@fiado/type-kit 3.88.0 → 3.90.0

package/_test_/unit/platformRbac/enums/__snapshots__/permissionBits.test.ts.snap

@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
-exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `3492726697`;
+exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `2374504554`;
 
 exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe ante cualquier reorden/inserción) 1`] = `
 [
@@ -120,5 +120,7 @@ exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe an
   "agents.group.manage",
   "agents.group.user.manage",
   "agents.person.create",
+  "platform.tenant.userfields.manage",
+  "agents.app.access",
 ]
 `;

package/bin/platformRbac/dtos/AuthContext.d.ts

@@ -24,4 +24,10 @@ export interface AuthContext {
     permVer?: number;
     /** @deprecated DEC-RBAC-008: epoch de permisos. El authorizer ya no lo chequea. */
     permsEpoch?: number;
+    /**
+     * Metadata de negocio por-usuario inyectada por jwt-inyector (campos personalizados del tenant
+     * marcados injectToToken). NO es autorización: NUNCA usar en un guard/decisión de acceso (DEC-RBAC-020).
+     * El gateway-adapter (buildAuthContextFromToken) parsea el claim JSON a este objeto.
+     */
+    customAttributes?: Record<string, string>;
 }

package/bin/platformRbac/dtos/CreateUserFieldRequest.d.ts

@@ -0,0 +1,10 @@
+import { UserFieldType } from '../enums/UserFieldType';
+/** Body del POST /backoffice/tenants/{tenantId}/user-fields. La validación de `options` por `type` (no vacío si select) la hace el manager. */
+export declare class CreateUserFieldRequest {
+    key: string;
+    label: string;
+    type: UserFieldType;
+    options?: string[];
+    required: boolean;
+    injectToToken: boolean;
+}

package/bin/platformRbac/dtos/CreateUserFieldRequest.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateUserFieldRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const UserFieldType_1 = require("../enums/UserFieldType");
+/** Body del POST /backoffice/tenants/{tenantId}/user-fields. La validación de `options` por `type` (no vacío si select) la hace el manager. */
+class CreateUserFieldRequest {
+}
+exports.CreateUserFieldRequest = CreateUserFieldRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Matches)(/^[a-z][a-zA-Z0-9_]*$/, { message: 'key debe ser slug ^[a-z][a-zA-Z0-9_]*$' }),
+    __metadata("design:type", String)
+], CreateUserFieldRequest.prototype, "key", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(80),
+    __metadata("design:type", String)
+], CreateUserFieldRequest.prototype, "label", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEnum)(UserFieldType_1.UserFieldType),
+    __metadata("design:type", String)
+], CreateUserFieldRequest.prototype, "type", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], CreateUserFieldRequest.prototype, "options", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], CreateUserFieldRequest.prototype, "required", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], CreateUserFieldRequest.prototype, "injectToToken", void 0);

package/bin/platformRbac/dtos/InjectableUserAttributesResponse.d.ts

@@ -0,0 +1,5 @@
+/** Respuesta del GET /internal/users/{cognitoSub}/injectable-attributes (consumida por jwt-inyector). */
+export interface InjectableUserAttributesResponse {
+    /** Solo los campos injectToToken && enabled del tenant que tengan valor en el usuario. */
+    customAttributes: Record<string, string>;
+}

package/bin/platformRbac/dtos/InjectableUserAttributesResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/dtos/UpdateUserFieldRequest.d.ts

@@ -0,0 +1,8 @@
+/** Body del PATCH /backoffice/tenants/{tenantId}/user-fields/{key}. `key` y `type` NO son editables (inmutables, DEC-RBAC-016). */
+export declare class UpdateUserFieldRequest {
+    label?: string;
+    options?: string[];
+    required?: boolean;
+    injectToToken?: boolean;
+    enabled?: boolean;
+}

package/bin/platformRbac/dtos/UpdateUserFieldRequest.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateUserFieldRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body del PATCH /backoffice/tenants/{tenantId}/user-fields/{key}. `key` y `type` NO son editables (inmutables, DEC-RBAC-016). */
+class UpdateUserFieldRequest {
+}
+exports.UpdateUserFieldRequest = UpdateUserFieldRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(80),
+    __metadata("design:type", String)
+], UpdateUserFieldRequest.prototype, "label", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], UpdateUserFieldRequest.prototype, "options", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], UpdateUserFieldRequest.prototype, "required", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], UpdateUserFieldRequest.prototype, "injectToToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], UpdateUserFieldRequest.prototype, "enabled", void 0);

