@fiado/type-kit 3.118.0 → 3.120.0

package/bin/places/enums/EstablishmentBrandEnum.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EstablishmentBrandEnum = void 0;
+var EstablishmentBrandEnum;
+(function (EstablishmentBrandEnum) {
+    EstablishmentBrandEnum["WALMART"] = "WALMART";
+    EstablishmentBrandEnum["SEVEN_ELEVEN"] = "SEVEN_ELEVEN";
+    EstablishmentBrandEnum["CVS"] = "CVS";
+    EstablishmentBrandEnum["DOLLAR_TREE"] = "DOLLAR_TREE";
+    // RITE_AID eliminada (2026-06-24): la cadena desapareció tras su bancarrota de 2025.
+})(EstablishmentBrandEnum || (exports.EstablishmentBrandEnum = EstablishmentBrandEnum = {}));

package/bin/places/enums/PlaceTypeEnum.d.ts

@@ -0,0 +1,4 @@
+export declare enum PlaceTypeEnum {
+    CashInUs = "CashInUs",
+    OfficeFiado = "OfficeFiado"
+}

package/bin/places/enums/PlaceTypeEnum.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlaceTypeEnum = void 0;
+var PlaceTypeEnum;
+(function (PlaceTypeEnum) {
+    PlaceTypeEnum["CashInUs"] = "CashInUs";
+    PlaceTypeEnum["OfficeFiado"] = "OfficeFiado";
+})(PlaceTypeEnum || (exports.PlaceTypeEnum = PlaceTypeEnum = {}));

package/bin/places/enums/ReportReasonEnum.d.ts

@@ -0,0 +1,5 @@
+export declare enum ReportReasonEnum {
+    NO_EXISTE = "NO_EXISTE",
+    CERRADO = "CERRADO",
+    UBICACION_INCORRECTA = "UBICACION_INCORRECTA"
+}

package/bin/places/enums/ReportReasonEnum.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReportReasonEnum = void 0;
+var ReportReasonEnum;
+(function (ReportReasonEnum) {
+    ReportReasonEnum["NO_EXISTE"] = "NO_EXISTE";
+    ReportReasonEnum["CERRADO"] = "CERRADO";
+    ReportReasonEnum["UBICACION_INCORRECTA"] = "UBICACION_INCORRECTA";
+})(ReportReasonEnum || (exports.ReportReasonEnum = ReportReasonEnum = {}));

package/bin/places/enums/ResolveReportedActionEnum.d.ts

@@ -0,0 +1,4 @@
+export declare enum ResolveReportedActionEnum {
+    CONFIRM = "CONFIRM",
+    DISMISS = "DISMISS"
+}

package/bin/places/enums/ResolveReportedActionEnum.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResolveReportedActionEnum = void 0;
+var ResolveReportedActionEnum;
+(function (ResolveReportedActionEnum) {
+    ResolveReportedActionEnum["CONFIRM"] = "CONFIRM";
+    ResolveReportedActionEnum["DISMISS"] = "DISMISS";
+})(ResolveReportedActionEnum || (exports.ResolveReportedActionEnum = ResolveReportedActionEnum = {}));

package/bin/places/index.d.ts

@@ -0,0 +1,10 @@
+export * from './dtos/EstablishmentDto';
+export * from './dtos/GetNearbyPlacesRequest';
+export * from './dtos/GetNearbyPlacesResponse';
+export * from './dtos/ReportPlaceRequest';
+export * from './dtos/ReportedPlaceDto';
+export * from './dtos/ResolveReportedPlaceRequest';
+export * from './enums/PlaceTypeEnum';
+export * from './enums/EstablishmentBrandEnum';
+export * from './enums/ReportReasonEnum';
+export * from './enums/ResolveReportedActionEnum';

