@wildo-ai/saas-frontend-lib 1.0.1 → 1.1.1

package/dist/esm/core/resources/useResourceOperationActions.js

@@ -6,12 +6,19 @@
  * display priority sorting, risk-level-based button variants, confirmation dialogs for critical
  * operations, and "View Details" injection in summary mode.
  */
-import { useMemo, useState, useCallback, useContext, useRef } from 'react';
+import React, { useMemo, useState, useCallback, useContext, useRef } from 'react';
 import { useResourceRegistry } from './useResourceRegistry.js';
+import { useUserOrgs } from '../../core/security/useUserOrgs.js';
+import { useAppScopeSafe } from '../../core/scope/useAppScope.js';
 import { useNavigationController } from '../../core/navigation/useNavigationController.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
+import { resolveComponentLabel } from '../../core/i18n/component-label-resolution.utils.js';
 import { useIconRegistry } from '../../core/icons/useIconRegistry.js';
 import { useEventBus } from '../../core/events/useEventBus.js';
+import { NotificationContext } from '../../core/events/NotificationContext.js';
+import { ApplicationContext } from '../../core/runtime/ApplicationContext.shared.js';
+import { envLoader } from '../../core/runtime/env-variable-loader.frontend.service.js';
+import { buildCollectionExportUrl, downloadCollectionExport, } from '../../core/resources/collection-export-url.frontend.utils.js';
 import { useOperationsEnabled, buildOperationEnabledKey, } from './hooks/useOperationEnabled.js';
 import { NavigationUtils } from '../../core/navigation/navigation.utils.js';
 import { frontendResourceUtils, FrontendResourceUtils } from './frontend-resource.utils.js';
@@ -20,12 +27,44 @@ import { FrontendComponentType } from '@wildo-ai/presets-components-models';
 import { IconCategory, IconSize, StandardIconReference } from '../../core/icons/icon-registry.frontend.schemas.js';
 import { WebSocketContext } from '../../core/requests/websockets/WebSocketContext.js';
 import { extractEphemeralFields } from './ephemeral-fields.utils.js';
+import { ActionVisibility, ActionPlacement, DisabledActionHandling, ResourceOperationActionPresentation, resolveActionDisclosure, isOperationHeadless, isCollectionScopedOperation } from '../../core/resources/resources.frontend.schemas.js';
+import { ResourceOperationActionPopoverBody } from '../../components/resources/ResourceOperationActionPopover.js';
+import { InPlaceOperationTargetKind, useInPlaceOperation } from '../../core/resources/in-place/InPlaceOperationContext.js';
 import { ButtonVariants_Variant } from '../../components/actions/button.js';
-import { BULK_OPERATION_SELECTION_IDS_CONTEXT_KEY, getOperationsForCoreSemantic, RESOURCE_OPERATION_EXECUTED_DISCRIMINATOR_CONTEXT_KEY, isSingleResourceUpdateLikeOperation, pickPreferredOperationForCoreSemantic, resolveEffectiveCoreOperationFromOperation, shouldEmitResourceRefreshAfterDirectOperation, shouldNavigateResourceOperation, shouldTreatAsNonItemResourceOperation, } from './operation-semantics.frontend.utils.js';
-import { CoreResourceOperation, ResourceOperationRiskLevel, ResourceOperationDisplayMode, ResourcesConfig_OperationPathUtils, ResourceOperationVariantType, FeatureUnavailabilityBehavior, } from '@wildo-ai/saas-models';
+import { actionPresentationNavigates, BULK_OPERATION_SELECTION_IDS_CONTEXT_KEY, buildBulkOperationSelectorPayload, resolveResourceOperationActionPresentation, getOperationsForCoreSemantic, RESOURCE_OPERATION_EXECUTED_DISCRIMINATOR_CONTEXT_KEY, isGeneratedFileRegenerateOperation, isGeneratedCollectionExportOperation, readResourceOperationExecutedDiscriminator, resolveEffectiveCoreOperationFromOperation, shouldEmitResourceRefreshAfterDirectOperation, shouldTreatAsNonItemResourceOperation, } from './operation-semantics.frontend.utils.js';
+import { isFrontendOperationAddressableForCurrentContext, pickPreferredOperationForCoreSemanticAddressability, shouldRequireCurrentContextAddressabilityForOperation, } from './resource-addressability.frontend.utils.js';
+import { normalizeContextResourceIdentifiersForOutcome, normalizeContextResourceIdentifiersForTransport, } from './context-resource-identifiers.frontend.utils.js';
+import { CoreResourceOperation, ResourceOperationRiskLevel, ResourceOperationDisplayMode, ResourcesConfig_OperationPathUtils, Resources_SharedUtils, ResourceGeneratedOperationKind, ResourceCollectionExportRowScope, listCollectionExportSelections, ResourceOperationVariantType, FeatureUnavailabilityBehavior, userRolesSatisfyRequiredRoles, selectHighestRightsVariants, } from '@wildo-ai/saas-models';
 function toActionBarFeatureAvailability(featureAvailability) {
     return featureAvailability;
 }
+function operationInitiatorParametersSatisfied(operation, contextResourceIdentifiers, contextualParameters) {
+    const initiatorInfos = operation.initiatorInfos ?? [];
+    if (initiatorInfos.length === 0) {
+        return true;
+    }
+    return initiatorInfos.some((initiatorInfo) => {
+        const parameters = initiatorInfo.parameters ?? [];
+        if (parameters.length === 0) {
+            return true;
+        }
+        return parameters.every((parameter) => {
+            const candidateKeys = [
+                parameter.fieldIdentifier,
+                parameter.relationshipField,
+                parameter.resourceType,
+            ].filter((key) => typeof key === 'string' && key.length > 0);
+            return candidateKeys.some((key) => {
+                const contextResourceId = frontendResourceUtils.getResourceId(contextResourceIdentifiers[key]);
+                if (contextResourceId.length > 0) {
+                    return true;
+                }
+                const contextualValue = contextualParameters[key];
+                return contextualValue !== undefined && String(contextualValue).length > 0;
+            });
+        });
+    });
+}
 // ─────────────────────────────────────────────────────────────────────────────
 // Default display priorities by operation type
 // ─────────────────────────────────────────────────────────────────────────────
@@ -39,6 +78,72 @@ const DEFAULT_DISPLAY_PRIORITIES = {
 };
 const DEFAULT_CUSTOM_OPERATION_PRIORITY = 50;
 const VIEW_DETAILS_PRIORITY = 0;
+/**
+ * The export contract declared on a collection-export companion, or `undefined`.
+ *
+ * Read defensively: the frontend receives operations through several projections and the
+ * semantics-level type models `generatedOperation` only loosely. A missing contract means the action
+ * is not offered — never a download built from guessed defaults.
+ */
+function resolveCollectionExportConfig(operation) {
+    const metadata = operation.generatedOperation;
+    const exportConfig = metadata?.export;
+    if (!exportConfig?.formats?.length || !exportConfig.rowScopes?.length)
+        return undefined;
+    return exportConfig;
+}
+/**
+ * Name ONE offered export in a way a person can choose between at a glance.
+ *
+ * The format is the coarse choice and leads; the row scope is the qualifier. "This page" rather than
+ * the enum's own wording, because the user is looking at that page — and "all rows" rather than
+ * "full result set", because what they care about is how much is about to leave, not the mechanism.
+ */
+/**
+ * Drop `page`/`limit` from a forwarded listing query.
+ *
+ * A whole-result-set export iterates internally and the backend ignores the caller's pagination for
+ * that scope — but forwarding `page=3` would still be a lie in the request, and the moment anything
+ * downstream started honouring it the export would return one page while claiming to return
+ * everything. Filters and sort ARE forwarded: they define WHICH rows, which is the whole point.
+ */
+function omitPaginationFromListingQuery(params) {
+    if (!params)
+        return undefined;
+    const { page: _page, limit: _limit, ...rest } = params;
+    return rest;
+}
+function describeCollectionExportSelection(selection) {
+    const scopeLabel = selection.rowScope === ResourceCollectionExportRowScope.FULL_RESULT_SET
+        ? 'all rows'
+        : 'this page';
+    return `${selection.format.toUpperCase()} — ${scopeLabel}`;
+}
+function humanizeGeneratedFileFieldName(operation) {
+    // NARROW on `kind` before reading `fieldName`. `generatedOperation` is a DISCRIMINATED UNION —
+    // the file-regenerate member carries `fieldName`, the collection-export member does not — so an
+    // unnarrowed read is both a type error and, if it ever compiled, a field lookup on the wrong
+    // member. Reading the metadata without asking which kind it is was the one site that had to change
+    // when the union grew from a single member.
