@fiado/api-invoker 5.85.0 → 5.87.0

package/bin/benefits-marketplace/api/BenefitsMarketplaceApi.d.ts

@@ -2,6 +2,7 @@ import { IBenefitsMarketplaceApi } from "./interfaces/IBenefitsMarketplaceApi.js
 import { IHttpRequest } from "@fiado/http-client";
 import { BenefitPaymentRequest, BenefitPaymentResponse } from "@fiado/type-kit/bin/benefitCenter/index.js";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { RemittanceOnboardingPrefillRequest, RemittanceOnboardingPrefillResponse } from "@fiado/type-kit/bin/remittance/index.js";
 import { BenefitLeafDisplayResponse } from "./dtos/BenefitLeafDisplayResponse.js";
 import { CreateFundingReferenceRequest, CreateFundingReferenceResponse, ListFundingReferencesResponse } from "@fiado/type-kit/bin/walletFunding/index.js";
 export default class BenefitsMarketplaceApi implements IBenefitsMarketplaceApi {
@@ -13,4 +14,5 @@ export default class BenefitsMarketplaceApi implements IBenefitsMarketplaceApi {
     getLeafDisplay(benefitId: string, leafId: string): Promise<ApiGatewayResponse<BenefitLeafDisplayResponse>>;
     fundingCreate(moduleName: string, request: CreateFundingReferenceRequest): Promise<ApiGatewayResponse<CreateFundingReferenceResponse>>;
     fundingList(moduleName: string, directoryId: string, status?: string): Promise<ApiGatewayResponse<ListFundingReferencesResponse>>;
+    remittanceOnboardingPrefill(request: RemittanceOnboardingPrefillRequest): Promise<ApiGatewayResponse<RemittanceOnboardingPrefillResponse>>;
 }

package/bin/benefits-marketplace/api/BenefitsMarketplaceApi.js

@@ -40,6 +40,10 @@ let BenefitsMarketplaceApi = class BenefitsMarketplaceApi {
         const url = `${this.baseUrl}/funding/${encodeURIComponent(moduleName)}/references?${params.toString()}`;
         return await this.httpRequest.get(url);
     }
+    async remittanceOnboardingPrefill(request) {
+        const url = `${this.baseUrl}/remittance/onboarding/prefill`;
+        return await this.httpRequest.post(url, request);
+    }
 };
 BenefitsMarketplaceApi = __decorate([
     injectable(),

package/bin/benefits-marketplace/api/interfaces/IBenefitsMarketplaceApi.d.ts

@@ -1,5 +1,6 @@
 import { BenefitPaymentRequest, BenefitPaymentResponse } from "@fiado/type-kit/bin/benefitCenter/index.js";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import { RemittanceOnboardingPrefillRequest, RemittanceOnboardingPrefillResponse } from "@fiado/type-kit/bin/remittance/index.js";
 import { BenefitLeafDisplayResponse } from "../dtos/BenefitLeafDisplayResponse.js";
 import { CreateFundingReferenceRequest, CreateFundingReferenceResponse, ListFundingReferencesResponse } from "@fiado/type-kit/bin/walletFunding/index.js";
 /**
@@ -71,4 +72,11 @@ export interface IBenefitsMarketplaceApi {
      * Backend: GET /funding/{moduleName}/references?directoryId=&status=
      */
     fundingList(moduleName: string, directoryId: string, status?: string): Promise<ApiGatewayResponse<ListFundingReferencesResponse>>;
+    /**
+     * Composición del onboarding de remesas de un usuario SIN ejecutarla: lo que la app
+     * mandaría hoy (datos de Fiado) o el motivo de bloqueo + direcciones candidatas.
+     * Backend: POST /remittance/onboarding/prefill (privado VPC). Lo consume remittance-business
+     * para el reintento de registro desde el backoffice.
+     */
+    remittanceOnboardingPrefill(request: RemittanceOnboardingPrefillRequest): Promise<ApiGatewayResponse<RemittanceOnboardingPrefillResponse>>;
 }

package/bin/platformRbac/api/PlatformRbacBusinessApi.d.ts

@@ -1,6 +1,6 @@
 import type { IHttpRequest } from "@fiado/http-client";
-import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse, PermissionScope, CreateLevelEntityRequest, CreateLevelEntityResponse, CreateTenantUserRequest, CreateTenantUserResponse, UserProfileResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
+import { APIGatewayProxyResultBody, ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse, PermissionScope, CreateLevelEntityRequest, CreateLevelEntityResponse, CreateTenantUserRequest, CreateTenantUserResponse, UserProfileResponse, ListLevelEntitiesResponse, LevelEntityResponse, UpdateLevelEntityRequest, DeleteLevelEntityRequest, DeleteLevelEntityResponse, ListTenantUsersResponse, GetTenantUserResponse, TenantUserResponse, TenantUserAckResponse, UpdateTenantUserRequest, DeleteTenantUserRequest, DisableTenantUserRequest, EnableTenantUserRequest, ResetTenantUserPasswordRequest, ResetTenantUserPasswordResponse, ResetTenantUserMfaRequest, ListTenantRolesResponse, AssignTenantRoleRequest, AssignTenantRoleResponse, RevokeTenantRoleRequest, RevokeTenantRoleResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.js";
 /**
  * Publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
@@ -29,4 +29,51 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
     createLevelEntity(tenantId: string, level: PermissionScope, input: CreateLevelEntityRequest): Promise<ApiGatewayResponse<CreateLevelEntityResponse>>;
     createTenantUser(tenantId: string, input: CreateTenantUserRequest): Promise<ApiGatewayResponse<CreateTenantUserResponse>>;
     getUserProfile(cognitoSub: string, tenantId: string): Promise<ApiGatewayResponse<UserProfileResponse>>;
+    /** Ruta base de los grupos (entidades de nivel) de un tenant. */
+    private _levelEntitiesUrl;
+    /** Ruta base de los usuarios de un tenant. */
+    private _tenantUsersUrl;
+    private _deleteWithBody;
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities — lista los grupos de un nivel; `parentId` filtra por los hijos de un grupo. */
+    listLevelEntities(tenantId: string, level: PermissionScope, parentId?: string): Promise<APIGatewayProxyResultBody<ListLevelEntitiesResponse>>;
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities/{id} — detalle de un grupo. */
+    getLevelEntity(tenantId: string, level: PermissionScope, id: string): Promise<APIGatewayProxyResultBody<LevelEntityResponse>>;
+    /** PUT /internal/tenants/{tenantId}/levels/{level}/entities/{id} — renombra un grupo. */
+    updateLevelEntity(tenantId: string, level: PermissionScope, id: string, input: UpdateLevelEntityRequest): Promise<APIGatewayProxyResultBody<LevelEntityResponse>>;
+    /** DELETE /internal/tenants/{tenantId}/levels/{level}/entities/{id} — borra un grupo. El `actedBy` viaja en el cuerpo. */
+    deleteLevelEntity(tenantId: string, level: PermissionScope, id: string, input: DeleteLevelEntityRequest): Promise<APIGatewayProxyResultBody<DeleteLevelEntityResponse>>;
+    /**
+     * GET /internal/tenants/{tenantId}/users — lista los usuarios del tenant.
+     * El filtro `email` es lo que permite adoptar una cuenta que ya existía.
+     */
+    listTenantUsers(tenantId: string, email?: string): Promise<APIGatewayProxyResultBody<ListTenantUsersResponse>>;
+    /**
+     * GET /internal/tenants/{tenantId}/users/{cognitoSub} — detalle de un usuario.
+     * De aquí sale el `assignmentId` que hace falta para revocar un rol.
+     */
+    getTenantUser(tenantId: string, cognitoSub: string): Promise<APIGatewayProxyResultBody<GetTenantUserResponse>>;
+    /** PUT /internal/tenants/{tenantId}/users/{cognitoSub} — renombra a un usuario. */
+    updateTenantUser(tenantId: string, cognitoSub: string, input: UpdateTenantUserRequest): Promise<APIGatewayProxyResultBody<TenantUserResponse>>;
+    /** DELETE /internal/tenants/{tenantId}/users/{cognitoSub} — borra a un usuario. El `actedBy` viaja en el cuerpo. */
+    deleteTenantUser(tenantId: string, cognitoSub: string, input: DeleteTenantUserRequest): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/disable — suspende a un usuario. */
+    disableTenantUser(tenantId: string, cognitoSub: string, input: DisableTenantUserRequest): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/enable — reactiva a un usuario suspendido. */
+    enableTenantUser(tenantId: string, cognitoSub: string, input: EnableTenantUserRequest): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+    /**
+     * POST /internal/tenants/{tenantId}/users/{cognitoSub}/password-reset — resetea la contraseña.
+     * Devuelve la contraseña temporal en claro; no se manda correo.
+     */
+    resetTenantUserPassword(tenantId: string, cognitoSub: string, input: ResetTenantUserPasswordRequest): Promise<APIGatewayProxyResultBody<ResetTenantUserPasswordResponse>>;
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/mfa-reset — resetea el MFA de un usuario. */
+    resetTenantUserMfa(tenantId: string, cognitoSub: string, input: ResetTenantUserMfaRequest): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+    /** GET /internal/tenants/{tenantId}/roles — catálogo de roles del tenant, para armar el selector de asignación. */
+    listTenantRoles(tenantId: string): Promise<APIGatewayProxyResultBody<ListTenantRolesResponse>>;
+    /** POST /internal/tenants/{tenantId}/role-assignments — asigna un rol a un usuario en un scope. */
+    assignTenantRole(tenantId: string, input: AssignTenantRoleRequest): Promise<APIGatewayProxyResultBody<AssignTenantRoleResponse>>;
+    /**
+     * POST /internal/tenants/{tenantId}/role-assignments/{assignmentId}/revoke — revoca una asignación.
+     * El `cognitoSub` va en el cuerpo porque es parte de la llave de la tabla de asignaciones.
+     */
+    revokeTenantRole(tenantId: string, assignmentId: string, input: RevokeTenantRoleRequest): Promise<APIGatewayProxyResultBody<RevokeTenantRoleResponse>>;
 }

