@fiado/type-kit 3.119.0 → 3.120.0

package/src/platformRbac/application/Application.ts

@@ -1,60 +1,59 @@
-import { PermissionScope } from '../enums/PermissionScope';
-import { ApplicationStatus } from '../enums/ApplicationStatus';
-import type { UserFieldDef } from '../dtos/UserFieldDef';
-import type { TokenValidationMode } from '../enums/TokenValidationMode';
-
-export interface LevelDef {
-    level: PermissionScope; // LEVEL_1 | LEVEL_2 | LEVEL_3
-    displayName: string;
-}
-
-export interface ApplicationSecurityPolicyDefault {
-    // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
-    mfaEnabled?: boolean;
-    mfaRequired?: boolean;
-    methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
-    defaultPreferred?: 'TOTP' | 'EMAIL';
-    sessionTimeoutMin?: number;
-    passwordPolicy?: { minLength: number; requireSymbol: boolean; requireNumber: boolean; requireUppercase: boolean };
-}
-
-export interface ApplicationBrandingDefault {
-    logoUrl?: string; primaryColor?: string; secondaryColor?: string; accentColor?: string;
-    logoWidth?: number; faviconUrl?: string; webappBaseUrl?: string;
-}
-
-// DEC-RBAC-038: config de autoregistro self-service. Promovido desde el tipo local
-// `PlatformTenantConfigRow.AutoregisterConfig` del platform-rbac-business a shape compartido
-// (patrón stub→swap DEC-001). `allowedRoles` es la allowlist anti-escalación que valida el
-// server contra el roleId/scope/scopeRef del SelfRegisterStartRequest.
-export interface AutoregisterAllowedRole {
-    roleId: string;
-    scope: PermissionScope;
-    allowedScopeRefs?: string[];
-}
-
-export interface AutoregisterConfig {
-    enabled: boolean;
-    allowedRoles: AutoregisterAllowedRole[];
-    otpTtlSeconds?: number;
-}
-
-export interface ApplicationDefaults {
-    externalScopeLevels?: PermissionScope[];
-    userFieldDefs?: UserFieldDef[];
-    securityPolicy?: ApplicationSecurityPolicyDefault;
-    brandingConfig?: ApplicationBrandingDefault;
-    tokenValidationMode?: TokenValidationMode;
-    autoregister?: AutoregisterConfig;
-}
-
-export interface SeedRole {
-    roleId: string; displayName: string; description?: string;
-    permissions: string[]; scope: PermissionScope; isSystem: boolean;
-}
-
-export interface Application {
-    applicationId: string; displayName: string; levels: LevelDef[];
-    defaults: ApplicationDefaults; seedRoles: SeedRole[]; status: ApplicationStatus;
-    createdAt?: number; updatedAt?: number;
-}
+import { PermissionScope } from '../enums/PermissionScope';
+import { ApplicationStatus } from '../enums/ApplicationStatus';
+import type { UserFieldDef } from '../dtos/UserFieldDef';
+import type { TokenValidationMode } from '../enums/TokenValidationMode';
+
+export interface LevelDef {
+    level: PermissionScope; // LEVEL_1 | LEVEL_2 | LEVEL_3
+    displayName: string;
+}
+
+export interface ApplicationSecurityPolicyDefault {
+    // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
+    mfaEnabled?: boolean;
+    methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
+    // DEC-RBAC-051: purgados mfaRequired / defaultPreferred / sessionTimeoutMin (write-only sin enforcement).
+    // DEC-RBAC-052: passwordPolicy deja de ser per-tenant → política global por env vars (Cognito enforce).
+}
+
+export interface ApplicationBrandingDefault {
+    logoUrl?: string; primaryColor?: string; secondaryColor?: string; accentColor?: string;
+    logoWidth?: number; faviconUrl?: string;
+    // DEC-RBAC-053: webappBaseUrl purgado (write-only/muerto, nadie lo consume).
+}
+
+// DEC-RBAC-038: config de autoregistro self-service. Promovido desde el tipo local
+// `PlatformTenantConfigRow.AutoregisterConfig` del platform-rbac-business a shape compartido
+// (patrón stub→swap DEC-001). `allowedRoles` es la allowlist anti-escalación que valida el
+// server contra el roleId/scope/scopeRef del SelfRegisterStartRequest.
+export interface AutoregisterAllowedRole {
+    roleId: string;
+    scope: PermissionScope;
+    allowedScopeRefs?: string[];
+}
+
+export interface AutoregisterConfig {
+    enabled: boolean;
+    allowedRoles: AutoregisterAllowedRole[];
+    otpTtlSeconds?: number;
+}
+
+export interface ApplicationDefaults {
+    externalScopeLevels?: PermissionScope[];
+    userFieldDefs?: UserFieldDef[];
+    securityPolicy?: ApplicationSecurityPolicyDefault;
+    brandingConfig?: ApplicationBrandingDefault;
+    tokenValidationMode?: TokenValidationMode;
+    autoregister?: AutoregisterConfig;
+}
+
+export interface SeedRole {
+    roleId: string; displayName: string; description?: string;
+    permissions: string[]; scope: PermissionScope; isSystem: boolean;
+}
+
+export interface Application {
+    applicationId: string; displayName: string; levels: LevelDef[];
+    defaults: ApplicationDefaults; seedRoles: SeedRole[]; status: ApplicationStatus;
+    createdAt?: number; updatedAt?: number;
+}

