@fiado/type-kit 3.69.0 → 3.71.0

package/_test_/unit/cognitoBackofficeConnector/dtos/CreateUserRequest.test.ts

@@ -38,6 +38,19 @@ describe('CreateUserRequest', () => {
         expect(errors.some(e => e.property === 'tenantId')).toBe(true);
     });
 
+    // userPoolId + region pasan a ser OPCIONALES: el front del alta de usuario PLATFORM deja de
+    // mandarlos y el backend (platform-rbac-business) los resuelve de la config del tenant 'platform'.
+    // Quedan en el DTO por compatibilidad con los demás callers del connector que SÍ los proveen.
+    it('valida sin userPoolId ni region (alta platform — el backend los resuelve)', async () => {
+        const dto = plainToInstance(CreateUserRequest, {
+            email: 'user@acme.com',
+            tenantId: 'platform',
+        });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'userPoolId')).toBe(false);
+        expect(errors.some(e => e.property === 'region')).toBe(false);
+    });
+
     it('preserva los campos opcionales legítimos', async () => {
         const dto = plainToInstance(CreateUserRequest, {
             ...valid,

package/_test_/unit/platformRbac/dtos/effectivePermissions.test.ts

@@ -0,0 +1,22 @@
+import 'reflect-metadata';
+import type { AuthContext, EffectivePermissionsResponse } from '../../../../src/platformRbac/index';
+
+it('AuthContext acepta los campos opcionales del token-as-cache', () => {
+    const ctx: AuthContext = {
+        cognitoSub: 's',
+        tenantId: 't',
+        email: 'e',
+        roleAssignments: [],
+        permissions: [],
+        resolvedAt: 'now',
+        permBits: 'AAA',
+        permVer: 1,
+        permsEpoch: 3,
+    };
+    expect(ctx.permVer).toBe(1);
+});
+
+it('EffectivePermissionsResponse tiene permissions + roleAssignments + epoch', () => {
+    const r: EffectivePermissionsResponse = { permissions: [], roleAssignments: [], permsEpoch: 0 };
+    expect(r.permsEpoch).toBe(0);
+});

package/_test_/unit/platformRbac/enums/__snapshots__/permissionBits.test.ts.snap

@@ -0,0 +1,98 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `4037934643`;
+
+exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe ante cualquier reorden/inserción) 1`] = `
+[
+  "rbac.catalog.manage",
+  "platform.tenant.create",
+  "platform.tenant.list",
+  "platform.tenant.view",
+  "platform.tenant.update",
+  "platform.tenant.suspend",
+  "platform.tenant.activate",
+  "platform.tenant.admin.replace",
+  "platform.cognito.pool.manage",
+  "platform.cognito.pool.list",
+  "platform.user.create",
+  "platform.user.list",
+  "platform.user.view",
+  "platform.user.update",
+  "platform.user.disable",
+  "platform.user.enable",
+  "platform.user.delete",
+  "platform.role.create",
+  "platform.role.list",
+  "platform.role.update",
+  "platform.role.delete",
+  "platform.audit.view",
+  "tenant.user.create",
+  "tenant.user.create.lateral",
+  "tenant.user.read",
+  "tenant.user.status",
+  "tenant.user.list",
+  "tenant.user.view",
+  "tenant.user.update",
+  "tenant.user.disable",
+  "tenant.user.enable",
+  "tenant.user.delete",
+  "tenant.user.mfa.reset",
+  "tenant.user.password.reset",
+  "tenant.role.create",
+  "tenant.role.list",
+  "tenant.role.update",
+  "tenant.role.delete",
+  "tenant.role.view",
+  "tenant.role.assign",
+  "tenant.role.revoke",
+  "tenant.security.policy.view",
+  "tenant.security.policy.manage",
+  "tenant.branding.manage",
+  "tenant.audit.view",
+  "retail.user.create",
+  "retail.user.create.lateral",
+  "retail.user.read",
+  "retail.user.update",
+  "retail.user.status",
+  "retail.user.delete",
+  "retail.user.password.reset",
+  "retail.user.mfa.reset",
+  "retail.product.create",
+  "retail.product.list",
+  "retail.product.view",
+  "retail.product.update",
+  "retail.product.delete",
+  "retail.product.mdm_config",
+  "retail.inventory.list",
+  "retail.inventory.view",
+  "retail.inventory.update",
+  "retail.sale.create",
+  "retail.sale.list",
+  "retail.sale.cancel",
+  "retail.store.manage",
+  "retail.retailer.manage",
+  "lend.credit.create",
+  "lend.credit.list",
+  "lend.credit.view",
+  "lend.credit.update",
+  "lend.credit.liquidate",
+  "lend.credit.restructure",
+  "lend.payment.apply",
+  "lend.payment.list",
+  "lend.payment.reverse",
+  "lend.installment.view",
+  "mdm.device.enroll",
+  "mdm.device.release",
+  "mdm.device.archive",
+  "mdm.device.deactivate",
+  "mdm.device.lock.manual",
+  "mdm.device.unlock.manual",
+  "mdm.device.pin_unlock",
+  "mdm.device.extend_validity",
+  "mdm.device.notify",
+  "mdm.device.status.view",
+  "mdm.operation_log.view",
+  "mdm.test",
+  "pay.transaction.view",
+]
+`;

package/_test_/unit/platformRbac/enums/permissionBits.test.ts

@@ -0,0 +1,36 @@
+import {
+    Permission,
+    PERMISSION_BIT_ORDER,
+    PERMS_VERSION,
+    permissionsToBits,
+    bitsToPermissions,
+} from '../../../../src/platformRbac/enums/Permission';
+
+describe('PERMISSION_BIT_ORDER', () => {
+    it('contiene TODOS los valores del enum Permission', () => {
+        const enumVals = Object.values(Permission) as string[];
+        expect([...PERMISSION_BIT_ORDER].sort()).toEqual([...enumVals].sort());
+    });
+    it('append-only: snapshot del ORDEN COMPLETO (rompe ante cualquier reorden/inserción)', () => {
+        // Snapshot del array entero, NO un prefijo: un reorden del índice 11+ o una inserción
+        // intermedia desalinea todos los tokens emitidos. Si esto rompe, fue intencional → -u consciente.
+        expect(PERMISSION_BIT_ORDER).toMatchSnapshot();
+    });
+    it('PERMS_VERSION es número estable', () => {
+        expect(typeof PERMS_VERSION).toBe('number');
+        expect(PERMS_VERSION).toMatchSnapshot();
+    });
+    it('round-trip permisos ↔ bits', () => {
+        const perms = [
+            PERMISSION_BIT_ORDER[0],
+            PERMISSION_BIT_ORDER[5],
+            PERMISSION_BIT_ORDER[PERMISSION_BIT_ORDER.length - 1],
+        ];
+        const bits = permissionsToBits(perms);
+        expect(typeof bits).toBe('string');
+        expect(new Set(bitsToPermissions(bits))).toEqual(new Set(perms));
+    });
+    it('bitsToPermissions tolera basura → []', () => {
+        expect(bitsToPermissions('')).toEqual([]);
+    });
+});

