@fiado/type-kit 3.662.0 → 3.663.0

package/bin/messagesConnector/dtos/OtpLoginStateRequest.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtpLoginStateRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body de POST /messages/otp/login-state. */
+class OtpLoginStateRequest {
+}
+exports.OtpLoginStateRequest = OtpLoginStateRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OtpLoginStateRequest.prototype, "directoryId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OtpLoginStateRequest.prototype, "typeOfDirectoryId", void 0);

package/bin/messagesConnector/dtos/OtpLoginStateResponse.d.ts

@@ -0,0 +1,5 @@
+/** Respuesta de POST /messages/otp/login-state. `lockedUntil` va en epoch ms. */
+export declare class OtpLoginStateResponse {
+    lastFailureCode: 'OTP_NOT_FOUND' | 'OTP_EXPIRED' | 'OTP_ALREADY_USED' | null;
+    lockedUntil: number | null;
+}

package/bin/messagesConnector/dtos/OtpLoginStateResponse.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtpLoginStateResponse = void 0;
+/** Respuesta de POST /messages/otp/login-state. `lockedUntil` va en epoch ms. */
+class OtpLoginStateResponse {
+}
+exports.OtpLoginStateResponse = OtpLoginStateResponse;

package/bin/messagesConnector/index.d.ts

@@ -10,6 +10,8 @@ export * from './dtos/AgentSendNotificationRequest';
 export * from './dtos/SendMessageResponse';
 export * from './dtos/VerifyOtpRequest';
 export * from './dtos/VerifyOtpResponse';
+export * from './dtos/OtpLoginStateRequest';
+export * from './dtos/OtpLoginStateResponse';
 export * from './dtos/OtpValidatedResponse';
 export * from './dtos/NotificationResponse';
 export * from './dtos/NotificationsPageResponse';

package/bin/messagesConnector/index.js

@@ -26,6 +26,8 @@ __exportStar(require("./dtos/AgentSendNotificationRequest"), exports);
 __exportStar(require("./dtos/SendMessageResponse"), exports);
 __exportStar(require("./dtos/VerifyOtpRequest"), exports);
 __exportStar(require("./dtos/VerifyOtpResponse"), exports);
+__exportStar(require("./dtos/OtpLoginStateRequest"), exports);
+__exportStar(require("./dtos/OtpLoginStateResponse"), exports);
 __exportStar(require("./dtos/OtpValidatedResponse"), exports);
 __exportStar(require("./dtos/NotificationResponse"), exports);
 __exportStar(require("./dtos/NotificationsPageResponse"), exports);

package/bin/platformRbac/application/Application.d.ts

@@ -3,6 +3,7 @@ import { PrincipalIdentifierEnum } from '../enums/PrincipalIdentifierEnum';
 import { ApplicationStatus } from '../enums/ApplicationStatus';
 import type { UserFieldDef } from '../dtos/UserFieldDef';
 import type { TokenValidationMode } from '../enums/TokenValidationMode';
+import type { LoginModeEnum } from '../enums/LoginModeEnum';
 export interface LevelDef {
     level: PermissionScope;
     displayName: string;
@@ -44,6 +45,8 @@ export interface ApplicationDefaults {
      * UsernameAttributes del pool): true ⇒ pool con ['email','phone_number']. Heredado al tenant.
      */
     allowSecondary?: boolean;
+    /** Modo de login que heredan los tenants de esta aplicación; sin valor entran con contraseña. */
+    loginMode?: LoginModeEnum | null;
     /**
      * DEC-RBAC-111: política de contraseña que heredan los tenants creados desde esta aplicación.
      *

package/bin/platformRbac/auth/DefineNextChallengeResponse.d.ts

@@ -1,6 +1,8 @@
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../enums/LoginModeEnum';
 export declare class DefineNextChallengeResponse {
     nextChallenge?: ChallengeNameEnum;
     issueTokens: boolean;
     failAuthentication: boolean;
+    loginMode?: LoginModeEnum;
 }

