@fiado/type-kit 3.42.0 → 3.43.1

package/src/cognitoBackofficeConnector/dtos/MfaVerifyResponse.ts

@@ -1,8 +1,8 @@
-/**
- * Shared entre los endpoints de verify MFA (TOTP, Email). Literal union sobre
- * `status` — no se introduce enum porque solo hay 2 valores estables y el
- * contrato es plano.
- */
-export class MfaVerifyResponse {
-    status!: 'SUCCESS' | 'ERROR';
-}
+/**
+ * Shared entre los endpoints de verify MFA (TOTP, Email). Literal union sobre
+ * `status` — no se introduce enum porque solo hay 2 valores estables y el
+ * contrato es plano.
+ */
+export class MfaVerifyResponse {
+    status!: 'SUCCESS' | 'ERROR';
+}

package/src/cognitoBackofficeConnector/dtos/PasswordPolicyConfig.ts

@@ -1,11 +1,11 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsNumber, Max, Min } from 'class-validator';
-
-export class PasswordPolicyConfig {
-    @Expose() @IsNumber() @Min(6) @Max(99) minLength!: number;
-    @Expose() @IsBoolean() requireUppercase!: boolean;
-    @Expose() @IsBoolean() requireLowercase!: boolean;
-    @Expose() @IsBoolean() requireNumbers!: boolean;
-    @Expose() @IsBoolean() requireSymbols!: boolean;
-    @Expose() @IsNumber() @Min(1) @Max(365) temporaryPasswordValidityDays!: number;
-}
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsNumber, Max, Min } from 'class-validator';
+
+export class PasswordPolicyConfig {
+    @Expose() @IsNumber() @Min(6) @Max(99) minLength!: number;
+    @Expose() @IsBoolean() requireUppercase!: boolean;
+    @Expose() @IsBoolean() requireLowercase!: boolean;
+    @Expose() @IsBoolean() requireNumbers!: boolean;
+    @Expose() @IsBoolean() requireSymbols!: boolean;
+    @Expose() @IsNumber() @Min(1) @Max(365) temporaryPasswordValidityDays!: number;
+}

package/src/cognitoBackofficeConnector/dtos/RefreshTokensRequest.ts

@@ -1,9 +1,9 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class RefreshTokensRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() clientId!: string;
-    @Expose() @IsString() @IsNotEmpty() refreshToken!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class RefreshTokensRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() refreshToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/RefreshTokensResponse.ts

@@ -1,5 +1,5 @@
-import { AuthTokensResponse } from './AuthTokensResponse';
-
-export class RefreshTokensResponse {
-    tokens!: AuthTokensResponse;
-}
+import { AuthTokensResponse } from './AuthTokensResponse';
+
+export class RefreshTokensResponse {
+    tokens!: AuthTokensResponse;
+}

package/src/cognitoBackofficeConnector/dtos/ResendConfirmationRequest.ts

@@ -1,9 +1,9 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class ResendConfirmationRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() clientId!: string;
-    @Expose() @IsString() @IsNotEmpty() username!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ResendConfirmationRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+}

package/src/cognitoBackofficeConnector/dtos/ResendInvitationRequest.ts

@@ -1,7 +1,7 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class ResendInvitationRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ResendInvitationRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/RespondToChallengeRequest.ts

@@ -1,12 +1,12 @@
-import { Expose } from 'class-transformer';
-import { IsEnum, IsNotEmpty, IsObject, IsString } from 'class-validator';
-import { CognitoChallengeType } from '../enums/CognitoChallengeType';
-
-export class RespondToChallengeRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() clientId!: string;
-    @Expose() @IsEnum(CognitoChallengeType) challengeName!: CognitoChallengeType;
-    @Expose() @IsString() @IsNotEmpty() session!: string;
-    @Expose() @IsObject() challengeResponses!: Record<string, string>;
-}
+import { Expose } from 'class-transformer';
+import { IsEnum, IsNotEmpty, IsObject, IsString } from 'class-validator';
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+
+export class RespondToChallengeRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsEnum(CognitoChallengeType) challengeName!: CognitoChallengeType;
+    @Expose() @IsString() @IsNotEmpty() session!: string;
+    @Expose() @IsObject() challengeResponses!: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/RespondToChallengeResponse.ts

