@fiado/api-invoker 4.37.1 → 4.39.0

package/bin/platformRbac/api/PlatformRbacBusinessApi.d.ts

@@ -1,5 +1,5 @@
 import type { IHttpRequest } from "@fiado/http-client";
-import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
 import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.js";
 /**
@@ -17,7 +17,6 @@ import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.
  */
 export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi {
     private httpRequest;
-    /** URL base del lambda. Leída de env var en cold start del consumer. */
     private readonly baseUrl;
     constructor(httpRequest: IHttpRequest);
     defineNextChallenge(input: DefineNextChallengeRequest): Promise<ApiGatewayResponse<DefineNextChallengeResponse>>;
@@ -26,4 +25,5 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
     authorize(input: AuthorizeRequest): Promise<ApiGatewayResponse<AuthorizeResponse>>;
     effectivePermissions(cognitoSub: string, tenantId?: string): Promise<ApiGatewayResponse<EffectivePermissionsResponse>>;
     getInjectableUserAttributes(cognitoSub: string, tenantId: string): Promise<ApiGatewayResponse<InjectableUserAttributesResponse>>;
+    resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
 }

package/bin/platformRbac/api/PlatformRbacBusinessApi.js

@@ -26,7 +26,9 @@ import { inject, injectable } from "inversify";
  */
 let PlatformRbacBusinessApi = class PlatformRbacBusinessApi {
     httpRequest;
-    /** URL base del lambda. Leída de env var en cold start del consumer. */
+    // DEC-RBAC-069 (unificado a env var): toda la URL de rbac — incluido el endpoint del resolver — sale
+    // del env var PLATFORM_RBAC_BUSINESS_URL ('{{resolve:ssm:platform-rbac-business}}'), una por ambiente.
+    // Es server-to-server (VpcEndpoint), sin relación con el dominio de cookies del navegador.
     baseUrl = process.env.PLATFORM_RBAC_BUSINESS_URL || "";
     constructor(httpRequest) {
         this.httpRequest = httpRequest;
@@ -62,6 +64,10 @@ let PlatformRbacBusinessApi = class PlatformRbacBusinessApi {
         const url = `${this.baseUrl}/internal/users/${encodeURIComponent(cognitoSub)}/injectable-attributes?tenantId=${encodeURIComponent(tenantId)}`;
         return await this.httpRequest.get(url);
     }
+    async resolvePermissions(input) {
+        const url = `${this.baseUrl}/internal/permissions/resolve`;
+        return await this.httpRequest.post(url, input);
+    }
 };
 PlatformRbacBusinessApi = __decorate([
     injectable(),

package/bin/platformRbac/api/interfaces/IPlatformRbacBusinessApi.d.ts

@@ -1,4 +1,4 @@
-import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
 import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
 /**
  * Contrato del publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
@@ -61,4 +61,6 @@ export interface IPlatformRbacBusinessApi {
      * jwt-inyector-trigger para estampar el claim `customAttributes`. DEC-RBAC-022.
      */
     getInjectableUserAttributes(cognitoSub: string, tenantId: string): Promise<ApiGatewayResponse<InjectableUserAttributesResponse>>;
+    /** POST /internal/permissions/resolve — resuelve permisos scope-bound (set completo, paginación interna) para el RBAC enforcement del gateway-adapter. DEC-RBAC-064. */
+    resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
 }

package/bin/platformRbac/index.d.ts

@@ -1,2 +1,4 @@
 export * from "./api/interfaces/IPlatformRbacBusinessApi.js";
 export { default as PlatformRbacBusinessApi } from "./api/PlatformRbacBusinessApi.js";
+export { ApiInvokerPermissionResolver } from "./resolver/ApiInvokerPermissionResolver.js";
+export { apiInvokerResolverBindings } from "./resolver/apiInvokerResolverBindings.js";

package/bin/platformRbac/index.js

@@ -1,2 +1,4 @@
 export * from "./api/interfaces/IPlatformRbacBusinessApi.js";
 export { default as PlatformRbacBusinessApi } from "./api/PlatformRbacBusinessApi.js";
+export { ApiInvokerPermissionResolver } from "./resolver/ApiInvokerPermissionResolver.js";
+export { apiInvokerResolverBindings } from "./resolver/apiInvokerResolverBindings.js";