package/src/platformRbac/application/ApplicationPermission.ts

@@ -1,8 +1,8 @@
-import { PermissionScope } from '../enums/PermissionScope';
-import { PermissionKind } from '../enums/PermissionKind';
-
-export interface ApplicationPermission {
-    applicationId: string; permissionKey: string; displayName: string; description: string;
-    scope: PermissionScope; kind: PermissionKind; category?: string;
-    createdAt?: number; updatedAt?: number;
-}
+import { PermissionScope } from '../enums/PermissionScope';
+import { PermissionKind } from '../enums/PermissionKind';
+
+export interface ApplicationPermission {
+    applicationId: string; permissionKey: string; displayName: string; description: string;
+    scope: PermissionScope; kind: PermissionKind; category?: string;
+    createdAt?: number; updatedAt?: number;
+}

package/src/platformRbac/application/requests.ts

@@ -1,13 +1,13 @@
-import { PermissionScope } from '../enums/PermissionScope';
-import type { LevelDef, ApplicationDefaults, SeedRole } from './Application';
-
-export interface CreateApplicationRequest {
-    applicationId: string; displayName: string; levels: LevelDef[];
-    defaults?: ApplicationDefaults; seedRoles?: SeedRole[];
-}
-export interface UpdateApplicationRequest {
-    displayName?: string; levels?: LevelDef[]; defaults?: ApplicationDefaults; seedRoles?: SeedRole[];
-}
-export interface UpsertApplicationPermissionRequest {
-    permissionKey: string; displayName: string; description: string; scope: PermissionScope; category?: string;
-}
+import { PermissionScope } from '../enums/PermissionScope';
+import type { LevelDef, ApplicationDefaults, SeedRole } from './Application';
+
+export interface CreateApplicationRequest {
+    applicationId: string; displayName: string; levels: LevelDef[];
+    defaults?: ApplicationDefaults; seedRoles?: SeedRole[];
+}
+export interface UpdateApplicationRequest {
+    displayName?: string; levels?: LevelDef[]; defaults?: ApplicationDefaults; seedRoles?: SeedRole[];
+}
+export interface UpsertApplicationPermissionRequest {
+    permissionKey: string; displayName: string; description: string; scope: PermissionScope; category?: string;
+}

