@fiado/type-kit 3.661.0 → 3.663.0

package/bin/cognitoBackofficeConnector/dtos/StartOtpLoginRequest.js

@@ -0,0 +1,48 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StartOtpLoginRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body de POST /auth/start-otp-login: inicia CUSTOM_AUTH sin SRP ni contraseña. */
+class StartOtpLoginRequest {
+}
+exports.StartOtpLoginRequest = StartOtpLoginRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], StartOtpLoginRequest.prototype, "userPoolId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], StartOtpLoginRequest.prototype, "region", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], StartOtpLoginRequest.prototype, "clientId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], StartOtpLoginRequest.prototype, "username", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], StartOtpLoginRequest.prototype, "useClientSecret", void 0);

package/bin/cognitoBackofficeConnector/index.d.ts

@@ -23,6 +23,7 @@ export * from './dtos/AuthEventResponse';
 export * from './dtos/AuthTokensResponse';
 export * from './dtos/AuthStartLoginRequest';
 export * from './dtos/AuthStartLoginResponse';
+export * from './dtos/StartOtpLoginRequest';
 export * from './dtos/InitiateAuthRequest';
 export * from './dtos/InitiateAuthResponse';
 export * from './dtos/VerifyPasswordRequest';

package/bin/cognitoBackofficeConnector/index.js

@@ -39,6 +39,7 @@ __exportStar(require("./dtos/AuthEventResponse"), exports);
 __exportStar(require("./dtos/AuthTokensResponse"), exports);
 __exportStar(require("./dtos/AuthStartLoginRequest"), exports);
 __exportStar(require("./dtos/AuthStartLoginResponse"), exports);
+__exportStar(require("./dtos/StartOtpLoginRequest"), exports);
 __exportStar(require("./dtos/InitiateAuthRequest"), exports);
 __exportStar(require("./dtos/InitiateAuthResponse"), exports);
 __exportStar(require("./dtos/VerifyPasswordRequest"), exports);

package/bin/common/constants/InputPatterns.d.ts

@@ -3,6 +3,9 @@ export declare const PHONE_MX_PATTERN: RegExp;
 /** Teléfono MX en el backend: 10 dígitos, opcionalmente con `+52` para clientes que ya lo mandan. */
 export declare const PHONE_MX_ACCEPTED_PATTERN: RegExp;
 export declare const PHONE_MX_MESSAGE = "El tel\u00E9fono debe tener 10 d\u00EDgitos";
+/** Celular guardado en todo SureKeep: `+52` y 10 dígitos. */
+export declare const PHONE_E164_PATTERN: RegExp;
+export declare const PHONE_E164_MESSAGE = "El tel\u00E9fono debe tener el formato +52 y 10 d\u00EDgitos";
 /** Correo pragmático: algo@dominio.tld, sin espacios. */
 export declare const EMAIL_PATTERN: RegExp;
 export declare const EMAIL_MAX_LENGTH = 254;

