@fiado/api-invoker 4.60.0 → 4.62.0

package/bin/container.config.js

@@ -106,6 +106,8 @@ import MessagesBusinessPublisher from "./messages-business/queue/MessagesBusines
 import { TotpSecurityApi } from "./totp-security/index.js";
 // Equality connector — wallet-funding HTTP client (benefits-marketplace → equality-connector)
 import { EqualityConnectorApi } from "./equality-connector/index.js";
+// SynergyPay connector — wallet-funding HTTP client (benefits-marketplace → synergypay-connector)
+import { SynergyPayConnectorApi } from "./synergypay-connector/index.js";
 // Contacts business — fuente de verdad de correos verificados (F2 gate UNIR)
 import { ContactsBusinessApi } from "./contacts-business/index.js";
 // Wallet funding settlement — TransactWriteItems atómico del money path cash-in (spec 15)
@@ -233,6 +235,8 @@ export const apiInvokerBindings = new ContainerModule(({ bind }) => {
     bind("ITotpSecurityApi").to(TotpSecurityApi);
     // Equality connector — wallet-funding (benefits-marketplace → equality-connector)
     bind("IEqualityConnectorApi").to(EqualityConnectorApi);
+    // SynergyPay connector — wallet-funding (benefits-marketplace → synergypay-connector)
+    bind("ISynergyPayConnectorApi").to(SynergyPayConnectorApi);
     // Contacts business — fuente de verdad de correos verificados (F2 gate UNIR)
     bind("IContactsBusinessApi").to(ContactsBusinessApi);
     // Wallet funding settlement — TransactWriteItems atómico del money path cash-in

package/bin/index.d.ts

@@ -76,9 +76,11 @@ export * from "./benefits-marketplace/index.js";
 export * from "./milestone-business/index.js";
 export * from "./cognitoBackofficeConnector/index.js";
 export * from "./platformRbac/index.js";
+export * from "./retailOrg/index.js";
 export * from "./messages-business/index.js";
 export * from "./totp-security/index.js";
 export * from "./equality-connector/index.js";
+export * from "./synergypay-connector/index.js";
 export * from "./contacts-business/index.js";
 export * from "./uniteller-connector/index.js";
 export * from "./walletFundingSettlement/index.js";

package/bin/index.js

@@ -76,9 +76,11 @@ export * from "./benefits-marketplace/index.js";
 export * from "./milestone-business/index.js";
 export * from "./cognitoBackofficeConnector/index.js";
 export * from "./platformRbac/index.js";
+export * from "./retailOrg/index.js";
 export * from "./messages-business/index.js";
 export * from "./totp-security/index.js";
 export * from "./equality-connector/index.js";
+export * from "./synergypay-connector/index.js";
 export * from "./contacts-business/index.js";
 export * from "./uniteller-connector/index.js";
 export * from "./walletFundingSettlement/index.js";

package/bin/retailOrg/api/RetailOrgBusinessApi.d.ts

@@ -0,0 +1,27 @@
+import type { IHttpRequest } from "@fiado/http-client";
+import { StandardResponse } from "@fiado/gateway-adapter";
+import { RetailerValidationDto, StoreValidationDto, RetailUserValidationDto } from "@fiado/type-kit/bin/retailOrg/index.js";
+import { IRetailOrgBusinessApi } from "./interfaces/IRetailOrgBusinessApi.js";
+/**
+ * Publisher HTTP del lambda `retail-org-business` (componente 04 SureKeep Fase 1) para sus 4
+ * endpoints privados de validación. Contrato y semántica completos → `IRetailOrgBusinessApi`.
+ *
+ * Los 4 paths y el `?tenantId=` fueron verificados contra dev (200 + negativos 400/404) el
+ * 2026-07-16 y matchean `openapi/private.yaml` del lambda destino.
+ *
+ * Env var requerida en el consumer: `RETAIL_ORG_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   RETAIL_ORG_BUSINESS_URL: '{{resolve:ssm:retail-org-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+export default class RetailOrgBusinessApi implements IRetailOrgBusinessApi {
+    private httpRequest;
+    private readonly baseUrl;
+    constructor(httpRequest: IHttpRequest);
+    getRetailer(retailerId: string, tenantId: string): Promise<StandardResponse<RetailerValidationDto>>;
+    getStore(retailerId: string, storeId: string, tenantId: string): Promise<StandardResponse<StoreValidationDto>>;
+    getStoreUsers(retailerId: string, storeId: string, tenantId: string): Promise<StandardResponse<RetailUserValidationDto[]>>;
+    getUserByCognitoSub(cognitoSub: string, tenantId: string): Promise<StandardResponse<RetailUserValidationDto>>;
+}

