@fiado/type-kit 3.37.0 → 3.39.0

package/src/benefitCenter/dtos/BackofficeSubcategoryLogoUpdateRequest.ts

@@ -0,0 +1,14 @@
+import { IsNotEmpty, IsString } from "class-validator";
+
+/**
+ * Body de PUT /backoffice/leaves/categories/{category}/subcategories/{subcategory}/logo.
+ *
+ * Asigna el mismo `logo` (URL pública ya subida a S3) a TODOS los leaves de la
+ * `(category, subcategory)` — el logo es de la marca, no de cada país.
+ */
+export class BackofficeSubcategoryLogoUpdateRequest {
+    /** URL pública del logo (CloudFront) ya subido vía asset-upload-url. */
+    @IsString()
+    @IsNotEmpty()
+    logo!: string;
+}

package/src/benefitCenter/dtos/LeafAssetUploadUrlRequest.ts

@@ -0,0 +1,23 @@
+import { IsEnum, IsNotEmpty, IsString } from "class-validator";
+import { LeafAssetKindEnum } from "../enums/LeafAssetKindEnum";
+
+/**
+ * Solicitud del backoffice para subir un asset de un leaf (logo o imagen de
+ * ayuda) directamente a S3. El backend responde con una presigned PUT URL y la
+ * URL pública final (CloudFront) que luego se asigna al leaf/producto.
+ */
+export class LeafAssetUploadUrlRequest {
+    /** Determina la subcarpeta S3 y el whitelist de MIME/tamaño. */
+    @IsEnum(LeafAssetKindEnum)
+    kind!: LeafAssetKindEnum;
+
+    /** MIME type del archivo (ej. "image/png"). Debe estar en el whitelist. */
+    @IsString()
+    @IsNotEmpty()
+    contentType!: string;
+
+    /** Extensión sin punto (ej. "png"). Se usa para componer la key en S3. */
+    @IsString()
+    @IsNotEmpty()
+    fileExtension!: string;
+}

package/src/benefitCenter/dtos/LeafAssetUploadUrlResponse.ts

@@ -0,0 +1,13 @@
+/**
+ * Respuesta con la presigned URL para subir el asset del leaf directamente a S3.
+ * El backoffice hace `PUT uploadUrl` con el `Content-Type` exacto solicitado y
+ * body binario (≤ maxSizeBytes). `publicUrl` (CloudFront) es la que se asigna
+ * luego al leaf (logo) o producto (helpImage).
+ */
+export class LeafAssetUploadUrlResponse {
+    uploadUrl: string;
+    publicUrl: string;
+    key: string;
+    expiresAt: string;
+    maxSizeBytes: number;
+}

package/src/benefitCenter/dtos/ProductItem.ts

@@ -8,4 +8,18 @@ export class ProductItem {
     amountType: AmountTypeEnum;
     logo: string;
     helpText: string;
+
+    /**
+     * Imagen de ayuda del producto (ej. dónde escanear la referencia/código).
+     * Mapea desde `refSrc` del catálogo nativo. Opcional/aditivo: ausente en
+     * datos viejos.
+     */
+    helpImage?: string;
+
+    /**
+     * Si el producto está habilitado. Opcional/aditivo: la AUSENCIA del campo
+     * se interpreta como habilitado (`true`). Solo `enabled === false` oculta
+     * el producto del catálogo público.
+     */
+    enabled?: boolean;
 }

package/src/benefitCenter/enums/LeafAssetKindEnum.ts

@@ -0,0 +1,12 @@
+/**
+ * Tipo de asset que el backoffice sube para un leaf del catálogo.
+ *
+ * Determina la subcarpeta en S3 (logos/ vs help-images/) y el whitelist de
+ * MIME types / tamaño de la presigned URL que devuelve el backend.
+ */
+export enum LeafAssetKindEnum {
+    /** Logo del servicio (ej. CALLPACKAGE). Va al campo `logo` del leaf. */
+    LOGO = "LOGO",
+    /** Imagen de ayuda del producto (dónde escanear la referencia). Va a `refSrc`. */
+    HELP_IMAGE = "HELP_IMAGE",
+}

package/src/benefitCenter/index.ts

@@ -12,6 +12,7 @@ export * from "./enums/FavoriteDisabledReasonEnum";
 export * from "./enums/BenefitPaymentStatusEnum";
 export * from "./enums/BenefitPaymentErrorCodeEnum";
 export * from "./enums/BannerAssetKindEnum";
+export * from "./enums/LeafAssetKindEnum";
 
