@fiado/type-kit 3.112.0 → 3.114.0

package/_test_/unit/platformRbac/enums/__snapshots__/permissionBits.test.ts.snap

@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
-exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `488222087`;
+exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `643213674`;
 
 exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe ante cualquier reorden/inserción) 1`] = `
 [
@@ -124,5 +124,6 @@ exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe an
   "agents.app.access",
   "platform.user.create.lateral",
   "platform.application.manage",
+  "tenant.level.manage",
 ]
 `;

package/bin/platformRbac/dtos/CompleteMyProfileRequest.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
+ * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
+ * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
+ */
+export declare class CompleteMyProfileRequest {
+    displayName: string;
+    customFields?: Record<string, string>;
+}

package/bin/platformRbac/dtos/CompleteMyProfileRequest.js

@@ -0,0 +1,34 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompleteMyProfileRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
+ * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
+ * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
+ */
+class CompleteMyProfileRequest {
+}
+exports.CompleteMyProfileRequest = CompleteMyProfileRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CompleteMyProfileRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], CompleteMyProfileRequest.prototype, "customFields", void 0);

package/bin/platformRbac/dtos/SelfRegisterCompleteRequest.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
+ * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
+ * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
+ * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ */
+export declare class SelfRegisterCompleteRequest {
+    tenantId: string;
+    email: string;
+    completionToken: string;
+    password: string;
+    displayName?: string;
+    customFields?: Record<string, string>;
+}
+/** Respuesta del complete. El usuario nace ACTIVE; `profileComplete` indica si falta completar perfil. */
+export interface SelfRegisterCompleteResponse {
+    cognitoSub: string;
+    profileComplete: boolean;
+}

package/bin/platformRbac/dtos/SelfRegisterCompleteRequest.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelfRegisterCompleteRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
+ * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
+ * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
+ * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ */
+class SelfRegisterCompleteRequest {
+}
+exports.SelfRegisterCompleteRequest = SelfRegisterCompleteRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "completionToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MinLength)(8),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "password", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], SelfRegisterCompleteRequest.prototype, "customFields", void 0);

package/bin/platformRbac/dtos/SelfRegisterStartRequest.d.ts

@@ -0,0 +1,18 @@
+import { PermissionScope } from '../enums/PermissionScope';
+/**
+ * Body del POST /self-register/start (público, anónimo). DEC-RBAC-030/031.
+ * El `roleId`/`scope`/`scopeRef` los manda el front pero el server los valida contra la allowlist
+ * del tenant (`autoregister.allowedRoles`) — guarda anti-escalación. NO incluye campos obligatorios:
+ * se completan post-MFA (DEC-RBAC-034). El email se normaliza lowercase server-side.
+ */
+export declare class SelfRegisterStartRequest {
+    tenantId: string;
+    email: string;
+    roleId: string;
+    scope: PermissionScope;
+    scopeRef: string;
+}
+/** Respuesta del start. `expiresAt` epoch ms del registro pendiente. Genérica también en los caminos de rechazo silencioso (anti-enumeración). */
+export interface SelfRegisterStartResponse {
+    expiresAt: number;
+}

package/bin/platformRbac/dtos/SelfRegisterStartRequest.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelfRegisterStartRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const PermissionScope_1 = require("../enums/PermissionScope");
+/**
+ * Body del POST /self-register/start (público, anónimo). DEC-RBAC-030/031.
+ * El `roleId`/`scope`/`scopeRef` los manda el front pero el server los valida contra la allowlist
+ * del tenant (`autoregister.allowedRoles`) — guarda anti-escalación. NO incluye campos obligatorios:
+ * se completan post-MFA (DEC-RBAC-034). El email se normaliza lowercase server-side.
+ */
+class SelfRegisterStartRequest {
+}
+exports.SelfRegisterStartRequest = SelfRegisterStartRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "roleId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEnum)(PermissionScope_1.PermissionScope),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "scope", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "scopeRef", void 0);

package/bin/platformRbac/dtos/SelfRegisterVerifyOtpRequest.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Body del POST /self-register/verify-otp (público, anónimo). DEC-RBAC-032.
+ * El OTP lo verifica `fiado-messages-lambda` (one-shot). En éxito el server devuelve un
+ * `completionToken` one-time que `complete` debe presentar.
+ */
+export declare class SelfRegisterVerifyOtpRequest {
+    tenantId: string;
+    email: string;
+    otp: string;
+}
+/** Respuesta del verify-otp. `completionToken` one-time para el paso `complete`. */
+export interface SelfRegisterVerifyOtpResponse {
+    completionToken: string;
+}

