@fiado/type-kit 3.141.0 → 3.142.0

package/_test_/unit/platformRbac/dtos/CreateTenantRequest.test.ts

@@ -2,7 +2,6 @@ import 'reflect-metadata';
 import { plainToInstance } from 'class-transformer';
 import { validate } from 'class-validator';
 import { CreateTenantRequest } from '../../../../src/platformRbac/dtos/CreateTenantRequest';
-import { TenantType } from '../../../../src/platformRbac/tenantTypes';
 
 describe('CreateTenantRequest', () => {
     const valid = {
@@ -47,15 +46,17 @@ describe('CreateTenantRequest', () => {
         expect(errors.some(e => e.property === 'tenantId')).toBe(true);
     });
 
-    it('valida con tenantType opcional = agents', async () => {
+    it('valida con tenantType opcional (legacy string libre — DEC-RBAC-062/063, purga v4.0.0)', async () => {
+        // Tras la purga de los tenant-types de dominio, tenantType es string libre por back-compat
+        // del shape del body (el alta se hace por applicationId). Cualquier string valida.
         const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 'agents' });
         const errors = await validate(dto);
         expect(errors).toEqual([]);
-        expect(dto.tenantType).toBe(TenantType.AGENTS);
+        expect(dto.tenantType).toBe('agents');
     });
 
-    it('falla si tenantType no es un TenantType válido', async () => {
-        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 'inexistente' });
+    it('falla si tenantType no es string', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 123 });
         const errors = await validate(dto);
         expect(errors.some(e => e.property === 'tenantType')).toBe(true);
     });

package/_test_/unit/platformRbac/enums/__snapshots__/permissionBits.test.ts.snap

@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
-exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `1703336986`;
+exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `1018014330`;
 
 exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe ante cualquier reorden/inserción) 1`] = `
 [
@@ -49,79 +49,7 @@ exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe an
   "tenant.security.policy.manage",
   "tenant.branding.manage",
   "tenant.audit.view",
-  "retail.user.create",
-  "retail.user.create.lateral",
-  "retail.user.read",
-  "retail.user.update",
-  "retail.user.status",
-  "retail.user.delete",
-  "retail.user.password.reset",
-  "retail.user.mfa.reset",
-  "retail.product.create",
-  "retail.product.list",
-  "retail.product.view",
-  "retail.product.update",
-  "retail.product.delete",
-  "retail.product.mdm_config",
-  "retail.inventory.list",
-  "retail.inventory.view",
-  "retail.inventory.update",
-  "retail.sale.create",
-  "retail.sale.list",
-  "retail.sale.cancel",
-  "retail.store.manage",
-  "retail.retailer.manage",
-  "lend.credit.create",
-  "lend.credit.list",
-  "lend.credit.view",
-  "lend.credit.update",
-  "lend.credit.liquidate",
-  "lend.credit.restructure",
-  "lend.payment.apply",
-  "lend.payment.list",
-  "lend.payment.reverse",
-  "lend.installment.view",
-  "mdm.device.enroll",
-  "mdm.device.release",
-  "mdm.device.archive",
-  "mdm.device.deactivate",
-  "mdm.device.lock.manual",
-  "mdm.device.unlock.manual",
-  "mdm.device.pin_unlock",
-  "mdm.device.extend_validity",
-  "mdm.device.notify",
-  "mdm.device.status.view",
-  "mdm.operation_log.view",
-  "mdm.test",
-  "pay.transaction.view",
-  "agents.agent.list",
-  "agents.agent.create",
-  "agents.agent.create_bulk",
-  "agents.agent.move",
-  "agents.agent.delete",
-  "agents.referral.view",
-  "agents.ranking.view",
-  "agents.production.view",
-  "agents.person.search",
-  "agents.person.view",
-  "agents.person.update",
-  "agents.document.view",
-  "agents.document.upload",
-  "agents.address.view",
-  "agents.address.manage",
-  "agents.beneficiary.view",
-  "agents.beneficiary.manage",
-  "agents.card.issue",
-  "agents.chat.view",
-  "agents.chat.send",
-  "agents.notification.send",
-  "agents.export.run",
-  "agents.catalog.view",
-  "agents.group.manage",
-  "agents.group.user.manage",
-  "agents.person.create",
   "platform.tenant.userfields.manage",
-  "agents.app.access",
   "platform.user.create.lateral",
   "platform.application.manage",
   "tenant.level.manage",

package/_test_/unit/platformRbac/tenantTypes.test.ts

@@ -1,58 +1,23 @@
-import { TenantType, TENANT_TYPES, levelsOf, tableSuffixForLevel, scopeRankOrder } from '../../../src/platformRbac/tenantTypes';
+import { TENANT_TYPES, scopeRankOrder } from '../../../src/platformRbac/tenantTypes';
 import { PermissionScope } from '../../../src/platformRbac/enums/PermissionScope';
 
