@fiado/api-invoker 4.6.0 → 4.8.0

package/bin/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.d.ts

@@ -1,6 +1,6 @@
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
+import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
 import { ICognitoBackofficeConnectorApi } from "./interfaces/ICognitoBackofficeConnectorApi";
 /**
  * Publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
@@ -36,6 +36,7 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
     setMfaPreference(input: SetMfaPreferenceRequest): Promise<ApiGatewayResponse<void>>;
     resetUserMfa(cognitoSub: string, input: MfaResetRequest): Promise<ApiGatewayResponse<void>>;
     authInitiate(input: InitiateAuthRequest): Promise<ApiGatewayResponse<InitiateAuthResponse>>;
+    authVerifyPassword(input: VerifyPasswordRequest): Promise<ApiGatewayResponse<VerifyPasswordResponse>>;
     authRespondChallenge(input: RespondToChallengeRequest): Promise<ApiGatewayResponse<RespondToChallengeResponse>>;
     authRefreshTokens(input: RefreshTokensRequest): Promise<ApiGatewayResponse<RefreshTokensResponse>>;
     authForgotPassword(input: ForgotPasswordRequest): Promise<ApiGatewayResponse<void>>;

package/bin/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.js

@@ -86,11 +86,15 @@ let CognitoBackofficeConnectorApi = class CognitoBackofficeConnectorApi {
         const url = `${this.baseUrl}/users/${encodeURIComponent(cognitoSub)}/mfa/reset`;
         return await this.httpRequest.post(url, input);
     }
-    // ============= Auth flow no-admin BFF M18 (7) =============
+    // ============= Auth flow no-admin BFF M18 (8) =============
     async authInitiate(input) {
         const url = `${this.baseUrl}/auth/initiate`;
         return await this.httpRequest.post(url, input);
     }
+    async authVerifyPassword(input) {
+        const url = `${this.baseUrl}/auth/verify-password`;
+        return await this.httpRequest.post(url, input);
+    }
     async authRespondChallenge(input) {
         const url = `${this.baseUrl}/auth/respond-challenge`;
         return await this.httpRequest.post(url, input);

package/bin/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.d.ts

@@ -1,5 +1,5 @@
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
+import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
 /**
  * Contrato del publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
  *
@@ -44,6 +44,12 @@ export interface ICognitoBackofficeConnectorApi {
     resetUserMfa(cognitoSub: string, input: MfaResetRequest): Promise<ApiGatewayResponse<void>>;
     /** POST /auth/initiate — inicia auth flow no-admin (devuelve tokens o challenge). */
     authInitiate(input: InitiateAuthRequest): Promise<ApiGatewayResponse<InitiateAuthResponse>>;
+    /**
+     * POST /auth/verify-password — valida un password contra Cognito (DEC-AUTH-012).
+     * El connector encapsula el mecanismo (hoy ADMIN_USER_PASSWORD_AUTH) y devuelve
+     * solo un veredicto `{ valid }`. El caller (rbac) NO conoce el mecanismo.
+     */
+    authVerifyPassword(input: VerifyPasswordRequest): Promise<ApiGatewayResponse<VerifyPasswordResponse>>;
     /** POST /auth/respond-challenge — responde a challenge pendiente (devuelve tokens o nuevo challenge). */
     authRespondChallenge(input: RespondToChallengeRequest): Promise<ApiGatewayResponse<RespondToChallengeResponse>>;
     /** POST /auth/refresh-tokens — refresca accessToken+idToken usando refreshToken. */

package/bin/container.config.js

@@ -104,6 +104,9 @@ const BenefitsMarketplaceApi_1 = __importDefault(require("./benefits-marketplace
 const uniteller_connector_1 = require("./uniteller-connector");
 const CognitoBackofficeConnectorApi_1 = __importDefault(require("./cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi"));
 const PlatformRbacBusinessApi_1 = __importDefault(require("./platformRbac/api/PlatformRbacBusinessApi"));
+// Messages business — API client + OTP/notifications SQS publisher (Fase 0 SureKeep)
+const messages_business_1 = require("./messages-business");
+const MessagesBusinessPublisher_1 = __importDefault(require("./messages-business/queue/MessagesBusinessPublisher"));
 exports.apiInvokerBindings = new inversify_1.ContainerModule(({ bind }) => {
     // UTILS bindings
     bind("InvokerUtils").to(InvokerUtils_1.InvokerUtils);
@@ -213,4 +216,7 @@ exports.apiInvokerBindings = new inversify_1.ContainerModule(({ bind }) => {
     bind("ICognitoBackofficeConnectorApi").to(CognitoBackofficeConnectorApi_1.default);
     // Platform RBAC business — Custom Auth Challenge endpoints (Fase 0 SureKeep)
     bind("IPlatformRbacBusinessApi").to(PlatformRbacBusinessApi_1.default);
+    // Messages business — API client + OTP/notifications SQS publisher (Fase 0 SureKeep)
+    bind("IMessagesBusinessApi").to(messages_business_1.MessagesBusinessApi);
+    bind("IMessagesBusinessPublisher").to(MessagesBusinessPublisher_1.default);
 });

