@fiado/type-kit 3.131.0 → 3.132.0

package/_test_/unit/platformRbac/enums/PrincipalIdentifierEnum.test.ts

@@ -0,0 +1,10 @@
+import { describe, it, expect } from '@jest/globals';
+import { PrincipalIdentifierEnum } from '../../../../src/platformRbac/enums/PrincipalIdentifierEnum';
+
+describe('PrincipalIdentifierEnum', () => {
+    it('tiene EMAIL y PHONE con esos valores', () => {
+        expect(PrincipalIdentifierEnum.EMAIL).toBe('EMAIL');
+        expect(PrincipalIdentifierEnum.PHONE).toBe('PHONE');
+        expect(Object.values(PrincipalIdentifierEnum)).toEqual(['EMAIL', 'PHONE']);
+    });
+});

package/bin/cognitoBackofficeConnector/dtos/CreatePoolRequest.d.ts

@@ -19,4 +19,9 @@ export declare class CreatePoolRequest {
     passwordPolicy: PasswordPolicyConfig;
     customAttributes: CustomAttributeSpec[];
     appClientConfig: AppClientConfig;
+    /**
+     * DEC-RBAC-079: atributos de sign-in del pool (Cognito UsernameAttributes). Ausente → el connector
+     * default-ea a ['email'] (backward-compatible con los pools ya creados).
+     */
+    usernameAttributes?: Array<'email' | 'phone_number'>;
 }

package/bin/cognitoBackofficeConnector/dtos/CreatePoolRequest.js

@@ -59,3 +59,10 @@ __decorate([
     (0, class_transformer_1.Type)(() => AppClientConfig_1.AppClientConfig),
     __metadata("design:type", AppClientConfig_1.AppClientConfig)
 ], CreatePoolRequest.prototype, "appClientConfig", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsIn)(['email', 'phone_number'], { each: true }),
+    __metadata("design:type", Array)
+], CreatePoolRequest.prototype, "usernameAttributes", void 0);

package/bin/platformRbac/application/Application.d.ts

@@ -1,4 +1,5 @@
 import { PermissionScope } from '../enums/PermissionScope';
+import { PrincipalIdentifierEnum } from '../enums/PrincipalIdentifierEnum';
 import { ApplicationStatus } from '../enums/ApplicationStatus';
 import type { UserFieldDef } from '../dtos/UserFieldDef';
 import type { TokenValidationMode } from '../enums/TokenValidationMode';
@@ -35,6 +36,14 @@ export interface ApplicationDefaults {
     brandingConfig?: ApplicationBrandingDefault;
     tokenValidationMode?: TokenValidationMode;
     autoregister?: AutoregisterConfig;
+    /** DEC-RBAC-079: identificador principal de login que heredan los tenants de esta app. Default EMAIL. */
+    principalIdentifier?: PrincipalIdentifierEnum;
+    /**
+     * DEC-RBAC-081: si la app permite un identificador secundario (el otro método) que el usuario/admin
+     * agrega y verifica después, habilitando login dual. Default false. INMUTABLE (define el
+     * UsernameAttributes del pool): true ⇒ pool con ['email','phone_number']. Heredado al tenant.
+     */
+    allowSecondary?: boolean;
 }
 export interface SeedRole {
     roleId: string;

package/bin/platformRbac/dtos/ResendOtpRequest.d.ts

@@ -0,0 +1,22 @@
+import { MfaMethodEnum } from '../enums/MfaMethodEnum';
+/**
+ * Body del POST /auth/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Reenvía el OTP del login re-disparando el challenge real CUSTOM_AUTH (EMAIL_OTP) para la
+ * identidad SIN password. `tenantId` obligatorio (DEC-064 — el picker ya lo resolvió, NO "solo email").
+ * El email se normaliza lowercase server-side. Postura anti-enumeración: respuesta 200 genérica
+ * siempre, sin filtrar existencia (ver AuthLoginManager.resendChallengeOtp).
+ */
+export declare class ResendOtpRequest {
+    email: string;
+    tenantId: string;
+}
+/**
+ * Respuesta del resend-otp. `session`/`mfaMethod` frescos del nuevo challenge CUSTOM_AUTH.
+ * Plain sin validators (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ * Ambos opcionales: en los caminos de rechazo silencioso (anti-enumeración) o ramas sin CUSTOM_AUTH
+ * el server responde 200 genérico sin session ni método.
+ */
+export interface ResendOtpResponse {
+    session?: string;
+    mfaMethod?: MfaMethodEnum;
+}

package/bin/{walletFunding/dtos/CancelFundingRequest.js → platformRbac/dtos/ResendOtpRequest.js}