package/bin/platformRbac/dtos/UserFieldDef.d.ts

@@ -0,0 +1,19 @@
+import type { UserFieldType } from '../enums/UserFieldType';
+/**
+ * Definición de un campo personalizado de usuario, embebida en PlatformTenantConfig.userFieldDefs.
+ * El `key` es inmutable (clave en el map de valores y en el claim). `enabled:false` = soft-disable.
+ * Timestamps inline: los setea el manager a mano (Dynamoose no mantiene sub-objetos inline). DEC-RBAC-016.
+ */
+export interface UserFieldDef {
+    key: string;
+    label: string;
+    type: UserFieldType;
+    options?: string[];
+    required: boolean;
+    injectToToken: boolean;
+    enabled: boolean;
+    createdAt: number;
+    updatedAt: number;
+    createdBy: string;
+    updatedBy: string;
+}

package/bin/platformRbac/dtos/UserFieldDef.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/enums/Permission.d.ts

@@ -51,6 +51,7 @@ export declare enum Permission {
     PLATFORM_ROLE_UPDATE = "platform.role.update",
     PLATFORM_ROLE_DELETE = "platform.role.delete",
     PLATFORM_AUDIT_VIEW = "platform.audit.view",
+    PLATFORM_TENANT_USERFIELDS_MANAGE = "platform.tenant.userfields.manage",
     TENANT_USER_CREATE = "tenant.user.create",
     TENANT_USER_CREATE_LATERAL = "tenant.user.create.lateral",
     TENANT_USER_READ = "tenant.user.read",
@@ -119,6 +120,7 @@ export declare enum Permission {
     MDM_OPERATION_LOG_VIEW = "mdm.operation_log.view",
     MDM_TEST = "mdm.test",
     PAY_TRANSACTION_VIEW = "pay.transaction.view",
+    AGENTS_APP_ACCESS = "agents.app.access",
     AGENTS_AGENT_LIST = "agents.agent.list",
     AGENTS_AGENT_CREATE = "agents.agent.create",
     AGENTS_AGENT_CREATE_BULK = "agents.agent.create_bulk",

package/bin/platformRbac/enums/Permission.js

@@ -63,6 +63,7 @@ var Permission;
     Permission["PLATFORM_ROLE_UPDATE"] = "platform.role.update";
     Permission["PLATFORM_ROLE_DELETE"] = "platform.role.delete";
     Permission["PLATFORM_AUDIT_VIEW"] = "platform.audit.view";
+    Permission["PLATFORM_TENANT_USERFIELDS_MANAGE"] = "platform.tenant.userfields.manage";
     // ====================================================
     // TENANT — operaciones dentro del silo de un tenant
     // ====================================================
@@ -160,6 +161,9 @@ var Permission;
     // (ver fiado-agents-webapp/docs/rbac/RBAC-agents.md §5.2). El aislamiento entre orgs lo da el
     // scope GROUP del roleAssignment (scopeRef = Group_GT.id), no un permiso aparte.
     // ====================================================
+    // Gate de ACCESO a la app web de Agents (gobernanza). Sin este permiso el usuario no
+    // entra a la app. Lo otorgan los 5 roles GROUP de agents (en su propio repo, no acá).
+    Permission["AGENTS_APP_ACCESS"] = "agents.app.access";
     Permission["AGENTS_AGENT_LIST"] = "agents.agent.list";
     Permission["AGENTS_AGENT_CREATE"] = "agents.agent.create";
     Permission["AGENTS_AGENT_CREATE_BULK"] = "agents.agent.create_bulk";
@@ -321,6 +325,13 @@ exports.PERMISSION_BIT_ORDER = [
     // Append-only: nuevo permiso agregado 2026-06-18 (DEC-A2-02). Va al FINAL para no correr los bits
     // existentes (PERMS_VERSION cambia, pero los índices previos se conservan).
     Permission.AGENTS_PERSON_CREATE,
+    // Append-only 2026-06-18 (DEC-RBAC-017): catálogo de campos personalizados por tenant. Al FINAL para
+    // no correr bits existentes. (El bitset está deprecado por token-flaco, pero el orden se mantiene
+    // sincronizado con el enum para que el test de bits no rompa.)
+    Permission.PLATFORM_TENANT_USERFIELDS_MANAGE,
+    // Append-only 2026-06-21: gate de acceso a la app web de Agents (gobernanza). Al FINAL para no
+    // correr bits existentes (PERMS_VERSION cambia, pero los índices previos se conservan).
+    Permission.AGENTS_APP_ACCESS,
 ];
 function djb2(input) {
     let h = 5381;

