@fiado/type-kit 3.137.0 → 3.139.0

package/bin/platformRbac/auth/PrepareChallengeRequest.d.ts

@@ -3,4 +3,5 @@ export declare class PrepareChallengeRequest {
     cognitoSub: string;
     challengeName: ChallengeNameEnum;
     email: string;
+    phone?: string;
 }

package/bin/platformRbac/auth/PrepareChallengeRequest.js

@@ -27,3 +27,8 @@ __decorate([
     (0, class_validator_1.IsEmail)(),
     __metadata("design:type", String)
 ], PrepareChallengeRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], PrepareChallengeRequest.prototype, "phone", void 0);

package/bin/platformRbac/dtos/ResendOtpRequest.d.ts

@@ -0,0 +1,22 @@
+import { MfaMethodEnum } from '../enums/MfaMethodEnum';
+/**
+ * Body del POST /auth/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Reenvía el OTP del login re-disparando el challenge real CUSTOM_AUTH (EMAIL_OTP) para la
+ * identidad SIN password. `tenantId` obligatorio (DEC-064 — el picker ya lo resolvió, NO "solo email").
+ * El email se normaliza lowercase server-side. Postura anti-enumeración: respuesta 200 genérica
+ * siempre, sin filtrar existencia (ver AuthLoginManager.resendChallengeOtp).
+ */
+export declare class ResendOtpRequest {
+    email: string;
+    tenantId: string;
+}
+/**
+ * Respuesta del resend-otp. `session`/`mfaMethod` frescos del nuevo challenge CUSTOM_AUTH.
+ * Plain sin validators (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ * Ambos opcionales: en los caminos de rechazo silencioso (anti-enumeración) o ramas sin CUSTOM_AUTH
+ * el server responde 200 genérico sin session ni método.
+ */
+export interface ResendOtpResponse {
+    session?: string;
+    mfaMethod?: MfaMethodEnum;
+}

package/bin/{walletFunding/dtos/CancelFundingRequest.js → platformRbac/dtos/ResendOtpRequest.js}

@@ -9,25 +9,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingRequest = void 0;
+exports.ResendOtpRequest = void 0;
+const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
 /**
- * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `fundingId` viaja en el path, `directoryId` se resuelve del JWT.
- * `providerModuleName` permite al marketplace rutear al publisher correcto
- * sin tener que persistir el mapping (el wallet-app sabe el moduleName
- * porque vino en la respuesta del authorize).
+ * Body del POST /auth/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Reenvía el OTP del login re-disparando el challenge real CUSTOM_AUTH (EMAIL_OTP) para la
+ * identidad SIN password. `tenantId` obligatorio (DEC-064 — el picker ya lo resolvió, NO "solo email").
+ * El email se normaliza lowercase server-side. Postura anti-enumeración: respuesta 200 genérica
+ * siempre, sin filtrar existencia (ver AuthLoginManager.resendChallengeOtp).
  */
-class CancelFundingRequest {
+class ResendOtpRequest {
 }
-exports.CancelFundingRequest = CancelFundingRequest;
+exports.ResendOtpRequest = ResendOtpRequest;
 __decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
-], CancelFundingRequest.prototype, "idempotencyKey", void 0);
+], ResendOtpRequest.prototype, "email", void 0);
 __decorate([
+    (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(128),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
-], CancelFundingRequest.prototype, "providerModuleName", void 0);
+], ResendOtpRequest.prototype, "tenantId", void 0);

package/bin/platformRbac/dtos/ResendSelfRegisterOtpRequest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Body del POST /self-register/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Re-envía el OTP del autoregistro (mecanismo messages-business, NO Cognito) tras validar un
+ * `pending` existente. Misma postura anti-enumeración del start. El email se normaliza lowercase
+ * server-side. DTO propio por endpoint (NO reusa SelfRegisterStartRequest, que exige roleId/scope/
+ * scopeRef, ni SelfRegisterVerifyOtpRequest, que exige otp).
+ */
+export declare class ResendSelfRegisterOtpRequest {
+    tenantId: string;
+    email: string;
+}

package/bin/{walletFunding/dtos/CancelFundingReferenceRequest.js → platformRbac/dtos/ResendSelfRegisterOtpRequest.js}

