@fiado/api-invoker 5.105.0 → 5.107.0

package/bin/address/AddressApi.d.ts

@@ -1,4 +1,4 @@
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { AddressCreateRequest, AddressShippingCardResponse } from "@fiado/type-kit/bin/address/index.js";
 import { IAddressApi } from "./interfaces/IAddressApi.js";
 type FiadoApiResponse<T> = import("@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse.js").default<T>;
@@ -14,5 +14,7 @@ export declare class AddressApi implements IAddressApi {
     }>>;
     private validateBaseUrl;
     private validateDirectoryId;
+    /** Direcciones por lote (GET users?directoryId=...). Lo usa la actividad diaria del backoffice (helpNeeded). */
+    getByDirectoryIds(directoryIds: string[]): Promise<any>;
 }
 export {};

package/bin/address/AddressApi.js

@@ -48,6 +48,13 @@ let AddressApi = class AddressApi {
             throw new Error("Directory ID is required.");
         }
     }
+    /** Direcciones por lote (GET users?directoryId=...). Lo usa la actividad diaria del backoffice (helpNeeded). */
+    async getByDirectoryIds(directoryIds) {
+        if (directoryIds.length === 0)
+            return Promise.resolve({ code: "PROCESS_OK", data: [] });
+        const query = directoryIds.map((id) => `directoryId=${encodeURIComponent(id)}`).join("&");
+        return await this.httpRequest.get(`${this.baseUrl}users?${query}`);
+    }
 };
 AddressApi = __decorate([
     injectable(),

package/bin/address/interfaces/IAddressApi.d.ts

@@ -32,5 +32,7 @@ export interface IAddressApi {
     deleteByDirectoryId(directoryId: string): Promise<FiadoApiResponse<{
         deletedCount: number;
     }>>;
+    /** Direcciones por lote (envelope con data: dirección[] con directoryId y helpNeeded). */
+    getByDirectoryIds(directoryIds: string[]): Promise<any>;
 }
 export {};

package/bin/authentication/AuthenticationApi.d.ts

@@ -11,4 +11,6 @@ export declare class AuthenticationApi implements IAuthenticationApi {
     agentSignInStatus(input: AgentSignInStatusInput, actorEmail: string): Promise<LegacyApiResponse<unknown>>;
     agentSignUpProspect(input: AgentSignUpProspectInput, actorEmail: string): Promise<LegacyApiResponse<unknown>>;
     agentGetSignUpByPhone(phoneNumber: string): Promise<LegacyApiResponse<unknown>>;
+    /** Sesiones de autenticación por lote (op getSessionsByDirectoryIds). Lo usa la actividad diaria del backoffice. */
+    getSessionsByDirectoryIds(directoryIds: string[]): Promise<any>;
 }

package/bin/authentication/AuthenticationApi.js

@@ -49,6 +49,13 @@ let AuthenticationApi = class AuthenticationApi {
         const operation = "agentGetSignUpByPhoneNumber";
         return await this.httpRequest.post(url, { pathParameters: { phoneNumber } }, { 'operationName': operation });
     }
+    /** Sesiones de autenticación por lote (op getSessionsByDirectoryIds). Lo usa la actividad diaria del backoffice. */
+    async getSessionsByDirectoryIds(directoryIds) {
+        if (directoryIds.length === 0)
+            return Promise.resolve({ code: "PROCESS_OK", data: [] });
+        const url = `${process.env.AUTH_LAMBDA_URL}`;
+        return await this.httpRequest.post(url, { directoryIds }, { 'operationName': 'getSessionsByDirectoryIds' });
+    }
 };
 AuthenticationApi = __decorate([
     injectable(),

package/bin/authentication/interfaces/IAuthenticationApi.d.ts

@@ -27,4 +27,6 @@ export interface IAuthenticationApi {
     agentSignInStatus(input: AgentSignInStatusInput, actorEmail: string): Promise<LegacyApiResponse<unknown>>;
     agentSignUpProspect(input: AgentSignUpProspectInput, actorEmail: string): Promise<LegacyApiResponse<unknown>>;
     agentGetSignUpByPhone(phoneNumber: string): Promise<LegacyApiResponse<unknown>>;
+    /** Sesiones por lote (envelope con data: sesión[] con directoryId). */
+    getSessionsByDirectoryIds(directoryIds: string[]): Promise<any>;
 }

