@fiado/type-kit 3.192.0 → 3.194.0

package/bin/platformRbac/dtos/CreateLevelEntityRequest.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Body del POST /internal/tenants/{tenantId}/users/../levels/{level}/entities (endpoint privado, VPC/ANONIMUS).
+ * `tenantId` y `level` viajan en el path (no acá). Crea una scope-entity genérica L1/L2/L3 en RBAC.
+ *
+ * Consumido por el espejo de jerarquía de SureKeep F1 (retailer→L1, zona→L2, tienda→L3) vía api-invoker.
+ * - `id` es BYOID (DEC-RBAC-027): el caller trae su propio id → creates idempotentes (PutItem overwrite).
+ * - `parentId` es obligatorio para L2/L3 (id del nivel superior); ausente en L1 (cuelga de TENANT). Lo valida el manager.
+ * - `createdBy` = cognitoSub del admin real (audit), propagado desde el evento de outbox.
+ */
+export declare class CreateLevelEntityRequest {
+    displayName: string;
+    id?: string;
+    parentId?: string;
+    createdBy: string;
+}

package/bin/platformRbac/dtos/CreateLevelEntityRequest.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateLevelEntityRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Body del POST /internal/tenants/{tenantId}/users/../levels/{level}/entities (endpoint privado, VPC/ANONIMUS).
+ * `tenantId` y `level` viajan en el path (no acá). Crea una scope-entity genérica L1/L2/L3 en RBAC.
+ *
+ * Consumido por el espejo de jerarquía de SureKeep F1 (retailer→L1, zona→L2, tienda→L3) vía api-invoker.
+ * - `id` es BYOID (DEC-RBAC-027): el caller trae su propio id → creates idempotentes (PutItem overwrite).
+ * - `parentId` es obligatorio para L2/L3 (id del nivel superior); ausente en L1 (cuelga de TENANT). Lo valida el manager.
+ * - `createdBy` = cognitoSub del admin real (audit), propagado desde el evento de outbox.
+ */
+class CreateLevelEntityRequest {
+}
+exports.CreateLevelEntityRequest = CreateLevelEntityRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateLevelEntityRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateLevelEntityRequest.prototype, "id", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateLevelEntityRequest.prototype, "parentId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateLevelEntityRequest.prototype, "createdBy", void 0);

package/bin/platformRbac/dtos/CreateLevelEntityResponse.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Respuesta del POST create-level-entity (endpoint privado). Espejo público de la scope-entity creada
+ * (SharedLevelEntityRow del rbac-business). Interface plain → export type-only.
+ */
+export interface CreateLevelEntityResponse {
+    id: string;
+    displayName: string;
+    parentId?: string;
+    level: string;
+    createdAt: number;
+    updatedAt: number;
+    createdBy?: string;
+    updatedBy?: string;
+}

package/bin/platformRbac/dtos/CreateLevelEntityResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/dtos/CreateTenantUserRequest.d.ts

@@ -0,0 +1,19 @@
+import { PermissionScope } from '../enums/PermissionScope';
+/**
+ * Body del POST /internal/tenants/{tenantId}/users (endpoint privado, VPC/ANONIMUS). `tenantId` viaja en el path.
+ * Provisiona Cognito + SharedUser + RoleAssignment (rol + scopeRef) en RBAC — reusa UserProvisioningService.
+ *
+ * Consumido por el alta de usuario orquestada de SureKeep F1 (retail-org → RBAC → RetailUser) vía api-invoker.
+ * - Usuario provisionado en estado INVITED (mitiga orphan si el paso siguiente en retail-org falla).
+ * - Idempotente por identidad Cognito.
+ * - `scope`/`scopeRef` = grant del rol (ej. LEVEL_3 + storeId para un vendedor de tienda).
+ * - `createdBy` = cognitoSub del admin real (audit + grantedBy del assignment).
+ */
+export declare class CreateTenantUserRequest {
+    email: string;
+    displayName?: string;
+    roleId: string;
+    scope: PermissionScope;
+    scopeRef: string;
+    createdBy: string;
+}