package/bin/platformRbac/auth/DefineNextChallengeResponse.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefineNextChallengeResponse = void 0;
 const class_validator_1 = require("class-validator");
 const ChallengeNameEnum_1 = require("../enums/ChallengeNameEnum");
+const LoginModeEnum_1 = require("../enums/LoginModeEnum");
 class DefineNextChallengeResponse {
 }
 exports.DefineNextChallengeResponse = DefineNextChallengeResponse;
@@ -28,3 +29,8 @@ __decorate([
     (0, class_validator_1.IsBoolean)(),
     __metadata("design:type", Boolean)
 ], DefineNextChallengeResponse.prototype, "failAuthentication", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(LoginModeEnum_1.LoginModeEnum),
+    __metadata("design:type", String)
+], DefineNextChallengeResponse.prototype, "loginMode", void 0);

package/bin/platformRbac/auth/PrepareChallengeRequest.d.ts

@@ -1,7 +1,10 @@
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../enums/LoginModeEnum';
 export declare class PrepareChallengeRequest {
     cognitoSub: string;
     challengeName: ChallengeNameEnum;
     email?: string;
     phone?: string;
+    loginMode?: LoginModeEnum;
+    isRetry?: boolean;
 }

package/bin/platformRbac/auth/PrepareChallengeRequest.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PrepareChallengeRequest = void 0;
 const class_validator_1 = require("class-validator");
 const ChallengeNameEnum_1 = require("../enums/ChallengeNameEnum");
+const LoginModeEnum_1 = require("../enums/LoginModeEnum");
 class PrepareChallengeRequest {
 }
 exports.PrepareChallengeRequest = PrepareChallengeRequest;
@@ -33,3 +34,13 @@ __decorate([
     (0, class_validator_1.IsString)(),
     __metadata("design:type", String)
 ], PrepareChallengeRequest.prototype, "phone", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(LoginModeEnum_1.LoginModeEnum),
+    __metadata("design:type", String)
+], PrepareChallengeRequest.prototype, "loginMode", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], PrepareChallengeRequest.prototype, "isRetry", void 0);

package/bin/platformRbac/dtos/EnsureCustomerAccountRequest.d.ts

@@ -0,0 +1,8 @@
+/** Body de POST /internal/tenants/{tenantId}/customer-accounts. */
+export declare class EnsureCustomerAccountRequest {
+    phone: string;
+    retailCustomerId: string;
+    directoryId: string;
+    displayName: string;
+    createdBy: string;
+}

package/bin/platformRbac/dtos/EnsureCustomerAccountRequest.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnsureCustomerAccountRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const InputPatterns_1 = require("../../common/constants/InputPatterns");
+/** Body de POST /internal/tenants/{tenantId}/customer-accounts. */
+class EnsureCustomerAccountRequest {
+}
+exports.EnsureCustomerAccountRequest = EnsureCustomerAccountRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Matches)(InputPatterns_1.PHONE_E164_PATTERN),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "phone", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "retailCustomerId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "directoryId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], EnsureCustomerAccountRequest.prototype, "createdBy", void 0);

package/bin/platformRbac/dtos/EnsureCustomerAccountResponse.d.ts

@@ -0,0 +1,5 @@
+/** Respuesta de POST /internal/tenants/{tenantId}/customer-accounts. */
+export interface EnsureCustomerAccountResponse {
+    outcome: 'CREATED' | 'EXISTING';
+    cognitoSub: string;
+}

package/bin/platformRbac/dtos/EnsureCustomerAccountResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/dtos/OtpLoginRequest.d.ts