@@ -1,14 +1,14 @@
-import { CognitoChallengeType } from '../enums/CognitoChallengeType';
-import { AuthTokensResponse } from './AuthTokensResponse';
-
-/**
- * SC3: clase PROPIA con shape espejo de `InitiateAuthResponse` (NO alias) para
- * desacoplar la evolución del endpoint `respond-to-challenge` del endpoint
- * `initiate-auth`. Ambos pueden cambiar shape independiente.
- */
-export class RespondToChallengeResponse {
-    tokens?: AuthTokensResponse;
-    challengeType?: CognitoChallengeType;
-    session?: string;
-    challengeParameters?: Record<string, string>;
-}
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+import { AuthTokensResponse } from './AuthTokensResponse';
+
+/**
+ * SC3: clase PROPIA con shape espejo de `InitiateAuthResponse` (NO alias) para
+ * desacoplar la evolución del endpoint `respond-to-challenge` del endpoint
+ * `initiate-auth`. Ambos pueden cambiar shape independiente.
+ */
+export class RespondToChallengeResponse {
+    tokens?: AuthTokensResponse;
+    challengeType?: CognitoChallengeType;
+    session?: string;
+    challengeParameters?: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/SetMfaPreferenceRequest.ts

@@ -1,12 +1,12 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsIn, IsNotEmpty, IsOptional, IsString } from 'class-validator';
-
-export class SetMfaPreferenceRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() cognitoSub!: string;
-    @Expose() @IsBoolean() softwareTokenEnabled!: boolean;
-    @Expose() @IsBoolean() emailEnabled!: boolean;
-    @Expose() @IsOptional() @IsIn(['TOTP', 'EMAIL'])
-    preferredMethod?: 'TOTP' | 'EMAIL';
-}
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsIn, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+export class SetMfaPreferenceRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() cognitoSub!: string;
+    @Expose() @IsBoolean() softwareTokenEnabled!: boolean;
+    @Expose() @IsBoolean() emailEnabled!: boolean;
+    @Expose() @IsOptional() @IsIn(['TOTP', 'EMAIL'])
+    preferredMethod?: 'TOTP' | 'EMAIL';
+}

package/src/cognitoBackofficeConnector/dtos/TotpBeginRequest.ts

@@ -1,8 +1,8 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class TotpBeginRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class TotpBeginRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/TotpBeginResponse.ts

@@ -1,4 +1,4 @@
-export class TotpBeginResponse {
-    secretCode!: string;
-    sessionToken!: string;
-}
+export class TotpBeginResponse {
+    secretCode!: string;
+    sessionToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/TotpVerifyRequest.ts

@@ -1,9 +1,9 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
-
-export class TotpVerifyRequest {
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-    @Expose() @IsString() @IsNotEmpty() userCode!: string;
-    @Expose() @IsOptional() @IsString() friendlyDeviceName?: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+export class TotpVerifyRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsString() @IsNotEmpty() userCode!: string;
+    @Expose() @IsOptional() @IsString() friendlyDeviceName?: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateEmailRequest.ts

@@ -1,8 +1,8 @@
-import { Expose } from 'class-transformer';
-import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
-
-export class UpdateEmailRequest {
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-    @Expose() @IsEmail() newEmail!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
+
+export class UpdateEmailRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsEmail() newEmail!: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateProfileRequest.ts

