@fiado/type-kit 3.487.0 → 3.488.0

package/_test_/unit/cognitoBackofficeConnector/dtos/CreatePoolClientRequest.test.ts

@@ -0,0 +1,55 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { CreatePoolClientRequest } from '../../../../src/cognitoBackofficeConnector/dtos/CreatePoolClientRequest';
+import { AppClientConfig } from '../../../../src/cognitoBackofficeConnector/dtos/AppClientConfig';
+
+const CLIENT = {
+    clientName: 'us-east-1_abc-api-client',
+    explicitAuthFlows: ['ALLOW_ADMIN_USER_PASSWORD_AUTH'],
+    tokenValidityUnits: 'minutes',
+    accessTokenValidity: 15,
+    idTokenValidity: 15,
+    refreshTokenValidity: 60,
+    preventUserExistenceErrors: true,
+    enableTokenRevocation: true,
+    writeAttributes: ['name'],
+};
+
+describe('CreatePoolClientRequest (reutiliza AppClientConfig)', () => {
+    it('acepta el client de API completo', async () => {
+        expect(await validate(plainToInstance(CreatePoolClientRequest, { region: 'us-east-1', appClientConfig: CLIENT }))).toEqual([]);
+    });
+
+    it('exige region', async () => {
+        const errors = await validate(plainToInstance(CreatePoolClientRequest, { region: '', appClientConfig: CLIENT }));
+        expect(errors.some((e) => e.property === 'region')).toBe(true);
+    });
+
+    it('valida el AppClientConfig anidado', async () => {
+        const errors = await validate(plainToInstance(CreatePoolClientRequest, { region: 'us-east-1', appClientConfig: { ...CLIENT, explicitAuthFlows: ['ALLOW_INVENTADO'] } }));
+        expect(errors.some((e) => e.property === 'appClientConfig')).toBe(true);
+    });
+});
+
+describe('AppClientConfig endurecido', () => {
+    it('acepta los flujos que usa el onboarding', async () => {
+        const dto = plainToInstance(AppClientConfig, { explicitAuthFlows: ['ALLOW_ADMIN_USER_PASSWORD_AUTH', 'ALLOW_CUSTOM_AUTH', 'ALLOW_REFRESH_TOKEN_AUTH'], refreshTokenValidity: 30 });
+        expect(await validate(dto)).toEqual([]);
+    });
+
+    it('rechaza un flujo desconocido', async () => {
+        const errors = await validate(plainToInstance(AppClientConfig, { explicitAuthFlows: ['ALLOW_INVENTADO'] }));
+        expect(errors.some((e) => e.property === 'explicitAuthFlows')).toBe(true);
+    });
+
+    it('rechaza una unidad de vigencia desconocida', async () => {
+        const errors = await validate(plainToInstance(AppClientConfig, { explicitAuthFlows: ['ALLOW_ADMIN_USER_PASSWORD_AUTH'], tokenValidityUnits: 'weeks' }));
+        expect(errors.some((e) => e.property === 'tokenValidityUnits')).toBe(true);
+    });
+
+    it('acepta writeAttributes', async () => {
+        const errors = await validate(plainToInstance(AppClientConfig, { explicitAuthFlows: ['ALLOW_ADMIN_USER_PASSWORD_AUTH'], writeAttributes: ['name'] }));
+        expect(errors).toEqual([]);
+    });
+});

package/_test_/unit/cognitoBackofficeConnector/dtos/CreateUserRequest.primaryVerified.test.ts

@@ -0,0 +1,23 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { CreateUserRequest } from '../../../../src/cognitoBackofficeConnector/dtos/CreateUserRequest';
+
+describe('CreateUserRequest.primaryIdentifierVerified', () => {
+    const base = { userPoolId: 'us-east-1_p', region: 'us-east-1', email: 'api-1@api.surekeep.invalid', tenantId: 'surekeep' };
+
+    it('es opcional', async () => {
+        expect(await validate(plainToInstance(CreateUserRequest, base))).toEqual([]);
+    });
+
+    it('acepta false', async () => {
+        const dto = plainToInstance(CreateUserRequest, { ...base, primaryIdentifierVerified: false });
+        expect(await validate(dto)).toEqual([]);
+        expect(dto.primaryIdentifierVerified).toBe(false);
+    });
+
+    it('rechaza un valor no booleano', async () => {
+        const errors = await validate(plainToInstance(CreateUserRequest, { ...base, primaryIdentifierVerified: 'no' }));
+        expect(errors.some((e) => e.property === 'primaryIdentifierVerified')).toBe(true);
+    });
+});

