@telos-dev-team/dealernode-permissions 1.1.56 → 1.1.58

package/dist/backoffice-permissions.d.ts

@@ -118,6 +118,27 @@ export declare const BACKOFFICE_PERMISSIONS: {
          */
         readonly CREDENTIALS: "backoffice.billing.credentials";
     };
+    /**
+     * Emails the system sent, read-only, across every dealer (dealernode-backend
+     * `src/email`): list them with their delivery status (sent, delivered,
+     * opened, bounced, spam complaint, failed) and open one to see its content
+     * and timeline. No MANAGE — the backoffice never sends or edits these, it
+     * only audits what the platform already sent.
+     */
+    readonly EMAILS: {
+        readonly VIEW: "backoffice.emails.view";
+    };
+    /**
+     * A dealer's notification configuration from the backoffice
+     * (dealernode-backend `dealer_notification_config`): the email addresses that
+     * receive payment, refund and dispute receipts, plus the payment-reminder
+     * lead times (first bank payment, pickup, BHPH). Not the per-type notification
+     * routing (`notification_routing`) — that is its own concern.
+     */
+    readonly DEALER_NOTIFICATIONS: {
+        readonly VIEW: "backoffice.dealer_notifications.view";
+        readonly MANAGE: "backoffice.dealer_notifications.manage";
+    };
 };
 export type BackofficePermission = typeof BACKOFFICE_PERMISSIONS;
 /**
@@ -137,10 +158,10 @@ export type BackofficePermissionId = Leaves<BackofficePermission>;
  */
 export declare const BACKOFFICE_PERMISSION_PRESETS: {
     /** Every `*.view` permission, nothing else. */
-    readonly READ_ONLY: ("backoffice.dealers.view" | "backoffice.dealers.manage" | "backoffice.users.view" | "backoffice.users.manage" | "backoffice.permissions.manage" | "backoffice.payments.view" | "backoffice.payments.manage" | "backoffice.dealer_resources.view" | "backoffice.dealer_resources.manage" | "backoffice.catalog.view" | "backoffice.catalog.manage" | "backoffice.dealer_roles.view" | "backoffice.dealer_roles.manage" | "backoffice.dealer_members.view" | "backoffice.dealer_members.manage" | "backoffice.dealer_relationships.view" | "backoffice.dealer_relationships.manage" | "backoffice.dealer_groups.view" | "backoffice.dealer_groups.manage" | "backoffice.workflows.view" | "backoffice.workflows.manage" | "backoffice.billing.view" | "backoffice.billing.manage" | "backoffice.billing.credentials")[];
+    readonly READ_ONLY: ("backoffice.dealers.view" | "backoffice.dealers.manage" | "backoffice.users.view" | "backoffice.users.manage" | "backoffice.permissions.manage" | "backoffice.payments.view" | "backoffice.payments.manage" | "backoffice.dealer_resources.view" | "backoffice.dealer_resources.manage" | "backoffice.catalog.view" | "backoffice.catalog.manage" | "backoffice.dealer_roles.view" | "backoffice.dealer_roles.manage" | "backoffice.dealer_members.view" | "backoffice.dealer_members.manage" | "backoffice.dealer_relationships.view" | "backoffice.dealer_relationships.manage" | "backoffice.dealer_groups.view" | "backoffice.dealer_groups.manage" | "backoffice.workflows.view" | "backoffice.workflows.manage" | "backoffice.billing.view" | "backoffice.billing.manage" | "backoffice.billing.credentials" | "backoffice.emails.view" | "backoffice.dealer_notifications.view" | "backoffice.dealer_notifications.manage")[];
     /** Read-only plus the two areas support routinely needs to act on. */
