@fiado/type-kit 3.57.0 → 3.57.1

package/src/platformRbac/dtos/AuthorizeRequest.ts

@@ -1,14 +1,14 @@
-import { Expose } from 'class-transformer';
-import { IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
-import { PermissionScope } from '../enums/PermissionScope';
-
-/**
- * Input del POST /internal/authorize. El decorador @RequirePermission lo construye:
- * token (del cookie session), permission requerida, y scope+scopeRef opcionales.
- */
-export class AuthorizeRequest {
-    @Expose() @IsString() @IsNotEmpty() token!: string;
-    @Expose() @IsString() @IsNotEmpty() permission!: string;
-    @Expose() @IsOptional() @IsEnum(PermissionScope) scope?: PermissionScope;
-    @Expose() @IsOptional() @IsString() scopeRef?: string;
-}
+import { Expose } from 'class-transformer';
+import { IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { PermissionScope } from '../enums/PermissionScope';
+
+/**
+ * Input del POST /internal/authorize. El decorador @RequirePermission lo construye:
+ * token (del cookie session), permission requerida, y scope+scopeRef opcionales.
+ */
+export class AuthorizeRequest {
+    @Expose() @IsString() @IsNotEmpty() token!: string;
+    @Expose() @IsString() @IsNotEmpty() permission!: string;
+    @Expose() @IsOptional() @IsEnum(PermissionScope) scope?: PermissionScope;
+    @Expose() @IsOptional() @IsString() scopeRef?: string;
+}

package/src/platformRbac/dtos/AuthorizeResponse.ts

@@ -1,16 +1,16 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
-import { AuthorizeDenyReason } from '../enums/AuthorizeDenyReason';
-import type { AuthContext } from './AuthContext';
-
-/**
- * Output del POST /internal/authorize. Si allow=true trae el context resuelto
- * (para que el decorador lo populé en el request). Si allow=false trae el reason.
- * `context` es solo contrato TS de salida (AuthContext es interface, no clase) → SIN @Expose,
- * es passthrough; los responses no se validan (fiado-validation-and-dtos § 7).
- */
-export class AuthorizeResponse {
-    @Expose() @IsBoolean() allow!: boolean;
-    @Expose() @IsOptional() @IsEnum(AuthorizeDenyReason) reason?: AuthorizeDenyReason;
-    context?: AuthContext;
-}
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
+import { AuthorizeDenyReason } from '../enums/AuthorizeDenyReason';
+import type { AuthContext } from './AuthContext';
+
+/**
+ * Output del POST /internal/authorize. Si allow=true trae el context resuelto
+ * (para que el decorador lo populé en el request). Si allow=false trae el reason.
+ * `context` es solo contrato TS de salida (AuthContext es interface, no clase) → SIN @Expose,
+ * es passthrough; los responses no se validan (fiado-validation-and-dtos § 7).
+ */
+export class AuthorizeResponse {
+    @Expose() @IsBoolean() allow!: boolean;
+    @Expose() @IsOptional() @IsEnum(AuthorizeDenyReason) reason?: AuthorizeDenyReason;
+    context?: AuthContext;
+}

