@fiado/api-invoker 5.106.0 → 5.108.0

package/bin/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.d.ts

@@ -1,6 +1,6 @@
 import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, SetUserPasswordRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
+import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, SetUserPasswordRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, CreatePoolClientRequest, CreatePoolClientResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
 import { ICognitoBackofficeConnectorApi } from "./interfaces/ICognitoBackofficeConnectorApi.js";
 /**
  * Publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
@@ -52,6 +52,7 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
     updateProfile(input: UpdateProfileRequest): Promise<ApiGatewayResponse<void>>;
     listUserAuthEvents(cognitoSub: string, input: AuthEventsRequest): Promise<ApiGatewayResponse<AuthEventResponse[]>>;
     createPool(input: CreatePoolRequest): Promise<ApiGatewayResponse<CreatePoolResponse>>;
+    createPoolClient(userPoolId: string, input: CreatePoolClientRequest): Promise<ApiGatewayResponse<CreatePoolClientResponse>>;
     deletePool(userPoolId: string, region: string): Promise<ApiGatewayResponse<void>>;
     healthcheck(): Promise<ApiGatewayResponse<HealthcheckResponse>>;
 }

package/bin/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.js

@@ -147,6 +147,10 @@ let CognitoBackofficeConnectorApi = class CognitoBackofficeConnectorApi {
         const url = `${this.baseUrl}/pools`;
         return await this.httpRequest.post(url, input);
     }
+    async createPoolClient(userPoolId, input) {
+        const url = `${this.baseUrl}/pools/${encodeURIComponent(userPoolId)}/clients`;
+        return await this.httpRequest.post(url, input);
+    }
     async deletePool(userPoolId, region) {
         const url = `${this.baseUrl}/pools/${encodeURIComponent(userPoolId)}`;
         return await this.httpRequest.delete(url, { region });

package/bin/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.d.ts

@@ -1,5 +1,5 @@
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, SetUserPasswordRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
+import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, SetUserPasswordRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, CreatePoolClientRequest, CreatePoolClientResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
 /**
  * Contrato del publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
  *
@@ -93,6 +93,8 @@ export interface ICognitoBackofficeConnectorApi {
      * SetUserPoolMfaConfig + CreateUserPoolClient con cleanup chain observable.
      */
     createPool(input: CreatePoolRequest): Promise<ApiGatewayResponse<CreatePoolResponse>>;
+    /** POST /pools/{userPoolId}/clients — app client extra sobre un pool existente (usuarios de API). */
+    createPoolClient(userPoolId: string, input: CreatePoolClientRequest): Promise<ApiGatewayResponse<CreatePoolClientResponse>>;
     /**
      * DELETE /pools/{userPoolId}?region=X — elimina un user pool vacío (pivote
      * v1.4.1 — compensation chain de saga). Requiere pool sin users; si tiene

package/bin/cognitoConnector/CognitoConnectorApi.d.ts

@@ -1,6 +1,6 @@
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { GetUserRequest, GetUserResponse, RefreshTokenRequest, RefreshTokenResponse, RespondToAuthChallengeRequest, SetPasswordRequest, SignInRequest, SignInResponse, SignUpConfirmRequest, SignUpRequest, SignUpResponse } from "@fiado/type-kit/bin/cognitoConnector/index.js";
-import { ICognitoConnectorApi } from "./interfaces/ICognitoConnectorApi.js";
+import type { CognitoUpdatePhoneNumberRequest, ICognitoConnectorApi } from "./interfaces/ICognitoConnectorApi.js";
 import { TypeOfDirectoryId } from "@fiado/type-kit/bin/directory/index.js";
 export default class CognitoConnectorApi implements ICognitoConnectorApi {
     private httpRequest;
@@ -15,4 +15,10 @@ export default class CognitoConnectorApi implements ICognitoConnectorApi {
     changePassword(input: SetPasswordRequest): Promise<void>;
     respondToNewPasswordChallenge(input: RespondToAuthChallengeRequest): Promise<SignInResponse>;
     resetPassword(username: string, typeOfDirectoryId: string): Promise<void>;
+    /**
+     * Cambia el phone_number de un usuario (PUT cognito/user del conector). Mismo contrato que
+     * CognitoAdapter.updateAttribute de fiado-directory-lambda: `username` es el identityId del usuario
+     * o, si no lo tiene, su teléfono actual.
+     */
+    updatePhoneNumber(input: CognitoUpdatePhoneNumberRequest): Promise<void>;
 }