-describe('tenantTypes', () => {
-    it('retail define RETAILER>STORE', () => {
-        expect(levelsOf(TenantType.RETAIL)).toEqual([PermissionScope.RETAILER, PermissionScope.STORE]);
+describe('tenantTypes (post-purga v4.0.0 — solo niveles genéricos)', () => {
+    it('TENANT_TYPES quedó vacío tras purgar los tipos de dominio (retail/agents)', () => {
+        expect(Object.keys(TENANT_TYPES)).toHaveLength(0);
     });
 
-    it('scopeRankOrder = [PLATFORM, TENANT, RETAILER, STORE, GROUP, LEVEL_1, LEVEL_2, LEVEL_3]', () => {
+    it('scopeRankOrder = [PLATFORM, TENANT, LEVEL_1, LEVEL_2, LEVEL_3]', () => {
         expect(scopeRankOrder()).toEqual([
             PermissionScope.PLATFORM,
             PermissionScope.TENANT,
-            PermissionScope.RETAILER,
-            PermissionScope.STORE,
-            PermissionScope.GROUP,
             PermissionScope.LEVEL_1,
             PermissionScope.LEVEL_2,
             PermissionScope.LEVEL_3,
         ]);
     });
 
-    it('tableSuffixForLevel mapea cada nivel de retail a su sufijo de tabla', () => {
-        expect(tableSuffixForLevel(TenantType.RETAIL, PermissionScope.RETAILER)).toBe('SharedRetailer');
-        expect(tableSuffixForLevel(TenantType.RETAIL, PermissionScope.STORE)).toBe('SharedStore');
-    });
-
-    it('tableSuffixForLevel devuelve undefined para un nivel no mapeado (PLATFORM/TENANT son fijos)', () => {
-        expect(tableSuffixForLevel(TenantType.RETAIL, PermissionScope.PLATFORM)).toBeUndefined();
-        expect(tableSuffixForLevel(TenantType.RETAIL, PermissionScope.TENANT)).toBeUndefined();
-    });
-
     it('scopeRankOrder no produce duplicados', () => {
         const order = scopeRankOrder();
         expect(new Set(order).size).toBe(order.length);
     });
-
-    it('agents define un único nivel GROUP debajo de TENANT', () => {
-        expect(levelsOf(TenantType.AGENTS)).toEqual([PermissionScope.GROUP]);
-    });
-
-    it('agents mapea GROUP a su sufijo de tabla SharedGroup', () => {
-        expect(TENANT_TYPES[TenantType.AGENTS].tableSuffix).toEqual({ [PermissionScope.GROUP]: 'SharedGroup' });
-        expect(tableSuffixForLevel(TenantType.AGENTS, PermissionScope.GROUP)).toBe('SharedGroup');
-    });
-
-    it('scopeRankOrder incluye GROUP (vía los levels de agents) seguido de los niveles genéricos LEVEL_1/2/3', () => {
-        expect(scopeRankOrder()).toEqual([
-            PermissionScope.PLATFORM,
-            PermissionScope.TENANT,
-            PermissionScope.RETAILER,
-            PermissionScope.STORE,
-            PermissionScope.GROUP,
-            PermissionScope.LEVEL_1,
-            PermissionScope.LEVEL_2,
-            PermissionScope.LEVEL_3,
-        ]);
-    });
 });

package/bin/platformRbac/dtos/CreateTenantRequest.d.ts

@@ -1,5 +1,4 @@
 import { TokenValidationMode } from '../enums/TokenValidationMode';
-import { TenantType } from '../tenantTypes';
 /**
  * Punto inicial de la política 2FA elegido en el alta del tenant (DEC-RBAC-064). Para el CREATE
  * ambos campos son OPCIONALES: es un override del punto de partida — si se omite, el onboarding
@@ -35,10 +34,12 @@ export declare class CreateTenantRequest {
     region: string;
     tokenValidationMode?: TokenValidationMode;
     /**
-     * Tipo de tenant a crear. Si se omite, el onboarding aplica su default (hoy: retail).
-     * @deprecated DEC-RBAC-062/063: el alta se hace por `applicationId`; `tenantType` se elimina al consolidar niveles. Migración pendiente; no usar en código nuevo.
+     * Tipo de tenant a crear (legacy). El alta se hace por `applicationId`.
+     * @deprecated DEC-RBAC-062/063: los tenant-types de dominio fueron purgados (v4.0.0, BREAKING).
+     * El alta se hace por `applicationId`; `tenantType` queda como string libre solo por back-compat
+     * del shape del body. No usar en código nuevo.
      */
-    tenantType?: TenantType;
+    tenantType?: string;
     /** DEC-RBAC-034: aplicación (plantilla) de la que se crea el tenant; opcional, fallback a tenantType (back-compat). */
     applicationId?: string;
     /**

