@fiado/api-invoker 4.65.0 → 4.67.0

package/bin/index.d.ts

@@ -78,6 +78,7 @@ export * from "./cognitoBackofficeConnector/index.js";
 export * from "./platformRbac/index.js";
 export * from "./retailOrg/index.js";
 export * from "./loanConfig/index.js";
+export * from "./loanOfferings/index.js";
 export * from "./messages-business/index.js";
 export * from "./totp-security/index.js";
 export * from "./equality-connector/index.js";

package/bin/index.js

@@ -78,6 +78,7 @@ export * from "./cognitoBackofficeConnector/index.js";
 export * from "./platformRbac/index.js";
 export * from "./retailOrg/index.js";
 export * from "./loanConfig/index.js";
+export * from "./loanOfferings/index.js";
 export * from "./messages-business/index.js";
 export * from "./totp-security/index.js";
 export * from "./equality-connector/index.js";

package/bin/loanOfferings/api/LoanOfferingsBusinessApi.d.ts

@@ -0,0 +1,25 @@
+import type { IHttpRequest } from "@fiado/http-client";
+import { StandardResponse } from "@fiado/gateway-adapter";
+import { CreditPlanResponse, FinancierResponse, SimulateCreditPlanRequest, SimulationResultResponse } from "@fiado/type-kit/bin/loanOfferings/index.js";
+import { ILoanOfferingsBusinessApi } from "./interfaces/ILoanOfferingsBusinessApi.js";
+/**
+ * Publisher HTTP del lambda `loan-offerings-business` (componente 07 SureKeep Fase 1) para sus 4
+ * endpoints privados de lectura del catálogo. Contrato y semántica completos →
+ * `ILoanOfferingsBusinessApi` (tenantId obligatorio, `StandardResponse` → leer `result.data`).
+ *
+ * Env var requerida en el consumer: `LOAN_OFFERINGS_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   LOAN_OFFERINGS_BUSINESS_URL: '{{resolve:ssm:loan-offerings-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+export default class LoanOfferingsBusinessApi implements ILoanOfferingsBusinessApi {
+    private httpRequest;
+    private readonly baseUrl;
+    constructor(httpRequest: IHttpRequest);
+    getCreditPlan(planId: string, tenantId: string): Promise<StandardResponse<CreditPlanResponse>>;
+    listActivePlansForRetailer(retailerId: string, tenantId: string): Promise<StandardResponse<CreditPlanResponse[]>>;
+    listActiveFinanciers(tenantId: string): Promise<StandardResponse<FinancierResponse[]>>;
+    simulate(planId: string, input: SimulateCreditPlanRequest, tenantId: string): Promise<StandardResponse<SimulationResultResponse>>;
+}

package/bin/loanOfferings/api/LoanOfferingsBusinessApi.js

@@ -0,0 +1,55 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from "inversify";
+/**
+ * Publisher HTTP del lambda `loan-offerings-business` (componente 07 SureKeep Fase 1) para sus 4
+ * endpoints privados de lectura del catálogo. Contrato y semántica completos →
+ * `ILoanOfferingsBusinessApi` (tenantId obligatorio, `StandardResponse` → leer `result.data`).
+ *
+ * Env var requerida en el consumer: `LOAN_OFFERINGS_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   LOAN_OFFERINGS_BUSINESS_URL: '{{resolve:ssm:loan-offerings-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+let LoanOfferingsBusinessApi = class LoanOfferingsBusinessApi {
+    httpRequest;
+    // El buildspec publica la URL en SSM con "/" final — se normaliza para no armar "//private".
+    baseUrl = (process.env.LOAN_OFFERINGS_BUSINESS_URL || "").replace(/\/+$/, "");
+    constructor(httpRequest) {
+        this.httpRequest = httpRequest;
+    }
+    async getCreditPlan(planId, tenantId) {
+        const url = `${this.baseUrl}/private/credit-plans/${encodeURIComponent(planId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+    async listActivePlansForRetailer(retailerId, tenantId) {
+        const url = `${this.baseUrl}/private/credit-plans/active-for-retailer/${encodeURIComponent(retailerId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+    async listActiveFinanciers(tenantId) {
+        const url = `${this.baseUrl}/private/financiers/active?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+    async simulate(planId, input, tenantId) {
+        const url = `${this.baseUrl}/private/credit-plans/${encodeURIComponent(planId)}/simulate?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.post(url, input);
+    }
+};
+LoanOfferingsBusinessApi = __decorate([
+    injectable(),
+    __param(0, inject("IHttpRequest")),
+    __metadata("design:paramtypes", [Object])
+], LoanOfferingsBusinessApi);
+export default LoanOfferingsBusinessApi;