package/bin/cognitoConnector/CognitoConnectorApi.js

@@ -84,6 +84,14 @@ let CognitoConnectorApi = class CognitoConnectorApi {
         const url = `${this.baseUrl}cognito/resetPassword`;
         return await this.httpRequest.post(url, { username, typeOfDirectoryId }, { operationName: "postConnectorCognitoResetPassword" });
     }
+    /**
+     * Cambia el phone_number de un usuario (PUT cognito/user del conector). Mismo contrato que
+     * CognitoAdapter.updateAttribute de fiado-directory-lambda: `username` es el identityId del usuario
+     * o, si no lo tiene, su teléfono actual.
+     */
+    async updatePhoneNumber(input) {
+        await this.httpRequest.put(`${this.baseUrl}cognito/user`, input);
+    }
 };
 CognitoConnectorApi = __decorate([
     injectable(),

package/bin/cognitoConnector/interfaces/ICognitoConnectorApi.d.ts

@@ -1,5 +1,11 @@
 import { GetUserRequest, GetUserResponse, RefreshTokenRequest, RefreshTokenResponse, RespondToAuthChallengeRequest, SetPasswordRequest, SignInRequest, SignInResponse, SignUpConfirmRequest, SignUpRequest, SignUpResponse } from "@fiado/type-kit/bin/cognitoConnector/index.js";
 import { TypeOfDirectoryId } from "@fiado/type-kit/bin/directory/index.js";
+/** Body de PUT cognito/user: `username` es el identityId o, si no hay, el teléfono actual. */
+export interface CognitoUpdatePhoneNumberRequest {
+    username: string;
+    phoneNumber: string;
+    typeOfDirectoryId: TypeOfDirectoryId;
+}
 export interface ICognitoConnectorApi {
     signUp(input: SignUpRequest): Promise<SignUpResponse>;
     signIn(input: SignInRequest): Promise<SignInResponse>;
@@ -10,4 +16,5 @@ export interface ICognitoConnectorApi {
     respondToNewPasswordChallenge(input: RespondToAuthChallengeRequest): Promise<SignInResponse>;
     resetPassword(username: string, typeOfDirectoryId: TypeOfDirectoryId): Promise<void>;
     deleteCognitoUser(identityId: string, typeOfDirectoryId?: TypeOfDirectoryId): Promise<void>;
+    updatePhoneNumber(input: CognitoUpdatePhoneNumberRequest): Promise<void>;
 }

package/bin/fiadoMessages/api/FiadoMessagesApi.d.ts

@@ -1,8 +1,10 @@
-import { IHttpRequest } from "@fiado/http-client";
-import { IFiadoMessagesApi } from "./interfaces/IFiadoMessagesApi.js";
+import type { IHttpRequest } from "@fiado/http-client";
+import type { IFiadoMessagesApi, SendMessageRequest } from "./interfaces/IFiadoMessagesApi.js";
 export declare class FiadoMessagesApi implements IFiadoMessagesApi {
     private httpRequest;
     private readonly baseUrl;
     constructor(httpRequest: IHttpRequest);
     getValidatedOtpByDirectoryIdAndOtpCode(directoryId: string, otpCode: string): Promise<any>;
+    /** Envía un mensaje (SMS, etc.) por fiado-messages-lambda. Mismo contrato que MessageAdapter.sendSMS de fiado-directory-lambda. */
+    sendMessage(message: SendMessageRequest): Promise<any>;
 }

