@fiado/type-kit 3.73.0 → 3.75.0

package/_test_/unit/platformRbac/dtos/CreateTenantRequest.test.ts

@@ -2,6 +2,7 @@ import 'reflect-metadata';
 import { plainToInstance } from 'class-transformer';
 import { validate } from 'class-validator';
 import { CreateTenantRequest } from '../../../../src/platformRbac/dtos/CreateTenantRequest';
+import { TenantType } from '../../../../src/platformRbac/tenantTypes';
 
 describe('CreateTenantRequest', () => {
     const valid = {
@@ -53,6 +54,19 @@ describe('CreateTenantRequest', () => {
         expect(errors.some(e => e.property === 'passwordMinLength')).toBe(true);
     });
 
+    it('valida con tenantType opcional = agents', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 'agents' });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+        expect(dto.tenantType).toBe(TenantType.AGENTS);
+    });
+
+    it('falla si tenantType no es un TenantType válido', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 'inexistente' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'tenantType')).toBe(true);
+    });
+
     it('NO expone temporaryPassword en el request (campo del response, no del body)', () => {
         // El request NO debe llevar temporaryPassword (es solo del response, fallback out-of-band F-11).
         // Con excludeExtraneousValues solo sobreviven las props @Expose() del DTO → el contrato lo excluye.

package/_test_/unit/platformRbac/tenantTypes.test.ts

@@ -1,4 +1,4 @@
-import { TenantType, levelsOf, tableSuffixForLevel, scopeRankOrder } from '../../../src/platformRbac/tenantTypes';
+import { TenantType, TENANT_TYPES, levelsOf, tableSuffixForLevel, scopeRankOrder } from '../../../src/platformRbac/tenantTypes';
 import { PermissionScope } from '../../../src/platformRbac/enums/PermissionScope';
 
 describe('tenantTypes', () => {
@@ -6,12 +6,13 @@ describe('tenantTypes', () => {
         expect(levelsOf(TenantType.RETAIL)).toEqual([PermissionScope.RETAILER, PermissionScope.STORE]);
     });
 
-    it('scopeRankOrder = [PLATFORM, TENANT, RETAILER, STORE] (retail único tipo hoy)', () => {
+    it('scopeRankOrder = [PLATFORM, TENANT, RETAILER, STORE, GROUP] (retail + agents)', () => {
         expect(scopeRankOrder()).toEqual([
             PermissionScope.PLATFORM,
             PermissionScope.TENANT,
             PermissionScope.RETAILER,
             PermissionScope.STORE,
+            PermissionScope.GROUP,
         ]);
     });
 
@@ -29,4 +30,23 @@ describe('tenantTypes', () => {
         const order = scopeRankOrder();
         expect(new Set(order).size).toBe(order.length);
     });
+
+    it('agents define un único nivel GROUP debajo de TENANT', () => {
+        expect(levelsOf(TenantType.AGENTS)).toEqual([PermissionScope.GROUP]);
+    });
+
+    it('agents mapea GROUP a su sufijo de tabla SharedGroup', () => {
+        expect(TENANT_TYPES[TenantType.AGENTS].tableSuffix).toEqual({ [PermissionScope.GROUP]: 'SharedGroup' });
+        expect(tableSuffixForLevel(TenantType.AGENTS, PermissionScope.GROUP)).toBe('SharedGroup');
+    });
+
+    it('scopeRankOrder incluye GROUP al final (vía los levels de agents, después de los de retail)', () => {
+        expect(scopeRankOrder()).toEqual([
+            PermissionScope.PLATFORM,
+            PermissionScope.TENANT,
+            PermissionScope.RETAILER,
+            PermissionScope.STORE,
+            PermissionScope.GROUP,
+        ]);
+    });
 });

package/bin/platformRbac/dtos/CreateTenantRequest.d.ts

@@ -1,4 +1,5 @@
 import { TokenValidationMode } from '../enums/TokenValidationMode';
+import { TenantType } from '../tenantTypes';
 /**
  * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
  * Consumido por el controller `backofficeCreateTenant` del platform-rbac-business y, a futuro,
@@ -16,4 +17,6 @@ export declare class CreateTenantRequest {
     mfaRequired?: boolean;
     passwordMinLength?: number;
     tokenValidationMode?: TokenValidationMode;
+    /** Tipo de tenant a crear. Si se omite, el onboarding aplica su default (hoy: retail). */
+    tenantType?: TenantType;
 }

