@fiado/type-kit 3.76.0 → 3.78.0

package/bin/complaint/dtos/ComplaintResponse.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Respuesta de lectura de una denuncia (`GET /complaints/{complaintId}`).
+ * NO incluye `createdBy` (email real) — solo `createdByHash`. El Dashboard
+ * nunca conoce la identidad del denunciante.
+ */
+export declare class ComplaintResponse {
+    id: string;
+    category: string;
+    title: string;
+    message: string;
+    status: string;
+    alertId?: string;
+    createdByHash?: string;
+    deadlineAt: string;
+    dictamenAt?: string | null;
+    dictamenBy?: string | null;
+    createdAt?: string;
+}
+/** Respuesta del create — ids para enlazar denuncia ↔ alerta. */
+export declare class CreateComplaintResponse {
+    complaintId: string;
+    alertId: string;
+}

package/bin/complaint/dtos/ComplaintResponse.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateComplaintResponse = exports.ComplaintResponse = void 0;
+const class_transformer_1 = require("class-transformer");
+/**
+ * Respuesta de lectura de una denuncia (`GET /complaints/{complaintId}`).
+ * NO incluye `createdBy` (email real) — solo `createdByHash`. El Dashboard
+ * nunca conoce la identidad del denunciante.
+ */
+class ComplaintResponse {
+}
+exports.ComplaintResponse = ComplaintResponse;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "id", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "category", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "title", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "message", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "status", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "alertId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "createdByHash", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "deadlineAt", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "dictamenAt", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "dictamenBy", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], ComplaintResponse.prototype, "createdAt", void 0);
+/** Respuesta del create — ids para enlazar denuncia ↔ alerta. */
+class CreateComplaintResponse {
+}
+exports.CreateComplaintResponse = CreateComplaintResponse;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], CreateComplaintResponse.prototype, "complaintId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], CreateComplaintResponse.prototype, "alertId", void 0);

package/bin/complaint/dtos/CreateComplaintRequest.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Catálogo de categorías del buzón anónimo de denuncias (BO-19, Manual cap. 20.3).
+ */
+export declare const COMPLAINT_CATEGORIES: readonly ["Sospecha sobre un cliente", "Sospecha sobre un empleado", "Conflicto de interés", "Incumplimiento del Manual", "Otro"];
+export type ComplaintCategory = (typeof COMPLAINT_CATEGORIES)[number];
+/**
+ * Request para crear una denuncia en el buzón anónimo (`complaint-mailbox-business`).
+ * El `userEmail` se persiste interno como `createdBy` y se hashea (`createdByHash`);
+ * el Dashboard nunca conoce la identidad real del denunciante.
+ */
+export declare class CreateComplaintRequest {
+    category: string;
+    title: string;
+    message: string;
+    userEmail: string;
+}

package/bin/complaint/dtos/CreateComplaintRequest.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateComplaintRequest = exports.COMPLAINT_CATEGORIES = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Catálogo de categorías del buzón anónimo de denuncias (BO-19, Manual cap. 20.3).
+ */
+exports.COMPLAINT_CATEGORIES = [
+    "Sospecha sobre un cliente",
+    "Sospecha sobre un empleado",
+    "Conflicto de interés",
+    "Incumplimiento del Manual",
+    "Otro",
+];
+/**
+ * Request para crear una denuncia en el buzón anónimo (`complaint-mailbox-business`).
+ * El `userEmail` se persiste interno como `createdBy` y se hashea (`createdByHash`);
+ * el Dashboard nunca conoce la identidad real del denunciante.
+ */
+class CreateComplaintRequest {
+}
+exports.CreateComplaintRequest = CreateComplaintRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsIn)(exports.COMPLAINT_CATEGORIES, { message: "category inválida" }),
+    __metadata("design:type", String)
+], CreateComplaintRequest.prototype, "category", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(200),
+    __metadata("design:type", String)
+], CreateComplaintRequest.prototype, "title", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateComplaintRequest.prototype, "message", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)({}, { message: "userEmail debe ser un correo válido" }),
+    __metadata("design:type", String)
+], CreateComplaintRequest.prototype, "userEmail", void 0);

package/bin/complaint/index.d.ts

@@ -0,0 +1,2 @@
+export * from './dtos/CreateComplaintRequest';
+export * from './dtos/ComplaintResponse';

package/bin/complaint/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./dtos/CreateComplaintRequest"), exports);
+__exportStar(require("./dtos/ComplaintResponse"), exports);