package/bin/fiadoMessages/api/FiadoMessagesApi.js

@@ -26,6 +26,10 @@ let FiadoMessagesApi = class FiadoMessagesApi {
         };
         return await this.httpRequest.post(`${url}`, request, { 'operationName': operationName });
     }
+    /** Envía un mensaje (SMS, etc.) por fiado-messages-lambda. Mismo contrato que MessageAdapter.sendSMS de fiado-directory-lambda. */
+    async sendMessage(message) {
+        return await this.httpRequest.post(this.baseUrl, message, { operationName: "postSendMessage", app: "USERS_APP" });
+    }
 };
 FiadoMessagesApi = __decorate([
     injectable(),

package/bin/fiadoMessages/api/interfaces/IFiadoMessagesApi.d.ts

@@ -1,3 +1,24 @@
+/** Body de postSendMessage en fiado-messages-lambda (NotificationPush de los lambdas legacy). */
+export interface SendMessageRequest {
+    messageType: string;
+    channelType: string;
+    directoryId: string | null;
+    typeOfDirectory: string | null;
+    destination: string;
+    language: string;
+    referenceMessageId: string | null;
+    country: string;
+    beneficiaryDirectoryId: string | null;
+    beneficiaryTypeOfDirectoryId: string | null;
+    status: string;
+    transactionNumber: string;
+    var1: unknown;
+    var2: unknown;
+    var3: unknown;
+    var4: unknown;
+    options: unknown;
+}
 export interface IFiadoMessagesApi {
     getValidatedOtpByDirectoryIdAndOtpCode(directoryId: string, otpCode: string): Promise<any>;
+    sendMessage(message: SendMessageRequest): Promise<any>;
 }

package/bin/file-storage/FileStorageApi.d.ts

@@ -1,6 +1,6 @@
 import type { IHttpRequest } from "@fiado/http-client";
 import type { UserDocumentItem } from "@fiado/type-kit/bin/fileStorage/index.js";
-import type { IFileStorageApi } from "./interfaces/IFileStorageApi.js";
+import type { IFileStorageApi, SaveFilesRequest } from "./interfaces/IFileStorageApi.js";
 type FiadoApiResponse<T> = import("@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse.js").default<T>;
 export declare class FileStorageApi implements IFileStorageApi {
     private readonly httpRequest;
@@ -11,5 +11,6 @@ export declare class FileStorageApi implements IFileStorageApi {
     getUserDocumentSignUrl(key: string): Promise<FiadoApiResponse<{
         url: string;
     }>>;
+    saveFiles(request: SaveFilesRequest): Promise<FiadoApiResponse<unknown>>;
 }
 export {};

package/bin/file-storage/FileStorageApi.js

@@ -37,6 +37,12 @@ let FileStorageApi = class FileStorageApi {
         }
         return await this.httpRequest.post(this.baseUrl, { key }, { operationName: "getUserDocumentSignUrl" });
     }
+    async saveFiles(request) {
+        if (!request?.path || !request.files?.length) {
+            throw new Error("path and at least one file are required.");
+        }
+        return await this.httpRequest.post(this.baseUrl, request, { operationName: "postDocumentCheck" });
+    }
 };
 FileStorageApi = __decorate([
     injectable(),

package/bin/file-storage/interfaces/IFileStorageApi.d.ts

@@ -4,6 +4,14 @@ type FiadoApiResponse<T> = import("@fiado/type-kit/bin/apiResponse/dtos/FiadoApi
  * Cliente de fiado-s3-lambda (documentos de usuario en S3). Una sola ruta POST; la operación viaja en el
  * header `operationName`. Mismo contrato que consumía el S3Adapter de fiado-identity-lambda.
  */
+/** Archivos en base64 (sin el prefijo `data:...;base64,`) a guardar bajo `path`, p. ej. `USER/{directoryId}`. */
+export interface SaveFilesRequest {
+    path: string;
+    files: Array<{
+        fileName: string;
+        content: string;
+    }>;
+}
 export interface IFileStorageApi {
     /** Lista los objetos bajo un prefijo, p. ej. `USER/{directoryId}`. Devuelve key completa, lastModified, sizeKb y url firmada. */
     listDirectoryDocuments(directory: string): Promise<FiadoApiResponse<UserDocumentItem[]>>;
@@ -13,5 +21,7 @@ export interface IFileStorageApi {
     getUserDocumentSignUrl(key: string): Promise<FiadoApiResponse<{
         url: string;
     }>>;
+    /** Guarda archivos (operación postDocumentCheck). Mismo contrato que DocumentAdapter.saveFileToS3 de fiado-directory-lambda. */
+    saveFiles(request: SaveFilesRequest): Promise<FiadoApiResponse<unknown>>;
 }
 export {};

