@fiado/type-kit 3.47.0 → 3.49.0

package/src/platformErrorEvents/dtos/internal/PlatformErrorEventMessage.ts

@@ -1,21 +1,21 @@
-import { ErrorSeverityEnum } from "../../enums/ErrorSeverityEnum";
-
-export class PlatformErrorEventMessage {
-    errorType: string;
-    severity: ErrorSeverityEnum;
-    errorCode: string;
-    stackTrace: string;
-    service: string;
-    traceId?: string;
-    requestId?: string;
-    endpoint?: string;
-    directoryId?: string;
-    peopleId?: string;
-    app?: string;
-
-    // Campos nuevos — opcionales para backwards compatibility
-    layer?: string;            // "SERVICE" | "REPOSITORY" | "CONTROLLER" | "GATEWAY" | etc.
-    exceptionName?: string;    // "InitializationException" | "ProcessingException" | etc.
-    transactionId?: string;    // ID de la transacción en proceso
-    productCatalogId?: string; // "CP_P2P_MXN" | "CP_SPEI_OUT" | etc.
-}
+import { ErrorSeverityEnum } from "../../enums/ErrorSeverityEnum";
+
+export class PlatformErrorEventMessage {
+    errorType: string;
+    severity: ErrorSeverityEnum;
+    errorCode: string;
+    stackTrace: string;
+    service: string;
+    traceId?: string;
+    requestId?: string;
+    endpoint?: string;
+    directoryId?: string;
+    peopleId?: string;
+    app?: string;
+
+    // Campos nuevos — opcionales para backwards compatibility
+    layer?: string;            // "SERVICE" | "REPOSITORY" | "CONTROLLER" | "GATEWAY" | etc.
+    exceptionName?: string;    // "InitializationException" | "ProcessingException" | etc.
+    transactionId?: string;    // ID de la transacción en proceso
+    productCatalogId?: string; // "CP_P2P_MXN" | "CP_SPEI_OUT" | etc.
+}

package/src/platformErrorEvents/enums/ErrorSeverityEnum.ts

@@ -1,6 +1,6 @@
-export enum ErrorSeverityEnum {
-    LOW = "LOW",
-    MEDIUM = "MEDIUM",
-    HIGH = "HIGH",
-    CRITICAL = "CRITICAL"
-}
+export enum ErrorSeverityEnum {
+    LOW = "LOW",
+    MEDIUM = "MEDIUM",
+    HIGH = "HIGH",
+    CRITICAL = "CRITICAL"
+}

package/src/platformErrorEvents/enums/ErrorStatusEnum.ts

@@ -1,5 +1,5 @@
-export enum ErrorStatusEnum {
-    OPEN = "OPEN",
-    RESOLVED = "RESOLVED",
-    IGNORED = "IGNORED"
-}
+export enum ErrorStatusEnum {
+    OPEN = "OPEN",
+    RESOLVED = "RESOLVED",
+    IGNORED = "IGNORED"
+}

package/src/platformErrorEvents/enums/ResolutionTypeEnum.ts

@@ -1,4 +1,4 @@
-export enum ResolutionTypeEnum {
-    OPERATIONAL = "OPERATIONAL",
-    TECHNICAL = "TECHNICAL"
-}
+export enum ResolutionTypeEnum {
+    OPERATIONAL = "OPERATIONAL",
+    TECHNICAL = "TECHNICAL"
+}

package/src/platformErrorEvents/index.ts

@@ -1,11 +1,11 @@
-//dtos/internal
-export * from './dtos/internal/PlatformErrorEventMessage';
-
-//enums
-export * from './enums/ErrorSeverityEnum';
-export * from './enums/ErrorStatusEnum';
-export * from './enums/ResolutionTypeEnum';
-
-// Mapas de severidad por lambda
-export { TRANSACTION_PROCESSOR_SEVERITY_BY_CODE } from './severity/transaction-processor.severity';
-export { CARD_BUSINESS_SEVERITY_BY_CODE } from './severity/card-business.severity';
+//dtos/internal
+export * from './dtos/internal/PlatformErrorEventMessage';
+
+//enums
+export * from './enums/ErrorSeverityEnum';
+export * from './enums/ErrorStatusEnum';
+export * from './enums/ResolutionTypeEnum';
+
+// Mapas de severidad por lambda
+export { TRANSACTION_PROCESSOR_SEVERITY_BY_CODE } from './severity/transaction-processor.severity';
+export { CARD_BUSINESS_SEVERITY_BY_CODE } from './severity/card-business.severity';

