@fiado/type-kit 3.105.0 → 3.107.0

package/_test_/unit/platformRbac/enums/__snapshots__/permissionBits.test.ts.snap

@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
-exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `2374504554`;
+exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `785870733`;
 
 exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe ante cualquier reorden/inserción) 1`] = `
 [
@@ -122,5 +122,6 @@ exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe an
   "agents.person.create",
   "platform.tenant.userfields.manage",
   "agents.app.access",
+  "platform.user.create.lateral",
 ]
 `;

package/bin/platformRbac/enums/Permission.d.ts

@@ -46,6 +46,7 @@ export declare enum Permission {
     PLATFORM_USER_DISABLE = "platform.user.disable",
     PLATFORM_USER_ENABLE = "platform.user.enable",
     PLATFORM_USER_DELETE = "platform.user.delete",
+    PLATFORM_USER_CREATE_LATERAL = "platform.user.create.lateral",
     PLATFORM_ROLE_CREATE = "platform.role.create",
     PLATFORM_ROLE_LIST = "platform.role.list",
     PLATFORM_ROLE_UPDATE = "platform.role.update",

package/bin/platformRbac/enums/Permission.js

@@ -58,6 +58,10 @@ var Permission;
     Permission["PLATFORM_USER_DISABLE"] = "platform.user.disable";
     Permission["PLATFORM_USER_ENABLE"] = "platform.user.enable";
     Permission["PLATFORM_USER_DELETE"] = "platform.user.delete";
+    // Crear/asignar usuarios platform de TU MISMO nivel (platform_admin → platform_admin).
+    // Espejo de tenant.user.create.lateral / retail.user.create.lateral: habilita allowOwnLevel
+    // en ScopeValidationService.canAssign para scope PLATFORM. DEC-052.
+    Permission["PLATFORM_USER_CREATE_LATERAL"] = "platform.user.create.lateral";
     Permission["PLATFORM_ROLE_CREATE"] = "platform.role.create";
     Permission["PLATFORM_ROLE_LIST"] = "platform.role.list";
     Permission["PLATFORM_ROLE_UPDATE"] = "platform.role.update";
@@ -332,6 +336,9 @@ exports.PERMISSION_BIT_ORDER = [
     // Append-only 2026-06-21: gate de acceso a la app web de Agents (gobernanza). Al FINAL para no
     // correr bits existentes (PERMS_VERSION cambia, pero los índices previos se conservan).
     Permission.AGENTS_APP_ACCESS,
+    // Append-only 2026-06-19: lateral platform (platform_super_admin asigna roles scope PLATFORM).
+    // Al FINAL para no correr bits existentes (PERMS_VERSION cambia, índices previos se conservan).
+    Permission.PLATFORM_USER_CREATE_LATERAL,
 ];
 function djb2(input) {
     let h = 5381;

package/bin/walletFunding/dtos/AuthorizeFundingResponse.d.ts

@@ -7,7 +7,8 @@ import { FundingProviderReferenceData } from "./FundingProviderReferenceData";
  * (barcodes, cadenas pagables) — opaco al front.
  */
 export declare class AuthorizeFundingResponse {
-    fundingId?: string;
+    /** Referencia Passport. Solo presente si status=APPROVED. */
+    reference?: string;
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
     /** ISO timestamp. */

package/bin/walletFunding/dtos/AuthorizeWalletFundingResponse.d.ts

@@ -4,7 +4,7 @@ import { FundingProviderReferenceData } from "./FundingProviderReferenceData";
 export declare class AuthorizeWalletFundingResponse {
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
-    fundingId?: string;
+    reference?: string;
     expiresAt?: string;
     providerData?: FundingProviderReferenceData;
 }

package/bin/walletFunding/dtos/CancelFundingReferenceRequest.d.ts

@@ -1,5 +1,6 @@
 export declare class CancelFundingReferenceRequest {
-    fundingId: string;
+    /** Referencia Passport (PK de EqualityFundingReference_GT). */
+    reference: string;
     directoryId: string;
     idempotencyKey: string;
 }

package/bin/walletFunding/dtos/CancelFundingReferenceRequest.js

@@ -18,7 +18,7 @@ __decorate([
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.MaxLength)(64),
     __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "fundingId", void 0);
+], CancelFundingReferenceRequest.prototype, "reference", void 0);
 __decorate([
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.MaxLength)(64),

package/bin/walletFunding/dtos/CancelFundingReferenceResponse.d.ts

@@ -1,7 +1,7 @@
 import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
 import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
 export declare class CancelFundingReferenceResponse {
-    fundingId: string;
+    reference: string;
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
 }

package/bin/walletFunding/dtos/CancelFundingRequest.d.ts

@@ -1,6 +1,6 @@
 /**
  * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `fundingId` viaja en el path, `directoryId` se resuelve del JWT.
+ * `reference` viaja en el path, `directoryId` se resuelve del JWT.
  * `providerModuleName` permite al marketplace rutear al publisher correcto
  * sin tener que persistir el mapping (el wallet-app sabe el moduleName
  * porque vino en la respuesta del authorize).