package/_test_/unit/platformRbac/apiUser/apiUserDtos.test.ts

@@ -0,0 +1,56 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import {
+    AccountType,
+    ApiLoginRequest,
+    CreateApiUserRequest,
+    UpdateApiUserAccessRequest,
+} from '../../../../src/platformRbac';
+
+describe('ApiLoginRequest', () => {
+    const valid = { clientId: '0b9f1c2e-1111-4222-8333-444455556666', clientSecret: 's3cr3t', tenantId: 'surekeep' };
+
+    it('acepta el body completo', async () => {
+        expect(await validate(plainToInstance(ApiLoginRequest, valid))).toEqual([]);
+    });
+
+    it.each(['clientId', 'clientSecret', 'tenantId'])('exige %s', async (field) => {
+        const errors = await validate(plainToInstance(ApiLoginRequest, { ...valid, [field]: '' }));
+        expect(errors.some((e) => e.property === field)).toBe(true);
+    });
+});
+
+describe('CreateApiUserRequest', () => {
+    const valid = { accountType: AccountType.API, displayName: 'La Central', technicalContact: 'ops@central.mx', ipAllowlist: ['189.128.0.0/16'] };
+
+    it('acepta el alta completa', async () => {
+        expect(await validate(plainToInstance(CreateApiUserRequest, valid))).toEqual([]);
+    });
+
+    it('exige accountType API', async () => {
+        const errors = await validate(plainToInstance(CreateApiUserRequest, { ...valid, accountType: 'HUMAN' }));
+        expect(errors.some((e) => e.property === 'accountType')).toBe(true);
+    });
+
+    it('exige displayName', async () => {
+        const errors = await validate(plainToInstance(CreateApiUserRequest, { ...valid, displayName: '' }));
+        expect(errors.some((e) => e.property === 'displayName')).toBe(true);
+    });
+
+    it('exige una lista de IPs no vacía', async () => {
+        const errors = await validate(plainToInstance(CreateApiUserRequest, { ...valid, ipAllowlist: [] }));
+        expect(errors.some((e) => e.property === 'ipAllowlist')).toBe(true);
+    });
+});
+
+describe('UpdateApiUserAccessRequest', () => {
+    it('acepta solo IPs', async () => {
+        expect(await validate(plainToInstance(UpdateApiUserAccessRequest, { ipAllowlist: ['10.0.0.0/8'] }))).toEqual([]);
+    });
+
+    it('rechaza una lista vacía', async () => {
+        const errors = await validate(plainToInstance(UpdateApiUserAccessRequest, { ipAllowlist: [] }));
+        expect(errors.some((e) => e.property === 'ipAllowlist')).toBe(true);
+    });
+});

package/_test_/unit/platformRbac/enums/AccountType.test.ts

@@ -0,0 +1,11 @@
+import { AccountType, PrincipalKind } from '../../../../src/platformRbac';
+
+describe('AccountType y PrincipalKind (usuarios de API)', () => {
+    it('AccountType tiene exactamente HUMAN y API', () => {
+        expect(Object.values(AccountType)).toEqual(['HUMAN', 'API']);
+    });
+
+    it('PrincipalKind suma API_USER al final sin tocar los existentes', () => {
+        expect(Object.values(PrincipalKind)).toEqual(['USER', 'INTEGRATION', 'API_USER']);
+    });
+});

package/_test_/unit/platformRbac/enums/__snapshots__/permissionBits.test.ts.snap

@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
-exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `3833769424`;
+exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `2686516275`;
 
 exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe ante cualquier reorden/inserción) 1`] = `
 [
@@ -95,5 +95,6 @@ exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe an
   "platform.integration.key.issue",
   "platform.integration.key.revoke",
   "tenant.integration.diagnostic",
+  "tenant.api_user.manage",
 ]
 `;

package/_test_/unit/platformRbac/enums/apiUserPermission.test.ts

@@ -0,0 +1,11 @@
+import { Permission, PERMISSION_BIT_ORDER } from '../../../../src/platformRbac/enums/Permission';
+
+describe('Permiso de administración de usuarios de API', () => {
+    it('existe con la llave tenant.api_user.manage', () => {
+        expect(Permission.TENANT_API_USER_MANAGE).toBe('tenant.api_user.manage');
+    });
+
+    it('va al FINAL del orden de bits (append-only)', () => {
+        expect(PERMISSION_BIT_ORDER[PERMISSION_BIT_ORDER.length - 1]).toBe(Permission.TENANT_API_USER_MANAGE);
+    });
+});

package/bin/cognitoBackofficeConnector/dtos/AppClientConfig.d.ts

@@ -1,11 +1,10 @@
+/** Flujos de autenticación que Cognito admite en un app client. */
+export declare const COGNITO_EXPLICIT_AUTH_FLOWS: readonly string[];
+/** Unidades de vigencia de token; el conector aplica una sola a los tres tokens. */
+export declare const COGNITO_TOKEN_VALIDITY_UNITS: readonly string[];
 /**
- * Config del único App Client del pool nuevo creado por POST /pools.
- *
- * NO expone `generateSecret` — el connector hardcodea `GenerateSecret: false`
- * en el SDK call (BFF pattern: rbac llama al connector server-to-server vía
- * api-invoker en VPC, sin SPA-to-Cognito directo que requiera client secret).
- * Decisión arquitectónica A21 del connector. Si aparece consumer B2B/M2M con
- * flow `client_credentials`, evaluar con líder + bump major del connector.
+ * Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients).
+ * Sin `generateSecret`: el conector fija GenerateSecret false (A21).
  */
 export declare class AppClientConfig {
     clientName?: string;
@@ -16,4 +15,6 @@ export declare class AppClientConfig {
     refreshTokenValidity?: number;
     preventUserExistenceErrors?: boolean;
     enableTokenRevocation?: boolean;
+    /** Atributos que el usuario puede escribir con su propio token. Ausente ⇒ todos (default de Cognito). */
+    writeAttributes?: string[];
 }