package/bin/common/constants/InputPatterns.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HTTPS_URL_MESSAGE = exports.HTTPS_URL_PATTERN = exports.IMEI_MESSAGE = exports.IMEI_PATTERN = exports.SKU_MESSAGE = exports.SKU_MAX_LENGTH = exports.SKU_PATTERN = exports.ZIP_CODE_MX_MESSAGE = exports.ZIP_CODE_MX_PATTERN = exports.RFC_MESSAGE = exports.RFC_PATTERN = exports.EMAIL_MESSAGE = exports.EMAIL_MAX_LENGTH = exports.EMAIL_PATTERN = exports.PHONE_MX_MESSAGE = exports.PHONE_MX_ACCEPTED_PATTERN = exports.PHONE_MX_PATTERN = void 0;
+exports.HTTPS_URL_MESSAGE = exports.HTTPS_URL_PATTERN = exports.IMEI_MESSAGE = exports.IMEI_PATTERN = exports.SKU_MESSAGE = exports.SKU_MAX_LENGTH = exports.SKU_PATTERN = exports.ZIP_CODE_MX_MESSAGE = exports.ZIP_CODE_MX_PATTERN = exports.RFC_MESSAGE = exports.RFC_PATTERN = exports.EMAIL_MESSAGE = exports.EMAIL_MAX_LENGTH = exports.EMAIL_PATTERN = exports.PHONE_E164_MESSAGE = exports.PHONE_E164_PATTERN = exports.PHONE_MX_MESSAGE = exports.PHONE_MX_ACCEPTED_PATTERN = exports.PHONE_MX_PATTERN = void 0;
 /** Teléfono MX tal como se teclea en la UI: exactamente 10 dígitos. */
 exports.PHONE_MX_PATTERN = /^\d{10}$/;
 /** Teléfono MX en el backend: 10 dígitos, opcionalmente con `+52` para clientes que ya lo mandan. */
 exports.PHONE_MX_ACCEPTED_PATTERN = /^(?:\+52)?\d{10}$/;
 exports.PHONE_MX_MESSAGE = 'El teléfono debe tener 10 dígitos';
+/** Celular guardado en todo SureKeep: `+52` y 10 dígitos. */
+exports.PHONE_E164_PATTERN = /^\+52\d{10}$/;
+exports.PHONE_E164_MESSAGE = 'El teléfono debe tener el formato +52 y 10 dígitos';
 /** Correo pragmático: algo@dominio.tld, sin espacios. */
 exports.EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 exports.EMAIL_MAX_LENGTH = 254;

package/bin/loanScoring/dtos/requests/EvaluateSciRequest.d.ts

@@ -26,7 +26,7 @@ export declare class EvaluateSciRequest {
      * tumbaría la evaluación del wizard. El formato lo revisa loan-scoring antes de consultar (L-177, A).
      */
     curp: string;
-    /** Celular del solicitante: 10 dígitos, sin `+52` (requerido por Modelias). */
+    /** Celular del solicitante: 10 dígitos, con o sin `+52`; loan-scoring lo manda a 10 a Modelias. */
     cellphone: string;
     email?: string;
     /**

package/bin/loanScoring/dtos/requests/EvaluateSciRequest.js

@@ -55,7 +55,7 @@ __decorate([
 __decorate([
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),
-    (0, class_validator_1.Matches)(InputPatterns_1.PHONE_MX_PATTERN, { message: 'cellphone debe tener 10 dígitos' }),
+    (0, class_validator_1.Matches)(InputPatterns_1.PHONE_MX_ACCEPTED_PATTERN, { message: 'cellphone debe tener 10 dígitos, con o sin +52' }),
     __metadata("design:type", String)
 ], EvaluateSciRequest.prototype, "cellphone", void 0);
 __decorate([

package/bin/messagesConnector/dtos/OtpLoginStateRequest.d.ts

@@ -0,0 +1,5 @@
+/** Body de POST /messages/otp/login-state. */
+export declare class OtpLoginStateRequest {
+    directoryId: string;
+    typeOfDirectoryId: string;
+}

package/bin/messagesConnector/dtos/OtpLoginStateRequest.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtpLoginStateRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body de POST /messages/otp/login-state. */
+class OtpLoginStateRequest {
+}
+exports.OtpLoginStateRequest = OtpLoginStateRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OtpLoginStateRequest.prototype, "directoryId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OtpLoginStateRequest.prototype, "typeOfDirectoryId", void 0);

package/bin/messagesConnector/dtos/OtpLoginStateResponse.d.ts

@@ -0,0 +1,5 @@
+/** Respuesta de POST /messages/otp/login-state. `lockedUntil` va en epoch ms. */
+export declare class OtpLoginStateResponse {
+    lastFailureCode: 'OTP_NOT_FOUND' | 'OTP_EXPIRED' | 'OTP_ALREADY_USED' | null;
+    lockedUntil: number | null;
+}

package/bin/messagesConnector/dtos/OtpLoginStateResponse.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtpLoginStateResponse = void 0;
+/** Respuesta de POST /messages/otp/login-state. `lockedUntil` va en epoch ms. */
+class OtpLoginStateResponse {
+}
+exports.OtpLoginStateResponse = OtpLoginStateResponse;