@@ -1,15 +1,15 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
-
-/**
- * D3 ajuste 2: self-service profile update NO permite tocar `customAttributes`
- * — eso es exclusivo del path admin (`UpdateUserAttributesRequest` con
- * `NoTenantIdInCustomAttrs`). El self-service solo modifica campos personales
- * benignos.
- */
-export class UpdateProfileRequest {
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-    @Expose() @IsOptional() @IsString() displayName?: string;
-    @Expose() @IsOptional() @IsString() phoneNumber?: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+/**
+ * D3 ajuste 2: self-service profile update NO permite tocar `customAttributes`
+ * — eso es exclusivo del path admin (`UpdateUserAttributesRequest` con
+ * `NoTenantIdInCustomAttrs`). El self-service solo modifica campos personales
+ * benignos.
+ */
+export class UpdateProfileRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsOptional() @IsString() phoneNumber?: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateUserAttributesRequest.ts

@@ -1,12 +1,12 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsObject, IsOptional, IsString, Validate } from 'class-validator';
-import { NoTenantIdInCustomAttrs } from '../validators/NoTenantIdInCustomAttrs';
-
-export class UpdateUserAttributesRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsOptional() @IsString() displayName?: string;
-    @Expose() @IsOptional() @IsString() phoneNumber?: string;
-    @Expose() @IsOptional() @IsObject() @Validate(NoTenantIdInCustomAttrs)
-    customAttributes?: Record<string, string>;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsObject, IsOptional, IsString, Validate } from 'class-validator';
+import { NoTenantIdInCustomAttrs } from '../validators/NoTenantIdInCustomAttrs';
+
+export class UpdateUserAttributesRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsOptional() @IsString() phoneNumber?: string;
+    @Expose() @IsOptional() @IsObject() @Validate(NoTenantIdInCustomAttrs)
+    customAttributes?: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/UserActionRequest.ts

@@ -1,12 +1,12 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-/**
- * Request shared para acciones admin que solo requieren identificar el pool
- * (el `cognitoSub` viaja por path param del endpoint): disable, enable,
- * global sign-out, password reset.
- */
-export class UserActionRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/**
+ * Request shared para acciones admin que solo requieren identificar el pool
+ * (el `cognitoSub` viaja por path param del endpoint): disable, enable,
+ * global sign-out, password reset.
+ */
+export class UserActionRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/UserDetailResponse.ts

@@ -1,14 +1,14 @@
-import { CognitoUserStatus } from '../enums/CognitoUserStatus';
-
-export class UserDetailResponse {
-    cognitoSub!: string;
-    email!: string;
-    emailVerified!: boolean;
-    status!: CognitoUserStatus;
-    enabled!: boolean;
-    displayName?: string;
-    phoneNumber?: string;
-    customAttributes?: Record<string, string>;
-    createdAt!: number;
-    lastModifiedAt!: number;
-}
+import { CognitoUserStatus } from '../enums/CognitoUserStatus';
+
+export class UserDetailResponse {
+    cognitoSub!: string;
+    email!: string;
+    emailVerified!: boolean;
+    status!: CognitoUserStatus;
+    enabled!: boolean;
+    displayName?: string;
+    phoneNumber?: string;
+    customAttributes?: Record<string, string>;
+    createdAt!: number;
+    lastModifiedAt!: number;
+}

package/src/cognitoBackofficeConnector/dtos/VerifyEmailRequest.ts

@@ -1,8 +1,8 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class VerifyEmailRequest {
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-    @Expose() @IsString() @IsNotEmpty() confirmationCode!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class VerifyEmailRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsString() @IsNotEmpty() confirmationCode!: string;
+}