package/bin/cognitoBackofficeConnector/dtos/AppClientConfig.js

@@ -9,17 +9,23 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AppClientConfig = void 0;
+exports.AppClientConfig = exports.COGNITO_TOKEN_VALIDITY_UNITS = exports.COGNITO_EXPLICIT_AUTH_FLOWS = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
+/** Flujos de autenticación que Cognito admite en un app client. */
+exports.COGNITO_EXPLICIT_AUTH_FLOWS = [
+    'ALLOW_ADMIN_USER_PASSWORD_AUTH',
+    'ALLOW_CUSTOM_AUTH',
+    'ALLOW_USER_PASSWORD_AUTH',
+    'ALLOW_USER_SRP_AUTH',
+    'ALLOW_REFRESH_TOKEN_AUTH',
+    'ALLOW_USER_AUTH',
+];
+/** Unidades de vigencia de token; el conector aplica una sola a los tres tokens. */
+exports.COGNITO_TOKEN_VALIDITY_UNITS = ['seconds', 'minutes', 'hours', 'days'];
 /**
- * Config del único App Client del pool nuevo creado por POST /pools.
- *
- * NO expone `generateSecret` — el connector hardcodea `GenerateSecret: false`
- * en el SDK call (BFF pattern: rbac llama al connector server-to-server vía
- * api-invoker en VPC, sin SPA-to-Cognito directo que requiera client secret).
- * Decisión arquitectónica A21 del connector. Si aparece consumer B2B/M2M con
- * flow `client_credentials`, evaluar con líder + bump major del connector.
+ * Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients).
+ * Sin `generateSecret`: el conector fija GenerateSecret false (A21).
  */
 class AppClientConfig {
 }
@@ -33,13 +39,13 @@ __decorate([
 __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsArray)(),
-    (0, class_validator_1.IsString)({ each: true }),
+    (0, class_validator_1.IsIn)(exports.COGNITO_EXPLICIT_AUTH_FLOWS, { each: true }),
     __metadata("design:type", Array)
 ], AppClientConfig.prototype, "explicitAuthFlows", void 0);
 __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsIn)(exports.COGNITO_TOKEN_VALIDITY_UNITS),
     __metadata("design:type", String)
 ], AppClientConfig.prototype, "tokenValidityUnits", void 0);
 __decorate([
@@ -72,3 +78,10 @@ __decorate([
     (0, class_validator_1.IsBoolean)(),
     __metadata("design:type", Boolean)
 ], AppClientConfig.prototype, "enableTokenRevocation", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], AppClientConfig.prototype, "writeAttributes", void 0);

package/bin/cognitoBackofficeConnector/dtos/CreatePoolClientRequest.d.ts

@@ -0,0 +1,6 @@
+import { AppClientConfig } from './AppClientConfig';
+/** Body de POST /pools/{userPoolId}/clients: un app client extra sobre un pool existente. */
+export declare class CreatePoolClientRequest {
+    region: string;
+    appClientConfig: AppClientConfig;
+}

package/bin/cognitoBackofficeConnector/dtos/CreatePoolClientRequest.js

@@ -0,0 +1,31 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePoolClientRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const AppClientConfig_1 = require("./AppClientConfig");
+/** Body de POST /pools/{userPoolId}/clients: un app client extra sobre un pool existente. */
+class CreatePoolClientRequest {
+}
+exports.CreatePoolClientRequest = CreatePoolClientRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreatePoolClientRequest.prototype, "region", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => AppClientConfig_1.AppClientConfig),
+    __metadata("design:type", AppClientConfig_1.AppClientConfig)
+], CreatePoolClientRequest.prototype, "appClientConfig", void 0);

package/bin/cognitoBackofficeConnector/dtos/CreatePoolClientResponse.d.ts

@@ -0,0 +1,4 @@
+/** Respuesta de POST /pools/{userPoolId}/clients. Sin secret: el client nace con GenerateSecret false. */
+export declare class CreatePoolClientResponse {
+    appClientId: string;
+}

package/bin/cognitoBackofficeConnector/dtos/CreatePoolClientResponse.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePoolClientResponse = void 0;
+/** Respuesta de POST /pools/{userPoolId}/clients. Sin secret: el client nace con GenerateSecret false. */
+class CreatePoolClientResponse {
+}
+exports.CreatePoolClientResponse = CreatePoolClientResponse;

package/bin/cognitoBackofficeConnector/dtos/CreateUserRequest.d.ts

@@ -10,4 +10,6 @@ export declare class CreateUserRequest {
     tenantId: string;
     temporaryPassword?: string;
     suppressInvitationEmail?: boolean;
+    /** Ausente ⇒ true. false crea el identificador primario sin verificar (usuario de API). */
+    primaryIdentifierVerified?: boolean;
 }

package/bin/cognitoBackofficeConnector/dtos/CreateUserRequest.js

@@ -69,3 +69,9 @@ __decorate([
     (0, class_validator_1.IsBoolean)(),
     __metadata("design:type", Boolean)
 ], CreateUserRequest.prototype, "suppressInvitationEmail", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], CreateUserRequest.prototype, "primaryIdentifierVerified", void 0);

package/bin/cognitoBackofficeConnector/index.d.ts

@@ -49,6 +49,8 @@ export * from './dtos/AppClientConfig';
 export * from './dtos/CreatePoolRequest';
 export * from './dtos/CreatePoolResponse';
 export * from './dtos/DeletePoolRequest';
+export * from './dtos/CreatePoolClientRequest';
+export * from './dtos/CreatePoolClientResponse';
 export * from './enums/IntrospectFailReason';
 export * from './dtos/IntrospectRequest';
 export * from './dtos/IntrospectResponse';