package/src/platformErrorEvents/severity/card-business.severity.ts

@@ -1,25 +1,25 @@
-// Mapa canónico de severidades para fiado-card-business.
-// Cada lambda tiene su propio archivo en este directorio.
-// Fuente de verdad: sincronizado con los error.code que lanzan las excepciones del lambda.
-export const CARD_BUSINESS_SEVERITY_BY_CODE: Record<string, string> = {
-    // CRITICAL — pérdida de datos, requiere acción inmediata
-    "DB_WRITE_ERROR":                               "CRITICAL",
-
-    // HIGH — errores técnicos inesperados
-    "SYSTEM_ERROR":                                 "HIGH",
-    "TIME_OUT":                                     "HIGH",
-    "CARD_PROCESSOR_ERROR":                         "HIGH",
-
-    // MEDIUM — errores de configuración o datos inválidos
-    "INVALID_TOKEN":                                "MEDIUM",
-    "PRODUCT_NOT_FOUND":                            "MEDIUM",
-
-    // LOW — errores de negocio esperados (útiles para soporte)
-    "INSUFFICIENT_FUNDS":                           "LOW",
-    "CARD_NOT_FOUND":                               "LOW",
-    "CARD_NOT_ACTIVE":                              "LOW",
-    "ACCOUNT_BLOCKED":                              "LOW",
-    "ACCOUNT_NOT_FOUND":                            "LOW",
-    "USER_NOT_ACTIVE":                              "LOW",
-    "INVALID_REQUEST":                              "LOW",
-};
+// Mapa canónico de severidades para fiado-card-business.
+// Cada lambda tiene su propio archivo en este directorio.
+// Fuente de verdad: sincronizado con los error.code que lanzan las excepciones del lambda.
+export const CARD_BUSINESS_SEVERITY_BY_CODE: Record<string, string> = {
+    // CRITICAL — pérdida de datos, requiere acción inmediata
+    "DB_WRITE_ERROR":                               "CRITICAL",
+
+    // HIGH — errores técnicos inesperados
+    "SYSTEM_ERROR":                                 "HIGH",
+    "TIME_OUT":                                     "HIGH",
+    "CARD_PROCESSOR_ERROR":                         "HIGH",
+
+    // MEDIUM — errores de configuración o datos inválidos
+    "INVALID_TOKEN":                                "MEDIUM",
+    "PRODUCT_NOT_FOUND":                            "MEDIUM",
+
+    // LOW — errores de negocio esperados (útiles para soporte)
+    "INSUFFICIENT_FUNDS":                           "LOW",
+    "CARD_NOT_FOUND":                               "LOW",
+    "CARD_NOT_ACTIVE":                              "LOW",
+    "ACCOUNT_BLOCKED":                              "LOW",
+    "ACCOUNT_NOT_FOUND":                            "LOW",
+    "USER_NOT_ACTIVE":                              "LOW",
+    "INVALID_REQUEST":                              "LOW",
+};