package/bin/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.d.ts

@@ -1,6 +1,6 @@
 import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, SetUserPasswordRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
+import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, SetUserPasswordRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, CreatePoolClientRequest, CreatePoolClientResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
 import { ICognitoBackofficeConnectorApi } from "./interfaces/ICognitoBackofficeConnectorApi.js";
 /**
  * Publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
@@ -52,6 +52,7 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
     updateProfile(input: UpdateProfileRequest): Promise<ApiGatewayResponse<void>>;
     listUserAuthEvents(cognitoSub: string, input: AuthEventsRequest): Promise<ApiGatewayResponse<AuthEventResponse[]>>;
     createPool(input: CreatePoolRequest): Promise<ApiGatewayResponse<CreatePoolResponse>>;
+    createPoolClient(userPoolId: string, input: CreatePoolClientRequest): Promise<ApiGatewayResponse<CreatePoolClientResponse>>;
     deletePool(userPoolId: string, region: string): Promise<ApiGatewayResponse<void>>;
     healthcheck(): Promise<ApiGatewayResponse<HealthcheckResponse>>;
 }

package/bin/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.js

@@ -147,6 +147,10 @@ let CognitoBackofficeConnectorApi = class CognitoBackofficeConnectorApi {
         const url = `${this.baseUrl}/pools`;
         return await this.httpRequest.post(url, input);
     }
+    async createPoolClient(userPoolId, input) {
+        const url = `${this.baseUrl}/pools/${encodeURIComponent(userPoolId)}/clients`;
+        return await this.httpRequest.post(url, input);
+    }
     async deletePool(userPoolId, region) {
         const url = `${this.baseUrl}/pools/${encodeURIComponent(userPoolId)}`;
         return await this.httpRequest.delete(url, { region });

package/bin/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.d.ts

@@ -1,5 +1,5 @@
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, SetUserPasswordRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
+import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, SetUserPasswordRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, CreatePoolClientRequest, CreatePoolClientResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
 /**
  * Contrato del publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
  *
@@ -93,6 +93,8 @@ export interface ICognitoBackofficeConnectorApi {
      * SetUserPoolMfaConfig + CreateUserPoolClient con cleanup chain observable.
      */
     createPool(input: CreatePoolRequest): Promise<ApiGatewayResponse<CreatePoolResponse>>;
+    /** POST /pools/{userPoolId}/clients — app client extra sobre un pool existente (usuarios de API). */
+    createPoolClient(userPoolId: string, input: CreatePoolClientRequest): Promise<ApiGatewayResponse<CreatePoolClientResponse>>;
     /**
      * DELETE /pools/{userPoolId}?region=X — elimina un user pool vacío (pivote
      * v1.4.1 — compensation chain de saga). Requiere pool sin users; si tiene

package/bin/onboarding/api/OnboardingApi.d.ts

@@ -7,4 +7,6 @@ export default class OnboardingApi implements IOnboardingApi {
     getByReferralDirectoryId(referralDirectoryId: string): Promise<any>;
     delete(id: string): Promise<any>;
     getOnboardingSteps(directoryId: string, countryId: string): Promise<OnboardingStepsEnvelope>;
+    /** Onboardings por lote de fiado-onboarding-lambda (GET ids?directoryId=...). Lo usa la actividad diaria del backoffice. */
+    getByIds(directoryIds: string[]): Promise<any>;
 }

package/bin/onboarding/api/OnboardingApi.js

@@ -30,6 +30,13 @@ let OnboardingApi = class OnboardingApi {
             directoryId, countryId, typeOfDirectoryId: "USER",
         });
     }
+    /** Onboardings por lote de fiado-onboarding-lambda (GET ids?directoryId=...). Lo usa la actividad diaria del backoffice. */
+    async getByIds(directoryIds) {
+        if (directoryIds.length === 0)
+            return Promise.resolve({ code: "PROCESS_OK", data: [] });
+        const query = directoryIds.map((id) => `directoryId=${encodeURIComponent(id)}`).join("&");
+        return await this.httpRequest.get(`${this.baseUrl}ids?${query}`);
+    }
 };
 OnboardingApi = __decorate([
     injectable(),