package/bin/retailOrg/api/RetailOrgBusinessApi.js

@@ -0,0 +1,56 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from "inversify";
+/**
+ * Publisher HTTP del lambda `retail-org-business` (componente 04 SureKeep Fase 1) para sus 4
+ * endpoints privados de validación. Contrato y semántica completos → `IRetailOrgBusinessApi`.
+ *
+ * Los 4 paths y el `?tenantId=` fueron verificados contra dev (200 + negativos 400/404) el
+ * 2026-07-16 y matchean `openapi/private.yaml` del lambda destino.
+ *
+ * Env var requerida en el consumer: `RETAIL_ORG_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   RETAIL_ORG_BUSINESS_URL: '{{resolve:ssm:retail-org-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+let RetailOrgBusinessApi = class RetailOrgBusinessApi {
+    httpRequest;
+    baseUrl = process.env.RETAIL_ORG_BUSINESS_URL || "";
+    constructor(httpRequest) {
+        this.httpRequest = httpRequest;
+    }
+    async getRetailer(retailerId, tenantId) {
+        const url = `${this.baseUrl}/private/retailers/${encodeURIComponent(retailerId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+    async getStore(retailerId, storeId, tenantId) {
+        const url = `${this.baseUrl}/private/retailers/${encodeURIComponent(retailerId)}/stores/${encodeURIComponent(storeId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+    async getStoreUsers(retailerId, storeId, tenantId) {
+        const url = `${this.baseUrl}/private/retailers/${encodeURIComponent(retailerId)}/users/by-store/${encodeURIComponent(storeId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+    async getUserByCognitoSub(cognitoSub, tenantId) {
+        const url = `${this.baseUrl}/private/users/by-cognito-sub/${encodeURIComponent(cognitoSub)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+};
+RetailOrgBusinessApi = __decorate([
+    injectable(),
+    __param(0, inject("IHttpRequest")),
+    __metadata("design:paramtypes", [Object])
+], RetailOrgBusinessApi);
+export default RetailOrgBusinessApi;