package/src/platformRbac/auth/DefineNextChallengeRequest.ts

@@ -1,25 +1,25 @@
-import 'reflect-metadata';
-import { Type } from 'class-transformer';
-import { IsArray, IsBoolean, IsEnum, IsString, ValidateNested } from 'class-validator';
-import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
-
-export class ChallengeResultEntry {
-    @IsEnum(ChallengeNameEnum)
-    challengeName!: ChallengeNameEnum;
-
-    @IsBoolean()
-    challengeResult!: boolean;
-}
-
-export class DefineNextChallengeRequest {
-    @IsString()
-    cognitoSub!: string;
-
-    @IsBoolean()
-    userNotFound!: boolean;
-
-    @IsArray()
-    @ValidateNested({ each: true })
-    @Type(() => ChallengeResultEntry)
-    session!: ChallengeResultEntry[];
-}
+import 'reflect-metadata';
+import { Type } from 'class-transformer';
+import { IsArray, IsBoolean, IsEnum, IsString, ValidateNested } from 'class-validator';
+import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+
+export class ChallengeResultEntry {
+    @IsEnum(ChallengeNameEnum)
+    challengeName!: ChallengeNameEnum;
+
+    @IsBoolean()
+    challengeResult!: boolean;
+}
+
+export class DefineNextChallengeRequest {
+    @IsString()
+    cognitoSub!: string;
+
+    @IsBoolean()
+    userNotFound!: boolean;
+
+    @IsArray()
+    @ValidateNested({ each: true })
+    @Type(() => ChallengeResultEntry)
+    session!: ChallengeResultEntry[];
+}

package/src/platformRbac/auth/DefineNextChallengeResponse.ts

@@ -1,14 +1,14 @@
-import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
-import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
-
-export class DefineNextChallengeResponse {
-    @IsOptional()
-    @IsEnum(ChallengeNameEnum)
-    nextChallenge?: ChallengeNameEnum;
-
-    @IsBoolean()
-    issueTokens!: boolean;
-
-    @IsBoolean()
-    failAuthentication!: boolean;
-}
+import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
+import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+
+export class DefineNextChallengeResponse {
+    @IsOptional()
+    @IsEnum(ChallengeNameEnum)
+    nextChallenge?: ChallengeNameEnum;
+
+    @IsBoolean()
+    issueTokens!: boolean;
+
+    @IsBoolean()
+    failAuthentication!: boolean;
+}

package/src/platformRbac/auth/NewPasswordRequest.ts

@@ -1,10 +1,10 @@
-import { IsString, MinLength } from 'class-validator';
-
-export class NewPasswordRequest {
-    @IsString()
-    cognitoSub!: string;
-
-    @IsString()
-    @MinLength(8)
-    newPassword!: string;
-}
+import { IsString, MinLength } from 'class-validator';
+
+export class NewPasswordRequest {
+    @IsString()
+    cognitoSub!: string;
+
+    @IsString()
+    @MinLength(8)
+    newPassword!: string;
+}

package/src/platformRbac/auth/PrepareChallengeRequest.ts

@@ -1,13 +1,13 @@
-import { IsEmail, IsEnum, IsString } from 'class-validator';
-import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
-
-export class PrepareChallengeRequest {
-    @IsString()
-    cognitoSub!: string;
-
-    @IsEnum(ChallengeNameEnum)
-    challengeName!: ChallengeNameEnum;
-
-    @IsEmail()
-    email!: string;
-}
+import { IsEmail, IsEnum, IsString } from 'class-validator';
+import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+
+export class PrepareChallengeRequest {
+    @IsString()
+    cognitoSub!: string;
+
+    @IsEnum(ChallengeNameEnum)
+    challengeName!: ChallengeNameEnum;
+
+    @IsEmail()
+    email!: string;
+}

package/src/platformRbac/auth/PrepareChallengeResponse.ts

@@ -1,9 +1,9 @@
-import { IsObject, IsString } from 'class-validator';
-
-export class PrepareChallengeResponse {
-    @IsString()
-    publicChallengeParameters!: string;
-
-    @IsObject()
-    privateChallengeParameters!: Record<string, string>;
-}
+import { IsObject, IsString } from 'class-validator';
+
+export class PrepareChallengeResponse {
+    @IsString()
+    publicChallengeParameters!: string;
+
+    @IsObject()
+    privateChallengeParameters!: Record<string, string>;
+}