package/bin/platformRbac/api/PlatformRbacBusinessApi.js

@@ -80,6 +80,111 @@ let PlatformRbacBusinessApi = class PlatformRbacBusinessApi {
         const url = `${this.baseUrl}/internal/users/${encodeURIComponent(cognitoSub)}/profile?tenantId=${encodeURIComponent(tenantId)}`;
         return await this.httpRequest.get(url);
     }
+    // ── Administración de RBAC para el hub de agentes (grupos, usuarios y roles) ──
+    // Tipados `APIGatewayProxyResultBody<T>`, el shape REAL que devuelve @fiado/http-client:
+    // el body HTTP crudo `{ code, date, msg, data }`, con el payload en `.data` (TD-AI-003).
+    /** Ruta base de los grupos (entidades de nivel) de un tenant. */
+    _levelEntitiesUrl(tenantId, level) {
+        return `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/levels/${encodeURIComponent(level)}/entities`;
+    }
+    /** Ruta base de los usuarios de un tenant. */
+    _tenantUsersUrl(tenantId) {
+        return `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/users`;
+    }
+    // `IHttpRequest.delete` manda su segundo argumento como QUERY STRING, no como cuerpo: el cuerpo
+    // solo llega por `extraConfig` ({ data }). `actedBy` va ahí para no quedar en los logs de API Gateway.
+    async _deleteWithBody(url, body) {
+        return await this.httpRequest.delete(url, undefined, undefined, undefined, undefined, { data: body });
+    }
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities — lista los grupos de un nivel; `parentId` filtra por los hijos de un grupo. */
+    async listLevelEntities(tenantId, level, parentId) {
+        const base = this._levelEntitiesUrl(tenantId, level);
+        const url = parentId ? `${base}?parentId=${encodeURIComponent(parentId)}` : base;
+        return await this.httpRequest.get(url);
+    }
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities/{id} — detalle de un grupo. */
+    async getLevelEntity(tenantId, level, id) {
+        const url = `${this._levelEntitiesUrl(tenantId, level)}/${encodeURIComponent(id)}`;
+        return await this.httpRequest.get(url);
+    }
+    /** PUT /internal/tenants/{tenantId}/levels/{level}/entities/{id} — renombra un grupo. */
+    async updateLevelEntity(tenantId, level, id, input) {
+        const url = `${this._levelEntitiesUrl(tenantId, level)}/${encodeURIComponent(id)}`;
+        return await this.httpRequest.put(url, input);
+    }
+    /** DELETE /internal/tenants/{tenantId}/levels/{level}/entities/{id} — borra un grupo. El `actedBy` viaja en el cuerpo. */
+    async deleteLevelEntity(tenantId, level, id, input) {
+        const url = `${this._levelEntitiesUrl(tenantId, level)}/${encodeURIComponent(id)}`;
+        return await this._deleteWithBody(url, input);
+    }
+    /**
+     * GET /internal/tenants/{tenantId}/users — lista los usuarios del tenant.
+     * El filtro `email` es lo que permite adoptar una cuenta que ya existía.
+     */
+    async listTenantUsers(tenantId, email) {
+        const base = this._tenantUsersUrl(tenantId);
+        const url = email ? `${base}?email=${encodeURIComponent(email)}` : base;
+        return await this.httpRequest.get(url);
+    }
+    /**
+     * GET /internal/tenants/{tenantId}/users/{cognitoSub} — detalle de un usuario.
+     * De aquí sale el `assignmentId` que hace falta para revocar un rol.
+     */
+    async getTenantUser(tenantId, cognitoSub) {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}`;
+        return await this.httpRequest.get(url);
+    }
+    /** PUT /internal/tenants/{tenantId}/users/{cognitoSub} — renombra a un usuario. */
+    async updateTenantUser(tenantId, cognitoSub, input) {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}`;
+        return await this.httpRequest.put(url, input);
+    }
+    /** DELETE /internal/tenants/{tenantId}/users/{cognitoSub} — borra a un usuario. El `actedBy` viaja en el cuerpo. */
+    async deleteTenantUser(tenantId, cognitoSub, input) {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}`;
+        return await this._deleteWithBody(url, input);
+    }
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/disable — suspende a un usuario. */
+    async disableTenantUser(tenantId, cognitoSub, input) {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}/disable`;
+        return await this.httpRequest.post(url, input);
+    }
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/enable — reactiva a un usuario suspendido. */
+    async enableTenantUser(tenantId, cognitoSub, input) {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}/enable`;
+        return await this.httpRequest.post(url, input);
+    }
+    /**
+     * POST /internal/tenants/{tenantId}/users/{cognitoSub}/password-reset — resetea la contraseña.
+     * Devuelve la contraseña temporal en claro; no se manda correo.
+     */
+    async resetTenantUserPassword(tenantId, cognitoSub, input) {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}/password-reset`;
+        return await this.httpRequest.post(url, input);
+    }
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/mfa-reset — resetea el MFA de un usuario. */
+    async resetTenantUserMfa(tenantId, cognitoSub, input) {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}/mfa-reset`;
+        return await this.httpRequest.post(url, input);
+    }
+    /** GET /internal/tenants/{tenantId}/roles — catálogo de roles del tenant, para armar el selector de asignación. */
+    async listTenantRoles(tenantId) {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/roles`;
+        return await this.httpRequest.get(url);
+    }
+    /** POST /internal/tenants/{tenantId}/role-assignments — asigna un rol a un usuario en un scope. */
+    async assignTenantRole(tenantId, input) {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/role-assignments`;
+        return await this.httpRequest.post(url, input);
+    }
+    /**
+     * POST /internal/tenants/{tenantId}/role-assignments/{assignmentId}/revoke — revoca una asignación.
+     * El `cognitoSub` va en el cuerpo porque es parte de la llave de la tabla de asignaciones.
+     */
+    async revokeTenantRole(tenantId, assignmentId, input) {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/role-assignments/${encodeURIComponent(assignmentId)}/revoke`;
+        return await this.httpRequest.post(url, input);
+    }
 };
 PlatformRbacBusinessApi = __decorate([
     injectable(),