package/bin/onboarding/api/OnboardingApi.d.ts

@@ -9,4 +9,6 @@ export default class OnboardingApi implements IOnboardingApi {
     getOnboardingSteps(directoryId: string, countryId: string): Promise<OnboardingStepsEnvelope>;
     /** Onboardings por lote de fiado-onboarding-lambda (GET ids?directoryId=...). Lo usa la actividad diaria del backoffice. */
     getByIds(directoryIds: string[]): Promise<any>;
+    /** Cambia el teléfono del onboarding (PUT raíz de fiado-onboarding-lambda). Lo usa el cambio de teléfono del backoffice. */
+    updatePhoneNumber(directoryId: string, phoneNumber: string): Promise<any>;
 }

package/bin/onboarding/api/OnboardingApi.js

@@ -37,6 +37,10 @@ let OnboardingApi = class OnboardingApi {
         const query = directoryIds.map((id) => `directoryId=${encodeURIComponent(id)}`).join("&");
         return await this.httpRequest.get(`${this.baseUrl}ids?${query}`);
     }
+    /** Cambia el teléfono del onboarding (PUT raíz de fiado-onboarding-lambda). Lo usa el cambio de teléfono del backoffice. */
+    async updatePhoneNumber(directoryId, phoneNumber) {
+        return await this.httpRequest.put(this.baseUrl, { directoryId, phoneNumber });
+    }
 };
 OnboardingApi = __decorate([
     injectable(),

package/bin/onboarding/api/interfaces/IOnboardingApi.d.ts

@@ -12,4 +12,6 @@ export interface IOnboardingApi {
     getOnboardingSteps(directoryId: string, countryId: string): Promise<OnboardingStepsEnvelope>;
     /** Onboardings por lote (envelope con data: onboarding[] con id = directoryId y referralCode). */
     getByIds(directoryIds: string[]): Promise<any>;
+    /** PUT raíz de fiado-onboarding-lambda con {directoryId, phoneNumber}. */
+    updatePhoneNumber(directoryId: string, phoneNumber: string): Promise<any>;
 }

package/bin/platformRbac/resolver/ApiInvokerPermissionResolver.d.ts

@@ -1,19 +1,7 @@
 import type { ResolveInput, ResolvedPermissions } from "@fiado/gateway-adapter";
 import type { IPlatformRbacBusinessApi } from "../api/interfaces/IPlatformRbacBusinessApi.js";
-/**
- * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
- * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
- * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
- * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
- * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
- *
- * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
- * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
- * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
- * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
- * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
- * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
- */
+/** Resuelve permisos vía el endpoint privado de rbac-business y cachea solo el fallback (sin roles del token).
+ *  Llave de caché: `${principalType}#${issuer}#${cognitoSub}`. */
 export declare class ApiInvokerPermissionResolver {
     private readonly _api;
     private readonly _cache;

