fix: preservar etiquetas técnicas extensas del Excel

F2.2: contrato seguro de autenticación Android

.github/workflows/android.yml

@@ -0,0 +1,59 @@
+name: Android APK
+
+on:
+  push:
+    branches:
+      - 'feature/f2-2*'
+    paths:
+      - 'android-app/**'
+      - '.github/workflows/android.yml'
+  pull_request:
+    paths:
+      - 'android-app/**'
+      - 'api-v3/src/auth/**'
+      - '.github/workflows/android.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-debug-apk:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Java 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Android API 36
+        run: sdkmanager 'platforms;android-36' 'build-tools;36.0.0'
+
+      - name: Gradle 8.13
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: '8.13'
+
+      - name: Assemble debug
+        working-directory: android-app
+        run: gradle --no-daemon :app:assembleDebug
+
+      - name: Unit tests
+        working-directory: android-app
+        run: gradle --no-daemon :app:testDebugUnitTest
+
+      - name: Upload APK
+        uses: actions/upload-artifact@v4
+        with:
+          name: DH-Inspeccion-F2.2.1-0.10.1-debug
+          path: android-app/app/build/outputs/apk/debug/app-debug.apk
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/f2-2-ci.yml

@@ -0,0 +1,136 @@
+name: F2.2 Integration CI
+
+on:
+  push:
+    branches:
+      - 'feature/f2-2*'
+    paths:
+      - 'api-v3/**'
+      - 'web-v2/**'
+      - 'scripts/**'
+      - 'docker-compose.yml'
+      - '.github/workflows/f2-2-ci.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  api:
+    name: API · typecheck, tests, build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: api-v3
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: api-v3/package-lock.json
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm test
+      - run: npm run build
+
+  migrations:
+    name: DB · migrations on PostgreSQL 16/PostGIS
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgis/postgis:16-3.4
+        env:
+          POSTGRES_USER: dhv2_owner
+          POSTGRES_PASSWORD: owner_test_password
+          POSTGRES_DB: dhv2_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U dhv2_owner -d dhv2_ci"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 20
+    env:
+      DB_HOST: 127.0.0.1
+      DB_PORT: 5432
+      DB_NAME: dhv2_ci
+      DB_MIGRATION_USER: dhv2_owner
+      DB_MIGRATION_PASSWORD: owner_test_password
+      DB_APP_USER: dhv2_app
+    defaults:
+      run:
+        working-directory: api-v3
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: api-v3/package-lock.json
+      - name: PostgreSQL client
+        run: |
+          command -v psql >/dev/null || {
+            sudo apt-get update
+            sudo apt-get install -y postgresql-client
+          }
+      - name: Prepare roles and extensions
+        env:
+          PGPASSWORD: owner_test_password
+        run: |
+          psql -v ON_ERROR_STOP=1 -h 127.0.0.1 -U dhv2_owner -d dhv2_ci <<'SQL'
+          CREATE EXTENSION IF NOT EXISTS postgis;
+          CREATE EXTENSION IF NOT EXISTS pgcrypto;
+          DO $$
+          BEGIN
+            IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname='dhv2_app') THEN
+              CREATE ROLE dhv2_app LOGIN PASSWORD 'app_test_password';
+            END IF;
+          END
+          $$;
+          GRANT CONNECT ON DATABASE dhv2_ci TO dhv2_app;
+          GRANT USAGE ON SCHEMA public TO dhv2_app;
+
+          -- This reset was a one-time late production operation. It is marked as
+          -- executed on the clean CI database so the historical schema can be
+          -- constructed chronologically without running that production-only wipe.
+          CREATE TABLE IF NOT EXISTS typeorm_migrations (
+            id SERIAL PRIMARY KEY,
+            timestamp bigint NOT NULL,
+            name varchar NOT NULL
+          );
+          INSERT INTO typeorm_migrations (timestamp,name)
+          VALUES (1788652800000,'ResetProductionOperationalData1788652800000');
+          SQL
+      - run: npm ci
+      - run: npm run build
+      - name: Run every pending migration
+        run: npm run migration:run
+      - name: Assert no pending migrations
+        run: |
+          npm run migration:show | tee /tmp/migrations.txt
+          grep -Fq 'Pending migrations: no' /tmp/migrations.txt
+      - name: Assert F2.2.1 reference import
+        env:
+          PGPASSWORD: owner_test_password
+        run: |
+          test "$(psql -At -h 127.0.0.1 -U dhv2_owner -d dhv2_ci -c "SELECT count(*) FROM assets a JOIN asset_types t ON t.id=a.asset_type_id WHERE a.data_origin='IMPORT' AND a.source_name='Tablas de yacimiento(1).xlsx' AND lower(t.code)='yacimiento'")" = "230"
+          test "$(psql -At -h 127.0.0.1 -U dhv2_owner -d dhv2_ci -c "SELECT count(*) FROM assets WHERE (operational_area_id IS NULL) <> (operator_company_id IS NULL)")" = "0"
+          test "$(psql -At -h 127.0.0.1 -U dhv2_owner -d dhv2_ci -c "SELECT count(*) FROM source_documents WHERE document_number IN ('DH-F221-TERRITORIO','DH-F221-APP')")" = "2"
+
+  web:
+    name: WEB · typecheck, build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web-v2
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: web-v2/package-lock.json
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run build

android-app/app/build.gradle.kts

@@ -0,0 +1,80 @@
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+    id("org.jetbrains.kotlin.plugin.compose")
+}
+
+android {
+    namespace = "com.korexlabs.dhinspeccion"
+    compileSdk = 36
+
+    defaultConfig {
+        applicationId = "com.korexlabs.dhinspeccion"
+        minSdk = 26
+        targetSdk = 36
+        versionCode = 15
+        versionName = "0.10.1"
+
+        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
+        vectorDrawables.useSupportLibrary = true
+        buildConfigField("String", "API_BASE_URL", "\"https://dhv2.korexlabs.com/api/v3/\"")
+    }
+
+    buildTypes {
+        debug {
+            applicationIdSuffix = ".debug"
+            versionNameSuffix = "-debug"
+        }
+        release {
+            isMinifyEnabled = false
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro",
+            )
+            // La firma de release NO se redefine aquí. Se conservará la clave histórica.
+        }
+    }
+
+    buildFeatures {
+        compose = true
+        buildConfig = true
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+    kotlinOptions.jvmTarget = "17"
+
+    packaging.resources.excludes += "/META-INF/{AL2.0,LGPL2.1}"
+}
+
+dependencies {
+    val composeBom = platform("androidx.compose:compose-bom:2025.08.01")
+    implementation(composeBom)
+    androidTestImplementation(composeBom)
+
+    implementation("androidx.core:core-ktx:1.17.0")
+    implementation("androidx.activity:activity-compose:1.10.1")
+    implementation("androidx.fragment:fragment-ktx:1.8.9")
+    implementation("androidx.lifecycle:lifecycle-runtime-ktx:2.9.2")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-compose:2.9.2")
+    implementation("androidx.compose.material3:material3")
+    implementation("androidx.compose.material:material-icons-extended")
+    implementation("androidx.compose.ui:ui")
+    implementation("androidx.compose.ui:ui-tooling-preview")
+    implementation("androidx.biometric:biometric:1.1.0")
+    debugImplementation("androidx.compose.ui:ui-tooling")
+
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.10.2")
+    implementation("com.squareup.retrofit2:retrofit:2.11.0")
+    implementation("com.squareup.retrofit2:converter-moshi:2.11.0")
+    implementation("com.squareup.moshi:moshi-kotlin:1.15.2")
+    implementation("com.squareup.okhttp3:okhttp:4.12.0")
+    implementation("com.google.android.gms:play-services-location:21.3.0")
+    implementation("androidx.exifinterface:exifinterface:1.4.1")
+
+    testImplementation("junit:junit:4.13.2")
+    androidTestImplementation("androidx.test.ext:junit:1.2.1")
+    androidTestImplementation("androidx.test.espresso:espresso-core:3.6.1")
+}

android-app/app/proguard-rules.pro

@@ -0,0 +1 @@
+# DH Inspección V2. Las reglas se ampliarán cuando se habilite minificación de release.

android-app/app/src/main/AndroidManifest.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
+
+    <application
+        android:allowBackup="false"
+        android:label="@string/app_name"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.DHInspeccion"
+        android:usesCleartextTraffic="false">
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.files"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths" />
+        </provider>
+    </application>
+</manifest>

android-app/app/src/main/java/com/korexlabs/dhinspeccion/MainActivity.kt

@@ -0,0 +1,19 @@
+package com.korexlabs.dhinspeccion
+
+import android.os.Bundle
+import androidx.activity.compose.setContent
+import androidx.activity.enableEdgeToEdge
+import androidx.fragment.app.FragmentActivity
+import androidx.lifecycle.viewmodel.compose.viewModel
+import com.korexlabs.dhinspeccion.ui.DhRoot
+
+class MainActivity : FragmentActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        enableEdgeToEdge()
+        setContent {
+            val model: MainViewModel = viewModel()
+            DhRoot(model, this@MainActivity)
+        }
+    }
+}

android-app/app/src/main/java/com/korexlabs/dhinspeccion/MainViewModel.kt

@@ -0,0 +1,209 @@
+package com.korexlabs.dhinspeccion
+
+import android.app.Application
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.lifecycle.AndroidViewModel
+import androidx.lifecycle.viewModelScope
+import com.korexlabs.dhinspeccion.data.CreateFieldInventoryRequest
+import com.korexlabs.dhinspeccion.data.DhRepository
+import com.korexlabs.dhinspeccion.data.FieldAssetDetail
+import com.korexlabs.dhinspeccion.data.FieldInventoryItem
+import com.korexlabs.dhinspeccion.data.FieldType
+import com.korexlabs.dhinspeccion.data.StoredSession
+import com.korexlabs.dhinspeccion.data.VisitDetail
+import com.korexlabs.dhinspeccion.data.VisitSummary
+import kotlinx.coroutines.launch
+import java.io.File
+import java.time.Instant
+
+class MainViewModel(application: Application) : AndroidViewModel(application) {
+    private val repository = DhRepository(application)
+
+    var session: StoredSession? by mutableStateOf(repository.currentSession())
+        private set
+    var busy by mutableStateOf(false)
+        private set
+    var error: String? by mutableStateOf(null)
+        private set
+    var notice: String? by mutableStateOf(null)
+        private set
+
+    var visits: List<VisitSummary> by mutableStateOf(emptyList())
+        private set
+    var visit: VisitDetail? by mutableStateOf(null)
+        private set
+
+    var inventory: List<FieldInventoryItem> by mutableStateOf(emptyList())
+        private set
+    var fieldTypes: List<FieldType> by mutableStateOf(emptyList())
+        private set
+    var selectedFieldAsset: FieldAssetDetail? by mutableStateOf(null)
+        private set
+
+    init {
+        if (session != null) loadVisits()
+    }
+
+    fun clearMessages() {
+        error = null
+        notice = null
+    }
+
+    fun login(identifier: String, password: String) {
+        if (identifier.isBlank() || password.isBlank()) {
+            error = "Ingresá usuario y contraseña."
+            return
+        }
+        launchBusy {
+            session = repository.login(identifier, password)
+            notice = "Sesión iniciada."
+            loadVisitsInternal()
+        }
+    }
+
+    fun logout() {
+        viewModelScope.launch {
+            runCatching { repository.logout() }
+            session = null
+            visits = emptyList()
+            visit = null
+            inventory = emptyList()
+            fieldTypes = emptyList()
+            selectedFieldAsset = null
+        }
+    }
+
+    fun loadVisits() = launchBusy { loadVisitsInternal() }
+
+    private suspend fun loadVisitsInternal() {
+        visits = repository.visits().data
+    }
+
+    fun openVisit(id: String) = launchBusy {
+        visit = repository.visit(id)
+        inventory = emptyList()
+        fieldTypes = emptyList()
+        selectedFieldAsset = null
+    }
+
+    fun closeVisitView() {
+        visit = null
+        inventory = emptyList()
+        fieldTypes = emptyList()
+        selectedFieldAsset = null
+        loadVisits()
+    }
+
+    fun startVisit() {
+        val id = visit?.id ?: return
+        launchBusy {
+            visit = repository.startVisit(id)
+            notice = "Inspección iniciada."
+            loadVisitsInternal()
+        }
+    }
+
+    fun searchInventory(search: String, parentId: String? = null) {
+        val id = visit?.id ?: return
+        launchBusy {
+            inventory = repository.fieldInventory(id, search, parentId).data
+        }
+    }
+
+    fun loadFieldTypes(parentId: String? = null) {
+        val id = visit?.id ?: return
+        launchBusy {
+            fieldTypes = repository.fieldTypes(id, parentId).data
+        }
+    }
+
+    fun selectExisting(item: FieldInventoryItem) {
+        val visitId = visit?.id ?: return
+        launchBusy {
+            selectedFieldAsset = repository.selectFieldAsset(visitId, item.id)
+            notice = "Inventario agregado a la inspección."
+            inventory = repository.fieldInventory(visitId, null, null).data
+        }
+    }
+
+    fun createFieldAsset(
+        type: FieldType,
+        parentId: String?,
+        name: String,
+        commonName: String?,
+        attributes: Map<String, Any?>,
+        latitude: Double,
+        longitude: Double,
+        accuracyM: Double?,
+    ) {
+        val visitId = visit?.id ?: return
+        if (visit?.status != "IN_PROGRESS") {
+            error = "La inspección debe estar en curso para dar de alta Inventario."
+            return
+        }
+        launchBusy {
+            val request = CreateFieldInventoryRequest(
+                typeId = type.id,
+                parentId = parentId,
+                name = name.trim(),
+                commonName = commonName?.trim()?.takeIf { it.isNotBlank() },
+                attributes = attributes,
+                deviceLatitude = latitude,
+                deviceLongitude = longitude,
+                deviceAccuracyM = accuracyM,
+                deviceCapturedAt = Instant.now().toString(),
+            )
+            selectedFieldAsset = repository.createFieldAsset(visitId, request)
+            notice = "Inventario creado con GPS. Falta la fotografía obligatoria."
+            inventory = repository.fieldInventory(visitId, null, null).data
+        }
+    }
+
+    fun uploadFieldPhoto(
+        file: File,
+        latitude: Double,
+        longitude: Double,
+        accuracyM: Double?,
+    ) {
+        val visitId = visit?.id ?: return
+        val asset = selectedFieldAsset?.asset ?: return
+        launchBusy {
+            val response = repository.uploadFieldPhoto(
+                visitId = visitId,
+                assetId = asset.id,
+                file = file,
+                latitude = latitude,
+                longitude = longitude,
+                accuracyM = accuracyM,
+            )
+            selectedFieldAsset = selectedFieldAsset?.copy(capture = response.capture)
+            notice = if (response.capture.readyForFinding) {
+                "Captura completa: GPS y fotografía registrados."
+            } else {
+                "Fotografía registrada."
+            }
+            inventory = repository.fieldInventory(visitId, null, null).data
+        }
+    }
+
+    fun clearSelectedFieldAsset() {
+        selectedFieldAsset = null
+    }
+
+    private fun launchBusy(block: suspend () -> Unit) {
+        viewModelScope.launch {
+            busy = true
+            error = null
+            try {
+                block()
+            } catch (throwable: Throwable) {
+                error = DhRepository.humanError(throwable)
+                if (repository.currentSession() == null) session = null
+            } finally {
+                busy = false
+            }
+        }
+    }
+}