@@ -0,0 +1,5 @@
+/** Body de POST /auth/otp-login. */
+export declare class OtpLoginRequest {
+    phone: string;
+    tenantId: string;
+}

package/bin/platformRbac/dtos/OtpLoginRequest.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtpLoginRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body de POST /auth/otp-login. */
+class OtpLoginRequest {
+}
+exports.OtpLoginRequest = OtpLoginRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OtpLoginRequest.prototype, "phone", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OtpLoginRequest.prototype, "tenantId", void 0);

package/bin/platformRbac/dtos/UserProfileResponse.d.ts

@@ -6,4 +6,6 @@ export interface UserProfileResponse {
     email?: string;
     phone?: string;
     status?: string;
+    retailCustomerId?: string | null;
+    directoryId?: string | null;
 }

package/bin/platformRbac/enums/LoginModeEnum.d.ts

@@ -0,0 +1,4 @@
+/** Modo de login de un tenant. Sin valor, el tenant entra con contraseña. */
+export declare enum LoginModeEnum {
+    OTP_ONLY = "OTP_ONLY"
+}

package/bin/platformRbac/enums/LoginModeEnum.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginModeEnum = void 0;
+/** Modo de login de un tenant. Sin valor, el tenant entra con contraseña. */
+var LoginModeEnum;
+(function (LoginModeEnum) {
+    LoginModeEnum["OTP_ONLY"] = "OTP_ONLY";
+})(LoginModeEnum || (exports.LoginModeEnum = LoginModeEnum = {}));

package/bin/platformRbac/enums/Permission.d.ts

@@ -121,7 +121,8 @@ export declare enum Permission {
     PLATFORM_INTEGRATION_KEY_REVOKE = "platform.integration.key.revoke",
     TENANT_INTEGRATION_DIAGNOSTIC = "tenant.integration.diagnostic",
     TENANT_API_USER_MANAGE = "tenant.api_user.manage",
-    PLATFORM_RETAIL_INTEGRATION_ACTIVATE = "platform.retail_integration.activate"
+    PLATFORM_RETAIL_INTEGRATION_ACTIVATE = "platform.retail_integration.activate",
+    CUSTOMER_PORTAL_READ = "customer.portal.read"
 }
 /**
  * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.

package/bin/platformRbac/enums/Permission.js

@@ -168,6 +168,8 @@ var Permission;
     Permission["TENANT_API_USER_MANAGE"] = "tenant.api_user.manage";
     // Activa la integración de un retailer externo (Zentral); scope PLATFORM.
     Permission["PLATFORM_RETAIL_INTEGRATION_ACTIVATE"] = "platform.retail_integration.activate";
+    // Lectura del portal del cliente.
+    Permission["CUSTOMER_PORTAL_READ"] = "customer.portal.read";
 })(Permission || (exports.Permission = Permission = {}));
 /**
  * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.
@@ -289,6 +291,7 @@ exports.PERMISSION_BIT_ORDER = [
     Permission.TENANT_INTEGRATION_DIAGNOSTIC,
     Permission.TENANT_API_USER_MANAGE,
     Permission.PLATFORM_RETAIL_INTEGRATION_ACTIVATE,
+    Permission.CUSTOMER_PORTAL_READ,
 ];
 function djb2(input) {
     let h = 5381;

package/bin/platformRbac/index.d.ts

@@ -11,6 +11,7 @@ export type { EffectivePermissionsResponse } from './dtos/EffectivePermissionsRe
 export * from './enums/MfaMethodEnum';
 export * from './enums/TokenValidationMode';
 export * from './enums/ChallengeNameEnum';
+export * from './enums/LoginModeEnum';
 export * from './auth/DefineNextChallengeRequest';
 export * from './auth/DefineNextChallengeResponse';
 export * from './auth/PrepareChallengeRequest';
@@ -51,6 +52,9 @@ export type { CreateApplicationRequest, UpdateApplicationRequest, UpsertApplicat
 export type { RoleScopeRecompute, InconsistentAssignment, CascadeTenantFailure, CascadeReport, UpdateApplicationPermissionResponse, RoleSeedDiff, RoleCascadeChange, RoleCascadeReport, } from './application/cascade';
 export * from './dtos/SelfRegisterStartRequest';
 export * from './dtos/SelfRegisterVerifyOtpRequest';
+export * from './dtos/EnsureCustomerAccountRequest';
+export type { EnsureCustomerAccountResponse } from './dtos/EnsureCustomerAccountResponse';
+export * from './dtos/OtpLoginRequest';
 export * from './dtos/SelfRegisterCompleteRequest';
 export * from './dtos/CreateLevelEntityRequest';
 export type { CreateLevelEntityResponse } from './dtos/CreateLevelEntityResponse';