package/bin/platformRbac/api/interfaces/IPlatformRbacBusinessApi.d.ts

@@ -1,5 +1,5 @@
-import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse, PermissionScope, CreateLevelEntityRequest, CreateLevelEntityResponse, CreateTenantUserRequest, CreateTenantUserResponse, UserProfileResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
+import { APIGatewayProxyResultBody, ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse, PermissionScope, CreateLevelEntityRequest, CreateLevelEntityResponse, CreateTenantUserRequest, CreateTenantUserResponse, UserProfileResponse, ListLevelEntitiesResponse, LevelEntityResponse, UpdateLevelEntityRequest, DeleteLevelEntityRequest, DeleteLevelEntityResponse, ListTenantUsersResponse, GetTenantUserResponse, TenantUserResponse, TenantUserAckResponse, UpdateTenantUserRequest, DeleteTenantUserRequest, DisableTenantUserRequest, EnableTenantUserRequest, ResetTenantUserPasswordRequest, ResetTenantUserPasswordResponse, ResetTenantUserMfaRequest, ListTenantRolesResponse, AssignTenantRoleRequest, AssignTenantRoleResponse, RevokeTenantRoleRequest, RevokeTenantRoleResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
 /**
  * Contrato del publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
  * para los 3 endpoints internos del Custom Auth Challenge flow (MFA).
@@ -8,8 +8,8 @@ import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallen
  * `defineAuthChallenge`, `createAuthChallenge` y `verifyAuthChallengeResponse`
  * configurados en cada User Pool aprovisionado por la saga `TenantOnboardingManager`.
  *
- * Patrón de retorno: `Promise<ApiGatewayResponse<T>>` sin unwrap (v4 canonical Fiado).
- * El consumer accede `result.body.data` para llegar al payload tipado.
+ * Devuelve el body HTTP crudo `{ code, date, msg, data }`, con el payload en `.data`: el tipo honesto es
+ * el de los métodos de administración. Los `ApiGatewayResponse<T>` mienten y quedan por TD-AI-003.
  *
  * Env var requerida en el consumer: `PLATFORM_RBAC_BUSINESS_URL`.
  * El template.yml del consumer la setea con:
@@ -77,4 +77,47 @@ export interface IPlatformRbacBusinessApi {
     createTenantUser(tenantId: string, input: CreateTenantUserRequest): Promise<ApiGatewayResponse<CreateTenantUserResponse>>;
     /** GET /internal/users/{cognitoSub}/profile?tenantId= — perfil básico del SharedUser (displayName, email, phone, status). */
     getUserProfile(cognitoSub: string, tenantId: string): Promise<ApiGatewayResponse<UserProfileResponse>>;
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities — lista los grupos de un nivel; `parentId` filtra por los hijos de un grupo. */
+    listLevelEntities(tenantId: string, level: PermissionScope, parentId?: string): Promise<APIGatewayProxyResultBody<ListLevelEntitiesResponse>>;
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities/{id} — detalle de un grupo. */
+    getLevelEntity(tenantId: string, level: PermissionScope, id: string): Promise<APIGatewayProxyResultBody<LevelEntityResponse>>;
+    /** PUT /internal/tenants/{tenantId}/levels/{level}/entities/{id} — renombra un grupo. */
+    updateLevelEntity(tenantId: string, level: PermissionScope, id: string, input: UpdateLevelEntityRequest): Promise<APIGatewayProxyResultBody<LevelEntityResponse>>;
+    /** DELETE /internal/tenants/{tenantId}/levels/{level}/entities/{id} — borra un grupo. El `actedBy` viaja en el cuerpo. */
+    deleteLevelEntity(tenantId: string, level: PermissionScope, id: string, input: DeleteLevelEntityRequest): Promise<APIGatewayProxyResultBody<DeleteLevelEntityResponse>>;
+    /**
+     * GET /internal/tenants/{tenantId}/users — lista los usuarios del tenant.
+     * El filtro `email` es lo que permite adoptar una cuenta que ya existía: antes de crear un
+     * usuario se pregunta si ese correo ya tiene uno.
+     */
+    listTenantUsers(tenantId: string, email?: string): Promise<APIGatewayProxyResultBody<ListTenantUsersResponse>>;
+    /**
+     * GET /internal/tenants/{tenantId}/users/{cognitoSub} — detalle de un usuario.
+     * De aquí sale el `assignmentId` que hace falta para revocar un rol.
+     */
+    getTenantUser(tenantId: string, cognitoSub: string): Promise<APIGatewayProxyResultBody<GetTenantUserResponse>>;
+    /** PUT /internal/tenants/{tenantId}/users/{cognitoSub} — renombra a un usuario. */
+    updateTenantUser(tenantId: string, cognitoSub: string, input: UpdateTenantUserRequest): Promise<APIGatewayProxyResultBody<TenantUserResponse>>;
+    /** DELETE /internal/tenants/{tenantId}/users/{cognitoSub} — borra a un usuario. El `actedBy` viaja en el cuerpo. */
+    deleteTenantUser(tenantId: string, cognitoSub: string, input: DeleteTenantUserRequest): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/disable — suspende a un usuario. */
+    disableTenantUser(tenantId: string, cognitoSub: string, input: DisableTenantUserRequest): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/enable — reactiva a un usuario suspendido. */
+    enableTenantUser(tenantId: string, cognitoSub: string, input: EnableTenantUserRequest): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+    /**
+     * POST /internal/tenants/{tenantId}/users/{cognitoSub}/password-reset — resetea la contraseña.
+     * Devuelve la contraseña temporal en claro; no se manda correo.
+     */
+    resetTenantUserPassword(tenantId: string, cognitoSub: string, input: ResetTenantUserPasswordRequest): Promise<APIGatewayProxyResultBody<ResetTenantUserPasswordResponse>>;
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/mfa-reset — resetea el MFA de un usuario. */
+    resetTenantUserMfa(tenantId: string, cognitoSub: string, input: ResetTenantUserMfaRequest): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+    /** GET /internal/tenants/{tenantId}/roles — catálogo de roles del tenant, para armar el selector de asignación. */
+    listTenantRoles(tenantId: string): Promise<APIGatewayProxyResultBody<ListTenantRolesResponse>>;
+    /** POST /internal/tenants/{tenantId}/role-assignments — asigna un rol a un usuario en un scope. */
+    assignTenantRole(tenantId: string, input: AssignTenantRoleRequest): Promise<APIGatewayProxyResultBody<AssignTenantRoleResponse>>;
+    /**
+     * POST /internal/tenants/{tenantId}/role-assignments/{assignmentId}/revoke — revoca una asignación.
+     * El `cognitoSub` va en el cuerpo porque es parte de la llave de la tabla de asignaciones.
+     */
+    revokeTenantRole(tenantId: string, assignmentId: string, input: RevokeTenantRoleRequest): Promise<APIGatewayProxyResultBody<RevokeTenantRoleResponse>>;
 }