package/src/platformRbac/auth/ResetPasswordRequest.ts

@@ -1,14 +1,14 @@
-import { IsEmail, IsString, Length, MinLength } from 'class-validator';
-
-export class ResetPasswordRequest {
-    @IsEmail()
-    email!: string;
-
-    @IsString()
-    @Length(6, 6)
-    otpCode!: string;
-
-    @IsString()
-    @MinLength(8)
-    newPassword!: string;
-}
+import { IsEmail, IsString, Length, MinLength } from 'class-validator';
+
+export class ResetPasswordRequest {
+    @IsEmail()
+    email!: string;
+
+    @IsString()
+    @Length(6, 6)
+    otpCode!: string;
+
+    @IsString()
+    @MinLength(8)
+    newPassword!: string;
+}

package/src/platformRbac/auth/VerifyChallengeRequest.ts

@@ -1,16 +1,16 @@
-import { IsEnum, IsObject, IsString } from 'class-validator';
-import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
-
-export class VerifyChallengeRequest {
-    @IsString()
-    cognitoSub!: string;
-
-    @IsEnum(ChallengeNameEnum)
-    challengeName!: ChallengeNameEnum;
-
-    @IsString()
-    challengeAnswer!: string;
-
-    @IsObject()
-    privateChallengeParameters!: Record<string, string>;
-}
+import { IsEnum, IsObject, IsString } from 'class-validator';
+import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+
+export class VerifyChallengeRequest {
+    @IsString()
+    cognitoSub!: string;
+
+    @IsEnum(ChallengeNameEnum)
+    challengeName!: ChallengeNameEnum;
+
+    @IsString()
+    challengeAnswer!: string;
+
+    @IsObject()
+    privateChallengeParameters!: Record<string, string>;
+}

package/src/platformRbac/auth/VerifyChallengeResponse.ts

@@ -1,6 +1,6 @@
-import { IsBoolean } from 'class-validator';
-
-export class VerifyChallengeResponse {
-    @IsBoolean()
-    answerCorrect!: boolean;
-}
+import { IsBoolean } from 'class-validator';
+
+export class VerifyChallengeResponse {
+    @IsBoolean()
+    answerCorrect!: boolean;
+}