package/bin/cognitoBackofficeConnector/dtos/CreateUserRequest.d.ts

@@ -1,6 +1,6 @@
 export declare class CreateUserRequest {
-    userPoolId: string;
-    region: string;
+    userPoolId?: string;
+    region?: string;
     email: string;
     displayName?: string;
     tenantId: string;

package/bin/cognitoBackofficeConnector/dtos/CreateUserRequest.js

@@ -17,14 +17,14 @@ class CreateUserRequest {
 exports.CreateUserRequest = CreateUserRequest;
 __decorate([
     (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], CreateUserRequest.prototype, "userPoolId", void 0);
 __decorate([
     (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], CreateUserRequest.prototype, "region", void 0);
 __decorate([

package/bin/index.d.ts

@@ -74,6 +74,7 @@ export * as CirculoCredito from './circuloCredito';
 export * as MilestoneBusiness from './milestone-business';
 export * as Mdm from './mdm';
 export * as MessagesConnector from './messagesConnector';
+export * as TwilioConnector from './twilioConnector';
 export * as CognitoBackofficeConnector from './cognitoBackofficeConnector';
 export * as PlatformRbac from './platformRbac';
 export * as Remittance from './remittance';

package/bin/index.js

@@ -37,7 +37,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Company = exports.Services = exports.AccountIssuanceBusiness = exports.AppSelectionData = exports.Device = exports.Observations = exports.IssuanceBusiness = exports.Blacklist = exports.CentralPayments = exports.Helpdesk = exports.FiadoApiResponse = exports.Auth = exports.LegalDocumentsBusiness = exports.Role = exports.STPAccount = exports.RiskProfile = exports.FraudPreventionEngine = exports.BBVARst = exports.Stp = exports.BenefitCenter = exports.BankAccount = exports.P2pContact = exports.CreditContract = exports.Contract = exports.ProductCatalog = exports.ContactInfo = exports.TransactionAnalytics = exports.Transaction = exports.TransactionProcessor = exports.GenericMessage = exports.EventBridgeMessage = exports.SessionActivity = exports.NotificationMessages = exports.ServicePayment = exports.Header = exports.Identity = exports.Group = exports.File = exports.ExchangeRate = exports.Directory = exports.Currency = exports.Country = exports.Card = exports.Authentication = exports.App = exports.Address = exports.Beneficiary = exports.Activity = exports.Account = exports.Crypto = void 0;
-exports.TotpSecurity = exports.WalletFunding = exports.Remittance = exports.PlatformRbac = exports.CognitoBackofficeConnector = exports.MessagesConnector = exports.Mdm = exports.MilestoneBusiness = exports.CirculoCredito = exports.CreditStatements = exports.Sentry = exports.AiEngine = exports.Funnel = exports.TeamsConnector = exports.PlatformErrorEvents = exports.CustomerFile = exports.CreditBackoffice = exports.CreditDashboard = exports.CreditEngine = exports.Credit = exports.ComissionBusiness = exports.ReferralBusiness = exports.ZendeskMessaging = exports.NotificationWS = exports.Event = exports.PayrollBusiness = exports.Cnbv = exports.DirectorySetting = exports.InvoiceCollector = exports.Collector = exports.Pricelist = void 0;
+exports.TotpSecurity = exports.WalletFunding = exports.Remittance = exports.PlatformRbac = exports.CognitoBackofficeConnector = exports.TwilioConnector = exports.MessagesConnector = exports.Mdm = exports.MilestoneBusiness = exports.CirculoCredito = exports.CreditStatements = exports.Sentry = exports.AiEngine = exports.Funnel = exports.TeamsConnector = exports.PlatformErrorEvents = exports.CustomerFile = exports.CreditBackoffice = exports.CreditDashboard = exports.CreditEngine = exports.Credit = exports.ComissionBusiness = exports.ReferralBusiness = exports.ZendeskMessaging = exports.NotificationWS = exports.Event = exports.PayrollBusiness = exports.Cnbv = exports.DirectorySetting = exports.InvoiceCollector = exports.Collector = exports.Pricelist = void 0;
 exports.Crypto = __importStar(require("./crypto"));
 exports.Account = __importStar(require("./account"));
 exports.Activity = __importStar(require("./activity"));
@@ -114,6 +114,7 @@ exports.CirculoCredito = __importStar(require("./circuloCredito"));
 exports.MilestoneBusiness = __importStar(require("./milestone-business"));
 exports.Mdm = __importStar(require("./mdm"));
 exports.MessagesConnector = __importStar(require("./messagesConnector"));
+exports.TwilioConnector = __importStar(require("./twilioConnector"));
 exports.CognitoBackofficeConnector = __importStar(require("./cognitoBackofficeConnector"));
 // PlatformRbac: módulo del lambda platform-rbac-business (Fase 0 SureKeep).
 // Contiene Permission enum + AuthContext + RoleAssignmentInfo + PermissionScope +

package/bin/milestone-business/dtos/Milestone.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Forma completa de un Milestone tal como lo persiste y devuelve el lambda
+ * `milestone-business`. Es la representación canónica del item de la tabla DDB
+ * `Milestones` expuesta a consumers server-to-server (api-invoker).
+ *
+ * `value` es metadata libre asociada al evento (objeto de forma variable).
+ * `createdAt` / `updatedAt` son epoch ms (Dynamoose `timestamps: true`).
+ */
+export interface Milestone {
+    /** Identificador único del milestone. Determinístico: `${directoryId}#${eventKey}`. */
+    id: string;
+    /** directoryId del usuario al que pertenece el evento. */
+    directoryId: string;
+    /** Fecha en la que ocurrió el evento (epoch en milisegundos). */
+    eventDate: number;
+    /** Llave que identifica el tipo de evento/milestone. */
+    eventKey: string;
+    /** Metadata libre asociada al milestone (objeto con forma variable). */
+    value?: Record<string, unknown>;
+    /** Epoch ms de creación (Dynamoose timestamps). */
+    createdAt?: number;
+    /** Epoch ms de última actualización (Dynamoose timestamps). */
+    updatedAt?: number;
+}

package/bin/milestone-business/dtos/Milestone.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/milestone-business/dtos/MilestonesByDirectoryIdsRequest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Cota máxima de directoryIds aceptados por request en el endpoint batch
+ * `privateListMilestonesByDirectoryIds`. Protege contra fan-out excesivo
+ * (cada directoryId dispara un query GSI con drenado de paginación).
+ */
+export declare const MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH = 100;
+/**
+ * Body de `POST /private/milestones/by-directory-ids`.
+ *
+ * Recibe una lista de directoryIds y devuelve, por cada uno, el array COMPLETO
+ * de milestones (paginación drenada del lado del lambda). Se usa POST en lugar
+ * de GET porque la lista puede ser larga y no cabe cómoda en query string.
+ *
+ * La cota de tamaño (`MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH`) se valida también
+ * en el manager para responder 400 explícito si se excede.
+ */
+export declare class MilestonesByDirectoryIdsRequest {
+    directoryIds: string[];
+}