package/bin/walletFunding/dtos/CancelFundingRequest.js

@@ -13,7 +13,7 @@ exports.CancelFundingRequest = void 0;
 const class_validator_1 = require("class-validator");
 /**
  * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `fundingId` viaja en el path, `directoryId` se resuelve del JWT.
+ * `reference` viaja en el path, `directoryId` se resuelve del JWT.
  * `providerModuleName` permite al marketplace rutear al publisher correcto
  * sin tener que persistir el mapping (el wallet-app sabe el moduleName
  * porque vino en la respuesta del authorize).

package/bin/walletFunding/dtos/CancelFundingResponse.d.ts

@@ -7,7 +7,7 @@ import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum"
  * (marketplace ↔ connector). Idempotente: re-cancelar devuelve APPROVED.
  */
 export declare class CancelFundingResponse {
-    fundingId: string;
+    reference: string;
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
     message?: string;

package/bin/walletFunding/dtos/CancelWalletFundingResponse.d.ts

@@ -3,5 +3,5 @@ import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum"
 export declare class CancelWalletFundingResponse {
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
-    fundingId?: string;
+    reference?: string;
 }

package/bin/walletFunding/dtos/CreateFundingReferenceRequest.d.ts

@@ -1,6 +1,5 @@
 import { WalletFundingModeEnum } from "../enums/WalletFundingModeEnum";
 export declare class CreateFundingReferenceRequest {
-    fundingId: string;
     directoryId: string;
     walletAccountId: string;
     name: string;

package/bin/walletFunding/dtos/CreateFundingReferenceRequest.js

@@ -15,11 +15,6 @@ const WalletFundingModeEnum_1 = require("../enums/WalletFundingModeEnum");
 class CreateFundingReferenceRequest {
 }
 exports.CreateFundingReferenceRequest = CreateFundingReferenceRequest;
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CreateFundingReferenceRequest.prototype, "fundingId", void 0);
 __decorate([
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.MaxLength)(64),

package/bin/walletFunding/dtos/CreateFundingReferenceResponse.d.ts

@@ -2,7 +2,12 @@ import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPayme
 import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
 import { FundingProviderReferenceData } from "./FundingProviderReferenceData";
 export declare class CreateFundingReferenceResponse {
-    fundingId: string;
+    /**
+     * Referencia única generada por Equality/Passport (PK de
+     * EqualityFundingReference_GT). Identificador estable a lo largo del ciclo
+     * de vida — la app la usa para list/cancel.
+     */
+    reference: string;
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
     expiresAt?: string;

package/bin/walletFunding/dtos/CreditWalletFundingResponse.d.ts

@@ -3,6 +3,11 @@ import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum"
 export declare class CreditWalletFundingResponse {
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
+    /**
+     * Folio canónico del processor. El connector lo devuelve a Equality
+     * como `noAuthorization` (campo Alfanumérico según doc Passport).
+     * Antes había un `noAuthorization` separado generado por el connector;
+     * eliminado por simplicidad y para auto-idempotencia.
+     */
     transactionNumber?: string;
-    noAuthorization?: string;
 }

package/bin/walletFunding/dtos/ListWalletFundingReferencesResponse.d.ts

@@ -2,7 +2,8 @@ import { WalletFundingReferenceStatusEnum } from "../enums/WalletFundingReferenc
 import { WalletFundingModeEnum } from "../enums/WalletFundingModeEnum";
 import { FundingProviderReferenceData } from "./FundingProviderReferenceData";
 export declare class WalletFundingReferenceListItem {
-    fundingId: string;
+    /** Referencia Passport (PK de EqualityFundingReference_GT). */
+    reference: string;
     mode: WalletFundingModeEnum;
     amount?: number;
     currencyCode: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.105.0",
+  "version": "3.107.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/enums/Permission.ts

@@ -53,6 +53,10 @@ export enum Permission {
     PLATFORM_USER_DISABLE = 'platform.user.disable',
     PLATFORM_USER_ENABLE = 'platform.user.enable',
     PLATFORM_USER_DELETE = 'platform.user.delete',
+    // Crear/asignar usuarios platform de TU MISMO nivel (platform_admin → platform_admin).
+    // Espejo de tenant.user.create.lateral / retail.user.create.lateral: habilita allowOwnLevel
+    // en ScopeValidationService.canAssign para scope PLATFORM. DEC-052.
+    PLATFORM_USER_CREATE_LATERAL = 'platform.user.create.lateral',
     PLATFORM_ROLE_CREATE = 'platform.role.create',
     PLATFORM_ROLE_LIST = 'platform.role.list',
     PLATFORM_ROLE_UPDATE = 'platform.role.update',
@@ -334,6 +338,9 @@ export const PERMISSION_BIT_ORDER: readonly Permission[] = [
     // Append-only 2026-06-21: gate de acceso a la app web de Agents (gobernanza). Al FINAL para no
     // correr bits existentes (PERMS_VERSION cambia, pero los índices previos se conservan).
     Permission.AGENTS_APP_ACCESS,
+    // Append-only 2026-06-19: lateral platform (platform_super_admin asigna roles scope PLATFORM).
+    // Al FINAL para no correr bits existentes (PERMS_VERSION cambia, índices previos se conservan).
+    Permission.PLATFORM_USER_CREATE_LATERAL,
 ] as const;
 