package/src/platformErrorEvents/severity/transaction-processor.severity.ts

@@ -1,34 +1,34 @@
-// Mapa canónico de severidades para transaction-processor-business.
-// Cada lambda tiene su propio archivo en este directorio.
-// Fuente de verdad: sincronizado con los error.code que lanzan las excepciones del lambda.
-export const TRANSACTION_PROCESSOR_SEVERITY_BY_CODE: Record<string, string> = {
-    // CRITICAL — pérdida de datos, requiere acción inmediata
-    "TRANSACTION_PERSIST_ERROR":                    "CRITICAL",
-    "DB_WRITE_ERROR":                               "CRITICAL",
-
-    // HIGH — errores técnicos inesperados
-    "SYSTEM_ERROR":                                 "HIGH",
-    "TIME_OUT":                                     "HIGH",
-
-    // MEDIUM — errores de configuración o datos inválidos
-    "INVALID_TOKEN":                                "MEDIUM",
-    "PRODUCT_NOT_FOUND":                            "MEDIUM",
-    "PROVIDER_NOT_FOUND":                           "MEDIUM",
-
-    // LOW — errores de negocio esperados (útiles para soporte)
-    "INSUFFICIENT_FUNDS":                           "LOW",
-    "USER_NOT_ACTIVE":                              "LOW",
-    "INVALID_SECRET_NUMBER":                        "LOW",
-    "BLOCKED_SECRET_NUMBER":                        "LOW",
-    "CARD_NOT_ACTIVE":                              "LOW",
-    "CARD_NOT_FOUND":                               "LOW",
-    "ACCOUNT_BLOCKED":                              "LOW",
-    "ACCOUNT_NOT_FOUND":                            "LOW",
-    "DOCUMENT_ID_NOT_FOUND":                        "LOW",
-    "TRX_AMOUNT_LIMIT_EXCEEDED":                    "LOW",
-    "CREDIT_MINIMAL_AMOUNT_ERROR":                  "LOW",
-    "OTP_REQUIRED":                                 "LOW",
-    "ACCOUNT_LEVEL_MAX_MONTHLY_AMOUNT_EXCEEDED":    "LOW",
-    "ACCOUNT_LEVEL_MAX_AVAILABLE_BALANCE_EXCEEDED": "LOW",
-    "USER_NOT_AUTHORIZED_FOR_CREDIT":               "LOW",
-};
+// Mapa canónico de severidades para transaction-processor-business.
+// Cada lambda tiene su propio archivo en este directorio.
+// Fuente de verdad: sincronizado con los error.code que lanzan las excepciones del lambda.
+export const TRANSACTION_PROCESSOR_SEVERITY_BY_CODE: Record<string, string> = {
+    // CRITICAL — pérdida de datos, requiere acción inmediata
+    "TRANSACTION_PERSIST_ERROR":                    "CRITICAL",
+    "DB_WRITE_ERROR":                               "CRITICAL",
+
+    // HIGH — errores técnicos inesperados
+    "SYSTEM_ERROR":                                 "HIGH",
+    "TIME_OUT":                                     "HIGH",
+
+    // MEDIUM — errores de configuración o datos inválidos
+    "INVALID_TOKEN":                                "MEDIUM",
+    "PRODUCT_NOT_FOUND":                            "MEDIUM",
+    "PROVIDER_NOT_FOUND":                           "MEDIUM",
+
+    // LOW — errores de negocio esperados (útiles para soporte)
+    "INSUFFICIENT_FUNDS":                           "LOW",
+    "USER_NOT_ACTIVE":                              "LOW",
+    "INVALID_SECRET_NUMBER":                        "LOW",
+    "BLOCKED_SECRET_NUMBER":                        "LOW",
+    "CARD_NOT_ACTIVE":                              "LOW",
+    "CARD_NOT_FOUND":                               "LOW",
+    "ACCOUNT_BLOCKED":                              "LOW",
+    "ACCOUNT_NOT_FOUND":                            "LOW",
+    "DOCUMENT_ID_NOT_FOUND":                        "LOW",
+    "TRX_AMOUNT_LIMIT_EXCEEDED":                    "LOW",
+    "CREDIT_MINIMAL_AMOUNT_ERROR":                  "LOW",
+    "OTP_REQUIRED":                                 "LOW",
+    "ACCOUNT_LEVEL_MAX_MONTHLY_AMOUNT_EXCEEDED":    "LOW",
+    "ACCOUNT_LEVEL_MAX_AVAILABLE_BALANCE_EXCEEDED": "LOW",
+    "USER_NOT_AUTHORIZED_FOR_CREDIT":               "LOW",
+};