package/bin/milestone-business/dtos/MilestonesByDirectoryIdsRequest.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MilestonesByDirectoryIdsRequest = exports.MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH = void 0;
+const class_validator_1 = require("class-validator");
+/**
+ * Cota máxima de directoryIds aceptados por request en el endpoint batch
+ * `privateListMilestonesByDirectoryIds`. Protege contra fan-out excesivo
+ * (cada directoryId dispara un query GSI con drenado de paginación).
+ */
+exports.MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH = 100;
+/**
+ * Body de `POST /private/milestones/by-directory-ids`.
+ *
+ * Recibe una lista de directoryIds y devuelve, por cada uno, el array COMPLETO
+ * de milestones (paginación drenada del lado del lambda). Se usa POST en lugar
+ * de GET porque la lista puede ser larga y no cabe cómoda en query string.
+ *
+ * La cota de tamaño (`MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH`) se valida también
+ * en el manager para responder 400 explícito si se excede.
+ */
+class MilestonesByDirectoryIdsRequest {
+}
+exports.MilestonesByDirectoryIdsRequest = MilestonesByDirectoryIdsRequest;
+__decorate([
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.ArrayMaxSize)(exports.MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], MilestonesByDirectoryIdsRequest.prototype, "directoryIds", void 0);

package/bin/milestone-business/dtos/MilestonesByDirectoryIdsResponse.d.ts

@@ -0,0 +1,10 @@
+import { Milestone } from "./Milestone";
+/**
+ * Respuesta de `POST /private/milestones/by-directory-ids`.
+ *
+ * Mapa directoryId -> array COMPLETO de milestones de ese directorio.
+ * Cada directoryId solicitado aparece como clave; si un directorio no tiene
+ * milestones, su valor es un array vacío `[]` (la clave NO se omite, para que
+ * el consumer pueda distinguir "consultado, sin milestones" de "no consultado").
+ */
+export type MilestonesByDirectoryIdsResponse = Record<string, Milestone[]>;

package/bin/milestone-business/dtos/MilestonesByDirectoryIdsResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/milestone-business/index.d.ts

@@ -1 +1,4 @@
 export { MilestonesByEventKeyDateRangeParams } from "./dtos/MilestonesByEventKeyDateRangeParams";
+export { Milestone } from "./dtos/Milestone";
+export { MilestonesByDirectoryIdsRequest, MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH, } from "./dtos/MilestonesByDirectoryIdsRequest";
+export { MilestonesByDirectoryIdsResponse } from "./dtos/MilestonesByDirectoryIdsResponse";

package/bin/milestone-business/index.js

@@ -1,2 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH = exports.MilestonesByDirectoryIdsRequest = void 0;
+var MilestonesByDirectoryIdsRequest_1 = require("./dtos/MilestonesByDirectoryIdsRequest");
+Object.defineProperty(exports, "MilestonesByDirectoryIdsRequest", { enumerable: true, get: function () { return MilestonesByDirectoryIdsRequest_1.MilestonesByDirectoryIdsRequest; } });
+Object.defineProperty(exports, "MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH", { enumerable: true, get: function () { return MilestonesByDirectoryIdsRequest_1.MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH; } });

package/bin/platformRbac/dtos/AuthContext.d.ts

@@ -18,4 +18,10 @@ export interface AuthContext {
     permissions: Permission[];
     resolvedAt: string;
     issuer?: string;
+    /** Bitset base64url de permisos efectivos (token-as-cache). Ausente → fallback al resolver/claim. */
+    permBits?: string;
+    /** Versión del catálogo (PERMS_VERSION) con la que se construyó permBits. */
+    permVer?: number;
+    /** Epoch de permisos del tenant al momento de emitir el token. */
+    permsEpoch?: number;
 }

package/bin/platformRbac/dtos/EffectivePermissionsResponse.d.ts

@@ -0,0 +1,8 @@
+import type { Permission } from '../enums/Permission';
+import type { RoleAssignmentInfo } from './RoleAssignmentInfo';
+/** Respuesta de platform-rbac-business /internal/effective-permissions (consumida por jwt-inyector). */
+export interface EffectivePermissionsResponse {
+    permissions: Permission[];
+    roleAssignments: RoleAssignmentInfo[];
+    permsEpoch: number;
+}

package/bin/platformRbac/dtos/EffectivePermissionsResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/enums/Permission.d.ts

@@ -102,3 +102,16 @@ export declare enum Permission {
     MDM_TEST = "mdm.test",
     PAY_TRANSACTION_VIEW = "pay.transaction.view"
 }
+/**
+ * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.
+ * Índice de cada permiso = su posición de bit. NUNCA reordenar ni borrar:
+ * deprecados CONSERVAN su posición; los nuevos van SIEMPRE al final.
+ * Derivado explícitamente (no Object.values, frágil ante edición del enum).
+ */
+export declare const PERMISSION_BIT_ORDER: readonly Permission[];
+/** Versión del catálogo = hash del orden. Cambia solo si el orden cambia. */
+export declare const PERMS_VERSION: number;
+/** Comprime un set de permisos a bitset base64url. */
+export declare function permissionsToBits(perms: readonly Permission[]): string;
+/** Decodifica un bitset base64url a la lista de permisos. Tolerante a basura → []. */
+export declare function bitsToPermissions(bits: string): Permission[];