package/bin/platformRbac/enums/UserFieldType.d.ts

@@ -0,0 +1,5 @@
+/** Tipo de un campo personalizado de usuario. text = texto libre; select = lista cerrada de opciones. */
+export declare enum UserFieldType {
+    TEXT = "text",
+    SELECT = "select"
+}

package/bin/platformRbac/enums/UserFieldType.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserFieldType = void 0;
+/** Tipo de un campo personalizado de usuario. text = texto libre; select = lista cerrada de opciones. */
+var UserFieldType;
+(function (UserFieldType) {
+    UserFieldType["TEXT"] = "text";
+    UserFieldType["SELECT"] = "select";
+})(UserFieldType || (exports.UserFieldType = UserFieldType = {}));

package/bin/platformRbac/index.d.ts

@@ -29,3 +29,8 @@ export type { CreateTenantResponse } from './dtos/CreateTenantResponse';
 export * from './dtos/UpdateTenantSecurityPolicyRequest';
 export type { TenantSecurityPolicyResponse } from './dtos/TenantSecurityPolicyResponse';
 export { TenantType, TENANT_TYPES, levelsOf, tableSuffixForLevel, scopeRankOrder } from './tenantTypes';
+export { UserFieldType } from './enums/UserFieldType';
+export type { UserFieldDef } from './dtos/UserFieldDef';
+export * from './dtos/CreateUserFieldRequest';
+export * from './dtos/UpdateUserFieldRequest';
+export type { InjectableUserAttributesResponse } from './dtos/InjectableUserAttributesResponse';

package/bin/platformRbac/index.js

@@ -23,7 +23,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.scopeRankOrder = exports.tableSuffixForLevel = exports.levelsOf = exports.TENANT_TYPES = exports.TenantType = exports.AuthorizeDenyReason = exports.PermissionCategory = exports.PermissionScope = exports.bitsToPermissions = exports.permissionsToBits = exports.PERMS_VERSION = exports.PERMISSION_BIT_ORDER = exports.Permission = void 0;
+exports.UserFieldType = exports.scopeRankOrder = exports.tableSuffixForLevel = exports.levelsOf = exports.TENANT_TYPES = exports.TenantType = exports.AuthorizeDenyReason = exports.PermissionCategory = exports.PermissionScope = exports.bitsToPermissions = exports.permissionsToBits = exports.PERMS_VERSION = exports.PERMISSION_BIT_ORDER = exports.Permission = void 0;
 var Permission_1 = require("./enums/Permission");
 Object.defineProperty(exports, "Permission", { enumerable: true, get: function () { return Permission_1.Permission; } });
 Object.defineProperty(exports, "PERMISSION_BIT_ORDER", { enumerable: true, get: function () { return Permission_1.PERMISSION_BIT_ORDER; } });
@@ -73,3 +73,11 @@ Object.defineProperty(exports, "TENANT_TYPES", { enumerable: true, get: function
 Object.defineProperty(exports, "levelsOf", { enumerable: true, get: function () { return tenantTypes_1.levelsOf; } });
 Object.defineProperty(exports, "tableSuffixForLevel", { enumerable: true, get: function () { return tenantTypes_1.tableSuffixForLevel; } });
 Object.defineProperty(exports, "scopeRankOrder", { enumerable: true, get: function () { return tenantTypes_1.scopeRankOrder; } });
+// Campos personalizados de usuario por tenant — embebidos en PlatformTenantConfig.userFieldDefs.
+// UserFieldType es enum (export de valor); UserFieldDef es interface plain (type-only).
+var UserFieldType_1 = require("./enums/UserFieldType");
+Object.defineProperty(exports, "UserFieldType", { enumerable: true, get: function () { return UserFieldType_1.UserFieldType; } });
+// DTOs de endpoints user-fields. Create/Update Request llevan decoradores class-validator → export de valor.
+// InjectableUserAttributesResponse es interface plain (consumida por jwt-inyector) → type-only.
+__exportStar(require("./dtos/CreateUserFieldRequest"), exports);
+__exportStar(require("./dtos/UpdateUserFieldRequest"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.88.0",
+  "version": "3.90.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/dtos/AuthContext.ts