+    const generatedFileRegenerate = operation.generatedOperation?.kind === ResourceGeneratedOperationKind.GENERATED_FILE_REGENERATE
+        ? operation.generatedOperation
+        : undefined;
+    const fieldName = typeof generatedFileRegenerate?.fieldName === 'string'
+        ? generatedFileRegenerate.fieldName
+        : typeof operation.operationIdentifier === 'string'
+            ? Resources_SharedUtils.parseGeneratedFileRegenerateOperationIdentifier(operation.operationIdentifier)?.fieldName
+            : undefined;
+    if (!fieldName)
+        return undefined;
+    const pathSegments = fieldName.split('.').filter(Boolean);
+    const lastSegment = pathSegments[pathSegments.length - 1] ?? fieldName;
+    const words = lastSegment
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/[-_]+/g, ' ')
+        .replace(/\bpdf\b/gi, '')
+        .trim();
+    return words.length > 0 ? words : undefined;
+}
 // ─────────────────────────────────────────────────────────────────────────────
 // Operations that are NOT per-item actions (excluded by default for item mode)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -65,18 +170,55 @@ const CORE_OPERATION_LABEL_KEYS = {
     [CoreResourceOperation.UPDATE]: 'edit',
     [CoreResourceOperation.DELETE]: 'delete',
 };
+/** Stable empty-array reference for role inputs when permissions are absent. */
+const EMPTY_ROLES = [];
 // ─────────────────────────────────────────────────────────────────────────────
 // Hook
 // ─────────────────────────────────────────────────────────────────────────────
 export function useResourceOperationActions(params) {
-    const { resourceType, displayMode, currentObject, contextResourceIdentifiers, parentResourcesRequirements = [], navigationZone, operationId = 'operations', excludeOperations = [], bulkOnly = false, selectedItemIds, successDiscriminator, onOperationExecuted, } = params;
+    const { resourceType, displayMode, currentObject, contextResourceIdentifiers, parentResourcesRequirements, navigationZone, operationId = 'operations', excludeOperations, bulkOnly = false, collectionOnly = false, placementFilter, selectedItemIds, additionalContext, successDiscriminator, suppressViewDetails = false, onOperationExecuted, collectionExportQuery, } = params;
     const { registry, doOperation } = useResourceRegistry();
+    const { permissions } = useUserOrgs();
+    const appScope = useAppScopeSafe();
     const { navigateToResource } = useNavigationController();
-    const { tComponent, isReady } = useI18n({ component: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS });
+    const { tComponent, tResourceOperation, isReady } = useI18n({ component: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, resource: resourceType });
     const { renderIcon } = useIconRegistry();
+    // The element-level host, when this action bar is rendered inside a collection that provides one.
+    // Absent everywhere else, where `isAvailable` is false — see `InPlaceOperationContext`.
+    const inPlaceHost = useInPlaceOperation();
     const { emit } = useEventBus();
     const webSocket = useContext(WebSocketContext);
     const isWebSocketConnected = webSocket?.isConnected ?? false;
+    // Best-effort success toast for direct-executed actions that return a human
+    // `message` (drain-op summaries — "Re-queued 3 of 5; skipped 2", "Purged N").
+    // Read the context directly rather than the throwing `useNotification()` so the
+    // hook never hard-requires a NotificationProvider; it no-ops when none is mounted.
+    // Read the context directly rather than the throwing `useApplication()`, for the same reason the
+    // notification context below is read this way: this hook must never hard-require a provider, and
+    // several of its callers (and every one of its tests) mount without one. Absent ⇒ the export
+    // action degrades to "not offered" instead of crashing the whole action bar.
+    const application = useContext(ApplicationContext);
+    const applicationRef = useRef(application);
+    applicationRef.current = application;
+    // The listing's live query, read through a REF at CLICK time rather than captured when the
+    // callback was built.
+    //
+    // This is the same pattern `notificationRef` and `applicationRef` above use, and here it removes a
+    // failure mode rather than a dependency: the action bar's items memo closes over the download
+    // callback directly, so a callback that captured the query would hand the user a file describing
+    // the UNFILTERED set while the screen showed a filter — a wrong answer delivered as a successful
+    // 200. Measured in the running app on 2026-08-25.
+    //
+    // Deliberately NOT relying on the memo's dependency list to keep it fresh. That list DOES include
+    // the callback, and it works — but only because several of its other entries also change identity
+    // when the listing refetches. Depending on that is depending on a coincidence: remove the
+    // dependency and the end-to-end behaviour still looks correct, which is precisely why a browser
+    // lane cannot pin it. The ref makes the staleness unrepresentable instead of merely unlikely.
+    const collectionExportQueryRef = useRef(collectionExportQuery);
+    collectionExportQueryRef.current = collectionExportQuery;
+    const notification = useContext(NotificationContext);
+    const notificationRef = useRef(notification);
+    notificationRef.current = notification;
     // Stable refs for async operations
     const doOperationRef = useRef(doOperation);
     const emitRef = useRef(emit);
@@ -85,8 +227,17 @@ export function useResourceOperationActions(params) {
     emitRef.current = emit;
     isWebSocketConnectedRef.current = isWebSocketConnected;
     // Confirmation dialog state
-    const [confirmState, setConfirmState] = useState({ open: false, label: '', callback: null });
+    const [confirmState, setConfirmState] = useState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', callback: null });
     const [isExecuting, setIsExecuting] = useState(false);
+    /**
+     * Which action currently has its anchored panel open, by operation PATH KEY.
+     *
+     * A path key rather than the operation object: the items memo rebuilds on every dependency change
+     * and hands back fresh operation references, so an identity comparison would close the panel the
+     * moment anything around it re-rendered. Only ONE panel is open at a time, which is what a single
+     * key expresses — two anchored panels open at once is not a state the bar can present.
+     */
+    const [openPopoverOperationKey, setOpenPopoverOperationKey] = useState(null);
     // Ephemeral fields reveal state (for operations returning one-time-only data)
     const [ephemeralFields, setEphemeralFields] = useState(null);
     const ephemeralPostAcknowledgeRef = useRef(null);
@@ -94,18 +245,187 @@ export function useResourceOperationActions(params) {
     const resourceConfig = useMemo(() => {
         return registry.resourceConfigurations[resourceType];
     }, [registry, resourceType]);
+    // Resolve the effective action-surfacing (disclosure) policy for this view:
+    // per-resource override (`layout.actionDisclosure[displayMode]`) over the
+    // framework default. `disabledActionHandling` is consumed below to decide
+    // whether an enabledCondition-disabled action is hidden or rendered greyed;
+    // the sibling `maxPrimaryActions` (overflow cap) is resolved by the host
+    // (ResourceLayout_OperationsItems), which owns the ActionBar `maxDisplayed`.
+    const disclosure = useMemo(() => resolveActionDisclosure(displayMode, resourceConfig?.frontendConfiguration?.layout?.actionDisclosure), [displayMode, resourceConfig]);
+    // ───────────────────────────────────────────────────────────────────────────
+    // Value-stabilize caller-supplied reference inputs (perf: keep `items` stable).
+    //
+    // `contextResourceIdentifiers` and `parentResourcesRequirements` are supplied by
+    // the caller and are, in practice, fresh references on most renders: the
+    // per-item / bulk operation layouts forward `resourceContext.*` fields that are
+    // re-created upstream, and `parentResourcesRequirements` previously hit an
+    // `= []` destructuring default that minted a brand-new array on every render the
+    // caller omitted it. Each one feeds the ActionBar `items` memo — directly, or
+    // transitively through `contextResourceIdentifiersWithIdEvidence` /
+    // `contextualParameters` / the operation callbacks — so a churning reference
+    // rebuilds the whole `items` array and every onClick closure on every commit,
+    // re-rendering each row operation's Radix Tooltip / DropdownMenu even when
+    // nothing changed. Stabilize by value: keep the same reference until the
+    // serialized contents actually change.
+    //
+    // Stabilization lives INSIDE the hook (rather than asking the two call sites to
+    // memoize) so the hook is robust to any caller — matching the sibling
+    // `excludeOperations`/`stableExcludeOperations` stabilization below. ESLint
+    // exhaustive-deps is not wired in this repo; reading the raw prop inside a memo
+    // keyed on its serialized contents is deliberate value-stabilization, not an
+    // oversight.
+    //
+    // Note `parentResourcesRequirements` is an array of OBJECTS
+    // (`FrontendResource_ParentResourceRequirement[]`, each a flat record of
+    // primitives), so a serialized-content key is the structural-equality projection
+    // it needs — a plain `join()` (which would suffice for a `string[]` like
+    // `excludeOperations`) would not capture the per-entry fields.
+    const contextResourceIdentifiersKey = JSON.stringify(contextResourceIdentifiers ?? {});
+    const stableContextResourceIdentifiers = useMemo(() => contextResourceIdentifiers, [contextResourceIdentifiersKey]);
+    const parentResourcesRequirementsKey = JSON.stringify(parentResourcesRequirements ?? []);
+    const stableParentResourcesRequirements = useMemo(() => parentResourcesRequirements ?? [], [parentResourcesRequirementsKey]);
+    // Derive the current-resource-id evidence as a SCALAR so the evidence memo below
+    // keys on the resolved id *value* rather than the `currentObject` reference.
+    // `currentObject` is a caller prop frequently re-created each render (row data,
+    // detail payloads); keying the memo on the whole object would rebuild
+    // `contextResourceIdentifiersWithIdEvidence` — and every downstream consumer of
+    // it — on every render even when the id is unchanged. Only these two scalar
+    // reads of `currentObject` matter here, so projecting to the resolved id string
+    // is both cheaper and more stable than memoizing the object. (The
+    // `useOperationsEnabled` feed further below still receives the raw
+    // `currentObject`; its result map is already value-gated, so that path does not
+    // thrash `items`.)