package/bin/platformRbac/dtos/CreateTenantRequest.js

@@ -13,6 +13,7 @@ exports.CreateTenantRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
 const TokenValidationMode_1 = require("../enums/TokenValidationMode");
+const tenantTypes_1 = require("../tenantTypes");
 /**
  * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
  * Consumido por el controller `backofficeCreateTenant` del platform-rbac-business y, a futuro,
@@ -73,3 +74,9 @@ __decorate([
     (0, class_validator_1.IsEnum)(TokenValidationMode_1.TokenValidationMode),
     __metadata("design:type", String)
 ], CreateTenantRequest.prototype, "tokenValidationMode", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(tenantTypes_1.TenantType),
+    __metadata("design:type", String)
+], CreateTenantRequest.prototype, "tenantType", void 0);

package/bin/platformRbac/enums/PermissionScope.d.ts

@@ -1,10 +1,12 @@
 /**
- * Jerarquía: PLATFORM > TENANT > RETAILER > STORE.
- * Componente 01 spec — copia exacta.
+ * Jerarquía retail: PLATFORM > TENANT > RETAILER > STORE.
+ * Jerarquía agents: PLATFORM > TENANT > GROUP.
+ * Componente 01 spec.
  */
 export declare enum PermissionScope {
     PLATFORM = "PLATFORM",
     TENANT = "TENANT",
     RETAILER = "RETAILER",
-    STORE = "STORE"
+    STORE = "STORE",
+    GROUP = "GROUP"
 }

package/bin/platformRbac/enums/PermissionScope.js

@@ -2,8 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PermissionScope = void 0;
 /**
- * Jerarquía: PLATFORM > TENANT > RETAILER > STORE.
- * Componente 01 spec — copia exacta.
+ * Jerarquía retail: PLATFORM > TENANT > RETAILER > STORE.
+ * Jerarquía agents: PLATFORM > TENANT > GROUP.
+ * Componente 01 spec.
  */
 var PermissionScope;
 (function (PermissionScope) {
@@ -11,4 +12,5 @@ var PermissionScope;
     PermissionScope["TENANT"] = "TENANT";
     PermissionScope["RETAILER"] = "RETAILER";
     PermissionScope["STORE"] = "STORE";
+    PermissionScope["GROUP"] = "GROUP";
 })(PermissionScope || (exports.PermissionScope = PermissionScope = {}));

package/bin/platformRbac/tenantTypes.d.ts

@@ -4,7 +4,8 @@ import { PermissionScope } from './enums/PermissionScope';
  * jerarquía de niveles DEBAJO de TENANT (data-driven). Hoy solo existe `retail`.
  */
 export declare enum TenantType {
-    RETAIL = "retail"
+    RETAIL = "retail",
+    AGENTS = "agents"
 }
 interface TenantTypeDef {
     displayName: string;

package/bin/platformRbac/tenantTypes.js

@@ -12,6 +12,7 @@ const PermissionScope_1 = require("./enums/PermissionScope");
 var TenantType;
 (function (TenantType) {
     TenantType["RETAIL"] = "retail";
+    TenantType["AGENTS"] = "agents";
 })(TenantType || (exports.TenantType = TenantType = {}));
 exports.TENANT_TYPES = {
     [TenantType.RETAIL]: {
@@ -22,6 +23,12 @@ exports.TENANT_TYPES = {
             [PermissionScope_1.PermissionScope.STORE]: 'SharedStore',
         },
     },
+    // Fiado Agents — un único nivel GROUP debajo de TENANT.
+    [TenantType.AGENTS]: {
+        displayName: 'Agents',
+        levels: [PermissionScope_1.PermissionScope.GROUP],
+        tableSuffix: { [PermissionScope_1.PermissionScope.GROUP]: 'SharedGroup' },
+    },
 };
 function levelsOf(type) {
     return exports.TENANT_TYPES[type].levels;

package/bin/riskProfile/dtos/private/ClientFinancialHistoryResponse.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Item del historial financiero del perfil (tabla `ClientFinancialHistory_GT`).
+ * Shape que consume el Dashboard para reconstruir la timeline del perfil.
+ */
+export declare class ClientFinancialHistoryResponse {
+    directoryId: string;
+    sk: string;
+    eventId: string;
+    eventType: string;
+    field: string;
+    before?: number | null;
+    after?: number | null;
+    triggeredBy: string;
+    createdBy: string;
+    updatedBy?: string;
+    reason?: string;
+    tenantId: string;
+    createdAt: number;
+}