package/bin/uniteller-connector/api/UnitellerConnectorApi.d.ts

@@ -1,7 +1,7 @@
 import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
 import { ConnectorCatalogItem } from "@fiado/type-kit/bin/benefitCenter/index.js";
-import { CohortCountRequest, CohortCountResponse, CohortUserMatchRequest, CohortUserMatchResponse, PricingMetricsRequest, PricingMetricsResponse, PromotionReachRequest, PromotionReachResponse, SegmentMetricsRequest, SegmentMetricsResponse, WholesaleRateRequest, WholesaleRateResponse, KycUserDetail, KycUsersListResponse, KycOnboardingAttemptsResponse, RefreshUserProfileResponse, RegisterOnboardingBlockRequest, RegisterOnboardingBlockResponse, RemittanceAddBeneficiaryRequest, RemittanceBackofficeDashboardSummary, RemittanceBackofficeStats, RemittanceBackofficeStatsPeriod, RemittanceBackofficeCancelCloseRequest, RemittanceBackofficeCancelCloseResponse, RemittanceBackofficeTransaction, RemittanceBackofficeTxListResponse, RemittanceBackofficeUserDetail, RemittanceBackofficeUserListResponse, RemittanceBeneficiary, RemittanceCancelRequest, RemittanceCancelResponse, RemittanceHomeResponse, RemittanceListBeneficiariesResponse, RemittanceOnboardRequest, RemittanceOnboardResponse, RemittancePayRequest, RemittancePayResponse, RemittancePayerAdditionalFieldDto, RemittancePayerBranchDto, RemittancePayerDto, RemittanceQuoteRequest, RemittanceQuoteResponse, RemittanceSecurityQuestionsResponse, RemittanceSendPreviewRequest, RemittanceSendPreviewResponse, RemittanceSmsRequest, RemittanceStateDto, RemittanceTransactionDetail, RemittanceTransactionReceipt, RemittanceTransactionsListRequest, RemittanceTransactionsListResponse, RemittanceUpdateBeneficiaryRequest, RemittanceUserLimits, RemittanceUserLimitsBatchResponse, RemittanceCorridor, PricingScheduleResponse } from "@fiado/type-kit/bin/remittance/index.js";
+import { CohortCountRequest, CohortCountResponse, CohortUserMatchRequest, CohortUserMatchResponse, PricingMetricsRequest, PricingMetricsResponse, PromotionReachRequest, PromotionReachResponse, SegmentMetricsRequest, SegmentMetricsResponse, WholesaleRateRequest, WholesaleRateResponse, KycUserDetail, KycUsersListResponse, KycOnboardingAttemptsResponse, RefreshUserProfileResponse, RegisterOnboardingBlockRequest, RegisterOnboardingBlockResponse, RemittanceAddBeneficiaryRequest, RemittanceBackofficeDashboardSummary, RemittanceBackofficeStats, RemittanceBackofficeStatsRangeRequest, RemittanceBackofficeStatsPeriod, RemittanceBackofficeCancelCloseRequest, RemittanceBackofficeCancelCloseResponse, RemittanceBackofficeTransaction, RemittanceBackofficeTxListResponse, RemittanceBackofficeUserDetail, RemittanceBackofficeUserListResponse, RemittanceBeneficiary, RemittanceCancelRequest, RemittanceCancelResponse, RemittanceHomeResponse, RemittanceListBeneficiariesResponse, RemittanceOnboardRequest, RemittanceOnboardResponse, RemittancePayRequest, RemittancePayResponse, RemittancePayerAdditionalFieldDto, RemittancePayerBranchDto, RemittancePayerDto, RemittanceQuoteRequest, RemittanceQuoteResponse, RemittanceSecurityQuestionsResponse, RemittanceSendPreviewRequest, RemittanceSendPreviewResponse, RemittanceSmsRequest, RemittanceStateDto, RemittanceTransactionDetail, RemittanceTransactionReceipt, RemittanceTransactionsListRequest, RemittanceTransactionsListResponse, RemittanceUpdateBeneficiaryRequest, RemittanceUserLimits, RemittanceUserLimitsBatchResponse, RemittanceCorridor, PricingScheduleResponse } from "@fiado/type-kit/bin/remittance/index.js";
 import { IUnitellerConnectorApi } from "./interfaces/IUnitellerConnectorApi.js";
 export default class UnitellerConnectorApi implements IUnitellerConnectorApi {
     private httpRequest;
@@ -27,9 +27,9 @@ export default class UnitellerConnectorApi implements IUnitellerConnectorApi {
     }): Promise<ApiGatewayResponse<RemittancePayerAdditionalFieldDto[]>>;
     listBeneficiaries(directoryId: string, includeDeactivated?: boolean): Promise<ApiGatewayResponse<RemittanceListBeneficiariesResponse>>;
     getBeneficiary(directoryId: string, beneficiaryId: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    addBeneficiary(directoryId: string, request: RemittanceAddBeneficiaryRequest): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    updateBeneficiary(directoryId: string, beneficiaryId: string, request: RemittanceUpdateBeneficiaryRequest): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    deactivateBeneficiary(directoryId: string, beneficiaryId: string): Promise<ApiGatewayResponse<{
+    addBeneficiary(directoryId: string, request: RemittanceAddBeneficiaryRequest, actor?: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
+    updateBeneficiary(directoryId: string, beneficiaryId: string, request: RemittanceUpdateBeneficiaryRequest, actor?: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
+    deactivateBeneficiary(directoryId: string, beneficiaryId: string, actor?: string): Promise<ApiGatewayResponse<{
         deactivated: boolean;
         beneficiaryId: string;
     }>>;
@@ -70,6 +70,7 @@ export default class UnitellerConnectorApi implements IUnitellerConnectorApi {
     backofficeSyncTransaction(txNumber: string): Promise<ApiGatewayResponse<RemittanceBackofficeTransaction>>;
     backofficeCloseCancellation(txNumber: string, request: RemittanceBackofficeCancelCloseRequest): Promise<ApiGatewayResponse<RemittanceBackofficeCancelCloseResponse>>;
     backofficeStats(period: RemittanceBackofficeStatsPeriod): Promise<ApiGatewayResponse<RemittanceBackofficeStats>>;
+    backofficeStatsRange(request: RemittanceBackofficeStatsRangeRequest): Promise<ApiGatewayResponse<RemittanceBackofficeStats>>;
     backofficeUserLimits(directoryId: string): Promise<ApiGatewayResponse<RemittanceUserLimits>>;
     backofficeUserLimitsBatch(directoryIds: string[]): Promise<ApiGatewayResponse<RemittanceUserLimitsBatchResponse>>;
     kycListUsers(filters?: {

package/bin/uniteller-connector/api/UnitellerConnectorApi.js

@@ -65,17 +65,17 @@ let UnitellerConnectorApi = class UnitellerConnectorApi {
         const url = `${this.baseUrl}/beneficiaries/${encodeURIComponent(beneficiaryId)}`;
         return await this.httpRequest.post(url, { directoryId });
     }
-    async addBeneficiary(directoryId, request) {
+    async addBeneficiary(directoryId, request, actor) {
         const url = `${this.baseUrl}/beneficiaries`;
-        return await this.httpRequest.post(url, { directoryId, ...request });
+        return await this.httpRequest.post(url, { directoryId, ...request, ...(actor && { actor }) });
     }
-    async updateBeneficiary(directoryId, beneficiaryId, request) {
+    async updateBeneficiary(directoryId, beneficiaryId, request, actor) {
         const url = `${this.baseUrl}/beneficiaries/${encodeURIComponent(beneficiaryId)}`;
-        return await this.httpRequest.put(url, { directoryId, ...request });
+        return await this.httpRequest.put(url, { directoryId, ...request, ...(actor && { actor }) });
     }
-    async deactivateBeneficiary(directoryId, beneficiaryId) {
+    async deactivateBeneficiary(directoryId, beneficiaryId, actor) {
         const url = `${this.baseUrl}/beneficiaries/${encodeURIComponent(beneficiaryId)}/deactivate`;
-        return await this.httpRequest.post(url, { directoryId });
+        return await this.httpRequest.post(url, { directoryId, ...(actor && { actor }) });
     }
     async pricingSchedule(directoryId, corridor) {
         const url = `${this.baseUrl}/pricing/schedule`;
@@ -157,6 +157,14 @@ let UnitellerConnectorApi = class UnitellerConnectorApi {
         const url = `${this.baseUrl}/backoffice/stats`;
         return await this.httpRequest.get(url, { period });
     }
+    async backofficeStatsRange(request) {
+        const url = `${this.baseUrl}/backoffice/stats`;
+        return await this.httpRequest.get(url, {
+            from: request.from,
+            to: request.to,
+            ...(request.tzOffsetMinutes !== undefined && { tzOffsetMinutes: String(request.tzOffsetMinutes) }),
+        });
+    }
     async backofficeUserLimits(directoryId) {
         const url = `${this.baseUrl}/backoffice/users/${encodeURIComponent(directoryId)}/limits`;
         return await this.httpRequest.get(url);