package/bin/retailOrg/api/interfaces/IRetailOrgBusinessApi.d.ts

@@ -0,0 +1,78 @@
+import { StandardResponse } from "@fiado/gateway-adapter";
+import { RetailerValidationDto, StoreValidationDto, RetailUserValidationDto } from "@fiado/type-kit/bin/retailOrg/index.js";
+/**
+ * Contrato del publisher HTTP del lambda `retail-org-business` (componente 04 SureKeep Fase 1)
+ * para sus 4 endpoints privados de VALIDACIÓN (service-to-service, VPC-only).
+ *
+ * Consumidores previstos (regla R5 — cruces entre lambdas son SOLO lecturas de validación;
+ * ningún lambda escribe en tabla ajena):
+ *   - `retail-catalog-business` → valida `storeId` al registrar IMEIs
+ *   - `retail-cards-business`   → valida `storeId` de un lote de tarjetas PCF
+ *   - `loan-*`                  → valida retailer / store / usuarios retail
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * `tenantId` es OBLIGATORIO en los 4 métodos — no es un detalle de firma.
+ * ─────────────────────────────────────────────────────────────────────────────
+ * Los privados NO llevan token de usuario (`Feature.ANONIMUS`; la protección es la red VPC),
+ * así que el lambda destino no tiene `AuthContext.issuer` y NO puede inferir el silo. El caller
+ * declara el tenant explícito por query y `@fiado/tenant-context` asume el rol de ESE silo.
+ * Sin `tenantId` → `400 UNKNOWN_TENANT` (fail-closed, verificado en dev). Nunca hay default:
+ * caer a un tenant por default sería fail-OPEN y podría devolver datos de otra SOFOM.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * ⚠️ Patrón de retorno: `StandardResponse<T>` — el consumer accede `result.data`, NO `result.body`.
+ * ─────────────────────────────────────────────────────────────────────────────
+ * Los publishers viejos tipan `ApiGatewayResponse<T>` (`{ statusCode, body }`) y documentan
+ * `result.body.data`. Eso es FICCIÓN del tipo: `@fiado/http-client` hace `return response.data`
+ * (ver `AxiosHttpRequest`), o sea entrega el BODY PELADO — `.statusCode`/`.body` no existen en
+ * runtime y leerlos da `undefined`. Verificado en dev el 2026-07-16: costó un `500` (TypeError sobre
+ * `body.roleAssignments`) en `retail-org-business` al confiar en el tipo. `StandardResponse<T>`
+ * (`{ code, date, data, description?, msg? }`, ya exportado por `@fiado/gateway-adapter`) SÍ describe
+ * lo que llega. No se toca el tipo de los publishers viejos acá para no romperlos, pero los nuevos
+ * dicen la verdad.
+ *
+ * Errores: el lambda destino lanza `DomainError` tipado → el publisher RECHAZA (no devuelve null).
+ * Cada consumer mapea a su propio error de dominio (ver `fiado-api-invoker § 6`):
+ *   `404 RETAILER_NOT_FOUND` / `404 STORE_NOT_FOUND` / `404 RETAIL_USER_NOT_FOUND`
+ *   `400 UNKNOWN_TENANT` (tenantId ausente o desconocido)
+ *
+ * Env var requerida en el consumer: `RETAIL_ORG_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   RETAIL_ORG_BUSINESS_URL: '{{resolve:ssm:retail-org-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+export interface IRetailOrgBusinessApi {
+    /**
+     * GET /private/retailers/{retailerId} — valida que el retailer exista y devuelve su shape mínimo
+     * (id, name, type, status, parentId). `status` ya viene con la cascada aplicada (estado efectivo).
+     *
+     * @throws si el retailer no existe (`404 RETAILER_NOT_FOUND`).
+     */
+    getRetailer(retailerId: string, tenantId: string): Promise<StandardResponse<RetailerValidationDto>>;
+    /**
+     * GET /private/retailers/{retailerId}/stores/{storeId} — valida que la tienda exista Y pertenezca
+     * a ese retailer. El path es ANIDADO (no `/private/stores/{storeId}`): la tabla es
+     * pk `RETAILER#<id>` / sk `STORE#<storeId>`, así que el lookup anidado es un `get(pk, sk)` directo
+     * sobre la tabla base — cero GSI. Un path aplanado obligaría a un índice que el spec no define.
+     *
+     * `status` viene con la cascada del retailer padre ya aplicada.
+     *
+     * @throws si la tienda no existe o es de OTRO retailer (`404 STORE_NOT_FOUND` — verificado en dev).
+     */
+    getStore(retailerId: string, storeId: string, tenantId: string): Promise<StandardResponse<StoreValidationDto>>;
+    /**
+     * GET /private/retailers/{retailerId}/users/by-store/{storeId} — usuarios retail cuya tienda base
+     * (`homeStoreId`) es esa. Devuelve `[]` (no 404) si la tienda no tiene usuarios asignados.
+     */
+    getStoreUsers(retailerId: string, storeId: string, tenantId: string): Promise<StandardResponse<RetailUserValidationDto[]>>;
+    /**
+     * GET /private/users/by-cognito-sub/{cognitoSub} — resuelve el usuario retail por su identidad
+     * Cognito. Es el match de la frontera RBAC (F0, identidad) ↔ retail-org (F1, estructura):
+     * el `cognitoSub` es la llave entre ambos mundos (ver `DEC-SKF1-005`).
+     *
+     * @throws si no hay usuario retail para ese sub (`404 RETAIL_USER_NOT_FOUND`).
+     */
+    getUserByCognitoSub(cognitoSub: string, tenantId: string): Promise<StandardResponse<RetailUserValidationDto>>;
+}

package/bin/retailOrg/api/interfaces/IRetailOrgBusinessApi.js

@@ -0,0 +1 @@
+export {};

package/bin/retailOrg/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/IRetailOrgBusinessApi.js";
+export { default as RetailOrgBusinessApi } from "./api/RetailOrgBusinessApi.js";

package/bin/retailOrg/index.js

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/IRetailOrgBusinessApi.js";
+export { default as RetailOrgBusinessApi } from "./api/RetailOrgBusinessApi.js";