package/bin/places/index.js

@@ -0,0 +1,28 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+//dtos
+__exportStar(require("./dtos/EstablishmentDto"), exports);
+__exportStar(require("./dtos/GetNearbyPlacesRequest"), exports);
+__exportStar(require("./dtos/GetNearbyPlacesResponse"), exports);
+__exportStar(require("./dtos/ReportPlaceRequest"), exports);
+__exportStar(require("./dtos/ReportedPlaceDto"), exports);
+__exportStar(require("./dtos/ResolveReportedPlaceRequest"), exports);
+//enums
+__exportStar(require("./enums/PlaceTypeEnum"), exports);
+__exportStar(require("./enums/EstablishmentBrandEnum"), exports);
+__exportStar(require("./enums/ReportReasonEnum"), exports);
+__exportStar(require("./enums/ResolveReportedActionEnum"), exports);

package/bin/platformRbac/application/Application.d.ts

@@ -8,16 +8,7 @@ export interface LevelDef {
 }
 export interface ApplicationSecurityPolicyDefault {
     mfaEnabled?: boolean;
-    mfaRequired?: boolean;
     methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
-    defaultPreferred?: 'TOTP' | 'EMAIL';
-    sessionTimeoutMin?: number;
-    passwordPolicy?: {
-        minLength: number;
-        requireSymbol: boolean;
-        requireNumber: boolean;
-        requireUppercase: boolean;
-    };
 }
 export interface ApplicationBrandingDefault {
     logoUrl?: string;
@@ -26,7 +17,6 @@ export interface ApplicationBrandingDefault {
     accentColor?: string;
     logoWidth?: number;
     faviconUrl?: string;
-    webappBaseUrl?: string;
 }
 export interface AutoregisterAllowedRole {
     roleId: string;

package/bin/platformRbac/dtos/CreateTenantRequest.d.ts

@@ -14,8 +14,6 @@ export declare class CreateTenantRequest {
     adminEmail: string;
     adminName: string;
     region: string;
-    mfaRequired?: boolean;
-    passwordMinLength?: number;
     tokenValidationMode?: TokenValidationMode;
     /** Tipo de tenant a crear. Si se omite, el onboarding aplica su default (hoy: retail). */
     tenantType?: TenantType;

package/bin/platformRbac/dtos/CreateTenantRequest.js

@@ -55,19 +55,6 @@ __decorate([
     (0, class_validator_1.IsString)(),
     __metadata("design:type", String)
 ], CreateTenantRequest.prototype, "region", void 0);
-__decorate([
-    (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsBoolean)(),
-    __metadata("design:type", Boolean)
-], CreateTenantRequest.prototype, "mfaRequired", void 0);
-__decorate([
-    (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsInt)(),
-    (0, class_validator_1.Min)(8),
-    __metadata("design:type", Number)
-], CreateTenantRequest.prototype, "passwordMinLength", void 0);
 __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsOptional)(),

package/bin/platformRbac/dtos/UpdateTenantAutoregisterRequest.d.ts

@@ -0,0 +1,26 @@
+import { PermissionScope } from '../enums/PermissionScope';
+/**
+ * Un rol auto-asignable de la allowlist anti-escalación (DEC-RBAC-038). Espejo validado de
+ * `AutoregisterAllowedRole` (interface plain de application/Application), usado como body de un
+ * endpoint backoffice → se hidrata con plainToInstance y se valida con class-validator.
+ */
+export declare class UpdateTenantAutoregisterAllowedRole {
+    roleId: string;
+    scope: PermissionScope;
+    allowedScopeRefs?: string[];
+}
+/**
+ * Body del PUT /tenants/{tenantId}/autoregister (backoffice, operación solo-platform — DEC-RBAC-050).
+ * Edita la config de autoregistro self-service del tenant (DEC-RBAC-038): master switch `enabled`,
+ * la allowlist anti-escalación `allowedRoles` (cada rol ⊆ roles del tenant — validado server-side) y
+ * el TTL del OTP. El permiso requerido es `platform.tenant.autoregister.manage` (scope PLATFORM): la
+ * allowlist es un catálogo centralizado/platform, no una config cosmética per-tenant.
+ *
+ * Se separa de `AutoregisterConfig` (interface plain, sin validators) porque éste es un boundary de
+ * entrada del lambda y debe validarse con class-validator (regla entradas tipadas + validadas).
+ */
+export declare class UpdateTenantAutoregisterRequest {
+    enabled: boolean;
+    allowedRoles: UpdateTenantAutoregisterAllowedRole[];
+    otpTtlSeconds?: number;
+}

