@open-mercato/core 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7

package/src/modules/auth/lib/backendChrome.tsx

@@ -21,7 +21,7 @@ import {
 import { resolveRegisteredLucideIconNode } from '@open-mercato/ui/backend/icons/lucideRegistry'
 import { profilePathPrefixes, profileSections } from './profile-sections'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { getNavGroupOrderOverride } from '@open-mercato/shared/modules/overrides'
+import { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'
 import {
   getSelectedOrganizationFromRequest,
   resolveFeatureCheckContext,
@@ -89,21 +89,15 @@ type ResolveBackendChromePayloadArgs = {
   selectedTenantId?: string | null
 }
 
-/**
- * Settings section weights, keyed by the untranslated group id each page declares as `pageGroupKey`.
- *
- * Mirrors `defaultGroupOrder` above: an id, never a rendered label, so the panel keeps its intended
- * order in every locale and an app-side module can place its own section deterministically (#4843).
- */
-export const settingsSectionOrder: Record<string, number> = {
-  'settings.sections.system': 1,
-  'settings.sections.auth': 2,
-  'customer_accounts.settings.section': 3,
-  'settings.sections.dataDesigner': 4,
-  'settings.sections.moduleConfigs': 5,
-  'currencies.nav.group': 6,
-  'settings.sections.directory': 7,
-  'settings.sections.featureToggles': 8,
+const settingsSectionOrder: Record<string, number> = {
+  system: 1,
+  auth: 2,
+  'customer-portal': 3,
+  'data-designer': 4,
+  'module-configs': 5,
+  currencies: 6,
+  directory: 7,
+  'feature-toggles': 8,
 }
 
 type NavGroupWithWeight = Omit<BackendChromeNavGroup, 'id' | 'defaultName' | 'items'> & {
@@ -153,35 +147,19 @@ async function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {
   }
 }
 
-const defaultGroupOrder = [
-  'customers.nav.group',
-  'catalog.nav.group',
-  'customers~sales.nav.group',
-  'wms.nav.group',
-  'resources.nav.group',
-  'staff.nav.group',
-  'entities.nav.group',
-  'directory.nav.group',
-  'attachments.nav.group',
-]
-
-/**
- * Group ids ranked ahead of everything else, most significant first.
- *
- * An app may prepend its own ids via `overrides.nav.groupOrder` in `modules.ts`; ids it does not name
- * keep the ordering they have today. With no override configured this returns `defaultGroupOrder`
- * itself, so ordering is unchanged for every existing install.
- */
-function resolveGroupOrder(): string[] {
-  const override = getNavGroupOrderOverride()
-  if (!override || override.length === 0) return defaultGroupOrder
-  const overridden = new Set(override)
-  return [...override, ...defaultGroupOrder.filter((id) => !overridden.has(id))]
-}
-
 function normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {
-  const groupOrder = resolveGroupOrder()
-  const groupOrderIndex = new Map(groupOrder.map((id, index) => [id, index]))
+  const defaultGroupOrder = [
+    'customers.nav.group',
+    'catalog.nav.group',
+    'customers~sales.nav.group',
+    'wms.nav.group',
+    'resources.nav.group',
+    'staff.nav.group',
+    'entities.nav.group',
+    'directory.nav.group',
+    'attachments.nav.group',
+  ]
+  const groupOrderIndex = new Map(defaultGroupOrder.map((id, index) => [id, index]))
   groups.sort((a, b) => {
     const aIndex = groupOrderIndex.get(a.id)
     const bIndex = groupOrderIndex.get(b.id)
@@ -193,7 +171,7 @@ function normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight
     if (a.weight !== b.weight) return a.weight - b.weight
     return a.name.localeCompare(b.name)
   })
-  const defaultGroupCount = groupOrder.length
+  const defaultGroupCount = defaultGroupOrder.length
   groups.forEach((group, index) => {
     const rank = groupOrderIndex.get(group.id)
     const fallbackWeight = typeof group.weight === 'number' ? group.weight : 10_000
@@ -288,17 +266,15 @@ export async function resolveBackendChromePayload({
   const container = await loadScopedContainer()
   const em = container.resolve('em') as EntityManager
   const rbac = container.resolve('rbacService') as {
-    getEffectiveFeatures: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>
+    loadAcl: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<{
+      isSuperAdmin: boolean
+      features: string[]
+    }>
     userHasAllFeatures: (userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }) => Promise<boolean>
   }
 