 function djb2(input: string): number {

package/src/walletFunding/dtos/AuthorizeFundingResponse.ts

@@ -8,7 +8,8 @@ import { FundingProviderReferenceData } from "./FundingProviderReferenceData";
  * (barcodes, cadenas pagables) — opaco al front.
  */
 export class AuthorizeFundingResponse {
-    fundingId?: string;
+    /** Referencia Passport. Solo presente si status=APPROVED. */
+    reference?: string;
     status!: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
     /** ISO timestamp. */

package/src/walletFunding/dtos/AuthorizeWalletFundingResponse.ts

@@ -5,7 +5,7 @@ import { FundingProviderReferenceData } from "./FundingProviderReferenceData";
 export class AuthorizeWalletFundingResponse {
     status!: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
-    fundingId?: string;
+    reference?: string;
     expiresAt?: string;
     providerData?: FundingProviderReferenceData;
 }

package/src/walletFunding/dtos/CancelFundingReferenceRequest.ts

@@ -1,7 +1,8 @@
 import { IsString, MaxLength } from "class-validator";
 
 export class CancelFundingReferenceRequest {
-    @IsString() @MaxLength(64) fundingId!: string;
+    /** Referencia Passport (PK de EqualityFundingReference_GT). */
+    @IsString() @MaxLength(64) reference!: string;
     @IsString() @MaxLength(64) directoryId!: string;
     @IsString() @MaxLength(64) idempotencyKey!: string;
 }

package/src/walletFunding/dtos/CancelFundingReferenceResponse.ts

@@ -2,7 +2,7 @@ import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPayme
 import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
 
 export class CancelFundingReferenceResponse {
-    fundingId!: string;
+    reference!: string;
     status!: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
 }

package/src/walletFunding/dtos/CancelFundingRequest.ts

@@ -2,7 +2,7 @@ import { IsString, MaxLength } from "class-validator";
 
 /**
  * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `fundingId` viaja en el path, `directoryId` se resuelve del JWT.
+ * `reference` viaja en el path, `directoryId` se resuelve del JWT.
  * `providerModuleName` permite al marketplace rutear al publisher correcto
  * sin tener que persistir el mapping (el wallet-app sabe el moduleName
  * porque vino en la respuesta del authorize).

package/src/walletFunding/dtos/CancelFundingResponse.ts

@@ -8,7 +8,7 @@ import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum"
  * (marketplace ↔ connector). Idempotente: re-cancelar devuelve APPROVED.
  */
 export class CancelFundingResponse {
-    fundingId!: string;
+    reference!: string;
     status!: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
     message?: string;

package/src/walletFunding/dtos/CancelWalletFundingResponse.ts

@@ -4,5 +4,5 @@ import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum"
 export class CancelWalletFundingResponse {
     status!: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
-    fundingId?: string;
+    reference?: string;
 }

package/src/walletFunding/dtos/CreateFundingReferenceRequest.ts

@@ -5,7 +5,6 @@ import {
 import { WalletFundingModeEnum } from "../enums/WalletFundingModeEnum";
 
 export class CreateFundingReferenceRequest {
-    @IsString() @MaxLength(64) fundingId!: string;
     @IsString() @MaxLength(64) directoryId!: string;
     @IsString() @MaxLength(64) walletAccountId!: string;
     @IsString() @MaxLength(128) name!: string;

package/src/walletFunding/dtos/CreateFundingReferenceResponse.ts

@@ -3,7 +3,12 @@ import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum"
 import { FundingProviderReferenceData } from "./FundingProviderReferenceData";
 
 export class CreateFundingReferenceResponse {
-    fundingId!: string;
+    /**
+     * Referencia única generada por Equality/Passport (PK de
+     * EqualityFundingReference_GT). Identificador estable a lo largo del ciclo
+     * de vida — la app la usa para list/cancel.
+     */
+    reference!: string;
     status!: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
     expiresAt?: string;

package/src/walletFunding/dtos/CreditWalletFundingResponse.ts

@@ -4,6 +4,11 @@ import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum"
 export class CreditWalletFundingResponse {
     status!: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
+    /**
+     * Folio canónico del processor. El connector lo devuelve a Equality
+     * como `noAuthorization` (campo Alfanumérico según doc Passport).
+     * Antes había un `noAuthorization` separado generado por el connector;
+     * eliminado por simplicidad y para auto-idempotencia.
+     */
     transactionNumber?: string;
-    noAuthorization?: string;
 }

package/src/walletFunding/dtos/ListWalletFundingReferencesResponse.ts

@@ -3,7 +3,8 @@ import { WalletFundingModeEnum } from "../enums/WalletFundingModeEnum";
 import { FundingProviderReferenceData } from "./FundingProviderReferenceData";
 
 export class WalletFundingReferenceListItem {
-    fundingId!: string;
+    /** Referencia Passport (PK de EqualityFundingReference_GT). */
+    reference!: string;
     mode!: WalletFundingModeEnum;
     amount?: number;
     currencyCode!: string;