package/bin/platformRbac/dtos/UpdateTenantAutoregisterRequest.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateTenantAutoregisterRequest = exports.UpdateTenantAutoregisterAllowedRole = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const PermissionScope_1 = require("../enums/PermissionScope");
+/**
+ * Un rol auto-asignable de la allowlist anti-escalación (DEC-RBAC-038). Espejo validado de
+ * `AutoregisterAllowedRole` (interface plain de application/Application), usado como body de un
+ * endpoint backoffice → se hidrata con plainToInstance y se valida con class-validator.
+ */
+class UpdateTenantAutoregisterAllowedRole {
+}
+exports.UpdateTenantAutoregisterAllowedRole = UpdateTenantAutoregisterAllowedRole;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], UpdateTenantAutoregisterAllowedRole.prototype, "roleId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEnum)(PermissionScope_1.PermissionScope),
+    __metadata("design:type", String)
+], UpdateTenantAutoregisterAllowedRole.prototype, "scope", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], UpdateTenantAutoregisterAllowedRole.prototype, "allowedScopeRefs", void 0);
+/**
+ * Body del PUT /tenants/{tenantId}/autoregister (backoffice, operación solo-platform — DEC-RBAC-050).
+ * Edita la config de autoregistro self-service del tenant (DEC-RBAC-038): master switch `enabled`,
+ * la allowlist anti-escalación `allowedRoles` (cada rol ⊆ roles del tenant — validado server-side) y
+ * el TTL del OTP. El permiso requerido es `platform.tenant.autoregister.manage` (scope PLATFORM): la
+ * allowlist es un catálogo centralizado/platform, no una config cosmética per-tenant.
+ *
+ * Se separa de `AutoregisterConfig` (interface plain, sin validators) porque éste es un boundary de
+ * entrada del lambda y debe validarse con class-validator (regla entradas tipadas + validadas).
+ */
+class UpdateTenantAutoregisterRequest {
+}
+exports.UpdateTenantAutoregisterRequest = UpdateTenantAutoregisterRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], UpdateTenantAutoregisterRequest.prototype, "enabled", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ValidateNested)({ each: true }),
+    (0, class_transformer_1.Type)(() => UpdateTenantAutoregisterAllowedRole),
+    __metadata("design:type", Array)
+], UpdateTenantAutoregisterRequest.prototype, "allowedRoles", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    __metadata("design:type", Number)
+], UpdateTenantAutoregisterRequest.prototype, "otpTtlSeconds", void 0);

package/bin/platformRbac/enums/Permission.d.ts

@@ -53,6 +53,7 @@ export declare enum Permission {
     PLATFORM_ROLE_DELETE = "platform.role.delete",
     PLATFORM_AUDIT_VIEW = "platform.audit.view",
     PLATFORM_TENANT_USERFIELDS_MANAGE = "platform.tenant.userfields.manage",
+    PLATFORM_TENANT_AUTOREGISTER_MANAGE = "platform.tenant.autoregister.manage",
     PLATFORM_APPLICATION_MANAGE = "platform.application.manage",
     TENANT_USER_CREATE = "tenant.user.create",
     TENANT_USER_CREATE_LATERAL = "tenant.user.create.lateral",