+    const currentResourceIdEvidenceCandidate = currentObject?._id
+        ?? (resourceConfig?.resourceFieldIdentifier
+            ? currentObject?.[resourceConfig.resourceFieldIdentifier]
+            : undefined);
+    const currentResourceIdEvidence = typeof currentResourceIdEvidenceCandidate === 'string'
+        && currentResourceIdEvidenceCandidate.length > 0
+        ? currentResourceIdEvidenceCandidate
+        : undefined;
+    const contextResourceIdentifiersWithIdEvidence = useMemo(() => {
+        if (!currentResourceIdEvidence) {
+            return stableContextResourceIdentifiers;
+        }
+        const currentValue = stableContextResourceIdentifiers[resourceType];
+        if (frontendResourceUtils.getResourceId(currentValue) === currentResourceIdEvidence) {
+            return stableContextResourceIdentifiers;
+        }
+        const fieldIdentifier = currentValue
+            ? frontendResourceUtils.getFieldIdentifier(currentValue)
+            : undefined;
+        return {
+            ...stableContextResourceIdentifiers,
+            [resourceType]: fieldIdentifier
+                ? { fieldIdentifier, resourceId: currentResourceIdEvidence }
+                : currentResourceIdEvidence,
+        };
+    }, [
+        stableContextResourceIdentifiers,
+        currentResourceIdEvidence,
+        resourceType,
+    ]);
+    // `excludeOperations` is supplied by the caller and is, in practice, a fresh
+    // array reference on most renders: the per-item / bulk operation layouts
+    // either forward a prop that may be re-created upstream, or omit it entirely
+    // (previously hitting an `= []` destructuring default that minted a new array
+    // every render). A churning reference would force the `filteredOps` memo
+    // below to recompute every render, which in turn re-fires the
+    // `useOperationsEnabled` evaluation effect (its `operations` dependency would
+    // churn) — redundant async `enabledCondition` work on every commit. Stabilize
+    // by value: keep the same array identity until the set of excluded ids
+    // actually changes.
+    const excludeOperationsKey = JSON.stringify(excludeOperations ?? []);
+    const stableExcludeOperations = useMemo(() => excludeOperations ?? [], 
+    // Intentionally keyed on the serialized contents rather than the array
+    // reference (see comment above). ESLint exhaustive-deps is not wired in
+    // this repo; reading `excludeOperations` here without listing it is
+    // deliberate value-stabilization, not an oversight.
+    [excludeOperationsKey]);
+    // ─── User effective roles for operation-visibility gating ───
+    // The action bar must not surface operations the current user's role cannot
+    // perform — historically every declared operation rendered as a button and
+    // only 403'd on click (admin / super-admin actions leaked to plain members).
+    // Mirror the backend's hierarchy-aware authorization via
+    // `userRolesSatisfyRequiredRoles`: the user's app-scope roles
+    // (`permissions.appLevel`) and current-org roles
+    // (`permissions.organizations[orgId]`) are expanded through their role
+    // hierarchies and matched (OR) against each operation's `roles`. The backend
+    // stays the security authority; this is a display gate that fails open on
+    // uncertainty (see the util). Value-stabilized like the sibling inputs above so
+    // a fresh `permissions` reference does not churn `filteredOps`.
+    const currentOrganizationId = appScope?.currentOrganizationId ?? null;
+    const userAppRoles = permissions?.appLevel ?? EMPTY_ROLES;
+    const userOrgRoles = currentOrganizationId
+        ? permissions?.organizations?.[currentOrganizationId] ?? EMPTY_ROLES
+        : EMPTY_ROLES;
+    const userAppRolesKey = userAppRoles.join(',');
+    const userOrgRolesKey = userOrgRoles.join(',');
+    const stableUserAppRoles = useMemo(() => userAppRoles, 
+    // Keyed on serialized contents (value-stabilization), matching the sibling
+    // inputs above. ESLint exhaustive-deps is not wired in this repo.
+    [userAppRolesKey]);
+    const stableUserOrgRoles = useMemo(() => userOrgRoles, [userOrgRolesKey]);
     // ─── Step 1: Filter operations (stable reference for enabledCondition evaluation) ───
     const filteredOps = useMemo(() => {
         if (!resourceConfig)
             return [];
         const operations = (resourceConfig.operations || []);
-        const excludeSet = new Set(excludeOperations);
+        const excludeSet = new Set(stableExcludeOperations);
         return operations.filter((op) => {
             const opId = String(op.operationIdentifier);
             const isBulk = op.isBulkOperation ?? false;
             // Exclude explicitly excluded operations
             if (excludeSet.has(opId))
                 return false;
+            // App-level hide: the operation's action is configured HIDDEN for this surface
+            // (`views: [[Op.X, { actionVisibility: ActionVisibility.HIDDEN }]]`). Display-only
+            // — backend authorization is unaffected. (WHEN_AVAILABLE is handled later, in the
+            // items memo, since it depends on the async `enabledCondition` result.)
+            if (op.operationFrontendConfig?.actionVisibility === ActionVisibility.HIDDEN)
+                return false;
+            // Headless (API_ONLY) operations have NO UI surface — never render an action.
+            // The canonical headless filter for every action surface (the create button in
+            // ResourceLayout_List uses the same gate). An unsurfaced or `apiOnly()` item op
+            // resolves to API_ONLY at registry build time and must not produce a clickable action.
+            //
+            // The collection-export companion is exempt, and it is the THIRD gate its inherited posture
+            // trips: it is derived from a LIST, and a listing legitimately resolves to `API_ONLY` because
+            // it is a data surface rather than a clickable action. The export is the opposite — it exists
+            // ONLY to be clicked. Measured in the running app: the operation reached the frontend registry
+            // correctly (`collectionExport:list`, with its URLs and its export contract) and carried
+            // `operationFrontendConfig: { surface: 'api_only' }` straight from its source, so the action
+            // silently never rendered.
+            //
+            // Exempted HERE rather than by stamping a frontend surface in the models factory: the surface
+            // vocabulary lives in this package, and the models layer must not learn a frontend enum to
+            // describe an operation it derives.
+            if (isOperationHeadless(op.operationFrontendConfig) && !isGeneratedCollectionExportOperation(op))
+                return false;
+            // Collection-scope split (the single R5 chokepoint). A collection-scoped
+            // action (`actionScope: COLLECTION` — a whole-scope "retry all" / "purge
+            // all") renders ONLY in the list's dedicated collection-action surface,
+            // which passes `collectionOnly: true`. Every OTHER caller (the per-row /
+            // detail / danger-zone / bulk bars) leaves `collectionOnly` false and drops
+            // collection-scoped ops here, so they can never appear per row. Because all
+            // of those surfaces funnel through this one filter, the exclusion holds at a
+            // single site rather than N call sites.
+            // The export companion is collection-scoped BY CONSTRUCTION, not by declaration: it is derived
+            // from a LIST/SEARCH operation and inherits that operation's `operationFrontendConfig`, which
+            // has no reason to carry `actionScope: COLLECTION` (a listing is a surface, not an action).
+            // Asking the author to stamp it would put the burden on every app for something the framework
+            // already knows. Recognised HERE because this filter is the single site that decides which bar
+            // an operation belongs to — the comment above says so, and adding a second site is what the
+            // design avoids.
+            const isCollectionScoped = isCollectionScopedOperation(op.operationFrontendConfig)
+                || isGeneratedCollectionExportOperation(op);
+            if (collectionOnly) {
+                if (!isCollectionScoped || isBulk)
+                    return false;
+            }
+            else if (isCollectionScoped) {
+                return false;
+            }
             // Bulk mode: only bulk operations
             if (bulkOnly && !isBulk)
                 return false;
@@ -121,32 +441,139 @@ export function useResourceOperationActions(params) {
             if (vType && vType !== ResourceOperationVariantType.API_CALL && vType !== ResourceOperationVariantType.API_CALL_WITH_CALLBACK) {
                 return false;
             }
+            // Role-gating: do not surface operations the user's effective roles cannot
+            // perform (hierarchy-aware OR match mirroring backend authorization).
+            if (!userRolesSatisfyRequiredRoles({
+                requiredRoles: op.roles,
+                userAppRoles: stableUserAppRoles,
+                userOrgRoles: stableUserOrgRoles,
+            })) {
+                return false;
+            }
             return true;
         });
-    }, [resourceConfig, excludeOperations, bulkOnly]);
+    }, [resourceConfig, stableExcludeOperations, bulkOnly, collectionOnly, stableUserAppRoles, stableUserOrgRoles]);
     // ─── Step 2: Evaluate enabledCondition for all filtered operations ───
     // Async — starts as empty Map, then populates after evaluation completes.
+    //
+    // EC — bulk contract: in bulk mode (`bulkOnly`) the caller passes NO
+    // `currentObject` (there is no single record for N selected items), so a bulk
+    // variant whose `enabledCondition` reads `currentObject.<field>` evaluates
+    // against an empty object. This is intentional: bulk availability is scoped to
+    // ROLES + SELECTION only — author bulk conditions accordingly. Per-item state
+    // gating belongs on the per-row action, which DOES receive `currentObject`.