@@ -9,25 +9,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingRequest = void 0;
+exports.ResendOtpRequest = void 0;
+const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
 /**
- * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `fundingId` viaja en el path, `directoryId` se resuelve del JWT.
- * `providerModuleName` permite al marketplace rutear al publisher correcto
- * sin tener que persistir el mapping (el wallet-app sabe el moduleName
- * porque vino en la respuesta del authorize).
+ * Body del POST /auth/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Reenvía el OTP del login re-disparando el challenge real CUSTOM_AUTH (EMAIL_OTP) para la
+ * identidad SIN password. `tenantId` obligatorio (DEC-064 — el picker ya lo resolvió, NO "solo email").
+ * El email se normaliza lowercase server-side. Postura anti-enumeración: respuesta 200 genérica
+ * siempre, sin filtrar existencia (ver AuthLoginManager.resendChallengeOtp).
  */
-class CancelFundingRequest {
+class ResendOtpRequest {
 }
-exports.CancelFundingRequest = CancelFundingRequest;
+exports.ResendOtpRequest = ResendOtpRequest;
 __decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
-], CancelFundingRequest.prototype, "idempotencyKey", void 0);
+], ResendOtpRequest.prototype, "email", void 0);
 __decorate([
+    (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(128),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
-], CancelFundingRequest.prototype, "providerModuleName", void 0);
+], ResendOtpRequest.prototype, "tenantId", void 0);

package/bin/platformRbac/dtos/ResendSelfRegisterOtpRequest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Body del POST /self-register/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Re-envía el OTP del autoregistro (mecanismo messages-business, NO Cognito) tras validar un
+ * `pending` existente. Misma postura anti-enumeración del start. El email se normaliza lowercase
+ * server-side. DTO propio por endpoint (NO reusa SelfRegisterStartRequest, que exige roleId/scope/
+ * scopeRef, ni SelfRegisterVerifyOtpRequest, que exige otp).
+ */
+export declare class ResendSelfRegisterOtpRequest {
+    tenantId: string;
+    email: string;
+}

package/bin/{cognitoBackofficeConnector/dtos/MfaPoolConfig.js → platformRbac/dtos/ResendSelfRegisterOtpRequest.js}

@@ -9,28 +9,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MfaPoolConfig = void 0;
+exports.ResendSelfRegisterOtpRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
-const MfaTypesRequiresOne_1 = require("../validators/MfaTypesRequiresOne");
-// EMAIL_OTP removido (3.41.0): el cognito-backoffice-connector no provisiona
-// EmailMfaConfiguration a nivel pool (requiere infra SES que no está montada
-// y la integración con messages-lambda aún no tiene diseño). Ver TD-020 +
-// DEC-001 en cognito-backoffice-connector/docs/. Si se reintroduce, agregar
-// 'EMAIL_OTP' a este array.
-const ALLOWED_MFA_TYPES = ['SOFTWARE_TOKEN_MFA'];
-class MfaPoolConfig {
+/**
+ * Body del POST /self-register/resend-otp (público, anónimo). DEC-RBAC-054.
+ * Re-envía el OTP del autoregistro (mecanismo messages-business, NO Cognito) tras validar un
+ * `pending` existente. Misma postura anti-enumeración del start. El email se normaliza lowercase
+ * server-side. DTO propio por endpoint (NO reusa SelfRegisterStartRequest, que exige roleId/scope/
+ * scopeRef, ni SelfRegisterVerifyOtpRequest, que exige otp).
+ */
+class ResendSelfRegisterOtpRequest {
 }
-exports.MfaPoolConfig = MfaPoolConfig;
+exports.ResendSelfRegisterOtpRequest = ResendSelfRegisterOtpRequest;
 __decorate([
     (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsBoolean)(),
-    __metadata("design:type", Boolean)
-], MfaPoolConfig.prototype, "requireMfa", void 0);
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ResendSelfRegisterOtpRequest.prototype, "tenantId", void 0);
 __decorate([
     (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsArray)(),
-    (0, class_validator_1.IsIn)(ALLOWED_MFA_TYPES, { each: true }),
-    (0, class_validator_1.Validate)(MfaTypesRequiresOne_1.MfaTypesRequiresOne),
-    __metadata("design:type", Array)
-], MfaPoolConfig.prototype, "mfaTypes", void 0);
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ResendSelfRegisterOtpRequest.prototype, "email", void 0);