package/bin/riskProfile/dtos/private/ClientFinancialHistoryResponse.js

@@ -0,0 +1,72 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientFinancialHistoryResponse = void 0;
+const class_transformer_1 = require("class-transformer");
+/**
+ * Item del historial financiero del perfil (tabla `ClientFinancialHistory_GT`).
+ * Shape que consume el Dashboard para reconstruir la timeline del perfil.
+ */
+class ClientFinancialHistoryResponse {
+}
+exports.ClientFinancialHistoryResponse = ClientFinancialHistoryResponse;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "directoryId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "sk", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "eventId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "eventType", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "field", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", Number)
+], ClientFinancialHistoryResponse.prototype, "before", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", Number)
+], ClientFinancialHistoryResponse.prototype, "after", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "triggeredBy", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "createdBy", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "updatedBy", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "reason", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ClientFinancialHistoryResponse.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", Number)
+], ClientFinancialHistoryResponse.prototype, "createdAt", void 0);

package/bin/riskProfile/dtos/private/CreateClientFinancialHistoryRequest.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Request para registrar un cambio en el historial financiero del perfil
+ * (tabla `ClientFinancialHistory_GT`). Audit log append-only — BO-03,
+ * Manual de Cumplimiento sec. 8.25 / Art. 24 (retención 10 años).
+ *
+ * El caller manda SOLO el cambio de negocio. El servidor deriva los campos
+ * meta/audit (`sk`, `eventId`, `eventType`, `triggeredBy`, `createdAt`), de
+ * modo que nadie pueda falsificar el timestamp ni el origen.
+ */
+export declare class CreateClientFinancialHistoryRequest {
+    directoryId: string;
+    field: string;
+    before?: number | null;
+    after: number | null;
+    email: string;
+    tenantId: string;
+    reason?: string;
+}

package/bin/riskProfile/dtos/private/CreateClientFinancialHistoryRequest.js

@@ -0,0 +1,67 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateClientFinancialHistoryRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Request para registrar un cambio en el historial financiero del perfil
+ * (tabla `ClientFinancialHistory_GT`). Audit log append-only — BO-03,
+ * Manual de Cumplimiento sec. 8.25 / Art. 24 (retención 10 años).
+ *
+ * El caller manda SOLO el cambio de negocio. El servidor deriva los campos
+ * meta/audit (`sk`, `eventId`, `eventType`, `triggeredBy`, `createdAt`), de
+ * modo que nadie pueda falsificar el timestamp ni el origen.
+ */
+class CreateClientFinancialHistoryRequest {
+}
+exports.CreateClientFinancialHistoryRequest = CreateClientFinancialHistoryRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateClientFinancialHistoryRequest.prototype, "directoryId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsIn)(["declaredMonthlyIncome", "manualRiskLevel", "customHighAmount", "customMonthlyIncrease"]),
+    __metadata("design:type", String)
+], CreateClientFinancialHistoryRequest.prototype, "field", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsNumber)(),
+    __metadata("design:type", Number)
+], CreateClientFinancialHistoryRequest.prototype, "before", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.ValidateIf)((o) => o.after !== null),
+    (0, class_validator_1.IsNumber)(),
+    __metadata("design:type", Number)
+], CreateClientFinancialHistoryRequest.prototype, "after", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)({}, { message: "email debe ser un correo válido" }),
+    __metadata("design:type", String)
+], CreateClientFinancialHistoryRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsIn)(["PAGOCONFIADO", "FIADOSA"]),
+    __metadata("design:type", String)
+], CreateClientFinancialHistoryRequest.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", String)
+], CreateClientFinancialHistoryRequest.prototype, "reason", void 0);

package/bin/riskProfile/dtos/private/ListClientFinancialHistoryResponse.d.ts

@@ -0,0 +1,9 @@
+import { ClientFinancialHistoryResponse } from "./ClientFinancialHistoryResponse";
+/**
+ * Respuesta paginada del listado por `directoryId`. `continuationToken` es el
+ * base64 del `ExclusiveStartKey` de DynamoDB; `null` cuando no hay más páginas.
+ */
+export declare class ListClientFinancialHistoryResponse {
+    items: ClientFinancialHistoryResponse[];
+    continuationToken?: string | null;
+}