package/src/platformRbac/dtos/AuthContext.ts

@@ -1,22 +1,22 @@
-import type { Permission } from '../enums/Permission';
-import type { RoleAssignmentInfo } from './RoleAssignmentInfo';
-
-/**
- * Shape DESERIALIZADO del authorizer context.
- * El authorizer Lambda (componente 07) lo construye + serializa; el helper
- * `extractTenantContext` lo deserializa para los handlers business.
- *
- * En API Gateway authorizer.context todos los valores son strings:
- * - `permissions` viaja como CSV (`"a.b.c,d.e.f,..."`).
- * - `roleAssignments` viaja como JSON string.
- * Este interface es la forma ya parseada.
- */
-export interface AuthContext {
-    cognitoSub: string;
-    tenantId: string;
-    email: string;
-    roleAssignments: RoleAssignmentInfo[];
-    permissions: Permission[];
-    resolvedAt: string;
-    issuer?: string;
-}
+import type { Permission } from '../enums/Permission';
+import type { RoleAssignmentInfo } from './RoleAssignmentInfo';
+
+/**
+ * Shape DESERIALIZADO del authorizer context.
+ * El authorizer Lambda (componente 07) lo construye + serializa; el helper
+ * `extractTenantContext` lo deserializa para los handlers business.
+ *
+ * En API Gateway authorizer.context todos los valores son strings:
+ * - `permissions` viaja como CSV (`"a.b.c,d.e.f,..."`).
+ * - `roleAssignments` viaja como JSON string.
+ * Este interface es la forma ya parseada.
+ */
+export interface AuthContext {
+    cognitoSub: string;
+    tenantId: string;
+    email: string;
+    roleAssignments: RoleAssignmentInfo[];
+    permissions: Permission[];
+    resolvedAt: string;
+    issuer?: string;
+}

package/src/platformRbac/dtos/AuthorizeRequest.ts

@@ -0,0 +1,14 @@
+import { Expose } from 'class-transformer';
+import { IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { PermissionScope } from '../enums/PermissionScope';
+
+/**
+ * Input del POST /internal/authorize. El decorador @RequirePermission lo construye:
+ * token (del cookie session), permission requerida, y scope+scopeRef opcionales.
+ */
+export class AuthorizeRequest {
+    @Expose() @IsString() @IsNotEmpty() token!: string;
+    @Expose() @IsString() @IsNotEmpty() permission!: string;
+    @Expose() @IsOptional() @IsEnum(PermissionScope) scope?: PermissionScope;
+    @Expose() @IsOptional() @IsString() scopeRef?: string;
+}

package/src/platformRbac/dtos/AuthorizeResponse.ts

@@ -0,0 +1,16 @@
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
+import { AuthorizeDenyReason } from '../enums/AuthorizeDenyReason';
+import type { AuthContext } from './AuthContext';
+
+/**
+ * Output del POST /internal/authorize. Si allow=true trae el context resuelto
+ * (para que el decorador lo populé en el request). Si allow=false trae el reason.
+ * `context` es solo contrato TS de salida (AuthContext es interface, no clase) → SIN @Expose,
+ * es passthrough; los responses no se validan (fiado-validation-and-dtos § 7).
+ */
+export class AuthorizeResponse {
+    @Expose() @IsBoolean() allow!: boolean;
+    @Expose() @IsOptional() @IsEnum(AuthorizeDenyReason) reason?: AuthorizeDenyReason;
+    context?: AuthContext;
+}

package/src/platformRbac/dtos/PermissionMeta.ts

@@ -1,20 +1,20 @@
-import type { Permission } from '../enums/Permission';
-import type { PermissionScope } from '../enums/PermissionScope';
-import type { PermissionCategory } from '../enums/PermissionCategory';
-
-/**
- * Metadata enriquecida de una permission del catálogo.
- * Usado para:
- * - Sync del enum a DDB `PlatformPermission_GT` al deploy.
- * - UI del módulo rbac-admin: selector de permissions agrupado.
- * - Reporting / docs.
- */
-export interface PermissionMeta {
-    permissionKey: Permission;
-    displayName: string;
-    description: string;
-    category: PermissionCategory;
-    scope: PermissionScope;
-    platforms: string[];
-    isDeprecated?: boolean;
-}
+import type { Permission } from '../enums/Permission';
+import type { PermissionScope } from '../enums/PermissionScope';
+import type { PermissionCategory } from '../enums/PermissionCategory';
+
+/**
+ * Metadata enriquecida de una permission del catálogo.
+ * Usado para:
+ * - Sync del enum a DDB `PlatformPermission_GT` al deploy.
+ * - UI del módulo rbac-admin: selector de permissions agrupado.
+ * - Reporting / docs.
+ */
+export interface PermissionMeta {
+    permissionKey: Permission;
+    displayName: string;
+    description: string;
+    category: PermissionCategory;
+    scope: PermissionScope;
+    platforms: string[];
+    isDeprecated?: boolean;
+}