package/bin/index.d.ts

@@ -75,3 +75,4 @@ export * from "./benefits-marketplace";
 export * from "./milestone-business";
 export * from "./cognitoBackofficeConnector";
 export * from "./platformRbac";
+export * from "./messages-business";

package/bin/index.js

@@ -91,3 +91,4 @@ __exportStar(require("./benefits-marketplace"), exports);
 __exportStar(require("./milestone-business"), exports);
 __exportStar(require("./cognitoBackofficeConnector"), exports);
 __exportStar(require("./platformRbac"), exports);
+__exportStar(require("./messages-business"), exports);

package/bin/messages-business/api/MessagesBusinessApi.d.ts

@@ -0,0 +1,17 @@
+import type { IHttpRequest } from '@fiado/http-client';
+import FiadoApiResponse from '@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse';
+import { SendMessageRequest, SendMessageResponse, VerifyOtpRequest, VerifyOtpResponse, OtpValidatedResponse, TemplateMessageCreateRequest, TemplateMessageUpdateRequest, TemplateMessageResponse, TemplateMessageListResponse, TemplateMessageListFiltersRequest } from '@fiado/type-kit/bin/messagesConnector';
+import { IMessagesBusinessApi } from './interfaces/IMessagesBusinessApi';
+export declare class MessagesBusinessApi implements IMessagesBusinessApi {
+    private readonly httpRequest;
+    private readonly baseUrl;
+    constructor(httpRequest: IHttpRequest);
+    sendMessage(request: SendMessageRequest): Promise<FiadoApiResponse<SendMessageResponse>>;
+    verifyOtp(request: VerifyOtpRequest): Promise<FiadoApiResponse<VerifyOtpResponse>>;
+    getValidatedOtp(directoryId: string, otpCode: string): Promise<FiadoApiResponse<OtpValidatedResponse>>;
+    createTemplate(request: TemplateMessageCreateRequest): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    listTemplates(filters: TemplateMessageListFiltersRequest): Promise<FiadoApiResponse<TemplateMessageListResponse>>;
+    getTemplate(id: string): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    updateTemplate(id: string, request: TemplateMessageUpdateRequest): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    deleteTemplate(id: string): Promise<FiadoApiResponse<void>>;
+}

package/bin/messages-business/api/MessagesBusinessApi.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessagesBusinessApi = void 0;
+const inversify_1 = require("inversify");
+let MessagesBusinessApi = class MessagesBusinessApi {
+    httpRequest;
+    baseUrl = process.env.MESSAGES_BUSINESS_URL || '';
+    constructor(httpRequest) {
+        this.httpRequest = httpRequest;
+    }
+    async sendMessage(request) {
+        return await this.httpRequest.post(`${this.baseUrl}messages/send`, request, { 'operationName': 'privateSendMessage' });
+    }
+    async verifyOtp(request) {
+        return await this.httpRequest.post(`${this.baseUrl}messages/otp/verify`, request, { 'operationName': 'privateVerifyOtp' });
+    }
+    async getValidatedOtp(directoryId, otpCode) {
+        return await this.httpRequest.get(`${this.baseUrl}messages/otp/validated`, { directoryId, otpCode }, { 'operationName': 'privateGetValidatedOtp' });
+    }
+    async createTemplate(request) {
+        return await this.httpRequest.post(`${this.baseUrl}templates`, request, { 'operationName': 'backofficeCreateTemplate' });
+    }
+    async listTemplates(filters) {
+        return await this.httpRequest.get(`${this.baseUrl}templates`, filters, { 'operationName': 'backofficeListTemplates' });
+    }
+    async getTemplate(id) {
+        return await this.httpRequest.get(`${this.baseUrl}templates/${id}`, undefined, { 'operationName': 'backofficeGetTemplate' });
+    }
+    async updateTemplate(id, request) {
+        return await this.httpRequest.put(`${this.baseUrl}templates/${id}`, request, { 'operationName': 'backofficeUpdateTemplate' });
+    }
+    async deleteTemplate(id) {
+        return await this.httpRequest.delete(`${this.baseUrl}templates/${id}`, undefined, { 'operationName': 'backofficeDeleteTemplate' });
+    }
+};
+exports.MessagesBusinessApi = MessagesBusinessApi;
+exports.MessagesBusinessApi = MessagesBusinessApi = __decorate([
+    (0, inversify_1.injectable)(),
+    __param(0, (0, inversify_1.inject)('IHttpRequest')),
+    __metadata("design:paramtypes", [Object])
+], MessagesBusinessApi);