package/bin/platformRbac/enums/Permission.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Permission = void 0;
+exports.PERMS_VERSION = exports.PERMISSION_BIT_ORDER = exports.Permission = void 0;
+exports.permissionsToBits = permissionsToBits;
+exports.bitsToPermissions = bitsToPermissions;
 /**
  * Catálogo universal de permisos del sistema RBAC Fiado.
  *
@@ -135,3 +137,140 @@ var Permission;
     // ====================================================
     Permission["PAY_TRANSACTION_VIEW"] = "pay.transaction.view";
 })(Permission || (exports.Permission = Permission = {}));
+/**
+ * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.
+ * Índice de cada permiso = su posición de bit. NUNCA reordenar ni borrar:
+ * deprecados CONSERVAN su posición; los nuevos van SIEMPRE al final.
+ * Derivado explícitamente (no Object.values, frágil ante edición del enum).
+ */
+exports.PERMISSION_BIT_ORDER = [
+    Permission.RBAC_CATALOG_MANAGE,
+    Permission.PLATFORM_TENANT_CREATE,
+    Permission.PLATFORM_TENANT_LIST,
+    Permission.PLATFORM_TENANT_VIEW,
+    Permission.PLATFORM_TENANT_UPDATE,
+    Permission.PLATFORM_TENANT_SUSPEND,
+    Permission.PLATFORM_TENANT_ACTIVATE,
+    Permission.PLATFORM_TENANT_ADMIN_REPLACE,
+    Permission.PLATFORM_COGNITO_POOL_MANAGE,
+    Permission.PLATFORM_COGNITO_POOL_LIST,
+    Permission.PLATFORM_USER_CREATE,
+    Permission.PLATFORM_USER_LIST,
+    Permission.PLATFORM_USER_VIEW,
+    Permission.PLATFORM_USER_UPDATE,
+    Permission.PLATFORM_USER_DISABLE,
+    Permission.PLATFORM_USER_ENABLE,
+    Permission.PLATFORM_USER_DELETE,
+    Permission.PLATFORM_ROLE_CREATE,
+    Permission.PLATFORM_ROLE_LIST,
+    Permission.PLATFORM_ROLE_UPDATE,
+    Permission.PLATFORM_ROLE_DELETE,
+    Permission.PLATFORM_AUDIT_VIEW,
+    Permission.TENANT_USER_CREATE,
+    Permission.TENANT_USER_CREATE_LATERAL,
+    Permission.TENANT_USER_READ,
+    Permission.TENANT_USER_STATUS,
+    Permission.TENANT_USER_LIST,
+    Permission.TENANT_USER_VIEW,
+    Permission.TENANT_USER_UPDATE,
+    Permission.TENANT_USER_DISABLE,
+    Permission.TENANT_USER_ENABLE,
+    Permission.TENANT_USER_DELETE,
+    Permission.TENANT_USER_MFA_RESET,
+    Permission.TENANT_USER_PASSWORD_RESET,
+    Permission.TENANT_ROLE_CREATE,
+    Permission.TENANT_ROLE_LIST,
+    Permission.TENANT_ROLE_UPDATE,
+    Permission.TENANT_ROLE_DELETE,
+    Permission.TENANT_ROLE_VIEW,
+    Permission.TENANT_ROLE_ASSIGN,
+    Permission.TENANT_ROLE_REVOKE,
+    Permission.TENANT_SECURITY_POLICY_VIEW,
+    Permission.TENANT_SECURITY_POLICY_MANAGE,
+    Permission.TENANT_BRANDING_MANAGE,
+    Permission.TENANT_AUDIT_VIEW,
+    Permission.RETAIL_USER_CREATE,
+    Permission.RETAIL_USER_CREATE_LATERAL,
+    Permission.RETAIL_USER_READ,
+    Permission.RETAIL_USER_UPDATE,
+    Permission.RETAIL_USER_STATUS,
+    Permission.RETAIL_USER_DELETE,
+    Permission.RETAIL_USER_PASSWORD_RESET,
+    Permission.RETAIL_USER_MFA_RESET,
+    Permission.RETAIL_PRODUCT_CREATE,
+    Permission.RETAIL_PRODUCT_LIST,
+    Permission.RETAIL_PRODUCT_VIEW,
+    Permission.RETAIL_PRODUCT_UPDATE,
+    Permission.RETAIL_PRODUCT_DELETE,
+    Permission.RETAIL_PRODUCT_MDM_CONFIG,
+    Permission.RETAIL_INVENTORY_LIST,
+    Permission.RETAIL_INVENTORY_VIEW,
+    Permission.RETAIL_INVENTORY_UPDATE,
+    Permission.RETAIL_SALE_CREATE,
+    Permission.RETAIL_SALE_LIST,
+    Permission.RETAIL_SALE_CANCEL,
+    Permission.RETAIL_STORE_MANAGE,
+    Permission.RETAIL_RETAILER_MANAGE,
+    Permission.LEND_CREDIT_CREATE,
+    Permission.LEND_CREDIT_LIST,
+    Permission.LEND_CREDIT_VIEW,
+    Permission.LEND_CREDIT_UPDATE,
+    Permission.LEND_CREDIT_LIQUIDATE,
+    Permission.LEND_CREDIT_RESTRUCTURE,
+    Permission.LEND_PAYMENT_APPLY,
+    Permission.LEND_PAYMENT_LIST,
+    Permission.LEND_PAYMENT_REVERSE,
+    Permission.LEND_INSTALLMENT_VIEW,
+    Permission.MDM_DEVICE_ENROLL,
+    Permission.MDM_DEVICE_RELEASE,
+    Permission.MDM_DEVICE_ARCHIVE,
+    Permission.MDM_DEVICE_DEACTIVATE,
+    Permission.MDM_DEVICE_LOCK_MANUAL,
+    Permission.MDM_DEVICE_UNLOCK_MANUAL,
+    Permission.MDM_DEVICE_PIN_UNLOCK,
+    Permission.MDM_DEVICE_EXTEND_VALIDITY,
+    Permission.MDM_DEVICE_NOTIFY,
+    Permission.MDM_DEVICE_STATUS_VIEW,
+    Permission.MDM_OPERATION_LOG_VIEW,
+    Permission.MDM_TEST,
+    Permission.PAY_TRANSACTION_VIEW,
+];
+function djb2(input) {
+    let h = 5381;
+    for (let i = 0; i < input.length; i++)
+        h = ((h << 5) + h + input.charCodeAt(i)) >>> 0;
+    return h;
+}
+/** Versión del catálogo = hash del orden. Cambia solo si el orden cambia. */
+exports.PERMS_VERSION = djb2(exports.PERMISSION_BIT_ORDER.join('|'));
+const BIT_INDEX = new Map(exports.PERMISSION_BIT_ORDER.map((p, i) => [p, i]));
+/** Comprime un set de permisos a bitset base64url. */
+function permissionsToBits(perms) {
+    const bytes = new Uint8Array(Math.ceil(exports.PERMISSION_BIT_ORDER.length / 8));
+    for (const p of perms) {
+        const idx = BIT_INDEX.get(p);
+        if (idx === undefined)
+            continue;
+        bytes[idx >> 3] |= 1 << (idx & 7);
+    }
+    return Buffer.from(bytes).toString('base64url');
+}
+/** Decodifica un bitset base64url a la lista de permisos. Tolerante a basura → []. */
+function bitsToPermissions(bits) {
+    if (typeof bits !== 'string' || bits.length === 0)
+        return [];
+    let bytes;
+    try {
+        bytes = Buffer.from(bits, 'base64url');
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (let i = 0; i < exports.PERMISSION_BIT_ORDER.length; i++) {
+        const byte = bytes[i >> 3] ?? 0;
+        if (byte & (1 << (i & 7)))
+            out.push(exports.PERMISSION_BIT_ORDER[i]);
+    }
+    return out;
+}

package/bin/platformRbac/index.d.ts

@@ -1,9 +1,10 @@
-export { Permission } from './enums/Permission';
+export { Permission, PERMISSION_BIT_ORDER, PERMS_VERSION, permissionsToBits, bitsToPermissions, } from './enums/Permission';
 export { PermissionScope } from './enums/PermissionScope';
 export { PermissionCategory } from './enums/PermissionCategory';
 export type { AuthContext } from './dtos/AuthContext';
 export type { RoleAssignmentInfo } from './dtos/RoleAssignmentInfo';
 export type { PermissionMeta } from './dtos/PermissionMeta';
+export type { EffectivePermissionsResponse } from './dtos/EffectivePermissionsResponse';
 export * from './enums/MfaMethodEnum';
 export * from './enums/ChallengeNameEnum';
 export * from './auth/DefineNextChallengeRequest';