package/src/platformRbac/dtos/RoleAssignmentInfo.ts

@@ -1,12 +1,12 @@
-import type { PermissionScope } from '../enums/PermissionScope';
-
-/**
- * Una asignación de role a un user con scope específico.
- * Shape que el authorizer Lambda (componente 07) serializa como JSON string
- * dentro del API Gateway authorizer context.
- */
-export interface RoleAssignmentInfo {
-    roleId: string;
-    scope: PermissionScope;
-    scopeRef: string;
-}
+import type { PermissionScope } from '../enums/PermissionScope';
+
+/**
+ * Una asignación de role a un user con scope específico.
+ * Shape que el authorizer Lambda (componente 07) serializa como JSON string
+ * dentro del API Gateway authorizer context.
+ */
+export interface RoleAssignmentInfo {
+    roleId: string;
+    scope: PermissionScope;
+    scopeRef: string;
+}

package/src/platformRbac/enums/AuthorizeDenyReason.ts

@@ -0,0 +1,10 @@
+/**
+ * Razón de denegación del endpoint POST /internal/authorize del platform-rbac-business.
+ * Consumido por el decorador @RequirePermission del @fiado/gateway-adapter.
+ */
+export enum AuthorizeDenyReason {
+    INVALID_TOKEN = 'INVALID_TOKEN',
+    NO_PERMISSION = 'NO_PERMISSION',
+    SCOPE_DENIED = 'SCOPE_DENIED',
+    USER_NOT_FOUND = 'USER_NOT_FOUND',
+}

