@fiado/type-kit 3.49.0 → 3.51.0

package/_test_/unit/cognitoBackofficeConnector/dtos/CreatePoolRequest.test.ts

@@ -0,0 +1,33 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { CreatePoolRequest } from '../../../../src/cognitoBackofficeConnector/dtos/CreatePoolRequest';
+
+describe('CreatePoolRequest', () => {
+    it('ya NO expone mfaConfig (pool MFA nativo OFF cerrado a nivel contrato — F-11 D2)', () => {
+        const instance = plainToInstance(
+            CreatePoolRequest,
+            {
+                region: 'us-east-1',
+                displayName: 'Tenant Demo',
+                mfaConfig: { requireMfa: true, mfaTypes: ['SOFTWARE_TOKEN_MFA'] },
+                passwordPolicy: {},
+                customAttributes: [],
+                appClientConfig: {},
+            },
+            { excludeExtraneousValues: true },
+        );
+
+        expect((instance as { mfaConfig?: unknown }).mfaConfig).toBeUndefined();
+    });
+
+    it('preserva los campos legítimos del request', () => {
+        const instance = plainToInstance(
+            CreatePoolRequest,
+            { region: 'us-east-1', displayName: 'Tenant Demo' },
+            { excludeExtraneousValues: true },
+        );
+
+        expect(instance.region).toBe('us-east-1');
+        expect(instance.displayName).toBe('Tenant Demo');
+    });
+});

package/_test_/unit/cognitoBackofficeConnector/dtos/Introspect.test.ts

@@ -1,30 +1,30 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import { IntrospectRequest } from '../../../../src/cognitoBackofficeConnector/dtos/IntrospectRequest';
-import { IntrospectResponse } from '../../../../src/cognitoBackofficeConnector/dtos/IntrospectResponse';
-import { IntrospectFailReason } from '../../../../src/cognitoBackofficeConnector/enums/IntrospectFailReason';
-
-describe('IntrospectRequest', () => {
-    it('valida happy path', async () => {
-        const dto = plainToInstance(IntrospectRequest, {
-            token: 'jwt', userPoolId: 'us-east-1_o0h1s3458', region: 'us-east-1', clientId: '1b8g4shbvbi5jhq19fuc8mi2bk',
-        });
-        expect(await validate(dto)).toEqual([]);
-    });
-    it('falla si falta userPoolId', async () => {
-        const dto = plainToInstance(IntrospectRequest, { token: 'jwt', region: 'us-east-1', clientId: 'c' });
-        expect((await validate(dto)).some(e => e.property === 'userPoolId')).toBe(true);
-    });
-});
-
-describe('IntrospectResponse', () => {
-    it('valid=true con cognitoSub', async () => {
-        const dto = plainToInstance(IntrospectResponse, { valid: true, cognitoSub: '248814c8' });
-        expect(await validate(dto)).toEqual([]);
-    });
-    it('valid=false con reason enum', async () => {
-        const dto = plainToInstance(IntrospectResponse, { valid: false, reason: IntrospectFailReason.REVOKED });
-        expect(await validate(dto)).toEqual([]);
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { IntrospectRequest } from '../../../../src/cognitoBackofficeConnector/dtos/IntrospectRequest';
+import { IntrospectResponse } from '../../../../src/cognitoBackofficeConnector/dtos/IntrospectResponse';
+import { IntrospectFailReason } from '../../../../src/cognitoBackofficeConnector/enums/IntrospectFailReason';
+
+describe('IntrospectRequest', () => {
+    it('valida happy path', async () => {
+        const dto = plainToInstance(IntrospectRequest, {
+            token: 'jwt', userPoolId: 'us-east-1_o0h1s3458', region: 'us-east-1', clientId: '1b8g4shbvbi5jhq19fuc8mi2bk',
+        });
+        expect(await validate(dto)).toEqual([]);
+    });
+    it('falla si falta userPoolId', async () => {
+        const dto = plainToInstance(IntrospectRequest, { token: 'jwt', region: 'us-east-1', clientId: 'c' });
+        expect((await validate(dto)).some(e => e.property === 'userPoolId')).toBe(true);
+    });
+});
+
+describe('IntrospectResponse', () => {
+    it('valid=true con cognitoSub', async () => {
+        const dto = plainToInstance(IntrospectResponse, { valid: true, cognitoSub: '248814c8' });
+        expect(await validate(dto)).toEqual([]);
+    });
+    it('valid=false con reason enum', async () => {
+        const dto = plainToInstance(IntrospectResponse, { valid: false, reason: IntrospectFailReason.REVOKED });
+        expect(await validate(dto)).toEqual([]);
+    });
+});