package/bin/cognitoBackofficeConnector/index.js

@@ -65,6 +65,8 @@ __exportStar(require("./dtos/AppClientConfig"), exports);
 __exportStar(require("./dtos/CreatePoolRequest"), exports);
 __exportStar(require("./dtos/CreatePoolResponse"), exports);
 __exportStar(require("./dtos/DeletePoolRequest"), exports);
+__exportStar(require("./dtos/CreatePoolClientRequest"), exports);
+__exportStar(require("./dtos/CreatePoolClientResponse"), exports);
 // Introspección de token (POST /auth/introspect) — consumido por el platform-rbac-business.
 __exportStar(require("./enums/IntrospectFailReason"), exports);
 __exportStar(require("./dtos/IntrospectRequest"), exports);

package/bin/platformRbac/apiUser/ApiLoginRequest.d.ts

@@ -0,0 +1,6 @@
+/** Body de POST /auth/api/login. clientId es el sub del usuario de API y clientSecret su secreto. */
+export declare class ApiLoginRequest {
+    clientId: string;
+    clientSecret: string;
+    tenantId: string;
+}

package/bin/platformRbac/apiUser/ApiLoginRequest.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiLoginRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body de POST /auth/api/login. clientId es el sub del usuario de API y clientSecret su secreto. */
+class ApiLoginRequest {
+}
+exports.ApiLoginRequest = ApiLoginRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ApiLoginRequest.prototype, "clientId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ApiLoginRequest.prototype, "clientSecret", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ApiLoginRequest.prototype, "tenantId", void 0);

package/bin/platformRbac/apiUser/ApiLoginResponse.d.ts

@@ -0,0 +1,6 @@
+/** Respuesta 200 del login de API: solo el access token, nunca el refresh. */
+export declare class ApiLoginResponse {
+    accessToken: string;
+    expiresIn: number;
+    tokenType: 'Bearer';
+}

package/bin/platformRbac/apiUser/ApiLoginResponse.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiLoginResponse = void 0;
+/** Respuesta 200 del login de API: solo el access token, nunca el refresh. */
+class ApiLoginResponse {
+}
+exports.ApiLoginResponse = ApiLoginResponse;

package/bin/platformRbac/apiUser/ApiUserWhoamiResponse.d.ts

@@ -0,0 +1,7 @@
+/** Diagnóstico del W5 para usuarios de API: el principal ya resuelto por el adapter. */
+export declare class ApiUserWhoamiResponse {
+    principalType: 'API_USER';
+    principalId: string;
+    tenantId: string;
+    permissions: string[];
+}

package/bin/platformRbac/apiUser/ApiUserWhoamiResponse.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiUserWhoamiResponse = void 0;
+/** Diagnóstico del W5 para usuarios de API: el principal ya resuelto por el adapter. */
+class ApiUserWhoamiResponse {
+}
+exports.ApiUserWhoamiResponse = ApiUserWhoamiResponse;

package/bin/platformRbac/apiUser/CreateApiUserRequest.d.ts

@@ -0,0 +1,8 @@
+import { AccountType } from '../enums/AccountType';
+/** Alta de un usuario de API por POST /tenants/{tenantId}/users con accountType API. */
+export declare class CreateApiUserRequest {
+    accountType: AccountType;
+    displayName: string;
+    technicalContact?: string;
+    ipAllowlist: string[];
+}

package/bin/platformRbac/apiUser/CreateApiUserRequest.js

@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateApiUserRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const AccountType_1 = require("../enums/AccountType");
+/** Alta de un usuario de API por POST /tenants/{tenantId}/users con accountType API. */
+class CreateApiUserRequest {
+}
+exports.CreateApiUserRequest = CreateApiUserRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsIn)([AccountType_1.AccountType.API]),
+    __metadata("design:type", String)
+], CreateApiUserRequest.prototype, "accountType", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(120),
+    __metadata("design:type", String)
+], CreateApiUserRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(200),
+    __metadata("design:type", String)
+], CreateApiUserRequest.prototype, "technicalContact", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], CreateApiUserRequest.prototype, "ipAllowlist", void 0);

package/bin/platformRbac/apiUser/CreateApiUserResponse.d.ts

@@ -0,0 +1,9 @@
+import type { AccountType } from '../enums/AccountType';
+/** Credenciales del usuario de API recién creado. El secreto sale UNA sola vez. */
+export declare class CreateApiUserResponse {
+    cognitoSub: string;
+    clientId: string;
+    clientSecret: string;
+    status: 'ACTIVE';
+    accountType: AccountType;
+}

package/bin/platformRbac/apiUser/CreateApiUserResponse.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateApiUserResponse = void 0;
+/** Credenciales del usuario de API recién creado. El secreto sale UNA sola vez. */
+class CreateApiUserResponse {
+}
+exports.CreateApiUserResponse = CreateApiUserResponse;

package/bin/platformRbac/apiUser/RotateApiUserSecretResponse.d.ts

@@ -0,0 +1,5 @@
+/** Secreto nuevo tras rotar. El anterior y los tokens vivos dejan de servir. */
+export declare class RotateApiUserSecretResponse {
+    clientId: string;
+    clientSecret: string;
+}

package/bin/platformRbac/apiUser/RotateApiUserSecretResponse.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RotateApiUserSecretResponse = void 0;
+/** Secreto nuevo tras rotar. El anterior y los tokens vivos dejan de servir. */
+class RotateApiUserSecretResponse {
+}
+exports.RotateApiUserSecretResponse = RotateApiUserSecretResponse;