package/src/platformRbac/enums/Permission.ts

@@ -1,120 +1,120 @@
-/**
- * Catálogo universal de permisos del sistema RBAC Fiado.
- *
- * Origen: componente 01 de Fase 0 SureKeep (spec maestro):
- *   surekeep/docs/5_fases/00_fase0_cognito_rbac_users_mfa/componentes/01_typekit-rbac-additions.md
- *
- * Copy-paste literal de los 78 valores del spec (DEC-003).
- * Convención: `<category>.<resource>.<action>` (snake_case en action si multi-palabra).
- * Cualquier cambio aquí requiere PR + bump minor + redeploy de consumers.
- *
- * Coexiste con módulo `rbac/` oficial cuando yhonhansen publique componente 01 — TD-RBAC-002.
- */
-export enum Permission {
-    // ====================================================
-    // RBAC — gestión genérica del propio sistema RBAC
-    // ====================================================
-    RBAC_CATALOG_MANAGE = 'rbac.catalog.manage',
-
-    // ====================================================
-    // PLATFORM — operaciones a nivel meta-plataforma (Fiado equipo)
-    // ====================================================
-    PLATFORM_TENANT_CREATE = 'platform.tenant.create',
-    PLATFORM_TENANT_LIST = 'platform.tenant.list',
-    PLATFORM_TENANT_VIEW = 'platform.tenant.view',
-    PLATFORM_TENANT_UPDATE = 'platform.tenant.update',
-    PLATFORM_TENANT_SUSPEND = 'platform.tenant.suspend',
-    PLATFORM_TENANT_ACTIVATE = 'platform.tenant.activate',
-    PLATFORM_TENANT_ADMIN_REPLACE = 'platform.tenant.admin.replace',
-    PLATFORM_COGNITO_POOL_MANAGE = 'platform.cognito.pool.manage',
-    PLATFORM_COGNITO_POOL_LIST = 'platform.cognito.pool.list',
-    PLATFORM_USER_CREATE = 'platform.user.create',
-    PLATFORM_USER_LIST = 'platform.user.list',
-    PLATFORM_USER_VIEW = 'platform.user.view',
-    PLATFORM_USER_UPDATE = 'platform.user.update',
-    PLATFORM_USER_DISABLE = 'platform.user.disable',
-    PLATFORM_USER_ENABLE = 'platform.user.enable',
-    PLATFORM_USER_DELETE = 'platform.user.delete',
-    PLATFORM_ROLE_CREATE = 'platform.role.create',
-    PLATFORM_ROLE_LIST = 'platform.role.list',
-    PLATFORM_ROLE_UPDATE = 'platform.role.update',
-    PLATFORM_ROLE_DELETE = 'platform.role.delete',
-    PLATFORM_AUDIT_VIEW = 'platform.audit.view',
-
-    // ====================================================
-    // TENANT — operaciones dentro del silo de un tenant
-    // ====================================================
-    TENANT_USER_CREATE = 'tenant.user.create',
-    TENANT_USER_LIST = 'tenant.user.list',
-    TENANT_USER_VIEW = 'tenant.user.view',
-    TENANT_USER_UPDATE = 'tenant.user.update',
-    TENANT_USER_DISABLE = 'tenant.user.disable',
-    TENANT_USER_ENABLE = 'tenant.user.enable',
-    TENANT_USER_DELETE = 'tenant.user.delete',
-    TENANT_USER_MFA_RESET = 'tenant.user.mfa.reset',
-    TENANT_USER_PASSWORD_RESET = 'tenant.user.password.reset',
-    TENANT_ROLE_CREATE = 'tenant.role.create',
-    TENANT_ROLE_LIST = 'tenant.role.list',
-    TENANT_ROLE_UPDATE = 'tenant.role.update',
-    TENANT_ROLE_DELETE = 'tenant.role.delete',
-    TENANT_ROLE_VIEW = 'tenant.role.view',
-    TENANT_ROLE_ASSIGN = 'tenant.role.assign',
-    TENANT_ROLE_REVOKE = 'tenant.role.revoke',
-    TENANT_SECURITY_POLICY_VIEW = 'tenant.security.policy.view',
-    TENANT_SECURITY_POLICY_MANAGE = 'tenant.security.policy.manage',
-    TENANT_BRANDING_MANAGE = 'tenant.branding.manage',
-    TENANT_AUDIT_VIEW = 'tenant.audit.view',
-
-    // ====================================================
-    // RETAIL — catálogo + inventario + ventas
-    // ====================================================
-    RETAIL_PRODUCT_CREATE = 'retail.product.create',
-    RETAIL_PRODUCT_LIST = 'retail.product.list',
-    RETAIL_PRODUCT_VIEW = 'retail.product.view',
-    RETAIL_PRODUCT_UPDATE = 'retail.product.update',
-    RETAIL_PRODUCT_DELETE = 'retail.product.delete',
-    RETAIL_PRODUCT_MDM_CONFIG = 'retail.product.mdm_config',
-    RETAIL_INVENTORY_LIST = 'retail.inventory.list',