package/bin/messages-business/api/interfaces/IMessagesBusinessApi.d.ts

@@ -0,0 +1,12 @@
+import FiadoApiResponse from '@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse';
+import { SendMessageRequest, SendMessageResponse, VerifyOtpRequest, VerifyOtpResponse, OtpValidatedResponse, TemplateMessageCreateRequest, TemplateMessageUpdateRequest, TemplateMessageResponse, TemplateMessageListResponse, TemplateMessageListFiltersRequest } from '@fiado/type-kit/bin/messagesConnector';
+export interface IMessagesBusinessApi {
+    sendMessage(request: SendMessageRequest): Promise<FiadoApiResponse<SendMessageResponse>>;
+    verifyOtp(request: VerifyOtpRequest): Promise<FiadoApiResponse<VerifyOtpResponse>>;
+    getValidatedOtp(directoryId: string, otpCode: string): Promise<FiadoApiResponse<OtpValidatedResponse>>;
+    createTemplate(request: TemplateMessageCreateRequest): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    listTemplates(filters: TemplateMessageListFiltersRequest): Promise<FiadoApiResponse<TemplateMessageListResponse>>;
+    getTemplate(id: string): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    updateTemplate(id: string, request: TemplateMessageUpdateRequest): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    deleteTemplate(id: string): Promise<FiadoApiResponse<void>>;
+}

package/bin/messages-business/api/interfaces/IMessagesBusinessApi.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/messages-business/index.d.ts

@@ -0,0 +1,4 @@
+export * from './api/MessagesBusinessApi';
+export * from './api/interfaces/IMessagesBusinessApi';
+export { default as MessagesBusinessPublisher } from './queue/MessagesBusinessPublisher';
+export * from './queue/interfaces/IMessagesBusinessPublisher';

package/bin/messages-business/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessagesBusinessPublisher = void 0;
+__exportStar(require("./api/MessagesBusinessApi"), exports);
+__exportStar(require("./api/interfaces/IMessagesBusinessApi"), exports);
+var MessagesBusinessPublisher_1 = require("./queue/MessagesBusinessPublisher");
+Object.defineProperty(exports, "MessagesBusinessPublisher", { enumerable: true, get: function () { return __importDefault(MessagesBusinessPublisher_1).default; } });
+__exportStar(require("./queue/interfaces/IMessagesBusinessPublisher"), exports);

package/bin/messages-business/queue/MessagesBusinessPublisher.d.ts

@@ -0,0 +1,7 @@
+import { NotificationQueueMessageRequestV2 } from '@fiado/type-kit/bin/messagesConnector';
+import { IMessagesBusinessPublisher } from './interfaces/IMessagesBusinessPublisher';
+export default class MessagesBusinessPublisher implements IMessagesBusinessPublisher {
+    private readonly queueUrl;
+    private readonly sqsClient;
+    publish(message: NotificationQueueMessageRequestV2): Promise<void>;
+}

package/bin/messages-business/queue/MessagesBusinessPublisher.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const inversify_1 = require("inversify");
+const client_sqs_1 = require("@aws-sdk/client-sqs");
+const logger_1 = require("@fiado/logger");
+let MessagesBusinessPublisher = class MessagesBusinessPublisher {
+    queueUrl = process.env.MESSAGES_BUSINESS_QUEUE_URL;
+    sqsClient = new client_sqs_1.SQSClient({ region: process.env.AWS_REGION });
+    async publish(message) {
+        const t0 = Date.now();
+        try {
+            const result = await this.sqsClient.send(new client_sqs_1.SendMessageCommand({
+                QueueUrl: this.queueUrl,
+                MessageBody: JSON.stringify(message),
+            }));
+            logger_1.log.info('MessagesBusinessPublisher.publish ok', {
+                messageId: result.MessageId,
+                latencyMs: Date.now() - t0,
+            });
+        }
+        catch (error) {
+            // Propaga el error crudo del SQSClient (NO envolver en new Error(string) = antipatron).
+            // Log de contexto + re-throw para que el caller decida.
+            logger_1.log.error('MessagesBusinessPublisher.publish failed', {
+                latencyMs: Date.now() - t0,
+                errorName: error?.name,
+            });
+            throw error;
+        }
+    }
+};
+MessagesBusinessPublisher = __decorate([
+    (0, inversify_1.injectable)()
+], MessagesBusinessPublisher);
+exports.default = MessagesBusinessPublisher;