package/bin/messagesConnector/index.d.ts

@@ -10,6 +10,8 @@ export * from './dtos/AgentSendNotificationRequest';
 export * from './dtos/SendMessageResponse';
 export * from './dtos/VerifyOtpRequest';
 export * from './dtos/VerifyOtpResponse';
+export * from './dtos/OtpLoginStateRequest';
+export * from './dtos/OtpLoginStateResponse';
 export * from './dtos/OtpValidatedResponse';
 export * from './dtos/NotificationResponse';
 export * from './dtos/NotificationsPageResponse';

package/bin/messagesConnector/index.js

@@ -26,6 +26,8 @@ __exportStar(require("./dtos/AgentSendNotificationRequest"), exports);
 __exportStar(require("./dtos/SendMessageResponse"), exports);
 __exportStar(require("./dtos/VerifyOtpRequest"), exports);
 __exportStar(require("./dtos/VerifyOtpResponse"), exports);
+__exportStar(require("./dtos/OtpLoginStateRequest"), exports);
+__exportStar(require("./dtos/OtpLoginStateResponse"), exports);
 __exportStar(require("./dtos/OtpValidatedResponse"), exports);
 __exportStar(require("./dtos/NotificationResponse"), exports);
 __exportStar(require("./dtos/NotificationsPageResponse"), exports);

package/bin/platformRbac/application/Application.d.ts

@@ -3,6 +3,7 @@ import { PrincipalIdentifierEnum } from '../enums/PrincipalIdentifierEnum';
 import { ApplicationStatus } from '../enums/ApplicationStatus';
 import type { UserFieldDef } from '../dtos/UserFieldDef';
 import type { TokenValidationMode } from '../enums/TokenValidationMode';
+import type { LoginModeEnum } from '../enums/LoginModeEnum';
 export interface LevelDef {
     level: PermissionScope;
     displayName: string;
@@ -44,6 +45,8 @@ export interface ApplicationDefaults {
      * UsernameAttributes del pool): true ⇒ pool con ['email','phone_number']. Heredado al tenant.
      */
     allowSecondary?: boolean;
+    /** Modo de login que heredan los tenants de esta aplicación; sin valor entran con contraseña. */
+    loginMode?: LoginModeEnum | null;
     /**
      * DEC-RBAC-111: política de contraseña que heredan los tenants creados desde esta aplicación.
      *

package/bin/platformRbac/auth/DefineNextChallengeResponse.d.ts

@@ -1,6 +1,8 @@
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../enums/LoginModeEnum';
 export declare class DefineNextChallengeResponse {
     nextChallenge?: ChallengeNameEnum;
     issueTokens: boolean;
     failAuthentication: boolean;
+    loginMode?: LoginModeEnum;
 }

package/bin/platformRbac/auth/DefineNextChallengeResponse.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefineNextChallengeResponse = void 0;
 const class_validator_1 = require("class-validator");
 const ChallengeNameEnum_1 = require("../enums/ChallengeNameEnum");
+const LoginModeEnum_1 = require("../enums/LoginModeEnum");
 class DefineNextChallengeResponse {
 }
 exports.DefineNextChallengeResponse = DefineNextChallengeResponse;
@@ -28,3 +29,8 @@ __decorate([
     (0, class_validator_1.IsBoolean)(),
     __metadata("design:type", Boolean)
 ], DefineNextChallengeResponse.prototype, "failAuthentication", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(LoginModeEnum_1.LoginModeEnum),
+    __metadata("design:type", String)
+], DefineNextChallengeResponse.prototype, "loginMode", void 0);

package/bin/platformRbac/auth/PrepareChallengeRequest.d.ts

@@ -1,7 +1,10 @@
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../enums/LoginModeEnum';
 export declare class PrepareChallengeRequest {
     cognitoSub: string;
     challengeName: ChallengeNameEnum;
     email?: string;
     phone?: string;
+    loginMode?: LoginModeEnum;
+    isRetry?: boolean;
 }