-    RETAIL_INVENTORY_VIEW = 'retail.inventory.view',
-    RETAIL_INVENTORY_UPDATE = 'retail.inventory.update',
-    RETAIL_SALE_CREATE = 'retail.sale.create',
-    RETAIL_SALE_LIST = 'retail.sale.list',
-    RETAIL_SALE_CANCEL = 'retail.sale.cancel',
-    RETAIL_STORE_MANAGE = 'retail.store.manage',
-    RETAIL_RETAILER_MANAGE = 'retail.retailer.manage',
-
-    // ====================================================
-    // LEND — créditos + cobranza
-    // ====================================================
-    LEND_CREDIT_CREATE = 'lend.credit.create',
-    LEND_CREDIT_LIST = 'lend.credit.list',
-    LEND_CREDIT_VIEW = 'lend.credit.view',
-    LEND_CREDIT_UPDATE = 'lend.credit.update',
-    LEND_CREDIT_LIQUIDATE = 'lend.credit.liquidate',
-    LEND_CREDIT_RESTRUCTURE = 'lend.credit.restructure',
-    LEND_PAYMENT_APPLY = 'lend.payment.apply',
-    LEND_PAYMENT_LIST = 'lend.payment.list',
-    LEND_PAYMENT_REVERSE = 'lend.payment.reverse',
-    LEND_INSTALLMENT_VIEW = 'lend.installment.view',
-
-    // ====================================================
-    // MDM — device management (subset especializado de LEND)
-    // ====================================================
-    MDM_DEVICE_ENROLL = 'mdm.device.enroll',
-    MDM_DEVICE_RELEASE = 'mdm.device.release',
-    MDM_DEVICE_ARCHIVE = 'mdm.device.archive',
-    MDM_DEVICE_DEACTIVATE = 'mdm.device.deactivate',
-    MDM_DEVICE_LOCK_MANUAL = 'mdm.device.lock.manual',
-    MDM_DEVICE_UNLOCK_MANUAL = 'mdm.device.unlock.manual',
-    MDM_DEVICE_PIN_UNLOCK = 'mdm.device.pin_unlock',
-    MDM_DEVICE_EXTEND_VALIDITY = 'mdm.device.extend_validity',
-    MDM_DEVICE_NOTIFY = 'mdm.device.notify',
-    MDM_DEVICE_STATUS_VIEW = 'mdm.device.status.view',
-    MDM_OPERATION_LOG_VIEW = 'mdm.operation_log.view',
-    MDM_TEST = 'mdm.test',
-
-    // ====================================================
-    // PAY — futuro FiadoPay (placeholder, no usado en MVP)
-    // ====================================================
-    PAY_TRANSACTION_VIEW = 'pay.transaction.view',
-}
+/**
+ * Catálogo universal de permisos del sistema RBAC Fiado.
+ *
+ * Origen: componente 01 de Fase 0 SureKeep (spec maestro):
+ *   surekeep/docs/5_fases/00_fase0_cognito_rbac_users_mfa/componentes/01_typekit-rbac-additions.md
+ *
+ * Copy-paste literal de los 78 valores del spec (DEC-003).
+ * Convención: `<category>.<resource>.<action>` (snake_case en action si multi-palabra).
+ * Cualquier cambio aquí requiere PR + bump minor + redeploy de consumers.
+ *
+ * Coexiste con módulo `rbac/` oficial cuando yhonhansen publique componente 01 — TD-RBAC-002.
+ */
+export enum Permission {
+    // ====================================================
+    // RBAC — gestión genérica del propio sistema RBAC
+    // ====================================================
+    RBAC_CATALOG_MANAGE = 'rbac.catalog.manage',
+
+    // ====================================================
+    // PLATFORM — operaciones a nivel meta-plataforma (Fiado equipo)
+    // ====================================================
+    PLATFORM_TENANT_CREATE = 'platform.tenant.create',
+    PLATFORM_TENANT_LIST = 'platform.tenant.list',
+    PLATFORM_TENANT_VIEW = 'platform.tenant.view',
+    PLATFORM_TENANT_UPDATE = 'platform.tenant.update',
+    PLATFORM_TENANT_SUSPEND = 'platform.tenant.suspend',
+    PLATFORM_TENANT_ACTIVATE = 'platform.tenant.activate',
+    PLATFORM_TENANT_ADMIN_REPLACE = 'platform.tenant.admin.replace',
+    PLATFORM_COGNITO_POOL_MANAGE = 'platform.cognito.pool.manage',
+    PLATFORM_COGNITO_POOL_LIST = 'platform.cognito.pool.list',
+    PLATFORM_USER_CREATE = 'platform.user.create',
+    PLATFORM_USER_LIST = 'platform.user.list',
+    PLATFORM_USER_VIEW = 'platform.user.view',
+    PLATFORM_USER_UPDATE = 'platform.user.update',
+    PLATFORM_USER_DISABLE = 'platform.user.disable',
+    PLATFORM_USER_ENABLE = 'platform.user.enable',
+    PLATFORM_USER_DELETE = 'platform.user.delete',
+    PLATFORM_ROLE_CREATE = 'platform.role.create',