package/bin/platformRbac/enums/Permission.js

@@ -68,6 +68,9 @@ var Permission;
     Permission["PLATFORM_ROLE_DELETE"] = "platform.role.delete";
     Permission["PLATFORM_AUDIT_VIEW"] = "platform.audit.view";
     Permission["PLATFORM_TENANT_USERFIELDS_MANAGE"] = "platform.tenant.userfields.manage";
+    // DEC-RBAC-050: edición del autoregistro self-service del tenant (allowlist anti-escalación
+    // centralizada/platform). Espejo EXACTO de PLATFORM_TENANT_USERFIELDS_MANAGE (scope PLATFORM).
+    Permission["PLATFORM_TENANT_AUTOREGISTER_MANAGE"] = "platform.tenant.autoregister.manage";
     // DEC-RBAC-036: gestión de aplicaciones (plantillas) — reemplaza el reuso de rbac.catalog.manage en /applications.
     Permission["PLATFORM_APPLICATION_MANAGE"] = "platform.application.manage";
     // ====================================================
@@ -349,6 +352,9 @@ exports.PERMISSION_BIT_ORDER = [
     // Append-only 2026-06-24 (DEC-RBAC-038): gestión de scope-entities de nivel genérico (scope-bound).
     // Al FINAL para no correr bits existentes (PERMS_VERSION cambia, índices previos se conservan).
     Permission.TENANT_LEVEL_MANAGE,
+    // Append-only 2026-06-25 (DEC-RBAC-050): edición del autoregistro self-service del tenant (allowlist
+    // anti-escalación). Al FINAL para no correr bits existentes (PERMS_VERSION cambia, índices previos se conservan).
+    Permission.PLATFORM_TENANT_AUTOREGISTER_MANAGE,
 ];
 function djb2(input) {
     let h = 5381;

package/bin/platformRbac/index.d.ts

@@ -28,6 +28,7 @@ export * from './dtos/CreateTenantRequest';
 export type { CreateTenantResponse } from './dtos/CreateTenantResponse';
 export * from './dtos/UpdateTenantSecurityPolicyRequest';
 export type { TenantSecurityPolicyResponse } from './dtos/TenantSecurityPolicyResponse';
+export * from './dtos/UpdateTenantAutoregisterRequest';
 export { TenantType, TENANT_TYPES, levelsOf, tableSuffixForLevel, scopeRankOrder } from './tenantTypes';
 export { UserFieldType } from './enums/UserFieldType';
 export type { UserFieldDef } from './dtos/UserFieldDef';

package/bin/platformRbac/index.js

@@ -64,6 +64,10 @@ __exportStar(require("./dtos/CreateTenantRequest"), exports);
 // UpdateTenantSecurityPolicyRequest lleva decoradores class-validator → export de valor;
 // TenantSecurityPolicyResponse es interface plain → type-only.
 __exportStar(require("./dtos/UpdateTenantSecurityPolicyRequest"), exports);
+// Autoregistro editable por tenant (DEC-RBAC-050) — body del PUT backoffice /tenants/{id}/autoregister.
+// UpdateTenantAutoregisterRequest + su nested AutoregisterAllowedRole llevan decoradores class-validator
+// → export de valor (se hidratan con plainToInstance en runtime).
+__exportStar(require("./dtos/UpdateTenantAutoregisterRequest"), exports);
 // A1 — registro data-driven de tenant-types (niveles debajo de TENANT, por tipo).
 // Consumido por ScopeValidationService._rank vía scopeRankOrder() y por los seeds.
 // Accesible bajo el namespace PlatformRbac (el index raíz hace export * as PlatformRbac).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.118.0",
+  "version": "3.120.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/index.ts