android-app/app/src/main/java/com/korexlabs/dhinspeccion/data/DhMobile.kt

@@ -0,0 +1,531 @@
+package com.korexlabs.dhinspeccion.data
+
+import android.content.Context
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.Base64
+import com.korexlabs.dhinspeccion.BuildConfig
+import com.squareup.moshi.Moshi
+import com.squareup.moshi.kotlin.reflect.KotlinJsonAdapterFactory
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.MultipartBody
+import okhttp3.OkHttpClient
+import okhttp3.RequestBody.Companion.asRequestBody
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONObject
+import retrofit2.HttpException
+import retrofit2.Retrofit
+import retrofit2.converter.moshi.MoshiConverterFactory
+import retrofit2.http.Body
+import retrofit2.http.GET
+import retrofit2.http.Header
+import retrofit2.http.Multipart
+import retrofit2.http.POST
+import retrofit2.http.Part
+import retrofit2.http.Path
+import retrofit2.http.Query
+import java.io.File
+import java.security.KeyStore
+import java.time.Instant
+import java.util.UUID
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+// ---------- Auth ----------
+
+data class LoginRequest(
+    val identifier: String,
+    val password: String,
+    val deviceLabel: String = "DH Android",
+)
+
+data class RefreshRequest(val refreshToken: String)
+
+data class MobileUser(
+    val id: String,
+    val username: String,
+    val firstName: String? = null,
+    val lastName: String? = null,
+    val email: String? = null,
+    val mustChangePassword: Boolean = false,
+    val roles: List<String> = emptyList(),
+    val permissions: List<String> = emptyList(),
+)
+
+data class MobileSessionResponse(
+    val user: MobileUser,
+    val accessToken: String,
+    val refreshToken: String,
+    val accessExpiresInSeconds: Long,
+)
+
+data class StoredSession(
+    val userId: String,
+    val username: String,
+    val displayName: String,
+    val accessToken: String,
+    val refreshToken: String,
+)
+
+// ---------- Inspections ----------
+
+data class AssetSummary(
+    val id: String,
+    val code: String,
+    val name: String,
+    val typeName: String? = null,
+)
+
+data class PersonSummary(
+    val id: String,
+    val username: String? = null,
+    val firstName: String? = null,
+    val lastName: String? = null,
+)
+
+data class VisitSummary(
+    val id: String,
+    val code: String,
+    val title: String? = null,
+    val objective: String? = null,
+    val status: String,
+    val scopeAsset: AssetSummary? = null,
+    val operationalArea: AssetSummary? = null,
+    val operatorCompany: AssetSummary? = null,
+    val leadInspector: PersonSummary? = null,
+    val plannedStartAt: String? = null,
+    val actualStartedAt: String? = null,
+    val actualClosedAt: String? = null,
+    val instructions: String? = null,
+    val checklistGeneration: Int = 0,
+    val assetCount: Int = 0,
+    val memberCount: Int = 0,
+)
+
+data class VisitMeta(
+    val page: Int,
+    val pageSize: Int,
+    val total: Int,
+    val totalPages: Int,
+)
+
+data class VisitListResponse(val data: List<VisitSummary>, val meta: VisitMeta)
+
+data class PlannedAsset(
+    val id: String,
+    val code: String,
+    val name: String,
+    val typeName: String? = null,
+    val included: Boolean = true,
+    val planningSource: String? = null,
+    val exclusionReason: String? = null,
+)
+
+data class ChecklistItem(
+    val id: String,
+    val findingId: String? = null,
+    val findingCode: String? = null,
+    val findingTitle: String? = null,
+    val findingStatus: String? = null,
+    val severity: Int? = null,
+    val itemKind: String? = null,
+    val referenceOn: String? = null,
+    val asset: AssetSummary? = null,
+    val assetIncluded: Boolean = true,
+)
+
+data class ChecklistSummary(
+    val generation: Int = 0,
+    val stale: Boolean = false,
+    val antecedents: Int = 0,
+    val companyOverdue: Int = 0,
+    val verificationOverdue: Int = 0,
+    val upcomingControls: Int = 0,
+    val actionableAssets: Int = 0,
+    val excludedAssets: Int = 0,
+    val items: List<ChecklistItem> = emptyList(),
+)
+
+data class VisitDetail(
+    val id: String,
+    val code: String,
+    val title: String? = null,
+    val objective: String? = null,
+    val status: String,
+    val operationalArea: AssetSummary? = null,
+    val operatorCompany: AssetSummary? = null,
+    val leadInspector: PersonSummary? = null,
+    val plannedStartAt: String? = null,
+    val actualStartedAt: String? = null,
+    val actualClosedAt: String? = null,
+    val instructions: String? = null,
+    val assets: List<AssetSummary> = emptyList(),
+    val planningAssets: List<PlannedAsset> = emptyList(),
+    val team: List<PersonSummary> = emptyList(),
+    val checklist: ChecklistSummary = ChecklistSummary(),
+)
+
+// ---------- Field inventory ----------
+
+data class FieldContext(
+    val visitId: String? = null,
+    val visitCode: String? = null,
+    val areaId: String? = null,
+    val areaCode: String? = null,
+    val areaName: String? = null,
+    val companyId: String? = null,
+    val companyCode: String? = null,
+    val companyName: String? = null,
+)
+
+data class FieldInventoryItem(
+    val id: String,
+    val code: String,
+    val name: String,
+    val commonName: String? = null,
+    val informationStatus: String? = null,
+    val dataOrigin: String? = null,
+    val type: AssetSummary? = null,
+    val parent: AssetSummary? = null,
+    val selectedInInspection: Boolean = false,
+    val captureRequired: Boolean = false,
+    val hasGeometry: Boolean = false,
+    val fieldPhotoCount: Int = 0,
+    val readyForFinding: Boolean = true,
+)
+
+data class FieldInventoryListResponse(
+    val context: FieldContext,
+    val data: List<FieldInventoryItem>,
+)
+
+data class FieldAttributeDefinition(
+    val id: String,
+    val code: String,
+    val name: String,
+    val dataType: String,
+    val isRequired: Boolean = false,
+    val unit: String? = null,
+    val options: Any? = null,
+    val sortOrder: Int = 0,
+)
+
+data class FieldType(
+    val id: String,
+    val code: String,
+    val name: String,
+    val description: String? = null,
+    val attributes: List<FieldAttributeDefinition> = emptyList(),
+)
+
+data class FieldTypeResponse(
+    val context: FieldContext,
+    val parent: AssetSummary,
+    val data: List<FieldType>,
+)
+
+data class CaptureStatus(
+    val captureRequired: Boolean = false,
+    val hasGeometry: Boolean = false,
+    val creationGpsCaptured: Boolean = false,
+    val fieldPhotoCount: Int = 0,
+    val readyForFinding: Boolean = true,
+)
+
+data class FieldAssetDetail(
+    val context: FieldContext? = null,
+    val asset: FieldInventoryItem,
+    val selectedInInspection: Boolean = true,
+    val capture: CaptureStatus = CaptureStatus(),
+)
+
+data class CreateFieldInventoryRequest(
+    val typeId: String,
+    val parentId: String? = null,
+    val code: String? = null,
+    val name: String,
+    val commonName: String? = null,
+    val description: String? = null,
+    val discoveryNotes: String? = null,
+    val attributes: Map<String, Any?>,
+    val deviceLatitude: Double,
+    val deviceLongitude: Double,
+    val deviceAccuracyM: Double? = null,
+    val deviceCapturedAt: String,
+    val deviceLabel: String = "DH Android",
+)
+
+data class FieldPhotoResponse(
+    val capture: CaptureStatus,
+)
+
+interface DhApi {
+    @POST("auth/mobile/login")
+    suspend fun login(@Body request: LoginRequest): MobileSessionResponse
+
+    @POST("auth/mobile/refresh")
+    suspend fun refresh(@Body request: RefreshRequest): MobileSessionResponse
+
+    @POST("auth/mobile/logout")
+    suspend fun logout(@Header("Authorization") authorization: String): Map<String, Any?>
+
+    @GET("inspection-visits")
+    suspend fun visits(
+        @Header("Authorization") authorization: String,
+        @Query("inspectorId") inspectorId: String,
+        @Query("pageSize") pageSize: Int = 100,
+    ): VisitListResponse
+
+    @GET("inspection-visits/{id}")
+    suspend fun visit(
+        @Header("Authorization") authorization: String,
+        @Path("id") id: String,
+    ): VisitDetail
+
+    @POST("inspection-visits/{id}/start")
+    suspend fun startVisit(
+        @Header("Authorization") authorization: String,
+        @Path("id") id: String,
+    ): VisitDetail
+
+    @GET("inspection-visits/{visitId}/field-inventory")
+    suspend fun fieldInventory(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Query("search") search: String? = null,
+        @Query("parentId") parentId: String? = null,
+        @Query("limit") limit: Int = 80,
+    ): FieldInventoryListResponse
+
+    @GET("inspection-visits/{visitId}/field-inventory/types")
+    suspend fun fieldTypes(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Query("parentId") parentId: String? = null,
+    ): FieldTypeResponse
+
+    @POST("inspection-visits/{visitId}/field-inventory/{assetId}/select")
+    suspend fun selectFieldAsset(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Path("assetId") assetId: String,
+    ): FieldAssetDetail
+
+    @POST("inspection-visits/{visitId}/field-inventory")
+    suspend fun createFieldAsset(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Body request: CreateFieldInventoryRequest,
+    ): FieldAssetDetail
+
+    @Multipart
+    @POST("inspection-visits/{visitId}/field-inventory/{assetId}/photos")
+    suspend fun uploadFieldPhoto(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Path("assetId") assetId: String,
+        @Part file: MultipartBody.Part,
+        @Part("deviceLatitude") latitude: okhttp3.RequestBody,
+        @Part("deviceLongitude") longitude: okhttp3.RequestBody,
+        @Part("deviceAccuracyM") accuracy: okhttp3.RequestBody?,
+        @Part("deviceCapturedAt") capturedAt: okhttp3.RequestBody,
+        @Part("deviceLabel") deviceLabel: okhttp3.RequestBody,
+        @Part("exifLatitude") exifLatitude: okhttp3.RequestBody?,
+        @Part("exifLongitude") exifLongitude: okhttp3.RequestBody?,
+        @Part("exifCapturedAt") exifCapturedAt: okhttp3.RequestBody?,
+    ): FieldPhotoResponse
+}
+
+class SecureSessionStore(context: Context) {
+    private val prefs = context.getSharedPreferences("dh_v2_mobile_session", Context.MODE_PRIVATE)
+    private val alias = "dh_v2_mobile_session_key"
+
+    fun load(): StoredSession? {
+        val encoded = prefs.getString("payload", null) ?: return null
+        return runCatching {
+            val parts = encoded.split('.', limit = 2)
+            require(parts.size == 2)
+            val iv = Base64.decode(parts[0], Base64.NO_WRAP)
+            val encrypted = Base64.decode(parts[1], Base64.NO_WRAP)
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+            cipher.init(Cipher.DECRYPT_MODE, key(), GCMParameterSpec(128, iv))
+            val json = JSONObject(String(cipher.doFinal(encrypted), Charsets.UTF_8))
+            StoredSession(
+                userId = json.getString("userId"),
+                username = json.getString("username"),
+                displayName = json.optString("displayName", json.getString("username")),
+                accessToken = json.getString("accessToken"),
+                refreshToken = json.getString("refreshToken"),
+            )
+        }.getOrElse {
+            clear()
+            null
+        }
+    }
+
+    fun save(response: MobileSessionResponse): StoredSession {
+        val displayName = listOfNotNull(response.user.firstName, response.user.lastName)
+            .joinToString(" ").trim().ifBlank { response.user.username }
+        val stored = StoredSession(
+            userId = response.user.id,
+            username = response.user.username,
+            displayName = displayName,
+            accessToken = response.accessToken,
+            refreshToken = response.refreshToken,
+        )
+        val json = JSONObject()
+            .put("userId", stored.userId)
+            .put("username", stored.username)
+            .put("displayName", stored.displayName)
+            .put("accessToken", stored.accessToken)
+            .put("refreshToken", stored.refreshToken)
+            .toString()
+        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        cipher.init(Cipher.ENCRYPT_MODE, key())
+        val encrypted = cipher.doFinal(json.toByteArray(Charsets.UTF_8))
+        val payload = Base64.encodeToString(cipher.iv, Base64.NO_WRAP) + "." +
+            Base64.encodeToString(encrypted, Base64.NO_WRAP)
+        prefs.edit().putString("payload", payload).apply()
+        return stored
+    }
+
+    fun clear() {
+        prefs.edit().clear().apply()
+    }
+
+    private fun key(): SecretKey {
+        val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
+        (keyStore.getKey(alias, null) as? SecretKey)?.let { return it }
+        val generator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore")
+        generator.init(
+            KeyGenParameterSpec.Builder(
+                alias,
+                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
+            )
+                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                .setRandomizedEncryptionRequired(true)
+                .build(),
+        )
+        return generator.generateKey()
+    }
+}
+
+class DhRepository(context: Context) {
+    private val store = SecureSessionStore(context.applicationContext)
+    private val refreshMutex = Mutex()
+    private val moshi = Moshi.Builder().addLast(KotlinJsonAdapterFactory()).build()
+    private val api: DhApi = Retrofit.Builder()
+        .baseUrl(BuildConfig.API_BASE_URL)
+        .client(OkHttpClient.Builder().build())
+        .addConverterFactory(MoshiConverterFactory.create(moshi))
+        .build()
+        .create(DhApi::class.java)
+
+    fun currentSession(): StoredSession? = store.load()
+
+    suspend fun login(identifier: String, password: String): StoredSession =
+        store.save(api.login(LoginRequest(identifier.trim(), password)))
+
+    suspend fun logout() {
+        val session = store.load()
+        if (session != null) runCatching { api.logout("Bearer ${session.accessToken}") }
+        store.clear()
+    }
+
+    suspend fun visits(): VisitListResponse = authorized { session ->
+        api.visits("Bearer ${session.accessToken}", session.userId)
+    }
+
+    suspend fun visit(id: String): VisitDetail = authorized { session ->
+        api.visit("Bearer ${session.accessToken}", id)
+    }
+
+    suspend fun startVisit(id: String): VisitDetail = authorized { session ->
+        api.startVisit("Bearer ${session.accessToken}", id)
+    }
+
+    suspend fun fieldInventory(visitId: String, search: String?, parentId: String? = null) = authorized { session ->
+        api.fieldInventory("Bearer ${session.accessToken}", visitId, search?.takeIf { it.isNotBlank() }, parentId)
+    }
+
+    suspend fun fieldTypes(visitId: String, parentId: String?) = authorized { session ->
+        api.fieldTypes("Bearer ${session.accessToken}", visitId, parentId)
+    }
+
+    suspend fun selectFieldAsset(visitId: String, assetId: String) = authorized { session ->
+        api.selectFieldAsset("Bearer ${session.accessToken}", visitId, assetId)
+    }
+
+    suspend fun createFieldAsset(visitId: String, request: CreateFieldInventoryRequest) = authorized { session ->
+        api.createFieldAsset("Bearer ${session.accessToken}", visitId, request)
+    }
+
+    suspend fun uploadFieldPhoto(
+        visitId: String,
+        assetId: String,
+        file: File,
+        latitude: Double,
+        longitude: Double,
+        accuracyM: Double?,
+        capturedAt: String = Instant.now().toString(),
+    ): FieldPhotoResponse = authorized { session ->
+        val text = "text/plain".toMediaType()
+        val body = file.asRequestBody("image/jpeg".toMediaType())
+        val part = MultipartBody.Part.createFormData("file", file.name, body)
+        api.uploadFieldPhoto(
+            authorization = "Bearer ${session.accessToken}",
+            visitId = visitId,
+            assetId = assetId,
+            file = part,
+            latitude = latitude.toString().toRequestBody(text),
+            longitude = longitude.toString().toRequestBody(text),
+            accuracy = accuracyM?.toString()?.toRequestBody(text),
+            capturedAt = capturedAt.toRequestBody(text),
+            deviceLabel = "DH Android".toRequestBody(text),
+            exifLatitude = latitude.toString().toRequestBody(text),
+            exifLongitude = longitude.toString().toRequestBody(text),
+            exifCapturedAt = capturedAt.toRequestBody(text),
+        )
+    }
+
+    private suspend fun <T> authorized(block: suspend (StoredSession) -> T): T {
+        var session = store.load() ?: throw IllegalStateException("Sesión no iniciada")
+        try {
+            return block(session)
+        } catch (error: HttpException) {
+            if (error.code() != 401) throw error
+        }
+        session = refresh(session.refreshToken)
+        return block(session)
+    }
+
+    private suspend fun refresh(previousRefreshToken: String): StoredSession = refreshMutex.withLock {
+        val latest = store.load() ?: throw IllegalStateException("Sesión no iniciada")
+        if (latest.refreshToken != previousRefreshToken) return@withLock latest
+        try {
+            store.save(api.refresh(RefreshRequest(previousRefreshToken)))
+        } catch (error: Throwable) {
+            store.clear()
+            throw error
+        }
+    }
+
+    companion object {
+        fun humanError(error: Throwable): String {
+            if (error is HttpException) {
+                val body = runCatching { error.response()?.errorBody()?.string() }.getOrNull()
+                val message = runCatching { JSONObject(body.orEmpty()).optString("message") }.getOrNull()
+                if (!message.isNullOrBlank()) return message
+                return "Error HTTP ${error.code()}"
+            }
+            return error.message ?: "Ocurrió un error inesperado"
+        }
+
+        fun newOperationId(): String = UUID.randomUUID().toString()
+    }
+}