package/bin/loanOfferings/api/interfaces/ILoanOfferingsBusinessApi.d.ts

@@ -0,0 +1,65 @@
+import { StandardResponse } from "@fiado/gateway-adapter";
+import { CreditPlanResponse, FinancierResponse, SimulateCreditPlanRequest, SimulationResultResponse } from "@fiado/type-kit/bin/loanOfferings/index.js";
+/**
+ * Contrato del publisher HTTP del lambda `loan-offerings-business` (componente 07 SureKeep Fase 1)
+ * para sus 4 endpoints privados de LECTURA del catálogo SOFOM (service-to-service, VPC-only).
+ *
+ * loan-offerings es el catálogo comercial del SOFOM: planes de crédito + financieras + la relación
+ * M:N retailer↔plan + el simulador de cuota. Consumidores previstos:
+ *   - wizard de originación (F2) → planes activos de un retailer · financieras activas
+ *   - motor de crédito (F3)      → leer un plan · simular la cuota (amortización + IVA + CAT)
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * `tenantId` es OBLIGATORIO en los 4 métodos — no es un detalle de firma.
+ * ─────────────────────────────────────────────────────────────────────────────
+ * Los privados NO llevan token de usuario (`Feature.ANONIMUS`; la protección es la red VPC), así que
+ * el lambda destino no tiene `AuthContext.issuer` y NO puede inferir el silo. El caller declara el
+ * tenant explícito por query y `@fiado/tenant-context` asume el rol de ESE silo. Sin `tenantId` →
+ * `400 UNKNOWN_TENANT` (fail-closed). Nunca hay default: caer a un tenant por default sería fail-OPEN
+ * y podría devolver el catálogo de otra SOFOM.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * ⚠️ Patrón de retorno: `StandardResponse<T>` — el consumer accede `result.data`, NO `result.body`.
+ * ─────────────────────────────────────────────────────────────────────────────
+ * `@fiado/http-client` devuelve el body pelado (`response.data` de axios); los publishers viejos que
+ * tipan `{ statusCode, body }` son ficción del tipo (ver `IRetailOrgBusinessApi`, donde está
+ * documentado el 500 que costó descubrirlo). Los publishers nuevos dicen la verdad.
+ *
+ * Errores: el lambda destino lanza `DomainError` tipado → el publisher RECHAZA (no devuelve null).
+ * Cada consumer mapea a su propio error de dominio (ver `fiado-api-invoker § 6`):
+ *   `404 CREDIT_PLAN_NOT_FOUND` (planId inexistente)
+ *   `400 UNKNOWN_TENANT` (tenantId ausente o desconocido)
+ *
+ * Env var requerida en el consumer: `LOAN_OFFERINGS_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   LOAN_OFFERINGS_BUSINESS_URL: '{{resolve:ssm:loan-offerings-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+export interface ILoanOfferingsBusinessApi {
+    /**
+     * GET /private/credit-plans/{planId} — lee un plan completo por id (para el motor de crédito).
+     *
+     * @throws si el plan no existe (`404 CREDIT_PLAN_NOT_FOUND`).
+     */
+    getCreditPlan(planId: string, tenantId: string): Promise<StandardResponse<CreditPlanResponse>>;
+    /**
+     * GET /private/credit-plans/active-for-retailer/{retailerId} — los planes ACTIVE que ese retailer
+     * puede ofrecer (para el wizard). Devuelve `[]` si el retailer no tiene planes activos (no 404).
+     */
+    listActivePlansForRetailer(retailerId: string, tenantId: string): Promise<StandardResponse<CreditPlanResponse[]>>;
+    /**
+     * GET /private/financiers/active — las financieras ACTIVE ordenadas por `displayOrder` (paso 4 del
+     * wizard). Devuelve `[]` si no hay financieras activas.
+     */
+    listActiveFinanciers(tenantId: string): Promise<StandardResponse<FinancierResponse[]>>;
+    /**
+     * POST /private/credit-plans/{planId}/simulate — calcula la tabla de amortización (cuota semanal +
+     * IVA 16% + CAT) para un precio/enganche/plazo dados. Misma lógica que el simulador público.
+     *
+     * @throws si el plan no existe (`404 CREDIT_PLAN_NOT_FOUND`) o el input viola el plan
+     *         (`400 INVALID_PLAN_PARAMETERS`, ej. plazo fuera de `termWeeksOptions`).
+     */
+    simulate(planId: string, input: SimulateCreditPlanRequest, tenantId: string): Promise<StandardResponse<SimulationResultResponse>>;
+}