package/bin/platformRbac/index.js

@@ -48,6 +48,7 @@ Object.defineProperty(exports, "AccountType", { enumerable: true, get: function
 __exportStar(require("./enums/MfaMethodEnum"), exports);
 __exportStar(require("./enums/TokenValidationMode"), exports);
 __exportStar(require("./enums/ChallengeNameEnum"), exports);
+__exportStar(require("./enums/LoginModeEnum"), exports);
 __exportStar(require("./auth/DefineNextChallengeRequest"), exports);
 __exportStar(require("./auth/DefineNextChallengeResponse"), exports);
 __exportStar(require("./auth/PrepareChallengeRequest"), exports);
@@ -107,6 +108,8 @@ __exportStar(require("./enums/PermissionKind"), exports);
 // plain (type-only). Consumidos por los endpoints públicos de platform-rbac-business + el gate de perfil.
 __exportStar(require("./dtos/SelfRegisterStartRequest"), exports);
 __exportStar(require("./dtos/SelfRegisterVerifyOtpRequest"), exports);
+__exportStar(require("./dtos/EnsureCustomerAccountRequest"), exports);
+__exportStar(require("./dtos/OtpLoginRequest"), exports);
 __exportStar(require("./dtos/SelfRegisterCompleteRequest"), exports);
 // Endpoints privados de espejo de jerarquía + alta de usuario (SureKeep F1, scope mirror).
 // Request DTOs llevan decoradores class-validator → export de valor (se hidratan con plainToInstance);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.662.0",
+  "version": "3.663.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/cognitoBackofficeConnector/dtos/AppClientConfig.ts

@@ -14,10 +14,7 @@ export const COGNITO_EXPLICIT_AUTH_FLOWS: readonly string[] = [
 /** Unidades de vigencia de token; el conector aplica una sola a los tres tokens. */
 export const COGNITO_TOKEN_VALIDITY_UNITS: readonly string[] = ['seconds', 'minutes', 'hours', 'days'];
 
-/**
- * Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients).
- * Sin `generateSecret`: el conector fija GenerateSecret false (A21).
- */
+/** Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients). */
 export class AppClientConfig {
     @Expose() @IsOptional() @IsString() clientName?: string;
     @Expose() @IsArray() @IsIn(COGNITO_EXPLICIT_AUTH_FLOWS, { each: true }) explicitAuthFlows!: string[];
@@ -29,4 +26,6 @@ export class AppClientConfig {
     @Expose() @IsOptional() @IsBoolean() enableTokenRevocation?: boolean;
     /** Atributos que el usuario puede escribir con su propio token. Ausente ⇒ todos (default de Cognito). */
     @Expose() @IsOptional() @IsArray() @IsString({ each: true }) writeAttributes?: string[];
+    /** Crea el client con secreto. Ausente ⇒ sin secreto. */
+    @Expose() @IsOptional() @IsBoolean() generateSecret?: boolean;
 }

package/src/cognitoBackofficeConnector/dtos/CreatePoolClientResponse.ts

@@ -1,4 +1,4 @@
-/** Respuesta de POST /pools/{userPoolId}/clients. Sin secret: el client nace con GenerateSecret false. */
+/** Respuesta de POST /pools/{userPoolId}/clients. Nunca expone el secreto del client. */
 export class CreatePoolClientResponse {
     appClientId!: string;
 }