+    //
+    // (Also note: on async-loaded surfaces like the read view, `currentObject` is
+    // briefly `undefined` on first mount and this batch evaluates against `{}`
+    // until the record loads, then re-runs — a benign transient, not a bug.)
     const enabledMap = useOperationsEnabled(filteredOps, {
         currentObject,
         resourceType,
     });
     // Build contextual parameters for API calls (canonical implementation)
     const contextualParameters = useMemo(() => {
-        return FrontendResourceUtils.buildContextualParameters(contextResourceIdentifiers, registry);
-    }, [contextResourceIdentifiers, registry]);
+        return FrontendResourceUtils.buildContextualParameters(contextResourceIdentifiersWithIdEvidence, registry);
+    }, [contextResourceIdentifiersWithIdEvidence, registry]);
+    const hasCurrentResourceId = useMemo(() => Boolean(frontendResourceUtils.getResourceId(contextResourceIdentifiersWithIdEvidence[resourceType])), [contextResourceIdentifiersWithIdEvidence, resourceType]);
+    const effectiveSuccessDiscriminator = successDiscriminator
+        ?? readResourceOperationExecutedDiscriminator(additionalContext);
+    const isOperationAddressableForActions = useCallback((operation) => {
+        if (!resourceConfig) {
+            return true;
+        }
+        if (operation.isBulkOperation === true) {
+            return operationInitiatorParametersSatisfied(operation, contextResourceIdentifiersWithIdEvidence, contextualParameters);
+        }
+        const needsCurrentContextAddressability = shouldRequireCurrentContextAddressabilityForOperation({
+            operation,
+            resourceType,
+            resourceConfig,
+        });
+        if (!needsCurrentContextAddressability) {
+            return true;
+        }
+        return isFrontendOperationAddressableForCurrentContext({
+            resourceConfig,
+            operation,
+            registry,
+            hasResourceId: hasCurrentResourceId,
+            contextResourceIdentifiers: contextResourceIdentifiersWithIdEvidence,
+            contextualParameters,
+        });
+    }, [
+        contextResourceIdentifiersWithIdEvidence,
+        contextualParameters,
+        hasCurrentResourceId,
+        registry,
+        resourceConfig,
+        resourceType,
+    ]);
     // Resolve label for an operation
     const getOperationLabel = useCallback((operation) => {
         const opId = String(operation.operationIdentifier);
-        // Try component i18n first
+        if (isGeneratedCollectionExportOperation(operation)) {
+            // The FORMAT is in the label on purpose. One action performs one format, so a bare "Export"
+            // would leave the user guessing which file they are about to receive — and the answer is the
+            // author's declaration order, which no reader of the UI can see.
+            const exportConfig = resolveCollectionExportConfig(operation);
+            const selections = exportConfig ? listCollectionExportSelections(exportConfig) : [];
+            const label = resolveComponentLabel({
+                tComponent,
+                componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                key: 'collectionExport',
+            });
+            const base = label && label !== 'collectionExport' ? label : 'Export';
+            // Only ONE thing on offer ⇒ name it, so the button is not a mystery about which file arrives.
+            // Several ⇒ stay generic: the choice is in the menu, and repeating one of them in the trigger
+            // would imply that one is what clicking does.
+            return selections.length === 1 ? `${base} ${selections[0].format.toUpperCase()}` : base;
+        }
+        if (isGeneratedFileRegenerateOperation(operation)) {
+            const fieldLabel = humanizeGeneratedFileFieldName(operation);
+            if (fieldLabel) {
+                return `Regenerate ${fieldLabel} file`;
+            }
+            const label = resolveComponentLabel({
+                tComponent,
+                componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                key: 'generatedFileRegenerate',
+            });
+            if (label && label !== 'generatedFileRegenerate') {
+                return label;
+            }
+            return 'Regenerate file';
+        }
+        // Core operations (READ, UPDATE, DELETE) own a registered i18n key —
+        // try the framework's component-level i18n bundle first.
         const labelKey = CORE_OPERATION_LABEL_KEYS[opId];
         if (labelKey) {
-            const label = tComponent(FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, labelKey);
+            const label = resolveComponentLabel({
+                tComponent,
+                componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                key: labelKey,
+            });
             if (label)
                 return label;
         }
-        // Fallback: capitalize operation identifier
+        // Custom operations (anything outside `CORE_OPERATION_LABEL_KEYS`) come
+        // from the application developer. Prefer the resource's generated
+        // per-operation TITLE (`resources.{res}.operations.{op}.title`) — the SAME
+        // label the form host, header, and launcher resolve via `tResourceOperation`
+        // — so a scope-level "Retry all" / "Purge all" reads correctly (and the
+        // CRITICAL type-to-confirm phrase is a real word, not a camelCase-mangled
+        // id). `tResourceOperation` returns '' (or the raw `resources.` key path)
+        // when the title is not generated yet, in which case we fall back to a
+        // humanized identifier so unregistered custom op ids remain visible and
+        // addressable instead of vanishing.
+        //
+        // Examples: `switch_mode` → "Switch mode", `regenerate_secret` →
+        // "Regenerate secret", `retry_all` → "Retry all" (or generated title).
+        const generatedTitle = tResourceOperation(resourceType, opId, 'title');
+        if (generatedTitle && !generatedTitle.startsWith('resources.')) {
+            return generatedTitle;
+        }
         return opId.charAt(0).toUpperCase() + opId.slice(1).replace(/_/g, ' ').toLowerCase();
-    }, [tComponent]);
+    }, [tComponent, tResourceOperation, resourceType]);
     // Resolve icon for an operation
     const getOperationIcon = useCallback((operation) => {
         return renderIcon({
@@ -181,53 +608,191 @@ export function useResourceOperationActions(params) {
     const isOperationEnabled = useCallback((operation) => {
         return getOperationEntry(operation).isEnabled;
     }, [getOperationEntry]);
-    // Navigate to an operation (UPDATE, READ, etc.)
-    const handleNavigateOperation = useCallback((operation) => {
-        if (!resourceConfig)
-            return;
-        const opContext = frontendResourceUtils.createFrontendResourceOperationContextFromOperation({
+    /**
+     * The operation context an action hands to whatever host presents it.
+     *
+     * Extracted from `handleNavigateOperation` because the ANCHORED host needs the identical context:
+     * a popover and a page must present the same operation, with the same bulk selection and the same
+     * success discriminator, or the two hosts quietly become two contracts.
+     */
+    const buildOperationContext = useCallback((operation) => {
+        return frontendResourceUtils.createFrontendResourceOperationContextFromOperation({
             resourceType,
             operation,
-            contextResourceIdentifiers,
+            contextResourceIdentifiers: contextResourceIdentifiersWithIdEvidence,
             additionalContext: {
                 ...(operation.isBulkOperation === true && selectedItemIds?.length
                     ? {
                         [BULK_OPERATION_SELECTION_IDS_CONTEXT_KEY]: selectedItemIds,
                     }
                     : {}),
-                ...(successDiscriminator
+                ...(effectiveSuccessDiscriminator
                     ? {
-                        [RESOURCE_OPERATION_EXECUTED_DISCRIMINATOR_CONTEXT_KEY]: successDiscriminator,
+                        [RESOURCE_OPERATION_EXECUTED_DISCRIMINATOR_CONTEXT_KEY]: effectiveSuccessDiscriminator,
                     }
                     : {}),
             },
-            parentResourcesRequirements,
+            parentResourcesRequirements: stableParentResourcesRequirements,
             isOperationDefault: operation.isOperationDefault ?? true,
         });
-        const normalizedContextIdentifiers = FrontendResourceUtils.flattenContextIdentifiers(contextResourceIdentifiers);
-        const urlPath = NavigationUtils.resolveResourceUrl(resourceConfig, operation, normalizedContextIdentifiers, registry.allResourceFieldIdentifiers, parentResourcesRequirements)?.resolvedUrl;
+    }, [resourceType, contextResourceIdentifiersWithIdEvidence, stableParentResourcesRequirements, selectedItemIds, effectiveSuccessDiscriminator]);
+    // Navigate to an operation (UPDATE, READ, etc.)
+    const handleNavigateOperation = useCallback((operation) => {
+        if (!resourceConfig)
+            return;
+        const opContext = buildOperationContext(operation);
+        const normalizedContextIdentifiers = FrontendResourceUtils.flattenContextIdentifiers(contextResourceIdentifiersWithIdEvidence);
+        const urlPath = NavigationUtils.resolveResourceUrl(resourceConfig, operation, normalizedContextIdentifiers, registry.allResourceFieldIdentifiers, stableParentResourcesRequirements)?.resolvedUrl;
         navigateToResource(opContext, NavigationUtils.createOperationInitiator(navigationZone, operationId), urlPath);
-    }, [resourceConfig, resourceType, contextResourceIdentifiers, parentResourcesRequirements, registry, navigateToResource, navigationZone, operationId, selectedItemIds, successDiscriminator]);
+    }, [resourceConfig, buildOperationContext, contextResourceIdentifiersWithIdEvidence, stableParentResourcesRequirements, registry, navigateToResource, navigationZone, operationId]);
     // Execute an operation (DELETE, custom, etc.)
+    /**
+     * Fetch the export and hand the file to the browser.
+     *
+     * Three refusals, each silent-by-design in a different way and each therefore reported to the user
+     * rather than swallowed:
+     *  - no export contract on the operation (a projection that dropped `generatedOperation`);
+     *  - no resolvable URL (a parent id missing from the current context — the builder answers `null`
+     *    rather than producing a route that would 404);
+     *  - no application context (no provider mounted), so there is no authenticated client to fetch
+     *    with. A plain `<a href>` would "work" and download an HTML login page named `.csv`.
+     */
+    const handleCollectionExportDownload = useCallback(async (operation, selection) => {
+        const exportConfig = resolveCollectionExportConfig(operation);
+        const httpClient = applicationRef.current?.httpClient;
+        if (!exportConfig || !httpClient) {
+            notificationRef.current?.notifyError?.('This export is not available here.');
+            return;
+        }
+        // REFUSE rather than export the wrong thing. When the listing is showing text-search results it
+        // is driving the SEARCH operation, and this companion exports its own source — a LIST export
+        // would quietly return rows the user is not looking at, which is the worst kind of correct
+        // response. A resource that declares `collectionExport` on SEARCH too gets its own companion and
+        // this branch never fires for it.
