@fiado/type-kit 3.46.2 → 3.48.0

package/src/cognitoBackofficeConnector/dtos/MfaPoolConfig.ts

@@ -1,21 +1,21 @@
-import { Expose } from 'class-transformer';
-import { IsArray, IsBoolean, IsIn, Validate } from 'class-validator';
-import { MfaTypesRequiresOne } from '../validators/MfaTypesRequiresOne';
-
-// EMAIL_OTP removido (3.41.0): el cognito-backoffice-connector no provisiona
-// EmailMfaConfiguration a nivel pool (requiere infra SES que no está montada
-// y la integración con messages-lambda aún no tiene diseño). Ver TD-020 +
-// DEC-001 en cognito-backoffice-connector/docs/. Si se reintroduce, agregar
-// 'EMAIL_OTP' a este array.
-const ALLOWED_MFA_TYPES = ['SOFTWARE_TOKEN_MFA'] as const;
-export type AllowedMfaType = (typeof ALLOWED_MFA_TYPES)[number];
-
-export class MfaPoolConfig {
-    @Expose() @IsBoolean() requireMfa!: boolean;
-
-    @Expose()
-    @IsArray()
-    @IsIn(ALLOWED_MFA_TYPES, { each: true })
-    @Validate(MfaTypesRequiresOne)
-    mfaTypes!: AllowedMfaType[];
-}
+import { Expose } from 'class-transformer';
+import { IsArray, IsBoolean, IsIn, Validate } from 'class-validator';
+import { MfaTypesRequiresOne } from '../validators/MfaTypesRequiresOne';
+
+// EMAIL_OTP removido (3.41.0): el cognito-backoffice-connector no provisiona
+// EmailMfaConfiguration a nivel pool (requiere infra SES que no está montada
+// y la integración con messages-lambda aún no tiene diseño). Ver TD-020 +
+// DEC-001 en cognito-backoffice-connector/docs/. Si se reintroduce, agregar
+// 'EMAIL_OTP' a este array.
+const ALLOWED_MFA_TYPES = ['SOFTWARE_TOKEN_MFA'] as const;
+export type AllowedMfaType = (typeof ALLOWED_MFA_TYPES)[number];
+
+export class MfaPoolConfig {
+    @Expose() @IsBoolean() requireMfa!: boolean;
+
+    @Expose()
+    @IsArray()
+    @IsIn(ALLOWED_MFA_TYPES, { each: true })
+    @Validate(MfaTypesRequiresOne)
+    mfaTypes!: AllowedMfaType[];
+}

package/src/cognitoBackofficeConnector/dtos/MfaResetRequest.ts

@@ -1,7 +1,7 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class MfaResetRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class MfaResetRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/MfaVerifyResponse.ts

@@ -1,8 +1,8 @@
-/**
- * Shared entre los endpoints de verify MFA (TOTP, Email). Literal union sobre
- * `status` — no se introduce enum porque solo hay 2 valores estables y el
- * contrato es plano.
- */
-export class MfaVerifyResponse {
-    status!: 'SUCCESS' | 'ERROR';
-}
+/**
+ * Shared entre los endpoints de verify MFA (TOTP, Email). Literal union sobre
+ * `status` — no se introduce enum porque solo hay 2 valores estables y el
+ * contrato es plano.
+ */
+export class MfaVerifyResponse {
+    status!: 'SUCCESS' | 'ERROR';
+}

package/src/cognitoBackofficeConnector/dtos/PasswordPolicyConfig.ts

@@ -1,11 +1,11 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsNumber, Max, Min } from 'class-validator';
-
-export class PasswordPolicyConfig {
-    @Expose() @IsNumber() @Min(6) @Max(99) minLength!: number;
-    @Expose() @IsBoolean() requireUppercase!: boolean;
-    @Expose() @IsBoolean() requireLowercase!: boolean;
-    @Expose() @IsBoolean() requireNumbers!: boolean;
-    @Expose() @IsBoolean() requireSymbols!: boolean;
-    @Expose() @IsNumber() @Min(1) @Max(365) temporaryPasswordValidityDays!: number;
-}
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsNumber, Max, Min } from 'class-validator';
+
+export class PasswordPolicyConfig {
+    @Expose() @IsNumber() @Min(6) @Max(99) minLength!: number;
+    @Expose() @IsBoolean() requireUppercase!: boolean;
+    @Expose() @IsBoolean() requireLowercase!: boolean;
+    @Expose() @IsBoolean() requireNumbers!: boolean;
+    @Expose() @IsBoolean() requireSymbols!: boolean;
+    @Expose() @IsNumber() @Min(1) @Max(365) temporaryPasswordValidityDays!: number;
+}