-    readonly SUPPORT: readonly [...("backoffice.dealers.view" | "backoffice.dealers.manage" | "backoffice.users.view" | "backoffice.users.manage" | "backoffice.permissions.manage" | "backoffice.payments.view" | "backoffice.payments.manage" | "backoffice.dealer_resources.view" | "backoffice.dealer_resources.manage" | "backoffice.catalog.view" | "backoffice.catalog.manage" | "backoffice.dealer_roles.view" | "backoffice.dealer_roles.manage" | "backoffice.dealer_members.view" | "backoffice.dealer_members.manage" | "backoffice.dealer_relationships.view" | "backoffice.dealer_relationships.manage" | "backoffice.dealer_groups.view" | "backoffice.dealer_groups.manage" | "backoffice.workflows.view" | "backoffice.workflows.manage" | "backoffice.billing.view" | "backoffice.billing.manage" | "backoffice.billing.credentials")[], "backoffice.dealers.manage", "backoffice.dealer_resources.manage"];
+    readonly SUPPORT: readonly [...("backoffice.dealers.view" | "backoffice.dealers.manage" | "backoffice.users.view" | "backoffice.users.manage" | "backoffice.permissions.manage" | "backoffice.payments.view" | "backoffice.payments.manage" | "backoffice.dealer_resources.view" | "backoffice.dealer_resources.manage" | "backoffice.catalog.view" | "backoffice.catalog.manage" | "backoffice.dealer_roles.view" | "backoffice.dealer_roles.manage" | "backoffice.dealer_members.view" | "backoffice.dealer_members.manage" | "backoffice.dealer_relationships.view" | "backoffice.dealer_relationships.manage" | "backoffice.dealer_groups.view" | "backoffice.dealer_groups.manage" | "backoffice.workflows.view" | "backoffice.workflows.manage" | "backoffice.billing.view" | "backoffice.billing.manage" | "backoffice.billing.credentials" | "backoffice.emails.view" | "backoffice.dealer_notifications.view" | "backoffice.dealer_notifications.manage")[], "backoffice.dealers.manage", "backoffice.dealer_resources.manage", "backoffice.dealer_relationships.manage"];
     /** Every backoffice permission. */
-    readonly ADMIN: ("backoffice.dealers.view" | "backoffice.dealers.manage" | "backoffice.users.view" | "backoffice.users.manage" | "backoffice.permissions.manage" | "backoffice.payments.view" | "backoffice.payments.manage" | "backoffice.dealer_resources.view" | "backoffice.dealer_resources.manage" | "backoffice.catalog.view" | "backoffice.catalog.manage" | "backoffice.dealer_roles.view" | "backoffice.dealer_roles.manage" | "backoffice.dealer_members.view" | "backoffice.dealer_members.manage" | "backoffice.dealer_relationships.view" | "backoffice.dealer_relationships.manage" | "backoffice.dealer_groups.view" | "backoffice.dealer_groups.manage" | "backoffice.workflows.view" | "backoffice.workflows.manage" | "backoffice.billing.view" | "backoffice.billing.manage" | "backoffice.billing.credentials")[];
+    readonly ADMIN: ("backoffice.dealers.view" | "backoffice.dealers.manage" | "backoffice.users.view" | "backoffice.users.manage" | "backoffice.permissions.manage" | "backoffice.payments.view" | "backoffice.payments.manage" | "backoffice.dealer_resources.view" | "backoffice.dealer_resources.manage" | "backoffice.catalog.view" | "backoffice.catalog.manage" | "backoffice.dealer_roles.view" | "backoffice.dealer_roles.manage" | "backoffice.dealer_members.view" | "backoffice.dealer_members.manage" | "backoffice.dealer_relationships.view" | "backoffice.dealer_relationships.manage" | "backoffice.dealer_groups.view" | "backoffice.dealer_groups.manage" | "backoffice.workflows.view" | "backoffice.workflows.manage" | "backoffice.billing.view" | "backoffice.billing.manage" | "backoffice.billing.credentials" | "backoffice.emails.view" | "backoffice.dealer_notifications.view" | "backoffice.dealer_notifications.manage")[];
 };
 export {};