package/src/cognitoBackofficeConnector/enums/CognitoChallengeType.ts

@@ -1,26 +1,26 @@
-/**
- * Tipos de Cognito Challenge que el `cognito-backoffice-connector` propaga al
- * caller (típicamente el BFF M18). Son los 4 valores canónicos del proyecto.
- *
- * Decisión A17 (MFA exclusivo): el proyecto soporta exclusivamente TOTP +
- * Email OTP. Cualquier otro challenge que devuelva el SDK
- * (`SELECT_MFA_TYPE`, `SMS_MFA`, `DEVICE_SRP_AUTH`, `DEVICE_PASSWORD_VERIFIER`,
- * `CUSTOM_CHALLENGE`, `ADMIN_NO_SRP_AUTH`, etc.) NO se propaga como
- * `challengeType` — se mapea a `CognitoUnexpectedError` con HTTP 502 en el
- * service correspondiente.
- *
- *  - `NEW_PASSWORD_REQUIRED` — el usuario fue creado con temp password y debe
- *    setear una definitiva en el primer login.
- *  - `MFA_SETUP` — el usuario debe enrolarse en MFA (TOTP o Email) antes de
- *    obtener tokens.
- *  - `SOFTWARE_TOKEN_MFA` — el usuario tiene TOTP enrolado y debe enviar el
- *    código del authenticator.
- *  - `EMAIL_OTP` — el usuario tiene Email MFA habilitado y debe enviar el OTP
- *    enviado al email.
- */
-export enum CognitoChallengeType {
-    NEW_PASSWORD_REQUIRED = 'NEW_PASSWORD_REQUIRED',
-    MFA_SETUP = 'MFA_SETUP',
-    SOFTWARE_TOKEN_MFA = 'SOFTWARE_TOKEN_MFA',
-    EMAIL_OTP = 'EMAIL_OTP',
-}
+/**
+ * Tipos de Cognito Challenge que el `cognito-backoffice-connector` propaga al
+ * caller (típicamente el BFF M18). Son los 4 valores canónicos del proyecto.
+ *
+ * Decisión A17 (MFA exclusivo): el proyecto soporta exclusivamente TOTP +
+ * Email OTP. Cualquier otro challenge que devuelva el SDK
+ * (`SELECT_MFA_TYPE`, `SMS_MFA`, `DEVICE_SRP_AUTH`, `DEVICE_PASSWORD_VERIFIER`,
+ * `CUSTOM_CHALLENGE`, `ADMIN_NO_SRP_AUTH`, etc.) NO se propaga como
+ * `challengeType` — se mapea a `CognitoUnexpectedError` con HTTP 502 en el
+ * service correspondiente.
+ *
+ *  - `NEW_PASSWORD_REQUIRED` — el usuario fue creado con temp password y debe
+ *    setear una definitiva en el primer login.
+ *  - `MFA_SETUP` — el usuario debe enrolarse en MFA (TOTP o Email) antes de
+ *    obtener tokens.
+ *  - `SOFTWARE_TOKEN_MFA` — el usuario tiene TOTP enrolado y debe enviar el
+ *    código del authenticator.
+ *  - `EMAIL_OTP` — el usuario tiene Email MFA habilitado y debe enviar el OTP
+ *    enviado al email.
+ */
+export enum CognitoChallengeType {
+    NEW_PASSWORD_REQUIRED = 'NEW_PASSWORD_REQUIRED',
+    MFA_SETUP = 'MFA_SETUP',
+    SOFTWARE_TOKEN_MFA = 'SOFTWARE_TOKEN_MFA',
+    EMAIL_OTP = 'EMAIL_OTP',
+}