package/bin/platformRbac/resolver/ApiInvokerPermissionResolver.js

@@ -12,20 +12,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from "inversify";
 import { TtlCache } from "@fiado/gateway-adapter";
-/**
- * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
- * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
- * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
- * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
- * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
- *
- * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
- * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
- * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
- * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
- * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
- * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
- */
+/** Resuelve permisos vía el endpoint privado de rbac-business y cachea solo el fallback (sin roles del token).
+ *  Llave de caché: `${principalType}#${issuer}#${cognitoSub}`. */
 let ApiInvokerPermissionResolver = class ApiInvokerPermissionResolver {
     _api;
     _cache;
@@ -38,16 +26,7 @@ let ApiInvokerPermissionResolver = class ApiInvokerPermissionResolver {
     }
     async resolve(input) {
         const cacheable = input.roleAssignmentsFromToken === undefined;
-        // DEC-RBAC-124: el tipo de principal entra en la cache key. NO es defensa contra colisión
-        // —los subs de integración llevan prefijo `INT#` y no chocan con un UUID de Cognito— sino
-        // para que el canal quede explícito y un cambio futuro de formato no cause aliasing
-        // silencioso entre un usuario y una integración.
-        //
-        // Se lee con cast en vez de tiparlo desde `ResolveInput` A PROPÓSITO: `principalType` recién
-        // existe en `@fiado/gateway-adapter` 4.x, y esta lib la consume toda la flota. Atarla al
-        // prerelease obligaría a todos a subir de major. Así compila igual contra 3.x y 4.x, y el
-        // reenvío al endpoint privado funciona en runtime porque `resolvePermissions(input)` manda
-        // el objeto entero sin filtrar campos.
+        // El tipo de principal va en la llave: USER, INTEGRATION y API_USER nunca comparten entrada.
         const principalType = input.principalType ?? "USER";
         const key = `${principalType}#${input.issuer ?? ""}#${input.cognitoSub}`;
         if (cacheable) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "5.106.0",
+  "version": "5.108.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "type": "module",
   "main": "bin/index.js",
@@ -34,7 +34,7 @@
     "@fiado/gateway-adapter": "^3.9.0",
     "@fiado/http-client": "^2.0.1",
     "@fiado/logger": "^1.1.3",
-    "@fiado/type-kit": "^3.487.0",
+    "@fiado/type-kit": "^3.488.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {

package/src/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.ts

@@ -32,6 +32,8 @@ import {
     UpdateProfileRequest,
     CreatePoolRequest,
     CreatePoolResponse,
+    CreatePoolClientRequest,
+    CreatePoolClientResponse,
     DeletePoolRequest,
     HealthcheckResponse,
     VerifyPasswordRequest,
@@ -269,6 +271,14 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
         return await this.httpRequest.post(url, input);
     }
 
+    async createPoolClient(
+        userPoolId: string,
+        input: CreatePoolClientRequest,
+    ): Promise<ApiGatewayResponse<CreatePoolClientResponse>> {
+        const url = `${this.baseUrl}/pools/${encodeURIComponent(userPoolId)}/clients`;
+        return await this.httpRequest.post(url, input);
+    }
+
     async deletePool(userPoolId: string, region: string): Promise<ApiGatewayResponse<void>> {
         const url = `${this.baseUrl}/pools/${encodeURIComponent(userPoolId)}`;
         return await this.httpRequest.delete(url, { region });

package/src/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.ts

@@ -30,6 +30,8 @@ import {
     UpdateProfileRequest,
     CreatePoolRequest,
     CreatePoolResponse,
+    CreatePoolClientRequest,
+    CreatePoolClientResponse,
     DeletePoolRequest,
     HealthcheckResponse,
     VerifyPasswordRequest,
@@ -203,6 +205,9 @@ export interface ICognitoBackofficeConnectorApi {
      */
     createPool(input: CreatePoolRequest): Promise<ApiGatewayResponse<CreatePoolResponse>>;
 
+    /** POST /pools/{userPoolId}/clients — app client extra sobre un pool existente (usuarios de API). */
+    createPoolClient(userPoolId: string, input: CreatePoolClientRequest): Promise<ApiGatewayResponse<CreatePoolClientResponse>>;
+
     /**
      * DELETE /pools/{userPoolId}?region=X — elimina un user pool vacío (pivote
      * v1.4.1 — compensation chain de saga). Requiere pool sin users; si tiene

package/src/cognitoConnector/CognitoConnectorApi.ts

@@ -1,7 +1,7 @@
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { GetUserRequest, GetUserResponse, RefreshTokenRequest, RefreshTokenResponse, RespondToAuthChallengeRequest, SetPasswordRequest, SignInRequest, SignInResponse, SignUpConfirmRequest, SignUpRequest, SignUpResponse } from "@fiado/type-kit/bin/cognitoConnector/index.js";
 import { inject, injectable } from "inversify";
-import { ICognitoConnectorApi } from "./interfaces/ICognitoConnectorApi.js";
+import type { CognitoUpdatePhoneNumberRequest, ICognitoConnectorApi } from "./interfaces/ICognitoConnectorApi.js";
 import { TypeOfDirectoryId } from "@fiado/type-kit/bin/directory/index.js";
 