package/dist/backoffice-permissions.js

@@ -121,6 +121,27 @@ exports.BACKOFFICE_PERMISSIONS = {
          */
         CREDENTIALS: "backoffice.billing.credentials",
     },
+    /**
+     * Emails the system sent, read-only, across every dealer (dealernode-backend
+     * `src/email`): list them with their delivery status (sent, delivered,
+     * opened, bounced, spam complaint, failed) and open one to see its content
+     * and timeline. No MANAGE — the backoffice never sends or edits these, it
+     * only audits what the platform already sent.
+     */
+    EMAILS: {
+        VIEW: "backoffice.emails.view",
+    },
+    /**
+     * A dealer's notification configuration from the backoffice
+     * (dealernode-backend `dealer_notification_config`): the email addresses that
+     * receive payment, refund and dispute receipts, plus the payment-reminder
+     * lead times (first bank payment, pickup, BHPH). Not the per-type notification
+     * routing (`notification_routing`) — that is its own concern.
+     */
+    DEALER_NOTIFICATIONS: {
+        VIEW: "backoffice.dealer_notifications.view",
+        MANAGE: "backoffice.dealer_notifications.manage",
+    },
 };
 function flatten(node) {
     const values = [];
@@ -151,6 +172,7 @@ exports.BACKOFFICE_PERMISSION_PRESETS = {
         ...READ_ONLY_BACKOFFICE_PERMISSIONS,
         exports.BACKOFFICE_PERMISSIONS.DEALERS.MANAGE,
         exports.BACKOFFICE_PERMISSIONS.DEALER_RESOURCES.MANAGE,
+        exports.BACKOFFICE_PERMISSIONS.DEALER_RELATIONSHIPS.MANAGE,
     ],
     /** Every backoffice permission. */
     ADMIN: ALL_BACKOFFICE_PERMISSIONS,

package/dist/permissions.d.ts

@@ -632,12 +632,6 @@ export declare const PERMISSIONS: {
     readonly DEALER_RELATIONSHIP: {
         readonly OPERATIONS: {
             readonly VIEW: "dealer_relationship.operations.view";
-            readonly CREATE: "dealer_relationship.operations.create";
-            readonly APPROVE: "dealer_relationship.operations.approve";
-            readonly REJECT: "dealer_relationship.operations.reject";
-            readonly REVOKE: "dealer_relationship.operations.revoke";
-            readonly SUSPEND: "dealer_relationship.operations.suspend";
-            readonly REACTIVATE: "dealer_relationship.operations.reactivate";
         };
         readonly RESOURCE: {
             readonly VIEW_INVENTORY: "dealer_relationship.resource.view_inventory";
@@ -654,12 +648,6 @@ export declare const PERMISSIONS: {
             readonly VIEW_PLATES: "dealer_relationship.resource.view_plates";
             readonly VIEW_ARBITRATIONS: "dealer_relationship.resource.view_arbitrations";
         };
-        readonly PERMISSION: {
-            readonly REQUEST: "dealer_relationship.permission.request";
-            readonly APPROVE: "dealer_relationship.permission.approve";
-            readonly REJECT: "dealer_relationship.permission.reject";
-            readonly REVOKE: "dealer_relationship.permission.revoke";
-        };
     };
     readonly DEALER_GROUP: {
         readonly OPERATIONS: {

package/dist/permissions.js

@@ -692,12 +692,6 @@ exports.PERMISSIONS = {
     DEALER_RELATIONSHIP: {
         OPERATIONS: {
             VIEW: "dealer_relationship.operations.view",
-            CREATE: "dealer_relationship.operations.create",
-            APPROVE: "dealer_relationship.operations.approve",
-            REJECT: "dealer_relationship.operations.reject",
-            REVOKE: "dealer_relationship.operations.revoke",
-            SUSPEND: "dealer_relationship.operations.suspend",
-            REACTIVATE: "dealer_relationship.operations.reactivate",
         },
         RESOURCE: {
             VIEW_INVENTORY: "dealer_relationship.resource.view_inventory",
@@ -714,12 +708,6 @@ exports.PERMISSIONS = {
             VIEW_PLATES: "dealer_relationship.resource.view_plates",
             VIEW_ARBITRATIONS: "dealer_relationship.resource.view_arbitrations",
         },
-        PERMISSION: {
-            REQUEST: "dealer_relationship.permission.request",
-            APPROVE: "dealer_relationship.permission.approve",
-            REJECT: "dealer_relationship.permission.reject",
-            REVOKE: "dealer_relationship.permission.revoke",
-        },
     },
     // ============================================
     // DEALER GROUP