package/bin/index.d.ts

@@ -81,3 +81,4 @@ export * as Remittance from './remittance';
 export * as WalletFunding from './walletFunding';
 export * as TotpSecurity from './totpSecurity';
 export * from './messaging';
+export * from './complaint';

package/bin/index.js

@@ -126,3 +126,4 @@ exports.Remittance = __importStar(require("./remittance"));
 exports.WalletFunding = __importStar(require("./walletFunding"));
 exports.TotpSecurity = __importStar(require("./totpSecurity"));
 __exportStar(require("./messaging"), exports);
+__exportStar(require("./complaint"), exports);

package/bin/platformRbac/dtos/TenantSecurityPolicyResponse.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Output de la consulta/actualización de la security policy del tenant. Response plain sin
+ * validators (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ *
+ * TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de
+ * MfaMethodEnum ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+ */
+export interface TenantSecurityPolicyResponse {
+    methodsAllowed: ('EMAIL' | 'TOTP')[];
+}

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.d.ts

@@ -0,0 +1,3 @@
+export declare class UpdateTenantSecurityPolicyRequest {
+    methodsAllowed: ('EMAIL' | 'TOTP')[];
+}

package/bin/{benefitCenter/dtos/InputSchemaOverrideRequest.js → platformRbac/dtos/UpdateTenantSecurityPolicyRequest.js}

@@ -9,21 +9,17 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InputSchemaOverrideRequest = void 0;
-const class_validator_1 = require("class-validator");
+exports.UpdateTenantSecurityPolicyRequest = void 0;
 const class_transformer_1 = require("class-transformer");
-const FieldOverrideRequest_1 = require("./FieldOverrideRequest");
-/**
- * Override del inputSchema completo. El array `fieldOverrides[]` lista overrides
- * parciales por `key`. La validación cruzada de que cada `key` exista en el
- * inputSchema del conector la hace el manager (no se puede expresar con class-validator).
- */
-class InputSchemaOverrideRequest {
+const class_validator_1 = require("class-validator");
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum
+// ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+class UpdateTenantSecurityPolicyRequest {
 }
-exports.InputSchemaOverrideRequest = InputSchemaOverrideRequest;
+exports.UpdateTenantSecurityPolicyRequest = UpdateTenantSecurityPolicyRequest;
 __decorate([
-    (0, class_validator_1.IsArray)(),
-    (0, class_validator_1.ValidateNested)({ each: true }),
-    (0, class_transformer_1.Type)(() => FieldOverrideRequest_1.FieldOverrideRequest),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsIn)(['EMAIL', 'TOTP'], { each: true }),
     __metadata("design:type", Array)
-], InputSchemaOverrideRequest.prototype, "fieldOverrides", void 0);
+], UpdateTenantSecurityPolicyRequest.prototype, "methodsAllowed", void 0);

package/bin/platformRbac/index.d.ts

@@ -20,9 +20,12 @@ export * from './mfa/EnrollTotpResponse';
 export * from './mfa/VerifyTotpEnrollmentRequest';
 export * from './mfa/ChangeMfaMethodRequest';
 export * from './mfa/MfaStatusResponse';
+export * from './mfa/MfaOptionsResponse';
 export { AuthorizeDenyReason } from './enums/AuthorizeDenyReason';
 export * from './dtos/AuthorizeRequest';
 export * from './dtos/AuthorizeResponse';
 export * from './dtos/CreateTenantRequest';
 export type { CreateTenantResponse } from './dtos/CreateTenantResponse';
+export * from './dtos/UpdateTenantSecurityPolicyRequest';
+export type { TenantSecurityPolicyResponse } from './dtos/TenantSecurityPolicyResponse';
 export { TenantType, TENANT_TYPES, levelsOf, tableSuffixForLevel, scopeRankOrder } from './tenantTypes';