package/bin/platformRbac/dtos/CreateTenantUserRequest.js

@@ -0,0 +1,63 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateTenantUserRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const PermissionScope_1 = require("../enums/PermissionScope");
+/**
+ * Body del POST /internal/tenants/{tenantId}/users (endpoint privado, VPC/ANONIMUS). `tenantId` viaja en el path.
+ * Provisiona Cognito + SharedUser + RoleAssignment (rol + scopeRef) en RBAC — reusa UserProvisioningService.
+ *
+ * Consumido por el alta de usuario orquestada de SureKeep F1 (retail-org → RBAC → RetailUser) vía api-invoker.
+ * - Usuario provisionado en estado INVITED (mitiga orphan si el paso siguiente en retail-org falla).
+ * - Idempotente por identidad Cognito.
+ * - `scope`/`scopeRef` = grant del rol (ej. LEVEL_3 + storeId para un vendedor de tienda).
+ * - `createdBy` = cognitoSub del admin real (audit + grantedBy del assignment).
+ */
+class CreateTenantUserRequest {
+}
+exports.CreateTenantUserRequest = CreateTenantUserRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], CreateTenantUserRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateTenantUserRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateTenantUserRequest.prototype, "roleId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEnum)(PermissionScope_1.PermissionScope),
+    __metadata("design:type", String)
+], CreateTenantUserRequest.prototype, "scope", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateTenantUserRequest.prototype, "scopeRef", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateTenantUserRequest.prototype, "createdBy", void 0);

package/bin/platformRbac/dtos/CreateTenantUserResponse.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Respuesta del POST create-tenant-user (endpoint privado). Devuelve el cognitoSub del usuario
+ * provisionado, que retail-org guarda en el RetailUser para el match F1↔RBAC. Interface plain → type-only.
+ */
+export interface CreateTenantUserResponse {
+    cognitoSub: string;
+}

package/bin/platformRbac/dtos/CreateTenantUserResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/index.d.ts

@@ -48,3 +48,7 @@ export type { RoleScopeRecompute, InconsistentAssignment, CascadeTenantFailure,
 export * from './dtos/SelfRegisterStartRequest';
 export * from './dtos/SelfRegisterVerifyOtpRequest';
 export * from './dtos/SelfRegisterCompleteRequest';
+export * from './dtos/CreateLevelEntityRequest';
+export type { CreateLevelEntityResponse } from './dtos/CreateLevelEntityResponse';
+export * from './dtos/CreateTenantUserRequest';
+export type { CreateTenantUserResponse } from './dtos/CreateTenantUserResponse';

package/bin/platformRbac/index.js

@@ -99,3 +99,8 @@ __exportStar(require("./enums/PermissionKind"), exports);
 __exportStar(require("./dtos/SelfRegisterStartRequest"), exports);
 __exportStar(require("./dtos/SelfRegisterVerifyOtpRequest"), exports);
 __exportStar(require("./dtos/SelfRegisterCompleteRequest"), exports);
+// Endpoints privados de espejo de jerarquía + alta de usuario (SureKeep F1, scope mirror).
+// Request DTOs llevan decoradores class-validator → export de valor (se hidratan con plainToInstance);
+// Response son interfaces plain → type-only. Consumidos por retail-org vía api-invoker (Publisher).
+__exportStar(require("./dtos/CreateLevelEntityRequest"), exports);
+__exportStar(require("./dtos/CreateTenantUserRequest"), exports);

package/bin/retailOrg/dtos/requests/ProvisionRetailUserRequest.d.ts

@@ -0,0 +1,38 @@
+import { CollectorSeniorityEnum } from '../../enums/CollectorSeniorityEnum';
+import { EmploymentTypeEnum } from '../../enums/EmploymentTypeEnum';
+import { PermissionScope } from '../../../platformRbac/enums/PermissionScope';
+/**
+ * Body de POST /retailers/:retailerId/users/provision — alta de usuario retail ORQUESTADA (SureKeep F1,
+ * scope mirror). Invierte el orden del alta clásica: en vez de recibir un `cognitoSub` ya existente,
+ * retail-org provisiona al usuario en RBAC (Cognito + SharedUser + RoleAssignment) y luego crea el
+ * `RetailUser` con el `cognitoSub` retornado. El `retailerId` sale del path.
+ *
+ * Diferencia con {@link CreateRetailUserRequest}: aquí van `email` + `roleId` + `scope` + `scopeRef`
+ * (el grant de RBAC) en lugar de `cognitoSub`. El resto de los atributos comerciales son idénticos.
+ */
+export declare class ProvisionRetailUserRequest {
+    /** Identidad de login del usuario a provisionar en Cognito/RBAC. */
+    email: string;
+    /** Rol de RBAC a asignar (id del rol del tenant). */
+    roleId: string;
+    /** Scope del grant (ej. LEVEL_1 = retailer, LEVEL_3 = tienda). */
+    scope: PermissionScope;
+    /** Referencia del scope (ej. retailerId para LEVEL_1, storeId para LEVEL_3). */
+    scopeRef: string;
+    /**
+     * Nombre de display — etiqueta de conveniencia (DEC-SKF1-021). La identidad real vive en RBAC
+     * (DEC-SKF1-005); esto es solo un rótulo para reconocer al usuario en el backoffice. Opcional.
+     */
+    displayName?: string;
+    homeStoreId: string;
+    employmentType: EmploymentTypeEnum;
+    commissionTier: string;
+    /** Zona de operación del usuario; `null` si no está acotado a una zona. */
+    zoneId: string | null;
+    /** Teléfono de contacto del usuario retail; opcional. */
+    phone?: string;
+    /** Seniority del cobrador; solo aplica a usuarios retail con rol de cobrador. */
+    collectorSeniority?: CollectorSeniorityEnum;
+    /** Tiendas que cubre el cobrador (zona de cobranza); opcional. */
+    coverageStoreIds?: string[];
+}