package/bin/onboarding/api/interfaces/IOnboardingApi.d.ts

@@ -10,4 +10,6 @@ export interface IOnboardingApi {
     delete(id: string): Promise<any>;
     getByReferralDirectoryId(referralDirectoryId: string): Promise<any>;
     getOnboardingSteps(directoryId: string, countryId: string): Promise<OnboardingStepsEnvelope>;
+    /** Onboardings por lote (envelope con data: onboarding[] con id = directoryId y referralCode). */
+    getByIds(directoryIds: string[]): Promise<any>;
 }

package/bin/platformRbac/resolver/ApiInvokerPermissionResolver.d.ts

@@ -1,19 +1,7 @@
 import type { ResolveInput, ResolvedPermissions } from "@fiado/gateway-adapter";
 import type { IPlatformRbacBusinessApi } from "../api/interfaces/IPlatformRbacBusinessApi.js";
-/**
- * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
- * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
- * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
- * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
- * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
- *
- * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
- * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
- * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
- * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
- * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
- * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
- */
+/** Resuelve permisos vía el endpoint privado de rbac-business y cachea solo el fallback (sin roles del token).
+ *  Llave de caché: `${principalType}#${issuer}#${cognitoSub}`. */
 export declare class ApiInvokerPermissionResolver {
     private readonly _api;
     private readonly _cache;

package/bin/platformRbac/resolver/ApiInvokerPermissionResolver.js

@@ -12,20 +12,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from "inversify";
 import { TtlCache } from "@fiado/gateway-adapter";
-/**
- * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
- * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
- * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
- * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
- * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
- *
- * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
- * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
- * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
- * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
- * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
- * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
- */
+/** Resuelve permisos vía el endpoint privado de rbac-business y cachea solo el fallback (sin roles del token).
+ *  Llave de caché: `${principalType}#${issuer}#${cognitoSub}`. */
 let ApiInvokerPermissionResolver = class ApiInvokerPermissionResolver {
     _api;
     _cache;
@@ -38,16 +26,7 @@ let ApiInvokerPermissionResolver = class ApiInvokerPermissionResolver {
     }
     async resolve(input) {
         const cacheable = input.roleAssignmentsFromToken === undefined;
-        // DEC-RBAC-124: el tipo de principal entra en la cache key. NO es defensa contra colisión
-        // —los subs de integración llevan prefijo `INT#` y no chocan con un UUID de Cognito— sino
-        // para que el canal quede explícito y un cambio futuro de formato no cause aliasing
-        // silencioso entre un usuario y una integración.
-        //
-        // Se lee con cast en vez de tiparlo desde `ResolveInput` A PROPÓSITO: `principalType` recién
-        // existe en `@fiado/gateway-adapter` 4.x, y esta lib la consume toda la flota. Atarla al
-        // prerelease obligaría a todos a subir de major. Así compila igual contra 3.x y 4.x, y el
-        // reenvío al endpoint privado funciona en runtime porque `resolvePermissions(input)` manda
-        // el objeto entero sin filtrar campos.
+        // El tipo de principal va en la llave: USER, INTEGRATION y API_USER nunca comparten entrada.
         const principalType = input.principalType ?? "USER";
         const key = `${principalType}#${input.issuer ?? ""}#${input.cognitoSub}`;
         if (cacheable) {

package/bin/riskProfile/api/RiskProfileApi.d.ts

@@ -1,5 +1,5 @@
 import { IRiskProfileApi } from "./interfaces/IRiskProfileApi.js";
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { CreatePrivateAlarm, CreateRiskProfileRequest } from "@fiado/type-kit/bin/riskProfile/index.js";
 type UpdateRiskProfileRequest = import("@fiado/type-kit/bin/riskProfile/dtos/UpdateRiskProfileRequest.js").default;
 type UpdateAlarmProfileRequest = import("@fiado/type-kit/bin/riskProfile/dtos/UpdateAlarmProfileRequest.js").default;
@@ -34,5 +34,7 @@ export default class RiskProfileApi implements IRiskProfileApi {
     deleteByDirectoryId(directoryId: string): Promise<FiadoApiResponse<{
         deletedCount: number;
     }>>;
+    /** Score y nivel de riesgo por lote (GET profiles/directories/scores). Lo usa la actividad diaria del backoffice. */
+    getScoreAndLevelByDirectoryIds(directoryIds: string[]): Promise<any>;
 }
 export {};