android-app/app/src/main/java/com/korexlabs/dhinspeccion/ui/DhApp.kt

@@ -0,0 +1,579 @@
+package com.korexlabs.dhinspeccion.ui
+
+import android.Manifest
+import android.content.Context
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Environment
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.LazyRow
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.AssistChip
+import androidx.compose.material3.Button
+import androidx.compose.material3.Card
+import androidx.compose.material3.CardDefaults
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateMapOf
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.unit.dp
+import androidx.core.content.ContextCompat
+import androidx.core.content.FileProvider
+import androidx.exifinterface.media.ExifInterface
+import com.google.android.gms.location.LocationServices
+import com.google.android.gms.location.Priority
+import com.google.android.gms.tasks.CancellationTokenSource
+import com.korexlabs.dhinspeccion.MainViewModel
+import com.korexlabs.dhinspeccion.data.FieldAttributeDefinition
+import com.korexlabs.dhinspeccion.data.FieldInventoryItem
+import com.korexlabs.dhinspeccion.data.FieldType
+import com.korexlabs.dhinspeccion.data.VisitDetail
+import com.korexlabs.dhinspeccion.data.VisitSummary
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.suspendCancellableCoroutine
+import java.io.File
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+
+private data class GeoSnapshot(
+    val latitude: Double,
+    val longitude: Double,
+    val accuracyM: Double?,
+)
+
+@Composable
+fun DhApp(model: MainViewModel) {
+    MaterialTheme {
+        Surface(modifier = Modifier.fillMaxSize()) {
+            when {
+                model.session == null -> LoginScreen(model)
+                model.visit == null -> VisitsScreen(model)
+                else -> VisitRouter(model)
+            }
+        }
+    }
+}
+
+@Composable
+private fun MessageStrip(model: MainViewModel) {
+    val error = model.error
+    val notice = model.notice
+    if (error != null || notice != null) {
+        Card(
+            modifier = Modifier.fillMaxWidth().padding(bottom = 12.dp),
+            colors = CardDefaults.cardColors(
+                containerColor = if (error != null) MaterialTheme.colorScheme.errorContainer
+                else MaterialTheme.colorScheme.secondaryContainer,
+            ),
+            onClick = { model.clearMessages() },
+        ) {
+            Text(
+                text = error ?: notice.orEmpty(),
+                modifier = Modifier.padding(12.dp),
+            )
+        }
+    }
+}
+
+@Composable
+private fun LoginScreen(model: MainViewModel) {
+    var identifier by rememberSaveable { mutableStateOf("") }
+    var password by rememberSaveable { mutableStateOf("") }
+
+    Box(Modifier.fillMaxSize().padding(24.dp), contentAlignment = Alignment.Center) {
+        Column(Modifier.fillMaxWidth(), verticalArrangement = Arrangement.spacedBy(14.dp)) {
+            Text("DH Inspección", style = MaterialTheme.typography.headlineMedium, fontWeight = FontWeight.Bold)
+            Text("Aplicación de campo · Dirección de Hidrocarburos")
+            MessageStrip(model)
+            OutlinedTextField(
+                value = identifier,
+                onValueChange = { identifier = it },
+                label = { Text("Usuario o email") },
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+            )
+            OutlinedTextField(
+                value = password,
+                onValueChange = { password = it },
+                label = { Text("Contraseña") },
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+                visualTransformation = PasswordVisualTransformation(),
+            )
+            Button(
+                onClick = { model.login(identifier, password) },
+                modifier = Modifier.fillMaxWidth(),
+                enabled = !model.busy,
+            ) {
+                if (model.busy) CircularProgressIndicator(modifier = Modifier.width(20.dp).height(20.dp))
+                else Text("Ingresar")
+            }
+            Text(
+                "El acceso móvil está reservado a usuarios con rol Inspector.",
+                style = MaterialTheme.typography.bodySmall,
+            )
+        }
+    }
+}
+
+@Composable
+private fun VisitsScreen(model: MainViewModel) {
+    val session = model.session ?: return
+    Column(Modifier.fillMaxSize().padding(top = 28.dp)) {
+        Row(
+            Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 10.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.SpaceBetween,
+        ) {
+            Column {
+                Text("Mis inspecciones", style = MaterialTheme.typography.headlineSmall, fontWeight = FontWeight.Bold)
+                Text(session.displayName, style = MaterialTheme.typography.bodySmall)
+            }
+            Row {
+                OutlinedButton(onClick = { model.loadVisits() }, enabled = !model.busy) { Text("Actualizar") }
+                Spacer(Modifier.width(8.dp))
+                OutlinedButton(onClick = { model.logout() }) { Text("Salir") }
+            }
+        }
+        Column(Modifier.padding(horizontal = 16.dp)) { MessageStrip(model) }
+        if (model.busy && model.visits.isEmpty()) {
+            Box(Modifier.fillMaxSize(), contentAlignment = Alignment.Center) { CircularProgressIndicator() }
+        } else if (model.visits.isEmpty()) {
+            Box(Modifier.fillMaxSize(), contentAlignment = Alignment.Center) {
+                Text("No tenés inspecciones asignadas.")
+            }
+        } else {
+            LazyColumn(
+                Modifier.fillMaxSize().padding(horizontal = 16.dp),
+                verticalArrangement = Arrangement.spacedBy(10.dp),
+            ) {
+                items(model.visits, key = { it.id }) { visit ->
+                    VisitCard(visit) { model.openVisit(visit.id) }
+                }
+                item { Spacer(Modifier.height(24.dp)) }
+            }
+        }
+    }
+}
+
+@Composable
+private fun VisitCard(visit: VisitSummary, onOpen: () -> Unit) {
+    Card(onClick = onOpen, modifier = Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(14.dp), verticalArrangement = Arrangement.spacedBy(5.dp)) {
+            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween) {
+                Text(visit.code, fontWeight = FontWeight.Bold)
+                Text(visit.status)
+            }
+            Text(visit.operatorCompany?.name ?: "Operadora sin definir")
+            Text(visit.operationalArea?.name ?: "Área sin definir", style = MaterialTheme.typography.bodySmall)
+            visit.plannedStartAt?.let { Text("Prevista: ${shortDate(it)}", style = MaterialTheme.typography.bodySmall) }
+            Text("Inventario: ${visit.assetCount} · Equipo inspector: ${visit.memberCount}", style = MaterialTheme.typography.bodySmall)
+        }
+    }
+}
+
+@Composable
+private fun VisitRouter(model: MainViewModel) {
+    var inventoryMode by rememberSaveable(model.visit?.id) { mutableStateOf(false) }
+    if (inventoryMode) {
+        FieldInventoryScreen(model) { inventoryMode = false }
+    } else {
+        VisitScreen(model) { inventoryMode = true }
+    }
+}
+
+@Composable
+private fun VisitScreen(model: MainViewModel, onInventory: () -> Unit) {
+    val visit = model.visit ?: return
+    Column(
+        Modifier.fillMaxSize().verticalScroll(rememberScrollState()).padding(top = 28.dp, start = 16.dp, end = 16.dp, bottom = 30.dp),
+        verticalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween, verticalAlignment = Alignment.CenterVertically) {
+            OutlinedButton(onClick = { model.closeVisitView() }) { Text("Volver") }
+            Text(visit.status, fontWeight = FontWeight.Bold)
+        }
+        Text(visit.code, style = MaterialTheme.typography.headlineMedium, fontWeight = FontWeight.Bold)
+        Text("${visit.operatorCompany?.name ?: "Sin operadora"} · ${visit.operationalArea?.name ?: "Sin área"}")
+        visit.instructions?.takeIf { it.isNotBlank() }?.let {
+            Card(Modifier.fillMaxWidth()) { Column(Modifier.padding(12.dp)) { Text("Instrucciones", fontWeight = FontWeight.Bold); Text(it) } }
+        }
+        MessageStrip(model)
+
+        if (visit.status == "PLANNED") {
+            Button(onClick = { model.startVisit() }, enabled = !model.busy, modifier = Modifier.fillMaxWidth()) {
+                Text("Iniciar inspección")
+            }
+        }
+        if (visit.status == "PLANNED" || visit.status == "IN_PROGRESS") {
+            OutlinedButton(onClick = onInventory, modifier = Modifier.fillMaxWidth()) { Text("Inventario de campo") }
+        }
+
+        ChecklistCard(visit)
+
+        Text("Inventario planificado", style = MaterialTheme.typography.titleMedium, fontWeight = FontWeight.Bold)
+        if (visit.planningAssets.isEmpty()) Text("Sin elementos planificados.")
+        visit.planningAssets.filter { it.included }.forEach { asset ->
+            Card(Modifier.fillMaxWidth()) {
+                Column(Modifier.padding(10.dp)) {
+                    Text(asset.name, fontWeight = FontWeight.SemiBold)
+                    Text("${asset.code} · ${asset.typeName.orEmpty()}", style = MaterialTheme.typography.bodySmall)
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun ChecklistCard(visit: VisitDetail) {
+    val checklist = visit.checklist
+    Card(Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
+            Text("Checklist de antecedentes", fontWeight = FontWeight.Bold)
+            Text("Vencidos empresa: ${checklist.companyOverdue} · Verificaciones vencidas: ${checklist.verificationOverdue}")
+            Text("Antecedentes: ${checklist.antecedents} · Próximos controles: ${checklist.upcomingControls}")
+            if (checklist.stale) Text("El checklist requiere revisión/actualización.", color = MaterialTheme.colorScheme.error)
+            checklist.items.take(10).forEach { item ->
+                HorizontalDivider()
+                Text(item.findingTitle ?: item.findingCode ?: "Hallazgo", fontWeight = FontWeight.SemiBold)
+                Text("${item.asset?.name.orEmpty()} · Gravedad ${item.severity ?: "s/d"}", style = MaterialTheme.typography.bodySmall)
+            }
+        }
+    }
+}
+
+@Composable
+private fun FieldInventoryScreen(model: MainViewModel, onBack: () -> Unit) {
+    val context = LocalContext.current
+    val scope = rememberCoroutineScope()
+    val visit = model.visit ?: return
+    var search by rememberSaveable { mutableStateOf("") }
+    var showCreate by rememberSaveable { mutableStateOf(false) }
+    var parentId by rememberSaveable { mutableStateOf<String?>(null) }
+    var parentLabel by rememberSaveable { mutableStateOf("Área de la inspección") }
+    var name by rememberSaveable { mutableStateOf("") }
+    var commonName by rememberSaveable { mutableStateOf("") }
+    var selectedTypeId by rememberSaveable { mutableStateOf<String?>(null) }
+    val attributeValues = remember { mutableStateMapOf<String, String>() }
+
+    LaunchedEffect(visit.id) {
+        model.searchInventory("")
+        model.loadFieldTypes(null)
+    }
+    LaunchedEffect(model.fieldTypes) {
+        if (model.fieldTypes.none { it.id == selectedTypeId }) {
+            selectedTypeId = model.fieldTypes.firstOrNull()?.id
+            attributeValues.clear()
+        }
+    }
+
+    val selectedType = model.fieldTypes.firstOrNull { it.id == selectedTypeId }
+
+    val createWithLocation: () -> Unit = {
+        val type = selectedType
+        if (type != null) {
+            scope.launch {
+                runCatching { currentGeo(context) }
+                    .onSuccess { geo ->
+                        val values = buildAttributes(type, attributeValues)
+                        model.createFieldAsset(type, parentId, name, commonName, values, geo.latitude, geo.longitude, geo.accuracyM)
+                    }
+            }
+        }
+    }
+    val locationPermissionLauncher = rememberLauncherForActivityResult(ActivityResultContracts.RequestMultiplePermissions()) { result ->
+        val allowed = result[Manifest.permission.ACCESS_FINE_LOCATION] == true || result[Manifest.permission.ACCESS_COARSE_LOCATION] == true
+        if (allowed) createWithLocation()
+    }
+
+    var pendingPhotoFile by remember { mutableStateOf<File?>(null) }
+    var pendingPhotoGeo by remember { mutableStateOf<GeoSnapshot?>(null) }
+    val takePicture = rememberLauncherForActivityResult(ActivityResultContracts.TakePicture()) { success ->
+        val file = pendingPhotoFile
+        val geo = pendingPhotoGeo
+        if (success && file != null && geo != null) {
+            runCatching { writeExif(file, geo) }
+            model.uploadFieldPhoto(file, geo.latitude, geo.longitude, geo.accuracyM)
+        }
+        pendingPhotoFile = null
+        pendingPhotoGeo = null
+    }
+    val beginPhoto: () -> Unit = {
+        scope.launch {
+            runCatching { currentGeo(context) }.onSuccess { geo ->
+                val (file, uri) = newPhoto(context)
+                pendingPhotoFile = file
+                pendingPhotoGeo = geo
+                takePicture.launch(uri)
+            }
+        }
+    }
+    val photoPermissionLauncher = rememberLauncherForActivityResult(ActivityResultContracts.RequestMultiplePermissions()) { result ->
+        val camera = result[Manifest.permission.CAMERA] == true || hasPermission(context, Manifest.permission.CAMERA)
+        val location = result[Manifest.permission.ACCESS_FINE_LOCATION] == true || result[Manifest.permission.ACCESS_COARSE_LOCATION] == true || hasLocation(context)
+        if (camera && location) beginPhoto()
+    }
+
+    Column(Modifier.fillMaxSize().padding(top = 28.dp)) {
+        Row(Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp), horizontalArrangement = Arrangement.SpaceBetween) {
+            OutlinedButton(onClick = onBack) { Text("Volver") }
+            Text("Inventario de campo", style = MaterialTheme.typography.titleLarge, fontWeight = FontWeight.Bold)
+        }
+        Column(Modifier.padding(horizontal = 16.dp)) { MessageStrip(model) }
+
+        val selectedCapture = model.selectedFieldAsset
+        if (selectedCapture != null) {
+            CaptureCard(
+                detailName = selectedCapture.asset.name,
+                captureRequired = selectedCapture.capture.captureRequired,
+                gps = selectedCapture.capture.creationGpsCaptured,
+                photos = selectedCapture.capture.fieldPhotoCount,
+                ready = selectedCapture.capture.readyForFinding,
+                onPhoto = {
+                    val permissions = arrayOf(Manifest.permission.CAMERA, Manifest.permission.ACCESS_FINE_LOCATION, Manifest.permission.ACCESS_COARSE_LOCATION)
+                    if (hasPermission(context, Manifest.permission.CAMERA) && hasLocation(context)) beginPhoto()
+                    else photoPermissionLauncher.launch(permissions)
+                },
+                onClose = { model.clearSelectedFieldAsset() },
+            )
+        }
+
+        Row(Modifier.fillMaxWidth().padding(horizontal = 16.dp), verticalAlignment = Alignment.CenterVertically) {
+            OutlinedTextField(
+                value = search,
+                onValueChange = { search = it },
+                label = { Text("Buscar por nombre, código o atributo") },
+                modifier = Modifier.weight(1f),
+                singleLine = true,
+            )
+            Spacer(Modifier.width(8.dp))
+            Button(onClick = { model.searchInventory(search) }, enabled = !model.busy) { Text("Buscar") }
+        }
+        if (visit.status == "IN_PROGRESS") {
+            Row(Modifier.fillMaxWidth().padding(16.dp), horizontalArrangement = Arrangement.SpaceBetween) {
+                Text("Alta en campo", fontWeight = FontWeight.Bold)
+                OutlinedButton(onClick = {
+                    showCreate = !showCreate
+                    if (showCreate) model.loadFieldTypes(parentId)
+                }) { Text(if (showCreate) "Ocultar" else "Crear nuevo") }
+            }
+        }
+
+        if (showCreate && visit.status == "IN_PROGRESS") {
+            Column(
+                Modifier.fillMaxWidth().padding(horizontal = 16.dp).verticalScroll(rememberScrollState()).weight(1f, fill = false),
+                verticalArrangement = Arrangement.spacedBy(10.dp),
+            ) {
+                Text("Padre: $parentLabel", style = MaterialTheme.typography.bodySmall)
+                if (parentId != null) {
+                    OutlinedButton(onClick = {
+                        parentId = null
+                        parentLabel = "Área de la inspección"
+                        model.loadFieldTypes(null)
+                    }) { Text("Volver al Área") }
+                }
+                if (model.fieldTypes.isEmpty()) Text("No hay tipos habilitados debajo de este padre.")
+                LazyRow(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    items(model.fieldTypes, key = { it.id }) { type ->
+                        AssistChip(
+                            onClick = { selectedTypeId = type.id; attributeValues.clear() },
+                            label = { Text(if (type.id == selectedTypeId) "✓ ${type.name}" else type.name) },
+                        )
+                    }
+                }
+                OutlinedTextField(name, { name = it }, label = { Text("Nombre o código identificable *") }, modifier = Modifier.fillMaxWidth())
+                OutlinedTextField(commonName, { commonName = it }, label = { Text("Nombre común") }, modifier = Modifier.fillMaxWidth())
+                selectedType?.attributes?.forEach { definition ->
+                    OutlinedTextField(
+                        value = attributeValues[definition.code].orEmpty(),
+                        onValueChange = { attributeValues[definition.code] = it },
+                        label = { Text(definition.name + if (definition.isRequired) " *" else "") },
+                        supportingText = {
+                            val details = listOfNotNull(definition.unit, definition.options?.toString()).joinToString(" · ")
+                            if (details.isNotBlank()) Text(details)
+                        },
+                        keyboardOptions = KeyboardOptions(
+                            keyboardType = if (definition.dataType.uppercase() in setOf("NUMBER", "DECIMAL", "INTEGER", "FLOAT")) KeyboardType.Decimal else KeyboardType.Text,
+                        ),
+                        modifier = Modifier.fillMaxWidth(),
+                    )
+                }
+                val requiredReady = selectedType?.attributes?.filter { it.isRequired }?.all { attributeValues[it.code].orEmpty().isNotBlank() } ?: false
+                Button(
+                    onClick = {
+                        if (hasLocation(context)) createWithLocation()
+                        else locationPermissionLauncher.launch(arrayOf(Manifest.permission.ACCESS_FINE_LOCATION, Manifest.permission.ACCESS_COARSE_LOCATION))
+                    },
+                    enabled = selectedType != null && name.isNotBlank() && requiredReady && !model.busy,
+                    modifier = Modifier.fillMaxWidth(),
+                ) { Text("Capturar GPS y crear") }
+                HorizontalDivider()
+            }
+        }
+
+        Text("Resultados", modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp), fontWeight = FontWeight.Bold)
+        LazyColumn(
+            Modifier.fillMaxSize().padding(horizontal = 16.dp),
+            verticalArrangement = Arrangement.spacedBy(8.dp),
+        ) {
+            items(model.inventory, key = { it.id }) { item ->
+                InventoryCard(
+                    item = item,
+                    canModify = visit.status == "IN_PROGRESS",
+                    onSelect = { model.selectExisting(item) },
+                    onUseParent = {
+                        parentId = item.id
+                        parentLabel = "${item.name} (${item.code})"
+                        showCreate = true
+                        selectedTypeId = null
+                        model.loadFieldTypes(item.id)
+                    },
+                )
+            }
+            item { Spacer(Modifier.height(30.dp)) }
+        }
+    }
+}
+
+@Composable
+private fun CaptureCard(
+    detailName: String,
+    captureRequired: Boolean,
+    gps: Boolean,
+    photos: Int,
+    ready: Boolean,
+    onPhoto: () -> Unit,
+    onClose: () -> Unit,
+) {
+    Card(Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp)) {
+        Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
+            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween) {
+                Text(detailName, fontWeight = FontWeight.Bold)
+                OutlinedButton(onClick = onClose) { Text("Cerrar") }
+            }
+            Text("GPS de alta: ${if (gps) "OK" else "pendiente"} · Fotos: $photos")
+            if (captureRequired && !ready) {
+                Text("El Hallazgo permanece bloqueado hasta completar GPS + foto.", color = MaterialTheme.colorScheme.error)
+                Button(onClick = onPhoto, modifier = Modifier.fillMaxWidth()) { Text("Tomar foto obligatoria") }
+            } else if (ready) {
+                Text("Captura completa · habilitado para Hallazgos", color = MaterialTheme.colorScheme.primary)
+            }
+        }
+    }
+}
+
+@Composable
+private fun InventoryCard(item: FieldInventoryItem, canModify: Boolean, onSelect: () -> Unit, onUseParent: () -> Unit) {
+    Card(Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(4.dp)) {
+            Text(item.name, fontWeight = FontWeight.SemiBold)
+            Text("${item.code} · ${item.type?.name.orEmpty()}", style = MaterialTheme.typography.bodySmall)
+            item.commonName?.let { Text(it, style = MaterialTheme.typography.bodySmall) }
+            Text(
+                if (item.readyForFinding) "Listo" else "Captura incompleta: GPS/foto pendiente",
+                color = if (item.readyForFinding) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.error,
+                style = MaterialTheme.typography.bodySmall,
+            )
+            if (canModify) {
+                Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    OutlinedButton(onClick = onSelect) { Text(if (item.selectedInInspection) "Abrir" else "Seleccionar") }
+                    OutlinedButton(onClick = onUseParent) { Text("Crear hijo") }
+                }
+            }
+        }
+    }
+}
+
+private fun buildAttributes(type: FieldType, values: Map<String, String>): Map<String, Any?> =
+    type.attributes.mapNotNull { definition ->
+        val raw = values[definition.code]?.trim().orEmpty()
+        if (raw.isBlank()) return@mapNotNull null
+        definition.code to coerceAttribute(definition, raw)
+    }.toMap()
+
+private fun coerceAttribute(definition: FieldAttributeDefinition, raw: String): Any = when (definition.dataType.uppercase()) {
+    "INTEGER", "INT" -> raw.toLongOrNull() ?: raw
+    "NUMBER", "DECIMAL", "FLOAT", "DOUBLE" -> raw.replace(',', '.').toDoubleOrNull() ?: raw
+    "BOOLEAN", "BOOL" -> raw.lowercase() in setOf("true", "1", "si", "sí", "yes")
+    else -> raw
+}
+
+private fun hasPermission(context: Context, permission: String): Boolean =
+    ContextCompat.checkSelfPermission(context, permission) == PackageManager.PERMISSION_GRANTED
+
+private fun hasLocation(context: Context): Boolean =
+    hasPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) || hasPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION)
+
+private suspend fun currentGeo(context: Context): GeoSnapshot = suspendCancellableCoroutine { continuation ->
+    if (!hasLocation(context)) {
+        continuation.resumeWithException(SecurityException("Se necesita permiso de ubicación."))
+        return@suspendCancellableCoroutine
+    }
+    val source = CancellationTokenSource()
+    val client = LocationServices.getFusedLocationProviderClient(context)
+    client.getCurrentLocation(Priority.PRIORITY_HIGH_ACCURACY, source.token)
+        .addOnSuccessListener { location ->
+            if (!continuation.isActive) return@addOnSuccessListener
+            if (location == null) continuation.resumeWithException(IllegalStateException("No se pudo obtener una ubicación GPS actual."))
+            else continuation.resume(GeoSnapshot(location.latitude, location.longitude, location.accuracy.toDouble()))
+        }
+        .addOnFailureListener { if (continuation.isActive) continuation.resumeWithException(it) }
+    continuation.invokeOnCancellation { source.cancel() }
+}
+
+private fun newPhoto(context: Context): Pair<File, Uri> {
+    val directory = context.getExternalFilesDir(Environment.DIRECTORY_PICTURES)
+        ?: throw IllegalStateException("No se pudo acceder al almacenamiento de fotografías.")
+    directory.mkdirs()
+    val file = File.createTempFile("DH_${System.currentTimeMillis()}_", ".jpg", directory)
+    val uri = FileProvider.getUriForFile(context, "${context.packageName}.files", file)
+    return file to uri
+}
+
+private fun writeExif(file: File, geo: GeoSnapshot) {
+    val now = Instant.now()
+    val exif = ExifInterface(file)
+    exif.setLatLong(geo.latitude, geo.longitude)
+    val formatter = DateTimeFormatter.ofPattern("yyyy:MM:dd HH:mm:ss").withZone(ZoneId.systemDefault())
+    exif.setAttribute(ExifInterface.TAG_DATETIME_ORIGINAL, formatter.format(now))
+    exif.setAttribute(ExifInterface.TAG_DATETIME_DIGITIZED, formatter.format(now))
+    exif.saveAttributes()
+}
+
+private fun shortDate(value: String): String = value.replace('T', ' ').take(16)