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "@telos-dev-team/dealernode-permissions",
-  "version": "1.1.56",
+  "version": "1.1.58",
   "description": "Shared permissions constants for dealernode projects",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
   "publishConfig": {
     "access": "public"
   },

package/.github/workflows/publish.yml

@@ -1,37 +0,0 @@
-name: Publish to npm
-
-on:
-  push:
-    branches: [main]
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          registry-url: https://registry.npmjs.org
-
-      - run: npm ci
-
-      - name: Bump version and publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          npm version patch --no-git-tag-version
-          VERSION=$(node -p "require('./package.json').version")
-          npm publish
-          git add package.json package-lock.json
-          git commit -m "chore: release v${VERSION}"
-          git tag "v${VERSION}"
-          git push && git push --tags

package/gps-provider-permissions.md

@@ -1,109 +0,0 @@
-# GPS Provider — Permisos a agregar al paquete común
-
-Este documento define los permisos del módulo `gps-provider` para integrarlos al
-paquete `@telos-dev-team/dealernode-permissions` (la fuente de verdad de
-permisos de DealerNode). Una vez agregados y publicada una nueva versión del
-paquete, `dealernode-backend` los importa desde `PERMISSIONS.GPS_PROVIDER.*` y
-los persiste en DB con `npm run sync:permissions`.
-
-## Bloque TypeScript a agregar en `src/permissions.ts`
-
-Insertar como un top-level más del objeto `PERMISSIONS` (mismo nivel que
-`DEAL`, `CAR`, `PAYMENT`, etc.):
-
-```ts
-GPS_PROVIDER: {
-  CONFIG: {
-    OPERATIONS: {
-      CREATE: 'gps-provider.config.operations.create',
-      VIEW:   'gps-provider.config.operations.view',
-      UPDATE: 'gps-provider.config.operations.update',
-      DELETE: 'gps-provider.config.operations.delete',
-    },
-  },
-  DEVICE: {
-    OPERATIONS: {
-      VIEW:   'gps-provider.device.operations.view',
-      LOCATE: 'gps-provider.device.operations.locate',
-    },
-  },
-},
-```
-
-Total: **6 permisos nuevos**.
-
-### Naming
-
-Sigue la convención existente del paquete: `module.resource.operations.action`,
-con `kebab-case` en el slug del módulo cuando lleva guión (como ya hace el
-paquete para `connected-account`).
-
-### Por qué dos sub-recursos (`CONFIG` y `DEVICE`)
-
-- `CONFIG` controla quién puede administrar la configuración del proveedor GPS
-  por dealer (credenciales, nombre, tipo de proveedor). Es un recurso CRUD
-  clásico → 4 acciones.
-- `DEVICE` controla quién puede consultar dispositivos GPS contra el proveedor
-  externo. Se separa en dos por costo:
-  - `VIEW` cubre las lecturas (location, history, status, info, mileage,
-    alerts, active, search).
-  - `LOCATE` controla el único endpoint que **dispara un ping on-demand al
-    dispositivo** (`POST /gps-provider/devices/:imei/locate`), que consume cuota
-    del proveedor. Tiene sentido restringirlo aparte.
-
-## Mapeo endpoint → permiso
-
-| Controller / Método | HTTP | Permiso |
-|---|---|---|
-| `DealerGpsConfigController.create` | `POST /gps-provider/config` | `GPS_PROVIDER.CONFIG.OPERATIONS.CREATE` |
-| `DealerGpsConfigController.findAllByDealer` | `GET /gps-provider/config` | `GPS_PROVIDER.CONFIG.OPERATIONS.VIEW` |