package/bin/retailOrg/dtos/requests/ProvisionRetailUserRequest.js

@@ -0,0 +1,95 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisionRetailUserRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const CollectorSeniorityEnum_1 = require("../../enums/CollectorSeniorityEnum");
+const EmploymentTypeEnum_1 = require("../../enums/EmploymentTypeEnum");
+const PermissionScope_1 = require("../../../platformRbac/enums/PermissionScope");
+/**
+ * Body de POST /retailers/:retailerId/users/provision — alta de usuario retail ORQUESTADA (SureKeep F1,
+ * scope mirror). Invierte el orden del alta clásica: en vez de recibir un `cognitoSub` ya existente,
+ * retail-org provisiona al usuario en RBAC (Cognito + SharedUser + RoleAssignment) y luego crea el
+ * `RetailUser` con el `cognitoSub` retornado. El `retailerId` sale del path.
+ *
+ * Diferencia con {@link CreateRetailUserRequest}: aquí van `email` + `roleId` + `scope` + `scopeRef`
+ * (el grant de RBAC) en lugar de `cognitoSub`. El resto de los atributos comerciales son idénticos.
+ */
+class ProvisionRetailUserRequest {
+}
+exports.ProvisionRetailUserRequest = ProvisionRetailUserRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "roleId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEnum)(PermissionScope_1.PermissionScope),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "scope", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "scopeRef", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "homeStoreId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEnum)(EmploymentTypeEnum_1.EmploymentTypeEnum),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "employmentType", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "commissionTier", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "zoneId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "phone", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(CollectorSeniorityEnum_1.CollectorSeniorityEnum),
+    __metadata("design:type", String)
+], ProvisionRetailUserRequest.prototype, "collectorSeniority", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], ProvisionRetailUserRequest.prototype, "coverageStoreIds", void 0);

package/bin/retailOrg/index.d.ts

@@ -27,6 +27,7 @@ export * from './dtos/requests/CreateStoreRequest';
 export * from './dtos/requests/UpdateStoreRequest';
 export * from './dtos/requests/ChangeStoreStatusRequest';
 export * from './dtos/requests/CreateRetailUserRequest';
+export * from './dtos/requests/ProvisionRetailUserRequest';
 export * from './dtos/requests/UpdateRetailUserRequest';
 export * from './dtos/requests/ChangeRetailUserStatusRequest';
 export * from './dtos/requests/TransferRetailUserRequest';

package/bin/retailOrg/index.js

@@ -47,6 +47,7 @@ __exportStar(require("./dtos/requests/CreateStoreRequest"), exports);
 __exportStar(require("./dtos/requests/UpdateStoreRequest"), exports);
 __exportStar(require("./dtos/requests/ChangeStoreStatusRequest"), exports);
 __exportStar(require("./dtos/requests/CreateRetailUserRequest"), exports);
+__exportStar(require("./dtos/requests/ProvisionRetailUserRequest"), exports);
 __exportStar(require("./dtos/requests/UpdateRetailUserRequest"), exports);
 __exportStar(require("./dtos/requests/ChangeRetailUserStatusRequest"), exports);
 __exportStar(require("./dtos/requests/TransferRetailUserRequest"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.192.0",
+  "version": "3.194.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/dtos/CreateLevelEntityRequest.ts