android-app/app/src/main/java/com/korexlabs/dhinspeccion/ui/LoginGate.kt

@@ -0,0 +1,202 @@
+package com.korexlabs.dhinspeccion.ui
+
+import android.content.Context
+import androidx.biometric.BiometricManager
+import androidx.biometric.BiometricPrompt
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Visibility
+import androidx.compose.material.icons.filled.VisibilityOff
+import androidx.compose.material3.Button
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.input.VisualTransformation
+import androidx.compose.ui.unit.dp
+import androidx.core.content.ContextCompat
+import androidx.fragment.app.FragmentActivity
+import com.korexlabs.dhinspeccion.MainViewModel
+
+private const val BIOMETRIC_PREFS = "dh_v2_biometric"
+private const val BIOMETRIC_ENABLED = "enabled"
+
+private fun biometricAvailable(context: Context): Boolean =
+    BiometricManager.from(context).canAuthenticate(BiometricManager.Authenticators.BIOMETRIC_STRONG) ==
+        BiometricManager.BIOMETRIC_SUCCESS
+
+private fun biometricEnabled(context: Context): Boolean =
+    context.getSharedPreferences(BIOMETRIC_PREFS, Context.MODE_PRIVATE)
+        .getBoolean(BIOMETRIC_ENABLED, false)
+
+private fun setBiometricEnabled(context: Context, enabled: Boolean) {
+    context.getSharedPreferences(BIOMETRIC_PREFS, Context.MODE_PRIVATE)
+        .edit().putBoolean(BIOMETRIC_ENABLED, enabled).apply()
+}
+
+@Composable
+fun DhRoot(model: MainViewModel, activity: FragmentActivity) {
+    val context = LocalContext.current
+    val capable = remember { biometricAvailable(context) }
+    var unlocked by rememberSaveable { mutableStateOf(false) }
+    var passwordLoginInFlight by rememberSaveable { mutableStateOf(false) }
+    var enabled by remember { mutableStateOf(biometricEnabled(context)) }
+
+    LaunchedEffect(model.session) {
+        if (model.session != null && passwordLoginInFlight) {
+            if (capable) {
+                setBiometricEnabled(context, true)
+                enabled = true
+            }
+            unlocked = true
+            passwordLoginInFlight = false
+        }
+        if (model.session == null) unlocked = false
+    }
+
+    MaterialTheme {
+        Surface(Modifier.fillMaxSize()) {
+            when {
+                model.session == null -> EnhancedLoginScreen(model) {
+                    passwordLoginInFlight = true
+                }
+                enabled && capable && !unlocked -> BiometricUnlockScreen(
+                    activity = activity,
+                    displayName = model.session?.displayName.orEmpty(),
+                    onAuthenticated = { unlocked = true },
+                    onUsePassword = {
+                        setBiometricEnabled(context, false)
+                        enabled = false
+                        model.logout()
+                    },
+                )
+                else -> DhApp(model)
+            }
+        }
+    }
+}
+
+@Composable
+private fun EnhancedLoginScreen(model: MainViewModel, onPasswordLogin: () -> Unit) {
+    var identifier by rememberSaveable { mutableStateOf("") }
+    var password by rememberSaveable { mutableStateOf("") }
+    var passwordVisible by rememberSaveable { mutableStateOf(false) }
+
+    Box(Modifier.fillMaxSize().padding(24.dp), contentAlignment = Alignment.Center) {
+        Column(Modifier.fillMaxWidth(), verticalArrangement = Arrangement.spacedBy(14.dp)) {
+            Text("DH Inspección", style = MaterialTheme.typography.headlineMedium, fontWeight = FontWeight.Bold)
+            Text("Aplicación de campo · Dirección de Hidrocarburos")
+            model.error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+            model.notice?.let { Text(it, color = MaterialTheme.colorScheme.primary) }
+            OutlinedTextField(
+                value = identifier,
+                onValueChange = { identifier = it },
+                label = { Text("Usuario o email") },
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+            )
+            OutlinedTextField(
+                value = password,
+                onValueChange = { password = it },
+                label = { Text("Contraseña") },
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+                visualTransformation = if (passwordVisible) VisualTransformation.None else PasswordVisualTransformation(),
+                trailingIcon = {
+                    IconButton(onClick = { passwordVisible = !passwordVisible }) {
+                        Icon(
+                            imageVector = if (passwordVisible) Icons.Filled.VisibilityOff else Icons.Filled.Visibility,
+                            contentDescription = if (passwordVisible) "Ocultar contraseña" else "Mostrar contraseña",
+                        )
+                    }
+                },
+            )
+            Button(
+                onClick = {
+                    onPasswordLogin()
+                    model.login(identifier, password)
+                },
+                modifier = Modifier.fillMaxWidth(),
+                enabled = !model.busy,
+            ) { Text(if (model.busy) "Ingresando…" else "Ingresar") }
+            Text(
+                "Después del primer ingreso correcto, si la tablet tiene una huella fuerte configurada, se habilita el acceso biométrico. La contraseña no se almacena.",
+                style = MaterialTheme.typography.bodySmall,
+            )
+        }
+    }
+}
+
+@Composable
+private fun BiometricUnlockScreen(
+    activity: FragmentActivity,
+    displayName: String,
+    onAuthenticated: () -> Unit,
+    onUsePassword: () -> Unit,
+) {
+    var error by rememberSaveable { mutableStateOf<String?>(null) }
+
+    fun authenticate() {
+        val executor = ContextCompat.getMainExecutor(activity)
+        val prompt = BiometricPrompt(
+            activity,
+            executor,
+            object : BiometricPrompt.AuthenticationCallback() {
+                override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
+                    super.onAuthenticationSucceeded(result)
+                    error = null
+                    onAuthenticated()
+                }
+
+                override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
+                    super.onAuthenticationError(errorCode, errString)
+                    error = errString.toString()
+                }
+
+                override fun onAuthenticationFailed() {
+                    super.onAuthenticationFailed()
+                    error = "Huella no reconocida."
+                }
+            },
+        )
+        val info = BiometricPrompt.PromptInfo.Builder()
+            .setTitle("Ingresar a DH Inspección")
+            .setSubtitle(if (displayName.isBlank()) "Validá tu identidad" else "Hola, $displayName")
+            .setNegativeButtonText("Usar contraseña")
+            .setAllowedAuthenticators(BiometricManager.Authenticators.BIOMETRIC_STRONG)
+            .build()
+        prompt.authenticate(info)
+    }
+
+    LaunchedEffect(Unit) { authenticate() }
+
+    Box(Modifier.fillMaxSize().padding(24.dp), contentAlignment = Alignment.Center) {
+        Column(Modifier.fillMaxWidth(), verticalArrangement = Arrangement.spacedBy(14.dp), horizontalAlignment = Alignment.CenterHorizontally) {
+            Text("DH Inspección", style = MaterialTheme.typography.headlineMedium, fontWeight = FontWeight.Bold)
+            Text("Ingresá con tu huella")
+            error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+            Button(onClick = { authenticate() }, modifier = Modifier.fillMaxWidth()) { Text("Usar huella") }
+            OutlinedButton(onClick = onUsePassword, modifier = Modifier.fillMaxWidth()) { Text("Ingresar con contraseña") }
+        }
+    }
+}

android-app/app/src/main/res/values/strings.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">DH Inspección</string>
+</resources>

android-app/app/src/main/res/values/styles.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <style name="Theme.DHInspeccion" parent="android:style/Theme.Material.Light.NoActionBar">
+        <item name="android:fontFamily">sans</item>
+        <item name="android:windowActionModeOverlay">true</item>
+        <item name="android:colorAccent">#1B5E20</item>
+        <item name="android:navigationBarColor">#FFFFFF</item>
+        <item name="android:statusBarColor">#FFFFFF</item>
+        <item name="android:windowLightStatusBar">true</item>
+    </style>
+</resources>

android-app/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths xmlns:android="http://schemas.android.com/apk/res/android">
+    <external-files-path name="inspection_photos" path="Pictures/" />
+</paths>

android-app/build.gradle.kts

@@ -0,0 +1,5 @@
+plugins {
+    id("com.android.application") version "8.13.2" apply false
+    id("org.jetbrains.kotlin.android") version "2.2.20" apply false
+    id("org.jetbrains.kotlin.plugin.compose") version "2.2.20" apply false
+}

android-app/gradle.properties

@@ -0,0 +1,4 @@
+org.gradle.jvmargs=-Xmx3g -Dfile.encoding=UTF-8
+android.useAndroidX=true
+kotlin.code.style=official
+android.nonTransitiveRClass=true

android-app/settings.gradle.kts

@@ -0,0 +1,18 @@
+pluginManagement {
+    repositories {
+        google()
+        mavenCentral()
+        gradlePluginPortal()
+    }
+}
+
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+rootProject.name = "DHInspeccion"
+include(":app")

api-v3/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dhv2-api",
-  "version": "0.21.0-2",
+  "version": "0.22.1-1",
   "private": true,
   "license": "UNLICENSED",
   "scripts": {
@@ -43,4 +43,4 @@
     "tsx": "^4.20.6",
     "typescript": "^5.9.0"
   }
-}
+}

api-v3/src/auth/auth.module.ts

@@ -5,6 +5,8 @@ import { AuthorizationModule } from '../authorization/authorization.module';
 import { PhaseADataModule } from '../core-data/phase-a-data.module';
 import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
+import { MobileAuthController } from './mobile-auth.controller';
+import { MobileAuthService } from './mobile-auth.service';
 import { AccessTokenGuard } from './guards/access-token.guard';
 import { CsrfGuard } from './guards/csrf.guard';
 import { AuthConfigService } from '../common/config/auth-config.service';
@@ -18,6 +20,7 @@ const providers = [
   PasswordService,
   TokenService,
   AuthService,
+  MobileAuthService,
   AccessTokenGuard,
   CsrfGuard,
 ];
@@ -29,7 +32,7 @@ const providers = [
     AuditModule,
     AuthorizationModule,
   ],
-  controllers: [AuthController],
+  controllers: [AuthController, MobileAuthController],
   providers,
   exports: [
     AuthConfigService,

api-v3/src/auth/dto/mobile-refresh.dto.ts

@@ -0,0 +1,8 @@
+import { IsString, MaxLength, MinLength } from 'class-validator';
+
+export class MobileRefreshDto {
+  @IsString()
+  @MinLength(32)
+  @MaxLength(256)
+  refreshToken!: string;
+}

api-v3/src/auth/mobile-auth.controller.ts

@@ -0,0 +1,56 @@
+import {
+  Body,
+  Controller,
+  HttpCode,
+  Post,
+  Req,
+} from '@nestjs/common';
+import { Throttle } from '@nestjs/throttler';
+import type {
+  AuthPrincipal,
+  RequestWithContext,
+} from '../common/http/request-context';
+import { CurrentAuth } from './decorators/current-auth.decorator';
+import { Public } from './decorators/public.decorator';
+import { SkipCsrf } from './decorators/skip-csrf.decorator';
+import { LoginDto } from './dto/login.dto';
+import { MobileRefreshDto } from './dto/mobile-refresh.dto';
+import { MobileAuthService } from './mobile-auth.service';
+
+@Controller('auth/mobile')
+export class MobileAuthController {
+  constructor(private readonly mobileAuth: MobileAuthService) {}
+
+  @Post('login')
+  @HttpCode(200)
+  @Public()
+  @SkipCsrf()
+  @Throttle({ default: { limit: 5, ttl: 60_000, blockDuration: 60_000 } })
+  login(
+    @Body() dto: LoginDto,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.mobileAuth.login(dto, request);
+  }
+
+  @Post('refresh')
+  @HttpCode(200)
+  @Public()
+  @SkipCsrf()
+  @Throttle({ default: { limit: 20, ttl: 60_000 } })
+  refresh(
+    @Body() dto: MobileRefreshDto,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.mobileAuth.refresh(dto.refreshToken, request);
+  }
+
+  @Post('logout')
+  @HttpCode(200)
+  logout(
+    @CurrentAuth() principal: AuthPrincipal,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.mobileAuth.logout(principal, request);
+  }
+}