package/bin/platformRbac/auth/PrepareChallengeRequest.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PrepareChallengeRequest = void 0;
 const class_validator_1 = require("class-validator");
 const ChallengeNameEnum_1 = require("../enums/ChallengeNameEnum");
+const LoginModeEnum_1 = require("../enums/LoginModeEnum");
 class PrepareChallengeRequest {
 }
 exports.PrepareChallengeRequest = PrepareChallengeRequest;
@@ -33,3 +34,13 @@ __decorate([
     (0, class_validator_1.IsString)(),
     __metadata("design:type", String)
 ], PrepareChallengeRequest.prototype, "phone", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(LoginModeEnum_1.LoginModeEnum),
+    __metadata("design:type", String)
+], PrepareChallengeRequest.prototype, "loginMode", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], PrepareChallengeRequest.prototype, "isRetry", void 0);

package/bin/platformRbac/dtos/EnsureCustomerAccountRequest.d.ts

@@ -0,0 +1,8 @@
+/** Body de POST /internal/tenants/{tenantId}/customer-accounts. */
+export declare class EnsureCustomerAccountRequest {
+    phone: string;
+    retailCustomerId: string;
+    directoryId: string;
+    displayName: string;
+    createdBy: string;
+}

package/bin/platformRbac/dtos/EnsureCustomerAccountRequest.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnsureCustomerAccountRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const InputPatterns_1 = require("../../common/constants/InputPatterns");
+/** Body de POST /internal/tenants/{tenantId}/customer-accounts. */
+class EnsureCustomerAccountRequest {
+}
+exports.EnsureCustomerAccountRequest = EnsureCustomerAccountRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Matches)(InputPatterns_1.PHONE_E164_PATTERN),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "phone", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "retailCustomerId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "directoryId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "createdBy", void 0);

package/bin/platformRbac/dtos/EnsureCustomerAccountResponse.d.ts

@@ -0,0 +1,5 @@
+/** Respuesta de POST /internal/tenants/{tenantId}/customer-accounts. */
+export interface EnsureCustomerAccountResponse {
+    outcome: 'CREATED' | 'EXISTING';
+    cognitoSub: string;
+}

package/bin/platformRbac/dtos/EnsureCustomerAccountResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/dtos/OtpLoginRequest.d.ts

@@ -0,0 +1,5 @@
+/** Body de POST /auth/otp-login. */
+export declare class OtpLoginRequest {
+    phone: string;
+    tenantId: string;
+}

package/bin/platformRbac/dtos/OtpLoginRequest.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtpLoginRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body de POST /auth/otp-login. */
+class OtpLoginRequest {
+}
+exports.OtpLoginRequest = OtpLoginRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OtpLoginRequest.prototype, "phone", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OtpLoginRequest.prototype, "tenantId", void 0);

package/bin/platformRbac/dtos/UserProfileResponse.d.ts

@@ -6,4 +6,6 @@ export interface UserProfileResponse {
     email?: string;
     phone?: string;
     status?: string;
+    retailCustomerId?: string | null;
+    directoryId?: string | null;
 }

package/bin/platformRbac/enums/LoginModeEnum.d.ts

@@ -0,0 +1,4 @@
+/** Modo de login de un tenant. Sin valor, el tenant entra con contraseña. */
+export declare enum LoginModeEnum {
+    OTP_ONLY = "OTP_ONLY"
+}

package/bin/platformRbac/enums/LoginModeEnum.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginModeEnum = void 0;
+/** Modo de login de un tenant. Sin valor, el tenant entra con contraseña. */
+var LoginModeEnum;
+(function (LoginModeEnum) {
+    LoginModeEnum["OTP_ONLY"] = "OTP_ONLY";
+})(LoginModeEnum || (exports.LoginModeEnum = LoginModeEnum = {}));

package/bin/platformRbac/enums/Permission.d.ts

@@ -121,7 +121,8 @@ export declare enum Permission {
     PLATFORM_INTEGRATION_KEY_REVOKE = "platform.integration.key.revoke",
     TENANT_INTEGRATION_DIAGNOSTIC = "tenant.integration.diagnostic",
     TENANT_API_USER_MANAGE = "tenant.api_user.manage",
-    PLATFORM_RETAIL_INTEGRATION_ACTIVATE = "platform.retail_integration.activate"
+    PLATFORM_RETAIL_INTEGRATION_ACTIVATE = "platform.retail_integration.activate",
+    CUSTOMER_PORTAL_READ = "customer.portal.read"
 }
 /**
  * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.