+        const listingQueryNow = collectionExportQueryRef.current;
+        const exportsSearchResults = operation.resourceOperationLike === CoreResourceOperation.SEARCH;
+        if (listingQueryNow?.isSearchActive && !exportsSearchResults) {
+            notificationRef.current?.notifyError?.('Clear the search box before exporting — this export covers filters and sorting, not text search.');
+            return;
+        }
+        const { format, rowScope } = selection;
+        const url = buildCollectionExportUrl({
+            registry,
+            resourceConfig,
+            exportOperation: operation,
+            resourceType,
+            // The TRANSPORT-normalized map, not the raw one: a caller may pass
+            // `{ fieldIdentifier, resourceId }` evidence objects, and route matching wants plain ids. The
+            // normalizer is the same one every other transport-facing call in this hook uses.
+            contextResourceIdentifiers: normalizeContextResourceIdentifiersForTransport(contextResourceIdentifiers),
+            contextualParameters,
+            parentResourcesRequirements: stableParentResourcesRequirements,
+            apiBaseUrl: envLoader.getApiUrl(),
+            format,
+            rowScope,
+            // The listing's OWN query — the filters, sort and page the user is looking at. Without it the
+            // export answers a different question from the screen it was clicked on, and a `VISIBLE_PAGE`
+            // export in particular becomes meaningless: it would return page 1 of an unfiltered set.
+            listingQuery: rowScope === ResourceCollectionExportRowScope.FULL_RESULT_SET
+                ? omitPaginationFromListingQuery(listingQueryNow?.params)
+                : listingQueryNow?.params,
+        });
+        if (!url) {
+            notificationRef.current?.notifyError?.('This export cannot be addressed from here.');
+            return;
+        }
+        try {
+            await downloadCollectionExport({
+                url,
+                resourceType,
+                format,
+                // `fetchFileBlob` is the authenticated byte path — the access token lives in the http client,
+                // not in a cookie a browser navigation would carry.
+                getBlob: (blobUrl) => httpClient.fetchFileBlob(blobUrl),
+            });
+        }
+        catch (error) {
+            // The backend REFUSES rather than truncating when an export exceeds its declared ceiling, so a
+            // failure here is a message worth showing — silently doing nothing would read as a dead button.
+            notificationRef.current?.notifyError?.(error instanceof Error && error.message ? error.message : 'The export could not be produced.');
+        }
+    }, [
+        registry,
+        resourceConfig,
+        resourceType,
+        contextResourceIdentifiers,
+        contextualParameters,
+        stableParentResourcesRequirements,
+        // `collectionExportQuery` is deliberately ABSENT: it is read through its ref above, so listing it
+        // here would rebuild every export button on every keystroke in a filter for no behavioural gain.
+    ]);
     const handleExecuteOperation = useCallback(async (operation) => {
         if (!resourceConfig)
             return;
         setIsExecuting(true);
         try {
             const operationPathKey = ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(operation);
-            // For bulk operations, pass selected IDs as request data
+            // Request body. Bulk ops send the selection; a ROW-TARGETED action sends the
+            // clicked row's id under its declared `rowTargetRequestField` (e.g. a per-row
+            // "Retry" whose backend reads `{ entryId }` from the body — the id also rides
+            // the URL path, which that handler ignores). Mutually exclusive: a
+            // row-targeted action is ITEM-scoped, never bulk. Collection-scoped drain
+            // ops carry no `rowTargetRequestField`, so they send an empty body.
             const isBulk = operation.isBulkOperation ?? false;
-            const requestData = isBulk && selectedItemIds?.length ? { ids: selectedItemIds } : undefined;
+            const rowTargetField = operation.operationFrontendConfig?.rowTargetRequestField;
+            const rowTargetId = rowTargetField
+                ? frontendResourceUtils.getResourceId(contextResourceIdentifiersWithIdEvidence[resourceType])
+                : '';
+            const requestData = isBulk && selectedItemIds?.length
+                ? buildBulkOperationSelectorPayload(selectedItemIds)
+                : rowTargetField && rowTargetId
+                    ? { [rowTargetField]: rowTargetId }
+                    : undefined;
+            // A row-targeted action MUST resolve the clicked row's id (it is injected
+            // into the request body). If it cannot, fail loudly through the catch below
+            // rather than POST an empty body the backend rejects as not-found. In
+            // practice a per-row action always carries its id; this guards a
+            // misconfiguration / missing-context edge.
+            if (rowTargetField && !rowTargetId) {
+                throw new Error(`Row-targeted operation "${String(operation.operationIdentifier)}" could not resolve the target row id from context.`);
+            }
             const result = await doOperationRef.current(operationPathKey, {
                 contextualParameters,
-                parentResourcesRequirements,
+                parentResourcesRequirements: stableParentResourcesRequirements,
                 ...(requestData ? { requestData } : {}),
-            });
+            }, 
+            // silent: the resource layer owns the failure UX — the catch below emits a
+            // single NOTIFY_RESOURCE_ERROR toast. Suppress the global error toast so
+            // action-bar operations (delete, custom, bulk) match the form's model.
+            { silent: true });
+            // Surface any human summary the action returned ("Re-queued 3 of 5; skipped
+            // 2", "Purged N entries") as a success toast. Best-effort: fires only when a
+            // NotificationProvider is mounted (see `notificationRef`) and the result is a
+            // plain object carrying a non-empty string `message`. This is the ONLY path
+            // that surfaces a custom op's response message — the resource-notification
+            // event path resolves the operation title, not the response body.
+            const resultMessage = result && typeof result === 'object' && !Array.isArray(result)
+                ? result.message
+                : undefined;
+            if (typeof resultMessage === 'string' && resultMessage.length > 0) {
+                notificationRef.current?.notifySuccess(resultMessage);
+            }
             // Build the post-operation side effects (refresh + callback) as a single closure
             const runPostOperationEffects = () => {
+                const isGeneratedFileRegenerate = isGeneratedFileRegenerateOperation(operation);
+                const normalizedTransportContext = normalizeContextResourceIdentifiersForTransport(contextResourceIdentifiersWithIdEvidence);
+                const normalizedOutcomeContext = normalizeContextResourceIdentifiersForOutcome({
+                    contextResourceIdentifiers: contextResourceIdentifiersWithIdEvidence,
+                    resourceType,
+                    result,
+                });
+                const outcomeContextualParameters = FrontendResourceUtils.buildContextualParameters(normalizedOutcomeContext, registry);
+                const resultSummary = typeof result === 'object' && result !== null
+                    ? result
+                    : undefined;
                 if (!isWebSocketConnectedRef.current && shouldEmitResourceRefreshAfterDirectOperation(operation)) {
-                    const listOperations = getOperationsForCoreSemantic(resourceConfig.operations ?? [], CoreResourceOperation.LIST);
-                    const { [resourceType]: _self, ...parentScopeIdentifiers } = contextResourceIdentifiers;
+                    const listOperations = getOperationsForCoreSemantic(resourceConfig.operations ?? [], CoreResourceOperation.LIST).filter((listOperation) => operationInitiatorParametersSatisfied(listOperation, contextResourceIdentifiersWithIdEvidence, contextualParameters));
+                    const { [resourceType]: _self, ...parentScopeIdentifiers } = normalizedTransportContext;
                     const refreshTargets = listOperations.length > 0
                         ? listOperations
                         : [null];
@@ -238,24 +803,71 @@ export function useResourceOperationActions(params) {
                             resourceType,
                             operationIdentifier: String(listOperationContext.operationIdentifier ?? CoreResourceOperation.LIST),
                             operation: listOperationContext,
+                            variantType: listOperation?.variantType,
                             isOperationDefault: listOperation?.isOperationDefault ?? true,
                             isBulkOperation: listOperation?.isBulkOperation ?? false,
                             variantKey: listOperation?.variantKey,
                             contextResourceIdentifiers: parentScopeIdentifiers,
-                            parentResourcesRequirements,
+                            parentResourcesRequirements: stableParentResourcesRequirements,
+                            ...(effectiveSuccessDiscriminator ? { optionalDiscriminator: effectiveSuccessDiscriminator } : {}),
                         });
                     }
+                    if (isGeneratedFileRegenerate) {
+                        const readOperations = getOperationsForCoreSemantic(resourceConfig.operations ?? [], CoreResourceOperation.READ, {
+                            requireAddressable: true,
+                        }).filter((readOperation) => isFrontendOperationAddressableForCurrentContext({
+                            resourceConfig,
+                            operation: readOperation,
+                            registry,
+                            hasResourceId: frontendResourceUtils.getResourceId(normalizedOutcomeContext[resourceType]).length > 0,
+                            contextResourceIdentifiers: normalizedOutcomeContext,
+                            contextualParameters: outcomeContextualParameters,
+                        }));
+                        const readRefreshTargets = readOperations.length > 0
+                            ? readOperations
+                            : [null];
+                        const emittedReadOperationKeys = new Set();
+                        for (const readOperation of readRefreshTargets) {
+                            const readOperationContext = readOperation
+                                ?? { operationIdentifier: CoreResourceOperation.READ };
+                            const readOperationKey = [
+                                frontendResourceUtils.getResourceId(normalizedOutcomeContext[resourceType]),
+                                String(readOperationContext.operationIdentifier),
+                                readOperationContext.variantType ?? '',
+                                readOperationContext.variantKey ?? '',
+                                readOperationContext.isBulkOperation ?? false,
+                            ].join(':');
+                            if (emittedReadOperationKeys.has(readOperationKey)) {
+                                continue;
+                            }
+                            emittedReadOperationKeys.add(readOperationKey);
+                            emitRef.current(FrontendEvents.RESOURCE_REFRESH, {
+                                resourceType,
+                                operationIdentifier: String(readOperationContext.operationIdentifier ?? CoreResourceOperation.READ),
+                                operation: readOperationContext,
+                                variantType: readOperation?.variantType,
+                                isOperationDefault: readOperation?.isOperationDefault ?? true,
+                                isBulkOperation: readOperation?.isBulkOperation ?? false,
+                                variantKey: readOperation?.variantKey,
+                                contextResourceIdentifiers: normalizedOutcomeContext,
+                                parentResourcesRequirements: stableParentResourcesRequirements,
+                                ...(effectiveSuccessDiscriminator ? { optionalDiscriminator: effectiveSuccessDiscriminator } : {}),
+                            });
+                        }
+                    }
                 }
                 emitRef.current(FrontendEvents.RESOURCE_OPERATION_EXECUTED, {
                     resourceType,
                     operationIdentifier: String(operation.operationIdentifier),
                     operation,
+                    variantType: operation.variantType,
                     isOperationDefault: operation.isOperationDefault ?? true,
                     isBulkOperation: operation.isBulkOperation ?? false,
                     variantKey: operation.variantKey,
-                    contextResourceIdentifiers,
-                    parentResourcesRequirements,
-                    optionalDiscriminator: successDiscriminator,
+                    contextResourceIdentifiers: normalizedOutcomeContext,
+                    parentResourcesRequirements: stableParentResourcesRequirements,
+                    resultSummary,
+                    ...(effectiveSuccessDiscriminator ? { optionalDiscriminator: effectiveSuccessDiscriminator } : {}),
                 });
                 onOperationExecuted?.(operation);
             };
@@ -272,54 +884,154 @@ export function useResourceOperationActions(params) {
         }
         catch (err) {
             console.error(`[useResourceOperationActions] Operation ${String(operation.operationIdentifier)} failed:`, err);
+            // Resource layer owns the failure UX: emit ONE resource error toast. The
+            // doOperation above passes `silent: true` so the global error toast is
+            // suppressed — this mirrors the form's NOTIFY_RESOURCE_ERROR contract so
+            // action-bar operations (delete, custom, bulk) surface failures consistently
+            // and with a localized message (resolved via tErrorMessage in NotificationContext).