package/src/cognitoBackofficeConnector/dtos/CreatePoolRequest.ts

@@ -1,5 +1,5 @@
 import { Expose, Type } from 'class-transformer';
-import { IsArray, IsIn, IsOptional, IsString, ValidateNested } from 'class-validator';
+import { IsArray, IsBoolean, IsIn, IsOptional, IsString, ValidateNested } from 'class-validator';
 import { PasswordPolicyConfig } from './PasswordPolicyConfig';
 import { CustomAttributeSpec } from './CustomAttributeSpec';
 import { AppClientConfig } from './AppClientConfig';
@@ -38,4 +38,7 @@ export class CreatePoolRequest {
     @IsArray()
     @IsIn(['email', 'phone_number'], { each: true })
     usernameAttributes?: Array<'email' | 'phone_number'>;
+
+    /** Solo un administrador puede crear usuarios en el pool. Ausente ⇒ default de Cognito. */
+    @Expose() @IsOptional() @IsBoolean() allowAdminCreateUserOnly?: boolean;
 }

package/src/cognitoBackofficeConnector/dtos/CreatePoolResponse.ts

@@ -1,10 +1,4 @@
-/**
- * Response del endpoint POST /pools (pivote v1.4.1 stateless).
- *
- * NO expone `clientSecret` — el SDK Cognito no lo devuelve cuando
- * `GenerateSecret: false` (BFF pattern A21). Si aparece consumer B2B/M2M
- * que requiera client secret, evaluar con líder + bump major del connector.
- */
+/** Respuesta de POST /pools. Nunca expone el secreto del app client. */
 export class CreatePoolResponse {
     userPoolId!: string;
     userPoolArn!: string;

package/src/cognitoBackofficeConnector/dtos/RefreshTokensRequest.ts

@@ -1,9 +1,12 @@
 import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
+import { IsBoolean, IsNotEmpty, IsOptional, IsString } from 'class-validator';
 
 export class RefreshTokensRequest {
     @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
     @Expose() @IsString() @IsNotEmpty() region!: string;
     @Expose() @IsString() @IsNotEmpty() clientId!: string;
     @Expose() @IsString() @IsNotEmpty() refreshToken!: string;
+    // Username de Cognito; hace falta para el SECRET_HASH.
+    @Expose() @IsOptional() @IsString() @IsNotEmpty() username?: string;
+    @Expose() @IsOptional() @IsBoolean() useClientSecret?: boolean;
 }

package/src/cognitoBackofficeConnector/dtos/RespondToChallengeRequest.ts

@@ -1,5 +1,5 @@
 import { Expose } from 'class-transformer';
-import { IsEnum, IsNotEmpty, IsObject, IsString } from 'class-validator';
+import { IsBoolean, IsEnum, IsNotEmpty, IsObject, IsOptional, IsString } from 'class-validator';
 import { CognitoChallengeType } from '../enums/CognitoChallengeType';
 
 export class RespondToChallengeRequest {
@@ -9,4 +9,5 @@ export class RespondToChallengeRequest {
     @Expose() @IsEnum(CognitoChallengeType) challengeName!: CognitoChallengeType;
     @Expose() @IsString() @IsNotEmpty() session!: string;
     @Expose() @IsObject() challengeResponses!: Record<string, string>;
+    @Expose() @IsOptional() @IsBoolean() useClientSecret?: boolean;
 }

package/src/cognitoBackofficeConnector/dtos/StartOtpLoginRequest.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+/** Body de POST /auth/start-otp-login: inicia CUSTOM_AUTH sin SRP ni contraseña. */
+export class StartOtpLoginRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+    @Expose() @IsOptional() @IsBoolean() useClientSecret?: boolean;
+}

package/src/cognitoBackofficeConnector/index.ts

@@ -23,6 +23,7 @@ export * from './dtos/AuthEventResponse';
 export * from './dtos/AuthTokensResponse';
 export * from './dtos/AuthStartLoginRequest';
 export * from './dtos/AuthStartLoginResponse';
+export * from './dtos/StartOtpLoginRequest';
 export * from './dtos/InitiateAuthRequest';
 export * from './dtos/InitiateAuthResponse';
 export * from './dtos/VerifyPasswordRequest';