package/_test_/unit/cognitoBackofficeConnector/validators/NoTenantIdInCustomAttrs.test.ts

@@ -1,43 +1,43 @@
-import 'reflect-metadata';
-import { NoTenantIdInCustomAttrs } from '../../../../src/cognitoBackofficeConnector/validators/NoTenantIdInCustomAttrs';
-
-describe('NoTenantIdInCustomAttrs validator', () => {
-    const subject = new NoTenantIdInCustomAttrs();
-
-    test('undefined es válido (optional field)', () => {
-        expect(subject.validate(undefined, { value: undefined } as any)).toBe(true);
-    });
-
-    test('null es válido (optional field)', () => {
-        expect(subject.validate(null, { value: null } as any)).toBe(true);
-    });
-
-    test('objeto vacío {} es válido', () => {
-        expect(subject.validate({}, { value: {} } as any)).toBe(true);
-    });
-
-    test('objeto sin tenantId es válido', () => {
-        const value = { foo: 'bar', anotherKey: 'baz' };
-        expect(subject.validate(value, { value } as any)).toBe(true);
-    });
-
-    test('objeto con tenantId solo es INVÁLIDO', () => {
-        const value = { tenantId: 'X' };
-        expect(subject.validate(value, { value } as any)).toBe(false);
-    });
-
-    test('objeto mixed con tenantId presente es INVÁLIDO', () => {
-        const value = { foo: 'bar', tenantId: 'X' };
-        expect(subject.validate(value, { value } as any)).toBe(false);
-    });
-
-    test('tipo incorrecto (string) es INVÁLIDO', () => {
-        expect(subject.validate('not-an-object', { value: 'not-an-object' } as any)).toBe(false);
-    });
-
-    test('defaultMessage menciona tenant reassignment', () => {
-        const msg = subject.defaultMessage({ property: 'customAttributes' } as any);
-        expect(msg.toLowerCase()).toContain('tenant');
-        expect(msg.toLowerCase()).toContain('reassignment');
-    });
-});
+import 'reflect-metadata';
+import { NoTenantIdInCustomAttrs } from '../../../../src/cognitoBackofficeConnector/validators/NoTenantIdInCustomAttrs';
+
+describe('NoTenantIdInCustomAttrs validator', () => {
+    const subject = new NoTenantIdInCustomAttrs();
+
+    test('undefined es válido (optional field)', () => {
+        expect(subject.validate(undefined, { value: undefined } as any)).toBe(true);
+    });
+
+    test('null es válido (optional field)', () => {
+        expect(subject.validate(null, { value: null } as any)).toBe(true);
+    });
+
+    test('objeto vacío {} es válido', () => {
+        expect(subject.validate({}, { value: {} } as any)).toBe(true);
+    });
+
+    test('objeto sin tenantId es válido', () => {
+        const value = { foo: 'bar', anotherKey: 'baz' };
+        expect(subject.validate(value, { value } as any)).toBe(true);
+    });
+
+    test('objeto con tenantId solo es INVÁLIDO', () => {
+        const value = { tenantId: 'X' };
+        expect(subject.validate(value, { value } as any)).toBe(false);
+    });
+
+    test('objeto mixed con tenantId presente es INVÁLIDO', () => {
+        const value = { foo: 'bar', tenantId: 'X' };
+        expect(subject.validate(value, { value } as any)).toBe(false);
+    });
+
+    test('tipo incorrecto (string) es INVÁLIDO', () => {
+        expect(subject.validate('not-an-object', { value: 'not-an-object' } as any)).toBe(false);
+    });
+
+    test('defaultMessage menciona tenant reassignment', () => {
+        const msg = subject.defaultMessage({ property: 'customAttributes' } as any);
+        expect(msg.toLowerCase()).toContain('tenant');
+        expect(msg.toLowerCase()).toContain('reassignment');
+    });
+});