package/bin/platformRbac/dtos/SelfRegisterVerifyOtpRequest.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelfRegisterVerifyOtpRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Body del POST /self-register/verify-otp (público, anónimo). DEC-RBAC-032.
+ * El OTP lo verifica `fiado-messages-lambda` (one-shot). En éxito el server devuelve un
+ * `completionToken` one-time que `complete` debe presentar.
+ */
+class SelfRegisterVerifyOtpRequest {
+}
+exports.SelfRegisterVerifyOtpRequest = SelfRegisterVerifyOtpRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterVerifyOtpRequest.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], SelfRegisterVerifyOtpRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterVerifyOtpRequest.prototype, "otp", void 0);

package/bin/platformRbac/enums/Permission.d.ts

@@ -77,6 +77,7 @@ export declare enum Permission {
     TENANT_SECURITY_POLICY_MANAGE = "tenant.security.policy.manage",
     TENANT_BRANDING_MANAGE = "tenant.branding.manage",
     TENANT_AUDIT_VIEW = "tenant.audit.view",
+    TENANT_LEVEL_MANAGE = "tenant.level.manage",
     RETAIL_USER_CREATE = "retail.user.create",
     RETAIL_USER_CREATE_LATERAL = "retail.user.create.lateral",
     RETAIL_USER_READ = "retail.user.read",

package/bin/platformRbac/enums/Permission.js

@@ -101,6 +101,8 @@ var Permission;
     Permission["TENANT_SECURITY_POLICY_MANAGE"] = "tenant.security.policy.manage";
     Permission["TENANT_BRANDING_MANAGE"] = "tenant.branding.manage";
     Permission["TENANT_AUDIT_VIEW"] = "tenant.audit.view";
+    // DEC-RBAC-038: gestión de scope-entities de nivel genérico — crear/editar/borrar entidades del nivel inferior; scope-bound.
+    Permission["TENANT_LEVEL_MANAGE"] = "tenant.level.manage";
     // ====================================================
     // RETAIL — catálogo + inventario + ventas
     // ====================================================
@@ -344,6 +346,9 @@ exports.PERMISSION_BIT_ORDER = [
     // Append-only 2026-06-24 (DEC-RBAC-036): gate dedicada de gestión de aplicaciones (plantillas).
     // Al FINAL para no correr bits existentes (PERMS_VERSION cambia, índices previos se conservan).
     Permission.PLATFORM_APPLICATION_MANAGE,
+    // Append-only 2026-06-24 (DEC-RBAC-038): gestión de scope-entities de nivel genérico (scope-bound).
+    // Al FINAL para no correr bits existentes (PERMS_VERSION cambia, índices previos se conservan).
+    Permission.TENANT_LEVEL_MANAGE,
 ];
 function djb2(input) {
     let h = 5381;

package/bin/platformRbac/index.d.ts

@@ -39,3 +39,7 @@ export * from './enums/PermissionKind';
 export type { LevelDef, ApplicationSecurityPolicyDefault, ApplicationBrandingDefault, ApplicationDefaults, SeedRole, Application, } from './application/Application';
 export type { ApplicationPermission } from './application/ApplicationPermission';
 export type { CreateApplicationRequest, UpdateApplicationRequest, UpsertApplicationPermissionRequest, } from './application/requests';
+export * from './dtos/SelfRegisterStartRequest';
+export * from './dtos/SelfRegisterVerifyOtpRequest';
+export * from './dtos/SelfRegisterCompleteRequest';
+export * from './dtos/CompleteMyProfileRequest';

package/bin/platformRbac/index.js

@@ -86,3 +86,10 @@ __exportStar(require("./dtos/UpdateUserFieldRequest"), exports);
 // los requests son interfaces plain (sin decoradores class-validator) → type-only.
 __exportStar(require("./enums/ApplicationStatus"), exports);
 __exportStar(require("./enums/PermissionKind"), exports);
+// Autoregistro self-service por tenant (DEC-RBAC-030..034). Los Request llevan decoradores
+// class-validator (export de valor — se hidratan con plainToInstance); los Response son interfaces
+// plain (type-only). Consumidos por los endpoints públicos de platform-rbac-business + el gate de perfil.
+__exportStar(require("./dtos/SelfRegisterStartRequest"), exports);
+__exportStar(require("./dtos/SelfRegisterVerifyOtpRequest"), exports);
+__exportStar(require("./dtos/SelfRegisterCompleteRequest"), exports);
+__exportStar(require("./dtos/CompleteMyProfileRequest"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.112.0",
+  "version": "3.114.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/dtos/CompleteMyProfileRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsObject, IsOptional, IsString } from 'class-validator';
+
+/**
+ * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
+ * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
+ * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
+ */
+export class CompleteMyProfileRequest {
+    @Expose() @IsString() @IsNotEmpty() displayName!: string;
+    @Expose() @IsOptional() @IsObject() customFields?: Record<string, string>;
+}