package/bin/platformRbac/index.js

@@ -5,9 +5,9 @@
 // del platform-rbac-business documenta la migración futura de los 4 símbolos cross-cutting
 // (Permission, PermissionScope, AuthContext, RoleAssignmentInfo) de aquí a `rbac/`.
 //
-// En Fase 1.A los DTOs propios del rbac-business (CreateTenantRequest, AssignRoleRequest,
-// EffectivePermissionsResponse, etc.) NO viven en este módulo todavía — se agregan en
-// Fase 1.B cuando los managers que los consumen se implementen.
+// Los DTOs propios del rbac-business se van agregando a medida que los flujos los necesitan.
+// EffectivePermissionsResponse ya vive acá (lo consume jwt-inyector vía /internal/effective-permissions).
+// Otros DTOs aún pendientes se sumarán cuando los managers que los consumen se implementen.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -23,9 +23,13 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.scopeRankOrder = exports.tableSuffixForLevel = exports.levelsOf = exports.TENANT_TYPES = exports.TenantType = exports.AuthorizeDenyReason = exports.PermissionCategory = exports.PermissionScope = exports.Permission = void 0;
+exports.scopeRankOrder = exports.tableSuffixForLevel = exports.levelsOf = exports.TENANT_TYPES = exports.TenantType = exports.AuthorizeDenyReason = exports.PermissionCategory = exports.PermissionScope = exports.bitsToPermissions = exports.permissionsToBits = exports.PERMS_VERSION = exports.PERMISSION_BIT_ORDER = exports.Permission = void 0;
 var Permission_1 = require("./enums/Permission");
 Object.defineProperty(exports, "Permission", { enumerable: true, get: function () { return Permission_1.Permission; } });
+Object.defineProperty(exports, "PERMISSION_BIT_ORDER", { enumerable: true, get: function () { return Permission_1.PERMISSION_BIT_ORDER; } });
+Object.defineProperty(exports, "PERMS_VERSION", { enumerable: true, get: function () { return Permission_1.PERMS_VERSION; } });
+Object.defineProperty(exports, "permissionsToBits", { enumerable: true, get: function () { return Permission_1.permissionsToBits; } });
+Object.defineProperty(exports, "bitsToPermissions", { enumerable: true, get: function () { return Permission_1.bitsToPermissions; } });
 var PermissionScope_1 = require("./enums/PermissionScope");
 Object.defineProperty(exports, "PermissionScope", { enumerable: true, get: function () { return PermissionScope_1.PermissionScope; } });
 var PermissionCategory_1 = require("./enums/PermissionCategory");

package/bin/twilioConnector/dtos/ConnectorSendMessageRequest.d.ts

@@ -0,0 +1,27 @@
+import { SelectedProvider } from './SelectedProvider';
+/**
+ * Contrato de entrada `messages-business → twilio-connector`.
+ *
+ * messages-business resuelve el proveedor (plantilla, remitente, `secretRef`)
+ * desde el `senderConfig` del `(tenant, channel)` y lo manda ya resuelto en
+ * `selectedProvider`. El connector NO resuelve plantillas ni elige proveedor:
+ * solo transmite a Twilio y resuelve el secret indicado por `secretRef`.
+ *
+ * NOTA: `channelType` es `string` (no el enum) a proposito: el connector es un
+ * transporte tonto y maneja canales como WHATSAPP que aun no estan en
+ * `DeliveryChannelEnum`. El alta de WHATSAPP en el enum aplica al lado *inbound*
+ * (productor → messages-business), no a este contrato. Ver docs/cross-team en
+ * messages-business.
+ */
+export declare class ConnectorSendMessageRequest {
+    /** Canal de entrega. Ej: "WHATSAPP", "SMS". */
+    channelType: string;
+    /** Numero destino en formato E.164. Ej: "+50212345678". */
+    destination: string;
+    /** Tipo de mensaje de dominio. Ej: "OTP_CODE". Solo para logging/trazabilidad. */
+    messageType?: string;
+    /** Idioma de la plantilla. Ej: "ES". Solo para logging/trazabilidad. */
+    language?: string;
+    /** Proveedor ya seleccionado y resuelto por messages-business. */
+    selectedProvider: SelectedProvider;
+}

package/bin/twilioConnector/dtos/ConnectorSendMessageRequest.js

@@ -0,0 +1,62 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectorSendMessageRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const SelectedProvider_1 = require("./SelectedProvider");
+/**
+ * Contrato de entrada `messages-business → twilio-connector`.
+ *
+ * messages-business resuelve el proveedor (plantilla, remitente, `secretRef`)
+ * desde el `senderConfig` del `(tenant, channel)` y lo manda ya resuelto en
+ * `selectedProvider`. El connector NO resuelve plantillas ni elige proveedor:
+ * solo transmite a Twilio y resuelve el secret indicado por `secretRef`.
+ *
+ * NOTA: `channelType` es `string` (no el enum) a proposito: el connector es un
+ * transporte tonto y maneja canales como WHATSAPP que aun no estan en
+ * `DeliveryChannelEnum`. El alta de WHATSAPP en el enum aplica al lado *inbound*
+ * (productor → messages-business), no a este contrato. Ver docs/cross-team en
+ * messages-business.
+ */
+class ConnectorSendMessageRequest {
+}
+exports.ConnectorSendMessageRequest = ConnectorSendMessageRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ConnectorSendMessageRequest.prototype, "channelType", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ConnectorSendMessageRequest.prototype, "destination", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConnectorSendMessageRequest.prototype, "messageType", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConnectorSendMessageRequest.prototype, "language", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => SelectedProvider_1.SelectedProvider),
+    __metadata("design:type", SelectedProvider_1.SelectedProvider)
+], ConnectorSendMessageRequest.prototype, "selectedProvider", void 0);

package/bin/twilioConnector/dtos/ConnectorSendMessageResponse.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Respuesta del twilio-connector tras delegar el envio a Twilio.
+ */
+export declare class ConnectorSendMessageResponse {
+    /** SID del mensaje generado por Twilio. */
+    providerMessageId: string;
+    /** Estado reportado por Twilio al momento del envio (queued, sent, ...). */
+    status: string;
+}

package/bin/twilioConnector/dtos/ConnectorSendMessageResponse.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectorSendMessageResponse = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Respuesta del twilio-connector tras delegar el envio a Twilio.
+ */
+class ConnectorSendMessageResponse {
+}
+exports.ConnectorSendMessageResponse = ConnectorSendMessageResponse;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConnectorSendMessageResponse.prototype, "providerMessageId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConnectorSendMessageResponse.prototype, "status", void 0);

package/bin/twilioConnector/dtos/SelectedProvider.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Proveedor ya resuelto por messages-business desde el `senderConfig` del
+ * `(tenant, channel)`. El twilio-connector es transporte tonto: solo transmite
+ * estos valores a Twilio. Los nombres son genericos para no acoplar el contrato
+ * al vocabulario del proveedor.
+ */
+export declare class SelectedProvider {
+    /** Plantilla del proveedor ya resuelta. Para Twilio se traduce a `contentSid` (HX...). */
+    templateId: string;
+    /** Remitente ya resuelto. Para Twilio = Messaging Service SID (MG...) o numero `from`. */
+    senderId: string;
+    /** Variables de la plantilla ya resueltas, keyeadas por slot posicional. Ej: { "1": "1234" }. */
+    contentVariables?: Record<string, string>;
+    /**
+     * Referencia (nombre/ARN) al secret de Secrets Manager con las credenciales
+     * de la cuenta de Twilio de este `(tenant, channel)`. Ej: "twilio/FIADO/credentials".
+     * El connector resuelve el secret real con esta referencia justo antes de enviar.
+     * Opcional: si se omite, el connector usa su secret por defecto (TWILIO_SECRET_NAME).
+     */
+    secretRef?: string;
+}