package/bin/platformRbac/resolver/ApiInvokerPermissionResolver.d.ts

@@ -0,0 +1,25 @@
+import type { ResolveInput, ResolvedPermissions } from "@fiado/gateway-adapter";
+import type { IPlatformRbacBusinessApi } from "../api/interfaces/IPlatformRbacBusinessApi.js";
+/**
+ * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
+ * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
+ * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
+ * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
+ * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
+ *
+ * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
+ * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
+ * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
+ * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
+ * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
+ * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
+ */
+export declare class ApiInvokerPermissionResolver {
+    private readonly _api;
+    private readonly _cache;
+    constructor(_api: IPlatformRbacBusinessApi, opts?: {
+        ttlMs: number;
+        maxEntries: number;
+    });
+    resolve(input: ResolveInput): Promise<ResolvedPermissions>;
+}

package/bin/platformRbac/resolver/ApiInvokerPermissionResolver.js

@@ -0,0 +1,63 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { injectable, inject } from "inversify";
+import { TtlCache } from "@fiado/gateway-adapter";
+/**
+ * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
+ * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
+ * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
+ * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
+ * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
+ *
+ * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
+ * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
+ * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
+ * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
+ * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
+ * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
+ */
+let ApiInvokerPermissionResolver = class ApiInvokerPermissionResolver {
+    _api;
+    _cache;
+    constructor(_api, opts = {
+        ttlMs: Number(process.env.RBAC_AUTHZ_CACHE_TTL_MS) || 60000,
+        maxEntries: 500,
+    }) {
+        this._api = _api;
+        this._cache = new TtlCache(opts);
+    }
+    async resolve(input) {
+        const cacheable = input.roleAssignmentsFromToken === undefined;
+        const key = `${input.issuer ?? ""}#${input.cognitoSub}`;
+        if (cacheable) {
+            const hit = this._cache.get(key);
+            if (hit)
+                return hit;
+        }
+        // DEC-RBAC-071: fail-closed por propagación. Si el invoke (HTTP/VpcEndpoint) falla, se propaga:
+        // en el adapter, enforceRbac mapea solo PermissionDeniedError a 403; este error se re-lanza -> 5xx.
+        // Es fail-closed (no concede), NO un 403, y es deliberado: un fallo de red NO debe verse como
+        // "usuario sin permisos". NUNCA devolver { assignments: [] } en un catch.
+        const resp = await this._api.resolvePermissions(input);
+        const resolved = resp.body;
+        if (cacheable)
+            this._cache.set(key, resolved);
+        return resolved;
+    }
+};
+ApiInvokerPermissionResolver = __decorate([
+    injectable(),
+    __param(0, inject("IPlatformRbacBusinessApi")),
+    __metadata("design:paramtypes", [Object, Object])
+], ApiInvokerPermissionResolver);
+export { ApiInvokerPermissionResolver };

package/bin/platformRbac/resolver/apiInvokerResolverBindings.d.ts

@@ -0,0 +1,4 @@
+import { ContainerModule } from "inversify";
+/** DEC-RBAC-066: bindea ApiInvokerPermissionResolver al símbolo PERMISSION_RESOLVER de gateway-adapter.
+ *  El lambda consumidor carga este módulo DESPUÉS de gatewayAdapterBindings y de bindear "IPlatformRbacBusinessApi". */
+export declare const apiInvokerResolverBindings: ContainerModule;

package/bin/platformRbac/resolver/apiInvokerResolverBindings.js

@@ -0,0 +1,13 @@
+import { ContainerModule } from "inversify";
+import { PERMISSION_RESOLVER } from "@fiado/gateway-adapter";
+import { ApiInvokerPermissionResolver } from "./ApiInvokerPermissionResolver.js";
+/** DEC-RBAC-066: bindea ApiInvokerPermissionResolver al símbolo PERMISSION_RESOLVER de gateway-adapter.
+ *  El lambda consumidor carga este módulo DESPUÉS de gatewayAdapterBindings y de bindear "IPlatformRbacBusinessApi". */
+export const apiInvokerResolverBindings = new ContainerModule(({ bind }) => {
+    bind(PERMISSION_RESOLVER)
+        .toDynamicValue((ctx) => {
+        const api = ctx.get("IPlatformRbacBusinessApi");
+        return new ApiInvokerPermissionResolver(api);
+    })
+        .inSingletonScope();
+});