package/bin/platformRbac/enums/Permission.js

@@ -168,6 +168,8 @@ var Permission;
     Permission["TENANT_API_USER_MANAGE"] = "tenant.api_user.manage";
     // Activa la integración de un retailer externo (Zentral); scope PLATFORM.
     Permission["PLATFORM_RETAIL_INTEGRATION_ACTIVATE"] = "platform.retail_integration.activate";
+    // Lectura del portal del cliente.
+    Permission["CUSTOMER_PORTAL_READ"] = "customer.portal.read";
 })(Permission || (exports.Permission = Permission = {}));
 /**
  * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.
@@ -289,6 +291,7 @@ exports.PERMISSION_BIT_ORDER = [
     Permission.TENANT_INTEGRATION_DIAGNOSTIC,
     Permission.TENANT_API_USER_MANAGE,
     Permission.PLATFORM_RETAIL_INTEGRATION_ACTIVATE,
+    Permission.CUSTOMER_PORTAL_READ,
 ];
 function djb2(input) {
     let h = 5381;

package/bin/platformRbac/index.d.ts

@@ -11,6 +11,7 @@ export type { EffectivePermissionsResponse } from './dtos/EffectivePermissionsRe
 export * from './enums/MfaMethodEnum';
 export * from './enums/TokenValidationMode';
 export * from './enums/ChallengeNameEnum';
+export * from './enums/LoginModeEnum';
 export * from './auth/DefineNextChallengeRequest';
 export * from './auth/DefineNextChallengeResponse';
 export * from './auth/PrepareChallengeRequest';
@@ -51,6 +52,9 @@ export type { CreateApplicationRequest, UpdateApplicationRequest, UpsertApplicat
 export type { RoleScopeRecompute, InconsistentAssignment, CascadeTenantFailure, CascadeReport, UpdateApplicationPermissionResponse, RoleSeedDiff, RoleCascadeChange, RoleCascadeReport, } from './application/cascade';
 export * from './dtos/SelfRegisterStartRequest';
 export * from './dtos/SelfRegisterVerifyOtpRequest';
+export * from './dtos/EnsureCustomerAccountRequest';
+export type { EnsureCustomerAccountResponse } from './dtos/EnsureCustomerAccountResponse';
+export * from './dtos/OtpLoginRequest';
 export * from './dtos/SelfRegisterCompleteRequest';
 export * from './dtos/CreateLevelEntityRequest';
 export type { CreateLevelEntityResponse } from './dtos/CreateLevelEntityResponse';

package/bin/platformRbac/index.js

@@ -48,6 +48,7 @@ Object.defineProperty(exports, "AccountType", { enumerable: true, get: function
 __exportStar(require("./enums/MfaMethodEnum"), exports);
 __exportStar(require("./enums/TokenValidationMode"), exports);
 __exportStar(require("./enums/ChallengeNameEnum"), exports);
+__exportStar(require("./enums/LoginModeEnum"), exports);
 __exportStar(require("./auth/DefineNextChallengeRequest"), exports);
 __exportStar(require("./auth/DefineNextChallengeResponse"), exports);
 __exportStar(require("./auth/PrepareChallengeRequest"), exports);
@@ -107,6 +108,8 @@ __exportStar(require("./enums/PermissionKind"), exports);
 // plain (type-only). Consumidos por los endpoints públicos de platform-rbac-business + el gate de perfil.
 __exportStar(require("./dtos/SelfRegisterStartRequest"), exports);
 __exportStar(require("./dtos/SelfRegisterVerifyOtpRequest"), exports);
+__exportStar(require("./dtos/EnsureCustomerAccountRequest"), exports);
+__exportStar(require("./dtos/OtpLoginRequest"), exports);
 __exportStar(require("./dtos/SelfRegisterCompleteRequest"), exports);
 // Endpoints privados de espejo de jerarquía + alta de usuario (SureKeep F1, scope mirror).
 // Request DTOs llevan decoradores class-validator → export de valor (se hidratan con plainToInstance);