   let scopedOrganizationId: string | null = auth.orgId ?? null
   let scopedTenantId: string | null = auth.tenantId ?? null
-  // The organization the caller actually *selected*, as distinct from the one the scope resolver fell
-  // back to. `resolveFeatureCheckContext` resolves `organizationId` to `auth.orgId` when no concrete
-  // organization is selected — which is precisely what an all-organizations view produces — so the
-  // resolved id cannot answer "which organization am I viewing".
-  let concretelySelectedOrganizationId: string | null = null
   let allowNavigation = true
 
   try {
@@ -311,22 +287,23 @@ export async function resolveBackendChromePayload({
     })
     scopedOrganizationId = organizationId
     scopedTenantId = scope.tenantId ?? auth.tenantId ?? null
-    concretelySelectedOrganizationId = scope.selectedId ?? null
     if (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length === 0) {
       allowNavigation = false
     }
   } catch {
     scopedOrganizationId = auth.orgId ?? null
     scopedTenantId = auth.tenantId ?? null
-    concretelySelectedOrganizationId = null
   }
 
-  const grantedFeatures = allowNavigation
-    ? await rbac.getEffectiveFeatures(auth.sub, {
+  const acl = allowNavigation
+    ? await rbac.loadAcl(auth.sub, {
         tenantId: scopedTenantId,
         organizationId: scopedOrganizationId,
       })
-    : []
+    : { isSuperAdmin: false, features: [] }
+
+  const rawGrantedFeatures = acl.isSuperAdmin ? ['*'] : acl.features
+  const grantedFeatures = filterGrantsByEnabledModules(rawGrantedFeatures)
   const featureChecker = async (features: string[]): Promise<string[]> => {
     if (!allowNavigation || !features.length) return []
     const context = {
@@ -434,11 +411,6 @@ export async function resolveBackendChromePayload({
     ?? (fallbackOrganizationId && !isAllOrganizationsSelection(fallbackOrganizationId) ? fallbackOrganizationId : null)
 
   let brand: BackendChromePayload['brand'] = null
-  // Resolved here rather than left to callers. `brand` only populates when the organization has a
-  // logo, so it is a branding channel, not a dependable "which organization am I viewing" source.
-  // Without this field every downstream app has to fetch `/api/directory/organization-switcher` and
-  // walk its tree for the selected id. The row is already loaded below, so the name costs nothing.
-  let currentOrganization: BackendChromePayload['currentOrganization'] = null
   if (brandOrganizationId && scopedTenantId) {
     try {
       const organization = await findOneWithDecryption(
@@ -448,26 +420,17 @@ export async function resolveBackendChromePayload({
         undefined,
         { tenantId: scopedTenantId, organizationId: brandOrganizationId },
       )
-      // Only when a concrete organization was selected. Under an all-organizations view
-      // `brandOrganizationId` still resolves (to the caller's own organization, which is what keeps
-      // branding working), so gating on the loaded row alone would misreport the scope.
-      if (organization && concretelySelectedOrganizationId === brandOrganizationId) {
-        currentOrganization = { id: String(organization.id), name: organization.name }
-      }
       if (organization?.logoUrl) {
         brand = {
           name: organization.name,
           logo: {
             src: organization.logoUrl,
             alt: `${organization.name} logo`,
-            preserveAspectRatio: !!organization.logoPreserveAspectRatio,
           },
         }
       }
     } catch {
-      // Fail soft, as before: a failed organization lookup must not take down the nav payload.
       brand = null
-      currentOrganization = null
     }
   }
 