package/bin/synergypay-connector/api/SynergyPayConnectorApi.d.ts

@@ -0,0 +1,17 @@
+import { IHttpRequest } from "@fiado/http-client";
+import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { ConnectorCatalogResponse } from "@fiado/type-kit/bin/benefitCenter/index.js";
+import { CreateFundingReferenceRequest, CreateFundingReferenceResponse, ListFundingReferencesResponse, ApplyWalletFundingRequest, ApplyWalletFundingResponse } from "@fiado/type-kit/bin/walletFunding/index.js";
+import { ISynergyPayConnectorApi } from "./interfaces/ISynergyPayConnectorApi.js";
+export default class SynergyPayConnectorApi implements ISynergyPayConnectorApi {
+    private httpRequest;
+    private readonly baseUrl;
+    constructor(httpRequest: IHttpRequest);
+    createFundingReference(request: CreateFundingReferenceRequest): Promise<ApiGatewayResponse<CreateFundingReferenceResponse>>;
+    listFundingReferences(directoryId: string, status?: string): Promise<ApiGatewayResponse<ListFundingReferencesResponse>>;
+    getStandardCatalog(query: {
+        benefitId: string;
+        includeDisabled?: boolean;
+    }): Promise<ApiGatewayResponse<ConnectorCatalogResponse>>;
+    applyFunding(request: ApplyWalletFundingRequest): Promise<ApiGatewayResponse<ApplyWalletFundingResponse>>;
+}

package/bin/synergypay-connector/api/SynergyPayConnectorApi.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from "inversify";
+let SynergyPayConnectorApi = class SynergyPayConnectorApi {
+    httpRequest;
+    baseUrl = process.env.SYNERGYPAY_CONNECTOR_LAMBDA_URL || "";
+    constructor(httpRequest) {
+        this.httpRequest = httpRequest;
+    }
+    async createFundingReference(request) {
+        const url = `${this.baseUrl}/funding`;
+        return await this.httpRequest.post(url, request);
+    }
+    async listFundingReferences(directoryId, status) {
+        const params = new URLSearchParams({ directoryId });
+        if (status)
+            params.set("status", status);
+        const url = `${this.baseUrl}/funding/references?${params.toString()}`;
+        return await this.httpRequest.get(url);
+    }
+    async getStandardCatalog(query) {
+        const params = new URLSearchParams({ benefitId: query.benefitId });
+        if (query.includeDisabled)
+            params.set("includeDisabled", "true");
+        const url = `${this.baseUrl}/catalog/standard?${params.toString()}`;
+        return await this.httpRequest.get(url);
+    }
+    async applyFunding(request) {
+        const url = `${this.baseUrl}/funding/apply`;
+        return await this.httpRequest.post(url, request);
+    }
+};
+SynergyPayConnectorApi = __decorate([
+    injectable(),
+    __param(0, inject("IHttpRequest")),
+    __metadata("design:paramtypes", [Object])
+], SynergyPayConnectorApi);
+export default SynergyPayConnectorApi;

package/bin/synergypay-connector/api/interfaces/ISynergyPayConnectorApi.d.ts

@@ -0,0 +1,45 @@
+import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { ConnectorCatalogResponse } from "@fiado/type-kit/bin/benefitCenter/index.js";
+import { CreateFundingReferenceRequest, CreateFundingReferenceResponse, ListFundingReferencesResponse, ApplyWalletFundingRequest, ApplyWalletFundingResponse } from "@fiado/type-kit/bin/walletFunding/index.js";
+/**
+ * Cliente del marketplace hacia synergypay-connector (privado, dentro de la VPC).
+ *
+ * Segundo proveedor de Cash In (SinergyPay). Lo consume `SynergyPayFundingPublisher`
+ * + `SynergyPayCatalogPublisher` del benefits-marketplace-business. Mismo contrato
+ * provider-agnostic que `IEqualityConnectorApi` — el marketplace no sabe con qué
+ * proveedor habla.
+ *
+ * Endpoints backend en synergypay-connector (privado VPC):
+ *  - POST /funding
+ *  - GET  /funding/references?directoryId=&status=
+ *  - GET  /catalog/standard?benefitId=&includeDisabled=
+ *  - POST /funding/apply
+ *
+ * NOTA: los endpoints `/passport/*` del BackOffice (SPEC 1.3) NO están incluidos —
+ * el synergypay-connector aún no los expone (F6.1 construyó solo el money-path).
+ * Se agregan en F6.4 junto con `SynergyPayPassportBackofficePublisher`.
+ */
+export interface ISynergyPayConnectorApi {
+    /** Genera una referencia de fondeo en SinergyPay via el connector. */
+    createFundingReference(request: CreateFundingReferenceRequest): Promise<ApiGatewayResponse<CreateFundingReferenceResponse>>;
+    /**
+     * Lista las referencias del usuario, opcionalmente filtradas por status.
+     * Status default (cuando no se pasa) lo decide el connector.
+     */
+    listFundingReferences(directoryId: string, status?: string): Promise<ApiGatewayResponse<ListFundingReferencesResponse>>;
+    /**
+     * Devuelve el catalogo standard de productos de wallet-funding del connector.
+     * Patron canonico del Centro de Beneficios — el marketplace lo consume via
+     * `IConnectorCatalogPublisher.getStandardCatalog` (mismo flow que Equality).
+     */
+    getStandardCatalog(query: {
+        benefitId: string;
+        includeDisabled?: boolean;
+    }): Promise<ApiGatewayResponse<ConnectorCatalogResponse>>;
+    /**
+     * Aplica el resultado de la conciliación de un pago (POST /funding/apply).
+     * En SinergyPay el crédito se hace inline en el webhook firmado; este endpoint
+     * queda para el cierre SETTLED (conciliación bancaria) — mismo contrato canónico.
+     */
+    applyFunding(request: ApplyWalletFundingRequest): Promise<ApiGatewayResponse<ApplyWalletFundingResponse>>;
+}