package/bin/transactionProcessor/api/TransactionProcessorApi.d.ts

@@ -4,7 +4,6 @@ import { AuthorizeCollectorOrderRequest, AuthorizeCollectorOrderResponse, Author
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
 import { ValidateWalletFundingRequest, ValidateWalletFundingResponse, CreditWalletFundingRequest, CreditWalletFundingResponse, ReverseWalletFundingRequest, ReverseWalletFundingResponse, GetWalletFundingLimitRequest, GetWalletFundingLimitResponse } from "@fiado/type-kit/bin/walletFunding/index.js";
 import { RemittanceCreditBackRequest, RemittanceCreditBackResponse } from "@fiado/type-kit/bin/remittance/index.js";
-import { PublishFiadoTxRequest, PublishFiadoTxResponse } from "@fiado/type-kit/bin/transactionProcessor/index.js";
 type ProcessUpdateLevelRequest = import("@fiado/type-kit/bin/transactionProcessor/dtos/ProcessUpdateLevelRequest.js").default;
 type FiadoApiResponse<T> = import("@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse.js").default<T>;
 export default class TransactionProcessorApi implements ITransactionProcessorApi {
@@ -23,6 +22,5 @@ export default class TransactionProcessorApi implements ITransactionProcessorApi
     walletFundingReverse(request: ReverseWalletFundingRequest): Promise<ApiGatewayResponse<ReverseWalletFundingResponse>>;
     walletFundingGetLimit(request: GetWalletFundingLimitRequest): Promise<ApiGatewayResponse<GetWalletFundingLimitResponse>>;
     creditBack(request: RemittanceCreditBackRequest): Promise<FiadoApiResponse<RemittanceCreditBackResponse>>;
-    publishFiadoTx(request: PublishFiadoTxRequest): Promise<ApiGatewayResponse<PublishFiadoTxResponse>>;
 }
 export {};

package/bin/transactionProcessor/api/TransactionProcessorApi.js

@@ -65,10 +65,6 @@ let TransactionProcessorApi = class TransactionProcessorApi {
         const url = `${this.baseUrl}remittance/credit-back`;
         return await this.httpRequest.post(url, request);
     }
-    async publishFiadoTx(request) {
-        const url = `${this.baseUrl}wallet-funding/publish`;
-        return await this.httpRequest.post(url, request);
-    }
 };
 TransactionProcessorApi = __decorate([
     injectable(),

package/bin/transactionProcessor/api/interfaces/ITransactionProcessorApi.d.ts

@@ -3,7 +3,6 @@ import { AuthorizeCollectorOrderRequest, AuthorizeCollectorOrderResponse, Author
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
 import { ValidateWalletFundingRequest, ValidateWalletFundingResponse, CreditWalletFundingRequest, CreditWalletFundingResponse, ReverseWalletFundingRequest, ReverseWalletFundingResponse, GetWalletFundingLimitRequest, GetWalletFundingLimitResponse } from "@fiado/type-kit/bin/walletFunding/index.js";
 import { RemittanceCreditBackRequest, RemittanceCreditBackResponse } from "@fiado/type-kit/bin/remittance/index.js";
-import { PublishFiadoTxRequest, PublishFiadoTxResponse } from "@fiado/type-kit/bin/transactionProcessor/index.js";
 type ProcessUpdateLevelRequest = import("@fiado/type-kit/bin/transactionProcessor/dtos/ProcessUpdateLevelRequest.js").default;
 export interface ITransactionProcessorApi {
     authorizeTransaction(request: AuthorizeCreditCardPurchaseRequest): Promise<any>;
@@ -44,22 +43,5 @@ export interface ITransactionProcessorApi {
      * Backend: POST /transaction-processor/remittance/credit-back (privado VPC).
      */
     creditBack(request: RemittanceCreditBackRequest): Promise<FiadoApiResponse<RemittanceCreditBackResponse>>;
-    /**
-     * Publica el evento FiadoTx del wallet-funding cash-in al SQS
-     * TRANSACTION_QUEUE para que transaction-business persista la
-     * tupla EQ_CASH_SA en FiadoTx_GT.
-     *
-     * Ownership del SQS sigue en el processor (el settlement NO publica,
-     * solo ejecuta el TransactWriteItems atómico). Best-effort: status
-     * FAILED indica que sqs.sendMessage falló — el caller debe loggear
-     * y continuar; el reconciler T+0 del connector recupera gaps.
-     *
-     * Backend: POST /transaction-processor/wallet-funding/publish (privado VPC).
-     * Consumido por equality-connector (post-settlement OK) y por su
-     * FiadoTxGapReconcilerCron.
-     *
-     * Ver spec 15 §6.2.
-     */
-    publishFiadoTx(request: PublishFiadoTxRequest): Promise<ApiGatewayResponse<PublishFiadoTxResponse>>;
 }
 export {};