package/src/platformRbac/dtos/CreateTenantRequest.ts

@@ -1,21 +1,21 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsEmail, IsInt, IsOptional, IsString, Matches, Min } from 'class-validator';
-
-/**
- * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
- * Consumido por el controller `backofficeCreateTenant` del platform-rbac-business y, a futuro,
- * por el frontend de staff. La `idempotencyKey` viaja en header HTTP (no en el body).
- * El `temporaryPassword` NO viaja en el request: vive solo en el response como fallback
- * out-of-band mientras el correo de invitación no entrega.
- */
-export class CreateTenantRequest {
-    @Expose() @IsString() @Matches(/^[a-z0-9-]+$/) tenantId!: string;
-    @Expose() @IsString() displayName!: string;
-    @Expose() @IsString() emailDomain!: string;
-    @Expose() @IsString() tablePrefix!: string;
-    @Expose() @IsEmail() adminEmail!: string;
-    @Expose() @IsString() adminName!: string;
-    @Expose() @IsString() region!: string;
-    @Expose() @IsOptional() @IsBoolean() mfaRequired?: boolean;
-    @Expose() @IsOptional() @IsInt() @Min(8) passwordMinLength?: number;
-}
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsEmail, IsInt, IsOptional, IsString, Matches, Min } from 'class-validator';
+
+/**
+ * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
+ * Consumido por el controller `backofficeCreateTenant` del platform-rbac-business y, a futuro,
+ * por el frontend de staff. La `idempotencyKey` viaja en header HTTP (no en el body).
+ * El `temporaryPassword` NO viaja en el request: vive solo en el response como fallback
+ * out-of-band mientras el correo de invitación no entrega.
+ */
+export class CreateTenantRequest {
+    @Expose() @IsString() @Matches(/^[a-z0-9-]+$/) tenantId!: string;
+    @Expose() @IsString() displayName!: string;
+    @Expose() @IsString() emailDomain!: string;
+    @Expose() @IsString() tablePrefix!: string;
+    @Expose() @IsEmail() adminEmail!: string;
+    @Expose() @IsString() adminName!: string;
+    @Expose() @IsString() region!: string;
+    @Expose() @IsOptional() @IsBoolean() mfaRequired?: boolean;
+    @Expose() @IsOptional() @IsInt() @Min(8) passwordMinLength?: number;
+}

package/src/platformRbac/dtos/CreateTenantResponse.ts

@@ -1,12 +1,12 @@
-/**
- * Output del POST backoffice de creación de tenant (F-11). Response plain sin validators
- * (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
- */
-export interface CreateTenantResponse {
-    tenantId: string;
-    userPoolId: string;
-    appClientId: string;
-    adminCognitoSub: string;
-    /** Fallback out-of-band mientras el correo de invitación no entrega (F-11). */
-    temporaryPassword: string;
-}
+/**
+ * Output del POST backoffice de creación de tenant (F-11). Response plain sin validators
+ * (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ */
+export interface CreateTenantResponse {
+    tenantId: string;
+    userPoolId: string;
+    appClientId: string;
+    adminCognitoSub: string;
+    /** Fallback out-of-band mientras el correo de invitación no entrega (F-11). */
+    temporaryPassword: string;
+}

package/src/platformRbac/dtos/PermissionMeta.ts

@@ -1,20 +1,20 @@
-import type { Permission } from '../enums/Permission';
-import type { PermissionScope } from '../enums/PermissionScope';
-import type { PermissionCategory } from '../enums/PermissionCategory';
-
-/**
- * Metadata enriquecida de una permission del catálogo.
- * Usado para:
- * - Sync del enum a DDB `PlatformPermission_GT` al deploy.
- * - UI del módulo rbac-admin: selector de permissions agrupado.
- * - Reporting / docs.
- */
-export interface PermissionMeta {
-    permissionKey: Permission;
-    displayName: string;
-    description: string;
-    category: PermissionCategory;
-    scope: PermissionScope;
-    platforms: string[];
-    isDeprecated?: boolean;
-}
+import type { Permission } from '../enums/Permission';
+import type { PermissionScope } from '../enums/PermissionScope';
+import type { PermissionCategory } from '../enums/PermissionCategory';
+
+/**
+ * Metadata enriquecida de una permission del catálogo.
+ * Usado para:
+ * - Sync del enum a DDB `PlatformPermission_GT` al deploy.
+ * - UI del módulo rbac-admin: selector de permissions agrupado.
+ * - Reporting / docs.
+ */
+export interface PermissionMeta {
+    permissionKey: Permission;
+    displayName: string;
+    description: string;
+    category: PermissionCategory;
+    scope: PermissionScope;
+    platforms: string[];
+    isDeprecated?: boolean;
+}

package/src/platformRbac/dtos/RoleAssignmentInfo.ts

@@ -1,12 +1,12 @@
-import type { PermissionScope } from '../enums/PermissionScope';
-
-/**
- * Una asignación de role a un user con scope específico.
- * Shape que el authorizer Lambda (componente 07) serializa como JSON string
- * dentro del API Gateway authorizer context.
- */
-export interface RoleAssignmentInfo {
-    roleId: string;
-    scope: PermissionScope;
-    scopeRef: string;
-}
+import type { PermissionScope } from '../enums/PermissionScope';
+
+/**
+ * Una asignación de role a un user con scope específico.
+ * Shape que el authorizer Lambda (componente 07) serializa como JSON string
+ * dentro del API Gateway authorizer context.
+ */
+export interface RoleAssignmentInfo {
+    roleId: string;
+    scope: PermissionScope;
+    scopeRef: string;
+}