package/src/cognitoBackofficeConnector/dtos/RefreshTokensRequest.ts

@@ -1,9 +1,9 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class RefreshTokensRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() clientId!: string;
-    @Expose() @IsString() @IsNotEmpty() refreshToken!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class RefreshTokensRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() refreshToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/RefreshTokensResponse.ts

@@ -1,5 +1,5 @@
-import { AuthTokensResponse } from './AuthTokensResponse';
-
-export class RefreshTokensResponse {
-    tokens!: AuthTokensResponse;
-}
+import { AuthTokensResponse } from './AuthTokensResponse';
+
+export class RefreshTokensResponse {
+    tokens!: AuthTokensResponse;
+}

package/src/cognitoBackofficeConnector/dtos/ResendConfirmationRequest.ts

@@ -1,9 +1,9 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class ResendConfirmationRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() clientId!: string;
-    @Expose() @IsString() @IsNotEmpty() username!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ResendConfirmationRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+}

package/src/cognitoBackofficeConnector/dtos/ResendInvitationRequest.ts

@@ -1,7 +1,7 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class ResendInvitationRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ResendInvitationRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/RespondToChallengeRequest.ts

@@ -1,12 +1,12 @@
-import { Expose } from 'class-transformer';
-import { IsEnum, IsNotEmpty, IsObject, IsString } from 'class-validator';
-import { CognitoChallengeType } from '../enums/CognitoChallengeType';
-
-export class RespondToChallengeRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() clientId!: string;
-    @Expose() @IsEnum(CognitoChallengeType) challengeName!: CognitoChallengeType;
-    @Expose() @IsString() @IsNotEmpty() session!: string;
-    @Expose() @IsObject() challengeResponses!: Record<string, string>;
-}
+import { Expose } from 'class-transformer';
+import { IsEnum, IsNotEmpty, IsObject, IsString } from 'class-validator';
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+
+export class RespondToChallengeRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsEnum(CognitoChallengeType) challengeName!: CognitoChallengeType;
+    @Expose() @IsString() @IsNotEmpty() session!: string;
+    @Expose() @IsObject() challengeResponses!: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/RespondToChallengeResponse.ts

@@ -1,14 +1,14 @@
-import { CognitoChallengeType } from '../enums/CognitoChallengeType';
-import { AuthTokensResponse } from './AuthTokensResponse';
-
-/**
- * SC3: clase PROPIA con shape espejo de `InitiateAuthResponse` (NO alias) para
- * desacoplar la evolución del endpoint `respond-to-challenge` del endpoint
- * `initiate-auth`. Ambos pueden cambiar shape independiente.
- */
-export class RespondToChallengeResponse {
-    tokens?: AuthTokensResponse;
-    challengeType?: CognitoChallengeType;
-    session?: string;
-    challengeParameters?: Record<string, string>;
-}
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+import { AuthTokensResponse } from './AuthTokensResponse';
+
+/**
+ * SC3: clase PROPIA con shape espejo de `InitiateAuthResponse` (NO alias) para
+ * desacoplar la evolución del endpoint `respond-to-challenge` del endpoint
+ * `initiate-auth`. Ambos pueden cambiar shape independiente.
+ */
+export class RespondToChallengeResponse {
+    tokens?: AuthTokensResponse;
+    challengeType?: CognitoChallengeType;
+    session?: string;
+    challengeParameters?: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/SetMfaPreferenceRequest.ts