 @injectable()
@@ -107,6 +107,13 @@ export default class CognitoConnectorApi implements ICognitoConnectorApi {
         const url = `${this.baseUrl}cognito/resetPassword`;
         return await this.httpRequest.post(url, { username, typeOfDirectoryId }, { operationName: "postConnectorCognitoResetPassword" });
     }
-}
-
 
+    /**
+     * Cambia el phone_number de un usuario (PUT cognito/user del conector). Mismo contrato que
+     * CognitoAdapter.updateAttribute de fiado-directory-lambda: `username` es el identityId del usuario
+     * o, si no lo tiene, su teléfono actual.
+     */
+    async updatePhoneNumber(input: CognitoUpdatePhoneNumberRequest): Promise<void> {
+        await this.httpRequest.put(`${this.baseUrl}cognito/user`, input);
+    }
+}

package/src/cognitoConnector/interfaces/ICognitoConnectorApi.ts

@@ -3,6 +3,13 @@ import { TypeOfDirectoryId } from "@fiado/type-kit/bin/directory/index.js";
 
 
 
+/** Body de PUT cognito/user: `username` es el identityId o, si no hay, el teléfono actual. */
+export interface CognitoUpdatePhoneNumberRequest {
+    username: string;
+    phoneNumber: string;
+    typeOfDirectoryId: TypeOfDirectoryId;
+}
+
 export interface ICognitoConnectorApi {
 
     signUp(input: SignUpRequest): Promise<SignUpResponse>;
@@ -14,4 +21,5 @@ export interface ICognitoConnectorApi {
     respondToNewPasswordChallenge(input: RespondToAuthChallengeRequest): Promise<SignInResponse>;
     resetPassword(username: string, typeOfDirectoryId: TypeOfDirectoryId): Promise<void>;
     deleteCognitoUser(identityId: string, typeOfDirectoryId?: TypeOfDirectoryId): Promise<void>;
+    updatePhoneNumber(input: CognitoUpdatePhoneNumberRequest): Promise<void>;
 }

package/src/fiadoMessages/api/FiadoMessagesApi.ts

@@ -1,6 +1,6 @@
 import {inject, injectable} from "inversify";
-import {IHttpRequest} from "@fiado/http-client";
-import {IFiadoMessagesApi} from "./interfaces/IFiadoMessagesApi.js";
+import type {IHttpRequest} from "@fiado/http-client";
+import type {IFiadoMessagesApi, SendMessageRequest} from "./interfaces/IFiadoMessagesApi.js";
 
 @injectable()
 export class FiadoMessagesApi implements IFiadoMessagesApi {
@@ -18,4 +18,9 @@ export class FiadoMessagesApi implements IFiadoMessagesApi {
         };
         return await this.httpRequest.post(`${url}`, request, {'operationName': operationName});
     }
-}
+
+    /** Envía un mensaje (SMS, etc.) por fiado-messages-lambda. Mismo contrato que MessageAdapter.sendSMS de fiado-directory-lambda. */
+    async sendMessage(message: SendMessageRequest): Promise<any> {
+        return await this.httpRequest.post(this.baseUrl, message, { operationName: "postSendMessage", app: "USERS_APP" });
+    }
+}