package/bin/platformRbac/apiUser/UpdateApiUserAccessRequest.d.ts

@@ -0,0 +1,5 @@
+/** Body de PUT /tenants/{tenantId}/users/{cognitoSub}/api-access. */
+export declare class UpdateApiUserAccessRequest {
+    ipAllowlist?: string[];
+    technicalContact?: string;
+}

package/bin/platformRbac/apiUser/UpdateApiUserAccessRequest.js

@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateApiUserAccessRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body de PUT /tenants/{tenantId}/users/{cognitoSub}/api-access. */
+class UpdateApiUserAccessRequest {
+}
+exports.UpdateApiUserAccessRequest = UpdateApiUserAccessRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], UpdateApiUserAccessRequest.prototype, "ipAllowlist", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(200),
+    __metadata("design:type", String)
+], UpdateApiUserAccessRequest.prototype, "technicalContact", void 0);

package/bin/platformRbac/enums/AccountType.d.ts

@@ -0,0 +1,5 @@
+/** Tipo de cuenta de un usuario del pool. API entra por Bearer, sin 2FA. */
+export declare enum AccountType {
+    HUMAN = "HUMAN",
+    API = "API"
+}

package/bin/platformRbac/enums/AccountType.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountType = void 0;
+/** Tipo de cuenta de un usuario del pool. API entra por Bearer, sin 2FA. */
+var AccountType;
+(function (AccountType) {
+    AccountType["HUMAN"] = "HUMAN";
+    AccountType["API"] = "API";
+})(AccountType || (exports.AccountType = AccountType = {}));

package/bin/platformRbac/enums/Permission.d.ts

@@ -119,7 +119,8 @@ export declare enum Permission {
     PLATFORM_INTEGRATION_MANAGE = "platform.integration.manage",
     PLATFORM_INTEGRATION_KEY_ISSUE = "platform.integration.key.issue",
     PLATFORM_INTEGRATION_KEY_REVOKE = "platform.integration.key.revoke",
-    TENANT_INTEGRATION_DIAGNOSTIC = "tenant.integration.diagnostic"
+    TENANT_INTEGRATION_DIAGNOSTIC = "tenant.integration.diagnostic",
+    TENANT_API_USER_MANAGE = "tenant.api_user.manage"
 }
 /**
  * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.

package/bin/platformRbac/enums/Permission.js

@@ -164,6 +164,8 @@ var Permission;
     // Por eso este es TENANT-scoped. Y por eso NO entra en el set de la guarda 1: no administra
     // nada, solo devuelve quién sos.
     Permission["TENANT_INTEGRATION_DIAGNOSTIC"] = "tenant.integration.diagnostic";
+    // Alta, rotación de secreto y edición de IPs de usuarios de API; se exige además de tenant.user.create.
+    Permission["TENANT_API_USER_MANAGE"] = "tenant.api_user.manage";
 })(Permission || (exports.Permission = Permission = {}));
 /**
  * Orden CANÓNICO y APPEND-ONLY de los permisos para el bitset del token.
@@ -283,6 +285,7 @@ exports.PERMISSION_BIT_ORDER = [
     Permission.PLATFORM_INTEGRATION_KEY_ISSUE,
     Permission.PLATFORM_INTEGRATION_KEY_REVOKE,
     Permission.TENANT_INTEGRATION_DIAGNOSTIC,
+    Permission.TENANT_API_USER_MANAGE,
 ];
 function djb2(input) {
     let h = 5381;

package/bin/platformRbac/enums/PrincipalKind.d.ts

@@ -4,11 +4,13 @@
  * USER        — persona autenticada con sesión de Cognito (cookie `session`).
  * INTEGRATION — credencial máquina-a-máquina de un socio externo (API key bearer). Su `cognitoSub`
  *               tiene la forma `INT#<integrationId>` y NO viene de Cognito.
+ * API_USER    — usuario de API del pool (token del client de API validado por el W5).
  *
  * NO confundir con `PrincipalIdentifierEnum` (EMAIL/PHONE), que es cómo se identifica un humano al
  * hacer login (DEC-RBAC-079). Este enum es el TIPO de principal, no cómo se identifica.
  */
 export declare enum PrincipalKind {
     USER = "USER",
-    INTEGRATION = "INTEGRATION"
+    INTEGRATION = "INTEGRATION",
+    API_USER = "API_USER"
 }

package/bin/platformRbac/enums/PrincipalKind.js

@@ -7,6 +7,7 @@ exports.PrincipalKind = void 0;
  * USER        — persona autenticada con sesión de Cognito (cookie `session`).
  * INTEGRATION — credencial máquina-a-máquina de un socio externo (API key bearer). Su `cognitoSub`
  *               tiene la forma `INT#<integrationId>` y NO viene de Cognito.
+ * API_USER    — usuario de API del pool (token del client de API validado por el W5).
  *
  * NO confundir con `PrincipalIdentifierEnum` (EMAIL/PHONE), que es cómo se identifica un humano al
  * hacer login (DEC-RBAC-079). Este enum es el TIPO de principal, no cómo se identifica.
@@ -15,4 +16,5 @@ var PrincipalKind;
 (function (PrincipalKind) {
     PrincipalKind["USER"] = "USER";
     PrincipalKind["INTEGRATION"] = "INTEGRATION";
+    PrincipalKind["API_USER"] = "API_USER";
 })(PrincipalKind || (exports.PrincipalKind = PrincipalKind = {}));