package/bin/synergypay-connector/api/interfaces/ISynergyPayConnectorApi.js

@@ -0,0 +1 @@
+export {};

package/bin/synergypay-connector/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/ISynergyPayConnectorApi.js";
+export { default as SynergyPayConnectorApi } from "./api/SynergyPayConnectorApi.js";

package/bin/synergypay-connector/index.js

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/ISynergyPayConnectorApi.js";
+export { default as SynergyPayConnectorApi } from "./api/SynergyPayConnectorApi.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "4.60.0",
+  "version": "4.62.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "type": "module",
   "main": "bin/index.js",
@@ -34,7 +34,7 @@
     "@fiado/gateway-adapter": "^3.9.0",
     "@fiado/http-client": "^2.0.1",
     "@fiado/logger": "^1.1.3",
-    "@fiado/type-kit": "^3.177.0",
+    "@fiado/type-kit": "^3.189.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {

package/src/container.config.ts

@@ -165,6 +165,8 @@ import { IMessagesBusinessPublisher } from "./messages-business/queue/interfaces
 import { ITotpSecurityApi, TotpSecurityApi } from "./totp-security/index.js";
 // Equality connector — wallet-funding HTTP client (benefits-marketplace → equality-connector)
 import { IEqualityConnectorApi, EqualityConnectorApi } from "./equality-connector/index.js";
+// SynergyPay connector — wallet-funding HTTP client (benefits-marketplace → synergypay-connector)
+import { ISynergyPayConnectorApi, SynergyPayConnectorApi } from "./synergypay-connector/index.js";
 // Contacts business — fuente de verdad de correos verificados (F2 gate UNIR)
 import { IContactsBusinessApi, ContactsBusinessApi } from "./contacts-business/index.js";
 // Wallet funding settlement — TransactWriteItems atómico del money path cash-in (spec 15)
@@ -308,6 +310,8 @@ export const apiInvokerBindings = new ContainerModule(({ bind }) => {
 
     // Equality connector — wallet-funding (benefits-marketplace → equality-connector)
     bind<IEqualityConnectorApi>("IEqualityConnectorApi").to(EqualityConnectorApi);
+    // SynergyPay connector — wallet-funding (benefits-marketplace → synergypay-connector)
+    bind<ISynergyPayConnectorApi>("ISynergyPayConnectorApi").to(SynergyPayConnectorApi);
 
     // Contacts business — fuente de verdad de correos verificados (F2 gate UNIR)
     bind<IContactsBusinessApi>("IContactsBusinessApi").to(ContactsBusinessApi);

package/src/index.ts

@@ -76,9 +76,11 @@ export * from "./benefits-marketplace/index.js";
 export * from "./milestone-business/index.js";
 export * from "./cognitoBackofficeConnector/index.js";
 export * from "./platformRbac/index.js";
+export * from "./retailOrg/index.js";
 export * from "./messages-business/index.js";
 export * from "./totp-security/index.js";
 export * from "./equality-connector/index.js";
+export * from "./synergypay-connector/index.js";
 export * from "./contacts-business/index.js";
 export * from "./uniteller-connector/index.js";
 export * from "./walletFundingSettlement/index.js";

