feat(planning): ship holiday-aware planning and assistant upgrades

apps/web/src/components/admin/SystemRolesClient.tsx

@@ -9,6 +9,7 @@ const ALL_PERMISSION_KEYS = Object.values(PermissionKey);
 
 const PERMISSION_LABELS: Record<string, string> = {
   viewCosts: "View Costs",
+  useAssistantAdvancedTools: "Assistant Advanced Tools",
   exportData: "Export Data",
   importData: "Import Data",
   approveVacations: "Approve Vacations",
@@ -24,6 +25,7 @@ const PERMISSION_LABELS: Record<string, string> = {
 
 const PERMISSION_DESCRIPTIONS: Record<string, string> = {
   viewCosts: "Access to cost data, budget views, and financial reports",
+  useAssistantAdvancedTools: "Unlocks advanced AI assistant workflows for complex cross-entity analyses",
   exportData: "Export data to Excel, CSV, or PDF formats",
   importData: "Import data from external sources (Dispo, Excel)",
   approveVacations: "Approve or reject vacation requests",
@@ -97,6 +99,8 @@ export function SystemRolesClient() {
     staleTime: 10_000,
   });
 
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore TS2589: tRPC infers union type too deeply for the role config update payload
   const updateMutation = trpc.systemRoleConfig.update.useMutation({
     onSuccess: async () => {
       await utils.systemRoleConfig.list.invalidate();

apps/web/src/components/admin/UsersClient.tsx

@@ -15,6 +15,7 @@ const ALL_PERMISSION_KEYS = Object.values(PermissionKey);
 
 const PERMISSION_LABELS: Record<string, string> = {
   viewCosts: "View Costs",
+  useAssistantAdvancedTools: "Assistant Advanced Tools",
   exportData: "Export Data",
   importData: "Import Data",
   approveVacations: "Approve Vacations",
@@ -25,6 +26,7 @@ const PERMISSION_LABELS: Record<string, string> = {
   manageAllocations: "Manage Allocations",
   manageRoles: "Manage Roles",
   manageUsers: "Manage Users",
+  viewScores: "View Scores",
 };
 
 const SYSTEM_ROLE_LABELS: Record<SystemRole, string> = {