package/bin/platformRbac/index.d.ts

@@ -3,6 +3,7 @@ export { PermissionScope } from './enums/PermissionScope';
 export { PermissionCategory } from './enums/PermissionCategory';
 export { PrincipalIdentifierEnum } from './enums/PrincipalIdentifierEnum';
 export { PrincipalKind } from './enums/PrincipalKind';
+export { AccountType } from './enums/AccountType';
 export type { AuthContext } from './dtos/AuthContext';
 export type { RoleAssignmentInfo } from './dtos/RoleAssignmentInfo';
 export type { PermissionMeta } from './dtos/PermissionMeta';
@@ -86,3 +87,10 @@ export * from './dtos/RevokeTenantRoleRequest';
 export type { RevokeTenantRoleResponse } from './dtos/RevokeTenantRoleResponse';
 export * from './dtos/TenantUsersBySubsRequest';
 export type { TenantUserBySubItem, TenantUsersBySubsResponse } from './dtos/TenantUsersBySubsResponse';
+export * from './apiUser/ApiLoginRequest';
+export * from './apiUser/ApiLoginResponse';
+export * from './apiUser/CreateApiUserRequest';
+export * from './apiUser/CreateApiUserResponse';
+export * from './apiUser/RotateApiUserSecretResponse';
+export * from './apiUser/UpdateApiUserAccessRequest';
+export * from './apiUser/ApiUserWhoamiResponse';

package/bin/platformRbac/index.js

@@ -23,7 +23,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserFieldType = exports.scopeRankOrder = exports.tableSuffixForLevel = exports.levelsOf = exports.TENANT_TYPES = exports.TenantType = exports.AuthorizeDenyReason = exports.PrincipalKind = exports.PrincipalIdentifierEnum = exports.PermissionCategory = exports.PermissionScope = exports.bitsToPermissions = exports.permissionsToBits = exports.PERMS_VERSION = exports.PERMISSION_BIT_ORDER = exports.Permission = void 0;
+exports.UserFieldType = exports.scopeRankOrder = exports.tableSuffixForLevel = exports.levelsOf = exports.TENANT_TYPES = exports.TenantType = exports.AuthorizeDenyReason = exports.AccountType = exports.PrincipalKind = exports.PrincipalIdentifierEnum = exports.PermissionCategory = exports.PermissionScope = exports.bitsToPermissions = exports.permissionsToBits = exports.PERMS_VERSION = exports.PERMISSION_BIT_ORDER = exports.Permission = void 0;
 var Permission_1 = require("./enums/Permission");
 Object.defineProperty(exports, "Permission", { enumerable: true, get: function () { return Permission_1.Permission; } });
 Object.defineProperty(exports, "PERMISSION_BIT_ORDER", { enumerable: true, get: function () { return Permission_1.PERMISSION_BIT_ORDER; } });
@@ -41,6 +41,8 @@ Object.defineProperty(exports, "PrincipalIdentifierEnum", { enumerable: true, ge
 // que es cómo se identifica un humano al hacer login.
 var PrincipalKind_1 = require("./enums/PrincipalKind");
 Object.defineProperty(exports, "PrincipalKind", { enumerable: true, get: function () { return PrincipalKind_1.PrincipalKind; } });
+var AccountType_1 = require("./enums/AccountType");
+Object.defineProperty(exports, "AccountType", { enumerable: true, get: function () { return AccountType_1.AccountType; } });
 // Fase 1 — Custom Auth Challenge (Email OTP + TOTP) + MFA self-service.
 // Class values (no type-only) — los DTOs llevan decoradores class-validator y se hidratan con plainToInstance en runtime.
 __exportStar(require("./enums/MfaMethodEnum"), exports);
@@ -127,3 +129,11 @@ __exportStar(require("./dtos/AssignTenantRoleRequest"), exports);
 __exportStar(require("./dtos/RevokeTenantRoleRequest"), exports);
 // Batch privado de usuarios del tenant por cognitoSub (hub de miembros de group-business).
 __exportStar(require("./dtos/TenantUsersBySubsRequest"), exports);
+// Usuarios de API: login por Bearer, alta, rotación de secreto y diagnóstico del W5.
+__exportStar(require("./apiUser/ApiLoginRequest"), exports);
+__exportStar(require("./apiUser/ApiLoginResponse"), exports);
+__exportStar(require("./apiUser/CreateApiUserRequest"), exports);
+__exportStar(require("./apiUser/CreateApiUserResponse"), exports);
+__exportStar(require("./apiUser/RotateApiUserSecretResponse"), exports);
+__exportStar(require("./apiUser/UpdateApiUserAccessRequest"), exports);
+__exportStar(require("./apiUser/ApiUserWhoamiResponse"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.487.0",
+  "version": "3.488.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/cognitoBackofficeConnector/dtos/AppClientConfig.ts

@@ -1,22 +1,32 @@
 import { Expose } from 'class-transformer';
-import { IsArray, IsBoolean, IsNumber, IsOptional, IsString } from 'class-validator';
+import { IsArray, IsBoolean, IsIn, IsNumber, IsOptional, IsString } from 'class-validator';
+
+/** Flujos de autenticación que Cognito admite en un app client. */
+export const COGNITO_EXPLICIT_AUTH_FLOWS: readonly string[] = [
+    'ALLOW_ADMIN_USER_PASSWORD_AUTH',
+    'ALLOW_CUSTOM_AUTH',
+    'ALLOW_USER_PASSWORD_AUTH',
+    'ALLOW_USER_SRP_AUTH',
+    'ALLOW_REFRESH_TOKEN_AUTH',
+    'ALLOW_USER_AUTH',
+];
+
+/** Unidades de vigencia de token; el conector aplica una sola a los tres tokens. */
+export const COGNITO_TOKEN_VALIDITY_UNITS: readonly string[] = ['seconds', 'minutes', 'hours', 'days'];
 