package/bin/retailCustomer/dtos/requests/UpsertCustomerFromKycRequest.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpsertCustomerFromKycRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
+const InputPatterns_1 = require("../../../common/constants/InputPatterns");
 const regex_1 = require("../../../helpers/constans/regex");
 const RetailAddress_1 = require("../RetailAddress");
 const KycMethodEnum_1 = require("../../enums/KycMethodEnum");
@@ -56,7 +57,7 @@ __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.replace(/[\s-]/g, '') : value)),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.Matches)(regex_1.regexPhoneMx, { message: 'phone debe ser 10 dígitos MX' }),
+    (0, class_validator_1.Matches)(InputPatterns_1.PHONE_MX_ACCEPTED_PATTERN, { message: 'phone debe ser 10 dígitos MX, con o sin +52' }),
     __metadata("design:type", String)
 ], UpsertCustomerFromKycRequest.prototype, "phone", void 0);
 __decorate([

package/bin/retailOrg/dtos/requests/LinkRetailUserWalletRequest.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LinkRetailUserWalletRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
+const InputPatterns_1 = require("../../../common/constants/InputPatterns");
 const IsSingleWalletKeyConstraint_1 = require("../../validators/IsSingleWalletKeyConstraint");
 /**
  * Body de `PUT /retailers/{retailerId}/users/{retailUserId}/wallet`: vincula la wallet PCF del
@@ -32,6 +33,6 @@ __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)({ message: 'phone debe ser texto' }),
-    (0, class_validator_1.Matches)(/^(\+52)?\d{10}$/, { message: 'phone debe tener 10 dígitos, con o sin +52' }),
+    (0, class_validator_1.Matches)(InputPatterns_1.PHONE_MX_ACCEPTED_PATTERN, { message: 'phone debe tener 10 dígitos, con o sin +52' }),
     __metadata("design:type", String)
 ], LinkRetailUserWalletRequest.prototype, "phone", void 0);

package/bin/retailOrg/dtos/requests/LookupRetailUserWalletRequest.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LookupRetailUserWalletRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
+const InputPatterns_1 = require("../../../common/constants/InputPatterns");
 const IsSingleWalletKeyConstraint_1 = require("../../validators/IsSingleWalletKeyConstraint");
 /**
  * Body de `POST /retailers/{retailerId}/users/wallet-lookup`: busca una wallet PCF por CLABE o por
@@ -32,6 +33,6 @@ __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)({ message: 'phone debe ser texto' }),
-    (0, class_validator_1.Matches)(/^(\+52)?\d{10}$/, { message: 'phone debe tener 10 dígitos, con o sin +52' }),
+    (0, class_validator_1.Matches)(InputPatterns_1.PHONE_MX_ACCEPTED_PATTERN, { message: 'phone debe tener 10 dígitos, con o sin +52' }),
     __metadata("design:type", String)
 ], LookupRetailUserWalletRequest.prototype, "phone", void 0);

package/bin/retailWizard/dtos/requests/StartSessionRequest.js

@@ -12,7 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.StartSessionRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
-const regex_1 = require("../../../helpers/constans/regex");
+const InputPatterns_1 = require("../../../common/constants/InputPatterns");
 /**
  * POST /wizard/sessions — arranca (o reanuda) la saga del wizard para un teléfono.
  * `retailerId`/`storeId`/`sellerRetailUserId` NO viajan en el body: se derivan del JWT del vendedor.
@@ -24,7 +24,7 @@ exports.StartSessionRequest = StartSessionRequest;
 __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.Matches)(regex_1.regexPhoneMx, { message: 'phone debe ser un teléfono MX de 10 dígitos' }),
+    (0, class_validator_1.Matches)(InputPatterns_1.PHONE_MX_ACCEPTED_PATTERN, { message: 'phone debe ser un teléfono MX de 10 dígitos, con o sin +52' }),
     __metadata("design:type", String)
 ], StartSessionRequest.prototype, "phone", void 0);
 __decorate([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.661.0",
+  "version": "3.663.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/cognitoBackofficeConnector/dtos/AppClientConfig.ts