@@ -480,6 +443,5 @@ export async function resolveBackendChromePayload({
     grantedFeatures,
     roles: Array.isArray(auth.roles) ? auth.roles : [],
     brand,
-    currentOrganization,
   }
 }

package/src/modules/auth/lib/setup-app.ts

@@ -5,7 +5,7 @@ import { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/d
 import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { normalizeTenantId } from './tenantAccess'
-import { computeEmailHash, emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
+import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'
 import { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'
@@ -190,20 +190,7 @@ export async function setupInitialTenant(
   const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)
 
   const mainEmail = primaryUser.email
-  const existingUserByHash = await findOneWithDecryption(
-    em,
-    User,
-    { emailHash: { $in: emailHashLookupValues(mainEmail) }, deletedAt: null },
-    {},
-    { tenantId: null, organizationId: null },
-  )
-  const existingUser = existingUserByHash ?? await findOneWithDecryption(
-    em,
-    User,
-    { email: mainEmail, deletedAt: null },
-    {},
-    { tenantId: null, organizationId: null },
-  )
+  const existingUser = await findOneWithDecryption(em, User, { email: mainEmail }, {}, { tenantId: null, organizationId: null })
   if (existingUser && failIfUserExists) {
     throw new Error('USER_EXISTS')
   }
@@ -333,7 +320,6 @@ export async function setupInitialTenant(
         ancestorIds: [],
         childIds: [],
         descendantIds: [],
-        logoPreserveAspectRatio: false,
         createdAt: new Date(),
         updatedAt: new Date(),
       })
@@ -371,12 +357,7 @@ export async function setupInitialTenant(
       await tem.flush()
 
       if (isTenantDataEncryptionEnabled()) {
-        // System-scoped maps are resolved from module code, never from a tenant row.
-        // Persisting one here would make the tenant-scoped encryption CLIs believe they
-        // own that entity and re-wrap its `system:<entityId>` ciphertext under the tenant
-        // DEK, which runtime decryption can no longer read.
         for (const spec of defaultEncryptionMaps) {
-          if (spec.keyScope === 'system') continue
           const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })
           if (!existing) {
             tem.persist(tem.create(EncryptionMap, {

package/src/modules/auth/lib/tenantAccess.ts

@@ -77,11 +77,3 @@ export async function enforceTenantSelection(ctx: TenantGuardCtx, requested: unk
   if (normalized === actorTenant) return actorTenant
   throw forbidden('Not authorized to target this tenant.')
 }
-
-export async function requireSuperAdmin(ctx: TenantGuardCtx): Promise<void> {
-  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
-  if (!isSuperAdmin) {
-    throw forbidden('Forbidden')
-  }
-}
-

package/src/modules/auth/services/rbacService.ts

@@ -5,11 +5,8 @@ import { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/aut
 import { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'
-import {
-  authorizeFeatures,
-  resolveEffectiveFeatures,
-} from '@open-mercato/shared/security/featurePolicy'
-import { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'
+import { matchFeature as sharedMatchFeature, hasAllFeatures as sharedHasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'
+import { filterGrantsByEnabledModules, getOwningModuleId, getEnabledModuleIds } from '@open-mercato/shared/security/enabledModulesRegistry'
 
 interface AclData {
   isSuperAdmin: boolean
@@ -46,9 +43,32 @@ export class RbacService {
     this.cacheTtlMs = ttlMs
   }
 
-  /** Compatibility wrapper for callers that already have both feature lists. */
+  /**
+   * Checks if a required feature is satisfied by a granted feature permission.
+   * 
+   * Wildcard patterns:
+   * - `*` (global wildcard): Grants access to all features
+   * - `prefix.*` (module wildcard): Grants access to all features starting with `prefix.`
+   *   and also the exact prefix itself (e.g., `entities.*` matches both `entities` and `entities.records.view`)
+   * - Exact match: Feature must match exactly (e.g., `users.view` only matches `users.view`)
+   * 
+   * @param required - The feature being requested (e.g., 'entities.records.view')
+   * @param granted - The feature permission granted (e.g., 'entities.*' or '*')
+   * @returns true if the granted permission satisfies the required feature
+   * 
+   * @example
+   * matchFeature('users.view', '*') // true - global wildcard
+   * matchFeature('entities.records.view', 'entities.*') // true - module wildcard
+   * matchFeature('entities', 'entities.*') // true - exact prefix match
+   * matchFeature('users.view', 'entities.*') // false - different module
+   * matchFeature('users.view', 'users.view') // true - exact match
+   */
+  private matchFeature(required: string, granted: string): boolean {
+    return sharedMatchFeature(required, granted)
+  }
+
   public hasAllFeatures(required: string[], granted: string[]): boolean {
-    return authorizeFeatures(required, { grantedFeatures: granted })
+    return sharedHasAllFeatures(required, granted)
   }
 
   private roleAclAllowsOrganization(acl: RoleAcl, organizationId: string | null | undefined): boolean {
@@ -360,6 +380,9 @@ export class RbacService {
   ): Promise<boolean> {
     if (!tenantId || !feature) return false
 