package/bin/platformRbac/enums/PrincipalIdentifierEnum.d.ts

@@ -0,0 +1,8 @@
+/**
+ * DEC-RBAC-079: identificador principal de login de una aplicación. Lo hereda cada tenant (inmutable)
+ * y determina el UsernameAttributes del pool, el campo obligatorio del alta y el canal de mensajes.
+ */
+export declare enum PrincipalIdentifierEnum {
+    EMAIL = "EMAIL",
+    PHONE = "PHONE"
+}

package/bin/platformRbac/enums/PrincipalIdentifierEnum.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrincipalIdentifierEnum = void 0;
+/**
+ * DEC-RBAC-079: identificador principal de login de una aplicación. Lo hereda cada tenant (inmutable)
+ * y determina el UsernameAttributes del pool, el campo obligatorio del alta y el canal de mensajes.
+ */
+var PrincipalIdentifierEnum;
+(function (PrincipalIdentifierEnum) {
+    PrincipalIdentifierEnum["EMAIL"] = "EMAIL";
+    PrincipalIdentifierEnum["PHONE"] = "PHONE";
+})(PrincipalIdentifierEnum || (exports.PrincipalIdentifierEnum = PrincipalIdentifierEnum = {}));

package/bin/platformRbac/index.d.ts

@@ -1,6 +1,7 @@
 export { Permission, PERMISSION_BIT_ORDER, PERMS_VERSION, permissionsToBits, bitsToPermissions, } from './enums/Permission';
 export { PermissionScope } from './enums/PermissionScope';
 export { PermissionCategory } from './enums/PermissionCategory';
+export { PrincipalIdentifierEnum } from './enums/PrincipalIdentifierEnum';
 export type { AuthContext } from './dtos/AuthContext';
 export type { RoleAssignmentInfo } from './dtos/RoleAssignmentInfo';
 export type { PermissionMeta } from './dtos/PermissionMeta';

package/bin/platformRbac/index.js

@@ -23,7 +23,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserFieldType = exports.scopeRankOrder = exports.tableSuffixForLevel = exports.levelsOf = exports.TENANT_TYPES = exports.TenantType = exports.AuthorizeDenyReason = exports.PermissionCategory = exports.PermissionScope = exports.bitsToPermissions = exports.permissionsToBits = exports.PERMS_VERSION = exports.PERMISSION_BIT_ORDER = exports.Permission = void 0;
+exports.UserFieldType = exports.scopeRankOrder = exports.tableSuffixForLevel = exports.levelsOf = exports.TENANT_TYPES = exports.TenantType = exports.AuthorizeDenyReason = exports.PrincipalIdentifierEnum = exports.PermissionCategory = exports.PermissionScope = exports.bitsToPermissions = exports.permissionsToBits = exports.PERMS_VERSION = exports.PERMISSION_BIT_ORDER = exports.Permission = void 0;
 var Permission_1 = require("./enums/Permission");
 Object.defineProperty(exports, "Permission", { enumerable: true, get: function () { return Permission_1.Permission; } });
 Object.defineProperty(exports, "PERMISSION_BIT_ORDER", { enumerable: true, get: function () { return Permission_1.PERMISSION_BIT_ORDER; } });
@@ -34,6 +34,9 @@ var PermissionScope_1 = require("./enums/PermissionScope");
 Object.defineProperty(exports, "PermissionScope", { enumerable: true, get: function () { return PermissionScope_1.PermissionScope; } });
 var PermissionCategory_1 = require("./enums/PermissionCategory");
 Object.defineProperty(exports, "PermissionCategory", { enumerable: true, get: function () { return PermissionCategory_1.PermissionCategory; } });
+// DEC-RBAC-079: identificador principal de login por aplicación (heredado por tenant).
+var PrincipalIdentifierEnum_1 = require("./enums/PrincipalIdentifierEnum");
+Object.defineProperty(exports, "PrincipalIdentifierEnum", { enumerable: true, get: function () { return PrincipalIdentifierEnum_1.PrincipalIdentifierEnum; } });
 // Fase 1 — Custom Auth Challenge (Email OTP + TOTP) + MFA self-service.
 // Class values (no type-only) — los DTOs llevan decoradores class-validator y se hidratan con plainToInstance en runtime.
 __exportStar(require("./enums/MfaMethodEnum"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.131.0",
+  "version": "3.132.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/cognitoBackofficeConnector/dtos/CreatePoolRequest.ts