package/bin/riskProfile/api/RiskProfileApi.js

@@ -75,6 +75,13 @@ let RiskProfileApi = class RiskProfileApi {
         const url = `${this.baseUrl}/private/directory/${directoryId}`;
         return await this.httpRequest.delete(url);
     }
+    /** Score y nivel de riesgo por lote (GET profiles/directories/scores). Lo usa la actividad diaria del backoffice. */
+    async getScoreAndLevelByDirectoryIds(directoryIds) {
+        if (directoryIds.length === 0)
+            return Promise.resolve({ code: "PROCESS_OK", data: [] });
+        const query = directoryIds.map((id) => `directoryId=${encodeURIComponent(id)}`).join("&");
+        return await this.httpRequest.get(`${this.baseUrl}/profiles/directories/scores?${query}`);
+    }
 };
 RiskProfileApi = __decorate([
     injectable(),

package/bin/riskProfile/api/interfaces/IRiskProfileApi.d.ts

@@ -59,5 +59,7 @@ export interface IRiskProfileApi {
     deleteByDirectoryId(directoryId: string): Promise<FiadoApiResponse<{
         deletedCount: number;
     }>>;
+    /** Score y nivel por lote (envelope con data: { directoryId, score, riskLevel, manualRiskLevel }[]). */
+    getScoreAndLevelByDirectoryIds(directoryIds: string[]): Promise<any>;
 }
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "5.105.0",
+  "version": "5.107.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "type": "module",
   "main": "bin/index.js",
@@ -34,7 +34,7 @@
     "@fiado/gateway-adapter": "^3.9.0",
     "@fiado/http-client": "^2.0.1",
     "@fiado/logger": "^1.1.3",
-    "@fiado/type-kit": "^3.487.0",
+    "@fiado/type-kit": "^3.488.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {

package/src/address/AddressApi.ts

@@ -1,4 +1,4 @@
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { AddressCreateRequest, AddressShippingCardResponse } from "@fiado/type-kit/bin/address/index.js";
 import { inject, injectable } from "inversify";
 import { IAddressApi } from "./interfaces/IAddressApi.js";
@@ -50,4 +50,11 @@ export class AddressApi implements IAddressApi {
             throw new Error("Directory ID is required.");
         }
     }
-}
+
+    /** Direcciones por lote (GET users?directoryId=...). Lo usa la actividad diaria del backoffice (helpNeeded). */
+    async getByDirectoryIds(directoryIds: string[]): Promise<any> {
+        if (directoryIds.length === 0) return Promise.resolve({ code: "PROCESS_OK", data: [] } as never);
+        const query = directoryIds.map((id) => `directoryId=${encodeURIComponent(id)}`).join("&");
+        return await this.httpRequest.get(`${this.baseUrl}users?${query}`);
+    }
+}

package/src/address/interfaces/IAddressApi.ts

@@ -37,4 +37,7 @@ export interface IAddressApi {
     // TODO(type-kit): swap a Directory.DeleteByDirectoryResponse cuando se publique
     deleteByDirectoryId(directoryId: string): Promise<FiadoApiResponse<{ deletedCount: number }>>;
 
+    /** Direcciones por lote (envelope con data: dirección[] con directoryId y helpNeeded). */
+    getByDirectoryIds(directoryIds: string[]): Promise<any>;
+
 }

package/src/authentication/AuthenticationApi.ts

@@ -53,4 +53,11 @@ export class AuthenticationApi implements IAuthenticationApi {
 
         return await this.httpRequest.post<LegacyApiResponse<unknown>>(url, { pathParameters: { phoneNumber } }, { 'operationName': operation });
     }
+
+    /** Sesiones de autenticación por lote (op getSessionsByDirectoryIds). Lo usa la actividad diaria del backoffice. */
+    async getSessionsByDirectoryIds(directoryIds: string[]): Promise<any> {
+        if (directoryIds.length === 0) return Promise.resolve({ code: "PROCESS_OK", data: [] } as never);
+        const url = `${process.env.AUTH_LAMBDA_URL}`;
+        return await this.httpRequest.post(url, { directoryIds }, { 'operationName': 'getSessionsByDirectoryIds' });
+    }
 }