+    const enabledIds = getEnabledModuleIds()
+    if (enabledIds.length && !enabledIds.includes(getOwningModuleId(feature))) return false
+
     const em = this.em.fork()
     const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})
     const list = Array.isArray(roleAcls) ? roleAcls : []
@@ -367,13 +390,9 @@ export class RbacService {
 
     for (const acl of list) {
       if (!this.roleAclAllowsOrganization(acl, organizationId)) continue
+      if (acl.isSuperAdmin) return true
       const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []
-      if (authorizeFeatures([feature], {
-        grantedFeatures: grants,
-        unrestricted: acl.isSuperAdmin,
-      })) {
-        return true
-      }
+      if (this.hasAllFeatures([feature], filterGrantsByEnabledModules(grants))) return true
     }
 
     return false
@@ -417,22 +436,23 @@ export class RbacService {
   async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {
     if (!required.length) return true
     const acl = await this.loadAcl(userId, scope)
-    const organizationAllowed = acl.isSuperAdmin
-      || !acl.organizations
-      || !scope.organizationId
-      || acl.organizations.includes(scope.organizationId)
-      || acl.organizations.includes('__all__')
-    return authorizeFeatures(required, {
-      grantedFeatures: acl.features,
-      unrestricted: acl.isSuperAdmin,
-      scopeAllowed: organizationAllowed,
-    })
+    if (acl.isSuperAdmin) {
+      const enabledIds = getEnabledModuleIds()
+      if (!enabledIds.length) return true
+      const enabledSet = new Set(enabledIds)
+      return required.every((feature) => enabledSet.has(getOwningModuleId(feature)))
+    }
+    if (acl.organizations && scope.organizationId && !acl.organizations.includes(scope.organizationId) && !acl.organizations.includes('__all__')) return false
+    return this.hasAllFeatures(required, filterGrantsByEnabledModules(acl.features))
   }
 
   /**
-   * Returns the user's infrastructure grant list, filtered to enabled modules.
-   * The result may contain wildcards; authoritative checks must still go through
-   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.
+   * Returns the effective feature grant list for a user within a scope,
+   * filtered to enabled modules only. Super admins receive `['*']` expanded
+   * to per-module wildcards via `filterGrantsByEnabledModules` — consistent
+   * with `userHasAllFeatures` which also enforces disabled-module boundaries
+   * for super admins. Returns `[]` when the requested organization is outside
+   * the user's visibility list, or when the user does not exist.
    */
   async getGrantedFeatures(
     userId: string,
@@ -450,19 +470,4 @@ export class RbacService {
     }
     return filterGrantsByEnabledModules(acl.features)
   }
-
-  /** Returns concrete active feature IDs for browser capability payloads. */
-  async getEffectiveFeatures(
-    userId: string,
-    scope: { tenantId: string | null; organizationId: string | null },
-  ): Promise<string[]> {
-    const acl = await this.loadAcl(userId, scope)
-    const organizationAllowed = acl.isSuperAdmin
-      || !acl.organizations
-      || !scope.organizationId
-      || acl.organizations.includes(scope.organizationId)
-      || acl.organizations.includes('__all__')
-    if (!organizationAllowed) return []
-    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)
-  }
 }

package/src/modules/business_rules/api/rules/route.ts

@@ -21,7 +21,6 @@ import {
   invalidateBusinessRuleDiscoveryCache,
   resolveBusinessRuleDiscoveryCache,
 } from '../../lib/rule-engine'
-import { validateOpenMercatoCallActions } from '../../lib/openmercato-call-options'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('business_rules').child({ component: 'rules-api' })
@@ -88,41 +87,6 @@ const routeMetadata = {
 