package/src/retailOrg/api/RetailOrgBusinessApi.ts

@@ -0,0 +1,64 @@
+import { inject, injectable } from "inversify";
+import type { IHttpRequest } from "@fiado/http-client";
+import { StandardResponse } from "@fiado/gateway-adapter";
+import {
+    RetailerValidationDto,
+    StoreValidationDto,
+    RetailUserValidationDto,
+} from "@fiado/type-kit/bin/retailOrg/index.js";
+import { IRetailOrgBusinessApi } from "./interfaces/IRetailOrgBusinessApi.js";
+
+/**
+ * Publisher HTTP del lambda `retail-org-business` (componente 04 SureKeep Fase 1) para sus 4
+ * endpoints privados de validación. Contrato y semántica completos → `IRetailOrgBusinessApi`.
+ *
+ * Los 4 paths y el `?tenantId=` fueron verificados contra dev (200 + negativos 400/404) el
+ * 2026-07-16 y matchean `openapi/private.yaml` del lambda destino.
+ *
+ * Env var requerida en el consumer: `RETAIL_ORG_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   RETAIL_ORG_BUSINESS_URL: '{{resolve:ssm:retail-org-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+@injectable()
+export default class RetailOrgBusinessApi implements IRetailOrgBusinessApi {
+    private readonly baseUrl = process.env.RETAIL_ORG_BUSINESS_URL || "";
+
+    constructor(@inject("IHttpRequest") private httpRequest: IHttpRequest) {}
+
+    async getRetailer(
+        retailerId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<RetailerValidationDto>> {
+        const url = `${this.baseUrl}/private/retailers/${encodeURIComponent(retailerId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+
+    async getStore(
+        retailerId: string,
+        storeId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<StoreValidationDto>> {
+        const url = `${this.baseUrl}/private/retailers/${encodeURIComponent(retailerId)}/stores/${encodeURIComponent(storeId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+
+    async getStoreUsers(
+        retailerId: string,
+        storeId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<RetailUserValidationDto[]>> {
+        const url = `${this.baseUrl}/private/retailers/${encodeURIComponent(retailerId)}/users/by-store/${encodeURIComponent(storeId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+
+    async getUserByCognitoSub(
+        cognitoSub: string,
+        tenantId: string,
+    ): Promise<StandardResponse<RetailUserValidationDto>> {
+        const url = `${this.baseUrl}/private/users/by-cognito-sub/${encodeURIComponent(cognitoSub)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+}