package/bin/uniteller-connector/api/interfaces/IUnitellerConnectorApi.d.ts

@@ -1,6 +1,6 @@
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
 import { ConnectorCatalogItem } from "@fiado/type-kit/bin/benefitCenter/index.js";
-import { CohortCountRequest, CohortCountResponse, CohortUserMatchRequest, CohortUserMatchResponse, PricingMetricsRequest, PricingMetricsResponse, PromotionReachRequest, PromotionReachResponse, SegmentMetricsRequest, SegmentMetricsResponse, WholesaleRateRequest, WholesaleRateResponse, RemittanceCorridor, PricingScheduleResponse, KycUserDetail, KycUsersListResponse, KycOnboardingAttemptsResponse, RefreshUserProfileResponse, RegisterOnboardingBlockRequest, RegisterOnboardingBlockResponse, RemittanceAddBeneficiaryRequest, RemittanceBackofficeDashboardSummary, RemittanceBackofficeStats, RemittanceBackofficeStatsPeriod, RemittanceBackofficeCancelCloseRequest, RemittanceBackofficeCancelCloseResponse, RemittanceBackofficeTransaction, RemittanceBackofficeTxListResponse, RemittanceBackofficeUserDetail, RemittanceBackofficeUserListResponse, RemittanceBeneficiary, RemittanceCancelRequest, RemittanceCancelResponse, RemittanceHomeResponse, RemittanceListBeneficiariesResponse, RemittanceOnboardRequest, RemittanceOnboardResponse, RemittancePayRequest, RemittancePayResponse, RemittancePayerAdditionalFieldDto, RemittancePayerBranchDto, RemittancePayerDto, RemittanceQuoteRequest, RemittanceQuoteResponse, RemittanceSecurityQuestionsResponse, RemittanceSendPreviewRequest, RemittanceSendPreviewResponse, RemittanceSmsRequest, RemittanceStateDto, RemittanceTransactionDetail, RemittanceTransactionReceipt, RemittanceTransactionsListRequest, RemittanceTransactionsListResponse, RemittanceUpdateBeneficiaryRequest, RemittanceUserLimits, RemittanceUserLimitsBatchResponse } from "@fiado/type-kit/bin/remittance/index.js";
+import { CohortCountRequest, CohortCountResponse, CohortUserMatchRequest, CohortUserMatchResponse, PricingMetricsRequest, PricingMetricsResponse, PromotionReachRequest, PromotionReachResponse, SegmentMetricsRequest, SegmentMetricsResponse, WholesaleRateRequest, WholesaleRateResponse, RemittanceCorridor, PricingScheduleResponse, KycUserDetail, KycUsersListResponse, KycOnboardingAttemptsResponse, RefreshUserProfileResponse, RegisterOnboardingBlockRequest, RegisterOnboardingBlockResponse, RemittanceAddBeneficiaryRequest, RemittanceBackofficeDashboardSummary, RemittanceBackofficeStats, RemittanceBackofficeStatsRangeRequest, RemittanceBackofficeStatsPeriod, RemittanceBackofficeCancelCloseRequest, RemittanceBackofficeCancelCloseResponse, RemittanceBackofficeTransaction, RemittanceBackofficeTxListResponse, RemittanceBackofficeUserDetail, RemittanceBackofficeUserListResponse, RemittanceBeneficiary, RemittanceCancelRequest, RemittanceCancelResponse, RemittanceHomeResponse, RemittanceListBeneficiariesResponse, RemittanceOnboardRequest, RemittanceOnboardResponse, RemittancePayRequest, RemittancePayResponse, RemittancePayerAdditionalFieldDto, RemittancePayerBranchDto, RemittancePayerDto, RemittanceQuoteRequest, RemittanceQuoteResponse, RemittanceSecurityQuestionsResponse, RemittanceSendPreviewRequest, RemittanceSendPreviewResponse, RemittanceSmsRequest, RemittanceStateDto, RemittanceTransactionDetail, RemittanceTransactionReceipt, RemittanceTransactionsListRequest, RemittanceTransactionsListResponse, RemittanceUpdateBeneficiaryRequest, RemittanceUserLimits, RemittanceUserLimitsBatchResponse } from "@fiado/type-kit/bin/remittance/index.js";
 export interface IUnitellerConnectorApi {
     /** Estado del módulo remesas para un directoryId. */
     getHome(directoryId: string): Promise<ApiGatewayResponse<RemittanceHomeResponse>>;
@@ -38,9 +38,10 @@ export interface IUnitellerConnectorApi {
     }): Promise<ApiGatewayResponse<RemittancePayerAdditionalFieldDto[]>>;
     listBeneficiaries(directoryId: string, includeDeactivated?: boolean): Promise<ApiGatewayResponse<RemittanceListBeneficiariesResponse>>;
     getBeneficiary(directoryId: string, beneficiaryId: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    addBeneficiary(directoryId: string, request: RemittanceAddBeneficiaryRequest): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    updateBeneficiary(directoryId: string, beneficiaryId: string, request: RemittanceUpdateBeneficiaryRequest): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    deactivateBeneficiary(directoryId: string, beneficiaryId: string): Promise<ApiGatewayResponse<{
+    /** `actor` opcional ("BACKOFFICE:<email>") cuando la operación no la hace el usuario; queda en createdBy/updatedBy. */
+    addBeneficiary(directoryId: string, request: RemittanceAddBeneficiaryRequest, actor?: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
+    updateBeneficiary(directoryId: string, beneficiaryId: string, request: RemittanceUpdateBeneficiaryRequest, actor?: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
+    deactivateBeneficiary(directoryId: string, beneficiaryId: string, actor?: string): Promise<ApiGatewayResponse<{
         deactivated: boolean;
         beneficiaryId: string;
     }>>;
@@ -122,6 +123,8 @@ export interface IUnitellerConnectorApi {
     /** Cierre manual de una cancelación: UPDATE a UniTeller + credit-back. */
     backofficeCloseCancellation(txNumber: string, request: RemittanceBackofficeCancelCloseRequest): Promise<ApiGatewayResponse<RemittanceBackofficeCancelCloseResponse>>;
     backofficeStats(period: RemittanceBackofficeStatsPeriod): Promise<ApiGatewayResponse<RemittanceBackofficeStats>>;
+    /** Stats por rango explícito (from/to ISO) agrupando los días con el desfase del operador. GET /backoffice/stats. */
+    backofficeStatsRange(request: RemittanceBackofficeStatsRangeRequest): Promise<ApiGatewayResponse<RemittanceBackofficeStats>>;
     /** Límites por usuario (Operación · read-only): ventanas (límite del provider + usage) + nivel + discrepancia. */
     backofficeUserLimits(directoryId: string): Promise<ApiGatewayResponse<RemittanceUserLimits>>;
     /** Batch de límites para la tabla de Límites (CSV de directoryIds). */

package/docs/TECH_DEBT.md

@@ -2,7 +2,9 @@
 
 Registro vivo de deudas conscientes del repo. Cada entrada con ID estable `TD-AI-NNN` y los 4 campos canónicos (contexto / asunción / condición para cerrar / bloqueante).
 
-## TD-AI-001 — 2026-05-29 — npm link @fiado/type-kit activo
+## TD-AI-001 — 2026-05-29 — CERRADA 2026-09-21 — npm link @fiado/type-kit activo
+
+- **Cierre:** el symlink se quitó y se reinstaló `@fiado/type-kit@3.455.0` desde el registry. `tsc --noEmit` en cero y 331 tests en verde, así que el módulo `platformRbac` ya resuelve sin link. El detalle de abajo es histórico.
 
 - **Contexto:** `node_modules/@fiado/type-kit` es symlink local a `C:/Users/Fiado/Documents/Repos/fiado-type-kit/` (v3.43.1) — el publicado en CodeArtifact es v3.42.0 sin el módulo `platformRbac` que el Publisher `PlatformRbacBusinessApi` nuevo (`src/platformRbac/`) importa. El link se activó para iterar localmente sin publish prematuro del type-kit (decisión del user en el plan `2026-05-29-custom-auth-challenge-mfa.md`).
 - **Asunción / pendiente:** el `npm run build` y `tsc --noEmit` funcionan con el link, pero CI y cualquier `npm install` fresh van a resolver desde CodeArtifact (3.42.0) y fallar con `TS2307: Cannot find module '@fiado/type-kit/bin/platformRbac'` en los 2 archivos nuevos del Publisher.
@@ -21,3 +23,17 @@ Registro vivo de deudas conscientes del repo. Cada entrada con ID estable `TD-AI
 - **Asunción / pendiente:** se tiparon inline a propósito para no bloquear el cableado del wizard F2 en un bump de type-kit (regla de la sesión: NO tocar type-kit sin OK). Los shapes espejan fielmente el contrato del destino verificado en código.
 - **Condición para cerrar:** cuando `retail-catalog-business`/`retail-cards-business` publiquen esos DTOs en `@fiado/type-kit` (dominios `retailCatalog`/`retailCards`), reemplazar los inline por el import del type-kit y bumpear.
 - **Bloqueante:** NO — el contrato de red es correcto; es unificación de tipos con downstream.
+
+## TD-AI-003 — 2026-09-21 — el tipo de retorno de los publishers miente sobre el shape real
+
+- **Contexto:** `@fiado/http-client` hace `return response.data` de axios, así que lo que llega en runtime es el body HTTP crudo del `ApiResponse` del lambda destino: `{ code, date, msg, data }`, con el payload en `.data`. Los 43 archivos de `src/` que declaran `Promise<ApiGatewayResponse<T>>` (`{ statusCode, body }`) declaran un shape que nunca existe. Ya costó un crash: leer `.body` en `ApiInvokerPermissionResolver` daba `undefined` y reventaba `enforceRbac`, y `retail-org-business` compensa con `response as unknown as Record<string, unknown>` + `(raw?.data ?? raw)` al consumir `createLevelEntity`.
+- **Asunción / pendiente:** los 15 métodos de administración de RBAC (`listLevelEntities`..`revokeTenantRole`) ya se tipan `APIGatewayProxyResultBody<T>` de `@fiado/gateway-adapter`, que es el shape honesto — mismo precedente que `CollectorApi.getCollectorTransactionByIds`. Los métodos viejos NO se tocaron: corregirlos por abajo rompe la compensación de los consumidores vivos que ya leen `?? raw`.
+- **Condición para cerrar:** migrar los 43 archivos a `APIGatewayProxyResultBody<T>` en un bump coordinado, quitando en el mismo movimiento los casts de compensación de cada consumer (arrancando por `retail-org-business`). No es de este ciclo.
+- **Bloqueante:** NO — el contrato de red es correcto y el shape honesto ya es el de los métodos nuevos; es unificación de tipos.
+
+## TD-AI-004 — 2026-09-21 — CERRADA — npm link @fiado/type-kit (DTOs de administración de RBAC)
+
+- **Contexto:** durante el desarrollo, `node_modules/@fiado/type-kit` fue symlink al repo local porque los 15 métodos de administración de RBAC importaban DTOs que la versión publicada todavía no tenía.
+- **Cómo se cerró:** publicada `@fiado/type-kit@3.455.0`, se quitó el symlink y se reinstaló desde el registry. `tsc --noEmit` en cero y 331 tests en verde contra el árbol del registry.
+- **Lo que el link tapaba, y conviene recordar:** `tsc` no limpia `bin/`, así que artefactos compilados de DTOs ya borrados seguían resolviendo a través del symlink. Un `npm link` puede hacer compilar contra tipos que ya no existen.
+- **Trampa del teardown:** `npm unlink <pkg>` en npm 7+ es alias de `uninstall` y BORRA la dependencia de `package.json`. Hay que restaurarla antes del `npm install`, o el paquete se resuelve como transitiva en una versión vieja.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "5.85.0",
+  "version": "5.87.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "type": "module",
   "main": "bin/index.js",
@@ -34,7 +34,7 @@
     "@fiado/gateway-adapter": "^3.9.0",
     "@fiado/http-client": "^2.0.1",
     "@fiado/logger": "^1.1.3",
-    "@fiado/type-kit": "^3.435.0",
+    "@fiado/type-kit": "^3.441.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {

package/src/benefits-marketplace/api/BenefitsMarketplaceApi.ts

@@ -3,6 +3,7 @@ import {inject, injectable} from "inversify";
 import {IHttpRequest} from "@fiado/http-client";
 import {BenefitPaymentRequest, BenefitPaymentResponse} from "@fiado/type-kit/bin/benefitCenter/index.js";
 import {ApiGatewayResponse} from "@fiado/gateway-adapter";
+import {RemittanceOnboardingPrefillRequest, RemittanceOnboardingPrefillResponse} from "@fiado/type-kit/bin/remittance/index.js";
 import {BenefitLeafDisplayResponse} from "./dtos/BenefitLeafDisplayResponse.js";
 import {
     CreateFundingReferenceRequest,
@@ -56,4 +57,11 @@ export default class BenefitsMarketplaceApi implements IBenefitsMarketplaceApi {
         const url = `${this.baseUrl}/funding/${encodeURIComponent(moduleName)}/references?${params.toString()}`;
         return await this.httpRequest.get(url);
     }
+
+    async remittanceOnboardingPrefill(
+        request: RemittanceOnboardingPrefillRequest,
+    ): Promise<ApiGatewayResponse<RemittanceOnboardingPrefillResponse>> {
+        const url = `${this.baseUrl}/remittance/onboarding/prefill`;
+        return await this.httpRequest.post(url, request);
+    }
 }

package/src/benefits-marketplace/api/interfaces/IBenefitsMarketplaceApi.ts

@@ -1,5 +1,6 @@
 import {BenefitPaymentRequest, BenefitPaymentResponse} from "@fiado/type-kit/bin/benefitCenter/index.js";
 import {ApiGatewayResponse} from "@fiado/gateway-adapter";
+import {RemittanceOnboardingPrefillRequest, RemittanceOnboardingPrefillResponse} from "@fiado/type-kit/bin/remittance/index.js";
 import {BenefitLeafDisplayResponse} from "../dtos/BenefitLeafDisplayResponse.js";
 import {
     CreateFundingReferenceRequest,
@@ -90,4 +91,14 @@ export interface IBenefitsMarketplaceApi {
         directoryId: string,
         status?: string,
     ): Promise<ApiGatewayResponse<ListFundingReferencesResponse>>;
+
+    /**
+     * Composición del onboarding de remesas de un usuario SIN ejecutarla: lo que la app
+     * mandaría hoy (datos de Fiado) o el motivo de bloqueo + direcciones candidatas.
+     * Backend: POST /remittance/onboarding/prefill (privado VPC). Lo consume remittance-business
+     * para el reintento de registro desde el backoffice.
+     */
+    remittanceOnboardingPrefill(
+        request: RemittanceOnboardingPrefillRequest,
+    ): Promise<ApiGatewayResponse<RemittanceOnboardingPrefillResponse>>;
 }

package/src/platformRbac/api/PlatformRbacBusinessApi.ts

@@ -1,7 +1,12 @@
 import { inject, injectable } from "inversify";
 import type { IHttpRequest } from "@fiado/http-client";
-import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
-// TD-AI-001: import de @fiado/type-kit/bin/platformRbac requiere npm link a type-kit 3.43.1 hasta publish final. Ver docs/TECH_DEBT.md.
+import {
+    APIGatewayProxyResultBody,
+    ApiGatewayResponse,
+    ResolvedPermissions,
+    ResolveInput,
+} from "@fiado/gateway-adapter";
+// TD-AI-003: el tipo de retorno de los métodos viejos no refleja el runtime. Ver docs/TECH_DEBT.md.
 import {
     DefineNextChallengeRequest,
     DefineNextChallengeResponse,
@@ -19,6 +24,27 @@ import {
     CreateTenantUserRequest,
     CreateTenantUserResponse,
     UserProfileResponse,
+    ListLevelEntitiesResponse,
+    LevelEntityResponse,
+    UpdateLevelEntityRequest,
+    DeleteLevelEntityRequest,
+    DeleteLevelEntityResponse,
+    ListTenantUsersResponse,
+    GetTenantUserResponse,
+    TenantUserResponse,
+    TenantUserAckResponse,
+    UpdateTenantUserRequest,
+    DeleteTenantUserRequest,
+    DisableTenantUserRequest,
+    EnableTenantUserRequest,
+    ResetTenantUserPasswordRequest,
+    ResetTenantUserPasswordResponse,
+    ResetTenantUserMfaRequest,
+    ListTenantRolesResponse,
+    AssignTenantRoleRequest,
+    AssignTenantRoleResponse,
+    RevokeTenantRoleRequest,
+    RevokeTenantRoleResponse,
 } from "@fiado/type-kit/bin/platformRbac/index.js";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.js";
 
@@ -126,4 +152,185 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
         const url = `${this.baseUrl}/internal/users/${encodeURIComponent(cognitoSub)}/profile?tenantId=${encodeURIComponent(tenantId)}`;
         return await this.httpRequest.get(url);
     }
+
+    // ── Administración de RBAC para el hub de agentes (grupos, usuarios y roles) ──
+    // Tipados `APIGatewayProxyResultBody<T>`, el shape REAL que devuelve @fiado/http-client:
+    // el body HTTP crudo `{ code, date, msg, data }`, con el payload en `.data` (TD-AI-003).
+
+    /** Ruta base de los grupos (entidades de nivel) de un tenant. */
+    private _levelEntitiesUrl(tenantId: string, level: PermissionScope): string {
+        return `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/levels/${encodeURIComponent(level)}/entities`;
+    }
+
+    /** Ruta base de los usuarios de un tenant. */
+    private _tenantUsersUrl(tenantId: string): string {
+        return `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/users`;
+    }
+
+    // `IHttpRequest.delete` manda su segundo argumento como QUERY STRING, no como cuerpo: el cuerpo
+    // solo llega por `extraConfig` ({ data }). `actedBy` va ahí para no quedar en los logs de API Gateway.
+    private async _deleteWithBody<T>(url: string, body: unknown): Promise<T> {
+        return await this.httpRequest.delete<T>(url, undefined, undefined, undefined, undefined, { data: body });
+    }
+
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities — lista los grupos de un nivel; `parentId` filtra por los hijos de un grupo. */
+    async listLevelEntities(
+        tenantId: string,
+        level: PermissionScope,
+        parentId?: string,
+    ): Promise<APIGatewayProxyResultBody<ListLevelEntitiesResponse>> {
+        const base = this._levelEntitiesUrl(tenantId, level);
+        const url = parentId ? `${base}?parentId=${encodeURIComponent(parentId)}` : base;
+        return await this.httpRequest.get(url);
+    }
+
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities/{id} — detalle de un grupo. */
+    async getLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        id: string,
+    ): Promise<APIGatewayProxyResultBody<LevelEntityResponse>> {
+        const url = `${this._levelEntitiesUrl(tenantId, level)}/${encodeURIComponent(id)}`;
+        return await this.httpRequest.get(url);
+    }
+
+    /** PUT /internal/tenants/{tenantId}/levels/{level}/entities/{id} — renombra un grupo. */
+    async updateLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        id: string,
+        input: UpdateLevelEntityRequest,
+    ): Promise<APIGatewayProxyResultBody<LevelEntityResponse>> {
+        const url = `${this._levelEntitiesUrl(tenantId, level)}/${encodeURIComponent(id)}`;
+        return await this.httpRequest.put(url, input);
+    }
+
+    /** DELETE /internal/tenants/{tenantId}/levels/{level}/entities/{id} — borra un grupo. El `actedBy` viaja en el cuerpo. */
+    async deleteLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        id: string,
+        input: DeleteLevelEntityRequest,
+    ): Promise<APIGatewayProxyResultBody<DeleteLevelEntityResponse>> {
+        const url = `${this._levelEntitiesUrl(tenantId, level)}/${encodeURIComponent(id)}`;
+        return await this._deleteWithBody(url, input);
+    }
+
+    /**
+     * GET /internal/tenants/{tenantId}/users — lista los usuarios del tenant.
+     * El filtro `email` es lo que permite adoptar una cuenta que ya existía.
+     */
+    async listTenantUsers(
+        tenantId: string,
+        email?: string,
+    ): Promise<APIGatewayProxyResultBody<ListTenantUsersResponse>> {
+        const base = this._tenantUsersUrl(tenantId);
+        const url = email ? `${base}?email=${encodeURIComponent(email)}` : base;
+        return await this.httpRequest.get(url);
+    }
+
+    /**
+     * GET /internal/tenants/{tenantId}/users/{cognitoSub} — detalle de un usuario.
+     * De aquí sale el `assignmentId` que hace falta para revocar un rol.
+     */
+    async getTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+    ): Promise<APIGatewayProxyResultBody<GetTenantUserResponse>> {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}`;
+        return await this.httpRequest.get(url);
+    }
+
+    /** PUT /internal/tenants/{tenantId}/users/{cognitoSub} — renombra a un usuario. */
+    async updateTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+        input: UpdateTenantUserRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserResponse>> {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}`;
+        return await this.httpRequest.put(url, input);
+    }
+
+    /** DELETE /internal/tenants/{tenantId}/users/{cognitoSub} — borra a un usuario. El `actedBy` viaja en el cuerpo. */
+    async deleteTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+        input: DeleteTenantUserRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>> {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}`;
+        return await this._deleteWithBody(url, input);
+    }
+
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/disable — suspende a un usuario. */
+    async disableTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+        input: DisableTenantUserRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>> {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}/disable`;
+        return await this.httpRequest.post(url, input);
+    }
+
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/enable — reactiva a un usuario suspendido. */
+    async enableTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+        input: EnableTenantUserRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>> {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}/enable`;
+        return await this.httpRequest.post(url, input);
+    }
+
+    /**
+     * POST /internal/tenants/{tenantId}/users/{cognitoSub}/password-reset — resetea la contraseña.
+     * Devuelve la contraseña temporal en claro; no se manda correo.
+     */
+    async resetTenantUserPassword(
+        tenantId: string,
+        cognitoSub: string,
+        input: ResetTenantUserPasswordRequest,
+    ): Promise<APIGatewayProxyResultBody<ResetTenantUserPasswordResponse>> {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}/password-reset`;
+        return await this.httpRequest.post(url, input);
+    }
+
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/mfa-reset — resetea el MFA de un usuario. */
+    async resetTenantUserMfa(
+        tenantId: string,
+        cognitoSub: string,
+        input: ResetTenantUserMfaRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>> {
+        const url = `${this._tenantUsersUrl(tenantId)}/${encodeURIComponent(cognitoSub)}/mfa-reset`;
+        return await this.httpRequest.post(url, input);
+    }
+
+    /** GET /internal/tenants/{tenantId}/roles — catálogo de roles del tenant, para armar el selector de asignación. */
+    async listTenantRoles(
+        tenantId: string,
+    ): Promise<APIGatewayProxyResultBody<ListTenantRolesResponse>> {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/roles`;
+        return await this.httpRequest.get(url);
+    }
+
+    /** POST /internal/tenants/{tenantId}/role-assignments — asigna un rol a un usuario en un scope. */
+    async assignTenantRole(
+        tenantId: string,
+        input: AssignTenantRoleRequest,
+    ): Promise<APIGatewayProxyResultBody<AssignTenantRoleResponse>> {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/role-assignments`;
+        return await this.httpRequest.post(url, input);
+    }
+
+    /**
+     * POST /internal/tenants/{tenantId}/role-assignments/{assignmentId}/revoke — revoca una asignación.
+     * El `cognitoSub` va en el cuerpo porque es parte de la llave de la tabla de asignaciones.
+     */
+    async revokeTenantRole(
+        tenantId: string,
+        assignmentId: string,
+        input: RevokeTenantRoleRequest,
+    ): Promise<APIGatewayProxyResultBody<RevokeTenantRoleResponse>> {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/role-assignments/${encodeURIComponent(assignmentId)}/revoke`;
+        return await this.httpRequest.post(url, input);
+    }
 }