package/bin/twilioConnector/dtos/SelectedProvider.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelectedProvider = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Proveedor ya resuelto por messages-business desde el `senderConfig` del
+ * `(tenant, channel)`. El twilio-connector es transporte tonto: solo transmite
+ * estos valores a Twilio. Los nombres son genericos para no acoplar el contrato
+ * al vocabulario del proveedor.
+ */
+class SelectedProvider {
+}
+exports.SelectedProvider = SelectedProvider;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelectedProvider.prototype, "templateId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelectedProvider.prototype, "senderId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], SelectedProvider.prototype, "contentVariables", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], SelectedProvider.prototype, "secretRef", void 0);

package/bin/twilioConnector/index.d.ts

@@ -0,0 +1,3 @@
+export * from './dtos/SelectedProvider';
+export * from './dtos/ConnectorSendMessageRequest';
+export * from './dtos/ConnectorSendMessageResponse';

package/bin/twilioConnector/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./dtos/SelectedProvider"), exports);
+__exportStar(require("./dtos/ConnectorSendMessageRequest"), exports);
+__exportStar(require("./dtos/ConnectorSendMessageResponse"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.69.0",
+  "version": "3.71.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/cognitoBackofficeConnector/dtos/CreateUserRequest.ts

@@ -2,8 +2,11 @@ import { Expose } from 'class-transformer';
 import { IsBoolean, IsEmail, IsNotEmpty, IsOptional, IsString } from 'class-validator';
 
 export class CreateUserRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
+    // userPoolId + region son OPCIONALES: el alta de usuario PLATFORM ya no los manda desde el front
+    // (el backend platform-rbac-business los resuelve de la config del tenant 'platform'). Se conservan
+    // en el DTO porque los demás callers del connector SÍ los proveen.
+    @Expose() @IsOptional() @IsString() userPoolId?: string;
+    @Expose() @IsOptional() @IsString() region?: string;
     @Expose() @IsEmail() email!: string;
     @Expose() @IsOptional() @IsString() displayName?: string;
     @Expose() @IsString() @IsNotEmpty() tenantId!: string;

package/src/index.ts

@@ -74,6 +74,7 @@ export * as CirculoCredito from './circuloCredito';
 export * as MilestoneBusiness from './milestone-business';
 export * as Mdm from './mdm';
 export * as MessagesConnector from './messagesConnector';
+export * as TwilioConnector from './twilioConnector';
 export * as CognitoBackofficeConnector from './cognitoBackofficeConnector';
 // PlatformRbac: módulo del lambda platform-rbac-business (Fase 0 SureKeep).
 // Contiene Permission enum + AuthContext + RoleAssignmentInfo + PermissionScope +

package/src/milestone-business/dtos/Milestone.ts

@@ -0,0 +1,24 @@
+/**
+ * Forma completa de un Milestone tal como lo persiste y devuelve el lambda
+ * `milestone-business`. Es la representación canónica del item de la tabla DDB
+ * `Milestones` expuesta a consumers server-to-server (api-invoker).
+ *
+ * `value` es metadata libre asociada al evento (objeto de forma variable).
+ * `createdAt` / `updatedAt` son epoch ms (Dynamoose `timestamps: true`).
+ */
+export interface Milestone {
+    /** Identificador único del milestone. Determinístico: `${directoryId}#${eventKey}`. */
+    id: string;
+    /** directoryId del usuario al que pertenece el evento. */
+    directoryId: string;
+    /** Fecha en la que ocurrió el evento (epoch en milisegundos). */
+    eventDate: number;
+    /** Llave que identifica el tipo de evento/milestone. */
+    eventKey: string;
+    /** Metadata libre asociada al milestone (objeto con forma variable). */
+    value?: Record<string, unknown>;
+    /** Epoch ms de creación (Dynamoose timestamps). */
+    createdAt?: number;
+    /** Epoch ms de última actualización (Dynamoose timestamps). */
+    updatedAt?: number;
+}

package/src/milestone-business/dtos/MilestonesByDirectoryIdsRequest.ts

@@ -0,0 +1,26 @@
+import { ArrayMaxSize, ArrayNotEmpty, IsArray, IsString } from "class-validator";
+
+/**
+ * Cota máxima de directoryIds aceptados por request en el endpoint batch
+ * `privateListMilestonesByDirectoryIds`. Protege contra fan-out excesivo
+ * (cada directoryId dispara un query GSI con drenado de paginación).
+ */
+export const MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH = 100;
+
+/**
+ * Body de `POST /private/milestones/by-directory-ids`.
+ *
+ * Recibe una lista de directoryIds y devuelve, por cada uno, el array COMPLETO
+ * de milestones (paginación drenada del lado del lambda). Se usa POST en lugar
+ * de GET porque la lista puede ser larga y no cabe cómoda en query string.
+ *
+ * La cota de tamaño (`MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH`) se valida también
+ * en el manager para responder 400 explícito si se excede.
+ */
+export class MilestonesByDirectoryIdsRequest {
+    @IsArray()
+    @ArrayNotEmpty()
+    @ArrayMaxSize(MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH)
+    @IsString({ each: true })
+    directoryIds!: string[];
+}

package/src/milestone-business/dtos/MilestonesByDirectoryIdsResponse.ts

@@ -0,0 +1,11 @@
+import { Milestone } from "./Milestone";
+
+/**
+ * Respuesta de `POST /private/milestones/by-directory-ids`.
+ *
+ * Mapa directoryId -> array COMPLETO de milestones de ese directorio.
+ * Cada directoryId solicitado aparece como clave; si un directorio no tiene
+ * milestones, su valor es un array vacío `[]` (la clave NO se omite, para que
+ * el consumer pueda distinguir "consultado, sin milestones" de "no consultado").
+ */
+export type MilestonesByDirectoryIdsResponse = Record<string, Milestone[]>;

package/src/milestone-business/index.ts

@@ -1,2 +1,8 @@
 // dtos
 export { MilestonesByEventKeyDateRangeParams } from "./dtos/MilestonesByEventKeyDateRangeParams";
+export { Milestone } from "./dtos/Milestone";
+export {
+    MilestonesByDirectoryIdsRequest,
+    MILESTONES_BY_DIRECTORY_IDS_MAX_BATCH,
+} from "./dtos/MilestonesByDirectoryIdsRequest";
+export { MilestonesByDirectoryIdsResponse } from "./dtos/MilestonesByDirectoryIdsResponse";

package/src/platformRbac/dtos/AuthContext.ts

@@ -19,4 +19,10 @@ export interface AuthContext {
     permissions: Permission[];
     resolvedAt: string;
     issuer?: string;
+    /** Bitset base64url de permisos efectivos (token-as-cache). Ausente → fallback al resolver/claim. */
+    permBits?: string;
+    /** Versión del catálogo (PERMS_VERSION) con la que se construyó permBits. */
+    permVer?: number;
+    /** Epoch de permisos del tenant al momento de emitir el token. */
+    permsEpoch?: number;
 }