+            const failure = (err && typeof err === 'object')
+                ? err
+                : {};
+            emitRef.current(FrontendEvents.NOTIFY_RESOURCE_ERROR, {
+                resourceType,
+                operationIdentifier: String(operation.operationIdentifier),
+                operation,
+                variantType: operation.variantType,
+                isOperationDefault: operation.isOperationDefault ?? true,
+                isBulkOperation: operation.isBulkOperation ?? false,
+                variantKey: operation.variantKey,
+                contextResourceIdentifiers: normalizeContextResourceIdentifiersForTransport(contextResourceIdentifiersWithIdEvidence),
+                parentResourcesRequirements: stableParentResourcesRequirements,
+                additionalContext: {
+                    error: failure.message ?? (err instanceof Error ? err.message : String(err)),
+                    errorCustomMessageReference: failure.customMessageReference,
+                    errorHttpStatus: failure.httpStatus,
+                },
+            });
         }
         finally {
             setIsExecuting(false);
         }
-    }, [resourceConfig, resourceType, contextualParameters, contextResourceIdentifiers, parentResourcesRequirements, selectedItemIds, successDiscriminator, onOperationExecuted]);
+    }, [
+        resourceConfig,
+        resourceType,
+        registry,
+        contextualParameters,
+        contextResourceIdentifiersWithIdEvidence,
+        stableParentResourcesRequirements,
+        selectedItemIds,
+        effectiveSuccessDiscriminator,
+        onOperationExecuted,
+    ]);
     // Handle click — navigate, execute, or show confirmation
     const handleOperationClick = useCallback((operation) => {
+        // ── COLLECTION EXPORT ───────────────────────────────────────────────────────────────────
+        // Intercepted BEFORE the navigate-vs-execute decision below, because it is neither. The export
+        // carries the listing's `requestDto` (every field optional), which the generic rule would read as
+        // "has input ⇒ navigate to a form"; and it answers BYTES, which the direct-execute path would
+        // hand to a JSON result pipeline. It is its own third shape: fetch and give the browser a file.
+        if (isGeneratedCollectionExportOperation(operation)) {
+            // Reached only for the single-selection case (the menu wires each item's own selection
+            // directly). Falling back to the first offered pair keeps a click meaningful rather than
+            // silently doing nothing if an export ever arrives here with several on offer.
+            const exportConfig = resolveCollectionExportConfig(operation);
+            const selections = exportConfig ? listCollectionExportSelections(exportConfig) : [];
+            if (selections.length > 0)
+                void handleCollectionExportDownload(operation, selections[0]);
+            return;
+        }
         const opId = String(operation.operationIdentifier);
         const riskLevel = operation.riskLevel;
-        const requiresRMMBackedZeroInputHost = !operation.requestDto
-            && isSingleResourceUpdateLikeOperation(operation);
-        // Addressable custom operations now navigate through the host family implied
-        // by their effective core semantic. The navigation decision still belongs to
-        // the operation contract (`requestDto` / `isAddressable`), while the actual
-        // host is resolved later by `resolveResourceOperationLayoutKind()`.
+        // ── The single question: HOW does this action collect its input? ──
+        //
+        // Every outcome below is one answer to it. Before this axis existed the answer was a bare rule —
+        // *has a `requestDto` ⇒ navigate* — so an action asking for one reason string got the same full
+        // page as a multi-step wizard, and the only way out was to hand-author `navigationOverrides` per
+        // operation in terms of a zone, a verb and an appearance.
         //
-        // Step 6: zero-input UPDATE-like custom actions must also route through a
-        // host instead of silently executing as direct doOperation() actions, so the
-        // eventual mutation still stays under an explicit RMM-vs-weaker-guarantee
-        // contract.
-        if (shouldNavigateResourceOperation(operation) || requiresRMMBackedZeroInputHost) {
+        // `resolveResourceOperationActionPresentation` returns an AUTHORED presentation untouched and
+        // otherwise derives one; the derivation deliberately reproduces every in-place shape this
+        // handler already had (row-targeted actions, zero-input collection actions, generated-file
+        // regenerate), so the axis DESCRIBES the framework's behaviour instead of sitting beside it.
+        const presentation = resolveResourceOperationActionPresentation(operation);
+        if (presentation === ResourceOperationActionPresentation.INLINE && inPlaceHost.isAvailable) {
+            // The clicked row transforms itself; neighbours stay put and the zone stack is untouched.
+            // Guarded on `isAvailable` because the SAME action also renders where there is no row to
+            // transform (a detail page, a danger zone, a picker) — there it falls through to the overlay
+            // below rather than becoming a button that does nothing.
+            const elementId = frontendResourceUtils.getResourceId(contextResourceIdentifiersWithIdEvidence[resourceType]);
+            if (elementId) {
+                inPlaceHost.open({
+                    kind: InPlaceOperationTargetKind.ELEMENT,
+                    elementId,
+                    operation,
+                    resourceContext: buildOperationContext(operation),
+                });
+                return;
+            }
+        }
+        if (presentation === ResourceOperationActionPresentation.POPOVER) {
+            // The panel is rendered BY the action bar, anchored to this very button, so all this handler
+            // does is name which operation is open. A bar that cannot anchor (an item collapsed into the
+            // overflow menu or nested in a subgroup) never routes here — it calls `onClick` on the item,
+            // which is wired to `handleNavigateOperation` and degrades to the overlay.
+            setOpenPopoverOperationKey(ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(operation));
+            return;
+        }
+        if (actionPresentationNavigates(presentation)
+            || presentation === ResourceOperationActionPresentation.INLINE) {
+            // MODAL and PAGE hand off to navigation, which turns the presentation into a transition
+            // (`OVERLAY`, or the ordinary chain). The action layer does not render either — one runtime
+            // mechanism, one set of zone, appearance and URL semantics.
+            //
+            // INLINE reaches here only as a DEGRADE: no in-place host above this action, or a row whose id
+            // could not be resolved. `resolveActionPresentationTransition` maps it to an overlay, so the
+            // fall-back is the nearest presentation rather than the full page the ordinary chain would
+            // otherwise produce.
             handleNavigateOperation(operation);
             return;
         }
         // Risky operations — show confirmation first
         if (isRiskyOperation(riskLevel)) {
+            // Dialog title: DELETE uses the framework "confirmDelete" copy; every other
+            // risky action (custom collection/drain ops, lifecycle ops) names ITSELF via
+            // its resolved label, so the operator sees "Retry all" / "Purge all" rather
+            // than a generic confirmation with no subject.
             const confirmLabel = opId === CoreResourceOperation.DELETE
-                ? (tComponent(FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, 'confirmDelete') || 'Are you sure you want to delete this item?')
-                : `Are you sure you want to ${opId.toLowerCase().replace(/_/g, ' ')}?`;
+                ? resolveComponentLabel({
+                    tComponent,
+                    componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                    key: 'confirmDelete',
+                })
+                : getOperationLabel(operation);
+            // CRITICAL ops demand a deliberate "double validation": the user must type
+            // the action's label to arm the confirm button. HIGH keeps the plain single
+            // confirm. (This covers direct-execute CRITICAL ops — e.g. DELETE; CRITICAL
+            // ops that navigate to a form, like a reset-with-flags, carry their
+            // double-validation on the form submit instead — see
+            // settings-hub-framework-topics.md Topic 2.)