package/src/platformRbac/dtos/AuthContext.ts

@@ -1,34 +1,34 @@
-import type { Permission } from '../enums/Permission';
-import type { RoleAssignmentInfo } from './RoleAssignmentInfo';
-
-/**
- * Shape DESERIALIZADO del authorizer context.
- * El authorizer Lambda (componente 07) lo construye + serializa; el helper
- * `extractTenantContext` lo deserializa para los handlers business.
- *
- * En API Gateway authorizer.context todos los valores son strings:
- * - `permissions` viaja como CSV (`"a.b.c,d.e.f,..."`).
- * - `roleAssignments` viaja como JSON string.
- * Este interface es la forma ya parseada.
- */
-export interface AuthContext {
-    cognitoSub: string;
-    tenantId: string;
-    email: string;
-    roleAssignments: RoleAssignmentInfo[];
-    permissions: Permission[];
-    resolvedAt: string;
-    issuer?: string;
-    /** @deprecated RBAC Token Flaco (DEC-RBAC-008): el bitset muere; el adapter resuelve permisos frescos desde DDB. Se conserva el campo para compat de tokens viejos en transición. */
-    permBits?: string;
-    /** @deprecated DEC-RBAC-008: versión del catálogo del bitset. No se usa en el modelo token-flaco. */
-    permVer?: number;
-    /** @deprecated DEC-RBAC-008: epoch de permisos. El authorizer ya no lo chequea. */
-    permsEpoch?: number;
-    /**
-     * Metadata de negocio por-usuario inyectada por jwt-inyector (campos personalizados del tenant
-     * marcados injectToToken). NO es autorización: NUNCA usar en un guard/decisión de acceso (DEC-RBAC-020).
-     * El gateway-adapter (buildAuthContextFromToken) parsea el claim JSON a este objeto.
-     */
-    customAttributes?: Record<string, string>;
-}
+import type { Permission } from '../enums/Permission';
+import type { RoleAssignmentInfo } from './RoleAssignmentInfo';
+
+/**
+ * Shape DESERIALIZADO del authorizer context.
+ * El authorizer Lambda (componente 07) lo construye + serializa; el helper
+ * `extractTenantContext` lo deserializa para los handlers business.
+ *
+ * En API Gateway authorizer.context todos los valores son strings:
+ * - `permissions` viaja como CSV (`"a.b.c,d.e.f,..."`).
+ * - `roleAssignments` viaja como JSON string.
+ * Este interface es la forma ya parseada.
+ */
+export interface AuthContext {
+    cognitoSub: string;
+    tenantId: string;
+    email: string;
+    roleAssignments: RoleAssignmentInfo[];
+    permissions: Permission[];
+    resolvedAt: string;
+    issuer?: string;
+    /** @deprecated RBAC Token Flaco (DEC-RBAC-008): el bitset muere; el adapter resuelve permisos frescos desde DDB. Se conserva el campo para compat de tokens viejos en transición. */
+    permBits?: string;
+    /** @deprecated DEC-RBAC-008: versión del catálogo del bitset. No se usa en el modelo token-flaco. */
+    permVer?: number;
+    /** @deprecated DEC-RBAC-008: epoch de permisos. El authorizer ya no lo chequea. */
+    permsEpoch?: number;
+    /**
+     * Metadata de negocio por-usuario inyectada por jwt-inyector (campos personalizados del tenant
+     * marcados injectToToken). NO es autorización: NUNCA usar en un guard/decisión de acceso (DEC-RBAC-020).
+     * El gateway-adapter (buildAuthContextFromToken) parsea el claim JSON a este objeto.
+     */
+    customAttributes?: Record<string, string>;
+}

package/src/platformRbac/dtos/AuthorizeRequest.ts

@@ -1,14 +1,14 @@
-import { Expose } from 'class-transformer';
-import { IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
-import { PermissionScope } from '../enums/PermissionScope';
-
-/**
- * Input del POST /internal/authorize. El decorador @RequirePermission lo construye:
- * token (del cookie session), permission requerida, y scope+scopeRef opcionales.
- */
-export class AuthorizeRequest {
-    @Expose() @IsString() @IsNotEmpty() token!: string;
-    @Expose() @IsString() @IsNotEmpty() permission!: string;
-    @Expose() @IsOptional() @IsEnum(PermissionScope) scope?: PermissionScope;
-    @Expose() @IsOptional() @IsString() scopeRef?: string;
-}
+import { Expose } from 'class-transformer';
+import { IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { PermissionScope } from '../enums/PermissionScope';
+
+/**
+ * Input del POST /internal/authorize. El decorador @RequirePermission lo construye:
+ * token (del cookie session), permission requerida, y scope+scopeRef opcionales.
+ */
+export class AuthorizeRequest {
+    @Expose() @IsString() @IsNotEmpty() token!: string;
+    @Expose() @IsString() @IsNotEmpty() permission!: string;
+    @Expose() @IsOptional() @IsEnum(PermissionScope) scope?: PermissionScope;
+    @Expose() @IsOptional() @IsString() scopeRef?: string;
+}