api-v3/src/auth/mobile-auth.service.ts

@@ -0,0 +1,386 @@
+import { isIP } from 'node:net';
+import {
+  ForbiddenException,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import { AuditService } from '../audit/audit.service';
+import type {
+  AuthPrincipal,
+  RequestWithContext,
+} from '../common/http/request-context';
+import { AuthSessionsRepository } from '../core-data/repositories/auth-sessions.repository';
+import { RolesRepository } from '../core-data/repositories/roles.repository';
+import { UsersRepository } from '../core-data/repositories/users.repository';
+import {
+  AuditAction,
+  AuditSource,
+  AuthSession,
+  User,
+  UserStatus,
+} from '../database/entities';
+import type { LoginDto } from './dto/login.dto';
+import { PasswordService } from './services/password.service';
+import {
+  IssuedRefreshToken,
+  TokenService,
+} from './services/token.service';
+
+interface RequestMetadata {
+  ip: string | null;
+  userAgent: string | null;
+}
+
+interface SuccessfulAuthentication {
+  user: User;
+  accessToken: string;
+  refreshToken: IssuedRefreshToken;
+}
+
+type LoginOutcome = SuccessfulAuthentication | null;
+type RefreshOutcome =
+  | ({ kind: 'ok' } & SuccessfulAuthentication)
+  | { kind: 'reuse' }
+  | { kind: 'invalid' };
+
+function invalidCredentials(): UnauthorizedException {
+  return new UnauthorizedException({
+    code: 'INVALID_CREDENTIALS',
+    message: 'Credenciales inválidas',
+  });
+}
+
+function invalidSession(): UnauthorizedException {
+  return new UnauthorizedException({
+    code: 'INVALID_SESSION',
+    message: 'Sesión móvil inválida o vencida',
+  });
+}
+
+function inspectorRequired(): ForbiddenException {
+  return new ForbiddenException({
+    code: 'INSPECTION_INSPECTOR_ROLE_REQUIRED',
+    message: 'Sólo un usuario con rol inspector puede ingresar a la aplicación móvil',
+  });
+}
+
+function requestMetadata(request: RequestWithContext): RequestMetadata {
+  const candidateIp = request.ip || request.socket.remoteAddress || '';
+  const ip = isIP(candidateIp) ? candidateIp : null;
+  const rawUserAgent = request.header('user-agent')?.trim();
+  return {
+    ip,
+    userAgent: rawUserAgent ? rawUserAgent.slice(0, 2048) : null,
+  };
+}
+
+@Injectable()
+export class MobileAuthService {
+  constructor(
+    private readonly dataSource: DataSource,
+    private readonly users: UsersRepository,
+    private readonly sessions: AuthSessionsRepository,
+    private readonly roles: RolesRepository,
+    private readonly passwords: PasswordService,
+    private readonly tokens: TokenService,
+    private readonly audit: AuditService,
+  ) {}
+
+  async login(dto: LoginDto, request: RequestWithContext) {
+    const identifier = dto.identifier.trim().toLowerCase();
+    const candidate = await this.users.findForAuthentication(identifier);
+    const metadata = requestMetadata(request);
+
+    if (!candidate) {
+      await this.passwords.verifyUnknown(dto.password);
+      await this.audit.record({
+        action: AuditAction.AUTH_LOGIN_FAILED,
+        requestId: request.requestId,
+        source: AuditSource.ANDROID,
+        ...metadata,
+        metadata: { identifier, reason: 'UNKNOWN_IDENTIFIER' },
+      });
+      throw invalidCredentials();
+    }
+
+    const outcome = await this.dataSource.transaction<LoginOutcome>(
+      async (manager) => {
+        const user = await manager
+          .getRepository(User)
+          .createQueryBuilder('user')
+          .addSelect('user.passwordHash')
+          .where('user.id = :id', { id: candidate.id })
+          .setLock('pessimistic_write')
+          .getOne();
+        if (!user) return null;
+
+        const now = new Date();
+        const passwordMatches = await this.passwords.verify(
+          user.passwordHash,
+          dto.password,
+        );
+        const locked = Boolean(user.lockedUntil && user.lockedUntil > now);
+        const active = user.status === UserStatus.ACTIVE;
+
+        if (!passwordMatches || locked || !active) {
+          if (!passwordMatches && active && !locked) {
+            await manager.query(
+              `
+                UPDATE users
+                SET
+                  failed_login_attempts = failed_login_attempts + 1,
+                  locked_until = CASE
+                    WHEN failed_login_attempts + 1 >= $2
+                      THEN CURRENT_TIMESTAMP + ($3 * INTERVAL '1 second')
+                    ELSE locked_until
+                  END,
+                  updated_at = CURRENT_TIMESTAMP
+                WHERE id = $1
+              `,
+              [
+                user.id,
+                this.tokens.maxLoginAttempts,
+                this.tokens.lockoutSeconds,
+              ],
+            );
+          }
+
+          await this.audit.record(
+            {
+              actorUserId: user.id,
+              actorUsername: user.username,
+              action: AuditAction.AUTH_LOGIN_FAILED,
+              entityType: 'user',
+              entityId: user.id,
+              requestId: request.requestId,
+              source: AuditSource.ANDROID,
+              ...metadata,
+              metadata: {
+                reason: !active
+                  ? 'INACTIVE_USER'
+                  : locked
+                    ? 'LOCKED_USER'
+                    : 'INVALID_PASSWORD',
+              },
+            },
+            manager,
+          );
+          return null;
+        }
+
+        if (this.passwords.needsRehash(user.passwordHash)) {
+          user.passwordHash = await this.passwords.hash(dto.password);
+        }
+        user.failedLoginAttempts = 0;
+        user.lockedUntil = null;
+        user.lastLoginAt = now;
+        await manager.getRepository(User).save(user);
+
+        const refreshToken = this.tokens.issueRefreshToken();
+        const session = manager.getRepository(AuthSession).create({
+          id: refreshToken.sessionId,
+          userId: user.id,
+          refreshTokenHash: refreshToken.tokenHash,
+          expiresAt: this.tokens.refreshExpiresAt(now),
+          lastUsedAt: now,
+          revokedAt: null,
+          replacedBySessionId: null,
+          ip: metadata.ip,
+          userAgent: metadata.userAgent,
+          deviceLabel: dto.deviceLabel?.trim() || 'DH Android',
+        });
+        await manager.getRepository(AuthSession).save(session);
+
+        const accessToken = await this.tokens.issueAccessToken({
+          userId: user.id,
+          sessionId: session.id,
+          username: user.username,
+        });
+
+        await this.audit.record(
+          {
+            actorUserId: user.id,
+            actorUsername: user.username,
+            action: AuditAction.AUTH_LOGIN_SUCCESS,
+            entityType: 'auth_session',
+            entityId: session.id,
+            requestId: request.requestId,
+            source: AuditSource.ANDROID,
+            ...metadata,
+            metadata: { deviceLabel: session.deviceLabel },
+          },
+          manager,
+        );
+
+        return { user, accessToken, refreshToken };
+      },
+    );
+
+    if (!outcome) throw invalidCredentials();
+    return this.complete(outcome);
+  }
+
+  async refresh(rawToken: string, request: RequestWithContext) {
+    const parsed = this.tokens.parseRefreshToken(rawToken);
+    if (!parsed) throw invalidSession();
+
+    const metadata = requestMetadata(request);
+    const outcome = await this.dataSource.transaction<RefreshOutcome>(
+      async (manager) => {
+        const session = await manager
+          .getRepository(AuthSession)
+          .createQueryBuilder('session')
+          .addSelect('session.refreshTokenHash')
+          .where('session.id = :id', { id: parsed.sessionId })
+          .setLock('pessimistic_write')
+          .getOne();
+
+        if (
+          !session ||
+          !this.tokens.verifyRefreshToken(rawToken, session.refreshTokenHash)
+        ) {
+          return { kind: 'invalid' };
+        }
+
+        const user = await manager.getRepository(User).findOne({
+          where: { id: session.userId },
+        });
+
+        if (session.revokedAt) {
+          await this.sessions.revokeSessionFamily(session.id, manager);
+          await this.audit.record(
+            {
+              actorUserId: user?.id ?? null,
+              actorUsername: user?.username ?? null,
+              action: AuditAction.AUTH_REFRESH_REUSE_DETECTED,
+              entityType: 'auth_session',
+              entityId: session.id,
+              requestId: request.requestId,
+              source: AuditSource.ANDROID,
+              ...metadata,
+            },
+            manager,
+          );
+          return { kind: 'reuse' };
+        }
+
+        const now = new Date();
+        if (!user || user.status !== UserStatus.ACTIVE || session.expiresAt <= now) {
+          session.revokedAt = now;
+          session.lastUsedAt = now;
+          await manager.getRepository(AuthSession).save(session);
+          if (user?.status === UserStatus.INACTIVE) {
+            await this.sessions.revokeUserSessions(user.id, undefined, manager);
+          }
+          return { kind: 'invalid' };
+        }
+
+        const refreshToken = this.tokens.issueRefreshToken();
+        const replacement = manager.getRepository(AuthSession).create({
+          id: refreshToken.sessionId,
+          userId: user.id,
+          refreshTokenHash: refreshToken.tokenHash,
+          expiresAt: this.tokens.refreshExpiresAt(now),
+          lastUsedAt: now,
+          revokedAt: null,
+          replacedBySessionId: null,
+          ip: metadata.ip,
+          userAgent: metadata.userAgent,
+          deviceLabel: session.deviceLabel,
+        });
+        await manager.getRepository(AuthSession).save(replacement);
+
+        session.revokedAt = now;
+        session.lastUsedAt = now;
+        session.replacedBySessionId = replacement.id;
+        await manager.getRepository(AuthSession).save(session);
+
+        const accessToken = await this.tokens.issueAccessToken({
+          userId: user.id,
+          sessionId: replacement.id,
+          username: user.username,
+        });
+
+        await this.audit.record(
+          {
+            actorUserId: user.id,
+            actorUsername: user.username,
+            action: AuditAction.AUTH_REFRESH,
+            entityType: 'auth_session',
+            entityId: replacement.id,
+            requestId: request.requestId,
+            source: AuditSource.ANDROID,
+            ...metadata,
+            metadata: { replacedSessionId: session.id },
+          },
+          manager,
+        );
+
+        return { kind: 'ok', user, accessToken, refreshToken };
+      },
+    );
+
+    if (outcome.kind !== 'ok') throw invalidSession();
+    return this.complete(outcome);
+  }
+
+  async logout(
+    principal: AuthPrincipal,
+    request: RequestWithContext,
+  ) {
+    const metadata = requestMetadata(request);
+    await this.dataSource.transaction(async (manager) => {
+      await this.sessions.revokeSession(
+        principal.sessionId,
+        principal.userId,
+        manager,
+      );
+      await this.audit.record(
+        {
+          actorUserId: principal.userId,
+          actorUsername: principal.username,
+          action: AuditAction.AUTH_LOGOUT,
+          entityType: 'auth_session',
+          entityId: principal.sessionId,
+          requestId: request.requestId,
+          source: AuditSource.ANDROID,
+          ...metadata,
+        },
+        manager,
+      );
+    });
+    return { status: 'ok' };
+  }
+
+  private async complete(authentication: SuccessfulAuthentication) {
+    const [roleCodes, permissionCodes] = await Promise.all([
+      this.roles.findRoleCodesForUser(authentication.user.id),
+      this.roles.findPermissionCodesForUser(authentication.user.id),
+    ]);
+
+    if (!roleCodes.includes('inspector')) {
+      await this.sessions.revokeSession(
+        authentication.refreshToken.sessionId,
+        authentication.user.id,
+      );
+      throw inspectorRequired();
+    }
+
+    return {
+      user: {
+        id: authentication.user.id,
+        username: authentication.user.username,
+        firstName: authentication.user.firstName,
+        lastName: authentication.user.lastName,
+        email: authentication.user.email,
+        mustChangePassword: authentication.user.mustChangePassword,
+        roles: roleCodes,
+        permissions: permissionCodes,
+      },
+      accessToken: authentication.accessToken,
+      refreshToken: authentication.refreshToken.token,
+      accessExpiresInSeconds: this.tokens.accessTokenTtlSeconds,
+    };
+  }
+}

api-v3/src/database/migrations/1789754300000-phase-f2-2-1-base-operational-types.ts

@@ -0,0 +1,50 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class PhaseF221BaseOperationalTypes1789754300000 implements MigrationInterface {
+  name = 'PhaseF221BaseOperationalTypes1789754300000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      UPDATE asset_types
+      SET operational_role='AREA', can_be_root=true, is_active=true, updated_at=CURRENT_TIMESTAMP
+      WHERE lower(code)='area'
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_types (code,name,description,can_be_root,is_active,operational_role)
+      SELECT 'area','Área',
+        'Área hidrocarburífera administrada como ancla territorial.',
+        true,true,'AREA'
+      WHERE NOT EXISTS (SELECT 1 FROM asset_types WHERE operational_role='AREA')
+        AND NOT EXISTS (SELECT 1 FROM asset_types WHERE lower(code)='area')
+    `);
+
+    await queryRunner.query(`
+      UPDATE asset_types
+      SET operational_role='COMPANY', can_be_root=true, is_active=true, updated_at=CURRENT_TIMESTAMP
+      WHERE lower(code) IN ('empresa','organizacion')
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_types (code,name,description,can_be_root,is_active,operational_role)
+      SELECT 'empresa','Organización',
+        'Entidad jurídica u organización administrada. Su rol operativo se registra mediante relaciones históricas.',
+        true,true,'COMPANY'
+      WHERE NOT EXISTS (SELECT 1 FROM asset_types WHERE operational_role='COMPANY')
+        AND NOT EXISTS (SELECT 1 FROM asset_types WHERE lower(code)='empresa')
+    `);
+
+    const rows = (await queryRunner.query(`
+      SELECT
+        count(*) FILTER (WHERE operational_role='AREA')::text AS areas,
+        count(*) FILTER (WHERE operational_role='COMPANY')::text AS companies
+      FROM asset_types
+    `)) as Array<{ areas: string; companies: string }>;
+
+    if (Number(rows[0]?.areas ?? 0) < 1 || Number(rows[0]?.companies ?? 0) < 1) {
+      throw new Error('F2.2.1 could not guarantee AREA and COMPANY asset types');
+    }
+  }
+
+  public async down(): Promise<void> {
+    throw new Error('F2.2.1 base operational types are structural and are not removed automatically');
+  }
+}

api-v3/src/database/migrations/1789754350000-phase-f2-2-1-long-reference-labels.ts

@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class PhaseF221LongReferenceLabels1789754350000 implements MigrationInterface {
+  name = 'PhaseF221LongReferenceLabels1789754350000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    // La matriz APLICACION APP contiene denominaciones técnicas descriptivas que
+    // legítimamente superan el límite histórico de 160 caracteres. No se recorta
+    // información de la fuente: ampliamos sólo columnas descriptivas.
+    await queryRunner.query(`ALTER TABLE asset_types ALTER COLUMN name TYPE varchar(500)`);
+    await queryRunner.query(`ALTER TABLE asset_attribute_definitions ALTER COLUMN name TYPE varchar(500)`);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    const rows = (await queryRunner.query(`
+      SELECT
+        coalesce(max(length(name)),0)::integer AS max_type_name,
+        (SELECT coalesce(max(length(name)),0)::integer FROM asset_attribute_definitions) AS max_attribute_name
+      FROM asset_types
+    `)) as Array<{ max_type_name: number; max_attribute_name: number }>;
+
+    if ((rows[0]?.max_type_name ?? 0) > 160 || (rows[0]?.max_attribute_name ?? 0) > 160) {
+      throw new Error('F2.2.1 no puede reducir etiquetas a 160 caracteres sin pérdida de información');
+    }
+    await queryRunner.query(`ALTER TABLE asset_types ALTER COLUMN name TYPE varchar(160)`);
+    await queryRunner.query(`ALTER TABLE asset_attribute_definitions ALTER COLUMN name TYPE varchar(160)`);
+  }
+}

api-v3/src/database/migrations/1789754400000-phase-f2-2-1-reference-excel-data.ts