 //DTOs
 export * from "./dtos/BenefitItem";
@@ -70,6 +71,14 @@ export * from "./dtos/BackofficeSubcategoryOrderUpdateRequest";
 export * from "./dtos/BackofficeSubcategoryOrdersResponse";
 //Admin leaves iteration-3 (v3.37.0): ordering por país + bulk reorder (drag-and-drop)
 export * from "./dtos/BackofficeSubcategoryReorderRequest";
+//Admin leaves iteration-4 (v3.39.0): assets (logo + help-image), product enable/disable, input label overrides
+export * from "./dtos/LeafAssetUploadUrlRequest";
+export * from "./dtos/LeafAssetUploadUrlResponse";
+export * from "./dtos/BackofficeSubcategoryLogoUpdateRequest";
+export * from "./dtos/BackofficeLeafHelpImageUpdateRequest";
+export * from "./dtos/BackofficeProductHelpImageUpdateRequest";
+export * from "./dtos/BackofficeProductEnabledUpdateRequest";
+export * from "./dtos/BackofficeInputLabelsUpdateRequest";
 //Banner assets upload (presigned PUT)
 export * from "./dtos/BannerUploadUrlRequest";
 export * from "./dtos/BannerUploadUrlResponse";

package/src/cognitoBackofficeConnector/dtos/AppClientConfig.ts

@@ -0,0 +1,22 @@
+import { Expose } from 'class-transformer';
+import { IsArray, IsBoolean, IsNumber, IsOptional, IsString } from 'class-validator';
+
+/**
+ * Config del único App Client del pool nuevo creado por POST /pools.
+ *
+ * NO expone `generateSecret` — el connector hardcodea `GenerateSecret: false`
+ * en el SDK call (BFF pattern: rbac llama al connector server-to-server vía
+ * api-invoker en VPC, sin SPA-to-Cognito directo que requiera client secret).
+ * Decisión arquitectónica A21 del connector. Si aparece consumer B2B/M2M con
+ * flow `client_credentials`, evaluar con líder + bump major del connector.
+ */
+export class AppClientConfig {
+    @Expose() @IsOptional() @IsString() clientName?: string;
+    @Expose() @IsArray() @IsString({ each: true }) explicitAuthFlows!: string[];
+    @Expose() @IsOptional() @IsString() tokenValidityUnits?: string;
+    @Expose() @IsOptional() @IsNumber() accessTokenValidity?: number;
+    @Expose() @IsOptional() @IsNumber() idTokenValidity?: number;
+    @Expose() @IsOptional() @IsNumber() refreshTokenValidity?: number;
+    @Expose() @IsOptional() @IsBoolean() preventUserExistenceErrors?: boolean;
+    @Expose() @IsOptional() @IsBoolean() enableTokenRevocation?: boolean;
+}

package/src/cognitoBackofficeConnector/dtos/AuthEventResponse.ts

@@ -0,0 +1,8 @@
+export class AuthEventResponse {
+    eventId!: string;
+    eventType!: string;
+    creationDate!: string;
+    eventResponse?: string;
+    eventRisk?: string;
+    ipAddress?: string;
+}

package/src/cognitoBackofficeConnector/dtos/AuthEventsRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { IsInt, IsNotEmpty, IsOptional, IsString, Max, Min } from 'class-validator';
+
+export class AuthEventsRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsOptional() @IsInt() @Min(1) @Max(60) maxResults?: number;
+}