package/src/platformRbac/dtos/EffectivePermissionsResponse.ts

@@ -0,0 +1,9 @@
+import type { Permission } from '../enums/Permission';
+import type { RoleAssignmentInfo } from './RoleAssignmentInfo';
+
+/** Respuesta de platform-rbac-business /internal/effective-permissions (consumida por jwt-inyector). */
+export interface EffectivePermissionsResponse {
+    permissions: Permission[];
+    roleAssignments: RoleAssignmentInfo[];
+    permsEpoch: number;
+}

package/src/platformRbac/enums/Permission.ts

@@ -137,3 +137,139 @@ export enum Permission {
     // ====================================================
     PAY_TRANSACTION_VIEW = 'pay.transaction.view',
 }
+
+/**
+ * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.
+ * Índice de cada permiso = su posición de bit. NUNCA reordenar ni borrar:
+ * deprecados CONSERVAN su posición; los nuevos van SIEMPRE al final.
+ * Derivado explícitamente (no Object.values, frágil ante edición del enum).
+ */
+export const PERMISSION_BIT_ORDER: readonly Permission[] = [
+    Permission.RBAC_CATALOG_MANAGE,
+    Permission.PLATFORM_TENANT_CREATE,
+    Permission.PLATFORM_TENANT_LIST,
+    Permission.PLATFORM_TENANT_VIEW,
+    Permission.PLATFORM_TENANT_UPDATE,
+    Permission.PLATFORM_TENANT_SUSPEND,
+    Permission.PLATFORM_TENANT_ACTIVATE,
+    Permission.PLATFORM_TENANT_ADMIN_REPLACE,
+    Permission.PLATFORM_COGNITO_POOL_MANAGE,
+    Permission.PLATFORM_COGNITO_POOL_LIST,
+    Permission.PLATFORM_USER_CREATE,
+    Permission.PLATFORM_USER_LIST,
+    Permission.PLATFORM_USER_VIEW,
+    Permission.PLATFORM_USER_UPDATE,
+    Permission.PLATFORM_USER_DISABLE,
+    Permission.PLATFORM_USER_ENABLE,
+    Permission.PLATFORM_USER_DELETE,
+    Permission.PLATFORM_ROLE_CREATE,
+    Permission.PLATFORM_ROLE_LIST,
+    Permission.PLATFORM_ROLE_UPDATE,
+    Permission.PLATFORM_ROLE_DELETE,
+    Permission.PLATFORM_AUDIT_VIEW,
+    Permission.TENANT_USER_CREATE,
+    Permission.TENANT_USER_CREATE_LATERAL,
+    Permission.TENANT_USER_READ,
+    Permission.TENANT_USER_STATUS,
+    Permission.TENANT_USER_LIST,
+    Permission.TENANT_USER_VIEW,
+    Permission.TENANT_USER_UPDATE,
+    Permission.TENANT_USER_DISABLE,
+    Permission.TENANT_USER_ENABLE,
+    Permission.TENANT_USER_DELETE,
+    Permission.TENANT_USER_MFA_RESET,
+    Permission.TENANT_USER_PASSWORD_RESET,
+    Permission.TENANT_ROLE_CREATE,
+    Permission.TENANT_ROLE_LIST,
+    Permission.TENANT_ROLE_UPDATE,
+    Permission.TENANT_ROLE_DELETE,
+    Permission.TENANT_ROLE_VIEW,
+    Permission.TENANT_ROLE_ASSIGN,
+    Permission.TENANT_ROLE_REVOKE,
+    Permission.TENANT_SECURITY_POLICY_VIEW,
+    Permission.TENANT_SECURITY_POLICY_MANAGE,
+    Permission.TENANT_BRANDING_MANAGE,
+    Permission.TENANT_AUDIT_VIEW,
+    Permission.RETAIL_USER_CREATE,
+    Permission.RETAIL_USER_CREATE_LATERAL,
+    Permission.RETAIL_USER_READ,
+    Permission.RETAIL_USER_UPDATE,
+    Permission.RETAIL_USER_STATUS,
+    Permission.RETAIL_USER_DELETE,
+    Permission.RETAIL_USER_PASSWORD_RESET,
+    Permission.RETAIL_USER_MFA_RESET,
+    Permission.RETAIL_PRODUCT_CREATE,
+    Permission.RETAIL_PRODUCT_LIST,
+    Permission.RETAIL_PRODUCT_VIEW,
+    Permission.RETAIL_PRODUCT_UPDATE,
+    Permission.RETAIL_PRODUCT_DELETE,
+    Permission.RETAIL_PRODUCT_MDM_CONFIG,
+    Permission.RETAIL_INVENTORY_LIST,
+    Permission.RETAIL_INVENTORY_VIEW,
+    Permission.RETAIL_INVENTORY_UPDATE,
+    Permission.RETAIL_SALE_CREATE,
+    Permission.RETAIL_SALE_LIST,
+    Permission.RETAIL_SALE_CANCEL,
+    Permission.RETAIL_STORE_MANAGE,
+    Permission.RETAIL_RETAILER_MANAGE,
+    Permission.LEND_CREDIT_CREATE,
+    Permission.LEND_CREDIT_LIST,
+    Permission.LEND_CREDIT_VIEW,
+    Permission.LEND_CREDIT_UPDATE,
+    Permission.LEND_CREDIT_LIQUIDATE,
+    Permission.LEND_CREDIT_RESTRUCTURE,
+    Permission.LEND_PAYMENT_APPLY,
+    Permission.LEND_PAYMENT_LIST,
+    Permission.LEND_PAYMENT_REVERSE,
+    Permission.LEND_INSTALLMENT_VIEW,
+    Permission.MDM_DEVICE_ENROLL,
+    Permission.MDM_DEVICE_RELEASE,
+    Permission.MDM_DEVICE_ARCHIVE,
+    Permission.MDM_DEVICE_DEACTIVATE,
+    Permission.MDM_DEVICE_LOCK_MANUAL,
+    Permission.MDM_DEVICE_UNLOCK_MANUAL,
+    Permission.MDM_DEVICE_PIN_UNLOCK,
+    Permission.MDM_DEVICE_EXTEND_VALIDITY,
+    Permission.MDM_DEVICE_NOTIFY,
+    Permission.MDM_DEVICE_STATUS_VIEW,
+    Permission.MDM_OPERATION_LOG_VIEW,
+    Permission.MDM_TEST,
+    Permission.PAY_TRANSACTION_VIEW,
+] as const;
+
+function djb2(input: string): number {
+    let h = 5381;
+    for (let i = 0; i < input.length; i++) h = ((h << 5) + h + input.charCodeAt(i)) >>> 0;
+    return h;
+}
+/** Versión del catálogo = hash del orden. Cambia solo si el orden cambia. */
+export const PERMS_VERSION: number = djb2(PERMISSION_BIT_ORDER.join('|'));
+
+const BIT_INDEX: ReadonlyMap<Permission, number> = new Map(PERMISSION_BIT_ORDER.map((p, i) => [p, i]));
+
+/** Comprime un set de permisos a bitset base64url. */
+export function permissionsToBits(perms: readonly Permission[]): string {
+    const bytes = new Uint8Array(Math.ceil(PERMISSION_BIT_ORDER.length / 8));
+    for (const p of perms) {
+        const idx = BIT_INDEX.get(p);
+        if (idx === undefined) continue;
+        bytes[idx >> 3] |= 1 << (idx & 7);
+    }
+    return Buffer.from(bytes).toString('base64url');
+}
+/** Decodifica un bitset base64url a la lista de permisos. Tolerante a basura → []. */
+export function bitsToPermissions(bits: string): Permission[] {
+    if (typeof bits !== 'string' || bits.length === 0) return [];
+    let bytes: Buffer;
+    try {
+        bytes = Buffer.from(bits, 'base64url');
+    } catch {
+        return [];
+    }
+    const out: Permission[] = [];
+    for (let i = 0; i < PERMISSION_BIT_ORDER.length; i++) {
+        const byte = bytes[i >> 3] ?? 0;
+        if (byte & (1 << (i & 7))) out.push(PERMISSION_BIT_ORDER[i]);
+    }
+    return out;
+}