package/src/cognitoBackofficeConnector/enums/CognitoUserStatus.ts

@@ -1,29 +1,29 @@
-/**
- * Estados posibles de un usuario en un Cognito User Pool, según el tipo
- * `UserStatusType` del SDK `@aws-sdk/client-cognito-identity-provider`.
- *
- * El SDK no expone enum value `DISABLED` — el equivalente operativo en Cognito
- * es el flag boolean `enabled` del usuario (ver `CreateUserResponse.enabled`
- * y `UserDetailResponse.enabled`), que es independiente del `status`.
- *
- * `EXTERNAL_PROVIDER` (federación SAML / OIDC) no se incluye porque el
- * proyecto NO usa federación — el backoffice solo administra usuarios nativos
- * del pool.
- *
- *  - `UNCONFIRMED` — el usuario fue creado pero no completó la verificación de email.
- *  - `CONFIRMED` — usuario verificado, puede operar (sujeto a MFA si aplica).
- *  - `ARCHIVED` — usuario archivado por Cognito (no puede operar, no se borra).
- *  - `COMPROMISED` — flag de Cognito Advanced Security: credencial comprometida.
- *  - `UNKNOWN` — Cognito no determinó el estado (raro).
- *  - `RESET_REQUIRED` — el usuario debe resetear password antes del próximo login.
- *  - `FORCE_CHANGE_PASSWORD` — temp password vigente, requiere `NEW_PASSWORD_REQUIRED`.
- */
-export enum CognitoUserStatus {
-    UNCONFIRMED = 'UNCONFIRMED',
-    CONFIRMED = 'CONFIRMED',
-    ARCHIVED = 'ARCHIVED',
-    COMPROMISED = 'COMPROMISED',
-    UNKNOWN = 'UNKNOWN',
-    RESET_REQUIRED = 'RESET_REQUIRED',
-    FORCE_CHANGE_PASSWORD = 'FORCE_CHANGE_PASSWORD',
-}
+/**
+ * Estados posibles de un usuario en un Cognito User Pool, según el tipo
+ * `UserStatusType` del SDK `@aws-sdk/client-cognito-identity-provider`.
+ *
+ * El SDK no expone enum value `DISABLED` — el equivalente operativo en Cognito
+ * es el flag boolean `enabled` del usuario (ver `CreateUserResponse.enabled`
+ * y `UserDetailResponse.enabled`), que es independiente del `status`.
+ *
+ * `EXTERNAL_PROVIDER` (federación SAML / OIDC) no se incluye porque el
+ * proyecto NO usa federación — el backoffice solo administra usuarios nativos
+ * del pool.
+ *
+ *  - `UNCONFIRMED` — el usuario fue creado pero no completó la verificación de email.
+ *  - `CONFIRMED` — usuario verificado, puede operar (sujeto a MFA si aplica).
+ *  - `ARCHIVED` — usuario archivado por Cognito (no puede operar, no se borra).
+ *  - `COMPROMISED` — flag de Cognito Advanced Security: credencial comprometida.
+ *  - `UNKNOWN` — Cognito no determinó el estado (raro).
+ *  - `RESET_REQUIRED` — el usuario debe resetear password antes del próximo login.
+ *  - `FORCE_CHANGE_PASSWORD` — temp password vigente, requiere `NEW_PASSWORD_REQUIRED`.
+ */
+export enum CognitoUserStatus {
+    UNCONFIRMED = 'UNCONFIRMED',
+    CONFIRMED = 'CONFIRMED',
+    ARCHIVED = 'ARCHIVED',
+    COMPROMISED = 'COMPROMISED',
+    UNKNOWN = 'UNKNOWN',
+    RESET_REQUIRED = 'RESET_REQUIRED',
+    FORCE_CHANGE_PASSWORD = 'FORCE_CHANGE_PASSWORD',
+}