package/src/cognitoBackofficeConnector/dtos/AuthTokensResponse.ts

@@ -0,0 +1,12 @@
+/**
+ * Tokens devueltos por Cognito tras un login exitoso o un refresh. Shared
+ * entre `InitiateAuthResponse`, `RespondToChallengeResponse` y
+ * `RefreshTokensResponse`.
+ */
+export class AuthTokensResponse {
+    accessToken!: string;
+    idToken!: string;
+    refreshToken!: string;
+    expiresIn!: number;
+    tokenType!: string;
+}

package/src/cognitoBackofficeConnector/dtos/ChangePasswordRequest.ts

@@ -0,0 +1,9 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ChangePasswordRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsString() @IsNotEmpty() previousPassword!: string;
+    @Expose() @IsString() @IsNotEmpty() proposedPassword!: string;
+}

package/src/cognitoBackofficeConnector/dtos/ConfirmForgotPasswordRequest.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ConfirmForgotPasswordRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+    @Expose() @IsString() @IsNotEmpty() confirmationCode!: string;
+    @Expose() @IsString() @IsNotEmpty() newPassword!: string;
+}

package/src/cognitoBackofficeConnector/dtos/CreatePoolRequest.ts

@@ -0,0 +1,30 @@
+import { Expose, Type } from 'class-transformer';
+import { IsArray, IsString, ValidateNested } from 'class-validator';
+import { MfaPoolConfig } from './MfaPoolConfig';
+import { PasswordPolicyConfig } from './PasswordPolicyConfig';
+import { CustomAttributeSpec } from './CustomAttributeSpec';
+import { AppClientConfig } from './AppClientConfig';
+
+/**
+ * Request del endpoint POST /pools (pivote v1.4.1 stateless).
+ * Consumido por la saga `TenantOnboardingManager` del `platform-rbac-business`
+ * (Flujo 2 v1.2, PASO 4 de la saga). El connector ejecuta CreateUserPool +
+ * CreateUserPoolClient en secuencia. Si CreateUserPoolClient falla DESPUÉS de
+ * CreateUserPool exitoso, el connector hace DeleteUserPool de cleanup.
+ */
+export class CreatePoolRequest {
+    @Expose() @IsString() region!: string;
+    @Expose() @IsString() displayName!: string;
+
+    @Expose() @ValidateNested() @Type(() => MfaPoolConfig)
+    mfaConfig!: MfaPoolConfig;
+
+    @Expose() @ValidateNested() @Type(() => PasswordPolicyConfig)
+    passwordPolicy!: PasswordPolicyConfig;
+
+    @Expose() @IsArray() @ValidateNested({ each: true }) @Type(() => CustomAttributeSpec)
+    customAttributes!: CustomAttributeSpec[];
+
+    @Expose() @ValidateNested() @Type(() => AppClientConfig)
+    appClientConfig!: AppClientConfig;
+}

package/src/cognitoBackofficeConnector/dtos/CreatePoolResponse.ts

@@ -0,0 +1,13 @@
+/**
+ * Response del endpoint POST /pools (pivote v1.4.1 stateless).
+ *
+ * NO expone `clientSecret` — el SDK Cognito no lo devuelve cuando
+ * `GenerateSecret: false` (BFF pattern A21). Si aparece consumer B2B/M2M
+ * que requiera client secret, evaluar con líder + bump major del connector.
+ */
+export class CreatePoolResponse {
+    userPoolId!: string;
+    userPoolArn!: string;
+    appClientId!: string;
+    region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/CreateUserRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsEmail, IsNotEmpty, IsOptional, IsString, IsUUID } from 'class-validator';
+
+export class CreateUserRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsEmail() email!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsUUID() tenantId!: string;
+    @Expose() @IsOptional() @IsString() temporaryPassword?: string;
+    @Expose() @IsOptional() @IsBoolean() suppressInvitationEmail?: boolean;
+}