package/src/platformRbac/enums/AuthorizeDenyReason.ts

@@ -1,10 +1,10 @@
-/**
- * Razón de denegación del endpoint POST /internal/authorize del platform-rbac-business.
- * Consumido por el decorador @RequirePermission del @fiado/gateway-adapter.
- */
-export enum AuthorizeDenyReason {
-    INVALID_TOKEN = 'INVALID_TOKEN',
-    NO_PERMISSION = 'NO_PERMISSION',
-    SCOPE_DENIED = 'SCOPE_DENIED',
-    USER_NOT_FOUND = 'USER_NOT_FOUND',
-}
+/**
+ * Razón de denegación del endpoint POST /internal/authorize del platform-rbac-business.
+ * Consumido por el decorador @RequirePermission del @fiado/gateway-adapter.
+ */
+export enum AuthorizeDenyReason {
+    INVALID_TOKEN = 'INVALID_TOKEN',
+    NO_PERMISSION = 'NO_PERMISSION',
+    SCOPE_DENIED = 'SCOPE_DENIED',
+    USER_NOT_FOUND = 'USER_NOT_FOUND',
+}

package/src/platformRbac/enums/ChallengeNameEnum.ts

@@ -1,7 +1,7 @@
-export enum ChallengeNameEnum {
-    PASSWORD = 'PASSWORD',
-    EMAIL_OTP = 'EMAIL_OTP',
-    TOTP = 'TOTP',
-    NEW_PASSWORD_REQUIRED = 'NEW_PASSWORD_REQUIRED',
-    RESET_PASSWORD = 'RESET_PASSWORD',
-}
+export enum ChallengeNameEnum {
+    PASSWORD = 'PASSWORD',
+    EMAIL_OTP = 'EMAIL_OTP',
+    TOTP = 'TOTP',
+    NEW_PASSWORD_REQUIRED = 'NEW_PASSWORD_REQUIRED',
+    RESET_PASSWORD = 'RESET_PASSWORD',
+}

package/src/platformRbac/enums/MfaMethodEnum.ts

@@ -1,4 +1,4 @@
-export enum MfaMethodEnum {
-    EMAIL_OTP = 'EMAIL_OTP',
-    TOTP = 'TOTP',
-}
+export enum MfaMethodEnum {
+    EMAIL_OTP = 'EMAIL_OTP',
+    TOTP = 'TOTP',
+}