package/jest.config.cjs

@@ -0,0 +1,12 @@
+/** @type {import('ts-jest').JestConfigWithTsJest} */
+module.exports = {
+  testEnvironment: 'node',
+  testMatch: ['**/test/**/*.test.ts'],
+  setupFiles: ['reflect-metadata'],
+  extensionsToTreatAsEsm: ['.ts'],
+  moduleNameMapper: { '^(\\.{1,2}/.*)\\.js$': '$1' },
+  transform: {
+    '^.+\\.[tj]sx?$': ['ts-jest', { useESM: true, isolatedModules: true, tsconfig: 'tsconfig.test.json' }],
+  },
+  transformIgnorePatterns: ['/node_modules/(?!(inversify|@inversifyjs)/)'],
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "4.37.1",
+  "version": "4.39.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "type": "module",
   "main": "bin/index.js",
@@ -31,7 +31,7 @@
   "license": "ISC",
   "dependencies": {
     "@aws-sdk/client-sqs": "^3.919.0",
-    "@fiado/gateway-adapter": "^2.0.2",
+    "@fiado/gateway-adapter": "^3.9.0",
     "@fiado/http-client": "^2.0.1",
     "@fiado/logger": "^1.1.3",
     "@fiado/type-kit": "^3.123.0",

package/src/platformRbac/api/PlatformRbacBusinessApi.ts

@@ -1,6 +1,6 @@
 import { inject, injectable } from "inversify";
 import type { IHttpRequest } from "@fiado/http-client";
-import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
 // TD-AI-001: import de @fiado/type-kit/bin/platformRbac requiere npm link a type-kit 3.43.1 hasta publish final. Ver docs/TECH_DEBT.md.
 import {
     DefineNextChallengeRequest,
@@ -31,7 +31,9 @@ import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.
  */
 @injectable()
 export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi {
-    /** URL base del lambda. Leída de env var en cold start del consumer. */
+    // DEC-RBAC-069 (unificado a env var): toda la URL de rbac — incluido el endpoint del resolver — sale
+    // del env var PLATFORM_RBAC_BUSINESS_URL ('{{resolve:ssm:platform-rbac-business}}'), una por ambiente.
+    // Es server-to-server (VpcEndpoint), sin relación con el dominio de cookies del navegador.
     private readonly baseUrl = process.env.PLATFORM_RBAC_BUSINESS_URL || "";
 
     constructor(@inject("IHttpRequest") private httpRequest: IHttpRequest) {}
@@ -86,4 +88,11 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
         const url = `${this.baseUrl}/internal/users/${encodeURIComponent(cognitoSub)}/injectable-attributes?tenantId=${encodeURIComponent(tenantId)}`;
         return await this.httpRequest.get(url);
     }
+
+    async resolvePermissions(
+        input: ResolveInput,
+    ): Promise<ApiGatewayResponse<ResolvedPermissions>> {
+        const url = `${this.baseUrl}/internal/permissions/resolve`;
+        return await this.httpRequest.post(url, input);
+    }
 }