package/src/cognitoBackofficeConnector/dtos/CreateUserResponse.ts

@@ -0,0 +1,11 @@
+import { CognitoUserStatus } from '../enums/CognitoUserStatus';
+
+export class CreateUserResponse {
+    cognitoSub!: string;
+    email!: string;
+    emailVerified!: boolean;
+    status!: CognitoUserStatus;
+    enabled!: boolean;
+    temporaryPassword?: string;
+    createdAt!: number;
+}

package/src/cognitoBackofficeConnector/dtos/CustomAttributeSpec.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsIn, IsString } from 'class-validator';
+
+const ALLOWED_ATTR_TYPES = ['String', 'Number', 'Boolean', 'DateTime'] as const;
+export type AllowedAttrType = (typeof ALLOWED_ATTR_TYPES)[number];
+
+export class CustomAttributeSpec {
+    @Expose() @IsString() name!: string;
+    @Expose() @IsIn(ALLOWED_ATTR_TYPES) type!: AllowedAttrType;
+    @Expose() @IsBoolean() mutable!: boolean;
+    @Expose() @IsBoolean() required!: boolean;
+}

package/src/cognitoBackofficeConnector/dtos/DeletePoolRequest.ts

@@ -0,0 +1,16 @@
+import { Expose } from 'class-transformer';
+import { IsString } from 'class-validator';
+
+/**
+ * Request del endpoint DELETE /pools/:userPoolId?region=X (pivote v1.4.1 stateless).
+ * Consumido por compensation chain de la saga `TenantOnboardingManager` del
+ * `platform-rbac-business` cuando falla el paso 5 (CreateUser) o paso 6
+ * (TransactWriteItems) — ver Flujo 2 v1.2 del rbac.
+ *
+ * Requiere pool VACÍO (sin users). Si tiene users, AWS rechaza con
+ * ResourceInUseException → CognitoPoolNotEmptyError 409.
+ */
+export class DeletePoolRequest {
+    @Expose() @IsString() userPoolId!: string;
+    @Expose() @IsString() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/DeleteUserRequest.ts

@@ -0,0 +1,7 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class DeleteUserRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/ForgotPasswordRequest.ts

@@ -0,0 +1,9 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ForgotPasswordRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+}

package/src/cognitoBackofficeConnector/dtos/HealthcheckResponse.ts

@@ -0,0 +1,12 @@
+/**
+ * Decisión D4: contrato literal del healthcheck.
+ *  - `service`: nombre del lambda.
+ *  - `status`: literal `'OK'` (cualquier desviación de health = 5xx, no
+ *    status diferente).
+ *  - `timestamp`: ISO 8601.
+ */
+export class HealthcheckResponse {
+    service!: string;
+    status!: 'OK';
+    timestamp!: string;
+}

package/src/cognitoBackofficeConnector/dtos/InitiateAuthRequest.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class InitiateAuthRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() authFlow!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+    @Expose() @IsString() @IsNotEmpty() password!: string;
+}

package/src/cognitoBackofficeConnector/dtos/InitiateAuthResponse.ts

@@ -0,0 +1,17 @@
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+import { AuthTokensResponse } from './AuthTokensResponse';
+
+/**
+ * Respuesta del inicio de auth. Si el usuario completó el flow sin challenge,
+ * `tokens` viene poblado. Si Cognito devolvió challenge, `challengeType` y
+ * `session` vienen poblados.
+ *
+ * D6: `challengeParameters` es passthrough raw del SDK — el caller decide qué
+ * hacer con los valores (ej. el BFF lo usa para renderizar el form de MFA).
+ */
+export class InitiateAuthResponse {
+    tokens?: AuthTokensResponse;
+    challengeType?: CognitoChallengeType;
+    session?: string;
+    challengeParameters?: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/MfaPoolConfig.ts