package/src/fiadoMessages/api/interfaces/IFiadoMessagesApi.ts

@@ -1,3 +1,25 @@
+/** Body de postSendMessage en fiado-messages-lambda (NotificationPush de los lambdas legacy). */
+export interface SendMessageRequest {
+    messageType: string;
+    channelType: string;
+    directoryId: string | null;
+    typeOfDirectory: string | null;
+    destination: string;
+    language: string;
+    referenceMessageId: string | null;
+    country: string;
+    beneficiaryDirectoryId: string | null;
+    beneficiaryTypeOfDirectoryId: string | null;
+    status: string;
+    transactionNumber: string;
+    var1: unknown;
+    var2: unknown;
+    var3: unknown;
+    var4: unknown;
+    options: unknown;
+}
+
 export interface IFiadoMessagesApi {
     getValidatedOtpByDirectoryIdAndOtpCode(directoryId: string, otpCode: string): Promise<any>;
-}
+    sendMessage(message: SendMessageRequest): Promise<any>;
+}

package/src/file-storage/FileStorageApi.ts

@@ -2,7 +2,7 @@ import { inject, injectable } from "inversify";
 import type { IHttpRequest } from "@fiado/http-client";
 import dotenv from "dotenv";
 import type { UserDocumentItem } from "@fiado/type-kit/bin/fileStorage/index.js";
-import type { IFileStorageApi } from "./interfaces/IFileStorageApi.js";
+import type { IFileStorageApi, SaveFilesRequest } from "./interfaces/IFileStorageApi.js";
 type FiadoApiResponse<T> = import("@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse.js").default<T>;
 
 dotenv.config();
@@ -40,4 +40,13 @@ export class FileStorageApi implements IFileStorageApi {
             this.baseUrl, { key }, { operationName: "getUserDocumentSignUrl" },
         );
     }
+
+    async saveFiles(request: SaveFilesRequest): Promise<FiadoApiResponse<unknown>> {
+        if (!request?.path || !request.files?.length) {
+            throw new Error("path and at least one file are required.");
+        }
+        return await this.httpRequest.post<FiadoApiResponse<unknown>>(
+            this.baseUrl, request, { operationName: "postDocumentCheck" },
+        );
+    }
 }

package/src/file-storage/interfaces/IFileStorageApi.ts

@@ -5,6 +5,12 @@ type FiadoApiResponse<T> = import("@fiado/type-kit/bin/apiResponse/dtos/FiadoApi
  * Cliente de fiado-s3-lambda (documentos de usuario en S3). Una sola ruta POST; la operación viaja en el
  * header `operationName`. Mismo contrato que consumía el S3Adapter de fiado-identity-lambda.
  */
+/** Archivos en base64 (sin el prefijo `data:...;base64,`) a guardar bajo `path`, p. ej. `USER/{directoryId}`. */
+export interface SaveFilesRequest {
+    path: string;
+    files: Array<{ fileName: string; content: string }>;
+}
+
 export interface IFileStorageApi {
     /** Lista los objetos bajo un prefijo, p. ej. `USER/{directoryId}`. Devuelve key completa, lastModified, sizeKb y url firmada. */
     listDirectoryDocuments(directory: string): Promise<FiadoApiResponse<UserDocumentItem[]>>;
@@ -12,4 +18,6 @@ export interface IFileStorageApi {
     deleteUserDocument(fileName: string): Promise<FiadoApiResponse<void>>;
     /** URL firmada de lectura para una key completa. */
     getUserDocumentSignUrl(key: string): Promise<FiadoApiResponse<{ url: string }>>;
+    /** Guarda archivos (operación postDocumentCheck). Mismo contrato que DocumentAdapter.saveFileToS3 de fiado-directory-lambda. */
+    saveFiles(request: SaveFilesRequest): Promise<FiadoApiResponse<unknown>>;
 }

package/src/onboarding/api/OnboardingApi.ts

@@ -33,4 +33,9 @@ export default class OnboardingApi implements IOnboardingApi {
         const query = directoryIds.map((id) => `directoryId=${encodeURIComponent(id)}`).join("&");
         return await this.httpRequest.get(`${this.baseUrl}ids?${query}`);
     }
+
+    /** Cambia el teléfono del onboarding (PUT raíz de fiado-onboarding-lambda). Lo usa el cambio de teléfono del backoffice. */
+    async updatePhoneNumber(directoryId: string, phoneNumber: string): Promise<any> {
+        return await this.httpRequest.put(this.baseUrl, { directoryId, phoneNumber });
+    }
 }

package/src/onboarding/api/interfaces/IOnboardingApi.ts

@@ -14,5 +14,7 @@ export interface IOnboardingApi {
 
     /** Onboardings por lote (envelope con data: onboarding[] con id = directoryId y referralCode). */
     getByIds(directoryIds: string[]): Promise<any>;
+    /** PUT raíz de fiado-onboarding-lambda con {directoryId, phoneNumber}. */
+    updatePhoneNumber(directoryId: string, phoneNumber: string): Promise<any>;
 