package/src/platformRbac/dtos/AuthorizeResponse.ts

@@ -1,16 +1,16 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
-import { AuthorizeDenyReason } from '../enums/AuthorizeDenyReason';
-import type { AuthContext } from './AuthContext';
-
-/**
- * Output del POST /internal/authorize. Si allow=true trae el context resuelto
- * (para que el decorador lo populé en el request). Si allow=false trae el reason.
- * `context` es solo contrato TS de salida (AuthContext es interface, no clase) → SIN @Expose,
- * es passthrough; los responses no se validan (fiado-validation-and-dtos § 7).
- */
-export class AuthorizeResponse {
-    @Expose() @IsBoolean() allow!: boolean;
-    @Expose() @IsOptional() @IsEnum(AuthorizeDenyReason) reason?: AuthorizeDenyReason;
-    context?: AuthContext;
-}
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
+import { AuthorizeDenyReason } from '../enums/AuthorizeDenyReason';
+import type { AuthContext } from './AuthContext';
+
+/**
+ * Output del POST /internal/authorize. Si allow=true trae el context resuelto
+ * (para que el decorador lo populé en el request). Si allow=false trae el reason.
+ * `context` es solo contrato TS de salida (AuthContext es interface, no clase) → SIN @Expose,
+ * es passthrough; los responses no se validan (fiado-validation-and-dtos § 7).
+ */
+export class AuthorizeResponse {
+    @Expose() @IsBoolean() allow!: boolean;
+    @Expose() @IsOptional() @IsEnum(AuthorizeDenyReason) reason?: AuthorizeDenyReason;
+    context?: AuthContext;
+}

package/src/platformRbac/dtos/CreateTenantRequest.ts

@@ -1,27 +1,28 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsEmail, IsEnum, IsInt, IsOptional, IsString, Matches, Min } from 'class-validator';
-import { TokenValidationMode } from '../enums/TokenValidationMode';
-import { TenantType } from '../tenantTypes';
-
-/**
- * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
- * Consumido por el controller `backofficeCreateTenant` del platform-rbac-business y, a futuro,
- * por el frontend de staff. La `idempotencyKey` viaja en header HTTP (no en el body).
- * El `temporaryPassword` NO viaja en el request: vive solo en el response como fallback
- * out-of-band mientras el correo de invitación no entrega.
- */
-export class CreateTenantRequest {
-    @Expose() @IsString() @Matches(/^[a-z0-9-]+$/) tenantId!: string;
-    @Expose() @IsString() displayName!: string;
-    @Expose() @IsString() tablePrefix!: string;
-    @Expose() @IsEmail() adminEmail!: string;
-    @Expose() @IsString() adminName!: string;
-    @Expose() @IsString() region!: string;
-    @Expose() @IsOptional() @IsBoolean() mfaRequired?: boolean;
-    @Expose() @IsOptional() @IsInt() @Min(8) passwordMinLength?: number;
-    @Expose() @IsOptional() @IsEnum(TokenValidationMode) tokenValidationMode?: TokenValidationMode;
-    /** Tipo de tenant a crear. Si se omite, el onboarding aplica su default (hoy: retail). */
-    @Expose() @IsOptional() @IsEnum(TenantType) tenantType?: TenantType;
-    /** DEC-RBAC-034: aplicación (plantilla) de la que se crea el tenant; opcional, fallback a tenantType (back-compat). */
-    @Expose() @IsOptional() @IsString() applicationId?: string;
-}
+import { Expose } from 'class-transformer';
+import { IsEmail, IsEnum, IsOptional, IsString, Matches } from 'class-validator';
+import { TokenValidationMode } from '../enums/TokenValidationMode';
+import { TenantType } from '../tenantTypes';
+
+/**
+ * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
+ * Consumido por el controller `backofficeCreateTenant` del platform-rbac-business y, a futuro,
+ * por el frontend de staff. La `idempotencyKey` viaja en header HTTP (no en el body).
+ * El `temporaryPassword` NO viaja en el request: vive solo en el response como fallback
+ * out-of-band mientras el correo de invitación no entrega.
+ */
+export class CreateTenantRequest {
+    @Expose() @IsString() @Matches(/^[a-z0-9-]+$/) tenantId!: string;
+    @Expose() @IsString() displayName!: string;
+    @Expose() @IsString() tablePrefix!: string;
+    @Expose() @IsEmail() adminEmail!: string;
+    @Expose() @IsString() adminName!: string;
+    @Expose() @IsString() region!: string;
+    // DEC-RBAC-051: mfaRequired purgado de TODO el repo (write-only sin enforcement).
+    // DEC-RBAC-052: passwordMinLength purgado — la política de password es global (env vars) y la
+    // enforce Cognito (política nativa del pool), ya no es per-tenant en el create.
+    @Expose() @IsOptional() @IsEnum(TokenValidationMode) tokenValidationMode?: TokenValidationMode;
+    /** Tipo de tenant a crear. Si se omite, el onboarding aplica su default (hoy: retail). */
+    @Expose() @IsOptional() @IsEnum(TenantType) tenantType?: TenantType;
+    /** DEC-RBAC-034: aplicación (plantilla) de la que se crea el tenant; opcional, fallback a tenantType (back-compat). */
+    @Expose() @IsOptional() @IsString() applicationId?: string;
+}