package/src/cognitoBackofficeConnector/index.ts

@@ -1,50 +1,50 @@
-/**
- * Módulo `cognitoBackofficeConnector` — DTOs, enums y validators para el Lambda
- * `cognito-backoffice-connector` (backoffice multi-tenant Fiado).
- *
- * Es un módulo NUEVO y SEPARADO del módulo `cognitoConnector/` legacy que pertenece
- * a otro Lambda Cognito Fiado (mantenido por yhonhansen). No reusar tipos del
- * legacy aquí ni viceversa — los dominios divergieron y mezclarlos arrastraría
- * acoplamiento histórico.
- */
-export * from './enums/CognitoChallengeType';
-export * from './enums/CognitoUserStatus';
-export * from './validators/NoTenantIdInCustomAttrs';
-export * from './validators/MfaTypesRequiresOne';
-export * from './dtos/CreateUserRequest';
-export * from './dtos/CreateUserResponse';
-export * from './dtos/UpdateUserAttributesRequest';
-export * from './dtos/UserActionRequest';
-export * from './dtos/DeleteUserRequest';
-export * from './dtos/ResendInvitationRequest';
-export * from './dtos/UserDetailResponse';
-export * from './dtos/AuthEventsRequest';
-export * from './dtos/AuthEventResponse';
-export * from './dtos/AuthTokensResponse';
-export * from './dtos/InitiateAuthRequest';
-export * from './dtos/InitiateAuthResponse';
-export * from './dtos/RespondToChallengeRequest';
-export * from './dtos/RespondToChallengeResponse';
-export * from './dtos/RefreshTokensRequest';
-export * from './dtos/RefreshTokensResponse';
-export * from './dtos/ForgotPasswordRequest';
-export * from './dtos/ConfirmForgotPasswordRequest';
-export * from './dtos/ResendConfirmationRequest';
-export * from './dtos/ChangePasswordRequest';
-export * from './dtos/TotpBeginRequest';
-export * from './dtos/TotpBeginResponse';
-export * from './dtos/TotpVerifyRequest';
-export * from './dtos/MfaVerifyResponse';
-export * from './dtos/SetMfaPreferenceRequest';
-export * from './dtos/MfaResetRequest';
-export * from './dtos/UpdateEmailRequest';
-export * from './dtos/VerifyEmailRequest';
-export * from './dtos/UpdateProfileRequest';
-export * from './dtos/HealthcheckResponse';
-export * from './dtos/MfaPoolConfig';
-export * from './dtos/PasswordPolicyConfig';
-export * from './dtos/CustomAttributeSpec';
-export * from './dtos/AppClientConfig';
-export * from './dtos/CreatePoolRequest';
-export * from './dtos/CreatePoolResponse';
-export * from './dtos/DeletePoolRequest';
+/**
+ * Módulo `cognitoBackofficeConnector` — DTOs, enums y validators para el Lambda
+ * `cognito-backoffice-connector` (backoffice multi-tenant Fiado).
+ *
+ * Es un módulo NUEVO y SEPARADO del módulo `cognitoConnector/` legacy que pertenece
+ * a otro Lambda Cognito Fiado (mantenido por yhonhansen). No reusar tipos del
+ * legacy aquí ni viceversa — los dominios divergieron y mezclarlos arrastraría
+ * acoplamiento histórico.
+ */
+export * from './enums/CognitoChallengeType';
+export * from './enums/CognitoUserStatus';
+export * from './validators/NoTenantIdInCustomAttrs';
+export * from './validators/MfaTypesRequiresOne';
+export * from './dtos/CreateUserRequest';
+export * from './dtos/CreateUserResponse';
+export * from './dtos/UpdateUserAttributesRequest';
+export * from './dtos/UserActionRequest';
+export * from './dtos/DeleteUserRequest';
+export * from './dtos/ResendInvitationRequest';
+export * from './dtos/UserDetailResponse';
+export * from './dtos/AuthEventsRequest';
+export * from './dtos/AuthEventResponse';
+export * from './dtos/AuthTokensResponse';
+export * from './dtos/InitiateAuthRequest';
+export * from './dtos/InitiateAuthResponse';
+export * from './dtos/RespondToChallengeRequest';
+export * from './dtos/RespondToChallengeResponse';
+export * from './dtos/RefreshTokensRequest';
+export * from './dtos/RefreshTokensResponse';
+export * from './dtos/ForgotPasswordRequest';
+export * from './dtos/ConfirmForgotPasswordRequest';
+export * from './dtos/ResendConfirmationRequest';
+export * from './dtos/ChangePasswordRequest';
+export * from './dtos/TotpBeginRequest';
+export * from './dtos/TotpBeginResponse';
+export * from './dtos/TotpVerifyRequest';
+export * from './dtos/MfaVerifyResponse';
+export * from './dtos/SetMfaPreferenceRequest';
+export * from './dtos/MfaResetRequest';
+export * from './dtos/UpdateEmailRequest';
+export * from './dtos/VerifyEmailRequest';
+export * from './dtos/UpdateProfileRequest';
+export * from './dtos/HealthcheckResponse';
+export * from './dtos/MfaPoolConfig';
+export * from './dtos/PasswordPolicyConfig';
+export * from './dtos/CustomAttributeSpec';
+export * from './dtos/AppClientConfig';
+export * from './dtos/CreatePoolRequest';
+export * from './dtos/CreatePoolResponse';
+export * from './dtos/DeletePoolRequest';