package/bin/platformRbac/index.js

@@ -51,6 +51,7 @@ __exportStar(require("./mfa/EnrollTotpResponse"), exports);
 __exportStar(require("./mfa/VerifyTotpEnrollmentRequest"), exports);
 __exportStar(require("./mfa/ChangeMfaMethodRequest"), exports);
 __exportStar(require("./mfa/MfaStatusResponse"), exports);
+__exportStar(require("./mfa/MfaOptionsResponse"), exports);
 // RBAC enforcement (capa de protección) — DTOs del POST /internal/authorize.
 var AuthorizeDenyReason_1 = require("./enums/AuthorizeDenyReason");
 Object.defineProperty(exports, "AuthorizeDenyReason", { enumerable: true, get: function () { return AuthorizeDenyReason_1.AuthorizeDenyReason; } });
@@ -59,6 +60,10 @@ __exportStar(require("./dtos/AuthorizeResponse"), exports);
 // F-11 — onboarding de tenant (POST backoffice createTenant). CreateTenantRequest lleva
 // decoradores class-validator → export de valor; CreateTenantResponse es interface → type-only.
 __exportStar(require("./dtos/CreateTenantRequest"), exports);
+// MFA por tenant — methodsAllowed (value-set 'EMAIL'|'TOTP', TD-RBAC-071, DEC-095).
+// UpdateTenantSecurityPolicyRequest lleva decoradores class-validator → export de valor;
+// TenantSecurityPolicyResponse es interface plain → type-only.
+__exportStar(require("./dtos/UpdateTenantSecurityPolicyRequest"), exports);
 // A1 — registro data-driven de tenant-types (niveles debajo de TENANT, por tipo).
 // Consumido por ScopeValidationService._rank vía scopeRankOrder() y por los seeds.
 // Accesible bajo el namespace PlatformRbac (el index raíz hace export * as PlatformRbac).

package/bin/platformRbac/mfa/MfaOptionsResponse.d.ts

@@ -0,0 +1,6 @@
+import { MfaMethodEnum } from '../enums/MfaMethodEnum';
+export declare class MfaOptionsResponse {
+    allowedMethods: MfaMethodEnum[];
+    currentMethod: MfaMethodEnum;
+    mfaConfigured: boolean;
+}

package/bin/{credit/dtos/internal/CreditReversalRequest.js → platformRbac/mfa/MfaOptionsResponse.js}

@@ -9,23 +9,22 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CreditReversalRequest = void 0;
+exports.MfaOptionsResponse = void 0;
 const class_validator_1 = require("class-validator");
-class CreditReversalRequest {
+const MfaMethodEnum_1 = require("../enums/MfaMethodEnum");
+class MfaOptionsResponse {
 }
-exports.CreditReversalRequest = CreditReversalRequest;
+exports.MfaOptionsResponse = MfaOptionsResponse;
 __decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", String)
-], CreditReversalRequest.prototype, "originalTransactionId", void 0);
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsEnum)(MfaMethodEnum_1.MfaMethodEnum, { each: true }),
+    __metadata("design:type", Array)
+], MfaOptionsResponse.prototype, "allowedMethods", void 0);
 __decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsEnum)(MfaMethodEnum_1.MfaMethodEnum),
     __metadata("design:type", String)
-], CreditReversalRequest.prototype, "creditId", void 0);
+], MfaOptionsResponse.prototype, "currentMethod", void 0);
 __decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", String)
-], CreditReversalRequest.prototype, "reason", void 0);
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], MfaOptionsResponse.prototype, "mfaConfigured", void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.76.0",
+  "version": "3.78.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/complaint/dtos/ComplaintResponse.ts

@@ -0,0 +1,26 @@
+import { Expose } from "class-transformer";
+
+/**
+ * Respuesta de lectura de una denuncia (`GET /complaints/{complaintId}`).
+ * NO incluye `createdBy` (email real) — solo `createdByHash`. El Dashboard
+ * nunca conoce la identidad del denunciante.
+ */
+export class ComplaintResponse {
+    @Expose() id!: string;
+    @Expose() category!: string;
+    @Expose() title!: string;
+    @Expose() message!: string;
+    @Expose() status!: string; // OPEN | CLOSE_JUSTIFIED | CLOSE_RULED
+    @Expose() alertId?: string;
+    @Expose() createdByHash?: string;
+    @Expose() deadlineAt!: string;
+    @Expose() dictamenAt?: string | null;
+    @Expose() dictamenBy?: string | null;
+    @Expose() createdAt?: string;
+}
+
+/** Respuesta del create — ids para enlazar denuncia ↔ alerta. */
+export class CreateComplaintResponse {
+    @Expose() complaintId!: string;
+    @Expose() alertId!: string;
+}