package/src/platformRbac/api/interfaces/IPlatformRbacBusinessApi.ts

@@ -1,4 +1,4 @@
-import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
 import {
     DefineNextChallengeRequest,
     DefineNextChallengeResponse,
@@ -92,4 +92,7 @@ export interface IPlatformRbacBusinessApi {
         cognitoSub: string,
         tenantId: string,
     ): Promise<ApiGatewayResponse<InjectableUserAttributesResponse>>;
+
+    /** POST /internal/permissions/resolve — resuelve permisos scope-bound (set completo, paginación interna) para el RBAC enforcement del gateway-adapter. DEC-RBAC-064. */
+    resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
 }

package/src/platformRbac/index.ts

@@ -1,2 +1,4 @@
 export * from "./api/interfaces/IPlatformRbacBusinessApi.js";
 export { default as PlatformRbacBusinessApi } from "./api/PlatformRbacBusinessApi.js";
+export { ApiInvokerPermissionResolver } from "./resolver/ApiInvokerPermissionResolver.js";
+export { apiInvokerResolverBindings } from "./resolver/apiInvokerResolverBindings.js";

package/src/platformRbac/resolver/ApiInvokerPermissionResolver.ts

@@ -0,0 +1,48 @@
+import { injectable, inject } from "inversify";
+import type { ResolveInput, ResolvedPermissions } from "@fiado/gateway-adapter";
+import { TtlCache } from "@fiado/gateway-adapter";
+import type { IPlatformRbacBusinessApi } from "../api/interfaces/IPlatformRbacBusinessApi.js";
+
+/**
+ * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
+ * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
+ * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
+ * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
+ * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
+ *
+ * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
+ * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
+ * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
+ * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
+ * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
+ * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
+ */
+@injectable()
+export class ApiInvokerPermissionResolver {
+    private readonly _cache: TtlCache<ResolvedPermissions>;
+    constructor(
+        @inject("IPlatformRbacBusinessApi") private readonly _api: IPlatformRbacBusinessApi,
+        opts: { ttlMs: number; maxEntries: number } = {
+            ttlMs: Number(process.env.RBAC_AUTHZ_CACHE_TTL_MS) || 60000,
+            maxEntries: 500,
+        },
+    ) {
+        this._cache = new TtlCache<ResolvedPermissions>(opts);
+    }
+    async resolve(input: ResolveInput): Promise<ResolvedPermissions> {
+        const cacheable = input.roleAssignmentsFromToken === undefined;
+        const key = `${input.issuer ?? ""}#${input.cognitoSub}`;
+        if (cacheable) {
+            const hit = this._cache.get(key);
+            if (hit) return hit;
+        }
+        // DEC-RBAC-071: fail-closed por propagación. Si el invoke (HTTP/VpcEndpoint) falla, se propaga:
+        // en el adapter, enforceRbac mapea solo PermissionDeniedError a 403; este error se re-lanza -> 5xx.
+        // Es fail-closed (no concede), NO un 403, y es deliberado: un fallo de red NO debe verse como
+        // "usuario sin permisos". NUNCA devolver { assignments: [] } en un catch.
+        const resp = await this._api.resolvePermissions(input);
+        const resolved = resp.body;
+        if (cacheable) this._cache.set(key, resolved);
+        return resolved;
+    }
+}