package/bin/messages-business/queue/interfaces/IMessagesBusinessPublisher.d.ts

@@ -0,0 +1,4 @@
+import { NotificationQueueMessageRequestV2 } from '@fiado/type-kit/bin/messagesConnector';
+export interface IMessagesBusinessPublisher {
+    publish(message: NotificationQueueMessageRequestV2): Promise<void>;
+}

package/bin/messages-business/queue/interfaces/IMessagesBusinessPublisher.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",
@@ -17,7 +17,7 @@
     "@fiado/gateway-adapter": "^2.0.0",
     "@fiado/http-client": "^2.0.0",
     "@fiado/logger": "^1.0.3",
-    "@fiado/type-kit": "^3.30.0",
+    "@fiado/type-kit": "^3.46.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {
@@ -27,6 +27,7 @@
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.1",
+    "aws-sdk-client-mock": "^4.1.0",
     "inversify": "^8.1.0",
     "jest": "^30.4.2",
     "reflect-metadata": "^0.2.2",

package/src/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.ts

@@ -1,5 +1,5 @@
 import { inject, injectable } from "inversify";
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
 import {
     CreateUserRequest,
@@ -33,6 +33,8 @@ import {
     CreatePoolResponse,
     DeletePoolRequest,
     HealthcheckResponse,
+    VerifyPasswordRequest,
+    VerifyPasswordResponse,
 } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
 import { ICognitoBackofficeConnectorApi } from "./interfaces/ICognitoBackofficeConnectorApi";
 
@@ -159,7 +161,7 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
         return await this.httpRequest.post(url, input);
     }
 
-    // ============= Auth flow no-admin BFF M18 (7) =============
+    // ============= Auth flow no-admin BFF M18 (8) =============
 
     async authInitiate(
         input: InitiateAuthRequest,
@@ -168,6 +170,13 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
         return await this.httpRequest.post(url, input);
     }
 
+    async authVerifyPassword(
+        input: VerifyPasswordRequest,
+    ): Promise<ApiGatewayResponse<VerifyPasswordResponse>> {
+        const url = `${this.baseUrl}/auth/verify-password`;
+        return await this.httpRequest.post(url, input);
+    }
+
     async authRespondChallenge(
         input: RespondToChallengeRequest,
     ): Promise<ApiGatewayResponse<RespondToChallengeResponse>> {

package/src/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.ts

@@ -31,6 +31,8 @@ import {
     CreatePoolResponse,
     DeletePoolRequest,
     HealthcheckResponse,
+    VerifyPasswordRequest,
+    VerifyPasswordResponse,
 } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
 
 /**
@@ -110,11 +112,20 @@ export interface ICognitoBackofficeConnectorApi {
         input: MfaResetRequest,
     ): Promise<ApiGatewayResponse<void>>;
 
-    // ============= Auth flow no-admin BFF M18 (7) =============
+    // ============= Auth flow no-admin BFF M18 (8) =============
 
     /** POST /auth/initiate — inicia auth flow no-admin (devuelve tokens o challenge). */
     authInitiate(input: InitiateAuthRequest): Promise<ApiGatewayResponse<InitiateAuthResponse>>;
 
+    /**
+     * POST /auth/verify-password — valida un password contra Cognito (DEC-AUTH-012).
+     * El connector encapsula el mecanismo (hoy ADMIN_USER_PASSWORD_AUTH) y devuelve
+     * solo un veredicto `{ valid }`. El caller (rbac) NO conoce el mecanismo.
+     */
+    authVerifyPassword(
+        input: VerifyPasswordRequest,
+    ): Promise<ApiGatewayResponse<VerifyPasswordResponse>>;
+
     /** POST /auth/respond-challenge — responde a challenge pendiente (devuelve tokens o nuevo challenge). */
     authRespondChallenge(
         input: RespondToChallengeRequest,