package/bin/platformRbac/dtos/CreateTenantRequest.js

@@ -13,7 +13,6 @@ exports.CreateTenantRequest = exports.CreateTenantSecurityPolicy = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
 const TokenValidationMode_1 = require("../enums/TokenValidationMode");
-const tenantTypes_1 = require("../tenantTypes");
 /**
  * Punto inicial de la política 2FA elegido en el alta del tenant (DEC-RBAC-064). Para el CREATE
  * ambos campos son OPCIONALES: es un override del punto de partida — si se omite, el onboarding
@@ -91,7 +90,7 @@ __decorate([
 __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsEnum)(tenantTypes_1.TenantType),
+    (0, class_validator_1.IsString)(),
     __metadata("design:type", String)
 ], CreateTenantRequest.prototype, "tenantType", void 0);
 __decorate([

package/bin/platformRbac/dtos/ResendOtpRequest.d.ts

@@ -0,0 +1,22 @@
+import { MfaMethodEnum } from '../enums/MfaMethodEnum';
+/**
+ * Body del POST /auth/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Reenvía el OTP del login re-disparando el challenge real CUSTOM_AUTH (EMAIL_OTP) para la
+ * identidad SIN password. `tenantId` obligatorio (DEC-064 — el picker ya lo resolvió, NO "solo email").
+ * El email se normaliza lowercase server-side. Postura anti-enumeración: respuesta 200 genérica
+ * siempre, sin filtrar existencia (ver AuthLoginManager.resendChallengeOtp).
+ */
+export declare class ResendOtpRequest {
+    email: string;
+    tenantId: string;
+}
+/**
+ * Respuesta del resend-otp. `session`/`mfaMethod` frescos del nuevo challenge CUSTOM_AUTH.
+ * Plain sin validators (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ * Ambos opcionales: en los caminos de rechazo silencioso (anti-enumeración) o ramas sin CUSTOM_AUTH
+ * el server responde 200 genérico sin session ni método.
+ */
+export interface ResendOtpResponse {
+    session?: string;
+    mfaMethod?: MfaMethodEnum;
+}

package/bin/{walletFunding/dtos/CancelFundingRequest.js → platformRbac/dtos/ResendOtpRequest.js}

@@ -9,25 +9,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingRequest = void 0;
+exports.ResendOtpRequest = void 0;
+const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
 /**
- * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `fundingId` viaja en el path, `directoryId` se resuelve del JWT.
- * `providerModuleName` permite al marketplace rutear al publisher correcto
- * sin tener que persistir el mapping (el wallet-app sabe el moduleName
- * porque vino en la respuesta del authorize).
+ * Body del POST /auth/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Reenvía el OTP del login re-disparando el challenge real CUSTOM_AUTH (EMAIL_OTP) para la
+ * identidad SIN password. `tenantId` obligatorio (DEC-064 — el picker ya lo resolvió, NO "solo email").
+ * El email se normaliza lowercase server-side. Postura anti-enumeración: respuesta 200 genérica
+ * siempre, sin filtrar existencia (ver AuthLoginManager.resendChallengeOtp).
  */
-class CancelFundingRequest {
+class ResendOtpRequest {
 }
-exports.CancelFundingRequest = CancelFundingRequest;
+exports.ResendOtpRequest = ResendOtpRequest;
 __decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
-], CancelFundingRequest.prototype, "idempotencyKey", void 0);
+], ResendOtpRequest.prototype, "email", void 0);
 __decorate([
+    (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(128),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
-], CancelFundingRequest.prototype, "providerModuleName", void 0);
+], ResendOtpRequest.prototype, "tenantId", void 0);

package/bin/platformRbac/dtos/ResendSelfRegisterOtpRequest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Body del POST /self-register/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Re-envía el OTP del autoregistro (mecanismo messages-business, NO Cognito) tras validar un
+ * `pending` existente. Misma postura anti-enumeración del start. El email se normaliza lowercase
+ * server-side. DTO propio por endpoint (NO reusa SelfRegisterStartRequest, que exige roleId/scope/
+ * scopeRef, ni SelfRegisterVerifyOtpRequest, que exige otp).
+ */
+export declare class ResendSelfRegisterOtpRequest {
+    tenantId: string;
+    email: string;
+}

package/bin/{cognitoBackofficeConnector/dtos/MfaPoolConfig.js → platformRbac/dtos/ResendSelfRegisterOtpRequest.js}