@@ -9,23 +9,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingReferenceRequest = void 0;
+exports.ResendSelfRegisterOtpRequest = void 0;
+const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
-class CancelFundingReferenceRequest {
+/**
+ * Body del POST /self-register/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Re-envía el OTP del autoregistro (mecanismo messages-business, NO Cognito) tras validar un
+ * `pending` existente. Misma postura anti-enumeración del start. El email se normaliza lowercase
+ * server-side. DTO propio por endpoint (NO reusa SelfRegisterStartRequest, que exige roleId/scope/
+ * scopeRef, ni SelfRegisterVerifyOtpRequest, que exige otp).
+ */
+class ResendSelfRegisterOtpRequest {
 }
-exports.CancelFundingReferenceRequest = CancelFundingReferenceRequest;
+exports.ResendSelfRegisterOtpRequest = ResendSelfRegisterOtpRequest;
 __decorate([
+    (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "fundingId", void 0);
+], ResendSelfRegisterOtpRequest.prototype, "tenantId", void 0);
 __decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "directoryId", void 0);
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "idempotencyKey", void 0);
+], ResendSelfRegisterOtpRequest.prototype, "email", void 0);

package/bin/platformRbac/dtos/TenantSecurityPolicyResponse.d.ts

@@ -6,6 +6,6 @@
  * MfaMethodEnum ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
  */
 export interface TenantSecurityPolicyResponse {
-    methodsAllowed: ('EMAIL' | 'TOTP')[];
+    methodsAllowed: ('EMAIL' | 'TOTP' | 'SMS')[];
     mfaEnabled?: boolean;
 }

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.d.ts

@@ -1,4 +1,4 @@
 export declare class UpdateTenantSecurityPolicyRequest {
-    methodsAllowed: ('EMAIL' | 'TOTP')[];
+    methodsAllowed: ('EMAIL' | 'TOTP' | 'SMS')[];
     mfaEnabled?: boolean;
 }

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.js

@@ -12,14 +12,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpdateTenantSecurityPolicyRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
-// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum.
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP'|'SMS' (string), distinto de MfaMethodEnum.
+// DEC-RBAC-085: 'SMS' se suma como método tenant-controlado (3er método de MFA).
 class UpdateTenantSecurityPolicyRequest {
 }
 exports.UpdateTenantSecurityPolicyRequest = UpdateTenantSecurityPolicyRequest;
 __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.ArrayNotEmpty)(),
-    (0, class_validator_1.IsIn)(['EMAIL', 'TOTP'], { each: true }),
+    (0, class_validator_1.IsIn)(['EMAIL', 'TOTP', 'SMS'], { each: true }),
     __metadata("design:type", Array)
 ], UpdateTenantSecurityPolicyRequest.prototype, "methodsAllowed", void 0);
 __decorate([

package/bin/platformRbac/enums/ChallengeNameEnum.d.ts

@@ -3,5 +3,6 @@ export declare enum ChallengeNameEnum {
     EMAIL_OTP = "EMAIL_OTP",
     TOTP = "TOTP",
     NEW_PASSWORD_REQUIRED = "NEW_PASSWORD_REQUIRED",
-    RESET_PASSWORD = "RESET_PASSWORD"
+    RESET_PASSWORD = "RESET_PASSWORD",
+    SMS_OTP = "SMS_OTP"
 }

package/bin/platformRbac/enums/ChallengeNameEnum.js

@@ -8,4 +8,5 @@ var ChallengeNameEnum;
     ChallengeNameEnum["TOTP"] = "TOTP";
     ChallengeNameEnum["NEW_PASSWORD_REQUIRED"] = "NEW_PASSWORD_REQUIRED";
     ChallengeNameEnum["RESET_PASSWORD"] = "RESET_PASSWORD";
+    ChallengeNameEnum["SMS_OTP"] = "SMS_OTP";
 })(ChallengeNameEnum || (exports.ChallengeNameEnum = ChallengeNameEnum = {}));

package/bin/platformRbac/enums/MfaMethodEnum.d.ts

@@ -1,4 +1,5 @@
 export declare enum MfaMethodEnum {
     EMAIL_OTP = "EMAIL_OTP",
-    TOTP = "TOTP"
+    TOTP = "TOTP",
+    SMS_OTP = "SMS_OTP"
 }

package/bin/platformRbac/enums/MfaMethodEnum.js

@@ -5,4 +5,5 @@ var MfaMethodEnum;
 (function (MfaMethodEnum) {
     MfaMethodEnum["EMAIL_OTP"] = "EMAIL_OTP";
     MfaMethodEnum["TOTP"] = "TOTP";
+    MfaMethodEnum["SMS_OTP"] = "SMS_OTP";
 })(MfaMethodEnum || (exports.MfaMethodEnum = MfaMethodEnum = {}));