package/src/authentication/interfaces/IAuthenticationApi.ts

@@ -46,4 +46,8 @@ export interface IAuthenticationApi {
 
     // operationName: agentGetSignUpByPhoneNumber — body { pathParameters: { phoneNumber } }
     agentGetSignUpByPhone(phoneNumber: string): Promise<LegacyApiResponse<unknown>>;
+
+    /** Sesiones por lote (envelope con data: sesión[] con directoryId). */
+    getSessionsByDirectoryIds(directoryIds: string[]): Promise<any>;
+
 }

package/src/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.ts

@@ -32,6 +32,8 @@ import {
     UpdateProfileRequest,
     CreatePoolRequest,
     CreatePoolResponse,
+    CreatePoolClientRequest,
+    CreatePoolClientResponse,
     DeletePoolRequest,
     HealthcheckResponse,
     VerifyPasswordRequest,
@@ -269,6 +271,14 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
         return await this.httpRequest.post(url, input);
     }
 
+    async createPoolClient(
+        userPoolId: string,
+        input: CreatePoolClientRequest,
+    ): Promise<ApiGatewayResponse<CreatePoolClientResponse>> {
+        const url = `${this.baseUrl}/pools/${encodeURIComponent(userPoolId)}/clients`;
+        return await this.httpRequest.post(url, input);
+    }
+
     async deletePool(userPoolId: string, region: string): Promise<ApiGatewayResponse<void>> {
         const url = `${this.baseUrl}/pools/${encodeURIComponent(userPoolId)}`;
         return await this.httpRequest.delete(url, { region });

package/src/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.ts

@@ -30,6 +30,8 @@ import {
     UpdateProfileRequest,
     CreatePoolRequest,
     CreatePoolResponse,
+    CreatePoolClientRequest,
+    CreatePoolClientResponse,
     DeletePoolRequest,
     HealthcheckResponse,
     VerifyPasswordRequest,
@@ -203,6 +205,9 @@ export interface ICognitoBackofficeConnectorApi {
      */
     createPool(input: CreatePoolRequest): Promise<ApiGatewayResponse<CreatePoolResponse>>;
 
+    /** POST /pools/{userPoolId}/clients — app client extra sobre un pool existente (usuarios de API). */
+    createPoolClient(userPoolId: string, input: CreatePoolClientRequest): Promise<ApiGatewayResponse<CreatePoolClientResponse>>;
+
     /**
      * DELETE /pools/{userPoolId}?region=X — elimina un user pool vacío (pivote
      * v1.4.1 — compensation chain de saga). Requiere pool sin users; si tiene

package/src/onboarding/api/OnboardingApi.ts

@@ -26,4 +26,11 @@ export default class OnboardingApi implements IOnboardingApi {
             directoryId, countryId, typeOfDirectoryId: "USER",
         });
     }
+
+    /** Onboardings por lote de fiado-onboarding-lambda (GET ids?directoryId=...). Lo usa la actividad diaria del backoffice. */
+    async getByIds(directoryIds: string[]): Promise<any> {
+        if (directoryIds.length === 0) return Promise.resolve({ code: "PROCESS_OK", data: [] } as never);
+        const query = directoryIds.map((id) => `directoryId=${encodeURIComponent(id)}`).join("&");
+        return await this.httpRequest.get(`${this.baseUrl}ids?${query}`);
+    }
 }

package/src/onboarding/api/interfaces/IOnboardingApi.ts

@@ -11,4 +11,8 @@ export interface IOnboardingApi {
     delete(id: string): Promise<any>
     getByReferralDirectoryId(referralDirectoryId: string): Promise<any>
     getOnboardingSteps(directoryId: string, countryId: string): Promise<OnboardingStepsEnvelope>
+
+    /** Onboardings por lote (envelope con data: onboarding[] con id = directoryId y referralCode). */
+    getByIds(directoryIds: string[]): Promise<any>;
+
 }

package/src/platformRbac/resolver/ApiInvokerPermissionResolver.ts

@@ -3,20 +3,8 @@ import type { ResolveInput, ResolvedPermissions } from "@fiado/gateway-adapter";
 import { TtlCache } from "@fiado/gateway-adapter";
 import type { IPlatformRbacBusinessApi } from "../api/interfaces/IPlatformRbacBusinessApi.js";
 