package/bin/loanOfferings/api/interfaces/ILoanOfferingsBusinessApi.js

@@ -0,0 +1 @@
+export {};

package/bin/loanOfferings/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/ILoanOfferingsBusinessApi.js";
+export { default as LoanOfferingsBusinessApi } from "./api/LoanOfferingsBusinessApi.js";

package/bin/loanOfferings/index.js

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/ILoanOfferingsBusinessApi.js";
+export { default as LoanOfferingsBusinessApi } from "./api/LoanOfferingsBusinessApi.js";

package/bin/platformRbac/api/PlatformRbacBusinessApi.d.ts

@@ -1,6 +1,6 @@
 import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse, PermissionScope, CreateLevelEntityRequest, CreateLevelEntityResponse, CreateTenantUserRequest, CreateTenantUserResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.js";
 /**
  * Publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
@@ -26,4 +26,6 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
     effectivePermissions(cognitoSub: string, tenantId?: string): Promise<ApiGatewayResponse<EffectivePermissionsResponse>>;
     getInjectableUserAttributes(cognitoSub: string, tenantId: string): Promise<ApiGatewayResponse<InjectableUserAttributesResponse>>;
     resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
+    createLevelEntity(tenantId: string, level: PermissionScope, input: CreateLevelEntityRequest): Promise<ApiGatewayResponse<CreateLevelEntityResponse>>;
+    createTenantUser(tenantId: string, input: CreateTenantUserRequest): Promise<ApiGatewayResponse<CreateTenantUserResponse>>;
 }

package/bin/platformRbac/api/PlatformRbacBusinessApi.js

@@ -68,6 +68,14 @@ let PlatformRbacBusinessApi = class PlatformRbacBusinessApi {
         const url = `${this.baseUrl}/internal/permissions/resolve`;
         return await this.httpRequest.post(url, input);
     }
+    async createLevelEntity(tenantId, level, input) {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/levels/${encodeURIComponent(level)}/entities`;
+        return await this.httpRequest.post(url, input);
+    }
+    async createTenantUser(tenantId, input) {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/users`;
+        return await this.httpRequest.post(url, input);
+    }
 };
 PlatformRbacBusinessApi = __decorate([
     injectable(),