@@ -3,6 +3,8 @@ export * as Account from './account';
 export * as Activity from './activity';
 export * as Beneficiary from './beneficiary';
 export * as Address from './address';
+export * as Places from './places';
+export * as Offices from './offices';
 export * as App from './app';
 export * as Authentication from './authentication';
 export * as Card from './card';

package/src/offices/dtos/CreateOfficeRequest.ts

@@ -0,0 +1,39 @@
+import { IsArray, IsEnum, IsNotEmpty, IsNumber, IsOptional, IsString, Max, Min } from 'class-validator';
+import { OperationSchedule } from '../../address/dtos/OperationSchedule';
+import { OfficeStatusEnum } from '../enums/OfficeStatusEnum';
+
+/**
+ * Alta de oficina desde backoffice. El backoffice envía lat/lng directo (Opción A);
+ * el lambda calcula el h3Cell. NO se geocodifica.
+ */
+export class CreateOfficeRequest {
+    @IsString()
+    @IsNotEmpty()
+    name: string;
+
+    @IsString()
+    @IsNotEmpty()
+    address: string;
+
+    @IsNumber()
+    @Min(-90)
+    @Max(90)
+    latitude: number;
+
+    @IsNumber()
+    @Min(-180)
+    @Max(180)
+    longitude: number;
+
+    @IsOptional()
+    @IsString()
+    phone?: string;
+
+    @IsOptional()
+    @IsArray()
+    schedule?: OperationSchedule[];
+
+    @IsOptional()
+    @IsEnum(OfficeStatusEnum)
+    status?: OfficeStatusEnum;
+}

package/src/offices/dtos/OfficeDto.ts

@@ -0,0 +1,17 @@
+import { OperationSchedule } from '../../address/dtos/OperationSchedule';
+import { OfficeStatusEnum } from '../enums/OfficeStatusEnum';
+
+/**
+ * Oficina de Fiado, gestionada por el backoffice (fuente de verdad, no HERE).
+ * Response DTO — sin decoradores.
+ */
+export class OfficeDto {
+    officeId: string;
+    name: string;
+    address: string;
+    latitude: number;
+    longitude: number;
+    phone?: string;
+    schedule?: OperationSchedule[];
+    status: OfficeStatusEnum;
+}

package/src/offices/dtos/UpdateOfficeRequest.ts

@@ -0,0 +1,41 @@
+import { IsArray, IsEnum, IsNumber, IsOptional, IsString, Max, Min } from 'class-validator';
+import { OperationSchedule } from '../../address/dtos/OperationSchedule';
+import { OfficeStatusEnum } from '../enums/OfficeStatusEnum';
+
+/**
+ * Edición de oficina desde backoffice. Todos los campos opcionales.
+ * Si cambian lat/lng, el lambda recalcula el h3Cell.
+ */
+export class UpdateOfficeRequest {
+    @IsOptional()
+    @IsString()
+    name?: string;
+
+    @IsOptional()
+    @IsString()
+    address?: string;
+
+    @IsOptional()
+    @IsNumber()
+    @Min(-90)
+    @Max(90)
+    latitude?: number;
+
+    @IsOptional()
+    @IsNumber()
+    @Min(-180)
+    @Max(180)
+    longitude?: number;
+
+    @IsOptional()
+    @IsString()
+    phone?: string;
+
+    @IsOptional()
+    @IsArray()
+    schedule?: OperationSchedule[];
+
+    @IsOptional()
+    @IsEnum(OfficeStatusEnum)
+    status?: OfficeStatusEnum;
+}

package/src/offices/enums/OfficeStatusEnum.ts

@@ -0,0 +1,4 @@
+export enum OfficeStatusEnum {
+    ACTIVE = 'ACTIVE',
+    INACTIVE = 'INACTIVE',
+}

package/src/offices/index.ts

@@ -0,0 +1,7 @@
+//dtos
+export * from './dtos/OfficeDto';
+export * from './dtos/CreateOfficeRequest';
+export * from './dtos/UpdateOfficeRequest';
+
+//enums
+export * from './enums/OfficeStatusEnum';