 }

package/src/platformRbac/resolver/ApiInvokerPermissionResolver.ts

@@ -3,20 +3,8 @@ import type { ResolveInput, ResolvedPermissions } from "@fiado/gateway-adapter";
 import { TtlCache } from "@fiado/gateway-adapter";
 import type { IPlatformRbacBusinessApi } from "../api/interfaces/IPlatformRbacBusinessApi.js";
 
-/**
- * DEC-RBAC-064/066: resuelve permisos invocando el endpoint privado de rbac-business vía el publisher
- * tipado (HTTP sobre VpcEndpoint), reemplazando la lectura directa de DDB. Cachea la rama fallback;
- * la rama token-trust NO se cachea (paridad con DdbPermissionResolver, evita poisoning).
- * Cache key = `${issuer}#${cognitoSub}` (decisión consciente: el cliente no conoce el tenantId antes
- * de invocar; issuer<->tenantId mapean 1:1 vía el pool).
- *
- * NOTA (TD-AI-002): `@fiado/gateway-adapter` NO re-exporta el tipo `IPermissionResolver` desde su
- * barrel (`bin/index.d.ts` solo expone ResolveInput/ResolvedPermissions/ScopedAssignment/PERMISSION_RESOLVER)
- * y su `exports` map bloquea el deep-import del sub-path bajo nodenext. Por eso esta clase implementa
- * el contrato ESTRUCTURALMENTE (`resolve(input): Promise<ResolvedPermissions>`) sin la cláusula
- * `implements IPermissionResolver`. TypeScript es structural-typed: la instancia es asignable al
- * símbolo PERMISSION_RESOLVER en el binding. Ver docs/TECH_DEBT.md.
- */
+/** Resuelve permisos vía el endpoint privado de rbac-business y cachea solo el fallback (sin roles del token).
+ *  Llave de caché: `${principalType}#${issuer}#${cognitoSub}`. */
 @injectable()
 export class ApiInvokerPermissionResolver {
     private readonly _cache: TtlCache<ResolvedPermissions>;
@@ -31,17 +19,8 @@ export class ApiInvokerPermissionResolver {
     }
     async resolve(input: ResolveInput): Promise<ResolvedPermissions> {
         const cacheable = input.roleAssignmentsFromToken === undefined;
-        // DEC-RBAC-124: el tipo de principal entra en la cache key. NO es defensa contra colisión
-        // —los subs de integración llevan prefijo `INT#` y no chocan con un UUID de Cognito— sino
-        // para que el canal quede explícito y un cambio futuro de formato no cause aliasing
-        // silencioso entre un usuario y una integración.
-        //
-        // Se lee con cast en vez de tiparlo desde `ResolveInput` A PROPÓSITO: `principalType` recién
-        // existe en `@fiado/gateway-adapter` 4.x, y esta lib la consume toda la flota. Atarla al
-        // prerelease obligaría a todos a subir de major. Así compila igual contra 3.x y 4.x, y el
-        // reenvío al endpoint privado funciona en runtime porque `resolvePermissions(input)` manda
-        // el objeto entero sin filtrar campos.
-        const principalType = (input as { principalType?: string }).principalType ?? "USER";
+        // El tipo de principal va en la llave: USER, INTEGRATION y API_USER nunca comparten entrada.
+        const principalType = input.principalType ?? "USER";
         const key = `${principalType}#${input.issuer ?? ""}#${input.cognitoSub}`;
         if (cacheable) {
             const hit = this._cache.get(key);