@@ -0,0 +1,615 @@
+import { createHash } from 'node:crypto';
+import { MigrationInterface, QueryRunner } from 'typeorm';
+import { loadF221ExcelSource } from '../../reference-data/f2-2-1-excel-source';
+
+function slug(value: string, max = 70): string {
+  const normalized = value
+    .normalize('NFD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '');
+  return (normalized || 'item').slice(0, max);
+}
+
+function stableCode(prefix: string, ...parts: string[]): string {
+  const hash = createHash('sha1').update(parts.join('|')).digest('hex').slice(0, 8).toUpperCase();
+  const readable = slug(parts[0] ?? 'item', 72).toUpperCase();
+  return `${prefix}-${readable}-${hash}`.slice(0, 120);
+}
+
+function legalRightType(value: string): string {
+  const normalized = slug(value);
+  if (normalized.includes('explot')) return 'EXPLOITATION_CONCESSION';
+  if (normalized.includes('explor')) return 'EXPLORATION_PERMIT';
+  if (normalized.includes('transport')) return 'TRANSPORT_CONCESSION';
+  return 'OTHER';
+}
+
+const groupTargets: Record<string, string[]> = {
+  tanques: ['tanque'],
+  separadores: ['separador'],
+  bomba_zona_de_bombas: ['bomba'],
+  calderas: ['caldera'],
+  drenaje: ['drenaje'],
+  antorcha: ['antorcha'],
+  colectores: ['colector'],
+  sist_electrico_iluminacion: ['sistema_electrico_iluminacion'],
+  defensa_contra_incendios: ['defensa_contra_incendios'],
+  cargadero_y_descargadero_de_camiones: ['cargadero_descargadero'],
+  filtros: ['filtro'],
+  eq_flotacion: ['equipo_flotacion'],
+  baterias_y_plantas: ['bateria', 'planta'],
+  fwko_tratadores_calentadores: ['fwo', 'fwko', 'calentador', 'tratador_termico'],
+  bombeo_mecanico: ['bombeo_mecanico'],
+  bombeo_electreosumergible: ['bombeo_electreosumergible'],
+  bombeo_cavidad_progresiva_pcp: ['bombeo_cavidad_progresiva_pcp'],
+  pozos_surgentes_prod_gas: ['pozos_surgentes_prod_gas'],
+  pozos_inyectores_agua: ['pozos_inyectores_agua'],
+};
+
+const referenceAliases: Record<string, string> = {
+  tanque: 'tanque',
+  tanques: 'tanque',
+  separador: 'separador',
+  separadores: 'separador',
+  bombas: 'bomba',
+  bomba: 'bomba',
+  fwo: 'fwo',
+  fwko: 'fwko',
+  calentador: 'calentador',
+  piletas: 'drenaje',
+  pileta: 'drenaje',
+  cargadero_descargadero: 'cargadero_descargadero',
+  generador: 'generador',
+};
+
+type IdRow = { id: string };
+type CountRow = { total: string };
+
+async function assetIdByCode(queryRunner: QueryRunner, code: string): Promise<string | null> {
+  const rows = (await queryRunner.query(
+    `SELECT id FROM assets WHERE lower(code)=lower($1::text) LIMIT 1`,
+    [code],
+  )) as IdRow[];
+  return rows[0]?.id ?? null;
+}
+
+async function assetTypeIdByCode(queryRunner: QueryRunner, code: string): Promise<string | null> {
+  const rows = (await queryRunner.query(
+    `SELECT id FROM asset_types WHERE lower(code)=lower($1::text) LIMIT 1`,
+    [code],
+  )) as IdRow[];
+  return rows[0]?.id ?? null;
+}
+
+export class PhaseF221ReferenceExcelData1789754400000 implements MigrationInterface {
+  name = 'PhaseF221ReferenceExcelData1789754400000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    const source = loadF221ExcelSource();
+
+    await queryRunner.query(`
+      INSERT INTO source_documents (document_type,document_number,title,issuer,notes)
+      SELECT 'SPREADSHEET','DH-F221-TERRITORIO','Tablas de yacimiento(1).xlsx','Dirección de Hidrocarburos',
+        'Fuente F2.2.1: maestro territorial y operativo. Hoja normalizada cr26e_tabla1.'
+      WHERE NOT EXISTS (
+        SELECT 1 FROM source_documents
+        WHERE document_number='DH-F221-TERRITORIO' AND issuer='Dirección de Hidrocarburos'
+      )
+    `);
+    await queryRunner.query(`
+      INSERT INTO source_documents (document_type,document_number,title,issuer,notes)
+      SELECT 'SPREADSHEET','DH-F221-APP','APLICACION APP(1).xlsx','Dirección de Hidrocarburos',
+        'Fuente F2.2.1: matriz de jerarquía, información y catálogo contextual de hallazgos. Hojas Hoja1 y Hoja2.'
+      WHERE NOT EXISTS (
+        SELECT 1 FROM source_documents
+        WHERE document_number='DH-F221-APP' AND issuer='Dirección de Hidrocarburos'
+      )
+    `);
+
+    const territoryDocuments = (await queryRunner.query(
+      `SELECT id FROM source_documents
+       WHERE document_number='DH-F221-TERRITORIO' AND issuer='Dirección de Hidrocarburos' LIMIT 1`,
+    )) as IdRow[];
+    const appDocuments = (await queryRunner.query(
+      `SELECT id FROM source_documents
+       WHERE document_number='DH-F221-APP' AND issuer='Dirección de Hidrocarburos' LIMIT 1`,
+    )) as IdRow[];
+    const territoryDocumentId = territoryDocuments[0]?.id;
+    const appDocumentId = appDocuments[0]?.id;
+    if (!territoryDocumentId || !appDocumentId) {
+      throw new Error('F2.2.1 source documents could not be resolved');
+    }
+
+    await queryRunner.query(
+      `UPDATE asset_types SET can_be_root=true WHERE operational_role IN ('AREA','COMPANY')`,
+    );
+    await queryRunner.query(`
+      INSERT INTO asset_types (code,name,description,can_be_root,is_active,operational_role)
+      SELECT 'yacimiento','Yacimiento',
+        'Yacimiento físico/operativo perteneciente a un Área. Su operadora se determina por contexto histórico.',
+        false,true,'GENERIC'
+      WHERE NOT EXISTS (SELECT 1 FROM asset_types WHERE lower(code)='yacimiento')
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_type_parent_rules (child_type_id,parent_type_id)
+      SELECT child.id,parent.id
+      FROM asset_types child CROSS JOIN asset_types parent
+      WHERE lower(child.code)='yacimiento' AND parent.operational_role='AREA'
+      ON CONFLICT DO NOTHING
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_attribute_definitions
+        (asset_type_id,code,name,data_type,is_required,is_active,sort_order)
+      SELECT type.id,definition.code,definition.name,'TEXT',false,true,definition.sort_order
+      FROM asset_types type
+      CROSS JOIN (VALUES
+        ('departamento_fuente','Departamento informado por la fuente',10),
+        ('tipo_concesion_fuente','Tipo de concesión informado por la fuente',20)
+      ) definition(code,name,sort_order)
+      WHERE lower(type.code)='yacimiento'
+      ON CONFLICT DO NOTHING
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_attribute_definitions
+        (asset_type_id,code,name,data_type,is_required,is_active,sort_order)
+      SELECT type.id,'tipo_concesion_fuente','Tipo de concesión informado por la fuente',
+        'TEXT',false,true,40
+      FROM asset_types type
+      WHERE type.operational_role='AREA'
+      ON CONFLICT DO NOTHING
+    `);
+
+    const areaCache = new Map<string, string>();
+    const companyCache = new Map<string, string>();
+    const seenRights = new Set<string>();
+
+    for (const row of source.territory) {
+      const areaKey = row.area.trim().toLocaleLowerCase('es');
+      let areaId = areaCache.get(areaKey) ?? null;
+      if (!areaId) {
+        const areaCode = stableCode('AREA', row.area);
+        areaId = await assetIdByCode(queryRunner, areaCode);
+        if (!areaId) {
+          const inserted = (await queryRunner.query(
+            `INSERT INTO assets (
+               asset_type_id,parent_id,code,name,description,information_status,operational_status,
+               data_origin,source_name,source_reference,source_notes,current_version
+             )
+             SELECT type.id,NULL,$1::varchar,$2::varchar,$3::text,
+               'VALIDATED','IN_SERVICE','IMPORT',$4::varchar,$5::varchar,$6::text,0
+             FROM asset_types type
+             WHERE type.operational_role='AREA'
+             LIMIT 1
+             RETURNING id`,
+            [
+              areaCode,
+              row.area,
+              `Área importada desde Tablas de yacimiento. Departamento: ${row.department}.`,
+              'Tablas de yacimiento(1).xlsx',
+              `cr26e_tabla1|AREA|${row.area}`,
+              `Departamento=${row.department}; TipoConcesion=${row.concessionType}`,
+            ],
+          )) as IdRow[];
+          areaId = inserted[0]?.id ?? null;
+        }
+        if (!areaId) throw new Error(`Could not resolve area ${row.area}`);
+        areaCache.set(areaKey, areaId);
+
+        await queryRunner.query(
+          `INSERT INTO asset_source_documents (asset_id,document_id,relation_type,notes)
+           VALUES ($1::uuid,$2::uuid,'SOURCE','Importación F2.2.1 · cr26e_tabla1')
+           ON CONFLICT DO NOTHING`,
+          [areaId, territoryDocumentId],
+        );
+      }
+
+      for (const [definitionCode, value] of [
+        ['departamento', row.department],
+        ['tipo_concesion_fuente', row.concessionType],
+      ] as const) {
+        await queryRunner.query(
+          `INSERT INTO asset_attribute_values (asset_id,definition_id,value)
+           SELECT $1::uuid,definition.id,to_jsonb($3::text)
+           FROM asset_attribute_definitions definition
+           JOIN asset_types type ON type.id=definition.asset_type_id
+           WHERE type.operational_role='AREA'
+             AND lower(definition.code)=lower($2::text)
+           ON CONFLICT (asset_id,definition_id)
+           DO UPDATE SET value=EXCLUDED.value,updated_at=CURRENT_TIMESTAMP`,
+          [areaId, definitionCode, value],
+        );
+      }
+
+      const noOperator = slug(row.operator) === 'sin_empresa_operadora';
+      let companyId: string | null = null;
+      if (!noOperator) {
+        const companyKey = row.operator.trim().toLocaleLowerCase('es');
+        companyId = companyCache.get(companyKey) ?? null;
+        if (!companyId) {
+          const companyCode = stableCode('ORG', row.operator);
+          companyId = await assetIdByCode(queryRunner, companyCode);
+          if (!companyId) {
+            const inserted = (await queryRunner.query(
+              `INSERT INTO assets (
+                 asset_type_id,parent_id,code,name,description,information_status,operational_status,
+                 data_origin,source_name,source_reference,source_notes,current_version
+               )
+               SELECT type.id,NULL,$1::varchar,$2::varchar,
+                 'Organización operadora importada desde Tablas de yacimiento.',
+                 'VALIDATED','IN_SERVICE','IMPORT',$3::varchar,$4::varchar,
+                 'Empresa/Operadora informada por la fuente',0
+               FROM asset_types type
+               WHERE type.operational_role='COMPANY'
+               LIMIT 1
+               RETURNING id`,
+              [
+                companyCode,
+                row.operator,
+                'Tablas de yacimiento(1).xlsx',
+                `cr26e_tabla1|OPERADORA|${row.operator}`,
+              ],
+            )) as IdRow[];
+            companyId = inserted[0]?.id ?? null;
+          }
+          if (!companyId) throw new Error(`Could not resolve operator ${row.operator}`);
+          companyCache.set(companyKey, companyId);
+
+          await queryRunner.query(
+            `INSERT INTO organization_profiles (asset_id,organization_kind,legal_name)
+             SELECT $1::uuid,
+               CASE WHEN lower($2::text) LIKE 'ute %' OR lower($2::text) LIKE 'ute(%'
+                 THEN 'UTE'::organization_kind ELSE 'COMPANY'::organization_kind END,
+               $2::varchar
+             WHERE NOT EXISTS (SELECT 1 FROM organization_profiles WHERE asset_id=$1::uuid)`,
+            [companyId, row.operator],
+          );
+          await queryRunner.query(
+            `INSERT INTO asset_source_documents (asset_id,document_id,relation_type,notes)
+             VALUES ($1::uuid,$2::uuid,'SOURCE','Importación F2.2.1 · cr26e_tabla1')
+             ON CONFLICT DO NOTHING`,
+            [companyId, territoryDocumentId],
+          );
+        }
+
+        await queryRunner.query(
+          `INSERT INTO area_company_relations
+             (area_id,company_id,relation_role,valid_from,start_reason,source_document_id)
+           SELECT $1::uuid,$2::uuid,'OPERATOR',CURRENT_TIMESTAMP,
+             'Importado desde Tablas de yacimiento(1).xlsx',$3::uuid
+           WHERE NOT EXISTS (
+             SELECT 1 FROM area_company_relations
+             WHERE area_id=$1::uuid AND company_id=$2::uuid
+               AND relation_role='OPERATOR' AND valid_until IS NULL
+           )`,
+          [areaId, companyId, territoryDocumentId],
+        );
+      }
+
+      const fieldCode = stableCode('YAC', row.field, row.area);
+      let fieldId = await assetIdByCode(queryRunner, fieldCode);
+      if (!fieldId) {
+        // The operational context is intentionally all-or-nothing. A source row
+        // that explicitly says "Sin Empresa Operadora" stays physically under
+        // its Área but receives no fabricated operator and no half context.
+        const operationalAreaId = companyId ? areaId : null;
+        const inserted = (await queryRunner.query(
+          `INSERT INTO assets (
+             asset_type_id,parent_id,operational_area_id,operator_company_id,code,name,description,
+             information_status,operational_status,data_origin,source_name,source_reference,
+             source_notes,current_version
+           )
+           SELECT type.id,$1::uuid,$2::uuid,$3::uuid,$4::varchar,$5::varchar,$6::text,