package/src/platformRbac/api/interfaces/IPlatformRbacBusinessApi.ts

@@ -1,4 +1,9 @@
-import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
+import {
+    APIGatewayProxyResultBody,
+    ApiGatewayResponse,
+    ResolvedPermissions,
+    ResolveInput,
+} from "@fiado/gateway-adapter";
 import {
     DefineNextChallengeRequest,
     DefineNextChallengeResponse,
@@ -16,6 +21,27 @@ import {
     CreateTenantUserRequest,
     CreateTenantUserResponse,
     UserProfileResponse,
+    ListLevelEntitiesResponse,
+    LevelEntityResponse,
+    UpdateLevelEntityRequest,
+    DeleteLevelEntityRequest,
+    DeleteLevelEntityResponse,
+    ListTenantUsersResponse,
+    GetTenantUserResponse,
+    TenantUserResponse,
+    TenantUserAckResponse,
+    UpdateTenantUserRequest,
+    DeleteTenantUserRequest,
+    DisableTenantUserRequest,
+    EnableTenantUserRequest,
+    ResetTenantUserPasswordRequest,
+    ResetTenantUserPasswordResponse,
+    ResetTenantUserMfaRequest,
+    ListTenantRolesResponse,
+    AssignTenantRoleRequest,
+    AssignTenantRoleResponse,
+    RevokeTenantRoleRequest,
+    RevokeTenantRoleResponse,
 } from "@fiado/type-kit/bin/platformRbac/index.js";
 
 /**
@@ -26,8 +52,8 @@ import {
  * `defineAuthChallenge`, `createAuthChallenge` y `verifyAuthChallengeResponse`
  * configurados en cada User Pool aprovisionado por la saga `TenantOnboardingManager`.
  *
- * Patrón de retorno: `Promise<ApiGatewayResponse<T>>` sin unwrap (v4 canonical Fiado).
- * El consumer accede `result.body.data` para llegar al payload tipado.
+ * Devuelve el body HTTP crudo `{ code, date, msg, data }`, con el payload en `.data`: el tipo honesto es
+ * el de los métodos de administración. Los `ApiGatewayResponse<T>` mienten y quedan por TD-AI-003.
  *
  * Env var requerida en el consumer: `PLATFORM_RBAC_BUSINESS_URL`.
  * El template.yml del consumer la setea con:
@@ -128,4 +154,123 @@ export interface IPlatformRbacBusinessApi {
         cognitoSub: string,
         tenantId: string,
     ): Promise<ApiGatewayResponse<UserProfileResponse>>;
+
+    // ── Administración de RBAC para el hub de agentes (grupos, usuarios y roles) ──
+    // Estos métodos declaran el shape REAL de retorno: `APIGatewayProxyResultBody<T>` = el body
+    // HTTP crudo del ApiResponse de rbac, con el payload en `.data` (TD-AI-003).
+
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities — lista los grupos de un nivel; `parentId` filtra por los hijos de un grupo. */
+    listLevelEntities(
+        tenantId: string,
+        level: PermissionScope,
+        parentId?: string,
+    ): Promise<APIGatewayProxyResultBody<ListLevelEntitiesResponse>>;
+
+    /** GET /internal/tenants/{tenantId}/levels/{level}/entities/{id} — detalle de un grupo. */
+    getLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        id: string,
+    ): Promise<APIGatewayProxyResultBody<LevelEntityResponse>>;
+
+    /** PUT /internal/tenants/{tenantId}/levels/{level}/entities/{id} — renombra un grupo. */
+    updateLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        id: string,
+        input: UpdateLevelEntityRequest,
+    ): Promise<APIGatewayProxyResultBody<LevelEntityResponse>>;
+
+    /** DELETE /internal/tenants/{tenantId}/levels/{level}/entities/{id} — borra un grupo. El `actedBy` viaja en el cuerpo. */
+    deleteLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        id: string,
+        input: DeleteLevelEntityRequest,
+    ): Promise<APIGatewayProxyResultBody<DeleteLevelEntityResponse>>;
+
+    /**
+     * GET /internal/tenants/{tenantId}/users — lista los usuarios del tenant.
+     * El filtro `email` es lo que permite adoptar una cuenta que ya existía: antes de crear un
+     * usuario se pregunta si ese correo ya tiene uno.
+     */
+    listTenantUsers(
+        tenantId: string,
+        email?: string,
+    ): Promise<APIGatewayProxyResultBody<ListTenantUsersResponse>>;
+
+    /**
+     * GET /internal/tenants/{tenantId}/users/{cognitoSub} — detalle de un usuario.
+     * De aquí sale el `assignmentId` que hace falta para revocar un rol.
+     */
+    getTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+    ): Promise<APIGatewayProxyResultBody<GetTenantUserResponse>>;
+
+    /** PUT /internal/tenants/{tenantId}/users/{cognitoSub} — renombra a un usuario. */
+    updateTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+        input: UpdateTenantUserRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserResponse>>;
+
+    /** DELETE /internal/tenants/{tenantId}/users/{cognitoSub} — borra a un usuario. El `actedBy` viaja en el cuerpo. */
+    deleteTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+        input: DeleteTenantUserRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/disable — suspende a un usuario. */
+    disableTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+        input: DisableTenantUserRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/enable — reactiva a un usuario suspendido. */
+    enableTenantUser(
+        tenantId: string,
+        cognitoSub: string,
+        input: EnableTenantUserRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+
+    /**
+     * POST /internal/tenants/{tenantId}/users/{cognitoSub}/password-reset — resetea la contraseña.
+     * Devuelve la contraseña temporal en claro; no se manda correo.
+     */
+    resetTenantUserPassword(
+        tenantId: string,
+        cognitoSub: string,
+        input: ResetTenantUserPasswordRequest,
+    ): Promise<APIGatewayProxyResultBody<ResetTenantUserPasswordResponse>>;
+
+    /** POST /internal/tenants/{tenantId}/users/{cognitoSub}/mfa-reset — resetea el MFA de un usuario. */
+    resetTenantUserMfa(
+        tenantId: string,
+        cognitoSub: string,
+        input: ResetTenantUserMfaRequest,
+    ): Promise<APIGatewayProxyResultBody<TenantUserAckResponse>>;
+
+    /** GET /internal/tenants/{tenantId}/roles — catálogo de roles del tenant, para armar el selector de asignación. */
+    listTenantRoles(
+        tenantId: string,
+    ): Promise<APIGatewayProxyResultBody<ListTenantRolesResponse>>;
+
+    /** POST /internal/tenants/{tenantId}/role-assignments — asigna un rol a un usuario en un scope. */
+    assignTenantRole(
+        tenantId: string,
+        input: AssignTenantRoleRequest,
+    ): Promise<APIGatewayProxyResultBody<AssignTenantRoleResponse>>;
+
+    /**
+     * POST /internal/tenants/{tenantId}/role-assignments/{assignmentId}/revoke — revoca una asignación.
+     * El `cognitoSub` va en el cuerpo porque es parte de la llave de la tabla de asignaciones.
+     */
+    revokeTenantRole(
+        tenantId: string,
+        assignmentId: string,
+        input: RevokeTenantRoleRequest,
+    ): Promise<APIGatewayProxyResultBody<RevokeTenantRoleResponse>>;
 }