package/src/retailOrg/api/interfaces/IRetailOrgBusinessApi.ts

@@ -0,0 +1,100 @@
+import { StandardResponse } from "@fiado/gateway-adapter";
+import {
+    RetailerValidationDto,
+    StoreValidationDto,
+    RetailUserValidationDto,
+} from "@fiado/type-kit/bin/retailOrg/index.js";
+
+/**
+ * Contrato del publisher HTTP del lambda `retail-org-business` (componente 04 SureKeep Fase 1)
+ * para sus 4 endpoints privados de VALIDACIÓN (service-to-service, VPC-only).
+ *
+ * Consumidores previstos (regla R5 — cruces entre lambdas son SOLO lecturas de validación;
+ * ningún lambda escribe en tabla ajena):
+ *   - `retail-catalog-business` → valida `storeId` al registrar IMEIs
+ *   - `retail-cards-business`   → valida `storeId` de un lote de tarjetas PCF
+ *   - `loan-*`                  → valida retailer / store / usuarios retail
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * `tenantId` es OBLIGATORIO en los 4 métodos — no es un detalle de firma.
+ * ─────────────────────────────────────────────────────────────────────────────
+ * Los privados NO llevan token de usuario (`Feature.ANONIMUS`; la protección es la red VPC),
+ * así que el lambda destino no tiene `AuthContext.issuer` y NO puede inferir el silo. El caller
+ * declara el tenant explícito por query y `@fiado/tenant-context` asume el rol de ESE silo.
+ * Sin `tenantId` → `400 UNKNOWN_TENANT` (fail-closed, verificado en dev). Nunca hay default:
+ * caer a un tenant por default sería fail-OPEN y podría devolver datos de otra SOFOM.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * ⚠️ Patrón de retorno: `StandardResponse<T>` — el consumer accede `result.data`, NO `result.body`.
+ * ─────────────────────────────────────────────────────────────────────────────
+ * Los publishers viejos tipan `ApiGatewayResponse<T>` (`{ statusCode, body }`) y documentan
+ * `result.body.data`. Eso es FICCIÓN del tipo: `@fiado/http-client` hace `return response.data`
+ * (ver `AxiosHttpRequest`), o sea entrega el BODY PELADO — `.statusCode`/`.body` no existen en
+ * runtime y leerlos da `undefined`. Verificado en dev el 2026-07-16: costó un `500` (TypeError sobre
+ * `body.roleAssignments`) en `retail-org-business` al confiar en el tipo. `StandardResponse<T>`
+ * (`{ code, date, data, description?, msg? }`, ya exportado por `@fiado/gateway-adapter`) SÍ describe
+ * lo que llega. No se toca el tipo de los publishers viejos acá para no romperlos, pero los nuevos
+ * dicen la verdad.
+ *
+ * Errores: el lambda destino lanza `DomainError` tipado → el publisher RECHAZA (no devuelve null).
+ * Cada consumer mapea a su propio error de dominio (ver `fiado-api-invoker § 6`):
+ *   `404 RETAILER_NOT_FOUND` / `404 STORE_NOT_FOUND` / `404 RETAIL_USER_NOT_FOUND`
+ *   `400 UNKNOWN_TENANT` (tenantId ausente o desconocido)
+ *
+ * Env var requerida en el consumer: `RETAIL_ORG_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   RETAIL_ORG_BUSINESS_URL: '{{resolve:ssm:retail-org-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+export interface IRetailOrgBusinessApi {
+    /**
+     * GET /private/retailers/{retailerId} — valida que el retailer exista y devuelve su shape mínimo
+     * (id, name, type, status, parentId). `status` ya viene con la cascada aplicada (estado efectivo).
+     *
+     * @throws si el retailer no existe (`404 RETAILER_NOT_FOUND`).
+     */
+    getRetailer(
+        retailerId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<RetailerValidationDto>>;
+
+    /**
+     * GET /private/retailers/{retailerId}/stores/{storeId} — valida que la tienda exista Y pertenezca
+     * a ese retailer. El path es ANIDADO (no `/private/stores/{storeId}`): la tabla es
+     * pk `RETAILER#<id>` / sk `STORE#<storeId>`, así que el lookup anidado es un `get(pk, sk)` directo
+     * sobre la tabla base — cero GSI. Un path aplanado obligaría a un índice que el spec no define.
+     *
+     * `status` viene con la cascada del retailer padre ya aplicada.
+     *
+     * @throws si la tienda no existe o es de OTRO retailer (`404 STORE_NOT_FOUND` — verificado en dev).
+     */
+    getStore(
+        retailerId: string,
+        storeId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<StoreValidationDto>>;
+
+    /**
+     * GET /private/retailers/{retailerId}/users/by-store/{storeId} — usuarios retail cuya tienda base
+     * (`homeStoreId`) es esa. Devuelve `[]` (no 404) si la tienda no tiene usuarios asignados.
+     */
+    getStoreUsers(
+        retailerId: string,
+        storeId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<RetailUserValidationDto[]>>;
+
+    /**
+     * GET /private/users/by-cognito-sub/{cognitoSub} — resuelve el usuario retail por su identidad
+     * Cognito. Es el match de la frontera RBAC (F0, identidad) ↔ retail-org (F1, estructura):
+     * el `cognitoSub` es la llave entre ambos mundos (ver `DEC-SKF1-005`).
+     *
+     * @throws si no hay usuario retail para ese sub (`404 RETAIL_USER_NOT_FOUND`).
+     */
+    getUserByCognitoSub(
+        cognitoSub: string,
+        tenantId: string,
+    ): Promise<StandardResponse<RetailUserValidationDto>>;
+}

package/src/retailOrg/index.ts

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/IRetailOrgBusinessApi.js";
+export { default as RetailOrgBusinessApi } from "./api/RetailOrgBusinessApi.js";