-| `DealerGpsConfigController.findById` | `GET /gps-provider/config/:configId` | `GPS_PROVIDER.CONFIG.OPERATIONS.VIEW` |
-| `DealerGpsConfigController.update` | `PUT /gps-provider/config/:configId` | `GPS_PROVIDER.CONFIG.OPERATIONS.UPDATE` |
-| `DealerGpsConfigController.delete` | `DELETE /gps-provider/config/:configId` | `GPS_PROVIDER.CONFIG.OPERATIONS.DELETE` |
-| `GpsDeviceController.findByImei` | `GET /gps-provider/devices/search` | `GPS_PROVIDER.DEVICE.OPERATIONS.VIEW` |
-| `GpsDeviceController.getDeviceLocation` | `GET /gps-provider/devices/:imei/location` | `GPS_PROVIDER.DEVICE.OPERATIONS.VIEW` |
-| `GpsDeviceController.locateDeviceNow` | `POST /gps-provider/devices/:imei/locate` | `GPS_PROVIDER.DEVICE.OPERATIONS.LOCATE` |
-| `GpsDeviceController.getDeviceHistory` | `GET /gps-provider/devices/:imei/history` | `GPS_PROVIDER.DEVICE.OPERATIONS.VIEW` |
-| `GpsDeviceController.getDeviceStatus` | `GET /gps-provider/devices/:imei/status` | `GPS_PROVIDER.DEVICE.OPERATIONS.VIEW` |
-| `GpsDeviceController.getDeviceInfo` | `GET /gps-provider/devices/:imei/info` | `GPS_PROVIDER.DEVICE.OPERATIONS.VIEW` |
-| `GpsDeviceController.getDeviceMileage` | `GET /gps-provider/devices/:imei/mileage` | `GPS_PROVIDER.DEVICE.OPERATIONS.VIEW` |
-| `GpsDeviceController.getDeviceAlerts` | `GET /gps-provider/devices/:imei/alerts` | `GPS_PROVIDER.DEVICE.OPERATIONS.VIEW` |
-| `GpsDeviceController.isDeviceActive` | `GET /gps-provider/devices/:imei/active` | `GPS_PROVIDER.DEVICE.OPERATIONS.VIEW` |
-
-## Estado anterior (qué se reemplaza)
-
-Antes de esta integración, los endpoints del módulo dependían de permisos
-prestados o no validaban:
-
-- `POST/PUT /gps-provider/config` usaba `DEALER.OPERATIONS.UPDATE`.
-- `DELETE /gps-provider/config/:id` usaba `DEALER.OPERATIONS.DELETE`.
-- `GET /gps-provider/config` y `GET /gps-provider/config/:id` **no validaban
-  permiso alguno** (sólo JWT + filtro por `dealerId`).
-- Los 9 endpoints de `GpsDeviceController` usaban `CAR.GPS.OPERATIONS.VIEW`
-  (prestado del módulo `car`), sin distinguir `locate` de lecturas pasivas.
-
-## Pasos de release
-
-1. **Repo del paquete `@telos-dev-team/dealernode-permissions`**: pegar el
-   bloque `GPS_PROVIDER` en `src/permissions.ts`, abrir PR, bumpear versión
-   (minor: `1.x.0`), publicar.
-2. **dealernode-backend**:
-   - `npm install @telos-dev-team/dealernode-permissions@<nueva-versión>` y
-     commitear `package.json` + lockfile.
-   - Aplicar los reemplazos en commands y queries del módulo gps-provider
-     (los 14 endpoints, ver tabla de arriba).
-3. **Deploy**.
-4. **Post-deploy**: correr `npm run sync:permissions` contra el ambiente para
-   crear los 6 permisos nuevos en la tabla `permission`. El script es
-   idempotente y debe imprimir `6 created, 0 deleted`.
-5. **Operativo**: asignar los nuevos permisos a los roles correspondientes
-   (super_admin, dealer_admin, manager según política). No se hace por código.
-
-## Notas
-
-- No se elimina ningún permiso existente; los `CAR.GPS.OPERATIONS.*` y
-  `DEAL.GPS.OPERATIONS.*` siguen siendo válidos para sus propios módulos
-  (`car`/`deal`). Sólo se deja de **reusarlos** desde `gps-provider`.
-- Si en el futuro hace falta granularidad adicional para device (p. ej.
-  separar `VIEW_HISTORY` o `VIEW_ALERTS`), se agrega como una nueva acción
-  bajo `GPS_PROVIDER.DEVICE.OPERATIONS` sin romper compatibilidad.