package/bin/remittance/dtos/RemittanceKyc.d.ts

@@ -0,0 +1,70 @@
+/**
+ * DTOs de la pantalla Aceptación (KYC monitoring del provider · SPEC_06).
+ *
+ * Monitoreo read-only del estado que UNIR asigna (Fiado no hace KYC). El `usage`/estado
+ * sale de `RemittanceUsers_GT` (snapshot local, refrescado contra UNIR on-demand + job).
+ * `lastRejection` es el último rechazo persistido (MVP guarda solo el último).
+ */
+export declare class KycRejection {
+    /** Código normalizado del catálogo (p.ej. EMAIL_ALREADY_TAKEN, 59906005). */
+    code: string;
+    /** Mensaje original del provider. */
+    message: string;
+    /** ISO — cuándo ocurrió el rechazo. */
+    at: string;
+}
+export declare class KycUserAddress {
+    address1: string;
+    city: string;
+    state: string;
+    zipCode: string;
+    country: string;
+}
+/** Snapshot de identidad tomado de UNIR `remitterPersonalInfo` (el connector lo persiste). */
+export declare class KycUserIdentity {
+    fullName: string | null;
+    cellPhone: string | null;
+    address: KycUserAddress | null;
+    destinationCountryISOCode: string | null;
+    agreementLocale: string | null;
+}
+/** Fila de la lista de Aceptación (EP-33). */
+export declare class KycUserSummary {
+    directoryId: string;
+    unirEmail: string;
+    fullName: string | null;
+    status: string;
+    remitterLevel: string | null;
+    activatedAt: string | null;
+    lastDataSyncAt: string | null;
+    lastRejectionAt: string | null;
+    lastRejectionCode: string | null;
+}
+/** Detalle 360 de Aceptación (EP-35). */
+export declare class KycUserDetail {
+    directoryId: string;
+    unirEmail: string;
+    identity: KycUserIdentity | null;
+    status: string;
+    remitterStatus: string | null;
+    remitterLevel: string | null;
+    unirWlpWalletId: number | null;
+    unirSiftUserId: string | null;
+    createdAt: string;
+    activatedAt: string | null;
+    lastDataSyncAt: string | null;
+    lastRejection: KycRejection | null;
+}
+/** Lista paginada (cursor estándar `index`). */
+export declare class KycUsersListResponse {
+    items: KycUserSummary[];
+    index?: string;
+}
+/** Respuesta del refresh on-demand (EP-34). */
+export declare class RefreshUserProfileResponse {
+    directoryId: string;
+    status: string;
+    remitterStatus: string | null;
+    remitterLevel: string | null;
+    lastDataSyncAt: string;
+}

package/bin/remittance/dtos/RemittanceKyc.js

@@ -0,0 +1,36 @@
+"use strict";
+/**
+ * DTOs de la pantalla Aceptación (KYC monitoring del provider · SPEC_06).
+ *
+ * Monitoreo read-only del estado que UNIR asigna (Fiado no hace KYC). El `usage`/estado
+ * sale de `RemittanceUsers_GT` (snapshot local, refrescado contra UNIR on-demand + job).
+ * `lastRejection` es el último rechazo persistido (MVP guarda solo el último).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshUserProfileResponse = exports.KycUsersListResponse = exports.KycUserDetail = exports.KycUserSummary = exports.KycUserIdentity = exports.KycUserAddress = exports.KycRejection = void 0;
+class KycRejection {
+}
+exports.KycRejection = KycRejection;
+class KycUserAddress {
+}
+exports.KycUserAddress = KycUserAddress;
+/** Snapshot de identidad tomado de UNIR `remitterPersonalInfo` (el connector lo persiste). */
+class KycUserIdentity {
+}
+exports.KycUserIdentity = KycUserIdentity;
+/** Fila de la lista de Aceptación (EP-33). */
+class KycUserSummary {
+}
+exports.KycUserSummary = KycUserSummary;
+/** Detalle 360 de Aceptación (EP-35). */
+class KycUserDetail {
+}
+exports.KycUserDetail = KycUserDetail;
+/** Lista paginada (cursor estándar `index`). */
+class KycUsersListResponse {
+}
+exports.KycUsersListResponse = KycUsersListResponse;
+/** Respuesta del refresh on-demand (EP-34). */
+class RefreshUserProfileResponse {
+}
+exports.RefreshUserProfileResponse = RefreshUserProfileResponse;

package/bin/remittance/dtos/index.d.ts

@@ -35,3 +35,4 @@ export * from "./RemittanceBackofficeUserListResponse";
 export * from "./RemittanceBackofficeTxListResponse";
 export * from "./RemittanceBackofficeStats";
 export * from "./RemittanceUserLimits";
+export * from "./RemittanceKyc";

package/bin/remittance/dtos/index.js

@@ -51,3 +51,4 @@ __exportStar(require("./RemittanceBackofficeUserListResponse"), exports);
 __exportStar(require("./RemittanceBackofficeTxListResponse"), exports);
 __exportStar(require("./RemittanceBackofficeStats"), exports);
 __exportStar(require("./RemittanceUserLimits"), exports);
+__exportStar(require("./RemittanceKyc"), exports);