package/src/platformRbac/dtos/SelfRegisterCompleteRequest.ts

@@ -0,0 +1,25 @@
+import { Expose } from 'class-transformer';
+import { IsEmail, IsNotEmpty, IsObject, IsOptional, IsString, MinLength } from 'class-validator';
+
+/**
+ * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
+ * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
+ * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
+ * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ */
+export class SelfRegisterCompleteRequest {
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+    @Expose() @IsEmail() email!: string;
+    @Expose() @IsString() @IsNotEmpty() completionToken!: string;
+    @Expose() @IsString() @MinLength(8) password!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsOptional() @IsObject() customFields?: Record<string, string>;
+}
+
+/** Respuesta del complete. El usuario nace ACTIVE; `profileComplete` indica si falta completar perfil. */
+export interface SelfRegisterCompleteResponse {
+    cognitoSub: string;
+    profileComplete: boolean;
+}

package/src/platformRbac/dtos/SelfRegisterStartRequest.ts

@@ -0,0 +1,22 @@
+import { Expose } from 'class-transformer';
+import { IsEmail, IsEnum, IsNotEmpty, IsString } from 'class-validator';
+import { PermissionScope } from '../enums/PermissionScope';
+
+/**
+ * Body del POST /self-register/start (público, anónimo). DEC-RBAC-030/031.
+ * El `roleId`/`scope`/`scopeRef` los manda el front pero el server los valida contra la allowlist
+ * del tenant (`autoregister.allowedRoles`) — guarda anti-escalación. NO incluye campos obligatorios:
+ * se completan post-MFA (DEC-RBAC-034). El email se normaliza lowercase server-side.
+ */
+export class SelfRegisterStartRequest {
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+    @Expose() @IsEmail() email!: string;
+    @Expose() @IsString() @IsNotEmpty() roleId!: string;
+    @Expose() @IsEnum(PermissionScope) scope!: PermissionScope;
+    @Expose() @IsString() @IsNotEmpty() scopeRef!: string;
+}
+
+/** Respuesta del start. `expiresAt` epoch ms del registro pendiente. Genérica también en los caminos de rechazo silencioso (anti-enumeración). */
+export interface SelfRegisterStartResponse {
+    expiresAt: number;
+}

package/src/platformRbac/dtos/SelfRegisterVerifyOtpRequest.ts

@@ -0,0 +1,18 @@
+import { Expose } from 'class-transformer';
+import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
+
+/**
+ * Body del POST /self-register/verify-otp (público, anónimo). DEC-RBAC-032.
+ * El OTP lo verifica `fiado-messages-lambda` (one-shot). En éxito el server devuelve un
+ * `completionToken` one-time que `complete` debe presentar.
+ */
+export class SelfRegisterVerifyOtpRequest {
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+    @Expose() @IsEmail() email!: string;
+    @Expose() @IsString() @IsNotEmpty() otp!: string;
+}
+
+/** Respuesta del verify-otp. `completionToken` one-time para el paso `complete`. */
+export interface SelfRegisterVerifyOtpResponse {
+    completionToken: string;
+}

package/src/platformRbac/enums/Permission.ts

@@ -97,6 +97,8 @@ export enum Permission {
     TENANT_SECURITY_POLICY_MANAGE = 'tenant.security.policy.manage',
     TENANT_BRANDING_MANAGE = 'tenant.branding.manage',
     TENANT_AUDIT_VIEW = 'tenant.audit.view',
+    // DEC-RBAC-038: gestión de scope-entities de nivel genérico — crear/editar/borrar entidades del nivel inferior; scope-bound.
+    TENANT_LEVEL_MANAGE = 'tenant.level.manage',
 
     // ====================================================
     // RETAIL — catálogo + inventario + ventas
@@ -346,6 +348,9 @@ export const PERMISSION_BIT_ORDER: readonly Permission[] = [
     // Append-only 2026-06-24 (DEC-RBAC-036): gate dedicada de gestión de aplicaciones (plantillas).
     // Al FINAL para no correr bits existentes (PERMS_VERSION cambia, índices previos se conservan).
     Permission.PLATFORM_APPLICATION_MANAGE,
+    // Append-only 2026-06-24 (DEC-RBAC-038): gestión de scope-entities de nivel genérico (scope-bound).
+    // Al FINAL para no correr bits existentes (PERMS_VERSION cambia, índices previos se conservan).
+    Permission.TENANT_LEVEL_MANAGE,
 ] as const;
 
 function djb2(input: string): number {

package/src/platformRbac/index.ts

@@ -93,3 +93,11 @@ export type {
     UpdateApplicationRequest,
     UpsertApplicationPermissionRequest,
 } from './application/requests';
+
+// Autoregistro self-service por tenant (DEC-RBAC-030..034). Los Request llevan decoradores
+// class-validator (export de valor — se hidratan con plainToInstance); los Response son interfaces
+// plain (type-only). Consumidos por los endpoints públicos de platform-rbac-business + el gate de perfil.
+export * from './dtos/SelfRegisterStartRequest';
+export * from './dtos/SelfRegisterVerifyOtpRequest';
+export * from './dtos/SelfRegisterCompleteRequest';
+export * from './dtos/CompleteMyProfileRequest';