package/src/complaint/dtos/CreateComplaintRequest.ts

@@ -0,0 +1,43 @@
+import { Expose } from "class-transformer";
+import { IsEmail, IsIn, IsNotEmpty, IsString, MaxLength } from "class-validator";
+
+/**
+ * Catálogo de categorías del buzón anónimo de denuncias (BO-19, Manual cap. 20.3).
+ */
+export const COMPLAINT_CATEGORIES = [
+    "Sospecha sobre un cliente",
+    "Sospecha sobre un empleado",
+    "Conflicto de interés",
+    "Incumplimiento del Manual",
+    "Otro",
+] as const;
+
+export type ComplaintCategory = (typeof COMPLAINT_CATEGORIES)[number];
+
+/**
+ * Request para crear una denuncia en el buzón anónimo (`complaint-mailbox-business`).
+ * El `userEmail` se persiste interno como `createdBy` y se hashea (`createdByHash`);
+ * el Dashboard nunca conoce la identidad real del denunciante.
+ */
+export class CreateComplaintRequest {
+
+    @Expose()
+    @IsString()
+    @IsIn(COMPLAINT_CATEGORIES as unknown as string[], { message: "category inválida" })
+    category!: string;
+
+    @Expose()
+    @IsString()
+    @IsNotEmpty()
+    @MaxLength(200)
+    title!: string;
+
+    @Expose()
+    @IsString()
+    @IsNotEmpty()
+    message!: string; // HTML del editor
+
+    @Expose()
+    @IsEmail({}, { message: "userEmail debe ser un correo válido" })
+    userEmail!: string;
+}

package/src/complaint/index.ts

@@ -0,0 +1,2 @@
+export * from './dtos/CreateComplaintRequest';
+export * from './dtos/ComplaintResponse';

package/src/index.ts

@@ -86,3 +86,4 @@ export * as Remittance from './remittance';
 export * as WalletFunding from './walletFunding';
 export * as TotpSecurity from './totpSecurity';
 export * from './messaging';
+export * from './complaint';

package/src/platformRbac/dtos/TenantSecurityPolicyResponse.ts

@@ -0,0 +1,10 @@
+/**
+ * Output de la consulta/actualización de la security policy del tenant. Response plain sin
+ * validators (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ *
+ * TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de
+ * MfaMethodEnum ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+ */
+export interface TenantSecurityPolicyResponse {
+    methodsAllowed: ('EMAIL' | 'TOTP')[];
+}

package/src/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { ArrayNotEmpty, IsIn } from 'class-validator';
+
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum
+// ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+export class UpdateTenantSecurityPolicyRequest {
+    @Expose()
+    @ArrayNotEmpty()
+    @IsIn(['EMAIL', 'TOTP'], { each: true })
+    methodsAllowed!: ('EMAIL' | 'TOTP')[];
+}

package/src/platformRbac/index.ts

@@ -40,6 +40,7 @@ export * from './mfa/EnrollTotpResponse';
 export * from './mfa/VerifyTotpEnrollmentRequest';
 export * from './mfa/ChangeMfaMethodRequest';
 export * from './mfa/MfaStatusResponse';
+export * from './mfa/MfaOptionsResponse';
 
 // RBAC enforcement (capa de protección) — DTOs del POST /internal/authorize.
 export { AuthorizeDenyReason } from './enums/AuthorizeDenyReason';
@@ -51,6 +52,12 @@ export * from './dtos/AuthorizeResponse';
 export * from './dtos/CreateTenantRequest';
 export type { CreateTenantResponse } from './dtos/CreateTenantResponse';
 
+// MFA por tenant — methodsAllowed (value-set 'EMAIL'|'TOTP', TD-RBAC-071, DEC-095).
+// UpdateTenantSecurityPolicyRequest lleva decoradores class-validator → export de valor;
+// TenantSecurityPolicyResponse es interface plain → type-only.
+export * from './dtos/UpdateTenantSecurityPolicyRequest';
+export type { TenantSecurityPolicyResponse } from './dtos/TenantSecurityPolicyResponse';
+
 // A1 — registro data-driven de tenant-types (niveles debajo de TENANT, por tipo).
 // Consumido por ScopeValidationService._rank vía scopeRankOrder() y por los seeds.
 // Accesible bajo el namespace PlatformRbac (el index raíz hace export * as PlatformRbac).

package/src/platformRbac/mfa/MfaOptionsResponse.ts

@@ -0,0 +1,14 @@
+import { IsArray, IsBoolean, IsEnum } from 'class-validator';
+import { MfaMethodEnum } from '../enums/MfaMethodEnum';
+
+export class MfaOptionsResponse {
+    @IsArray()
+    @IsEnum(MfaMethodEnum, { each: true })
+    allowedMethods!: MfaMethodEnum[];
+
+    @IsEnum(MfaMethodEnum)
+    currentMethod!: MfaMethodEnum;
+
+    @IsBoolean()
+    mfaConfigured!: boolean;
+}