@@ -1,12 +1,12 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsIn, IsNotEmpty, IsOptional, IsString } from 'class-validator';
-
-export class SetMfaPreferenceRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() cognitoSub!: string;
-    @Expose() @IsBoolean() softwareTokenEnabled!: boolean;
-    @Expose() @IsBoolean() emailEnabled!: boolean;
-    @Expose() @IsOptional() @IsIn(['TOTP', 'EMAIL'])
-    preferredMethod?: 'TOTP' | 'EMAIL';
-}
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsIn, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+export class SetMfaPreferenceRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() cognitoSub!: string;
+    @Expose() @IsBoolean() softwareTokenEnabled!: boolean;
+    @Expose() @IsBoolean() emailEnabled!: boolean;
+    @Expose() @IsOptional() @IsIn(['TOTP', 'EMAIL'])
+    preferredMethod?: 'TOTP' | 'EMAIL';
+}

package/src/cognitoBackofficeConnector/dtos/TotpBeginRequest.ts

@@ -1,8 +1,8 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class TotpBeginRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class TotpBeginRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/TotpBeginResponse.ts

@@ -1,4 +1,4 @@
-export class TotpBeginResponse {
-    secretCode!: string;
-    sessionToken!: string;
-}
+export class TotpBeginResponse {
+    secretCode!: string;
+    sessionToken!: string;
+}

package/src/cognitoBackofficeConnector/dtos/TotpVerifyRequest.ts

@@ -1,9 +1,9 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
-
-export class TotpVerifyRequest {
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-    @Expose() @IsString() @IsNotEmpty() userCode!: string;
-    @Expose() @IsOptional() @IsString() friendlyDeviceName?: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+export class TotpVerifyRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsString() @IsNotEmpty() userCode!: string;
+    @Expose() @IsOptional() @IsString() friendlyDeviceName?: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateEmailRequest.ts

@@ -1,8 +1,8 @@
-import { Expose } from 'class-transformer';
-import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
-
-export class UpdateEmailRequest {
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-    @Expose() @IsEmail() newEmail!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
+
+export class UpdateEmailRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsEmail() newEmail!: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateProfileRequest.ts

@@ -1,15 +1,15 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
-
-/**
- * D3 ajuste 2: self-service profile update NO permite tocar `customAttributes`
- * — eso es exclusivo del path admin (`UpdateUserAttributesRequest` con
- * `NoTenantIdInCustomAttrs`). El self-service solo modifica campos personales
- * benignos.
- */
-export class UpdateProfileRequest {
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-    @Expose() @IsOptional() @IsString() displayName?: string;
-    @Expose() @IsOptional() @IsString() phoneNumber?: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+/**
+ * D3 ajuste 2: self-service profile update NO permite tocar `customAttributes`
+ * — eso es exclusivo del path admin (`UpdateUserAttributesRequest` con
+ * `NoTenantIdInCustomAttrs`). El self-service solo modifica campos personales
+ * benignos.
+ */
+export class UpdateProfileRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsOptional() @IsString() phoneNumber?: string;
+}

package/src/cognitoBackofficeConnector/dtos/UpdateUserAttributesRequest.ts

@@ -1,12 +1,12 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsObject, IsOptional, IsString, Validate } from 'class-validator';
-import { NoTenantIdInCustomAttrs } from '../validators/NoTenantIdInCustomAttrs';
-
-export class UpdateUserAttributesRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsOptional() @IsString() displayName?: string;
-    @Expose() @IsOptional() @IsString() phoneNumber?: string;
-    @Expose() @IsOptional() @IsObject() @Validate(NoTenantIdInCustomAttrs)
-    customAttributes?: Record<string, string>;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsObject, IsOptional, IsString, Validate } from 'class-validator';
+import { NoTenantIdInCustomAttrs } from '../validators/NoTenantIdInCustomAttrs';
+
+export class UpdateUserAttributesRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsOptional() @IsString() phoneNumber?: string;
+    @Expose() @IsOptional() @IsObject() @Validate(NoTenantIdInCustomAttrs)
+    customAttributes?: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/dtos/UserActionRequest.ts