package/src/platformRbac/enums/Permission.ts

@@ -1,120 +1,120 @@
-/**
- * Catálogo universal de permisos del sistema RBAC Fiado.
- *
- * Origen: componente 01 de Fase 0 SureKeep (spec maestro):
- *   surekeep/docs/5_fases/00_fase0_cognito_rbac_users_mfa/componentes/01_typekit-rbac-additions.md
- *
- * Copy-paste literal de los 78 valores del spec (DEC-003).
- * Convención: `<category>.<resource>.<action>` (snake_case en action si multi-palabra).
- * Cualquier cambio aquí requiere PR + bump minor + redeploy de consumers.
- *
- * Coexiste con módulo `rbac/` oficial cuando yhonhansen publique componente 01 — TD-RBAC-002.
- */
-export enum Permission {
-    // ====================================================
-    // RBAC — gestión genérica del propio sistema RBAC
-    // ====================================================
-    RBAC_CATALOG_MANAGE = 'rbac.catalog.manage',
-
-    // ====================================================
-    // PLATFORM — operaciones a nivel meta-plataforma (Fiado equipo)
-    // ====================================================
-    PLATFORM_TENANT_CREATE = 'platform.tenant.create',
-    PLATFORM_TENANT_LIST = 'platform.tenant.list',
-    PLATFORM_TENANT_VIEW = 'platform.tenant.view',
-    PLATFORM_TENANT_UPDATE = 'platform.tenant.update',
-    PLATFORM_TENANT_SUSPEND = 'platform.tenant.suspend',
-    PLATFORM_TENANT_ACTIVATE = 'platform.tenant.activate',
-    PLATFORM_TENANT_ADMIN_REPLACE = 'platform.tenant.admin.replace',
-    PLATFORM_COGNITO_POOL_MANAGE = 'platform.cognito.pool.manage',
-    PLATFORM_COGNITO_POOL_LIST = 'platform.cognito.pool.list',
-    PLATFORM_USER_CREATE = 'platform.user.create',
-    PLATFORM_USER_LIST = 'platform.user.list',
-    PLATFORM_USER_VIEW = 'platform.user.view',
-    PLATFORM_USER_UPDATE = 'platform.user.update',
-    PLATFORM_USER_DISABLE = 'platform.user.disable',
-    PLATFORM_USER_ENABLE = 'platform.user.enable',
-    PLATFORM_USER_DELETE = 'platform.user.delete',
-    PLATFORM_ROLE_CREATE = 'platform.role.create',
-    PLATFORM_ROLE_LIST = 'platform.role.list',
-    PLATFORM_ROLE_UPDATE = 'platform.role.update',
-    PLATFORM_ROLE_DELETE = 'platform.role.delete',
-    PLATFORM_AUDIT_VIEW = 'platform.audit.view',
-
-    // ====================================================
-    // TENANT — operaciones dentro del silo de un tenant
-    // ====================================================
-    TENANT_USER_CREATE = 'tenant.user.create',
-    TENANT_USER_LIST = 'tenant.user.list',
-    TENANT_USER_VIEW = 'tenant.user.view',
-    TENANT_USER_UPDATE = 'tenant.user.update',
-    TENANT_USER_DISABLE = 'tenant.user.disable',
-    TENANT_USER_ENABLE = 'tenant.user.enable',
-    TENANT_USER_DELETE = 'tenant.user.delete',
-    TENANT_USER_MFA_RESET = 'tenant.user.mfa.reset',
-    TENANT_USER_PASSWORD_RESET = 'tenant.user.password.reset',
-    TENANT_ROLE_CREATE = 'tenant.role.create',
-    TENANT_ROLE_LIST = 'tenant.role.list',
-    TENANT_ROLE_UPDATE = 'tenant.role.update',
-    TENANT_ROLE_DELETE = 'tenant.role.delete',
-    TENANT_ROLE_VIEW = 'tenant.role.view',
-    TENANT_ROLE_ASSIGN = 'tenant.role.assign',
-    TENANT_ROLE_REVOKE = 'tenant.role.revoke',
-    TENANT_SECURITY_POLICY_VIEW = 'tenant.security.policy.view',
-    TENANT_SECURITY_POLICY_MANAGE = 'tenant.security.policy.manage',
-    TENANT_BRANDING_MANAGE = 'tenant.branding.manage',
-    TENANT_AUDIT_VIEW = 'tenant.audit.view',
-
-    // ====================================================
-    // RETAIL — catálogo + inventario + ventas
-    // ====================================================
-    RETAIL_PRODUCT_CREATE = 'retail.product.create',
-    RETAIL_PRODUCT_LIST = 'retail.product.list',
-    RETAIL_PRODUCT_VIEW = 'retail.product.view',
-    RETAIL_PRODUCT_UPDATE = 'retail.product.update',
-    RETAIL_PRODUCT_DELETE = 'retail.product.delete',
-    RETAIL_PRODUCT_MDM_CONFIG = 'retail.product.mdm_config',
-    RETAIL_INVENTORY_LIST = 'retail.inventory.list',