package/_test_/unit/platformRbac/auth/dtos.test.ts

@@ -1,42 +1,42 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import {
-    DefineNextChallengeRequest,
-    ChallengeResultEntry,
-} from '../../../../src/platformRbac/auth/DefineNextChallengeRequest';
-import { ChallengeNameEnum } from '../../../../src/platformRbac/enums/ChallengeNameEnum';
-
-describe('DefineNextChallengeRequest', () => {
-    it('valida happy path con session vacia', async () => {
-        const dto = plainToInstance(DefineNextChallengeRequest, {
-            cognitoSub: 'abc-123',
-            userNotFound: false,
-            session: [],
-        });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('valida happy path con session de un PASSWORD result', async () => {
-        const dto = plainToInstance(DefineNextChallengeRequest, {
-            cognitoSub: 'abc-123',
-            userNotFound: false,
-            session: [{ challengeName: ChallengeNameEnum.PASSWORD, challengeResult: true }],
-        });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-        expect(dto.session[0]).toBeInstanceOf(ChallengeResultEntry);
-    });
-
-    it('falla si cognitoSub no es string', async () => {
-        const dto = plainToInstance(DefineNextChallengeRequest, {
-            cognitoSub: 42,
-            userNotFound: false,
-            session: [],
-        });
-        const errors = await validate(dto);
-        expect(errors.length).toBeGreaterThan(0);
-        expect(errors[0].property).toBe('cognitoSub');
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import {
+    DefineNextChallengeRequest,
+    ChallengeResultEntry,
+} from '../../../../src/platformRbac/auth/DefineNextChallengeRequest';
+import { ChallengeNameEnum } from '../../../../src/platformRbac/enums/ChallengeNameEnum';
+
+describe('DefineNextChallengeRequest', () => {
+    it('valida happy path con session vacia', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 'abc-123',
+            userNotFound: false,
+            session: [],
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida happy path con session de un PASSWORD result', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 'abc-123',
+            userNotFound: false,
+            session: [{ challengeName: ChallengeNameEnum.PASSWORD, challengeResult: true }],
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+        expect(dto.session[0]).toBeInstanceOf(ChallengeResultEntry);
+    });
+
+    it('falla si cognitoSub no es string', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 42,
+            userNotFound: false,
+            session: [],
+        });
+        const errors = await validate(dto);
+        expect(errors.length).toBeGreaterThan(0);
+        expect(errors[0].property).toBe('cognitoSub');
+    });
+});