@@ -1,12 +1,12 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-/**
- * Request shared para acciones admin que solo requieren identificar el pool
- * (el `cognitoSub` viaja por path param del endpoint): disable, enable,
- * global sign-out, password reset.
- */
-export class UserActionRequest {
-    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/**
+ * Request shared para acciones admin que solo requieren identificar el pool
+ * (el `cognitoSub` viaja por path param del endpoint): disable, enable,
+ * global sign-out, password reset.
+ */
+export class UserActionRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+}

package/src/cognitoBackofficeConnector/dtos/UserDetailResponse.ts

@@ -1,14 +1,14 @@
-import { CognitoUserStatus } from '../enums/CognitoUserStatus';
-
-export class UserDetailResponse {
-    cognitoSub!: string;
-    email!: string;
-    emailVerified!: boolean;
-    status!: CognitoUserStatus;
-    enabled!: boolean;
-    displayName?: string;
-    phoneNumber?: string;
-    customAttributes?: Record<string, string>;
-    createdAt!: number;
-    lastModifiedAt!: number;
-}
+import { CognitoUserStatus } from '../enums/CognitoUserStatus';
+
+export class UserDetailResponse {
+    cognitoSub!: string;
+    email!: string;
+    emailVerified!: boolean;
+    status!: CognitoUserStatus;
+    enabled!: boolean;
+    displayName?: string;
+    phoneNumber?: string;
+    customAttributes?: Record<string, string>;
+    createdAt!: number;
+    lastModifiedAt!: number;
+}

package/src/cognitoBackofficeConnector/dtos/VerifyEmailRequest.ts

@@ -1,8 +1,8 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsString } from 'class-validator';
-
-export class VerifyEmailRequest {
-    @Expose() @IsString() @IsNotEmpty() region!: string;
-    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
-    @Expose() @IsString() @IsNotEmpty() confirmationCode!: string;
-}
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class VerifyEmailRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() accessToken!: string;
+    @Expose() @IsString() @IsNotEmpty() confirmationCode!: string;
+}

package/src/cognitoBackofficeConnector/enums/CognitoUserStatus.ts

@@ -1,29 +1,29 @@
-/**
- * Estados posibles de un usuario en un Cognito User Pool, según el tipo
- * `UserStatusType` del SDK `@aws-sdk/client-cognito-identity-provider`.
- *
- * El SDK no expone enum value `DISABLED` — el equivalente operativo en Cognito
- * es el flag boolean `enabled` del usuario (ver `CreateUserResponse.enabled`
- * y `UserDetailResponse.enabled`), que es independiente del `status`.
- *
- * `EXTERNAL_PROVIDER` (federación SAML / OIDC) no se incluye porque el
- * proyecto NO usa federación — el backoffice solo administra usuarios nativos
- * del pool.
- *
- *  - `UNCONFIRMED` — el usuario fue creado pero no completó la verificación de email.
- *  - `CONFIRMED` — usuario verificado, puede operar (sujeto a MFA si aplica).
- *  - `ARCHIVED` — usuario archivado por Cognito (no puede operar, no se borra).
- *  - `COMPROMISED` — flag de Cognito Advanced Security: credencial comprometida.
- *  - `UNKNOWN` — Cognito no determinó el estado (raro).
- *  - `RESET_REQUIRED` — el usuario debe resetear password antes del próximo login.
- *  - `FORCE_CHANGE_PASSWORD` — temp password vigente, requiere `NEW_PASSWORD_REQUIRED`.
- */
-export enum CognitoUserStatus {
-    UNCONFIRMED = 'UNCONFIRMED',
-    CONFIRMED = 'CONFIRMED',
-    ARCHIVED = 'ARCHIVED',
-    COMPROMISED = 'COMPROMISED',
-    UNKNOWN = 'UNKNOWN',
-    RESET_REQUIRED = 'RESET_REQUIRED',
-    FORCE_CHANGE_PASSWORD = 'FORCE_CHANGE_PASSWORD',
-}
+/**
+ * Estados posibles de un usuario en un Cognito User Pool, según el tipo
+ * `UserStatusType` del SDK `@aws-sdk/client-cognito-identity-provider`.
+ *
+ * El SDK no expone enum value `DISABLED` — el equivalente operativo en Cognito
+ * es el flag boolean `enabled` del usuario (ver `CreateUserResponse.enabled`
+ * y `UserDetailResponse.enabled`), que es independiente del `status`.
+ *
+ * `EXTERNAL_PROVIDER` (federación SAML / OIDC) no se incluye porque el
+ * proyecto NO usa federación — el backoffice solo administra usuarios nativos
+ * del pool.
+ *
+ *  - `UNCONFIRMED` — el usuario fue creado pero no completó la verificación de email.
+ *  - `CONFIRMED` — usuario verificado, puede operar (sujeto a MFA si aplica).
+ *  - `ARCHIVED` — usuario archivado por Cognito (no puede operar, no se borra).
+ *  - `COMPROMISED` — flag de Cognito Advanced Security: credencial comprometida.
+ *  - `UNKNOWN` — Cognito no determinó el estado (raro).
+ *  - `RESET_REQUIRED` — el usuario debe resetear password antes del próximo login.
+ *  - `FORCE_CHANGE_PASSWORD` — temp password vigente, requiere `NEW_PASSWORD_REQUIRED`.
+ */
+export enum CognitoUserStatus {
+    UNCONFIRMED = 'UNCONFIRMED',
+    CONFIRMED = 'CONFIRMED',
+    ARCHIVED = 'ARCHIVED',
+    COMPROMISED = 'COMPROMISED',
+    UNKNOWN = 'UNKNOWN',
+    RESET_REQUIRED = 'RESET_REQUIRED',
+    FORCE_CHANGE_PASSWORD = 'FORCE_CHANGE_PASSWORD',
+}