@@ -9,28 +9,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MfaPoolConfig = void 0;
+exports.ResendSelfRegisterOtpRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
-const MfaTypesRequiresOne_1 = require("../validators/MfaTypesRequiresOne");
-// EMAIL_OTP removido (3.41.0): el cognito-backoffice-connector no provisiona
-// EmailMfaConfiguration a nivel pool (requiere infra SES que no está montada
-// y la integración con messages-lambda aún no tiene diseño). Ver TD-020 +
-// DEC-001 en cognito-backoffice-connector/docs/. Si se reintroduce, agregar
-// 'EMAIL_OTP' a este array.
-const ALLOWED_MFA_TYPES = ['SOFTWARE_TOKEN_MFA'];
-class MfaPoolConfig {
+/**
+ * Body del POST /self-register/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Re-envía el OTP del autoregistro (mecanismo messages-business, NO Cognito) tras validar un
+ * `pending` existente. Misma postura anti-enumeración del start. El email se normaliza lowercase
+ * server-side. DTO propio por endpoint (NO reusa SelfRegisterStartRequest, que exige roleId/scope/
+ * scopeRef, ni SelfRegisterVerifyOtpRequest, que exige otp).
+ */
+class ResendSelfRegisterOtpRequest {
 }
-exports.MfaPoolConfig = MfaPoolConfig;
+exports.ResendSelfRegisterOtpRequest = ResendSelfRegisterOtpRequest;
 __decorate([
     (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsBoolean)(),
-    __metadata("design:type", Boolean)
-], MfaPoolConfig.prototype, "requireMfa", void 0);
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ResendSelfRegisterOtpRequest.prototype, "tenantId", void 0);
 __decorate([
     (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsArray)(),
-    (0, class_validator_1.IsIn)(ALLOWED_MFA_TYPES, { each: true }),
-    (0, class_validator_1.Validate)(MfaTypesRequiresOne_1.MfaTypesRequiresOne),
-    __metadata("design:type", Array)
-], MfaPoolConfig.prototype, "mfaTypes", void 0);
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ResendSelfRegisterOtpRequest.prototype, "email", void 0);