package/src/platformRbac/resolver/apiInvokerResolverBindings.ts

@@ -0,0 +1,23 @@
+import { ContainerModule } from "inversify";
+import { PERMISSION_RESOLVER } from "@fiado/gateway-adapter";
+import type { ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
+import type { IPlatformRbacBusinessApi } from "../api/interfaces/IPlatformRbacBusinessApi.js";
+import { ApiInvokerPermissionResolver } from "./ApiInvokerPermissionResolver.js";
+
+/** Contrato estructural de `IPermissionResolver` del gateway-adapter.
+ *  El barrel del adapter no re-exporta el tipo `IPermissionResolver` (ver TD-AI-002 en
+ *  ApiInvokerPermissionResolver.ts), así que se replica el shape mínimo para tipar el binding. */
+type IPermissionResolver = {
+    resolve(input: ResolveInput): Promise<ResolvedPermissions>;
+};
+
+/** DEC-RBAC-066: bindea ApiInvokerPermissionResolver al símbolo PERMISSION_RESOLVER de gateway-adapter.
+ *  El lambda consumidor carga este módulo DESPUÉS de gatewayAdapterBindings y de bindear "IPlatformRbacBusinessApi". */
+export const apiInvokerResolverBindings = new ContainerModule(({ bind }) => {
+    bind<IPermissionResolver>(PERMISSION_RESOLVER)
+        .toDynamicValue((ctx) => {
+            const api = ctx.get<IPlatformRbacBusinessApi>("IPlatformRbacBusinessApi");
+            return new ApiInvokerPermissionResolver(api);
+        })
+        .inSingletonScope();
+});

package/src/transactionProcessor/api/TransactionProcessorApi.ts

@@ -22,7 +22,6 @@ import {
     GetWalletFundingLimitResponse,
 } from "@fiado/type-kit/bin/walletFunding/index.js";
 import { RemittanceCreditBackRequest, RemittanceCreditBackResponse } from "@fiado/type-kit/bin/remittance/index.js";
-import { PublishFiadoTxRequest, PublishFiadoTxResponse } from "@fiado/type-kit/bin/transactionProcessor/index.js";
 type ProcessUpdateLevelRequest = import("@fiado/type-kit/bin/transactionProcessor/dtos/ProcessUpdateLevelRequest.js").default;
 type FiadoApiResponse<T> = import("@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse.js").default<T>;
 
@@ -103,11 +102,4 @@ export default class TransactionProcessorApi implements ITransactionProcessorApi
         const url = `${this.baseUrl}remittance/credit-back`;
         return await this.httpRequest.post(url, request);
     }
-
-    async publishFiadoTx(
-        request: PublishFiadoTxRequest,
-    ): Promise<ApiGatewayResponse<PublishFiadoTxResponse>> {
-        const url = `${this.baseUrl}wallet-funding/publish`;
-        return await this.httpRequest.post(url, request);
-    }
 }

package/src/transactionProcessor/api/interfaces/ITransactionProcessorApi.ts

@@ -21,7 +21,6 @@ import {
     GetWalletFundingLimitResponse,
 } from "@fiado/type-kit/bin/walletFunding/index.js";
 import { RemittanceCreditBackRequest, RemittanceCreditBackResponse } from "@fiado/type-kit/bin/remittance/index.js";
-import { PublishFiadoTxRequest, PublishFiadoTxResponse } from "@fiado/type-kit/bin/transactionProcessor/index.js";
 type ProcessUpdateLevelRequest = import("@fiado/type-kit/bin/transactionProcessor/dtos/ProcessUpdateLevelRequest.js").default;
 
 export interface ITransactionProcessorApi {
@@ -85,24 +84,4 @@ export interface ITransactionProcessorApi {
     creditBack(
         request: RemittanceCreditBackRequest,
     ): Promise<FiadoApiResponse<RemittanceCreditBackResponse>>;
-
-    /**
-     * Publica el evento FiadoTx del wallet-funding cash-in al SQS
-     * TRANSACTION_QUEUE para que transaction-business persista la
-     * tupla EQ_CASH_SA en FiadoTx_GT.
-     *
-     * Ownership del SQS sigue en el processor (el settlement NO publica,
-     * solo ejecuta el TransactWriteItems atómico). Best-effort: status
-     * FAILED indica que sqs.sendMessage falló — el caller debe loggear
-     * y continuar; el reconciler T+0 del connector recupera gaps.
-     *
-     * Backend: POST /transaction-processor/wallet-funding/publish (privado VPC).
-     * Consumido por equality-connector (post-settlement OK) y por su
-     * FiadoTxGapReconcilerCron.
-     *
-     * Ver spec 15 §6.2.
-     */
-    publishFiadoTx(
-        request: PublishFiadoTxRequest,
-    ): Promise<ApiGatewayResponse<PublishFiadoTxResponse>>;
 }