 /**
- * Config del único App Client del pool nuevo creado por POST /pools.
- *
- * NO expone `generateSecret` — el connector hardcodea `GenerateSecret: false`
- * en el SDK call (BFF pattern: rbac llama al connector server-to-server vía
- * api-invoker en VPC, sin SPA-to-Cognito directo que requiera client secret).
- * Decisión arquitectónica A21 del connector. Si aparece consumer B2B/M2M con
- * flow `client_credentials`, evaluar con líder + bump major del connector.
+ * Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients).
+ * Sin `generateSecret`: el conector fija GenerateSecret false (A21).
  */
 export class AppClientConfig {
     @Expose() @IsOptional() @IsString() clientName?: string;
-    @Expose() @IsArray() @IsString({ each: true }) explicitAuthFlows!: string[];
-    @Expose() @IsOptional() @IsString() tokenValidityUnits?: string;
+    @Expose() @IsArray() @IsIn(COGNITO_EXPLICIT_AUTH_FLOWS, { each: true }) explicitAuthFlows!: string[];
+    @Expose() @IsOptional() @IsIn(COGNITO_TOKEN_VALIDITY_UNITS) tokenValidityUnits?: string;
     @Expose() @IsOptional() @IsNumber() accessTokenValidity?: number;
     @Expose() @IsOptional() @IsNumber() idTokenValidity?: number;
     @Expose() @IsOptional() @IsNumber() refreshTokenValidity?: number;
     @Expose() @IsOptional() @IsBoolean() preventUserExistenceErrors?: boolean;
     @Expose() @IsOptional() @IsBoolean() enableTokenRevocation?: boolean;
+    /** Atributos que el usuario puede escribir con su propio token. Ausente ⇒ todos (default de Cognito). */
+    @Expose() @IsOptional() @IsArray() @IsString({ each: true }) writeAttributes?: string[];
 }

package/src/cognitoBackofficeConnector/dtos/CreatePoolClientRequest.ts

@@ -0,0 +1,9 @@
+import { Expose, Type } from 'class-transformer';
+import { IsNotEmpty, IsString, ValidateNested } from 'class-validator';
+import { AppClientConfig } from './AppClientConfig';
+
+/** Body de POST /pools/{userPoolId}/clients: un app client extra sobre un pool existente. */
+export class CreatePoolClientRequest {
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @ValidateNested() @Type(() => AppClientConfig) appClientConfig!: AppClientConfig;
+}

package/src/cognitoBackofficeConnector/dtos/CreatePoolClientResponse.ts

@@ -0,0 +1,4 @@
+/** Respuesta de POST /pools/{userPoolId}/clients. Sin secret: el client nace con GenerateSecret false. */
+export class CreatePoolClientResponse {
+    appClientId!: string;
+}

package/src/cognitoBackofficeConnector/dtos/CreateUserRequest.ts

@@ -27,4 +27,6 @@ export class CreateUserRequest {
     @Expose() @IsString() @IsNotEmpty() tenantId!: string;
     @Expose() @IsOptional() @IsString() temporaryPassword?: string;
     @Expose() @IsOptional() @IsBoolean() suppressInvitationEmail?: boolean;
+    /** Ausente ⇒ true. false crea el identificador primario sin verificar (usuario de API). */
+    @Expose() @IsOptional() @IsBoolean() primaryIdentifierVerified?: boolean;
 }

package/src/cognitoBackofficeConnector/index.ts

@@ -49,6 +49,8 @@ export * from './dtos/AppClientConfig';
 export * from './dtos/CreatePoolRequest';
 export * from './dtos/CreatePoolResponse';
 export * from './dtos/DeletePoolRequest';
+export * from './dtos/CreatePoolClientRequest';
+export * from './dtos/CreatePoolClientResponse';
 
 // Introspección de token (POST /auth/introspect) — consumido por el platform-rbac-business.
 export * from './enums/IntrospectFailReason';

package/src/platformRbac/apiUser/ApiLoginRequest.ts

@@ -0,0 +1,9 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/** Body de POST /auth/api/login. clientId es el sub del usuario de API y clientSecret su secreto. */
+export class ApiLoginRequest {
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() clientSecret!: string;
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+}

package/src/platformRbac/apiUser/ApiLoginResponse.ts

@@ -0,0 +1,6 @@
+/** Respuesta 200 del login de API: solo el access token, nunca el refresh. */
+export class ApiLoginResponse {
+    accessToken!: string;
+    expiresIn!: number;
+    tokenType!: 'Bearer';
+}

package/src/platformRbac/apiUser/ApiUserWhoamiResponse.ts

@@ -0,0 +1,7 @@
+/** Diagnóstico del W5 para usuarios de API: el principal ya resuelto por el adapter. */
+export class ApiUserWhoamiResponse {
+    principalType!: 'API_USER';
+    principalId!: string;
+    tenantId!: string;
+    permissions!: string[];
+}