package/src/backoffice-permissions.ts

@@ -1,168 +0,0 @@
-/**
- * Backoffice realm — a separate, flat catalog from `PERMISSIONS`.
- *
- * The backoffice (internal admin tool) authorizes against its own
- * `backoffice_user_permission` table, never against a dealer's `user_dealer`
- * membership. Its permission ids share the `permission` table in the
- * database with the product catalog above, but the two are otherwise
- * unrelated: a `backoffice.*` id is never assignable to a dealer role, and a
- * product id is never assignable to a backoffice user. Keeping them as a
- * separate export (instead of a top-level key inside `PERMISSIONS`) makes
- * that boundary explicit and lets each side filter the other out of its own
- * catalog listing.
- */
-export const BACKOFFICE_PERMISSIONS = {
-  DEALERS: {
-    VIEW: "backoffice.dealers.view",
-    MANAGE: "backoffice.dealers.manage",
-  },
-  USERS: {
-    VIEW: "backoffice.users.view",
-    MANAGE: "backoffice.users.manage",
-  },
-  /**
-   * Split out from USERS.MANAGE on purpose: granting/revoking a backoffice
-   * user's permissions is more sensitive than editing their name or email,
-   * and folding both into one permission let any admin escalate themselves
-   * to anything. No VIEW counterpart — reading a user's permissions is
-   * already covered by USERS.VIEW (GET /backoffice/users/:id).
-   */
-  PERMISSIONS: {
-    MANAGE: "backoffice.permissions.manage",
-  },
-  PAYMENTS: {
-    VIEW: "backoffice.payments.view",
-    MANAGE: "backoffice.payments.manage",
-  },
-  /**
-   * Management of per-dealer resources from the backoffice — catalogs each
-   * dealer otherwise manages under Company → Resources: bank, color, floor,
-   * purchase_source, agency, plate_origin, wholesale_target,
-   * commission_category, deal_actor_type, title_status,
-   * car_extra_category/type, deal_extra_category/type, arbitration_issue_type.
-   * One permission per area (same grain as DEALERS/USERS/PAYMENTS), not one
-   * per entity — 15 very similar entities, one permission each would be
-   * noise with no real granularity benefit.
-   */
-  DEALER_RESOURCES: {
-    VIEW: "backoffice.dealer_resources.view",
-    MANAGE: "backoffice.dealer_resources.manage",
-  },
-  /** Global vehicle catalog: brand/model/trim/style/fuel-type/title-brand. */
-  CATALOG: {
-    VIEW: "backoffice.catalog.view",
-    MANAGE: "backoffice.catalog.manage",
-  },
-  /**
-   * Management of a dealer's roles and permissions from the backoffice —
-   * roles, role↔permission, role↔user and direct user↔permission grants.
-   * Its own permission (not DEALER_RESOURCES): roles/permissions govern a
-   * dealer's whole RBAC, more sensitive than a catalog of colors/banks.
-   */
-  DEALER_ROLES: {
-    VIEW: "backoffice.dealer_roles.view",
-    MANAGE: "backoffice.dealer_roles.manage",
-  },
-  /**
-   * Members of any dealer from the backoffice: list them, view one, and
-   * replace its roles and deal actor types. Its own permission (not
-   * DEALER_ROLES): who may edit a dealer's role catalog is not the same as who
-   * may re-assign people to those roles. Never touches a member's direct
-   * permissions.
-   */
-  DEALER_MEMBERS: {
-    VIEW: "backoffice.dealer_members.view",
-    MANAGE: "backoffice.dealer_members.manage",
-  },
-  /**
-   * Dealer-to-dealer relationships of any dealer from the backoffice: list them
-   * and (MANAGE) create/revoke/suspend/reactivate a relationship and set the
-   * capabilities one dealer grants another. Management only — the product keeps
-   * the runtime read-path that resolves cross-dealer access per request.
-   */
-  DEALER_RELATIONSHIPS: {