-    RETAIL_INVENTORY_VIEW = 'retail.inventory.view',
-    RETAIL_INVENTORY_UPDATE = 'retail.inventory.update',
-    RETAIL_SALE_CREATE = 'retail.sale.create',
-    RETAIL_SALE_LIST = 'retail.sale.list',
-    RETAIL_SALE_CANCEL = 'retail.sale.cancel',
-    RETAIL_STORE_MANAGE = 'retail.store.manage',
-    RETAIL_RETAILER_MANAGE = 'retail.retailer.manage',
-
-    // ====================================================
-    // LEND — créditos + cobranza
-    // ====================================================
-    LEND_CREDIT_CREATE = 'lend.credit.create',
-    LEND_CREDIT_LIST = 'lend.credit.list',
-    LEND_CREDIT_VIEW = 'lend.credit.view',
-    LEND_CREDIT_UPDATE = 'lend.credit.update',
-    LEND_CREDIT_LIQUIDATE = 'lend.credit.liquidate',
-    LEND_CREDIT_RESTRUCTURE = 'lend.credit.restructure',
-    LEND_PAYMENT_APPLY = 'lend.payment.apply',
-    LEND_PAYMENT_LIST = 'lend.payment.list',
-    LEND_PAYMENT_REVERSE = 'lend.payment.reverse',
-    LEND_INSTALLMENT_VIEW = 'lend.installment.view',
-
-    // ====================================================
-    // MDM — device management (subset especializado de LEND)
-    // ====================================================
-    MDM_DEVICE_ENROLL = 'mdm.device.enroll',
-    MDM_DEVICE_RELEASE = 'mdm.device.release',
-    MDM_DEVICE_ARCHIVE = 'mdm.device.archive',
-    MDM_DEVICE_DEACTIVATE = 'mdm.device.deactivate',
-    MDM_DEVICE_LOCK_MANUAL = 'mdm.device.lock.manual',
-    MDM_DEVICE_UNLOCK_MANUAL = 'mdm.device.unlock.manual',
-    MDM_DEVICE_PIN_UNLOCK = 'mdm.device.pin_unlock',
-    MDM_DEVICE_EXTEND_VALIDITY = 'mdm.device.extend_validity',
-    MDM_DEVICE_NOTIFY = 'mdm.device.notify',
-    MDM_DEVICE_STATUS_VIEW = 'mdm.device.status.view',
-    MDM_OPERATION_LOG_VIEW = 'mdm.operation_log.view',
-    MDM_TEST = 'mdm.test',
-
-    // ====================================================
-    // PAY — futuro FiadoPay (placeholder, no usado en MVP)
-    // ====================================================
-    PAY_TRANSACTION_VIEW = 'pay.transaction.view',
-}
+/**
+ * Catálogo universal de permisos del sistema RBAC Fiado.
+ *
+ * Origen: componente 01 de Fase 0 SureKeep (spec maestro):
+ *   surekeep/docs/5_fases/00_fase0_cognito_rbac_users_mfa/componentes/01_typekit-rbac-additions.md
+ *
+ * Copy-paste literal de los 78 valores del spec (DEC-003).
+ * Convención: `<category>.<resource>.<action>` (snake_case en action si multi-palabra).
+ * Cualquier cambio aquí requiere PR + bump minor + redeploy de consumers.
+ *
+ * Coexiste con módulo `rbac/` oficial cuando yhonhansen publique componente 01 — TD-RBAC-002.
+ */
+export enum Permission {
+    // ====================================================
+    // RBAC — gestión genérica del propio sistema RBAC
+    // ====================================================
+    RBAC_CATALOG_MANAGE = 'rbac.catalog.manage',
+
+    // ====================================================
+    // PLATFORM — operaciones a nivel meta-plataforma (Fiado equipo)
+    // ====================================================
+    PLATFORM_TENANT_CREATE = 'platform.tenant.create',
+    PLATFORM_TENANT_LIST = 'platform.tenant.list',
+    PLATFORM_TENANT_VIEW = 'platform.tenant.view',
+    PLATFORM_TENANT_UPDATE = 'platform.tenant.update',
+    PLATFORM_TENANT_SUSPEND = 'platform.tenant.suspend',
+    PLATFORM_TENANT_ACTIVATE = 'platform.tenant.activate',
+    PLATFORM_TENANT_ADMIN_REPLACE = 'platform.tenant.admin.replace',
+    PLATFORM_COGNITO_POOL_MANAGE = 'platform.cognito.pool.manage',
+    PLATFORM_COGNITO_POOL_LIST = 'platform.cognito.pool.list',
+    PLATFORM_USER_CREATE = 'platform.user.create',
+    PLATFORM_USER_LIST = 'platform.user.list',
+    PLATFORM_USER_VIEW = 'platform.user.view',
+    PLATFORM_USER_UPDATE = 'platform.user.update',
+    PLATFORM_USER_DISABLE = 'platform.user.disable',
+    PLATFORM_USER_ENABLE = 'platform.user.enable',
+    PLATFORM_USER_DELETE = 'platform.user.delete',
+    PLATFORM_ROLE_CREATE = 'platform.role.create',