@@ -0,0 +1,18 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+/**
+ * Body del POST /internal/tenants/{tenantId}/users/../levels/{level}/entities (endpoint privado, VPC/ANONIMUS).
+ * `tenantId` y `level` viajan en el path (no acá). Crea una scope-entity genérica L1/L2/L3 en RBAC.
+ *
+ * Consumido por el espejo de jerarquía de SureKeep F1 (retailer→L1, zona→L2, tienda→L3) vía api-invoker.
+ * - `id` es BYOID (DEC-RBAC-027): el caller trae su propio id → creates idempotentes (PutItem overwrite).
+ * - `parentId` es obligatorio para L2/L3 (id del nivel superior); ausente en L1 (cuelga de TENANT). Lo valida el manager.
+ * - `createdBy` = cognitoSub del admin real (audit), propagado desde el evento de outbox.
+ */
+export class CreateLevelEntityRequest {
+    @Expose() @IsString() @IsNotEmpty() displayName!: string;
+    @Expose() @IsOptional() @IsString() @IsNotEmpty() id?: string;
+    @Expose() @IsOptional() @IsString() @IsNotEmpty() parentId?: string;
+    @Expose() @IsString() @IsNotEmpty() createdBy!: string;
+}

package/src/platformRbac/dtos/CreateLevelEntityResponse.ts

@@ -0,0 +1,14 @@
+/**
+ * Respuesta del POST create-level-entity (endpoint privado). Espejo público de la scope-entity creada
+ * (SharedLevelEntityRow del rbac-business). Interface plain → export type-only.
+ */
+export interface CreateLevelEntityResponse {
+    id: string;
+    displayName: string;
+    parentId?: string;
+    level: string;
+    createdAt: number;
+    updatedAt: number;
+    createdBy?: string;
+    updatedBy?: string;
+}

package/src/platformRbac/dtos/CreateTenantUserRequest.ts

@@ -0,0 +1,22 @@
+import { Expose } from 'class-transformer';
+import { IsEmail, IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { PermissionScope } from '../enums/PermissionScope';
+
+/**
+ * Body del POST /internal/tenants/{tenantId}/users (endpoint privado, VPC/ANONIMUS). `tenantId` viaja en el path.
+ * Provisiona Cognito + SharedUser + RoleAssignment (rol + scopeRef) en RBAC — reusa UserProvisioningService.
+ *
+ * Consumido por el alta de usuario orquestada de SureKeep F1 (retail-org → RBAC → RetailUser) vía api-invoker.
+ * - Usuario provisionado en estado INVITED (mitiga orphan si el paso siguiente en retail-org falla).
+ * - Idempotente por identidad Cognito.
+ * - `scope`/`scopeRef` = grant del rol (ej. LEVEL_3 + storeId para un vendedor de tienda).
+ * - `createdBy` = cognitoSub del admin real (audit + grantedBy del assignment).
+ */
+export class CreateTenantUserRequest {
+    @Expose() @IsEmail() email!: string;
+    @Expose() @IsOptional() @IsString() @IsNotEmpty() displayName?: string;
+    @Expose() @IsString() @IsNotEmpty() roleId!: string;
+    @Expose() @IsEnum(PermissionScope) scope!: PermissionScope;
+    @Expose() @IsString() @IsNotEmpty() scopeRef!: string;
+    @Expose() @IsString() @IsNotEmpty() createdBy!: string;
+}

package/src/platformRbac/dtos/CreateTenantUserResponse.ts

@@ -0,0 +1,7 @@
+/**
+ * Respuesta del POST create-tenant-user (endpoint privado). Devuelve el cognitoSub del usuario
+ * provisionado, que retail-org guarda en el RetailUser para el match F1↔RBAC. Interface plain → type-only.
+ */
+export interface CreateTenantUserResponse {
+    cognitoSub: string;
+}

package/src/platformRbac/index.ts

@@ -123,3 +123,11 @@ export type {
 export * from './dtos/SelfRegisterStartRequest';
 export * from './dtos/SelfRegisterVerifyOtpRequest';
 export * from './dtos/SelfRegisterCompleteRequest';
+
+// Endpoints privados de espejo de jerarquía + alta de usuario (SureKeep F1, scope mirror).
+// Request DTOs llevan decoradores class-validator → export de valor (se hidratan con plainToInstance);
+// Response son interfaces plain → type-only. Consumidos por retail-org vía api-invoker (Publisher).
+export * from './dtos/CreateLevelEntityRequest';
+export type { CreateLevelEntityResponse } from './dtos/CreateLevelEntityResponse';
+export * from './dtos/CreateTenantUserRequest';
+export type { CreateTenantUserResponse } from './dtos/CreateTenantUserResponse';