package/src/uniteller-connector/api/UnitellerConnectorApi.ts

@@ -24,6 +24,7 @@ import {
     RemittanceAddBeneficiaryRequest,
     RemittanceBackofficeDashboardSummary,
     RemittanceBackofficeStats,
+    RemittanceBackofficeStatsRangeRequest,
     RemittanceBackofficeStatsPeriod,
     RemittanceBackofficeCancelCloseRequest,
     RemittanceBackofficeCancelCloseResponse,
@@ -126,19 +127,19 @@ export default class UnitellerConnectorApi implements IUnitellerConnectorApi {
         return await this.httpRequest.post(url, { directoryId });
     }
 
-    async addBeneficiary(directoryId: string, request: RemittanceAddBeneficiaryRequest): Promise<ApiGatewayResponse<RemittanceBeneficiary>> {
+    async addBeneficiary(directoryId: string, request: RemittanceAddBeneficiaryRequest, actor?: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>> {
         const url = `${this.baseUrl}/beneficiaries`;
-        return await this.httpRequest.post(url, { directoryId, ...request });
+        return await this.httpRequest.post(url, { directoryId, ...request, ...(actor && { actor }) });
     }
 
-    async updateBeneficiary(directoryId: string, beneficiaryId: string, request: RemittanceUpdateBeneficiaryRequest): Promise<ApiGatewayResponse<RemittanceBeneficiary>> {
+    async updateBeneficiary(directoryId: string, beneficiaryId: string, request: RemittanceUpdateBeneficiaryRequest, actor?: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>> {
         const url = `${this.baseUrl}/beneficiaries/${encodeURIComponent(beneficiaryId)}`;
-        return await this.httpRequest.put(url, { directoryId, ...request });
+        return await this.httpRequest.put(url, { directoryId, ...request, ...(actor && { actor }) });
     }
 
-    async deactivateBeneficiary(directoryId: string, beneficiaryId: string): Promise<ApiGatewayResponse<{ deactivated: boolean; beneficiaryId: string }>> {
+    async deactivateBeneficiary(directoryId: string, beneficiaryId: string, actor?: string): Promise<ApiGatewayResponse<{ deactivated: boolean; beneficiaryId: string }>> {
         const url = `${this.baseUrl}/beneficiaries/${encodeURIComponent(beneficiaryId)}/deactivate`;
-        return await this.httpRequest.post(url, { directoryId });
+        return await this.httpRequest.post(url, { directoryId, ...(actor && { actor }) });
     }
 
     async pricingSchedule(directoryId: string, corridor: RemittanceCorridor): Promise<ApiGatewayResponse<PricingScheduleResponse>> {
@@ -247,6 +248,15 @@ export default class UnitellerConnectorApi implements IUnitellerConnectorApi {
         return await this.httpRequest.get(url, { period });
     }
 
+    async backofficeStatsRange(request: RemittanceBackofficeStatsRangeRequest): Promise<ApiGatewayResponse<RemittanceBackofficeStats>> {
+        const url = `${this.baseUrl}/backoffice/stats`;
+        return await this.httpRequest.get(url, {
+            from: request.from,
+            to: request.to,
+            ...(request.tzOffsetMinutes !== undefined && { tzOffsetMinutes: String(request.tzOffsetMinutes) }),
+        });
+    }
+
     async backofficeUserLimits(directoryId: string): Promise<ApiGatewayResponse<RemittanceUserLimits>> {
         const url = `${this.baseUrl}/backoffice/users/${encodeURIComponent(directoryId)}/limits`;
         return await this.httpRequest.get(url);

package/src/uniteller-connector/api/interfaces/IUnitellerConnectorApi.ts

@@ -24,6 +24,7 @@ import {
     RemittanceAddBeneficiaryRequest,
     RemittanceBackofficeDashboardSummary,
     RemittanceBackofficeStats,
+    RemittanceBackofficeStatsRangeRequest,
     RemittanceBackofficeStatsPeriod,
     RemittanceBackofficeCancelCloseRequest,
     RemittanceBackofficeCancelCloseResponse,
@@ -108,9 +109,10 @@ export interface IUnitellerConnectorApi {
 
     listBeneficiaries(directoryId: string, includeDeactivated?: boolean): Promise<ApiGatewayResponse<RemittanceListBeneficiariesResponse>>;
     getBeneficiary(directoryId: string, beneficiaryId: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    addBeneficiary(directoryId: string, request: RemittanceAddBeneficiaryRequest): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    updateBeneficiary(directoryId: string, beneficiaryId: string, request: RemittanceUpdateBeneficiaryRequest): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
-    deactivateBeneficiary(directoryId: string, beneficiaryId: string): Promise<ApiGatewayResponse<{ deactivated: boolean; beneficiaryId: string }>>;
+    /** `actor` opcional ("BACKOFFICE:<email>") cuando la operación no la hace el usuario; queda en createdBy/updatedBy. */
+    addBeneficiary(directoryId: string, request: RemittanceAddBeneficiaryRequest, actor?: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
+    updateBeneficiary(directoryId: string, beneficiaryId: string, request: RemittanceUpdateBeneficiaryRequest, actor?: string): Promise<ApiGatewayResponse<RemittanceBeneficiary>>;
+    deactivateBeneficiary(directoryId: string, beneficiaryId: string, actor?: string): Promise<ApiGatewayResponse<{ deactivated: boolean; beneficiaryId: string }>>;
     /** Schedule de tramos de service fee + promo automática por corredor (F2 app; passthrough a remittance-business). POST /pricing/schedule. */
     pricingSchedule(directoryId: string, corridor: RemittanceCorridor): Promise<ApiGatewayResponse<PricingScheduleResponse>>;
 
@@ -198,6 +200,8 @@ export interface IUnitellerConnectorApi {
     /** Cierre manual de una cancelación: UPDATE a UniTeller + credit-back. */
     backofficeCloseCancellation(txNumber: string, request: RemittanceBackofficeCancelCloseRequest): Promise<ApiGatewayResponse<RemittanceBackofficeCancelCloseResponse>>;
     backofficeStats(period: RemittanceBackofficeStatsPeriod): Promise<ApiGatewayResponse<RemittanceBackofficeStats>>;
+    /** Stats por rango explícito (from/to ISO) agrupando los días con el desfase del operador. GET /backoffice/stats. */
+    backofficeStatsRange(request: RemittanceBackofficeStatsRangeRequest): Promise<ApiGatewayResponse<RemittanceBackofficeStats>>;
     /** Límites por usuario (Operación · read-only): ventanas (límite del provider + usage) + nivel + discrepancia. */
     backofficeUserLimits(directoryId: string): Promise<ApiGatewayResponse<RemittanceUserLimits>>;
     /** Batch de límites para la tabla de Límites (CSV de directoryIds). */