package/src/platformRbac/dtos/CreateTenantResponse.ts

@@ -1,12 +1,12 @@
-/**
- * Output del POST backoffice de creación de tenant (F-11). Response plain sin validators
- * (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
- */
-export interface CreateTenantResponse {
-    tenantId: string;
-    userPoolId: string;
-    appClientId: string;
-    adminCognitoSub: string;
-    /** Fallback out-of-band mientras el correo de invitación no entrega (F-11). */
-    temporaryPassword: string;
-}
+/**
+ * Output del POST backoffice de creación de tenant (F-11). Response plain sin validators
+ * (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ */
+export interface CreateTenantResponse {
+    tenantId: string;
+    userPoolId: string;
+    appClientId: string;
+    adminCognitoSub: string;
+    /** Fallback out-of-band mientras el correo de invitación no entrega (F-11). */
+    temporaryPassword: string;
+}

package/src/platformRbac/dtos/CreateUserFieldRequest.ts

@@ -1,13 +1,13 @@
-import { Expose } from 'class-transformer';
-import { ArrayNotEmpty, IsArray, IsBoolean, IsEnum, IsOptional, IsString, Matches, MaxLength } from 'class-validator';
-import { UserFieldType } from '../enums/UserFieldType';
-
-/** Body del POST /backoffice/tenants/{tenantId}/user-fields. La validación de `options` por `type` (no vacío si select) la hace el manager. */
-export class CreateUserFieldRequest {
-    @Expose() @IsString() @Matches(/^[a-z][a-zA-Z0-9_]*$/, { message: 'key debe ser slug ^[a-z][a-zA-Z0-9_]*$' }) key!: string;
-    @Expose() @IsString() @MaxLength(80) label!: string;
-    @Expose() @IsEnum(UserFieldType) type!: UserFieldType;
-    @Expose() @IsOptional() @IsArray() @ArrayNotEmpty() @IsString({ each: true }) options?: string[];
-    @Expose() @IsBoolean() required!: boolean;
-    @Expose() @IsBoolean() injectToToken!: boolean;
-}
+import { Expose } from 'class-transformer';
+import { ArrayNotEmpty, IsArray, IsBoolean, IsEnum, IsOptional, IsString, Matches, MaxLength } from 'class-validator';
+import { UserFieldType } from '../enums/UserFieldType';
+
+/** Body del POST /backoffice/tenants/{tenantId}/user-fields. La validación de `options` por `type` (no vacío si select) la hace el manager. */
+export class CreateUserFieldRequest {
+    @Expose() @IsString() @Matches(/^[a-z][a-zA-Z0-9_]*$/, { message: 'key debe ser slug ^[a-z][a-zA-Z0-9_]*$' }) key!: string;
+    @Expose() @IsString() @MaxLength(80) label!: string;
+    @Expose() @IsEnum(UserFieldType) type!: UserFieldType;
+    @Expose() @IsOptional() @IsArray() @ArrayNotEmpty() @IsString({ each: true }) options?: string[];
+    @Expose() @IsBoolean() required!: boolean;
+    @Expose() @IsBoolean() injectToToken!: boolean;
+}