@@ -25,4 +25,10 @@ export interface AuthContext {
     permVer?: number;
     /** @deprecated DEC-RBAC-008: epoch de permisos. El authorizer ya no lo chequea. */
     permsEpoch?: number;
+    /**
+     * Metadata de negocio por-usuario inyectada por jwt-inyector (campos personalizados del tenant
+     * marcados injectToToken). NO es autorización: NUNCA usar en un guard/decisión de acceso (DEC-RBAC-020).
+     * El gateway-adapter (buildAuthContextFromToken) parsea el claim JSON a este objeto.
+     */
+    customAttributes?: Record<string, string>;
 }

package/src/platformRbac/dtos/CreateUserFieldRequest.ts

@@ -0,0 +1,13 @@
+import { Expose } from 'class-transformer';
+import { ArrayNotEmpty, IsArray, IsBoolean, IsEnum, IsOptional, IsString, Matches, MaxLength } from 'class-validator';
+import { UserFieldType } from '../enums/UserFieldType';
+
+/** Body del POST /backoffice/tenants/{tenantId}/user-fields. La validación de `options` por `type` (no vacío si select) la hace el manager. */
+export class CreateUserFieldRequest {
+    @Expose() @IsString() @Matches(/^[a-z][a-zA-Z0-9_]*$/, { message: 'key debe ser slug ^[a-z][a-zA-Z0-9_]*$' }) key!: string;
+    @Expose() @IsString() @MaxLength(80) label!: string;
+    @Expose() @IsEnum(UserFieldType) type!: UserFieldType;
+    @Expose() @IsOptional() @IsArray() @ArrayNotEmpty() @IsString({ each: true }) options?: string[];
+    @Expose() @IsBoolean() required!: boolean;
+    @Expose() @IsBoolean() injectToToken!: boolean;
+}

package/src/platformRbac/dtos/InjectableUserAttributesResponse.ts

@@ -0,0 +1,5 @@
+/** Respuesta del GET /internal/users/{cognitoSub}/injectable-attributes (consumida por jwt-inyector). */
+export interface InjectableUserAttributesResponse {
+    /** Solo los campos injectToToken && enabled del tenant que tengan valor en el usuario. */
+    customAttributes: Record<string, string>;
+}

package/src/platformRbac/dtos/UpdateUserFieldRequest.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { ArrayNotEmpty, IsArray, IsBoolean, IsOptional, IsString, MaxLength } from 'class-validator';
+
+/** Body del PATCH /backoffice/tenants/{tenantId}/user-fields/{key}. `key` y `type` NO son editables (inmutables, DEC-RBAC-016). */
+export class UpdateUserFieldRequest {
+    @Expose() @IsOptional() @IsString() @MaxLength(80) label?: string;
+    @Expose() @IsOptional() @IsArray() @ArrayNotEmpty() @IsString({ each: true }) options?: string[];
+    @Expose() @IsOptional() @IsBoolean() required?: boolean;
+    @Expose() @IsOptional() @IsBoolean() injectToToken?: boolean;
+    @Expose() @IsOptional() @IsBoolean() enabled?: boolean;
+}

package/src/platformRbac/dtos/UserFieldDef.ts

@@ -0,0 +1,20 @@
+import type { UserFieldType } from '../enums/UserFieldType';
+
+/**
+ * Definición de un campo personalizado de usuario, embebida en PlatformTenantConfig.userFieldDefs.
+ * El `key` es inmutable (clave en el map de valores y en el claim). `enabled:false` = soft-disable.
+ * Timestamps inline: los setea el manager a mano (Dynamoose no mantiene sub-objetos inline). DEC-RBAC-016.
+ */
+export interface UserFieldDef {
+    key: string;
+    label: string;
+    type: UserFieldType;
+    options?: string[];
+    required: boolean;
+    injectToToken: boolean;
+    enabled: boolean;
+    createdAt: number;
+    updatedAt: number;
+    createdBy: string;
+    updatedBy: string;
+}