package/src/cognitoBackofficeConnector/enums/IntrospectFailReason.ts

@@ -0,0 +1,11 @@
+/**
+ * Razón de fallo del POST /auth/introspect del cognito-backoffice-connector.
+ */
+export enum IntrospectFailReason {
+    INVALID_SIGNATURE = 'INVALID_SIGNATURE',
+    EXPIRED = 'EXPIRED',
+    CLIENT_ID_MISMATCH = 'CLIENT_ID_MISMATCH',
+    TOKEN_USE_MISMATCH = 'TOKEN_USE_MISMATCH',
+    REVOKED = 'REVOKED',
+    USER_NOT_FOUND = 'USER_NOT_FOUND',
+}

package/src/cognitoBackofficeConnector/index.ts

@@ -1,52 +1,57 @@
-/**
- * Módulo `cognitoBackofficeConnector` — DTOs, enums y validators para el Lambda
- * `cognito-backoffice-connector` (backoffice multi-tenant Fiado).
- *
- * Es un módulo NUEVO y SEPARADO del módulo `cognitoConnector/` legacy que pertenece
- * a otro Lambda Cognito Fiado (mantenido por yhonhansen). No reusar tipos del
- * legacy aquí ni viceversa — los dominios divergieron y mezclarlos arrastraría
- * acoplamiento histórico.
- */
-export * from './enums/CognitoChallengeType';
-export * from './enums/CognitoUserStatus';
-export * from './validators/NoTenantIdInCustomAttrs';
-export * from './validators/MfaTypesRequiresOne';
-export * from './dtos/CreateUserRequest';
-export * from './dtos/CreateUserResponse';
-export * from './dtos/UpdateUserAttributesRequest';
-export * from './dtos/UserActionRequest';
-export * from './dtos/DeleteUserRequest';
-export * from './dtos/ResendInvitationRequest';
-export * from './dtos/UserDetailResponse';
-export * from './dtos/AuthEventsRequest';
-export * from './dtos/AuthEventResponse';
-export * from './dtos/AuthTokensResponse';
-export * from './dtos/InitiateAuthRequest';
-export * from './dtos/InitiateAuthResponse';
-export * from './dtos/VerifyPasswordRequest';
-export * from './dtos/VerifyPasswordResponse';
-export * from './dtos/RespondToChallengeRequest';
-export * from './dtos/RespondToChallengeResponse';
-export * from './dtos/RefreshTokensRequest';
-export * from './dtos/RefreshTokensResponse';
-export * from './dtos/ForgotPasswordRequest';
-export * from './dtos/ConfirmForgotPasswordRequest';
-export * from './dtos/ResendConfirmationRequest';
-export * from './dtos/ChangePasswordRequest';
-export * from './dtos/TotpBeginRequest';
-export * from './dtos/TotpBeginResponse';
-export * from './dtos/TotpVerifyRequest';
-export * from './dtos/MfaVerifyResponse';
-export * from './dtos/SetMfaPreferenceRequest';
-export * from './dtos/MfaResetRequest';
-export * from './dtos/UpdateEmailRequest';
-export * from './dtos/VerifyEmailRequest';
-export * from './dtos/UpdateProfileRequest';
-export * from './dtos/HealthcheckResponse';
-export * from './dtos/MfaPoolConfig';
-export * from './dtos/PasswordPolicyConfig';
-export * from './dtos/CustomAttributeSpec';
-export * from './dtos/AppClientConfig';