@@ -1,5 +1,5 @@
 import { Expose, Type } from 'class-transformer';
-import { IsArray, IsString, ValidateNested } from 'class-validator';
+import { IsArray, IsIn, IsOptional, IsString, ValidateNested } from 'class-validator';
 import { PasswordPolicyConfig } from './PasswordPolicyConfig';
 import { CustomAttributeSpec } from './CustomAttributeSpec';
 import { AppClientConfig } from './AppClientConfig';
@@ -28,4 +28,14 @@ export class CreatePoolRequest {
 
     @Expose() @ValidateNested() @Type(() => AppClientConfig)
     appClientConfig!: AppClientConfig;
+
+    /**
+     * DEC-RBAC-079: atributos de sign-in del pool (Cognito UsernameAttributes). Ausente → el connector
+     * default-ea a ['email'] (backward-compatible con los pools ya creados).
+     */
+    @Expose()
+    @IsOptional()
+    @IsArray()
+    @IsIn(['email', 'phone_number'], { each: true })
+    usernameAttributes?: Array<'email' | 'phone_number'>;
 }

package/src/platformRbac/application/Application.ts

@@ -1,4 +1,5 @@
 import { PermissionScope } from '../enums/PermissionScope';
+import { PrincipalIdentifierEnum } from '../enums/PrincipalIdentifierEnum';
 import { ApplicationStatus } from '../enums/ApplicationStatus';
 import type { UserFieldDef } from '../dtos/UserFieldDef';
 import type { TokenValidationMode } from '../enums/TokenValidationMode';
@@ -45,6 +46,14 @@ export interface ApplicationDefaults {
     brandingConfig?: ApplicationBrandingDefault;
     tokenValidationMode?: TokenValidationMode;
     autoregister?: AutoregisterConfig;
+    /** DEC-RBAC-079: identificador principal de login que heredan los tenants de esta app. Default EMAIL. */
+    principalIdentifier?: PrincipalIdentifierEnum;
+    /**
+     * DEC-RBAC-081: si la app permite un identificador secundario (el otro método) que el usuario/admin
+     * agrega y verifica después, habilitando login dual. Default false. INMUTABLE (define el
+     * UsernameAttributes del pool): true ⇒ pool con ['email','phone_number']. Heredado al tenant.
+     */
+    allowSecondary?: boolean;
 }
 
 export interface SeedRole {

package/src/platformRbac/enums/PrincipalIdentifierEnum.ts

@@ -0,0 +1,8 @@
+/**
+ * DEC-RBAC-079: identificador principal de login de una aplicación. Lo hereda cada tenant (inmutable)
+ * y determina el UsernameAttributes del pool, el campo obligatorio del alta y el canal de mensajes.
+ */
+export enum PrincipalIdentifierEnum {
+    EMAIL = 'EMAIL',
+    PHONE = 'PHONE',
+}

package/src/platformRbac/index.ts

@@ -17,6 +17,8 @@ export {
 } from './enums/Permission';
 export { PermissionScope } from './enums/PermissionScope';
 export { PermissionCategory } from './enums/PermissionCategory';
+// DEC-RBAC-079: identificador principal de login por aplicación (heredado por tenant).
+export { PrincipalIdentifierEnum } from './enums/PrincipalIdentifierEnum';
 