package/src/container.config.ts

@@ -156,6 +156,10 @@ import { ICognitoBackofficeConnectorApi } from "./cognitoBackofficeConnector";
 import CognitoBackofficeConnectorApi from "./cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi";
 import { IPlatformRbacBusinessApi } from "./platformRbac";
 import PlatformRbacBusinessApi from "./platformRbac/api/PlatformRbacBusinessApi";
+// Messages business — API client + OTP/notifications SQS publisher (Fase 0 SureKeep)
+import { IMessagesBusinessApi, MessagesBusinessApi } from "./messages-business";
+import MessagesBusinessPublisher from "./messages-business/queue/MessagesBusinessPublisher";
+import { IMessagesBusinessPublisher } from "./messages-business/queue/interfaces/IMessagesBusinessPublisher";
 
 export const apiInvokerBindings = new ContainerModule(({ bind }) => {
     // UTILS bindings
@@ -278,4 +282,8 @@ export const apiInvokerBindings = new ContainerModule(({ bind }) => {
 
     // Platform RBAC business — Custom Auth Challenge endpoints (Fase 0 SureKeep)
     bind<IPlatformRbacBusinessApi>("IPlatformRbacBusinessApi").to(PlatformRbacBusinessApi);
+
+    // Messages business — API client + OTP/notifications SQS publisher (Fase 0 SureKeep)
+    bind<IMessagesBusinessApi>("IMessagesBusinessApi").to(MessagesBusinessApi);
+    bind<IMessagesBusinessPublisher>("IMessagesBusinessPublisher").to(MessagesBusinessPublisher);
 });

package/src/index.ts

@@ -75,3 +75,4 @@ export * from "./benefits-marketplace";
 export * from "./milestone-business";
 export * from "./cognitoBackofficeConnector";
 export * from "./platformRbac";
+export * from "./messages-business";

package/src/messages-business/api/MessagesBusinessApi.ts

@@ -0,0 +1,50 @@
+import { inject, injectable } from 'inversify';
+import type { IHttpRequest } from '@fiado/http-client';
+import FiadoApiResponse from '@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse';
+import {
+    SendMessageRequest, SendMessageResponse,
+    VerifyOtpRequest, VerifyOtpResponse,
+    OtpValidatedResponse,
+    TemplateMessageCreateRequest, TemplateMessageUpdateRequest,
+    TemplateMessageResponse, TemplateMessageListResponse, TemplateMessageListFiltersRequest,
+} from '@fiado/type-kit/bin/messagesConnector';
+import { IMessagesBusinessApi } from './interfaces/IMessagesBusinessApi';
+
+@injectable()
+export class MessagesBusinessApi implements IMessagesBusinessApi {
+    private readonly baseUrl = process.env.MESSAGES_BUSINESS_URL || '';
+
+    constructor(@inject('IHttpRequest') private readonly httpRequest: IHttpRequest) {}
+
+    async sendMessage(request: SendMessageRequest): Promise<FiadoApiResponse<SendMessageResponse>> {
+        return await this.httpRequest.post(`${this.baseUrl}messages/send`, request, { 'operationName': 'privateSendMessage' });
+    }
+
+    async verifyOtp(request: VerifyOtpRequest): Promise<FiadoApiResponse<VerifyOtpResponse>> {
+        return await this.httpRequest.post(`${this.baseUrl}messages/otp/verify`, request, { 'operationName': 'privateVerifyOtp' });
+    }
+
+    async getValidatedOtp(directoryId: string, otpCode: string): Promise<FiadoApiResponse<OtpValidatedResponse>> {
+        return await this.httpRequest.get(`${this.baseUrl}messages/otp/validated`, { directoryId, otpCode }, { 'operationName': 'privateGetValidatedOtp' });
+    }
+
+    async createTemplate(request: TemplateMessageCreateRequest): Promise<FiadoApiResponse<TemplateMessageResponse>> {
+        return await this.httpRequest.post(`${this.baseUrl}templates`, request, { 'operationName': 'backofficeCreateTemplate' });
+    }
+
+    async listTemplates(filters: TemplateMessageListFiltersRequest): Promise<FiadoApiResponse<TemplateMessageListResponse>> {
+        return await this.httpRequest.get(`${this.baseUrl}templates`, filters as Record<string, unknown>, { 'operationName': 'backofficeListTemplates' });
+    }
+
+    async getTemplate(id: string): Promise<FiadoApiResponse<TemplateMessageResponse>> {
+        return await this.httpRequest.get(`${this.baseUrl}templates/${id}`, undefined, { 'operationName': 'backofficeGetTemplate' });
+    }
+
+    async updateTemplate(id: string, request: TemplateMessageUpdateRequest): Promise<FiadoApiResponse<TemplateMessageResponse>> {
+        return await this.httpRequest.put(`${this.baseUrl}templates/${id}`, request, { 'operationName': 'backofficeUpdateTemplate' });
+    }
+
+    async deleteTemplate(id: string): Promise<FiadoApiResponse<void>> {
+        return await this.httpRequest.delete(`${this.baseUrl}templates/${id}`, undefined, { 'operationName': 'backofficeDeleteTemplate' });
+    }
+}