package/src/synergypay-connector/api/SynergyPayConnectorApi.ts

@@ -0,0 +1,52 @@
+import { inject, injectable } from "inversify";
+import { IHttpRequest } from "@fiado/http-client";
+import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { ConnectorCatalogResponse } from "@fiado/type-kit/bin/benefitCenter/index.js";
+import {
+    CreateFundingReferenceRequest,
+    CreateFundingReferenceResponse,
+    ListFundingReferencesResponse,
+    ApplyWalletFundingRequest,
+    ApplyWalletFundingResponse,
+} from "@fiado/type-kit/bin/walletFunding/index.js";
+import { ISynergyPayConnectorApi } from "./interfaces/ISynergyPayConnectorApi.js";
+
+@injectable()
+export default class SynergyPayConnectorApi implements ISynergyPayConnectorApi {
+    private readonly baseUrl = process.env.SYNERGYPAY_CONNECTOR_LAMBDA_URL || "";
+
+    constructor(@inject("IHttpRequest") private httpRequest: IHttpRequest) {}
+
+    async createFundingReference(
+        request: CreateFundingReferenceRequest,
+    ): Promise<ApiGatewayResponse<CreateFundingReferenceResponse>> {
+        const url = `${this.baseUrl}/funding`;
+        return await this.httpRequest.post(url, request);
+    }
+
+    async listFundingReferences(
+        directoryId: string,
+        status?: string,
+    ): Promise<ApiGatewayResponse<ListFundingReferencesResponse>> {
+        const params = new URLSearchParams({ directoryId });
+        if (status) params.set("status", status);
+        const url = `${this.baseUrl}/funding/references?${params.toString()}`;
+        return await this.httpRequest.get(url);
+    }
+
+    async getStandardCatalog(
+        query: { benefitId: string; includeDisabled?: boolean },
+    ): Promise<ApiGatewayResponse<ConnectorCatalogResponse>> {
+        const params = new URLSearchParams({ benefitId: query.benefitId });
+        if (query.includeDisabled) params.set("includeDisabled", "true");
+        const url = `${this.baseUrl}/catalog/standard?${params.toString()}`;
+        return await this.httpRequest.get(url);
+    }
+
+    async applyFunding(
+        request: ApplyWalletFundingRequest,
+    ): Promise<ApiGatewayResponse<ApplyWalletFundingResponse>> {
+        const url = `${this.baseUrl}/funding/apply`;
+        return await this.httpRequest.post(url, request);
+    }
+}

package/src/synergypay-connector/api/interfaces/ISynergyPayConnectorApi.ts

@@ -0,0 +1,61 @@
+import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { ConnectorCatalogResponse } from "@fiado/type-kit/bin/benefitCenter/index.js";
+import {
+    CreateFundingReferenceRequest,
+    CreateFundingReferenceResponse,
+    ListFundingReferencesResponse,
+    ApplyWalletFundingRequest,
+    ApplyWalletFundingResponse,
+} from "@fiado/type-kit/bin/walletFunding/index.js";
+
+/**
+ * Cliente del marketplace hacia synergypay-connector (privado, dentro de la VPC).
+ *
+ * Segundo proveedor de Cash In (SinergyPay). Lo consume `SynergyPayFundingPublisher`
+ * + `SynergyPayCatalogPublisher` del benefits-marketplace-business. Mismo contrato
+ * provider-agnostic que `IEqualityConnectorApi` — el marketplace no sabe con qué
+ * proveedor habla.
+ *
+ * Endpoints backend en synergypay-connector (privado VPC):
+ *  - POST /funding
+ *  - GET  /funding/references?directoryId=&status=
+ *  - GET  /catalog/standard?benefitId=&includeDisabled=
+ *  - POST /funding/apply
+ *
+ * NOTA: los endpoints `/passport/*` del BackOffice (SPEC 1.3) NO están incluidos —
+ * el synergypay-connector aún no los expone (F6.1 construyó solo el money-path).
+ * Se agregan en F6.4 junto con `SynergyPayPassportBackofficePublisher`.
+ */
+export interface ISynergyPayConnectorApi {
+    /** Genera una referencia de fondeo en SinergyPay via el connector. */
+    createFundingReference(
+        request: CreateFundingReferenceRequest,
+    ): Promise<ApiGatewayResponse<CreateFundingReferenceResponse>>;
+
+    /**
+     * Lista las referencias del usuario, opcionalmente filtradas por status.
+     * Status default (cuando no se pasa) lo decide el connector.
+     */
+    listFundingReferences(
+        directoryId: string,
+        status?: string,
+    ): Promise<ApiGatewayResponse<ListFundingReferencesResponse>>;
+
+    /**
+     * Devuelve el catalogo standard de productos de wallet-funding del connector.
+     * Patron canonico del Centro de Beneficios — el marketplace lo consume via
+     * `IConnectorCatalogPublisher.getStandardCatalog` (mismo flow que Equality).
+     */
+    getStandardCatalog(
+        query: { benefitId: string; includeDisabled?: boolean },
+    ): Promise<ApiGatewayResponse<ConnectorCatalogResponse>>;
+
+    /**
+     * Aplica el resultado de la conciliación de un pago (POST /funding/apply).
+     * En SinergyPay el crédito se hace inline en el webhook firmado; este endpoint
+     * queda para el cierre SETTLED (conciliación bancaria) — mismo contrato canónico.
+     */
+    applyFunding(
+        request: ApplyWalletFundingRequest,
+    ): Promise<ApiGatewayResponse<ApplyWalletFundingResponse>>;
+}

package/src/synergypay-connector/index.ts

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/ISynergyPayConnectorApi.js";
+export { default as SynergyPayConnectorApi } from "./api/SynergyPayConnectorApi.js";