 export type { AuthContext } from './dtos/AuthContext';
 export type { RoleAssignmentInfo } from './dtos/RoleAssignmentInfo';

package/bin/cognitoBackofficeConnector/dtos/MfaPoolConfig.d.ts

@@ -1,7 +0,0 @@
-declare const ALLOWED_MFA_TYPES: readonly ["SOFTWARE_TOKEN_MFA"];
-export type AllowedMfaType = (typeof ALLOWED_MFA_TYPES)[number];
-export declare class MfaPoolConfig {
-    requireMfa: boolean;
-    mfaTypes: AllowedMfaType[];
-}
-export {};

package/bin/cognitoBackofficeConnector/dtos/PoolConfigResponse.d.ts

@@ -1,20 +0,0 @@
-import { PoolKind } from '../../rbac/enums/PoolKind';
-/**
- * Shape del `PoolConfigRow` expuesto al caller (BFF M18 / otros lambdas Fiado).
- * Refleja la configuración de un Cognito User Pool registrado en la tabla
- * `PoolConfigs_GT` del lambda `cognito-backoffice-connector`.
- */
-export declare class PoolConfigResponse {
-    userPoolId: string;
-    userPoolArn: string;
-    region: string;
-    poolKind: PoolKind;
-    displayName: string;
-    appClients: Record<string, {
-        clientId: string;
-        clientName: string;
-    }>;
-    status: 'active' | 'deprecated';
-    createdAt: number;
-    updatedAt: number;
-}

package/bin/cognitoBackofficeConnector/dtos/PoolConfigResponse.js

@@ -1,11 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PoolConfigResponse = void 0;
-/**
- * Shape del `PoolConfigRow` expuesto al caller (BFF M18 / otros lambdas Fiado).
- * Refleja la configuración de un Cognito User Pool registrado en la tabla
- * `PoolConfigs_GT` del lambda `cognito-backoffice-connector`.
- */
-class PoolConfigResponse {
-}
-exports.PoolConfigResponse = PoolConfigResponse;

package/bin/cognitoBackofficeConnector/dtos/PoolsListResponse.d.ts

@@ -1,4 +0,0 @@
-import { PoolConfigResponse } from './PoolConfigResponse';
-export declare class PoolsListResponse {
-    pools: PoolConfigResponse[];
-}

package/bin/cognitoBackofficeConnector/dtos/PoolsListResponse.js

@@ -1,6 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PoolsListResponse = void 0;
-class PoolsListResponse {
-}
-exports.PoolsListResponse = PoolsListResponse;

package/bin/cognitoBackofficeConnector/validators/MfaTypesRequiresOne.d.ts

@@ -1,17 +0,0 @@
-import { ValidatorConstraintInterface, ValidationArguments } from 'class-validator';
-/**
- * Cross-field validator: si `requireMfa: true`, entonces `mfaTypes` debe tener
- * al menos 1 elemento. Si `requireMfa: false`, `mfaTypes` puede ser vacío.
- *
- * Razón: cuando el pool nace con MFA habilitado, el connector llama
- * `SetUserPoolMfaConfigCommand` con la lista de tipos del DTO. Si el array
- * llega vacío con `requireMfa: true`, el SDK rechaza con InvalidParameterException
- * y el pool queda en estado inconsistente (MfaConfiguration:'ON' sin tipos).
- * Mejor rechazar en validación del DTO antes de tocar AWS.
- *
- * Ver pivote v1.4.1 TD-017 cerrado + spec doc §1 R3.
- */
-export declare class MfaTypesRequiresOne implements ValidatorConstraintInterface {
-    validate(mfaTypes: unknown, args: ValidationArguments): boolean;
-    defaultMessage(): string;
-}