 export const metadata = routeMetadata
 
-function hasOpenMercatoCallAction(actions: unknown): boolean {
-  return Array.isArray(actions)
-    && actions.some((action) => action && typeof action === 'object' && (action as { type?: unknown }).type === 'CALL_OPEN_MERCATO')
-}
-
-async function requireOpenMercatoCallConfiguratorAccess(
-  container: ReturnType<typeof createRequestContainer> extends Promise<infer T> ? T : never,
-  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>,
-): Promise<Response | null> {
-  if (!auth.sub) {
-    return NextResponse.json(
-      { error: 'Forbidden', requiredFeatures: ['api_keys.create'] },
-      { status: 403 },
-    )
-  }
-
-  const rbac = container.resolve('rbacService') as {
-    userHasAllFeatures?: (
-      userId: string,
-      required: string[],
-      scope: { tenantId: string | null; organizationId: string | null },
-    ) => Promise<boolean>
-  } | undefined
-  const allowed = await rbac?.userHasAllFeatures?.(auth.sub, ['api_keys.create'], {
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
-  })
-  if (allowed) return null
-
-  return NextResponse.json(
-    { error: 'Forbidden', requiredFeatures: ['api_keys.create'] },
-    { status: 403 },
-  )
-}
-
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) {
@@ -222,11 +186,6 @@ export async function POST(req: Request) {
   if (!auth) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
-  if (!auth.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: 'Tenant and organization context required' }, { status: 400 })
-  }
-  const tenantId = auth.tenantId
-  const organizationId = auth.orgId
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
@@ -241,8 +200,8 @@ export async function POST(req: Request) {
 
   const payload = {
     ...body,
-    tenantId,
-    organizationId,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     createdBy: auth.sub ?? auth.email ?? null,
   }
 
@@ -254,25 +213,6 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: `Validation failed: ${errors.join(', ')}` }, { status: 400 })
   }
 
-  if (hasOpenMercatoCallAction(parsed.data.successActions) || hasOpenMercatoCallAction(parsed.data.failureActions)) {
-    const accessError = await requireOpenMercatoCallConfiguratorAccess(container, auth)
-    if (accessError) return accessError
-  }
-
-  const actionErrors = [
-    ...await validateOpenMercatoCallActions(em as EntityManager, parsed.data.successActions, {
-      tenantId,
-      organizationId,
-    }),
-    ...await validateOpenMercatoCallActions(em as EntityManager, parsed.data.failureActions, {
-      tenantId,
-      organizationId,
-    }),
-  ]
-  if (actionErrors.length > 0) {
-    return NextResponse.json({ error: `Validation failed: ${actionErrors.join(', ')}` }, { status: 400 })
-  }
-
   const data = {
     ...parsed.data,
     conditionExpression: parsed.data.conditionExpression ?? null,
@@ -299,11 +239,6 @@ export async function PUT(req: Request) {
   if (!auth) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
-  if (!auth.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: 'Tenant and organization context required' }, { status: 400 })
-  }
-  const tenantId = auth.tenantId
-  const organizationId = auth.orgId
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
@@ -338,8 +273,8 @@ export async function PUT(req: Request) {
 
   const rule = await em.findOne(BusinessRule, {
     id: parsed.data.id,
-    tenantId,
-    organizationId,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
 
@@ -347,29 +282,6 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Rule not found' }, { status: 404 })
   }
 
-  const touchesOpenMercatoCall = hasOpenMercatoCallAction(parsed.data.successActions)
-    || hasOpenMercatoCallAction(parsed.data.failureActions)
-    || hasOpenMercatoCallAction(rule.successActions)
-    || hasOpenMercatoCallAction(rule.failureActions)
-  if (touchesOpenMercatoCall) {
-    const accessError = await requireOpenMercatoCallConfiguratorAccess(container, auth)
-    if (accessError) return accessError
-  }
-
-  const actionErrors = [
-    ...await validateOpenMercatoCallActions(em as EntityManager, parsed.data.successActions, {
-      tenantId,
-      organizationId,
-    }),
-    ...await validateOpenMercatoCallActions(em as EntityManager, parsed.data.failureActions, {
-      tenantId,
-      organizationId,
-    }),
-  ]
-  if (actionErrors.length > 0) {
-    return NextResponse.json({ error: `Validation failed: ${actionErrors.join(', ')}` }, { status: 400 })
-  }
-
   try {
     await enforceCommandOptimisticLockWithGuards(container, {
       resourceKind: 'business_rules.rule',