+    PLATFORM_ROLE_LIST = 'platform.role.list',
+    PLATFORM_ROLE_UPDATE = 'platform.role.update',
+    PLATFORM_ROLE_DELETE = 'platform.role.delete',
+    PLATFORM_AUDIT_VIEW = 'platform.audit.view',
+
+    // ====================================================
+    // TENANT — operaciones dentro del silo de un tenant
+    // ====================================================
+    TENANT_USER_CREATE = 'tenant.user.create',
+    TENANT_USER_LIST = 'tenant.user.list',
+    TENANT_USER_VIEW = 'tenant.user.view',
+    TENANT_USER_UPDATE = 'tenant.user.update',
+    TENANT_USER_DISABLE = 'tenant.user.disable',
+    TENANT_USER_ENABLE = 'tenant.user.enable',
+    TENANT_USER_DELETE = 'tenant.user.delete',
+    TENANT_USER_MFA_RESET = 'tenant.user.mfa.reset',
+    TENANT_USER_PASSWORD_RESET = 'tenant.user.password.reset',
+    TENANT_ROLE_CREATE = 'tenant.role.create',
+    TENANT_ROLE_LIST = 'tenant.role.list',
+    TENANT_ROLE_UPDATE = 'tenant.role.update',
+    TENANT_ROLE_DELETE = 'tenant.role.delete',
+    TENANT_ROLE_VIEW = 'tenant.role.view',
+    TENANT_ROLE_ASSIGN = 'tenant.role.assign',
+    TENANT_ROLE_REVOKE = 'tenant.role.revoke',
+    TENANT_SECURITY_POLICY_VIEW = 'tenant.security.policy.view',
+    TENANT_SECURITY_POLICY_MANAGE = 'tenant.security.policy.manage',
+    TENANT_BRANDING_MANAGE = 'tenant.branding.manage',
+    TENANT_AUDIT_VIEW = 'tenant.audit.view',
+
+    // ====================================================
+    // RETAIL — catálogo + inventario + ventas
+    // ====================================================
+    RETAIL_PRODUCT_CREATE = 'retail.product.create',
+    RETAIL_PRODUCT_LIST = 'retail.product.list',
+    RETAIL_PRODUCT_VIEW = 'retail.product.view',
+    RETAIL_PRODUCT_UPDATE = 'retail.product.update',
+    RETAIL_PRODUCT_DELETE = 'retail.product.delete',
+    RETAIL_PRODUCT_MDM_CONFIG = 'retail.product.mdm_config',
+    RETAIL_INVENTORY_LIST = 'retail.inventory.list',
+    RETAIL_INVENTORY_VIEW = 'retail.inventory.view',
+    RETAIL_INVENTORY_UPDATE = 'retail.inventory.update',
+    RETAIL_SALE_CREATE = 'retail.sale.create',
+    RETAIL_SALE_LIST = 'retail.sale.list',
+    RETAIL_SALE_CANCEL = 'retail.sale.cancel',
+    RETAIL_STORE_MANAGE = 'retail.store.manage',
+    RETAIL_RETAILER_MANAGE = 'retail.retailer.manage',
+
+    // ====================================================
+    // LEND — créditos + cobranza
+    // ====================================================
+    LEND_CREDIT_CREATE = 'lend.credit.create',
+    LEND_CREDIT_LIST = 'lend.credit.list',
+    LEND_CREDIT_VIEW = 'lend.credit.view',
+    LEND_CREDIT_UPDATE = 'lend.credit.update',
+    LEND_CREDIT_LIQUIDATE = 'lend.credit.liquidate',
+    LEND_CREDIT_RESTRUCTURE = 'lend.credit.restructure',
+    LEND_PAYMENT_APPLY = 'lend.payment.apply',
+    LEND_PAYMENT_LIST = 'lend.payment.list',
+    LEND_PAYMENT_REVERSE = 'lend.payment.reverse',
+    LEND_INSTALLMENT_VIEW = 'lend.installment.view',
+
+    // ====================================================
+    // MDM — device management (subset especializado de LEND)
+    // ====================================================
+    MDM_DEVICE_ENROLL = 'mdm.device.enroll',
+    MDM_DEVICE_RELEASE = 'mdm.device.release',
+    MDM_DEVICE_ARCHIVE = 'mdm.device.archive',
+    MDM_DEVICE_DEACTIVATE = 'mdm.device.deactivate',
+    MDM_DEVICE_LOCK_MANUAL = 'mdm.device.lock.manual',
+    MDM_DEVICE_UNLOCK_MANUAL = 'mdm.device.unlock.manual',
+    MDM_DEVICE_PIN_UNLOCK = 'mdm.device.pin_unlock',
+    MDM_DEVICE_EXTEND_VALIDITY = 'mdm.device.extend_validity',
+    MDM_DEVICE_NOTIFY = 'mdm.device.notify',
+    MDM_DEVICE_STATUS_VIEW = 'mdm.device.status.view',
+    MDM_OPERATION_LOG_VIEW = 'mdm.operation_log.view',
+    MDM_TEST = 'mdm.test',
+
+    // ====================================================
+    // PAY — futuro FiadoPay (placeholder, no usado en MVP)
+    // ====================================================
+    PAY_TRANSACTION_VIEW = 'pay.transaction.view',
+}