package/src/messagesConnector/dtos/OtpLoginStateRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/** Body de POST /messages/otp/login-state. */
+export class OtpLoginStateRequest {
+    @Expose() @IsString() @IsNotEmpty() directoryId!: string;
+    @Expose() @IsString() @IsNotEmpty() typeOfDirectoryId!: string;
+}

package/src/messagesConnector/dtos/OtpLoginStateResponse.ts

@@ -0,0 +1,5 @@
+/** Respuesta de POST /messages/otp/login-state. `lockedUntil` va en epoch ms. */
+export class OtpLoginStateResponse {
+    lastFailureCode!: 'OTP_NOT_FOUND' | 'OTP_EXPIRED' | 'OTP_ALREADY_USED' | null;
+    lockedUntil!: number | null;
+}

package/src/messagesConnector/index.ts

@@ -10,6 +10,8 @@ export * from './dtos/AgentSendNotificationRequest';
 export * from './dtos/SendMessageResponse';
 export * from './dtos/VerifyOtpRequest';
 export * from './dtos/VerifyOtpResponse';
+export * from './dtos/OtpLoginStateRequest';
+export * from './dtos/OtpLoginStateResponse';
 export * from './dtos/OtpValidatedResponse';
 export * from './dtos/NotificationResponse';
 export * from './dtos/NotificationsPageResponse';

package/src/platformRbac/application/Application.ts

@@ -3,6 +3,7 @@ import { PrincipalIdentifierEnum } from '../enums/PrincipalIdentifierEnum';
 import { ApplicationStatus } from '../enums/ApplicationStatus';
 import type { UserFieldDef } from '../dtos/UserFieldDef';
 import type { TokenValidationMode } from '../enums/TokenValidationMode';
+import type { LoginModeEnum } from '../enums/LoginModeEnum';
 
 export interface LevelDef {
     level: PermissionScope; // LEVEL_1 | LEVEL_2 | LEVEL_3
@@ -55,6 +56,8 @@ export interface ApplicationDefaults {
      * UsernameAttributes del pool): true ⇒ pool con ['email','phone_number']. Heredado al tenant.
      */
     allowSecondary?: boolean;
+    /** Modo de login que heredan los tenants de esta aplicación; sin valor entran con contraseña. */
+    loginMode?: LoginModeEnum | null;
     /**
      * DEC-RBAC-111: política de contraseña que heredan los tenants creados desde esta aplicación.
      *

package/src/platformRbac/auth/DefineNextChallengeResponse.ts

@@ -1,5 +1,6 @@
 import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../enums/LoginModeEnum';
 
 export class DefineNextChallengeResponse {
     @IsOptional()
@@ -11,4 +12,8 @@ export class DefineNextChallengeResponse {
 
     @IsBoolean()
     failAuthentication!: boolean;
+
+    @IsOptional()
+    @IsEnum(LoginModeEnum)
+    loginMode?: LoginModeEnum;
 }

package/src/platformRbac/auth/PrepareChallengeRequest.ts

@@ -1,5 +1,6 @@
-import { IsEmail, IsEnum, IsOptional, IsString, ValidateIf } from 'class-validator';
+import { IsBoolean, IsEmail, IsEnum, IsOptional, IsString, ValidateIf } from 'class-validator';
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../enums/LoginModeEnum';
 
 export class PrepareChallengeRequest {
     @IsString()
@@ -23,4 +24,13 @@ export class PrepareChallengeRequest {
     @IsOptional()
     @IsString()
     phone?: string;
+
+    @IsOptional()
+    @IsEnum(LoginModeEnum)
+    loginMode?: LoginModeEnum;
+
+    // Indica que la sesión ya trae un SMS_OTP fallido.
+    @IsOptional()
+    @IsBoolean()
+    isRetry?: boolean;
 }