package/bin/riskProfile/dtos/private/ListClientFinancialHistoryResponse.js

@@ -0,0 +1,28 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ListClientFinancialHistoryResponse = void 0;
+const class_transformer_1 = require("class-transformer");
+/**
+ * Respuesta paginada del listado por `directoryId`. `continuationToken` es el
+ * base64 del `ExclusiveStartKey` de DynamoDB; `null` cuando no hay más páginas.
+ */
+class ListClientFinancialHistoryResponse {
+}
+exports.ListClientFinancialHistoryResponse = ListClientFinancialHistoryResponse;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", Array)
+], ListClientFinancialHistoryResponse.prototype, "items", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ListClientFinancialHistoryResponse.prototype, "continuationToken", void 0);

package/bin/riskProfile/index.d.ts

@@ -37,3 +37,6 @@ export * from './dtos/private/SetCustomAlarmRequest';
 export * from './dtos/private/SetCustomAlarmResponse';
 export * from './dtos/private/SetDeclaredIncomeRequest';
 export * from './dtos/private/SetDeclaredIncomeResponse';
+export * from './dtos/private/CreateClientFinancialHistoryRequest';
+export * from './dtos/private/ClientFinancialHistoryResponse';
+export * from './dtos/private/ListClientFinancialHistoryResponse';

package/bin/riskProfile/index.js

@@ -55,3 +55,6 @@ __exportStar(require("./dtos/private/SetCustomAlarmRequest"), exports);
 __exportStar(require("./dtos/private/SetCustomAlarmResponse"), exports);
 __exportStar(require("./dtos/private/SetDeclaredIncomeRequest"), exports);
 __exportStar(require("./dtos/private/SetDeclaredIncomeResponse"), exports);
+__exportStar(require("./dtos/private/CreateClientFinancialHistoryRequest"), exports);
+__exportStar(require("./dtos/private/ClientFinancialHistoryResponse"), exports);
+__exportStar(require("./dtos/private/ListClientFinancialHistoryResponse"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.73.0",
+  "version": "3.75.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/dtos/CreateTenantRequest.ts

@@ -1,6 +1,7 @@
 import { Expose } from 'class-transformer';
 import { IsBoolean, IsEmail, IsEnum, IsInt, IsOptional, IsString, Matches, Min } from 'class-validator';
 import { TokenValidationMode } from '../enums/TokenValidationMode';
+import { TenantType } from '../tenantTypes';
 
 /**
  * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
@@ -19,4 +20,6 @@ export class CreateTenantRequest {
     @Expose() @IsOptional() @IsBoolean() mfaRequired?: boolean;
     @Expose() @IsOptional() @IsInt() @Min(8) passwordMinLength?: number;
     @Expose() @IsOptional() @IsEnum(TokenValidationMode) tokenValidationMode?: TokenValidationMode;
+    /** Tipo de tenant a crear. Si se omite, el onboarding aplica su default (hoy: retail). */
+    @Expose() @IsOptional() @IsEnum(TenantType) tenantType?: TenantType;
 }

package/src/platformRbac/enums/PermissionScope.ts

@@ -1,10 +1,12 @@
 /**
- * Jerarquía: PLATFORM > TENANT > RETAILER > STORE.
- * Componente 01 spec — copia exacta.
+ * Jerarquía retail: PLATFORM > TENANT > RETAILER > STORE.
+ * Jerarquía agents: PLATFORM > TENANT > GROUP.
+ * Componente 01 spec.
  */
 export enum PermissionScope {
     PLATFORM = 'PLATFORM',
     TENANT = 'TENANT',
     RETAILER = 'RETAILER',
     STORE = 'STORE',
+    GROUP = 'GROUP',
 }

package/src/platformRbac/tenantTypes.ts

@@ -6,6 +6,7 @@ import { PermissionScope } from './enums/PermissionScope';
  */
 export enum TenantType {
     RETAIL = 'retail',
+    AGENTS = 'agents',
 }
 
 interface TenantTypeDef {
@@ -25,6 +26,12 @@ export const TENANT_TYPES: Record<TenantType, TenantTypeDef> = {
             [PermissionScope.STORE]: 'SharedStore',
         },
     },
+    // Fiado Agents — un único nivel GROUP debajo de TENANT.
+    [TenantType.AGENTS]: {
+        displayName: 'Agents',
+        levels: [PermissionScope.GROUP],
+        tableSuffix: { [PermissionScope.GROUP]: 'SharedGroup' },
+    },
 };
 