+            const requiresTypedConfirmation = riskLevel === ResourceOperationRiskLevel.CRITICAL;
             setConfirmState({
                 open: true,
                 label: confirmLabel,
+                requiresTypedConfirmation,
+                confirmationPhrase: requiresTypedConfirmation ? getOperationLabel(operation) : '',
                 callback: () => handleExecuteOperation(operation),
             });
             return;
         }
         // Non-risky executable operations — execute directly
         handleExecuteOperation(operation);
-    }, [handleNavigateOperation, handleExecuteOperation, tComponent]);
+    }, [handleNavigateOperation, handleExecuteOperation, tComponent, getOperationLabel]);
     // Confirmation dialog handlers
     const onConfirm = useCallback(async () => {
         if (confirmState.callback) {
             await confirmState.callback();
         }
-        setConfirmState({ open: false, label: '', callback: null });
+        setConfirmState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', callback: null });
     }, [confirmState.callback]);
     const onCancel = useCallback(() => {
-        setConfirmState({ open: false, label: '', callback: null });
+        setConfirmState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', callback: null });
     }, []);
     const onEphemeralAcknowledge = useCallback(() => {
         setEphemeralFields(null);
@@ -327,14 +1039,50 @@ export function useResourceOperationActions(params) {
         ephemeralPostAcknowledgeRef.current = null;
         deferred?.();
     }, []);
+    /**
+     * Build the anchored panel for an action that presents as a POPOVER, or `undefined` for every
+     * other presentation.
+     *
+     * The element is created with `React.createElement` because this module is `.ts` — the same reason
+     * icons arrive through `renderIcon()` rather than as JSX. The panel BODY is a component
+     * (`ResourceOperationActionPopoverBody`) rather than inline markup so the execution flow it hosts
+     * stays the one every other host uses.
+     *
+     * Note what is NOT decided here: whether the bar can actually anchor. That depends on overflow
+     * caps and label-display mode, which are the bar's own layout knowledge — so the bar ignores this
+     * panel where it cannot present it and falls back to the item's `onClick`.
+     */
+    const buildAnchoredPanel = useCallback((operation, label) => {
+        if (resolveResourceOperationActionPresentation(operation) !== ResourceOperationActionPresentation.POPOVER) {
+            return undefined;
+        }
+        if (!resourceConfig) {
+            return undefined;
+        }
+        const operationKey = ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(operation);
+        const dismiss = () => setOpenPopoverOperationKey(null);
+        return {
+            open: openPopoverOperationKey === operationKey,
+            onOpenChange: (open) => setOpenPopoverOperationKey(open ? operationKey : null),
+            title: label,
+            content: React.createElement(ResourceOperationActionPopoverBody, {
+                resourceContext: buildOperationContext(operation),
+                navigationZone,
+                onDismiss: dismiss,
+            }),
+        };
+    }, [resourceConfig, openPopoverOperationKey, buildOperationContext, navigationZone]);
     // ─── Step 3: Build ActionBarItem[] from filtered & enabled operations ───
     const items = useMemo(() => {
         if (!resourceConfig)
             return [];
         const operations = (resourceConfig.operations || []);
-        // Group filtered operations by operationIdentifier for variant subgroups
+        // Group filtered operations by operationIdentifier for variant subgroups.
+        // Literal single-resource READ/UPDATE/DELETE variants are intersected with
+        // the current route context so child-id, parent-context singleton, and
+        // complete-association routes do not compete blindly in the action bar.
         const operationGroups = new Map();
-        for (const op of filteredOps) {
+        for (const op of filteredOps.filter(isOperationAddressableForActions)) {
             const opId = String(op.operationIdentifier);
             if (!operationGroups.has(opId)) {
                 operationGroups.set(opId, []);
@@ -342,16 +1090,69 @@ export function useResourceOperationActions(params) {
             operationGroups.get(opId).push(op);
         }
         const actionItems = [];
-        for (const [opId, variants] of operationGroups) {
-            // Find default variant
-            const defaultVariant = variants.find((v) => v.isOperationDefault !== false) || variants[0];
+        for (const [opId, groupVariants] of operationGroups) {
+            // Collapse the group to ONLY the highest-right-level variant(s) the viewer
+            // qualifies for. Variants of an operation exist to give different behaviour
+            // according to rights, so a viewer should see only the highest one — e.g. a
+            // super-admin who is also an org member sees the super-admin READ variant,
+            // not both it and the member variant. The group is already role-gated
+            // (`filteredOps`), so this just keeps the max-rights subset; variants that
+            // TIE at the top rank (equal rights — context/variantKey variants, not a
+            // rights distinction) are all kept and fall through to the default/sub-group
+            // logic below. Composite/execution views bypass this hook entirely, so they
+            // may still surface all variants (the intended exception, for now).
+            //
+            // Rank among variants the viewer can currently USE: a higher-rights variant
+            // that is disabled (failing `enabledCondition` / feature-locked) must NOT
+            // mask an enabled lower-rights variant of the same operation (that would
+            // leave a dead button). Fall back to the full group when none are enabled,
+            // so a wholly-unavailable operation still surfaces its highest-rights variant
+            // (rendered disabled / feature-locked) exactly as before.
+            const enabledGroupVariants = groupVariants.filter((v) => getOperationEntry(v).isEnabled);
+            const variants = selectHighestRightsVariants(enabledGroupVariants.length > 0 ? enabledGroupVariants : groupVariants);
+            // Prefer the explicit non-bulk default variant for the group's primary
+            // label/risk/icon. Undefined default flags should not masquerade as the
+            // canonical operation because variants are already materialized by the registry.
+            const defaultVariant = variants.find((v) => v.isOperationDefault === true && v.isBulkOperation !== true)
+                || variants.find((v) => v.isOperationDefault === true)
+                || variants[0];
             const entry = getOperationEntry(defaultVariant);
+            // Visibility of a disabled action. A WHEN_AVAILABLE operation vanishes
+            // (rather than rendering disabled) when its enabledCondition is unmet —
+            // e.g. ACTIVATE on an already-active org. When the operation declares NO
+            // explicit `actionVisibility`, the VIEW's disclosure policy decides:
+            // dense surfaces (SUMMARY) default to HIDE so rows aren't cluttered with
+            // greyed, non-actionable buttons; roomy surfaces (DETAIL) default to
+            // SHOW_DISABLED. Feature-gated unavailability is EXCLUDED from this hide —
+            // it keeps its own FeatureUnavailabilityBehavior (upgrade/prompt) handled
+            // below. Display-only; backend authorization is unchanged. Evaluated here
+            // (not in `filteredOps`) because it depends on the async enabledCondition
+            // result captured in `entry`.
+            const explicitVisibility = defaultVariant.operationFrontendConfig?.actionVisibility;
+            const isFeatureGated = !!(entry.featureAvailability && !entry.featureAvailability.isAvailable);
+            const effectiveVisibility = explicitVisibility
+                ?? (disclosure.disabledActionHandling === DisabledActionHandling.HIDE && !isFeatureGated
+                    ? ActionVisibility.WHEN_AVAILABLE
+                    : ActionVisibility.ALWAYS);
+            if (effectiveVisibility === ActionVisibility.WHEN_AVAILABLE && !entry.isEnabled) {
+                continue;
+            }
             const variantEntries = new Map(variants.map((variant) => [variant, getOperationEntry(variant)]));
             const riskLevel = defaultVariant.riskLevel;
-            const variant = riskLevelToVariant(riskLevel);
+            // Colour: explicit `actionVariant` override wins; otherwise derive from risk.
+            const variant = defaultVariant.operationFrontendConfig?.actionVariant ?? riskLevelToVariant(riskLevel);
             const icon = getOperationIcon(defaultVariant);
             const label = getOperationLabel(defaultVariant);
             const priority = getDisplayPriority(defaultVariant);
+            // Placement: explicit `actionPlacement` override wins; otherwise derive from
+            // risk (HIGH/CRITICAL trail in the danger zone). Tagged on every emitted item
+            // via `_group`, consumed by the group-then-priority sort below.
+            const placement = defaultVariant.operationFrontendConfig?.actionPlacement
+                ?? (isRiskyOperation(riskLevel) ? ActionPlacement.DANGER_ZONE : ActionPlacement.PRIMARY);
+            // Surface filter: the main bar requests PRIMARY, the danger-zone section
+            // requests DANGER_ZONE; omitted returns both (separated).
+            if (placementFilter && placement !== placementFilter)
+                continue;
             const disabled = !entry.isEnabled;
             // ── Feature-aware behavior switch ──
             // When disabled due to feature unavailability, apply the appropriate behavior
@@ -382,6 +1183,9 @@ export function useResourceOperationActions(params) {
                                 featureLocked: true,
                                 featureAvailability: toActionBarFeatureAvailability(fa),
                                 _priority: priority,
+                                _group: placement,
+                                riskLevel,
+                                operationIdentifier: String(defaultVariant.operationIdentifier),
                             });
                         }
                         else {
@@ -395,21 +1199,85 @@ export function useResourceOperationActions(params) {
                                 featureLocked: true,
                                 featureAvailability: toActionBarFeatureAvailability(fa),
                                 _priority: priority,
+                                _group: placement,
+                                riskLevel,
+                                operationIdentifier: String(defaultVariant.operationIdentifier),
                             });
                         }
                         continue; // Skip normal rendering below
                 }
             }
+            // ── COLLECTION EXPORT — one item per OFFERED COMBINATION, not per operation variant ──
+            // Every other action in this bar fans out by operation VARIANT. An export has exactly one
+            // variant and N choices inside it (format × row scope), so the fan-out is over the declared
+            // selectors instead. Committing to one pair and hiding the rest would be the surface answering
+            // a question the user was never asked.