-export * from './dtos/CreatePoolRequest';
-export * from './dtos/CreatePoolResponse';
-export * from './dtos/DeletePoolRequest';
+/**
+ * Módulo `cognitoBackofficeConnector` — DTOs, enums y validators para el Lambda
+ * `cognito-backoffice-connector` (backoffice multi-tenant Fiado).
+ *
+ * Es un módulo NUEVO y SEPARADO del módulo `cognitoConnector/` legacy que pertenece
+ * a otro Lambda Cognito Fiado (mantenido por yhonhansen). No reusar tipos del
+ * legacy aquí ni viceversa — los dominios divergieron y mezclarlos arrastraría
+ * acoplamiento histórico.
+ */
+export * from './enums/CognitoChallengeType';
+export * from './enums/CognitoUserStatus';
+export * from './validators/NoTenantIdInCustomAttrs';
+export * from './validators/MfaTypesRequiresOne';
+export * from './dtos/CreateUserRequest';
+export * from './dtos/CreateUserResponse';
+export * from './dtos/UpdateUserAttributesRequest';
+export * from './dtos/UserActionRequest';
+export * from './dtos/DeleteUserRequest';
+export * from './dtos/ResendInvitationRequest';
+export * from './dtos/UserDetailResponse';
+export * from './dtos/AuthEventsRequest';
+export * from './dtos/AuthEventResponse';
+export * from './dtos/AuthTokensResponse';
+export * from './dtos/InitiateAuthRequest';
+export * from './dtos/InitiateAuthResponse';
+export * from './dtos/VerifyPasswordRequest';
+export * from './dtos/VerifyPasswordResponse';
+export * from './dtos/RespondToChallengeRequest';
+export * from './dtos/RespondToChallengeResponse';
+export * from './dtos/RefreshTokensRequest';
+export * from './dtos/RefreshTokensResponse';
+export * from './dtos/ForgotPasswordRequest';
+export * from './dtos/ConfirmForgotPasswordRequest';
+export * from './dtos/ResendConfirmationRequest';
+export * from './dtos/ChangePasswordRequest';
+export * from './dtos/TotpBeginRequest';
+export * from './dtos/TotpBeginResponse';
+export * from './dtos/TotpVerifyRequest';
+export * from './dtos/MfaVerifyResponse';
+export * from './dtos/SetMfaPreferenceRequest';
+export * from './dtos/MfaResetRequest';
+export * from './dtos/UpdateEmailRequest';
+export * from './dtos/VerifyEmailRequest';
+export * from './dtos/UpdateProfileRequest';
+export * from './dtos/HealthcheckResponse';
+export * from './dtos/MfaPoolConfig';
+export * from './dtos/PasswordPolicyConfig';
+export * from './dtos/CustomAttributeSpec';
+export * from './dtos/AppClientConfig';
+export * from './dtos/CreatePoolRequest';
+export * from './dtos/CreatePoolResponse';
+export * from './dtos/DeletePoolRequest';
+
+// Introspección de token (POST /auth/introspect) — consumido por el platform-rbac-business.
+export * from './enums/IntrospectFailReason';
+export * from './dtos/IntrospectRequest';
+export * from './dtos/IntrospectResponse';