-/**
- * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
- * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
- * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
- * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
- * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
- *
- * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
- * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
- * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
- * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
- * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
- * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
- */
+/** Resuelve permisos vía el endpoint privado de rbac-business y cachea solo el fallback (sin roles del token).
+ *  Llave de caché: `${principalType}#${issuer}#${cognitoSub}`. */
 @injectable()
 export class ApiInvokerPermissionResolver {
     private readonly _cache: TtlCache<ResolvedPermissions>;
@@ -31,17 +19,8 @@ export class ApiInvokerPermissionResolver {
     }
     async resolve(input: ResolveInput): Promise<ResolvedPermissions> {
         const cacheable = input.roleAssignmentsFromToken === undefined;
-        // DEC-RBAC-124: el tipo de principal entra en la cache key. NO es defensa contra colisión
-        // —los subs de integración llevan prefijo `INT#` y no chocan con un UUID de Cognito— sino
-        // para que el canal quede explícito y un cambio futuro de formato no cause aliasing
-        // silencioso entre un usuario y una integración.
-        //
-        // Se lee con cast en vez de tiparlo desde `ResolveInput` A PROPÓSITO: `principalType` recién
-        // existe en `@fiado/gateway-adapter` 4.x, y esta lib la consume toda la flota. Atarla al
-        // prerelease obligaría a todos a subir de major. Así compila igual contra 3.x y 4.x, y el
-        // reenvío al endpoint privado funciona en runtime porque `resolvePermissions(input)` manda
-        // el objeto entero sin filtrar campos.
-        const principalType = (input as { principalType?: string }).principalType ?? "USER";
+        // El tipo de principal va en la llave: USER, INTEGRATION y API_USER nunca comparten entrada.
+        const principalType = input.principalType ?? "USER";
         const key = `${principalType}#${input.issuer ?? ""}#${input.cognitoSub}`;
         if (cacheable) {
             const hit = this._cache.get(key);

package/src/riskProfile/api/RiskProfileApi.ts

@@ -1,6 +1,6 @@
 import {IRiskProfileApi} from "./interfaces/IRiskProfileApi.js";
 import {inject, injectable} from "inversify";
-import {IHttpRequest} from "@fiado/http-client";
+import type {IHttpRequest} from "@fiado/http-client";
 import {CreatePrivateAlarm, CreateRiskProfileRequest} from "@fiado/type-kit/bin/riskProfile/index.js";
 type UpdateRiskProfileRequest = import("@fiado/type-kit/bin/riskProfile/dtos/UpdateRiskProfileRequest.js").default;
 type UpdateAlarmProfileRequest = import("@fiado/type-kit/bin/riskProfile/dtos/UpdateAlarmProfileRequest.js").default;
@@ -92,4 +92,10 @@ export default class RiskProfileApi implements IRiskProfileApi {
         return await this.httpRequest.delete<FiadoApiResponse<{ deletedCount: number }>>(url);
     }
 
-}
+    /** Score y nivel de riesgo por lote (GET profiles/directories/scores). Lo usa la actividad diaria del backoffice. */
+    async getScoreAndLevelByDirectoryIds(directoryIds: string[]): Promise<any> {
+        if (directoryIds.length === 0) return Promise.resolve({ code: "PROCESS_OK", data: [] } as never);
+        const query = directoryIds.map((id) => `directoryId=${encodeURIComponent(id)}`).join("&");
+        return await this.httpRequest.get(`${this.baseUrl}/profiles/directories/scores?${query}`);
+    }
+}

package/src/riskProfile/api/interfaces/IRiskProfileApi.ts

@@ -76,4 +76,8 @@ export interface IRiskProfileApi {
      */
     // TODO(type-kit): swap a Directory.DeleteByDirectoryResponse cuando se publique
     deleteByDirectoryId(directoryId: string): Promise<FiadoApiResponse<{ deletedCount: number }>>;
+
+    /** Score y nivel por lote (envelope con data: { directoryId, score, riskLevel, manualRiskLevel }[]). */
+    getScoreAndLevelByDirectoryIds(directoryIds: string[]): Promise<any>
+
 }