@@ -14,10 +14,7 @@ export const COGNITO_EXPLICIT_AUTH_FLOWS: readonly string[] = [
 /** Unidades de vigencia de token; el conector aplica una sola a los tres tokens. */
 export const COGNITO_TOKEN_VALIDITY_UNITS: readonly string[] = ['seconds', 'minutes', 'hours', 'days'];
 
-/**
- * Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients).
- * Sin `generateSecret`: el conector fija GenerateSecret false (A21).
- */
+/** Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients). */
 export class AppClientConfig {
     @Expose() @IsOptional() @IsString() clientName?: string;
     @Expose() @IsArray() @IsIn(COGNITO_EXPLICIT_AUTH_FLOWS, { each: true }) explicitAuthFlows!: string[];
@@ -29,4 +26,6 @@ export class AppClientConfig {
     @Expose() @IsOptional() @IsBoolean() enableTokenRevocation?: boolean;
     /** Atributos que el usuario puede escribir con su propio token. Ausente ⇒ todos (default de Cognito). */
     @Expose() @IsOptional() @IsArray() @IsString({ each: true }) writeAttributes?: string[];
+    /** Crea el client con secreto. Ausente ⇒ sin secreto. */
+    @Expose() @IsOptional() @IsBoolean() generateSecret?: boolean;
 }

package/src/cognitoBackofficeConnector/dtos/CreatePoolClientResponse.ts

@@ -1,4 +1,4 @@
-/** Respuesta de POST /pools/{userPoolId}/clients. Sin secret: el client nace con GenerateSecret false. */
+/** Respuesta de POST /pools/{userPoolId}/clients. Nunca expone el secreto del client. */
 export class CreatePoolClientResponse {
     appClientId!: string;
 }

package/src/cognitoBackofficeConnector/dtos/CreatePoolRequest.ts

@@ -1,5 +1,5 @@
 import { Expose, Type } from 'class-transformer';
-import { IsArray, IsIn, IsOptional, IsString, ValidateNested } from 'class-validator';
+import { IsArray, IsBoolean, IsIn, IsOptional, IsString, ValidateNested } from 'class-validator';
 import { PasswordPolicyConfig } from './PasswordPolicyConfig';
 import { CustomAttributeSpec } from './CustomAttributeSpec';
 import { AppClientConfig } from './AppClientConfig';
@@ -38,4 +38,7 @@ export class CreatePoolRequest {
     @IsArray()
     @IsIn(['email', 'phone_number'], { each: true })
     usernameAttributes?: Array<'email' | 'phone_number'>;
+
+    /** Solo un administrador puede crear usuarios en el pool. Ausente ⇒ default de Cognito. */
+    @Expose() @IsOptional() @IsBoolean() allowAdminCreateUserOnly?: boolean;
 }

package/src/cognitoBackofficeConnector/dtos/CreatePoolResponse.ts

@@ -1,10 +1,4 @@
-/**
- * Response del endpoint POST /pools (pivote v1.4.1 stateless).
- *
- * NO expone `clientSecret` — el SDK Cognito no lo devuelve cuando
- * `GenerateSecret: false` (BFF pattern A21). Si aparece consumer B2B/M2M
- * que requiera client secret, evaluar con líder + bump major del connector.
- */
+/** Respuesta de POST /pools. Nunca expone el secreto del app client. */
 export class CreatePoolResponse {
     userPoolId!: string;
     userPoolArn!: string;

package/src/cognitoBackofficeConnector/dtos/RefreshTokensRequest.ts

@@ -1,9 +1,12 @@
 import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
+import { IsBoolean, IsNotEmpty, IsOptional, IsString } from 'class-validator';
 
 export class RefreshTokensRequest {
     @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
     @Expose() @IsString() @IsNotEmpty() region!: string;
     @Expose() @IsString() @IsNotEmpty() clientId!: string;
     @Expose() @IsString() @IsNotEmpty() refreshToken!: string;
+    // Username de Cognito; hace falta para el SECRET_HASH.
+    @Expose() @IsOptional() @IsString() @IsNotEmpty() username?: string;
+    @Expose() @IsOptional() @IsBoolean() useClientSecret?: boolean;
 }