@@ -0,0 +1,16 @@
+import { Expose } from 'class-transformer';
+import { IsArray, IsBoolean, IsIn, Validate } from 'class-validator';
+import { MfaTypesRequiresOne } from '../validators/MfaTypesRequiresOne';
+
+const ALLOWED_MFA_TYPES = ['SOFTWARE_TOKEN_MFA', 'EMAIL_OTP'] as const;
+export type AllowedMfaType = (typeof ALLOWED_MFA_TYPES)[number];
+
+export class MfaPoolConfig {
+    @Expose() @IsBoolean() requireMfa!: boolean;
+
+    @Expose()
+    @IsArray()
+    @IsIn(ALLOWED_MFA_TYPES, { each: true })
+    @Validate(MfaTypesRequiresOne)
+    mfaTypes!: AllowedMfaType[];
+}

package/src/cognitoBackofficeConnector/dtos/MfaResetRequest.ts

@@ -0,0 +1,7 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class MfaResetRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/MfaVerifyResponse.ts

@@ -0,0 +1,8 @@
+/**
+ * Shared entre los endpoints de verify MFA (TOTP, Email). Literal union sobre
+ * `status` — no se introduce enum porque solo hay 2 valores estables y el
+ * contrato es plano.
+ */
+export class MfaVerifyResponse {
+    status!: 'SUCCESS' | 'ERROR';
+}

package/src/cognitoBackofficeConnector/dtos/PasswordPolicyConfig.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsNumber, Max, Min } from 'class-validator';
+
+export class PasswordPolicyConfig {
+    @Expose() @IsNumber() @Min(6) @Max(99) minLength!: number;
+    @Expose() @IsBoolean() requireUppercase!: boolean;
+    @Expose() @IsBoolean() requireLowercase!: boolean;
+    @Expose() @IsBoolean() requireNumbers!: boolean;
+    @Expose() @IsBoolean() requireSymbols!: boolean;
+    @Expose() @IsNumber() @Min(1) @Max(365) temporaryPasswordValidityDays!: number;
+}

package/src/cognitoBackofficeConnector/dtos/RefreshTokensRequest.ts

@@ -0,0 +1,9 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class RefreshTokensRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() refreshToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/RefreshTokensResponse.ts

@@ -0,0 +1,5 @@
+import { AuthTokensResponse } from './AuthTokensResponse';
+
+export class RefreshTokensResponse {
+    tokens!: AuthTokensResponse;
+}

package/src/cognitoBackofficeConnector/dtos/ResendConfirmationRequest.ts

@@ -0,0 +1,9 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ResendConfirmationRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+}

package/src/cognitoBackofficeConnector/dtos/ResendInvitationRequest.ts

@@ -0,0 +1,7 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ResendInvitationRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/RespondToChallengeRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsEnum, IsNotEmpty, IsObject, IsString } from 'class-validator';
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+
+export class RespondToChallengeRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsEnum(CognitoChallengeType) challengeName!: CognitoChallengeType;
+    @Expose() @IsString() @IsNotEmpty() session!: string;
+    @Expose() @IsObject() challengeResponses!: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/RespondToChallengeResponse.ts

@@ -0,0 +1,14 @@
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+import { AuthTokensResponse } from './AuthTokensResponse';
+
+/**
+ * SC3: clase PROPIA con shape espejo de `InitiateAuthResponse` (NO alias) para
+ * desacoplar la evolución del endpoint `respond-to-challenge` del endpoint
+ * `initiate-auth`. Ambos pueden cambiar shape independiente.
+ */
+export class RespondToChallengeResponse {
+    tokens?: AuthTokensResponse;
+    challengeType?: CognitoChallengeType;
+    session?: string;
+    challengeParameters?: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/SetMfaPreferenceRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsIn, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+export class SetMfaPreferenceRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() cognitoSub!: string;
+    @Expose() @IsBoolean() softwareTokenEnabled!: boolean;
+    @Expose() @IsBoolean() emailEnabled!: boolean;
+    @Expose() @IsOptional() @IsIn(['TOTP', 'EMAIL'])
+    preferredMethod?: 'TOTP' | 'EMAIL';
+}

package/src/cognitoBackofficeConnector/dtos/TotpBeginRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class TotpBeginRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/TotpBeginResponse.ts

@@ -0,0 +1,4 @@
+export class TotpBeginResponse {
+    secretCode!: string;
+    sessionToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/TotpVerifyRequest.ts