package/bin/benefitCenter/dtos/BackofficeLeafOverrideUpsertRequest.d.ts

@@ -1,22 +0,0 @@
-import { InputSchemaOverrideRequest } from "./InputSchemaOverrideRequest";
-/**
- * Body de PUT /backoffice/leaves/{leafId}. Upsert parcial:
- *   - undefined → no se toca
- *   - string/number/boolean seteado → pisa el valor previo del override
- *   - null NO se acepta (para borrar un campo, usar DELETE /fields/{fieldName})
- *
- * Si todos los campos llegan undefined → 400 INVALID_PATCH_PAYLOAD.
- */
-export declare class BackofficeLeafOverrideUpsertRequest {
-    serviceName?: string;
-    logo?: string;
-    description?: string;
-    helpText?: string;
-    serviceOrder?: number;
-    subcategoryOrder?: number;
-    enabled?: boolean;
-    category?: string;
-    subcategory?: string;
-    requiresReferenceVerification?: boolean;
-    inputSchema?: InputSchemaOverrideRequest;
-}

package/bin/benefitCenter/dtos/BackofficeLeafOverrideUpsertRequest.js

@@ -1,91 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BackofficeLeafOverrideUpsertRequest = void 0;
-const class_validator_1 = require("class-validator");
-const class_transformer_1 = require("class-transformer");
-const InputSchemaOverrideRequest_1 = require("./InputSchemaOverrideRequest");
-/**
- * Body de PUT /backoffice/leaves/{leafId}. Upsert parcial:
- *   - undefined → no se toca
- *   - string/number/boolean seteado → pisa el valor previo del override
- *   - null NO se acepta (para borrar un campo, usar DELETE /fields/{fieldName})
- *
- * Si todos los campos llegan undefined → 400 INVALID_PATCH_PAYLOAD.
- */
-class BackofficeLeafOverrideUpsertRequest {
-}
-exports.BackofficeLeafOverrideUpsertRequest = BackofficeLeafOverrideUpsertRequest;
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(120),
-    __metadata("design:type", String)
-], BackofficeLeafOverrideUpsertRequest.prototype, "serviceName", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsUrl)({ protocols: ["https"], require_protocol: true }),
-    (0, class_validator_1.MaxLength)(500),
-    __metadata("design:type", String)
-], BackofficeLeafOverrideUpsertRequest.prototype, "logo", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(2000),
-    __metadata("design:type", String)
-], BackofficeLeafOverrideUpsertRequest.prototype, "description", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(1000),
-    __metadata("design:type", String)
-], BackofficeLeafOverrideUpsertRequest.prototype, "helpText", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsInt)(),
-    (0, class_validator_1.Min)(0),
-    __metadata("design:type", Number)
-], BackofficeLeafOverrideUpsertRequest.prototype, "serviceOrder", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsInt)(),
-    (0, class_validator_1.Min)(0),
-    __metadata("design:type", Number)
-], BackofficeLeafOverrideUpsertRequest.prototype, "subcategoryOrder", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsBoolean)(),
-    __metadata("design:type", Boolean)
-], BackofficeLeafOverrideUpsertRequest.prototype, "enabled", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(60),
-    (0, class_validator_1.Matches)(/^[A-Z][A-Z0-9_ ]*$/, { message: "category must be uppercase with underscores or spaces" }),
-    __metadata("design:type", String)
-], BackofficeLeafOverrideUpsertRequest.prototype, "category", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(60),
-    __metadata("design:type", String)
-], BackofficeLeafOverrideUpsertRequest.prototype, "subcategory", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsBoolean)(),
-    __metadata("design:type", Boolean)
-], BackofficeLeafOverrideUpsertRequest.prototype, "requiresReferenceVerification", void 0);
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.ValidateNested)(),
-    (0, class_transformer_1.Type)(() => InputSchemaOverrideRequest_1.InputSchemaOverrideRequest),
-    __metadata("design:type", InputSchemaOverrideRequest_1.InputSchemaOverrideRequest)
-], BackofficeLeafOverrideUpsertRequest.prototype, "inputSchema", void 0);

package/bin/benefitCenter/dtos/FieldOverrideRequest.d.ts

@@ -1,19 +0,0 @@
-import { InputFieldTypeEnum } from "../enums/InputFieldTypeEnum";
-import { InputValidation } from "./InputValidation";
-import { SelectOption } from "./SelectOption";
-/**
- * Override parcial de un field individual del `inputSchema` por `key`.
- * El admin no puede agregar ni quitar fields — solo editar los existentes.
- */
-export declare class FieldOverrideRequest {
-    key: string;
-    type?: InputFieldTypeEnum;
-    label?: string;
-    placeholder?: string;
-    required?: boolean;
-    helpImage?: string;
-    showHelp?: boolean;
-    options?: SelectOption[];
-    dependsOn?: string;
-    validation?: InputValidation;
-}