 export function levelsOf(type: TenantType): PermissionScope[] {

package/src/riskProfile/dtos/private/ClientFinancialHistoryResponse.ts

@@ -0,0 +1,21 @@
+import { Expose } from "class-transformer";
+
+/**
+ * Item del historial financiero del perfil (tabla `ClientFinancialHistory_GT`).
+ * Shape que consume el Dashboard para reconstruir la timeline del perfil.
+ */
+export class ClientFinancialHistoryResponse {
+    @Expose() directoryId!: string;
+    @Expose() sk!: string;
+    @Expose() eventId!: string;
+    @Expose() eventType!: string;
+    @Expose() field!: string;
+    @Expose() before?: number | null;
+    @Expose() after?: number | null;
+    @Expose() triggeredBy!: string;
+    @Expose() createdBy!: string;
+    @Expose() updatedBy?: string;
+    @Expose() reason?: string;
+    @Expose() tenantId!: string;
+    @Expose() createdAt!: number;
+}

package/src/riskProfile/dtos/private/CreateClientFinancialHistoryRequest.ts

@@ -0,0 +1,53 @@
+import { Expose } from "class-transformer";
+import { IsEmail, IsIn, IsNotEmpty, IsNumber, IsOptional, IsString, ValidateIf } from "class-validator";
+
+/**
+ * Request para registrar un cambio en el historial financiero del perfil
+ * (tabla `ClientFinancialHistory_GT`). Audit log append-only — BO-03,
+ * Manual de Cumplimiento sec. 8.25 / Art. 24 (retención 10 años).
+ *
+ * El caller manda SOLO el cambio de negocio. El servidor deriva los campos
+ * meta/audit (`sk`, `eventId`, `eventType`, `triggeredBy`, `createdAt`), de
+ * modo que nadie pueda falsificar el timestamp ni el origen.
+ */
+export class CreateClientFinancialHistoryRequest {
+
+    @Expose()
+    @IsString()
+    @IsNotEmpty()
+    directoryId!: string;
+
+    // Campo que cambió. Enum acotado a los 4 factores declarados del MVP (§3.2).
+    @Expose()
+    @IsString()
+    @IsIn(["declaredMonthlyIncome", "manualRiskLevel", "customHighAmount", "customMonthlyIncrease"])
+    field!: string;
+
+    // Valor anterior: number, o null/omitido en alta (sin valor previo).
+    @Expose()
+    @IsOptional()
+    @IsNumber()
+    before?: number | null;
+
+    // Valor nuevo: number, o null si es remoción de alarma custom (se audita).
+    // ValidateIf fuerza presencia (undefined falla) pero permite null.
+    @Expose()
+    @ValidateIf((o) => o.after !== null)
+    @IsNumber()
+    after!: number | null;
+
+    // Email del OC que hizo el cambio → se persiste como `createdBy`.
+    @Expose()
+    @IsEmail({}, { message: "email debe ser un correo válido" })
+    email!: string;
+
+    @Expose()
+    @IsString()
+    @IsIn(["PAGOCONFIADO", "FIADOSA"])
+    tenantId!: string;
+
+    @Expose()
+    @IsString()
+    @IsOptional()
+    reason?: string;
+}

package/src/riskProfile/dtos/private/ListClientFinancialHistoryResponse.ts

@@ -0,0 +1,11 @@
+import { Expose } from "class-transformer";
+import { ClientFinancialHistoryResponse } from "./ClientFinancialHistoryResponse";
+
+/**
+ * Respuesta paginada del listado por `directoryId`. `continuationToken` es el
+ * base64 del `ExclusiveStartKey` de DynamoDB; `null` cuando no hay más páginas.
+ */
+export class ListClientFinancialHistoryResponse {
+    @Expose() items!: ClientFinancialHistoryResponse[];
+    @Expose() continuationToken?: string | null;
+}

package/src/riskProfile/index.ts

@@ -42,4 +42,7 @@ export * from './dtos/private/SetCustomAlarmRequest';
 export * from './dtos/private/SetCustomAlarmResponse';
 export * from './dtos/private/SetDeclaredIncomeRequest';
 export * from './dtos/private/SetDeclaredIncomeResponse';
+export * from './dtos/private/CreateClientFinancialHistoryRequest';
+export * from './dtos/private/ClientFinancialHistoryResponse';
+export * from './dtos/private/ListClientFinancialHistoryResponse';