package/src/retailOrg/dtos/requests/ProvisionRetailUserRequest.ts

@@ -0,0 +1,82 @@
+import { Expose } from 'class-transformer';
+import { IsArray, IsEmail, IsEnum, IsOptional, IsString } from 'class-validator';
+import { CollectorSeniorityEnum } from '../../enums/CollectorSeniorityEnum';
+import { EmploymentTypeEnum } from '../../enums/EmploymentTypeEnum';
+import { PermissionScope } from '../../../platformRbac/enums/PermissionScope';
+
+/**
+ * Body de POST /retailers/:retailerId/users/provision — alta de usuario retail ORQUESTADA (SureKeep F1,
+ * scope mirror). Invierte el orden del alta clásica: en vez de recibir un `cognitoSub` ya existente,
+ * retail-org provisiona al usuario en RBAC (Cognito + SharedUser + RoleAssignment) y luego crea el
+ * `RetailUser` con el `cognitoSub` retornado. El `retailerId` sale del path.
+ *
+ * Diferencia con {@link CreateRetailUserRequest}: aquí van `email` + `roleId` + `scope` + `scopeRef`
+ * (el grant de RBAC) en lugar de `cognitoSub`. El resto de los atributos comerciales son idénticos.
+ */
+export class ProvisionRetailUserRequest {
+    /** Identidad de login del usuario a provisionar en Cognito/RBAC. */
+    @Expose()
+    @IsEmail()
+    email!: string;
+
+    /** Rol de RBAC a asignar (id del rol del tenant). */
+    @Expose()
+    @IsString()
+    roleId!: string;
+
+    /** Scope del grant (ej. LEVEL_1 = retailer, LEVEL_3 = tienda). */
+    @Expose()
+    @IsEnum(PermissionScope)
+    scope!: PermissionScope;
+
+    /** Referencia del scope (ej. retailerId para LEVEL_1, storeId para LEVEL_3). */
+    @Expose()
+    @IsString()
+    scopeRef!: string;
+
+    /**
+     * Nombre de display — etiqueta de conveniencia (DEC-SKF1-021). La identidad real vive en RBAC
+     * (DEC-SKF1-005); esto es solo un rótulo para reconocer al usuario en el backoffice. Opcional.
+     */
+    @Expose()
+    @IsOptional()
+    @IsString()
+    displayName?: string;
+
+    @Expose()
+    @IsString()
+    homeStoreId!: string;
+
+    @Expose()
+    @IsEnum(EmploymentTypeEnum)
+    employmentType!: EmploymentTypeEnum;
+
+    @Expose()
+    @IsString()
+    commissionTier!: string;
+
+    /** Zona de operación del usuario; `null` si no está acotado a una zona. */
+    @Expose()
+    @IsOptional()
+    @IsString()
+    zoneId!: string | null;
+
+    /** Teléfono de contacto del usuario retail; opcional. */
+    @Expose()
+    @IsOptional()
+    @IsString()
+    phone?: string;
+
+    /** Seniority del cobrador; solo aplica a usuarios retail con rol de cobrador. */
+    @Expose()
+    @IsOptional()
+    @IsEnum(CollectorSeniorityEnum)
+    collectorSeniority?: CollectorSeniorityEnum;
+
+    /** Tiendas que cubre el cobrador (zona de cobranza); opcional. */
+    @Expose()
+    @IsOptional()
+    @IsArray()
+    @IsString({ each: true })
+    coverageStoreIds?: string[];
+}

package/src/retailOrg/index.ts

@@ -35,6 +35,7 @@ export * from './dtos/requests/CreateStoreRequest';
 export * from './dtos/requests/UpdateStoreRequest';
 export * from './dtos/requests/ChangeStoreStatusRequest';
 export * from './dtos/requests/CreateRetailUserRequest';
+export * from './dtos/requests/ProvisionRetailUserRequest';
 export * from './dtos/requests/UpdateRetailUserRequest';
 export * from './dtos/requests/ChangeRetailUserStatusRequest';
 export * from './dtos/requests/TransferRetailUserRequest';