package/src/platformRbac/index.ts

@@ -4,17 +4,24 @@
 // del platform-rbac-business documenta la migración futura de los 4 símbolos cross-cutting
 // (Permission, PermissionScope, AuthContext, RoleAssignmentInfo) de aquí a `rbac/`.
 //
-// En Fase 1.A los DTOs propios del rbac-business (CreateTenantRequest, AssignRoleRequest,
-// EffectivePermissionsResponse, etc.) NO viven en este módulo todavía — se agregan en
-// Fase 1.B cuando los managers que los consumen se implementen.
+// Los DTOs propios del rbac-business se van agregando a medida que los flujos los necesitan.
+// EffectivePermissionsResponse ya vive acá (lo consume jwt-inyector vía /internal/effective-permissions).
+// Otros DTOs aún pendientes se sumarán cuando los managers que los consumen se implementen.
 
-export { Permission } from './enums/Permission';
+export {
+    Permission,
+    PERMISSION_BIT_ORDER,
+    PERMS_VERSION,
+    permissionsToBits,
+    bitsToPermissions,
+} from './enums/Permission';
 export { PermissionScope } from './enums/PermissionScope';
 export { PermissionCategory } from './enums/PermissionCategory';
 
 export type { AuthContext } from './dtos/AuthContext';
 export type { RoleAssignmentInfo } from './dtos/RoleAssignmentInfo';
 export type { PermissionMeta } from './dtos/PermissionMeta';
+export type { EffectivePermissionsResponse } from './dtos/EffectivePermissionsResponse';
 
 // Fase 1 — Custom Auth Challenge (Email OTP + TOTP) + MFA self-service.
 // Class values (no type-only) — los DTOs llevan decoradores class-validator y se hidratan con plainToInstance en runtime.

package/src/twilioConnector/dtos/ConnectorSendMessageRequest.ts

@@ -0,0 +1,34 @@
+import { Expose, Type } from 'class-transformer';
+import { IsNotEmpty, IsOptional, IsString, ValidateNested } from 'class-validator';
+import { SelectedProvider } from './SelectedProvider';
+
+/**
+ * Contrato de entrada `messages-business → twilio-connector`.
+ *
+ * messages-business resuelve el proveedor (plantilla, remitente, `secretRef`)
+ * desde el `senderConfig` del `(tenant, channel)` y lo manda ya resuelto en
+ * `selectedProvider`. El connector NO resuelve plantillas ni elige proveedor:
+ * solo transmite a Twilio y resuelve el secret indicado por `secretRef`.
+ *
+ * NOTA: `channelType` es `string` (no el enum) a proposito: el connector es un
+ * transporte tonto y maneja canales como WHATSAPP que aun no estan en
+ * `DeliveryChannelEnum`. El alta de WHATSAPP en el enum aplica al lado *inbound*
+ * (productor → messages-business), no a este contrato. Ver docs/cross-team en
+ * messages-business.
+ */
+export class ConnectorSendMessageRequest {
+    /** Canal de entrega. Ej: "WHATSAPP", "SMS". */
+    @Expose() @IsString() @IsNotEmpty() channelType!: string;
+
+    /** Numero destino en formato E.164. Ej: "+50212345678". */
+    @Expose() @IsString() @IsNotEmpty() destination!: string;
+
+    /** Tipo de mensaje de dominio. Ej: "OTP_CODE". Solo para logging/trazabilidad. */
+    @Expose() @IsOptional() @IsString() messageType?: string;
+
+    /** Idioma de la plantilla. Ej: "ES". Solo para logging/trazabilidad. */
+    @Expose() @IsOptional() @IsString() language?: string;
+
+    /** Proveedor ya seleccionado y resuelto por messages-business. */
+    @Expose() @ValidateNested() @Type(() => SelectedProvider) selectedProvider!: SelectedProvider;
+}

package/src/twilioConnector/dtos/ConnectorSendMessageResponse.ts

@@ -0,0 +1,13 @@
+import { Expose } from 'class-transformer';
+import { IsString } from 'class-validator';
+
+/**
+ * Respuesta del twilio-connector tras delegar el envio a Twilio.
+ */
+export class ConnectorSendMessageResponse {
+    /** SID del mensaje generado por Twilio. */
+    @Expose() @IsString() providerMessageId!: string;
+
+    /** Estado reportado por Twilio al momento del envio (queued, sent, ...). */
+    @Expose() @IsString() status!: string;
+}

package/src/twilioConnector/dtos/SelectedProvider.ts

@@ -0,0 +1,27 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsObject, IsOptional, IsString } from 'class-validator';
+
+/**
+ * Proveedor ya resuelto por messages-business desde el `senderConfig` del
+ * `(tenant, channel)`. El twilio-connector es transporte tonto: solo transmite
+ * estos valores a Twilio. Los nombres son genericos para no acoplar el contrato
+ * al vocabulario del proveedor.
+ */
+export class SelectedProvider {
+    /** Plantilla del proveedor ya resuelta. Para Twilio se traduce a `contentSid` (HX...). */
+    @Expose() @IsString() @IsNotEmpty() templateId!: string;
+
+    /** Remitente ya resuelto. Para Twilio = Messaging Service SID (MG...) o numero `from`. */
+    @Expose() @IsString() @IsNotEmpty() senderId!: string;
+
+    /** Variables de la plantilla ya resueltas, keyeadas por slot posicional. Ej: { "1": "1234" }. */
+    @Expose() @IsOptional() @IsObject() contentVariables?: Record<string, string>;
+
+    /**
+     * Referencia (nombre/ARN) al secret de Secrets Manager con las credenciales
+     * de la cuenta de Twilio de este `(tenant, channel)`. Ej: "twilio/FIADO/credentials".
+     * El connector resuelve el secret real con esta referencia justo antes de enviar.
+     * Opcional: si se omite, el connector usa su secret por defecto (TWILIO_SECRET_NAME).
+     */
+    @Expose() @IsOptional() @IsString() secretRef?: string;
+}

package/src/twilioConnector/index.ts

@@ -0,0 +1,3 @@
+export * from './dtos/SelectedProvider';
+export * from './dtos/ConnectorSendMessageRequest';
+export * from './dtos/ConnectorSendMessageResponse';