-    VIEW: "backoffice.dealer_relationships.view",
-    MANAGE: "backoffice.dealer_relationships.manage",
-  },
-  /**
-   * Dealer groups from the backoffice: list them and (MANAGE) create/update/
-   * delete a group, add/remove members, set the group permission contract,
-   * manage group user assignments and propagate roles across the group.
-   */
-  DEALER_GROUPS: {
-    VIEW: "backoffice.dealer_groups.view",
-    MANAGE: "backoffice.dealer_groups.manage",
-  },
-  /**
-   * Workflows of any dealer from the backoffice: list them, open the editor,
-   * and (MANAGE) create, edit, version and test them, including the AI
-   * assistant. Never decides which workflows run in production: that is
-   * assigned by each dealer from the product.
-   */
-  WORKFLOWS: {
-    VIEW: "backoffice.workflows.view",
-    MANAGE: "backoffice.workflows.manage",
-  },
-  /**
-   * Platform-to-dealer billing (dealernode-backend `src/billing`): plans,
-   * global charge provider, dealer subscriptions, cards and invoices. Not
-   * PAYMENTS, which is what a dealer charges its own buyers.
-   */
-  BILLING: {
-    VIEW: "backoffice.billing.view",
-    MANAGE: "backoffice.billing.manage",
-    /**
-     * Load and change the platform's merchant credentials on each charge
-     * provider. Separate from MANAGE because these keys move money: whoever
-     * manages plans and subscriptions doesn't need to be able to change them.
-     */
-    CREDENTIALS: "backoffice.billing.credentials",
-  },
-} as const;
-
-export type BackofficePermission = typeof BACKOFFICE_PERMISSIONS;
-
-/**
- * The actual union of backoffice permission id strings. `BackofficePermission`
- * (the type of the whole tree, mirroring `Permission` above) can't be used to
- * type "any single backoffice permission id" — this can.
- */
-type Leaves<T> = T extends string ? T : { [K in keyof T]: Leaves<T[K]> }[keyof T];
-export type BackofficePermissionId = Leaves<BackofficePermission>;
-
-function flatten(node: Record<string, unknown>): BackofficePermissionId[] {
-  const values: BackofficePermissionId[] = [];
-  for (const key of Object.keys(node)) {
-    const value = node[key];
-    if (typeof value === "string") {
-      values.push(value as BackofficePermissionId);
-    } else if (typeof value === "object" && value !== null) {
-      values.push(...flatten(value as Record<string, unknown>));
-    }
-  }
-  return values;
-}
-
-const ALL_BACKOFFICE_PERMISSIONS = flatten(BACKOFFICE_PERMISSIONS);
-const READ_ONLY_BACKOFFICE_PERMISSIONS = ALL_BACKOFFICE_PERMISSIONS.filter((id) =>
-  id.endsWith(".view"),
-);
-
-/**
- * Selection presets for the permission-assignment UI. Consumers resolve
- * these ids against their own `permission` table rows (the DB, not this
- * package, owns the ULIDs) — see `GET /backoffice/permissions/backoffice`
- * in dealernode-backend.
- */
-export const BACKOFFICE_PERMISSION_PRESETS = {
-  /** Every `*.view` permission, nothing else. */
-  READ_ONLY: READ_ONLY_BACKOFFICE_PERMISSIONS,
-  /** Read-only plus the two areas support routinely needs to act on. */
-  SUPPORT: [
-    ...READ_ONLY_BACKOFFICE_PERMISSIONS,
-    BACKOFFICE_PERMISSIONS.DEALERS.MANAGE,
-    BACKOFFICE_PERMISSIONS.DEALER_RESOURCES.MANAGE,
-  ],
-  /** Every backoffice permission. */
-  ADMIN: ALL_BACKOFFICE_PERMISSIONS,
-} as const satisfies Record<string, readonly BackofficePermissionId[]>;

package/src/index.ts

@@ -1,7 +0,0 @@
-export { PERMISSIONS, Permission } from './permissions';
-export {
-  BACKOFFICE_PERMISSIONS,
-  BackofficePermission,
-  BackofficePermissionId,
-  BACKOFFICE_PERMISSION_PRESETS,
-} from './backoffice-permissions';