package/bin/platformRbac/enums/Permission.d.ts

@@ -79,83 +79,6 @@ export declare enum Permission {
     TENANT_BRANDING_MANAGE = "tenant.branding.manage",
     TENANT_AUDIT_VIEW = "tenant.audit.view",
     TENANT_LEVEL_MANAGE = "tenant.level.manage",
-    RETAIL_USER_CREATE = "retail.user.create",
-    RETAIL_USER_CREATE_LATERAL = "retail.user.create.lateral",
-    RETAIL_USER_READ = "retail.user.read",
-    RETAIL_USER_UPDATE = "retail.user.update",
-    RETAIL_USER_STATUS = "retail.user.status",
-    RETAIL_USER_DELETE = "retail.user.delete",
-    RETAIL_USER_PASSWORD_RESET = "retail.user.password.reset",
-    RETAIL_USER_MFA_RESET = "retail.user.mfa.reset",
-    RETAIL_PRODUCT_CREATE = "retail.product.create",
-    RETAIL_PRODUCT_LIST = "retail.product.list",
-    RETAIL_PRODUCT_VIEW = "retail.product.view",
-    RETAIL_PRODUCT_UPDATE = "retail.product.update",
-    RETAIL_PRODUCT_DELETE = "retail.product.delete",
-    /** @deprecated DEC-RBAC-061: se renombrará a 'retail.product.mdm.config' (naming con puntos). Migración de datos coordinada por backend pendiente; no usar en código nuevo. */
-    RETAIL_PRODUCT_MDM_CONFIG = "retail.product.mdm_config",
-    RETAIL_INVENTORY_LIST = "retail.inventory.list",
-    RETAIL_INVENTORY_VIEW = "retail.inventory.view",
-    RETAIL_INVENTORY_UPDATE = "retail.inventory.update",
-    RETAIL_SALE_CREATE = "retail.sale.create",
-    RETAIL_SALE_LIST = "retail.sale.list",
-    RETAIL_SALE_CANCEL = "retail.sale.cancel",
-    RETAIL_STORE_MANAGE = "retail.store.manage",
-    RETAIL_RETAILER_MANAGE = "retail.retailer.manage",
-    LEND_CREDIT_CREATE = "lend.credit.create",
-    LEND_CREDIT_LIST = "lend.credit.list",
-    LEND_CREDIT_VIEW = "lend.credit.view",
-    LEND_CREDIT_UPDATE = "lend.credit.update",
-    LEND_CREDIT_LIQUIDATE = "lend.credit.liquidate",
-    LEND_CREDIT_RESTRUCTURE = "lend.credit.restructure",
-    LEND_PAYMENT_APPLY = "lend.payment.apply",
-    LEND_PAYMENT_LIST = "lend.payment.list",
-    LEND_PAYMENT_REVERSE = "lend.payment.reverse",
-    LEND_INSTALLMENT_VIEW = "lend.installment.view",
-    MDM_DEVICE_ENROLL = "mdm.device.enroll",
-    MDM_DEVICE_RELEASE = "mdm.device.release",
-    MDM_DEVICE_ARCHIVE = "mdm.device.archive",
-    MDM_DEVICE_DEACTIVATE = "mdm.device.deactivate",
-    MDM_DEVICE_LOCK_MANUAL = "mdm.device.lock.manual",
-    MDM_DEVICE_UNLOCK_MANUAL = "mdm.device.unlock.manual",
-    /** @deprecated DEC-RBAC-061: se renombrará a 'mdm.device.pin.unlock' (naming con puntos). Migración de datos coordinada por backend pendiente; no usar en código nuevo. */
-    MDM_DEVICE_PIN_UNLOCK = "mdm.device.pin_unlock",
-    /** @deprecated DEC-RBAC-061: se renombrará a 'mdm.device.extend.validity' (naming con puntos). Migración de datos coordinada por backend pendiente; no usar en código nuevo. */
-    MDM_DEVICE_EXTEND_VALIDITY = "mdm.device.extend_validity",
-    MDM_DEVICE_NOTIFY = "mdm.device.notify",
-    MDM_DEVICE_STATUS_VIEW = "mdm.device.status.view",
-    /** @deprecated DEC-RBAC-061: se renombrará a 'mdm.operation.log.view' (naming con puntos). Migración de datos coordinada por backend pendiente; no usar en código nuevo. */
-    MDM_OPERATION_LOG_VIEW = "mdm.operation_log.view",
-    MDM_TEST = "mdm.test",
-    PAY_TRANSACTION_VIEW = "pay.transaction.view",
-    AGENTS_APP_ACCESS = "agents.app.access",
-    AGENTS_AGENT_LIST = "agents.agent.list",
-    AGENTS_AGENT_CREATE = "agents.agent.create",
-    /** @deprecated DEC-RBAC-061: se renombrará a 'agents.agent.create.bulk' (naming con puntos). Migración de datos coordinada por backend pendiente; no usar en código nuevo. */
-    AGENTS_AGENT_CREATE_BULK = "agents.agent.create_bulk",
-    AGENTS_AGENT_MOVE = "agents.agent.move",
-    AGENTS_AGENT_DELETE = "agents.agent.delete",
-    AGENTS_REFERRAL_VIEW = "agents.referral.view",
-    AGENTS_RANKING_VIEW = "agents.ranking.view",
-    AGENTS_PRODUCTION_VIEW = "agents.production.view",
-    AGENTS_PERSON_SEARCH = "agents.person.search",
-    AGENTS_PERSON_VIEW = "agents.person.view",
-    AGENTS_PERSON_UPDATE = "agents.person.update",
-    AGENTS_PERSON_CREATE = "agents.person.create",
-    AGENTS_DOCUMENT_VIEW = "agents.document.view",
-    AGENTS_DOCUMENT_UPLOAD = "agents.document.upload",
-    AGENTS_ADDRESS_VIEW = "agents.address.view",
-    AGENTS_ADDRESS_MANAGE = "agents.address.manage",
-    AGENTS_BENEFICIARY_VIEW = "agents.beneficiary.view",
-    AGENTS_BENEFICIARY_MANAGE = "agents.beneficiary.manage",
-    AGENTS_CARD_ISSUE = "agents.card.issue",
-    AGENTS_CHAT_VIEW = "agents.chat.view",
-    AGENTS_CHAT_SEND = "agents.chat.send",
-    AGENTS_NOTIFICATION_SEND = "agents.notification.send",
-    AGENTS_EXPORT_RUN = "agents.export.run",
-    AGENTS_CATALOG_VIEW = "agents.catalog.view",
-    AGENTS_GROUP_MANAGE = "agents.group.manage",
-    AGENTS_GROUP_USER_MANAGE = "agents.group.user.manage",
     LEVEL1_USER_CREATE = "level1.user.create",
     LEVEL1_USER_READ = "level1.user.read",
     LEVEL1_USER_UPDATE = "level1.user.update",