+    PLATFORM_ROLE_LIST = 'platform.role.list',
+    PLATFORM_ROLE_UPDATE = 'platform.role.update',
+    PLATFORM_ROLE_DELETE = 'platform.role.delete',
+    PLATFORM_AUDIT_VIEW = 'platform.audit.view',
+
+    // ====================================================
+    // TENANT — operaciones dentro del silo de un tenant
+    // ====================================================
+    TENANT_USER_CREATE = 'tenant.user.create',
+    TENANT_USER_LIST = 'tenant.user.list',
+    TENANT_USER_VIEW = 'tenant.user.view',
+    TENANT_USER_UPDATE = 'tenant.user.update',
+    TENANT_USER_DISABLE = 'tenant.user.disable',
+    TENANT_USER_ENABLE = 'tenant.user.enable',
+    TENANT_USER_DELETE = 'tenant.user.delete',
+    TENANT_USER_MFA_RESET = 'tenant.user.mfa.reset',
+    TENANT_USER_PASSWORD_RESET = 'tenant.user.password.reset',
+    TENANT_ROLE_CREATE = 'tenant.role.create',
+    TENANT_ROLE_LIST = 'tenant.role.list',
+    TENANT_ROLE_UPDATE = 'tenant.role.update',
+    TENANT_ROLE_DELETE = 'tenant.role.delete',
+    TENANT_ROLE_VIEW = 'tenant.role.view',
+    TENANT_ROLE_ASSIGN = 'tenant.role.assign',
+    TENANT_ROLE_REVOKE = 'tenant.role.revoke',
+    TENANT_SECURITY_POLICY_VIEW = 'tenant.security.policy.view',
+    TENANT_SECURITY_POLICY_MANAGE = 'tenant.security.policy.manage',
+    TENANT_BRANDING_MANAGE = 'tenant.branding.manage',
+    TENANT_AUDIT_VIEW = 'tenant.audit.view',
+
+    // ====================================================
+    // RETAIL — catálogo + inventario + ventas
+    // ====================================================
+    RETAIL_PRODUCT_CREATE = 'retail.product.create',
+    RETAIL_PRODUCT_LIST = 'retail.product.list',
+    RETAIL_PRODUCT_VIEW = 'retail.product.view',
+    RETAIL_PRODUCT_UPDATE = 'retail.product.update',
+    RETAIL_PRODUCT_DELETE = 'retail.product.delete',
+    RETAIL_PRODUCT_MDM_CONFIG = 'retail.product.mdm_config',
+    RETAIL_INVENTORY_LIST = 'retail.inventory.list',
+    RETAIL_INVENTORY_VIEW = 'retail.inventory.view',
+    RETAIL_INVENTORY_UPDATE = 'retail.inventory.update',
+    RETAIL_SALE_CREATE = 'retail.sale.create',
+    RETAIL_SALE_LIST = 'retail.sale.list',
+    RETAIL_SALE_CANCEL = 'retail.sale.cancel',
+    RETAIL_STORE_MANAGE = 'retail.store.manage',
+    RETAIL_RETAILER_MANAGE = 'retail.retailer.manage',
+
+    // ====================================================
+    // LEND — créditos + cobranza
+    // ====================================================
+    LEND_CREDIT_CREATE = 'lend.credit.create',
+    LEND_CREDIT_LIST = 'lend.credit.list',
+    LEND_CREDIT_VIEW = 'lend.credit.view',
+    LEND_CREDIT_UPDATE = 'lend.credit.update',
+    LEND_CREDIT_LIQUIDATE = 'lend.credit.liquidate',
+    LEND_CREDIT_RESTRUCTURE = 'lend.credit.restructure',
+    LEND_PAYMENT_APPLY = 'lend.payment.apply',
+    LEND_PAYMENT_LIST = 'lend.payment.list',
+    LEND_PAYMENT_REVERSE = 'lend.payment.reverse',
+    LEND_INSTALLMENT_VIEW = 'lend.installment.view',
+
+    // ====================================================
+    // MDM — device management (subset especializado de LEND)
+    // ====================================================
+    MDM_DEVICE_ENROLL = 'mdm.device.enroll',
+    MDM_DEVICE_RELEASE = 'mdm.device.release',
+    MDM_DEVICE_ARCHIVE = 'mdm.device.archive',
+    MDM_DEVICE_DEACTIVATE = 'mdm.device.deactivate',
+    MDM_DEVICE_LOCK_MANUAL = 'mdm.device.lock.manual',
+    MDM_DEVICE_UNLOCK_MANUAL = 'mdm.device.unlock.manual',
+    MDM_DEVICE_PIN_UNLOCK = 'mdm.device.pin_unlock',
+    MDM_DEVICE_EXTEND_VALIDITY = 'mdm.device.extend_validity',
+    MDM_DEVICE_NOTIFY = 'mdm.device.notify',
+    MDM_DEVICE_STATUS_VIEW = 'mdm.device.status.view',
+    MDM_OPERATION_LOG_VIEW = 'mdm.operation_log.view',
+    MDM_TEST = 'mdm.test',
+
+    // ====================================================
+    // PAY — futuro FiadoPay (placeholder, no usado en MVP)
+    // ====================================================
+    PAY_TRANSACTION_VIEW = 'pay.transaction.view',
+}