package/src/places/dtos/EstablishmentDto.ts

@@ -0,0 +1,21 @@
+import { EstablishmentBrandEnum } from '../enums/EstablishmentBrandEnum';
+
+/**
+ * Establecimiento (tienda de cash-in) servido desde el cache de HERE.
+ * Response DTO — sin decoradores de validación.
+ */
+export class EstablishmentDto {
+    placeId: string;
+    name: string;
+    brand: EstablishmentBrandEnum;
+    latitude: number;
+    longitude: number;
+    address: string;
+    categories: string[];
+    isOpen: boolean | null;
+    /** epoch ms del último refresco desde HERE (UI "verificado hace X días") */
+    lastRefreshed: number;
+    /** true si la celda alcanzó el umbral de reportes de "no existe" */
+    reportedMissing?: boolean;
+    reportCount?: number;
+}

package/src/places/dtos/GetNearbyPlacesRequest.ts

@@ -0,0 +1,23 @@
+import { ArrayNotEmpty, IsArray, IsEnum, IsNumber, Max, Min } from 'class-validator';
+import { PlaceTypeEnum } from '../enums/PlaceTypeEnum';
+
+/**
+ * Búsqueda unificada de lugares cercanos.
+ * `types` indica qué devolver: CashInUs (tiendas) y/o OfficeFiado (oficinas).
+ */
+export class GetNearbyPlacesRequest {
+    @IsNumber()
+    @Min(-90)
+    @Max(90)
+    latitude: number;
+
+    @IsNumber()
+    @Min(-180)
+    @Max(180)
+    longitude: number;
+
+    @IsArray()
+    @ArrayNotEmpty()
+    @IsEnum(PlaceTypeEnum, { each: true })
+    types: PlaceTypeEnum[];
+}

package/src/places/dtos/GetNearbyPlacesResponse.ts

@@ -0,0 +1,10 @@
+import { EstablishmentDto } from './EstablishmentDto';
+import { OfficeDto } from '../../offices/dtos/OfficeDto';
+
+/**
+ * Respuesta de la búsqueda unificada. Solo se incluyen los tipos pedidos en `types`.
+ */
+export class GetNearbyPlacesResponse {
+    cashInUs?: EstablishmentDto[];
+    officeFiado?: OfficeDto[];
+}

package/src/places/dtos/ReportPlaceRequest.ts

@@ -0,0 +1,27 @@
+import { IsEnum, IsNotEmpty, IsNumber, IsOptional, IsString, Max, Min } from 'class-validator';
+import { ReportReasonEnum } from '../enums/ReportReasonEnum';
+
+/**
+ * Reporte del usuario de que una tienda no existe / está cerrada.
+ * Se cuenta solo si el usuario está cerca del lugar (validado en el lambda).
+ * El identificador del usuario sale del token (directoryId), NO de este request.
+ */
+export class ReportPlaceRequest {
+    @IsString()
+    @IsNotEmpty()
+    placeId: string;
+
+    @IsNumber()
+    @Min(-90)
+    @Max(90)
+    latitude: number;
+
+    @IsNumber()
+    @Min(-180)
+    @Max(180)
+    longitude: number;
+
+    @IsOptional()
+    @IsEnum(ReportReasonEnum)
+    reason?: ReportReasonEnum;
+}

package/src/places/dtos/ReportedPlaceDto.ts

@@ -0,0 +1,14 @@
+/**
+ * Tienda reportada como inexistente, para revisión en backoffice.
+ * Response DTO — sin decoradores.
+ */
+export class ReportedPlaceDto {
+    placeId: string;
+    h3Cell: string;
+    name: string;
+    reportCount: number;
+    flagged: boolean;
+    suppressed: boolean;
+    /** epoch ms del último reporte */
+    lastReportAt: number;
+}