package/src/platformRbac/enums/Permission.ts

@@ -58,6 +58,7 @@ export enum Permission {
     PLATFORM_ROLE_UPDATE = 'platform.role.update',
     PLATFORM_ROLE_DELETE = 'platform.role.delete',
     PLATFORM_AUDIT_VIEW = 'platform.audit.view',
+    PLATFORM_TENANT_USERFIELDS_MANAGE = 'platform.tenant.userfields.manage',
 
     // ====================================================
     // TENANT — operaciones dentro del silo de un tenant
@@ -161,6 +162,9 @@ export enum Permission {
     // (ver fiado-agents-webapp/docs/rbac/RBAC-agents.md §5.2). El aislamiento entre orgs lo da el
     // scope GROUP del roleAssignment (scopeRef = Group_GT.id), no un permiso aparte.
     // ====================================================
+    // Gate de ACCESO a la app web de Agents (gobernanza). Sin este permiso el usuario no
+    // entra a la app. Lo otorgan los 5 roles GROUP de agents (en su propio repo, no acá).
+    AGENTS_APP_ACCESS = 'agents.app.access',
     AGENTS_AGENT_LIST = 'agents.agent.list',
     AGENTS_AGENT_CREATE = 'agents.agent.create',
     AGENTS_AGENT_CREATE_BULK = 'agents.agent.create_bulk',
@@ -323,6 +327,13 @@ export const PERMISSION_BIT_ORDER: readonly Permission[] = [
     // Append-only: nuevo permiso agregado 2026-06-18 (DEC-A2-02). Va al FINAL para no correr los bits
     // existentes (PERMS_VERSION cambia, pero los índices previos se conservan).
     Permission.AGENTS_PERSON_CREATE,
+    // Append-only 2026-06-18 (DEC-RBAC-017): catálogo de campos personalizados por tenant. Al FINAL para
+    // no correr bits existentes. (El bitset está deprecado por token-flaco, pero el orden se mantiene
+    // sincronizado con el enum para que el test de bits no rompa.)
+    Permission.PLATFORM_TENANT_USERFIELDS_MANAGE,
+    // Append-only 2026-06-21: gate de acceso a la app web de Agents (gobernanza). Al FINAL para no
+    // correr bits existentes (PERMS_VERSION cambia, pero los índices previos se conservan).
+    Permission.AGENTS_APP_ACCESS,
 ] as const;
 
 function djb2(input: string): number {

package/src/platformRbac/enums/UserFieldType.ts

@@ -0,0 +1,5 @@
+/** Tipo de un campo personalizado de usuario. text = texto libre; select = lista cerrada de opciones. */
+export enum UserFieldType {
+    TEXT = 'text',
+    SELECT = 'select',
+}

package/src/platformRbac/index.ts

@@ -62,3 +62,14 @@ export type { TenantSecurityPolicyResponse } from './dtos/TenantSecurityPolicyRe
 // Consumido por ScopeValidationService._rank vía scopeRankOrder() y por los seeds.
 // Accesible bajo el namespace PlatformRbac (el index raíz hace export * as PlatformRbac).
 export { TenantType, TENANT_TYPES, levelsOf, tableSuffixForLevel, scopeRankOrder } from './tenantTypes';
+
+// Campos personalizados de usuario por tenant — embebidos en PlatformTenantConfig.userFieldDefs.
+// UserFieldType es enum (export de valor); UserFieldDef es interface plain (type-only).
+export { UserFieldType } from './enums/UserFieldType';
+export type { UserFieldDef } from './dtos/UserFieldDef';
+
+// DTOs de endpoints user-fields. Create/Update Request llevan decoradores class-validator → export de valor.
+// InjectableUserAttributesResponse es interface plain (consumida por jwt-inyector) → type-only.
+export * from './dtos/CreateUserFieldRequest';
+export * from './dtos/UpdateUserFieldRequest';
+export type { InjectableUserAttributesResponse } from './dtos/InjectableUserAttributesResponse';