package/src/platformRbac/dtos/EnsureCustomerAccountRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString, Matches } from 'class-validator';
+import { PHONE_E164_PATTERN } from '../../common/constants/InputPatterns';
+
+/** Body de POST /internal/tenants/{tenantId}/customer-accounts. */
+export class EnsureCustomerAccountRequest {
+    @Expose() @IsString() @Matches(PHONE_E164_PATTERN) phone!: string;
+    @Expose() @IsString() @IsNotEmpty() retailCustomerId!: string;
+    @Expose() @IsString() @IsNotEmpty() directoryId!: string;
+    @Expose() @IsString() @IsNotEmpty() displayName!: string;
+    @Expose() @IsString() @IsNotEmpty() createdBy!: string;
+}

package/src/platformRbac/dtos/EnsureCustomerAccountResponse.ts

@@ -0,0 +1,5 @@
+/** Respuesta de POST /internal/tenants/{tenantId}/customer-accounts. */
+export interface EnsureCustomerAccountResponse {
+    outcome: 'CREATED' | 'EXISTING';
+    cognitoSub: string;
+}

package/src/platformRbac/dtos/OtpLoginRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/** Body de POST /auth/otp-login. */
+export class OtpLoginRequest {
+    @Expose() @IsString() @IsNotEmpty() phone!: string;
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+}

package/src/platformRbac/dtos/UserProfileResponse.ts

@@ -6,4 +6,6 @@ export interface UserProfileResponse {
     email?: string;
     phone?: string;
     status?: string;
+    retailCustomerId?: string | null;
+    directoryId?: string | null;
 }

package/src/platformRbac/enums/LoginModeEnum.ts

@@ -0,0 +1,4 @@
+/** Modo de login de un tenant. Sin valor, el tenant entra con contraseña. */
+export enum LoginModeEnum {
+    OTP_ONLY = 'OTP_ONLY',
+}

package/src/platformRbac/enums/Permission.ts

@@ -167,6 +167,8 @@ export enum Permission {
     TENANT_API_USER_MANAGE = 'tenant.api_user.manage',
     // Activa la integración de un retailer externo (Zentral); scope PLATFORM.
     PLATFORM_RETAIL_INTEGRATION_ACTIVATE = 'platform.retail_integration.activate',
+    // Lectura del portal del cliente.
+    CUSTOMER_PORTAL_READ = 'customer.portal.read',
 }
 
 /**
@@ -289,6 +291,7 @@ export const PERMISSION_BIT_ORDER: readonly Permission[] = [
     Permission.TENANT_INTEGRATION_DIAGNOSTIC,
     Permission.TENANT_API_USER_MANAGE,
     Permission.PLATFORM_RETAIL_INTEGRATION_ACTIVATE,
+    Permission.CUSTOMER_PORTAL_READ,
 ] as const;
 
 function djb2(input: string): number {

package/src/platformRbac/index.ts

@@ -34,6 +34,7 @@ export type { EffectivePermissionsResponse } from './dtos/EffectivePermissionsRe
 export * from './enums/MfaMethodEnum';
 export * from './enums/TokenValidationMode';
 export * from './enums/ChallengeNameEnum';
+export * from './enums/LoginModeEnum';
 export * from './auth/DefineNextChallengeRequest';
 export * from './auth/DefineNextChallengeResponse';
 export * from './auth/PrepareChallengeRequest';
@@ -130,6 +131,9 @@ export type {
 // plain (type-only). Consumidos por los endpoints públicos de platform-rbac-business + el gate de perfil.
 export * from './dtos/SelfRegisterStartRequest';
 export * from './dtos/SelfRegisterVerifyOtpRequest';
+export * from './dtos/EnsureCustomerAccountRequest';
+export type { EnsureCustomerAccountResponse } from './dtos/EnsureCustomerAccountResponse';
+export * from './dtos/OtpLoginRequest';
 export * from './dtos/SelfRegisterCompleteRequest';
 
 // Endpoints privados de espejo de jerarquía + alta de usuario (SureKeep F1, scope mirror).