package/src/places/dtos/ResolveReportedPlaceRequest.ts

@@ -0,0 +1,19 @@
+import { IsEnum, IsNotEmpty, IsString } from 'class-validator';
+import { ResolveReportedActionEnum } from '../enums/ResolveReportedActionEnum';
+
+/**
+ * Resolución del backoffice sobre una tienda reportada.
+ * CONFIRM = ocultar definitivo (sobrevive al refresco de HERE); DISMISS = limpiar.
+ */
+export class ResolveReportedPlaceRequest {
+    @IsString()
+    @IsNotEmpty()
+    placeId: string;
+
+    @IsString()
+    @IsNotEmpty()
+    h3Cell: string;
+
+    @IsEnum(ResolveReportedActionEnum)
+    action: ResolveReportedActionEnum;
+}

package/src/places/enums/EstablishmentBrandEnum.ts

@@ -0,0 +1,7 @@
+export enum EstablishmentBrandEnum {
+    WALMART = 'WALMART',
+    SEVEN_ELEVEN = 'SEVEN_ELEVEN',
+    CVS = 'CVS',
+    DOLLAR_TREE = 'DOLLAR_TREE',
+    // RITE_AID eliminada (2026-06-24): la cadena desapareció tras su bancarrota de 2025.
+}

package/src/places/enums/PlaceTypeEnum.ts

@@ -0,0 +1,4 @@
+export enum PlaceTypeEnum {
+    CashInUs = 'CashInUs',
+    OfficeFiado = 'OfficeFiado',
+}

package/src/places/enums/ReportReasonEnum.ts

@@ -0,0 +1,5 @@
+export enum ReportReasonEnum {
+    NO_EXISTE = 'NO_EXISTE',
+    CERRADO = 'CERRADO',
+    UBICACION_INCORRECTA = 'UBICACION_INCORRECTA',
+}

package/src/places/enums/ResolveReportedActionEnum.ts

@@ -0,0 +1,4 @@
+export enum ResolveReportedActionEnum {
+    CONFIRM = 'CONFIRM',
+    DISMISS = 'DISMISS',
+}

package/src/places/index.ts

@@ -0,0 +1,13 @@
+//dtos
+export * from './dtos/EstablishmentDto';
+export * from './dtos/GetNearbyPlacesRequest';
+export * from './dtos/GetNearbyPlacesResponse';
+export * from './dtos/ReportPlaceRequest';
+export * from './dtos/ReportedPlaceDto';
+export * from './dtos/ResolveReportedPlaceRequest';
+
+//enums
+export * from './enums/PlaceTypeEnum';
+export * from './enums/EstablishmentBrandEnum';
+export * from './enums/ReportReasonEnum';
+export * from './enums/ResolveReportedActionEnum';

package/src/platformRbac/application/Application.ts

@@ -11,16 +11,15 @@ export interface LevelDef {
 export interface ApplicationSecurityPolicyDefault {
     // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
     mfaEnabled?: boolean;
-    mfaRequired?: boolean;
     methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
-    defaultPreferred?: 'TOTP' | 'EMAIL';
-    sessionTimeoutMin?: number;
-    passwordPolicy?: { minLength: number; requireSymbol: boolean; requireNumber: boolean; requireUppercase: boolean };
+    // DEC-RBAC-051: purgados mfaRequired / defaultPreferred / sessionTimeoutMin (write-only sin enforcement).
+    // DEC-RBAC-052: passwordPolicy deja de ser per-tenant → política global por env vars (Cognito enforce).
 }
 
 export interface ApplicationBrandingDefault {
     logoUrl?: string; primaryColor?: string; secondaryColor?: string; accentColor?: string;
-    logoWidth?: number; faviconUrl?: string; webappBaseUrl?: string;
+    logoWidth?: number; faviconUrl?: string;
+    // DEC-RBAC-053: webappBaseUrl purgado (write-only/muerto, nadie lo consume).
 }
 
 // DEC-RBAC-038: config de autoregistro self-service. Promovido desde el tipo local