package/_test_/unit/platformRbac/dtos/AuthorizeRequest.test.ts

@@ -1,30 +1,30 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import { AuthorizeRequest } from '../../../../src/platformRbac/dtos/AuthorizeRequest';
-import { PermissionScope } from '../../../../src/platformRbac/enums/PermissionScope';
-
-describe('AuthorizeRequest', () => {
-    it('valida happy path con scope opcional', async () => {
-        const dto = plainToInstance(AuthorizeRequest, {
-            token: 'jwt.abc.def',
-            permission: 'tenant.user.create',
-            scope: PermissionScope.RETAILER,
-            scopeRef: 'VL-001',
-        });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('falla si falta token', async () => {
-        const dto = plainToInstance(AuthorizeRequest, { permission: 'tenant.user.create' });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'token')).toBe(true);
-    });
-
-    it('acepta sin scope/scopeRef (permiso sin scope)', async () => {
-        const dto = plainToInstance(AuthorizeRequest, { token: 'jwt', permission: 'catalog.read' });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { AuthorizeRequest } from '../../../../src/platformRbac/dtos/AuthorizeRequest';
+import { PermissionScope } from '../../../../src/platformRbac/enums/PermissionScope';
+
+describe('AuthorizeRequest', () => {
+    it('valida happy path con scope opcional', async () => {
+        const dto = plainToInstance(AuthorizeRequest, {
+            token: 'jwt.abc.def',
+            permission: 'tenant.user.create',
+            scope: PermissionScope.RETAILER,
+            scopeRef: 'VL-001',
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('falla si falta token', async () => {
+        const dto = plainToInstance(AuthorizeRequest, { permission: 'tenant.user.create' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'token')).toBe(true);
+    });
+
+    it('acepta sin scope/scopeRef (permiso sin scope)', async () => {
+        const dto = plainToInstance(AuthorizeRequest, { token: 'jwt', permission: 'catalog.read' });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+});

package/_test_/unit/platformRbac/dtos/AuthorizeResponse.test.ts

@@ -1,25 +1,25 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import { AuthorizeResponse } from '../../../../src/platformRbac/dtos/AuthorizeResponse';
-import { AuthorizeDenyReason } from '../../../../src/platformRbac/enums/AuthorizeDenyReason';
-
-describe('AuthorizeResponse', () => {
-    it('valida allow=true sin reason', async () => {
-        const dto = plainToInstance(AuthorizeResponse, { allow: true });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('valida allow=false con reason enum', async () => {
-        const dto = plainToInstance(AuthorizeResponse, { allow: false, reason: AuthorizeDenyReason.NO_PERMISSION });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('rechaza reason fuera del enum', async () => {
-        const dto = plainToInstance(AuthorizeResponse, { allow: false, reason: 'WHATEVER' });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'reason')).toBe(true);
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { AuthorizeResponse } from '../../../../src/platformRbac/dtos/AuthorizeResponse';
+import { AuthorizeDenyReason } from '../../../../src/platformRbac/enums/AuthorizeDenyReason';
+
+describe('AuthorizeResponse', () => {
+    it('valida allow=true sin reason', async () => {
+        const dto = plainToInstance(AuthorizeResponse, { allow: true });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida allow=false con reason enum', async () => {
+        const dto = plainToInstance(AuthorizeResponse, { allow: false, reason: AuthorizeDenyReason.NO_PERMISSION });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('rechaza reason fuera del enum', async () => {
+        const dto = plainToInstance(AuthorizeResponse, { allow: false, reason: 'WHATEVER' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'reason')).toBe(true);
+    });
+});