+             'VALIDATED','IN_SERVICE','IMPORT',$7::varchar,$8::varchar,$9::text,0
+           FROM asset_types type
+           WHERE lower(type.code)='yacimiento'
+           LIMIT 1
+           RETURNING id`,
+          [
+            areaId,
+            operationalAreaId,
+            companyId,
+            fieldCode,
+            row.field,
+            `Yacimiento del Área ${row.area}.`,
+            'Tablas de yacimiento(1).xlsx',
+            `cr26e_tabla1|YACIMIENTO|${row.field}|AREA|${row.area}`,
+            `Departamento=${row.department}; TipoConcesion=${row.concessionType}; OperadoraFuente=${row.operator}`,
+          ],
+        )) as IdRow[];
+        fieldId = inserted[0]?.id ?? null;
+      }
+      if (!fieldId) throw new Error(`Could not resolve field ${row.field} / ${row.area}`);
+
+      await queryRunner.query(
+        `INSERT INTO asset_source_documents (asset_id,document_id,relation_type,notes)
+         VALUES ($1::uuid,$2::uuid,'SOURCE','Importación F2.2.1 · cr26e_tabla1')
+         ON CONFLICT DO NOTHING`,
+        [fieldId, territoryDocumentId],
+      );
+      for (const [definitionCode, value] of [
+        ['departamento_fuente', row.department],
+        ['tipo_concesion_fuente', row.concessionType],
+      ] as const) {
+        await queryRunner.query(
+          `INSERT INTO asset_attribute_values (asset_id,definition_id,value)
+           SELECT $1::uuid,definition.id,to_jsonb($3::text)
+           FROM asset_attribute_definitions definition
+           JOIN asset_types type ON type.id=definition.asset_type_id
+           WHERE lower(type.code)='yacimiento'
+             AND lower(definition.code)=lower($2::text)
+           ON CONFLICT (asset_id,definition_id)
+           DO UPDATE SET value=EXCLUDED.value,updated_at=CURRENT_TIMESTAMP`,
+          [fieldId, definitionCode, value],
+        );
+      }
+
+      const rightName = `Tipo informado: ${row.concessionType}`;
+      const rightKey = `${areaId}|${slug(row.concessionType)}`;
+      if (!seenRights.has(rightKey)) {
+        seenRights.add(rightKey);
+        const existing = (await queryRunner.query(
+          `SELECT id FROM area_legal_rights
+           WHERE area_id=$1::uuid AND lower(name)=lower($2::text)
+             AND source_document_id=$3::uuid LIMIT 1`,
+          [areaId, rightName, territoryDocumentId],
+        )) as IdRow[];
+        if (!existing[0]?.id) {
+          await queryRunner.query(
+            `INSERT INTO area_legal_rights
+               (area_id,right_type,name,status,source_document_id,notes)
+             VALUES ($1::uuid,$2::area_legal_right_type,$3::varchar,'ACTIVE',$4::uuid,$5::text)`,
+            [
+              areaId,
+              legalRightType(row.concessionType),
+              rightName,
+              territoryDocumentId,
+              `Importado desde cr26e_tabla1. Departamento: ${row.department}.`,
+            ],
+          );
+        }
+      }
+    }
+
+    const topLevelTypes = new Set(source.types.map((entry) => entry.code));
+    for (const pair of source.parentPairs) topLevelTypes.delete(pair.child);
+
+    const allTypeDefinitions = new Map(source.types.map((entry) => [entry.code, entry.name]));
+    for (const targets of Object.values(groupTargets)) {
+      for (const target of targets) {
+        if (!allTypeDefinitions.has(target)) {
+          allTypeDefinitions.set(target, target.replaceAll('_', ' '));
+        }
+      }
+    }
+
+    for (const [typeCode, typeName] of allTypeDefinitions) {
+      if (!(await assetTypeIdByCode(queryRunner, typeCode))) {
+        await queryRunner.query(
+          `INSERT INTO asset_types (code,name,description,can_be_root,is_active,operational_role)
+           VALUES ($1::varchar,$2::varchar,
+             'Tipo incorporado desde APLICACION APP(1).xlsx · F2.2.1',false,true,'GENERIC')`,
+          [typeCode, typeName],
+        );
+      }
+      await queryRunner.query(
+        `INSERT INTO finding_catalog_asset_type_profiles (asset_type_id,reason)
+         SELECT id,'Aplicabilidad inicial importada desde APLICACION APP(1).xlsx'
+         FROM asset_types WHERE lower(code)=lower($1::text)
+         ON CONFLICT (asset_type_id) DO NOTHING`,
+        [typeCode],
+      );
+    }
+
+    for (const typeCode of topLevelTypes) {
+      await queryRunner.query(
+        `INSERT INTO asset_type_parent_rules (child_type_id,parent_type_id)
+         SELECT child.id,parent.id FROM asset_types child CROSS JOIN asset_types parent
+         WHERE lower(child.code)=lower($1::text) AND lower(parent.code)='yacimiento'
+         ON CONFLICT DO NOTHING`,
+        [typeCode],
+      );
+    }
+    for (const pair of source.parentPairs) {
+      if (pair.child === pair.parent) continue;
+      await queryRunner.query(
+        `INSERT INTO asset_type_parent_rules (child_type_id,parent_type_id)
+         SELECT child.id,parent.id FROM asset_types child CROSS JOIN asset_types parent
+         WHERE lower(child.code)=lower($1::text) AND lower(parent.code)=lower($2::text)
+         ON CONFLICT DO NOTHING`,
+        [pair.child, pair.parent],
+      );
+    }
+    for (const targets of Object.values(groupTargets)) {
+      for (const typeCode of targets) {
+        await queryRunner.query(
+          `INSERT INTO asset_type_parent_rules (child_type_id,parent_type_id)
+           SELECT child.id,parent.id FROM asset_types child CROSS JOIN asset_types parent
+           WHERE lower(child.code)=lower($1::text) AND lower(parent.code)='yacimiento'
+           ON CONFLICT DO NOTHING`,
+          [typeCode],
+        );
+      }
+    }
+
+    for (const entry of source.attributes) {
+      let sortOrder = 100;
+      for (const label of entry.labels) {
+        const attributeCode = slug(label, 72);
+        const typeId = await assetTypeIdByCode(queryRunner, entry.type);
+        if (!typeId) continue;
+        const existing = (await queryRunner.query(
+          `SELECT id FROM asset_attribute_definitions
+           WHERE asset_type_id=$1::uuid AND lower(code)=lower($2::text) LIMIT 1`,
+          [typeId, attributeCode],
+        )) as IdRow[];
+        if (!existing[0]?.id) {
+          await queryRunner.query(
+            `INSERT INTO asset_attribute_definitions
+               (asset_type_id,code,name,data_type,is_required,is_active,sort_order)
+             VALUES ($1::uuid,$2::varchar,$3::varchar,'TEXT',false,true,$4::integer)`,
+            [typeId, attributeCode, label, sortOrder],
+          );
+        }
+        sortOrder += 10;
+      }
+    }
+
+    await queryRunner.query(`
+      INSERT INTO finding_categories (code,name,sort_order,is_active)
+      SELECT 'APP26','Aplicación APP 2026',260,true
+      WHERE NOT EXISTS (SELECT 1 FROM finding_categories WHERE lower(code)='app26')
+    `);
+    const categoryRows = (await queryRunner.query(
+      `SELECT id FROM finding_categories WHERE lower(code)='app26' LIMIT 1`,
+    )) as IdRow[];
+    const categoryId = categoryRows[0]?.id;
+    if (!categoryId) throw new Error('Could not resolve APP26 finding category');
+
+    const titlesByType = new Map<string, Set<string>>();
+    const addTitle = (typeCode: string, title: string): void => {
+      const cleanTitle = title.trim();
+      if (!cleanTitle || /^idem\b/i.test(cleanTitle)) return;
+      const set = titlesByType.get(typeCode) ?? new Set<string>();
+      set.add(cleanTitle);
+      titlesByType.set(typeCode, set);
+    };
+
+    for (const entry of source.directFindings) {
+      for (const title of entry.titles) addTitle(entry.type, title);
+    }
+    for (const group of source.groups) {
+      const targets = groupTargets[slug(group.name)] ?? [slug(group.name)];
+      for (const target of targets) {
+        for (const item of group.items) addTitle(target, item.title);
+      }
+    }
+    for (let pass = 0; pass < 3; pass += 1) {
+      for (const entry of source.idemRefs) {
+        for (const rawReference of entry.refs) {
+          const reference = referenceAliases[slug(rawReference)] ?? slug(rawReference);
+          for (const title of titlesByType.get(reference) ?? []) addTitle(entry.type, title);
+        }
+      }
+    }
+
+    const allTitles = [
+      ...new Set([...titlesByType.values()].flatMap((titles) => [...titles])),
+    ].sort((a, b) => a.localeCompare(b, 'es'));
+
+    const itemIdByTitle = new Map<string, string>();
+    let sourceNumber = 1;
+    for (const title of allTitles) {
+      const itemCode = `APP26-${createHash('sha1').update(title).digest('hex').slice(0, 12).toUpperCase()}`;
+      let itemRows = (await queryRunner.query(
+        `SELECT id FROM finding_catalog_items WHERE lower(code)=lower($1::text) LIMIT 1`,
+        [itemCode],
+      )) as IdRow[];
+      if (!itemRows[0]?.id) {
+        itemRows = (await queryRunner.query(
+          `INSERT INTO finding_catalog_items
+             (category_id,code,source_number,title,import_note,revision,is_active)
+           VALUES ($1::uuid,$2::varchar,$3::integer,$4::varchar,
+             'Importado desde APLICACION APP(1).xlsx · F2.2.1',1,true)
+           RETURNING id`,
+          [categoryId, itemCode, sourceNumber, title],
+        )) as IdRow[];
+      }
+      const itemId = itemRows[0]?.id;
+      if (itemId) {
+        itemIdByTitle.set(title, itemId);
+        await queryRunner.query(
+          `INSERT INTO finding_catalog_item_versions
+             (item_id,revision,snapshot,actor_username)
+           SELECT item.id,item.revision,
+             jsonb_build_object(
+               'id',item.id,'categoryId',category.id,'categoryCode',category.code,
+               'categoryName',category.name,'code',item.code,'sourceNumber',item.source_number,
+               'title',item.title,'legalBasis',item.legal_basis,'glossary',item.glossary,
+               'importNote',item.import_note,'revision',item.revision,'isActive',item.is_active
+             ),
+             'migration:F2.2.1'
+           FROM finding_catalog_items item
+           JOIN finding_categories category ON category.id=item.category_id
+           WHERE item.id=$1::uuid
+             AND NOT EXISTS (
+               SELECT 1 FROM finding_catalog_item_versions version
+               WHERE version.item_id=item.id AND version.revision=item.revision
+             )`,
+          [itemId],
+        );
+      }
+      sourceNumber += 1;
+    }
+
+    for (const [typeCode, titles] of titlesByType) {
+      const assetTypeId = await assetTypeIdByCode(queryRunner, typeCode);
+      if (!assetTypeId) continue;
+      for (const title of titles) {
+        const catalogItemId = itemIdByTitle.get(title);
+        if (!catalogItemId) continue;
+        await queryRunner.query(
+          `INSERT INTO finding_catalog_item_asset_types (catalog_item_id,asset_type_id)
+           VALUES ($1::uuid,$2::uuid) ON CONFLICT DO NOTHING`,
+          [catalogItemId, assetTypeId],
+        );
+      }
+    }
+
+    await queryRunner.query(
+      `INSERT INTO asset_source_documents (asset_id,document_id,relation_type,notes)
+       SELECT asset.id,$1::uuid,'MENTIONS',
+         'El tipo/hallazgo del elemento se definió con la matriz APLICACION APP(1).xlsx'
+       FROM assets asset
+       JOIN asset_types type ON type.id=asset.asset_type_id
+       WHERE lower(type.code)='yacimiento'
+       ON CONFLICT DO NOTHING`,
+      [appDocumentId],
+    );
+
+    const importedYacimientos = (await queryRunner.query(
+      `SELECT count(*)::text AS total
+       FROM assets asset JOIN asset_types type ON type.id=asset.asset_type_id
+       WHERE asset.data_origin='IMPORT'
+         AND asset.source_name='Tablas de yacimiento(1).xlsx'
+         AND lower(type.code)='yacimiento'`,
+    )) as CountRow[];
+    if (Number(importedYacimientos[0]?.total ?? 0) !== source.territory.length) {
+      throw new Error(
+        `F2.2.1 verification failed: expected ${source.territory.length} imported yacimientos, found ${importedYacimientos[0]?.total ?? '0'}`,
+      );
+    }
+
+    const importedCatalog = (await queryRunner.query(
+      `SELECT count(*)::text AS total
+       FROM finding_catalog_items item
+       JOIN finding_categories category ON category.id=item.category_id
+       WHERE lower(category.code)='app26'`,
+    )) as CountRow[];
+    if (Number(importedCatalog[0]?.total ?? 0) !== allTitles.length) {
+      throw new Error(
+        `F2.2.1 verification failed: expected ${allTitles.length} APP26 findings, found ${importedCatalog[0]?.total ?? '0'}`,
+      );
+    }
+
+    const halfContexts = (await queryRunner.query(
+      `SELECT count(*)::text AS total FROM assets
+       WHERE (operational_area_id IS NULL) <> (operator_company_id IS NULL)`,
+    )) as CountRow[];
+    if (Number(halfContexts[0]?.total ?? 0) !== 0) {
+      throw new Error('F2.2.1 verification failed: an imported asset has an incomplete operational context');
+    }
+
+    // eslint-disable-next-line no-console
+    console.log(
+      `[F2.2.1] imported territory=${source.territory.length}; yacimientos=${importedYacimientos[0]?.total}; catalog=${importedCatalog[0]?.total}; halfContexts=0`,
+    );
+  }
+
+  public async down(): Promise<void> {
+    throw new Error(
+      'F2.2.1 contiene maestros territoriales y catálogo de referencia; no se revierte destructivamente. Restaurar backup PRE si fuera necesario.',
+    );
+  }
+}

