement duplicate functionality in Step 5.2
@@ -279,6 +282,7 @@ export default function RulesListPage() {
               },
             },
             {
+              id: 'delete',
               label: t('common.delete'),
               onSelect: () => handleDelete(row.original.id, row.original.ruleName),
               destructive: true,

package/src/modules/business_rules/backend/sets/page.tsx

@@ -196,14 +196,17 @@ export default function RuleSetsListPage() {
         <RowActions
           items={[
             {
+              id: 'edit',
               label: t('common.edit'),
               href: `/backend/sets/${row.original.id}`,
             },
             {
+              id: row.original.enabled ? 'disable' : 'enable',
               label: row.original.enabled ? t('common.disable') : t('common.enable'),
               onSelect: () => handleToggleEnabled(row.original.id, row.original.enabled),
             },
             {
+              id: 'delete',
               label: t('common.delete'),
               onSelect: () => handleDelete(row.original.id, row.original.setName),
               destructive: true,

package/src/modules/business_rules/cli.ts

@@ -44,6 +44,7 @@ const seedGuardRules: ModuleCli = {
       const rulesPath = path.join(__dirname, '../workflows/examples', 'guard-rules-example.json')
       const rulesData = JSON.parse(fs.readFileSync(rulesPath, 'utf8'))
 
+      console.log('🧠 Seeding guard rules...')
       let seededCount = 0
       let skippedCount = 0
 
@@ -73,7 +74,7 @@ const seedGuardRules: ModuleCli = {
         seededCount++
       }
 
-      console.log(`\n✓ Guard rules seeding complete:`)
+      console.log(`\n✅ Guard rules seeding complete:`)
       console.log(`  - Seeded: ${seededCount}`)
       console.log(`  - Skipped (existing): ${skippedCount}`)
       console.log(`  - Total: ${rulesData.length}`)