@@ -0,0 +1,9 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+export class TotpVerifyRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsString() @IsNotEmpty() userCode!: string;
+    @Expose() @IsOptional() @IsString() friendlyDeviceName?: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateEmailRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
+
+export class UpdateEmailRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsEmail() newEmail!: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateProfileRequest.ts

@@ -0,0 +1,15 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+/**
+ * D3 ajuste 2: self-service profile update NO permite tocar `customAttributes`
+ * — eso es exclusivo del path admin (`UpdateUserAttributesRequest` con
+ * `NoTenantIdInCustomAttrs`). El self-service solo modifica campos personales
+ * benignos.
+ */
+export class UpdateProfileRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsOptional() @IsString() phoneNumber?: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateUserAttributesRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsObject, IsOptional, IsString, Validate } from 'class-validator';
+import { NoTenantIdInCustomAttrs } from '../validators/NoTenantIdInCustomAttrs';
+
+export class UpdateUserAttributesRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsOptional() @IsString() phoneNumber?: string;
+    @Expose() @IsOptional() @IsObject() @Validate(NoTenantIdInCustomAttrs)
+    customAttributes?: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/UserActionRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/**
+ * Request shared para acciones admin que solo requieren identificar el pool
+ * (el `cognitoSub` viaja por path param del endpoint): disable, enable,
+ * global sign-out, password reset.
+ */
+export class UserActionRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/UserDetailResponse.ts

@@ -0,0 +1,14 @@
+import { CognitoUserStatus } from '../enums/CognitoUserStatus';
+
+export class UserDetailResponse {
+    cognitoSub!: string;
+    email!: string;
+    emailVerified!: boolean;
+    status!: CognitoUserStatus;
+    enabled!: boolean;
+    displayName?: string;
+    phoneNumber?: string;
+    customAttributes?: Record<string, string>;
+    createdAt!: number;
+    lastModifiedAt!: number;
+}

package/src/cognitoBackofficeConnector/dtos/VerifyEmailRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class VerifyEmailRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsString() @IsNotEmpty() confirmationCode!: string;
+}

package/src/cognitoBackofficeConnector/enums/CognitoChallengeType.ts

@@ -0,0 +1,26 @@
+/**
+ * Tipos de Cognito Challenge que el `cognito-backoffice-connector` propaga al
+ * caller (típicamente el BFF M18). Son los 4 valores canónicos del proyecto.
+ *
+ * Decisión A17 (MFA exclusivo): el proyecto soporta exclusivamente TOTP +
+ * Email OTP. Cualquier otro challenge que devuelva el SDK
+ * (`SELECT_MFA_TYPE`, `SMS_MFA`, `DEVICE_SRP_AUTH`, `DEVICE_PASSWORD_VERIFIER`,
+ * `CUSTOM_CHALLENGE`, `ADMIN_NO_SRP_AUTH`, etc.) NO se propaga como
+ * `challengeType` — se mapea a `CognitoUnexpectedError` con HTTP 502 en el
+ * service correspondiente.
+ *
+ *  - `NEW_PASSWORD_REQUIRED` — el usuario fue creado con temp password y debe
+ *    setear una definitiva en el primer login.
+ *  - `MFA_SETUP` — el usuario debe enrolarse en MFA (TOTP o Email) antes de
+ *    obtener tokens.
+ *  - `SOFTWARE_TOKEN_MFA` — el usuario tiene TOTP enrolado y debe enviar el
+ *    código del authenticator.
+ *  - `EMAIL_OTP` — el usuario tiene Email MFA habilitado y debe enviar el OTP
+ *    enviado al email.
+ */
+export enum CognitoChallengeType {
+    NEW_PASSWORD_REQUIRED = 'NEW_PASSWORD_REQUIRED',
+    MFA_SETUP = 'MFA_SETUP',
+    SOFTWARE_TOKEN_MFA = 'SOFTWARE_TOKEN_MFA',
+    EMAIL_OTP = 'EMAIL_OTP',
+}