package/bin/platformRbac/api/interfaces/IPlatformRbacBusinessApi.d.ts

@@ -1,5 +1,5 @@
 import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse, PermissionScope, CreateLevelEntityRequest, CreateLevelEntityResponse, CreateTenantUserRequest, CreateTenantUserResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
 /**
  * Contrato del publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
  * para los 3 endpoints internos del Custom Auth Challenge flow (MFA).
@@ -63,4 +63,16 @@ export interface IPlatformRbacBusinessApi {
     getInjectableUserAttributes(cognitoSub: string, tenantId: string): Promise<ApiGatewayResponse<InjectableUserAttributesResponse>>;
     /** POST /internal/permissions/resolve — resuelve permisos scope-bound (set completo, paginación interna) para el RBAC enforcement del gateway-adapter. DEC-RBAC-064. */
     resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
+    /**
+     * POST /internal/tenants/{tenantId}/levels/{level}/entities — crea una scope-entity genérica
+     * L1/L2/L3 en RBAC (endpoint privado, VPC/ANONIMUS). Espejo de jerarquía de SureKeep F1
+     * (retailer→L1, zona→L2, tienda→L3). BYOID + idempotente. `level` (LEVEL_1|2|3) va en el path.
+     */
+    createLevelEntity(tenantId: string, level: PermissionScope, input: CreateLevelEntityRequest): Promise<ApiGatewayResponse<CreateLevelEntityResponse>>;
+    /**
+     * POST /internal/tenants/{tenantId}/users — provisiona un usuario del tenant (Cognito + SharedUser +
+     * RoleAssignment) en RBAC (endpoint privado, VPC/ANONIMUS). Alta orquestada de SureKeep F1: el usuario
+     * queda INVITED (mitiga orphan) y retail-org guarda el `cognitoSub` retornado. Idempotente por identidad Cognito.
+     */
+    createTenantUser(tenantId: string, input: CreateTenantUserRequest): Promise<ApiGatewayResponse<CreateTenantUserResponse>>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "4.65.0",
+  "version": "4.67.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "type": "module",
   "main": "bin/index.js",
@@ -34,7 +34,7 @@
     "@fiado/gateway-adapter": "^3.9.0",
     "@fiado/http-client": "^2.0.1",
     "@fiado/logger": "^1.1.3",
-    "@fiado/type-kit": "^3.191.0",
+    "@fiado/type-kit": "^3.193.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {

package/src/index.ts

@@ -78,6 +78,7 @@ export * from "./cognitoBackofficeConnector/index.js";
 export * from "./platformRbac/index.js";
 export * from "./retailOrg/index.js";
 export * from "./loanConfig/index.js";
+export * from "./loanOfferings/index.js";
 export * from "./messages-business/index.js";
 export * from "./totp-security/index.js";
 export * from "./equality-connector/index.js";

package/src/loanOfferings/api/LoanOfferingsBusinessApi.ts

@@ -0,0 +1,62 @@
+import { inject, injectable } from "inversify";
+import type { IHttpRequest } from "@fiado/http-client";
+import { StandardResponse } from "@fiado/gateway-adapter";
+import {
+    CreditPlanResponse,
+    FinancierResponse,
+    SimulateCreditPlanRequest,
+    SimulationResultResponse,
+} from "@fiado/type-kit/bin/loanOfferings/index.js";
+import { ILoanOfferingsBusinessApi } from "./interfaces/ILoanOfferingsBusinessApi.js";
+
+/**
+ * Publisher HTTP del lambda `loan-offerings-business` (componente 07 SureKeep Fase 1) para sus 4
+ * endpoints privados de lectura del catálogo. Contrato y semántica completos →
+ * `ILoanOfferingsBusinessApi` (tenantId obligatorio, `StandardResponse` → leer `result.data`).
+ *
+ * Env var requerida en el consumer: `LOAN_OFFERINGS_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   LOAN_OFFERINGS_BUSINESS_URL: '{{resolve:ssm:loan-offerings-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+@injectable()
+export default class LoanOfferingsBusinessApi implements ILoanOfferingsBusinessApi {
+    // El buildspec publica la URL en SSM con "/" final — se normaliza para no armar "//private".
+    private readonly baseUrl = (process.env.LOAN_OFFERINGS_BUSINESS_URL || "").replace(/\/+$/, "");
+
+    constructor(@inject("IHttpRequest") private httpRequest: IHttpRequest) {}
+
+    async getCreditPlan(
+        planId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<CreditPlanResponse>> {
+        const url = `${this.baseUrl}/private/credit-plans/${encodeURIComponent(planId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+
+    async listActivePlansForRetailer(
+        retailerId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<CreditPlanResponse[]>> {
+        const url = `${this.baseUrl}/private/credit-plans/active-for-retailer/${encodeURIComponent(retailerId)}?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+
+    async listActiveFinanciers(
+        tenantId: string,
+    ): Promise<StandardResponse<FinancierResponse[]>> {
+        const url = `${this.baseUrl}/private/financiers/active?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.get(url);
+    }
+
+    async simulate(
+        planId: string,
+        input: SimulateCreditPlanRequest,
+        tenantId: string,
+    ): Promise<StandardResponse<SimulationResultResponse>> {
+        const url = `${this.baseUrl}/private/credit-plans/${encodeURIComponent(planId)}/simulate?tenantId=${encodeURIComponent(tenantId)}`;
+        return await this.httpRequest.post(url, input);
+    }
+}