+            const exportConfigForItems = isGeneratedCollectionExportOperation(defaultVariant)
+                ? resolveCollectionExportConfig(defaultVariant)
+                : undefined;
+            if (exportConfigForItems) {
+                const selections = listCollectionExportSelections(exportConfigForItems);
+                if (selections.length === 1) {
+                    actionItems.push({
+                        type: 'button',
+                        icon,
+                        label,
+                        variant,
+                        onClick: () => { void handleCollectionExportDownload(defaultVariant, selections[0]); },
+                        disabled,
+                        _priority: priority,
+                        _group: placement,
+                        riskLevel,
+                        operationIdentifier: String(defaultVariant.operationIdentifier),
+                    });
+                }
+                else if (selections.length > 1) {
+                    actionItems.push({
+                        type: 'subgroup',
+                        icon,
+                        label,
+                        variant,
+                        items: selections.map((selection) => ({
+                            type: 'button',
+                            icon,
+                            label: describeCollectionExportSelection(selection),
+                            variant,
+                            riskLevel,
+                            operationIdentifier: String(defaultVariant.operationIdentifier),
+                            onClick: () => { void handleCollectionExportDownload(defaultVariant, selection); },
+                            disabled,
+                        })),
+                        disabled,
+                        _priority: priority,
+                        _group: placement,
+                        riskLevel,
+                        operationIdentifier: String(defaultVariant.operationIdentifier),
+                    });
+                }
+                continue;
+            }
             if (variants.length === 1) {
                 // Single variant — simple button
+                const anchoredPanel = buildAnchoredPanel(defaultVariant, label);
                 actionItems.push({
                     type: 'button',
                     icon,
                     label,
                     variant,
-                    onClick: () => handleOperationClick(defaultVariant),
+                    // A POPOVER action's `onClick` is the DEGRADE path, not the normal one. The bar wires the
+                    // normal path to the popover trigger; `onClick` is reached only where the bar cannot
+                    // anchor (an item collapsed into the overflow menu, or nested in a subgroup), and there
+                    // the right answer is the overlay — never the page the ordinary chain would otherwise
+                    // produce for a popover-shaped action.
+                    onClick: anchoredPanel
+                        ? () => handleNavigateOperation(defaultVariant)
+                        : () => handleOperationClick(defaultVariant),
+                    ...(anchoredPanel ? { popover: anchoredPanel } : {}),
                     disabled,
                     _priority: priority,
+                    _group: placement,
+                    riskLevel,
+                    operationIdentifier: String(defaultVariant.operationIdentifier),
                 });
             }
             else {
@@ -432,6 +1300,8 @@ export function useResourceOperationActions(params) {
                             icon: getOperationIcon(v),
                             label: vLabel,
                             variant: riskLevelToVariant(vRisk),
+                            riskLevel: vRisk,
+                            operationIdentifier: String(v.operationIdentifier),
                             onClick: () => handleOperationClick(v),
                             disabled: !vEntry.isEnabled,
                             ...(vEntry.featureAvailability && !vEntry.featureAvailability.isAvailable
@@ -452,6 +1322,9 @@ export function useResourceOperationActions(params) {
                         onClick: () => handleOperationClick(defaultVariant),
                         disabled,
                         _priority: priority,
+                        _group: placement,
+                        riskLevel,
+                        operationIdentifier: String(defaultVariant.operationIdentifier),
                         ...(entry.featureAvailability && !entry.featureAvailability.isAvailable
                             ? {
                                 featureLocked: true,
@@ -469,14 +1342,36 @@ export function useResourceOperationActions(params) {
                     items: subItems,
                     disabled: subgroupDisabled,
                     _priority: priority,
+                    _group: placement,
+                    riskLevel,
+                    operationIdentifier: String(defaultVariant.operationIdentifier),
                 });
             }
         }
-        // Inject "View Details" in summary mode if READ operation is available
-        if (displayMode === ResourceOperationDisplayMode.SUMMARY) {
-            const readOp = pickPreferredOperationForCoreSemantic(operations, CoreResourceOperation.READ, { requireAddressable: true });
+        // Inject "View Details" in summary mode if READ operation is available —
+        // UNLESS the host row is itself the READ affordance (`suppressViewDetails`),
+        // in which case the eye button would just duplicate the row click.
+        if (displayMode === ResourceOperationDisplayMode.SUMMARY
+            && placementFilter !== ActionPlacement.DANGER_ZONE
+            && !suppressViewDetails) {
+            const readOp = resourceConfig
+                ? pickPreferredOperationForCoreSemanticAddressability({
+                    resourceConfig,
+                    operations,
+                    coreOperation: CoreResourceOperation.READ,
+                    registry,
+                    hasResourceId: hasCurrentResourceId,
+                    requireFrontendAddressable: true,
+                    contextResourceIdentifiers: contextResourceIdentifiersWithIdEvidence,
+                    contextualParameters,
+                })
+                : undefined;
             if (readOp) {
-                const viewLabel = tComponent(FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, 'viewDetails') || 'View Details';
+                const viewLabel = resolveComponentLabel({
+                    tComponent,
+                    componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                    key: 'viewDetails',
+                });
                 actionItems.push({
                     type: 'button',
                     icon: renderIcon(StandardIconReference.EYE, { size: IconSize.SM }),
@@ -485,18 +1380,50 @@ export function useResourceOperationActions(params) {
                     onClick: () => handleNavigateOperation(readOp),
                     disabled: false,
                     _priority: VIEW_DETAILS_PRIORITY,
+                    _group: ActionPlacement.PRIMARY,
                 });
             }
         }
-        // Sort by display priority (lower = first)
-        actionItems.sort((a, b) => a._priority - b._priority);
-        // Strip internal _priority field, preserve featureLocked + featureAvailability
-        return actionItems.map(({ _priority, ...item }) => item);
+        // Group-then-priority sort: every PRIMARY action first, the DANGER_ZONE group
+        // last, each ordered internally by display priority (lower = first).
+        const groupRank = (group) => (group === ActionPlacement.DANGER_ZONE ? 1 : 0);
+        actionItems.sort((a, b) => groupRank(a._group) - groupRank(b._group) || a._priority - b._priority);
+        // Strip internal _priority/_group fields (preserve featureLocked +
+        // featureAvailability), fencing the danger zone off from the primary group
+        // with a single separator — only when both groups are actually populated.
+        const finalItems = [];
+        let previousGroup;
+        for (const { _priority, _group, ...item } of actionItems) {
+            // Fence fires exactly once, on the PRIMARY→DANGER_ZONE transition. Guarding
+            // on the previous group (not "any preceding item") avoids a stray separator
+            // when the bar holds only danger-zone actions.
+            if (_group === ActionPlacement.DANGER_ZONE && previousGroup === ActionPlacement.PRIMARY) {
+                finalItems.push({ type: 'separator' });
+            }
+            finalItems.push(item);
+            previousGroup = _group;
+        }
+        return finalItems;
     }, [
+        // `currentObject` is intentionally NOT a dependency: it is not read in this
+        // memo body. It reaches `items` only transitively, via
+        // `currentResourceIdEvidence` → `contextResourceIdentifiersWithIdEvidence` /
+        // `contextualParameters` / `hasCurrentResourceId` (all listed), so listing the
+        // raw object would rebuild every ActionBar item + onClick on each render it is
+        // re-created — even when the resolved id is unchanged. (No exhaustive-deps lint
+        // in this repo — this omission is deliberate; see the stabilization note above.)
         resourceConfig,
+        contextResourceIdentifiersWithIdEvidence,
+        contextualParameters,
+        hasCurrentResourceId,
+        isOperationAddressableForActions,
+        registry,
+        resourceType,
         filteredOps,
         enabledMap,
         displayMode,
+        disclosure,
+        suppressViewDetails,
         getOperationIcon,
         getOperationLabel,
         getDisplayPriority,
@@ -504,6 +1431,12 @@ export function useResourceOperationActions(params) {
         getOperationEntry,
         handleOperationClick,
         handleNavigateOperation,
+        // The export buttons close over this callback directly (each menu item carries its own
+        // selection). It is stable now that the listing query is read through a ref, so this entry is
+        // correctness-by-declaration rather than load-bearing — and it must stay: dropping it would make
+        // the buttons' freshness depend on the ref alone, which is true today and is not a property
+        // anyone reading this list would know to preserve.
+        handleCollectionExportDownload,
         tComponent,
         renderIcon,
     ]);
@@ -511,6 +1444,8 @@ export function useResourceOperationActions(params) {
         items,
         isConfirmDialogOpen: confirmState.open,
         confirmDialogLabel: confirmState.label,
+        confirmRequiresTypedConfirmation: confirmState.requiresTypedConfirmation,
+        confirmConfirmationPhrase: confirmState.confirmationPhrase,
         onConfirm,
         onCancel,
         isExecuting,
@@ -518,4 +1453,4 @@ export function useResourceOperationActions(params) {
         onEphemeralAcknowledge,
     };
 }
-//# sourceMappingURL=useResourceOperationActions.js.map
+//# sourceMappingURL=useResourceOperationActions.js.map