package/bin/cognitoBackofficeConnector/validators/MfaTypesRequiresOne.js

@@ -1,39 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MfaTypesRequiresOne = void 0;
-const class_validator_1 = require("class-validator");
-/**
- * Cross-field validator: si `requireMfa: true`, entonces `mfaTypes` debe tener
- * al menos 1 elemento. Si `requireMfa: false`, `mfaTypes` puede ser vacío.
- *
- * Razón: cuando el pool nace con MFA habilitado, el connector llama
- * `SetUserPoolMfaConfigCommand` con la lista de tipos del DTO. Si el array
- * llega vacío con `requireMfa: true`, el SDK rechaza con InvalidParameterException
- * y el pool queda en estado inconsistente (MfaConfiguration:'ON' sin tipos).
- * Mejor rechazar en validación del DTO antes de tocar AWS.
- *
- * Ver pivote v1.4.1 TD-017 cerrado + spec doc §1 R3.
- */
-let MfaTypesRequiresOne = class MfaTypesRequiresOne {
-    validate(mfaTypes, args) {
-        const obj = args.object;
-        if (obj.requireMfa === true) {
-            return Array.isArray(mfaTypes) && mfaTypes.length >= 1;
-        }
-        // requireMfa: false → cualquier mfaTypes pasa.
-        return true;
-    }
-    defaultMessage() {
-        return 'mfaTypes requiere al menos un tipo cuando requireMfa=true';
-    }
-};
-exports.MfaTypesRequiresOne = MfaTypesRequiresOne;
-exports.MfaTypesRequiresOne = MfaTypesRequiresOne = __decorate([
-    (0, class_validator_1.ValidatorConstraint)({ name: 'MfaTypesRequiresOneWhenMfaRequired', async: false })
-], MfaTypesRequiresOne);

package/bin/rbac/enums/PoolKind.d.ts

@@ -1,16 +0,0 @@
-/**
- * Tipo de User Pool de Cognito desde la perspectiva del modelo RBAC Fiado.
- *
- * Origen: spec del proyecto `cognito-backoffice-connector` (Fase 0, componente 01
- * documento `docs/superpowers/specs/2026-05-26-cognito-connector-decisiones-pendientes-design.md`).
- *
- * Decisión (TD-003): el proyecto converge en estos 2 valores. El documento componente 03
- * lista 3 valores (incluyendo una variante adicional) pero queda como outlier — la
- * decisión vigente en los 6 docs restantes y en el plan de implementación es 2 valores:
- *  - BACKOFFICE_PLATFORM — pool del backoffice de plataforma (cross-tenant)
- *  - BACKOFFICE_TENANT — pool por tenant (multi-tenant isolation)
- */
-export declare enum PoolKind {
-    BACKOFFICE_PLATFORM = "BACKOFFICE_PLATFORM",
-    BACKOFFICE_TENANT = "BACKOFFICE_TENANT"
-}

package/bin/rbac/enums/PoolKind.js

@@ -1,20 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PoolKind = void 0;
-/**
- * Tipo de User Pool de Cognito desde la perspectiva del modelo RBAC Fiado.
- *
- * Origen: spec del proyecto `cognito-backoffice-connector` (Fase 0, componente 01
- * documento `docs/superpowers/specs/2026-05-26-cognito-connector-decisiones-pendientes-design.md`).
- *
- * Decisión (TD-003): el proyecto converge en estos 2 valores. El documento componente 03
- * lista 3 valores (incluyendo una variante adicional) pero queda como outlier — la
- * decisión vigente en los 6 docs restantes y en el plan de implementación es 2 valores:
- *  - BACKOFFICE_PLATFORM — pool del backoffice de plataforma (cross-tenant)
- *  - BACKOFFICE_TENANT — pool por tenant (multi-tenant isolation)
- */
-var PoolKind;
-(function (PoolKind) {
-    PoolKind["BACKOFFICE_PLATFORM"] = "BACKOFFICE_PLATFORM";
-    PoolKind["BACKOFFICE_TENANT"] = "BACKOFFICE_TENANT";
-})(PoolKind || (exports.PoolKind = PoolKind = {}));

package/bin/rbac/index.d.ts

@@ -1 +0,0 @@
-export * from './enums/PoolKind';

package/bin/rbac/index.js

@@ -1,17 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./enums/PoolKind"), exports);

package/bin/walletFunding/dtos/CancelFundingReferenceRequest.d.ts

@@ -1,5 +0,0 @@
-export declare class CancelFundingReferenceRequest {
-    fundingId: string;
-    directoryId: string;
-    idempotencyKey: string;
-}