package/src/loanOfferings/api/interfaces/ILoanOfferingsBusinessApi.ts

@@ -0,0 +1,86 @@
+import { StandardResponse } from "@fiado/gateway-adapter";
+import {
+    CreditPlanResponse,
+    FinancierResponse,
+    SimulateCreditPlanRequest,
+    SimulationResultResponse,
+} from "@fiado/type-kit/bin/loanOfferings/index.js";
+
+/**
+ * Contrato del publisher HTTP del lambda `loan-offerings-business` (componente 07 SureKeep Fase 1)
+ * para sus 4 endpoints privados de LECTURA del catálogo SOFOM (service-to-service, VPC-only).
+ *
+ * loan-offerings es el catálogo comercial del SOFOM: planes de crédito + financieras + la relación
+ * M:N retailer↔plan + el simulador de cuota. Consumidores previstos:
+ *   - wizard de originación (F2) → planes activos de un retailer · financieras activas
+ *   - motor de crédito (F3)      → leer un plan · simular la cuota (amortización + IVA + CAT)
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * `tenantId` es OBLIGATORIO en los 4 métodos — no es un detalle de firma.
+ * ─────────────────────────────────────────────────────────────────────────────
+ * Los privados NO llevan token de usuario (`Feature.ANONIMUS`; la protección es la red VPC), así que
+ * el lambda destino no tiene `AuthContext.issuer` y NO puede inferir el silo. El caller declara el
+ * tenant explícito por query y `@fiado/tenant-context` asume el rol de ESE silo. Sin `tenantId` →
+ * `400 UNKNOWN_TENANT` (fail-closed). Nunca hay default: caer a un tenant por default sería fail-OPEN
+ * y podría devolver el catálogo de otra SOFOM.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * ⚠️ Patrón de retorno: `StandardResponse<T>` — el consumer accede `result.data`, NO `result.body`.
+ * ─────────────────────────────────────────────────────────────────────────────
+ * `@fiado/http-client` devuelve el body pelado (`response.data` de axios); los publishers viejos que
+ * tipan `{ statusCode, body }` son ficción del tipo (ver `IRetailOrgBusinessApi`, donde está
+ * documentado el 500 que costó descubrirlo). Los publishers nuevos dicen la verdad.
+ *
+ * Errores: el lambda destino lanza `DomainError` tipado → el publisher RECHAZA (no devuelve null).
+ * Cada consumer mapea a su propio error de dominio (ver `fiado-api-invoker § 6`):
+ *   `404 CREDIT_PLAN_NOT_FOUND` (planId inexistente)
+ *   `400 UNKNOWN_TENANT` (tenantId ausente o desconocido)
+ *
+ * Env var requerida en el consumer: `LOAN_OFFERINGS_BUSINESS_URL`.
+ * El template.yml del consumer la setea con:
+ *
+ *   LOAN_OFFERINGS_BUSINESS_URL: '{{resolve:ssm:loan-offerings-business}}'
+ *
+ * Convención CLAUDE.md global: SSM key = nombre del lambda owner de la URL.
+ */
+export interface ILoanOfferingsBusinessApi {
+    /**
+     * GET /private/credit-plans/{planId} — lee un plan completo por id (para el motor de crédito).
+     *
+     * @throws si el plan no existe (`404 CREDIT_PLAN_NOT_FOUND`).
+     */
+    getCreditPlan(
+        planId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<CreditPlanResponse>>;
+
+    /**
+     * GET /private/credit-plans/active-for-retailer/{retailerId} — los planes ACTIVE que ese retailer
+     * puede ofrecer (para el wizard). Devuelve `[]` si el retailer no tiene planes activos (no 404).
+     */
+    listActivePlansForRetailer(
+        retailerId: string,
+        tenantId: string,
+    ): Promise<StandardResponse<CreditPlanResponse[]>>;
+
+    /**
+     * GET /private/financiers/active — las financieras ACTIVE ordenadas por `displayOrder` (paso 4 del
+     * wizard). Devuelve `[]` si no hay financieras activas.
+     */
+    listActiveFinanciers(
+        tenantId: string,
+    ): Promise<StandardResponse<FinancierResponse[]>>;
+
+    /**
+     * POST /private/credit-plans/{planId}/simulate — calcula la tabla de amortización (cuota semanal +
+     * IVA 16% + CAT) para un precio/enganche/plazo dados. Misma lógica que el simulador público.
+     *
+     * @throws si el plan no existe (`404 CREDIT_PLAN_NOT_FOUND`) o el input viola el plan
+     *         (`400 INVALID_PLAN_PARAMETERS`, ej. plazo fuera de `termWeeksOptions`).
+     */
+    simulate(
+        planId: string,
+        input: SimulateCreditPlanRequest,
+        tenantId: string,
+    ): Promise<StandardResponse<SimulationResultResponse>>;
+}