package/src/modules/business_rules/backend/rules/page.tsx

@@ -1,7 +1,6 @@
 "use client"
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/business_rules/extension-points'
 import Link from 'next/link'
 import { useRouter } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -343,7 +342,7 @@ export default function RulesListPage() {
           onFiltersApply={handleFiltersApply}
           onFiltersClear={handleFiltersClear}
           perspective={{
-            tableId: extensionPoints.hosts.rulesTable.tableId,
+            tableId: 'business-rules.rules.list',
           }}
           emptyState={(
             <ListEmptyState

package/src/modules/business_rules/components/ActionBuilder.tsx

@@ -3,13 +3,11 @@
 import * as React from 'react'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Plus, Code } from 'lucide-react'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
-import { ActionRow, type OpenMercatoCallOptionsState } from './ActionRow'
+import { ActionRow } from './ActionRow'
 import type { Action } from './utils/actionValidation'
 import { validateActions } from './utils/actionValidation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
-import type { OpenMercatoCallOptionsResponse } from '../lib/openmercato-call-options-types'
 
 export type ActionBuilderProps = {
   value: Action[] | null | undefined
@@ -31,52 +29,7 @@ export function ActionBuilder({
   const t = useT()
   const { confirm: confirmDialog, ConfirmDialogElement } = useConfirmDialog()
   const [showDebug, setShowDebug] = React.useState(false)
-  const [openMercatoOptions, setOpenMercatoOptions] = React.useState<OpenMercatoCallOptionsState>({
-    endpoints: [],
-    apiKeys: [],
-    loading: true,
-    error: null,
-  })
-  const actions = React.useMemo(() => value || [], [value])
-
-  React.useEffect(() => {
-    let cancelled = false
-
-    async function loadOpenMercatoOptions() {
-      setOpenMercatoOptions((current) => ({ ...current, loading: true, error: null }))
-      try {
-        const response = await apiCall<OpenMercatoCallOptionsResponse>('/api/business_rules/openmercato-call-options')
-        if (!response.ok || !response.result) {
-          const error = response.result && 'error' in response.result
-            ? String((response.result as any).error)
-            : t('business_rules.components.actionRow.openMercato.options.fetchFailed', { status: response.status })
-          throw new Error(error)
-        }
-        if (!cancelled) {
-          setOpenMercatoOptions({
-            endpoints: Array.isArray(response.result.endpoints) ? response.result.endpoints : [],
-            apiKeys: Array.isArray(response.result.apiKeys) ? response.result.apiKeys : [],
-            loading: false,
-            error: null,
-          })
-        }
-      } catch (error) {
-        if (!cancelled) {
-          setOpenMercatoOptions({
-            endpoints: [],
-            apiKeys: [],
-            loading: false,
-            error: error instanceof Error ? error.message : String(error),
-          })
-        }
-      }
-    }
-
-    void loadOpenMercatoOptions()
-    return () => {
-      cancelled = true
-    }
-  }, [t])
+  const actions = value || []
 
   const handleAddAction = () => {
     const newAction: Action = {
@@ -148,11 +101,10 @@ export function ActionBuilder({
         {/* Controls */}
         <div className="flex items-center gap-2">
           {showJsonPreview && actions.length > 0 && (
-            <Button
+            <button
               type="button"
               onClick={() => setShowDebug(!showDebug)}
-              variant="muted"
-              size="2xs"
+              className="flex items-center gap-1 text-xs text-muted-foreground hover:text-foreground"
               title={t('business_rules.components.actionBuilder.jsonPreview.toggle')}
             >
               <Code className="w-3 h-3" />
@@ -160,7 +112,7 @@ export function ActionBuilder({
                 ? t('business_rules.components.actionBuilder.jsonPreview.hide')
                 : t('business_rules.components.actionBuilder.jsonPreview.show')
               }
-            </Button>
+            </button>
           )}
         </div>
       </div>
@@ -191,7 +143,6 @@ export function ActionBuilder({
                 onMoveDown={index < actions.length - 1 ? handleMoveDown : undefined}
                 canMoveUp={index > 0}
                 canMoveDown={index < actions.length - 1}
-                openMercatoOptions={openMercatoOptions}
               />
             ))}
           </div>