package/src/platformRbac/enums/PermissionCategory.ts

@@ -1,14 +1,14 @@
-/**
- * Categorías del catálogo de permissions (componente 01).
- * TD-RBAC-005: `AUDIT` category sin permissions `audit.*` asociadas — drift consciente.
- */
-export enum PermissionCategory {
-    RBAC = 'rbac',
-    PLATFORM = 'platform',
-    TENANT = 'tenant',
-    RETAIL = 'retail',
-    LEND = 'lend',
-    MDM = 'mdm',
-    AUDIT = 'audit',
-    PAY = 'pay',
-}
+/**
+ * Categorías del catálogo de permissions (componente 01).
+ * TD-RBAC-005: `AUDIT` category sin permissions `audit.*` asociadas — drift consciente.
+ */
+export enum PermissionCategory {
+    RBAC = 'rbac',
+    PLATFORM = 'platform',
+    TENANT = 'tenant',
+    RETAIL = 'retail',
+    LEND = 'lend',
+    MDM = 'mdm',
+    AUDIT = 'audit',
+    PAY = 'pay',
+}

package/src/platformRbac/enums/PermissionScope.ts

@@ -1,10 +1,10 @@
-/**
- * Jerarquía: PLATFORM > TENANT > RETAILER > STORE.
- * Componente 01 spec — copia exacta.
- */
-export enum PermissionScope {
-    PLATFORM = 'PLATFORM',
-    TENANT = 'TENANT',
-    RETAILER = 'RETAILER',
-    STORE = 'STORE',
-}
+/**
+ * Jerarquía: PLATFORM > TENANT > RETAILER > STORE.
+ * Componente 01 spec — copia exacta.
+ */
+export enum PermissionScope {
+    PLATFORM = 'PLATFORM',
+    TENANT = 'TENANT',
+    RETAILER = 'RETAILER',
+    STORE = 'STORE',
+}