package/src/messages-business/api/interfaces/IMessagesBusinessApi.ts

@@ -0,0 +1,20 @@
+import FiadoApiResponse from '@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse';
+import {
+    SendMessageRequest, SendMessageResponse,
+    VerifyOtpRequest, VerifyOtpResponse,
+    OtpValidatedResponse,
+    TemplateMessageCreateRequest, TemplateMessageUpdateRequest,
+    TemplateMessageResponse, TemplateMessageListResponse, TemplateMessageListFiltersRequest,
+} from '@fiado/type-kit/bin/messagesConnector';
+
+export interface IMessagesBusinessApi {
+    sendMessage(request: SendMessageRequest): Promise<FiadoApiResponse<SendMessageResponse>>;
+    verifyOtp(request: VerifyOtpRequest): Promise<FiadoApiResponse<VerifyOtpResponse>>;
+    getValidatedOtp(directoryId: string, otpCode: string): Promise<FiadoApiResponse<OtpValidatedResponse>>;
+
+    createTemplate(request: TemplateMessageCreateRequest): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    listTemplates(filters: TemplateMessageListFiltersRequest): Promise<FiadoApiResponse<TemplateMessageListResponse>>;
+    getTemplate(id: string): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    updateTemplate(id: string, request: TemplateMessageUpdateRequest): Promise<FiadoApiResponse<TemplateMessageResponse>>;
+    deleteTemplate(id: string): Promise<FiadoApiResponse<void>>;
+}

package/src/messages-business/index.ts

@@ -0,0 +1,4 @@
+export * from './api/MessagesBusinessApi';
+export * from './api/interfaces/IMessagesBusinessApi';
+export { default as MessagesBusinessPublisher } from './queue/MessagesBusinessPublisher';
+export * from './queue/interfaces/IMessagesBusinessPublisher';

package/src/messages-business/queue/MessagesBusinessPublisher.ts

@@ -0,0 +1,33 @@
+import { injectable } from 'inversify';
+import { SendMessageCommand, SQSClient } from '@aws-sdk/client-sqs';
+import { log } from '@fiado/logger';
+import { NotificationQueueMessageRequestV2 } from '@fiado/type-kit/bin/messagesConnector';
+import { IMessagesBusinessPublisher } from './interfaces/IMessagesBusinessPublisher';
+
+@injectable()
+export default class MessagesBusinessPublisher implements IMessagesBusinessPublisher {
+    private readonly queueUrl = process.env.MESSAGES_BUSINESS_QUEUE_URL!;
+    private readonly sqsClient = new SQSClient({ region: process.env.AWS_REGION });
+
+    async publish(message: NotificationQueueMessageRequestV2): Promise<void> {
+        const t0 = Date.now();
+        try {
+            const result = await this.sqsClient.send(new SendMessageCommand({
+                QueueUrl: this.queueUrl,
+                MessageBody: JSON.stringify(message),
+            }));
+            log.info('MessagesBusinessPublisher.publish ok', {
+                messageId: result.MessageId,
+                latencyMs: Date.now() - t0,
+            });
+        } catch (error) {
+            // Propaga el error crudo del SQSClient (NO envolver en new Error(string) = antipatron).
+            // Log de contexto + re-throw para que el caller decida.
+            log.error('MessagesBusinessPublisher.publish failed', {
+                latencyMs: Date.now() - t0,
+                errorName: (error as Error)?.name,
+            });
+            throw error;
+        }
+    }
+}

package/src/messages-business/queue/interfaces/IMessagesBusinessPublisher.ts

@@ -0,0 +1,5 @@
+import { NotificationQueueMessageRequestV2 } from '@fiado/type-kit/bin/messagesConnector';
+
+export interface IMessagesBusinessPublisher {
+    publish(message: NotificationQueueMessageRequestV2): Promise<void>;
+}