package/src/loanOfferings/index.ts

@@ -0,0 +1,2 @@
+export * from "./api/interfaces/ILoanOfferingsBusinessApi.js";
+export { default as LoanOfferingsBusinessApi } from "./api/LoanOfferingsBusinessApi.js";

package/src/platformRbac/api/PlatformRbacBusinessApi.ts

@@ -13,6 +13,11 @@ import {
     AuthorizeResponse,
     EffectivePermissionsResponse,
     InjectableUserAttributesResponse,
+    PermissionScope,
+    CreateLevelEntityRequest,
+    CreateLevelEntityResponse,
+    CreateTenantUserRequest,
+    CreateTenantUserResponse,
 } from "@fiado/type-kit/bin/platformRbac/index.js";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.js";
 
@@ -95,4 +100,21 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
         const url = `${this.baseUrl}/internal/permissions/resolve`;
         return await this.httpRequest.post(url, input);
     }
+
+    async createLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        input: CreateLevelEntityRequest,
+    ): Promise<ApiGatewayResponse<CreateLevelEntityResponse>> {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/levels/${encodeURIComponent(level)}/entities`;
+        return await this.httpRequest.post(url, input);
+    }
+
+    async createTenantUser(
+        tenantId: string,
+        input: CreateTenantUserRequest,
+    ): Promise<ApiGatewayResponse<CreateTenantUserResponse>> {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/users`;
+        return await this.httpRequest.post(url, input);
+    }
 }

package/src/platformRbac/api/interfaces/IPlatformRbacBusinessApi.ts

@@ -10,6 +10,11 @@ import {
     AuthorizeResponse,
     EffectivePermissionsResponse,
     InjectableUserAttributesResponse,
+    PermissionScope,
+    CreateLevelEntityRequest,
+    CreateLevelEntityResponse,
+    CreateTenantUserRequest,
+    CreateTenantUserResponse,
 } from "@fiado/type-kit/bin/platformRbac/index.js";
 
 /**
@@ -95,4 +100,25 @@ export interface IPlatformRbacBusinessApi {
 
     /** POST /internal/permissions/resolve — resuelve permisos scope-bound (set completo, paginación interna) para el RBAC enforcement del gateway-adapter. DEC-RBAC-064. */
     resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
+
+    /**
+     * POST /internal/tenants/{tenantId}/levels/{level}/entities — crea una scope-entity genérica
+     * L1/L2/L3 en RBAC (endpoint privado, VPC/ANONIMUS). Espejo de jerarquía de SureKeep F1
+     * (retailer→L1, zona→L2, tienda→L3). BYOID + idempotente. `level` (LEVEL_1|2|3) va en el path.
+     */
+    createLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        input: CreateLevelEntityRequest,
+    ): Promise<ApiGatewayResponse<CreateLevelEntityResponse>>;
+
+    /**
+     * POST /internal/tenants/{tenantId}/users — provisiona un usuario del tenant (Cognito + SharedUser +
+     * RoleAssignment) en RBAC (endpoint privado, VPC/ANONIMUS). Alta orquestada de SureKeep F1: el usuario
+     * queda INVITED (mitiga orphan) y retail-org guarda el `cognitoSub` retornado. Idempotente por identidad Cognito.
+     */
+    createTenantUser(
+        tenantId: string,
+        input: CreateTenantUserRequest,
+    ): Promise<ApiGatewayResponse<CreateTenantUserResponse>>;
 }