package/src/platformRbac/apiUser/CreateApiUserRequest.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { ArrayNotEmpty, IsArray, IsIn, IsNotEmpty, IsOptional, IsString, MaxLength } from 'class-validator';
+import { AccountType } from '../enums/AccountType';
+
+/** Alta de un usuario de API por POST /tenants/{tenantId}/users con accountType API. */
+export class CreateApiUserRequest {
+    @Expose() @IsIn([AccountType.API]) accountType!: AccountType;
+    @Expose() @IsString() @IsNotEmpty() @MaxLength(120) displayName!: string;
+    @Expose() @IsOptional() @IsString() @MaxLength(200) technicalContact?: string;
+    @Expose() @IsArray() @ArrayNotEmpty() @IsString({ each: true }) ipAllowlist!: string[];
+}

package/src/platformRbac/apiUser/CreateApiUserResponse.ts

@@ -0,0 +1,10 @@
+import type { AccountType } from '../enums/AccountType';
+
+/** Credenciales del usuario de API recién creado. El secreto sale UNA sola vez. */
+export class CreateApiUserResponse {
+    cognitoSub!: string;
+    clientId!: string;
+    clientSecret!: string;
+    status!: 'ACTIVE';
+    accountType!: AccountType;
+}

package/src/platformRbac/apiUser/RotateApiUserSecretResponse.ts

@@ -0,0 +1,5 @@
+/** Secreto nuevo tras rotar. El anterior y los tokens vivos dejan de servir. */
+export class RotateApiUserSecretResponse {
+    clientId!: string;
+    clientSecret!: string;
+}

package/src/platformRbac/apiUser/UpdateApiUserAccessRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { ArrayNotEmpty, IsArray, IsOptional, IsString, MaxLength } from 'class-validator';
+
+/** Body de PUT /tenants/{tenantId}/users/{cognitoSub}/api-access. */
+export class UpdateApiUserAccessRequest {
+    @Expose() @IsOptional() @IsArray() @ArrayNotEmpty() @IsString({ each: true }) ipAllowlist?: string[];
+    @Expose() @IsOptional() @IsString() @MaxLength(200) technicalContact?: string;
+}

package/src/platformRbac/enums/AccountType.ts

@@ -0,0 +1,5 @@
+/** Tipo de cuenta de un usuario del pool. API entra por Bearer, sin 2FA. */
+export enum AccountType {
+    HUMAN = 'HUMAN',
+    API = 'API',
+}

package/src/platformRbac/enums/Permission.ts

@@ -163,6 +163,8 @@ export enum Permission {
     // Por eso este es TENANT-scoped. Y por eso NO entra en el set de la guarda 1: no administra
     // nada, solo devuelve quién sos.
     TENANT_INTEGRATION_DIAGNOSTIC = 'tenant.integration.diagnostic',
+    // Alta, rotación de secreto y edición de IPs de usuarios de API; se exige además de tenant.user.create.
+    TENANT_API_USER_MANAGE = 'tenant.api_user.manage',
 }
 
 /**
@@ -283,6 +285,7 @@ export const PERMISSION_BIT_ORDER: readonly Permission[] = [
     Permission.PLATFORM_INTEGRATION_KEY_ISSUE,
     Permission.PLATFORM_INTEGRATION_KEY_REVOKE,
     Permission.TENANT_INTEGRATION_DIAGNOSTIC,
+    Permission.TENANT_API_USER_MANAGE,
 ] as const;
 
 function djb2(input: string): number {

package/src/platformRbac/enums/PrincipalKind.ts

@@ -4,6 +4,7 @@
  * USER        — persona autenticada con sesión de Cognito (cookie `session`).
  * INTEGRATION — credencial máquina-a-máquina de un socio externo (API key bearer). Su `cognitoSub`
  *               tiene la forma `INT#<integrationId>` y NO viene de Cognito.
+ * API_USER    — usuario de API del pool (token del client de API validado por el W5).
  *
  * NO confundir con `PrincipalIdentifierEnum` (EMAIL/PHONE), que es cómo se identifica un humano al
  * hacer login (DEC-RBAC-079). Este enum es el TIPO de principal, no cómo se identifica.
@@ -11,4 +12,5 @@
 export enum PrincipalKind {
     USER = 'USER',
     INTEGRATION = 'INTEGRATION',
+    API_USER = 'API_USER',
 }

package/src/platformRbac/index.ts

@@ -22,6 +22,7 @@ export { PrincipalIdentifierEnum } from './enums/PrincipalIdentifierEnum';
 // DEC-RBAC-120: TIPO de principal (humano vs credencial M2M). No confundir con el de arriba,
 // que es cómo se identifica un humano al hacer login.
 export { PrincipalKind } from './enums/PrincipalKind';
+export { AccountType } from './enums/AccountType';
 
 export type { AuthContext } from './dtos/AuthContext';
 export type { RoleAssignmentInfo } from './dtos/RoleAssignmentInfo';
@@ -182,3 +183,12 @@ export type { RevokeTenantRoleResponse } from './dtos/RevokeTenantRoleResponse';
 // Batch privado de usuarios del tenant por cognitoSub (hub de miembros de group-business).
 export * from './dtos/TenantUsersBySubsRequest';
 export type { TenantUserBySubItem, TenantUsersBySubsResponse } from './dtos/TenantUsersBySubsResponse';
+
+// Usuarios de API: login por Bearer, alta, rotación de secreto y diagnóstico del W5.
+export * from './apiUser/ApiLoginRequest';
+export * from './apiUser/ApiLoginResponse';
+export * from './apiUser/CreateApiUserRequest';
+export * from './apiUser/CreateApiUserResponse';
+export * from './apiUser/RotateApiUserSecretResponse';
+export * from './apiUser/UpdateApiUserAccessRequest';
+export * from './apiUser/ApiUserWhoamiResponse';