package/src/platformRbac/index.ts

@@ -1,44 +1,44 @@
-// platformRbac — módulo del lambda platform-rbac-business (Fase 0 SureKeep).
-//
-// Coexiste con `Rbac` oficial cuando yhonhansen publique componente 01 — TD-RBAC-002
-// del platform-rbac-business documenta la migración futura de los 4 símbolos cross-cutting
-// (Permission, PermissionScope, AuthContext, RoleAssignmentInfo) de aquí a `rbac/`.
-//
-// En Fase 1.A los DTOs propios del rbac-business (CreateTenantRequest, AssignRoleRequest,
-// EffectivePermissionsResponse, etc.) NO viven en este módulo todavía — se agregan en
-// Fase 1.B cuando los managers que los consumen se implementen.
-
-export { Permission } from './enums/Permission';
-export { PermissionScope } from './enums/PermissionScope';
-export { PermissionCategory } from './enums/PermissionCategory';
-
-export type { AuthContext } from './dtos/AuthContext';
-export type { RoleAssignmentInfo } from './dtos/RoleAssignmentInfo';
-export type { PermissionMeta } from './dtos/PermissionMeta';
-
-// Fase 1 — Custom Auth Challenge (Email OTP + TOTP) + MFA self-service.
-// Class values (no type-only) — los DTOs llevan decoradores class-validator y se hidratan con plainToInstance en runtime.
-export * from './enums/MfaMethodEnum';
-export * from './enums/ChallengeNameEnum';
-export * from './auth/DefineNextChallengeRequest';
-export * from './auth/DefineNextChallengeResponse';
-export * from './auth/PrepareChallengeRequest';
-export * from './auth/PrepareChallengeResponse';
-export * from './auth/VerifyChallengeRequest';
-export * from './auth/VerifyChallengeResponse';
-export * from './auth/NewPasswordRequest';
-export * from './auth/ResetPasswordRequest';
-export * from './mfa/EnrollTotpResponse';
-export * from './mfa/VerifyTotpEnrollmentRequest';
-export * from './mfa/ChangeMfaMethodRequest';
-export * from './mfa/MfaStatusResponse';
-
-// RBAC enforcement (capa de protección) — DTOs del POST /internal/authorize.
-export { AuthorizeDenyReason } from './enums/AuthorizeDenyReason';
-export * from './dtos/AuthorizeRequest';
-export * from './dtos/AuthorizeResponse';
-
-// F-11 — onboarding de tenant (POST backoffice createTenant). CreateTenantRequest lleva
-// decoradores class-validator → export de valor; CreateTenantResponse es interface → type-only.
-export * from './dtos/CreateTenantRequest';
-export type { CreateTenantResponse } from './dtos/CreateTenantResponse';
+// platformRbac — módulo del lambda platform-rbac-business (Fase 0 SureKeep).
+//
+// Coexiste con `Rbac` oficial cuando yhonhansen publique componente 01 — TD-RBAC-002
+// del platform-rbac-business documenta la migración futura de los 4 símbolos cross-cutting
+// (Permission, PermissionScope, AuthContext, RoleAssignmentInfo) de aquí a `rbac/`.
+//
+// En Fase 1.A los DTOs propios del rbac-business (CreateTenantRequest, AssignRoleRequest,
+// EffectivePermissionsResponse, etc.) NO viven en este módulo todavía — se agregan en
+// Fase 1.B cuando los managers que los consumen se implementen.
+
+export { Permission } from './enums/Permission';
+export { PermissionScope } from './enums/PermissionScope';
+export { PermissionCategory } from './enums/PermissionCategory';
+
+export type { AuthContext } from './dtos/AuthContext';
+export type { RoleAssignmentInfo } from './dtos/RoleAssignmentInfo';
+export type { PermissionMeta } from './dtos/PermissionMeta';
+
+// Fase 1 — Custom Auth Challenge (Email OTP + TOTP) + MFA self-service.
+// Class values (no type-only) — los DTOs llevan decoradores class-validator y se hidratan con plainToInstance en runtime.
+export * from './enums/MfaMethodEnum';
+export * from './enums/ChallengeNameEnum';
+export * from './auth/DefineNextChallengeRequest';
+export * from './auth/DefineNextChallengeResponse';
+export * from './auth/PrepareChallengeRequest';
+export * from './auth/PrepareChallengeResponse';
+export * from './auth/VerifyChallengeRequest';
+export * from './auth/VerifyChallengeResponse';
+export * from './auth/NewPasswordRequest';
+export * from './auth/ResetPasswordRequest';
+export * from './mfa/EnrollTotpResponse';
+export * from './mfa/VerifyTotpEnrollmentRequest';
+export * from './mfa/ChangeMfaMethodRequest';
+export * from './mfa/MfaStatusResponse';
+
+// RBAC enforcement (capa de protección) — DTOs del POST /internal/authorize.
+export { AuthorizeDenyReason } from './enums/AuthorizeDenyReason';
+export * from './dtos/AuthorizeRequest';
+export * from './dtos/AuthorizeResponse';
+
+// F-11 — onboarding de tenant (POST backoffice createTenant). CreateTenantRequest lleva
+// decoradores class-validator → export de valor; CreateTenantResponse es interface → type-only.
+export * from './dtos/CreateTenantRequest';
+export type { CreateTenantResponse } from './dtos/CreateTenantResponse';