api-v3/src/database/migrations/1789758000000-phase-f2-2-1-reference-baselines.ts

@@ -0,0 +1,57 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class PhaseF221ReferenceBaselines1789758000000 implements MigrationInterface {
+  name = 'PhaseF221ReferenceBaselines1789758000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      INSERT INTO asset_versions (
+        asset_id,version_number,change_type,changed_fields,snapshot,source
+      )
+      SELECT
+        asset.id,
+        1,
+        'BASELINE',
+        ARRAY['assetTypeId','parentId','operationalAreaId','operatorCompanyId','code','name','informationStatus','operationalStatus','dataOrigin','sourceName','sourceReference'],
+        jsonb_build_object(
+          'id',asset.id,
+          'assetTypeId',asset.asset_type_id,
+          'parentId',asset.parent_id,
+          'operationalAreaId',asset.operational_area_id,
+          'operatorCompanyId',asset.operator_company_id,
+          'code',asset.code,
+          'name',asset.name,
+          'commonName',asset.common_name,
+          'description',asset.description,
+          'informationStatus',asset.information_status,
+          'operationalStatus',asset.operational_status,
+          'dataOrigin',asset.data_origin,
+          'sourceName',asset.source_name,
+          'sourceReference',asset.source_reference,
+          'sourceNotes',asset.source_notes
+        ),
+        'SYSTEM'
+      FROM assets asset
+      WHERE asset.data_origin='IMPORT'
+        AND asset.source_name='Tablas de yacimiento(1).xlsx'
+        AND NOT EXISTS (
+          SELECT 1 FROM asset_versions version
+          WHERE version.asset_id=asset.id AND version.version_number=1
+        )
+    `);
+    await queryRunner.query(`
+      UPDATE assets asset
+      SET current_version=GREATEST(asset.current_version,1),updated_at=CURRENT_TIMESTAMP
+      WHERE asset.data_origin='IMPORT'
+        AND asset.source_name='Tablas de yacimiento(1).xlsx'
+        AND EXISTS (
+          SELECT 1 FROM asset_versions version
+          WHERE version.asset_id=asset.id AND version.version_number=1
+        )
+    `);
+  }
+
+  public async down(): Promise<void> {
+    throw new Error('F2.2.1 no elimina baselines históricos del maestro importado. Restaurar backup PRE si fuera necesario.');
+  }
+}

api-v3/src/version.ts

@@ -1,2 +1,2 @@
-export const API_VERSION = '0.21.0-2';
-export const API_PHASE = 'F2.1';
+export const API_VERSION = '0.22.1-1';
+export const API_PHASE = 'F2.2.1';

api-v3/test/f2-2-1-reference-excel-data.test.ts

@@ -0,0 +1,49 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { loadF221ExcelSource } from '../src/reference-data/f2-2-1-excel-source';
+
+const source = loadF221ExcelSource();
+
+test('F2.2.1 preserves every normalized territorial source row', () => {
+  assert.equal(source.territory.length, 230);
+  assert.equal(new Set(source.territory.map((row) => row.field)).size, 220);
+  assert.equal(new Set(source.territory.map((row) => `${row.field.toLowerCase()}|${row.area.toLowerCase()}`)).size, 230);
+});
+
+test('F2.2.1 does not collapse repeated field names across different operational contexts', () => {
+  const byName = new Map<string, Set<string>>();
+  for (const row of source.territory) {
+    const key = row.field.toLowerCase();
+    const contexts = byName.get(key) ?? new Set<string>();
+    contexts.add(`${row.area}|${row.operator}`);
+    byName.set(key, contexts);
+  }
+  assert.ok([...byName.values()].some((contexts) => contexts.size > 1));
+});
+
+test('F2.2.1 keeps the APP matrix as configuration rather than physical inventory rows', () => {
+  assert.equal(source.types.length, 113);
+  assert.equal(source.parentPairs.length, 119);
+  assert.equal(source.attributes.length, 44);
+  assert.equal(source.idemRefs.length, 25);
+  assert.ok(source.types.some((entry) => entry.code === 'tanque'));
+  assert.ok(source.types.some((entry) => entry.code === 'bateria'));
+});
+
+test('F2.2.1 keeps IDEM as inheritance metadata, never as a catalog title', () => {
+  const directTitles = source.directFindings.flatMap((entry) => entry.titles);
+  assert.equal(directTitles.some((title) => /^idem\b/i.test(title.trim())), false);
+  assert.ok(source.idemRefs.some((entry) => entry.type === 'tanque'));
+});
+
+test('F2.2.1 imports the grouped Hallazgo catalog supplied in Hoja2', () => {
+  assert.equal(source.groups.length, 19);
+  assert.equal(source.groups.reduce((total, group) => total + group.items.length, 0), 171);
+  const tanks = source.groups.find((group) => group.name.trim().toUpperCase() === 'TANQUES');
+  assert.ok(tanks);
+  assert.ok(tanks.items.some((item) => /ESTADO DEL TANQUE/i.test(item.title)));
+});
+
+test('F2.2.1 preserves rows explicitly reporting no operator without fabricating an organization in source data', () => {
+  assert.ok(source.territory.some((row) => row.operator.toLowerCase().includes('sin empresa operadora')));
+});