package/bin/walletFunding/dtos/CancelFundingReferenceRequest.js

@@ -1,31 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingReferenceRequest = void 0;
-const class_validator_1 = require("class-validator");
-class CancelFundingReferenceRequest {
-}
-exports.CancelFundingReferenceRequest = CancelFundingReferenceRequest;
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "fundingId", void 0);
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "directoryId", void 0);
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "idempotencyKey", void 0);

package/bin/walletFunding/dtos/CancelFundingReferenceResponse.d.ts

@@ -1,7 +0,0 @@
-import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
-import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
-export declare class CancelFundingReferenceResponse {
-    fundingId: string;
-    status: BenefitPaymentStatusEnum;
-    errorCode?: WalletFundingErrorCodeEnum;
-}

package/bin/walletFunding/dtos/CancelFundingReferenceResponse.js

@@ -1,6 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingReferenceResponse = void 0;
-class CancelFundingReferenceResponse {
-}
-exports.CancelFundingReferenceResponse = CancelFundingReferenceResponse;

package/bin/walletFunding/dtos/CancelFundingRequest.d.ts

@@ -1,11 +0,0 @@
-/**
- * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `fundingId` viaja en el path, `directoryId` se resuelve del JWT.
- * `providerModuleName` permite al marketplace rutear al publisher correcto
- * sin tener que persistir el mapping (el wallet-app sabe el moduleName
- * porque vino en la respuesta del authorize).
- */
-export declare class CancelFundingRequest {
-    idempotencyKey: string;
-    providerModuleName: string;
-}

package/bin/walletFunding/dtos/CancelFundingResponse.d.ts

@@ -1,14 +0,0 @@
-import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
-import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
-/**
- * Response del cancel via Centro de Beneficios (spec 13 v2.0).
- * `status` reusa `BenefitPaymentStatusEnum` (APPROVED = cancel aceptado;
- * REJECTED = no se pudo) para consistencia con `CancelFundingReferenceResponse`
- * (marketplace ↔ connector). Idempotente: re-cancelar devuelve APPROVED.
- */
-export declare class CancelFundingResponse {
-    fundingId: string;
-    status: BenefitPaymentStatusEnum;
-    errorCode?: WalletFundingErrorCodeEnum;
-    message?: string;
-}

package/bin/walletFunding/dtos/CancelFundingResponse.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingResponse = void 0;
-/**
- * Response del cancel via Centro de Beneficios (spec 13 v2.0).
- * `status` reusa `BenefitPaymentStatusEnum` (APPROVED = cancel aceptado;
- * REJECTED = no se pudo) para consistencia con `CancelFundingReferenceResponse`
- * (marketplace ↔ connector). Idempotente: re-cancelar devuelve APPROVED.
- */
-class CancelFundingResponse {
-}
-exports.CancelFundingResponse = CancelFundingResponse;

package/bin/walletFunding/dtos/CancelWalletFundingRequest.d.ts

@@ -1,3 +0,0 @@
-export declare class CancelWalletFundingRequest {
-    idempotencyKey: string;
-}

package/bin/walletFunding/dtos/CancelWalletFundingRequest.js

@@ -1,21 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelWalletFundingRequest = void 0;
-const class_validator_1 = require("class-validator");
-class CancelWalletFundingRequest {
-}
-exports.CancelWalletFundingRequest = CancelWalletFundingRequest;
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelWalletFundingRequest.prototype, "idempotencyKey", void 0);

package/bin/walletFunding/dtos/CancelWalletFundingResponse.d.ts

@@ -1,7 +0,0 @@
-import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
-import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
-export declare class CancelWalletFundingResponse {
-    status: BenefitPaymentStatusEnum;
-    errorCode?: WalletFundingErrorCodeEnum;
-    fundingId?: string;
-}

package/bin/walletFunding/dtos/CancelWalletFundingResponse.js

@@ -1,6 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelWalletFundingResponse = void 0;
-class CancelWalletFundingResponse {
-}
-exports.CancelWalletFundingResponse = CancelWalletFundingResponse;