package/_test_/unit/platformRbac/dtos/CreateTenantRequest.test.ts

@@ -0,0 +1,68 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { CreateTenantRequest } from '../../../../src/platformRbac/dtos/CreateTenantRequest';
+
+describe('CreateTenantRequest', () => {
+    const valid = {
+        tenantId: 'acme-mx',
+        displayName: 'Acme México',
+        emailDomain: 'acme.com',
+        tablePrefix: 'acme',
+        adminEmail: 'admin@acme.com',
+        adminName: 'Admin Acme',
+        region: 'us-east-1',
+        mfaRequired: true,
+        passwordMinLength: 12,
+    };
+
+    it('valida happy path (0 errores)', async () => {
+        const dto = plainToInstance(CreateTenantRequest, valid);
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida sin campos opcionales (mfaRequired / passwordMinLength)', async () => {
+        const { mfaRequired, passwordMinLength, ...sinOpcionales } = valid;
+        const dto = plainToInstance(CreateTenantRequest, sinOpcionales);
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('falla si adminEmail es inválido', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, adminEmail: 'no-es-email' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'adminEmail')).toBe(true);
+    });
+
+    it('falla si tenantId tiene mayúsculas', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantId: 'Acme-MX' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'tenantId')).toBe(true);
+    });
+
+    it('falla si tenantId tiene caracteres inválidos (espacios / underscore)', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantId: 'acme_mx 01' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'tenantId')).toBe(true);
+    });
+
+    it('falla si passwordMinLength es menor a 8', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, passwordMinLength: 6 });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'passwordMinLength')).toBe(true);
+    });
+
+    it('NO expone temporaryPassword en el request (campo del response, no del body)', () => {
+        // El request NO debe llevar temporaryPassword (es solo del response, fallback out-of-band F-11).
+        // Con excludeExtraneousValues solo sobreviven las props @Expose() del DTO → el contrato lo excluye.
+        const dto = plainToInstance(
+            CreateTenantRequest,
+            { ...valid, temporaryPassword: 'Secreto123!' },
+            { excludeExtraneousValues: true },
+        );
+        expect((dto as unknown as Record<string, unknown>).temporaryPassword).toBeUndefined();
+        // sanity: una prop sí declarada en el contrato sí sobrevive
+        expect(dto.tenantId).toBe('acme-mx');
+    });
+});

package/bin/cognitoBackofficeConnector/dtos/CreatePoolRequest.d.ts

@@ -1,4 +1,3 @@
-import { MfaPoolConfig } from './MfaPoolConfig';
 import { PasswordPolicyConfig } from './PasswordPolicyConfig';
 import { CustomAttributeSpec } from './CustomAttributeSpec';
 import { AppClientConfig } from './AppClientConfig';
@@ -8,11 +7,15 @@ import { AppClientConfig } from './AppClientConfig';
  * (Flujo 2 v1.2, PASO 4 de la saga). El connector ejecuta CreateUserPool +
  * CreateUserPoolClient en secuencia. Si CreateUserPoolClient falla DESPUÉS de
  * CreateUserPool exitoso, el connector hace DeleteUserPool de cleanup.
+ *
+ * El request NO expone configuración de MFA nativo del pool (F-11 D2): el 2º
+ * factor del backoffice va por custom-auth (EMAIL OTP / TOTP), nunca por MFA
+ * nativo del pool. El connector fuerza `MfaConfiguration: 'OFF'` como invariante
+ * de código al crear el pool — no es negociable vía contrato.
  */
 export declare class CreatePoolRequest {
     region: string;
     displayName: string;
-    mfaConfig: MfaPoolConfig;
     passwordPolicy: PasswordPolicyConfig;
     customAttributes: CustomAttributeSpec[];
     appClientConfig: AppClientConfig;

package/bin/cognitoBackofficeConnector/dtos/CreatePoolRequest.js

@@ -12,7 +12,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CreatePoolRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
-const MfaPoolConfig_1 = require("./MfaPoolConfig");
 const PasswordPolicyConfig_1 = require("./PasswordPolicyConfig");
 const CustomAttributeSpec_1 = require("./CustomAttributeSpec");
 const AppClientConfig_1 = require("./AppClientConfig");
@@ -22,6 +21,11 @@ const AppClientConfig_1 = require("./AppClientConfig");
  * (Flujo 2 v1.2, PASO 4 de la saga). El connector ejecuta CreateUserPool +
  * CreateUserPoolClient en secuencia. Si CreateUserPoolClient falla DESPUÉS de
  * CreateUserPool exitoso, el connector hace DeleteUserPool de cleanup.
+ *
+ * El request NO expone configuración de MFA nativo del pool (F-11 D2): el 2º
+ * factor del backoffice va por custom-auth (EMAIL OTP / TOTP), nunca por MFA
+ * nativo del pool. El connector fuerza `MfaConfiguration: 'OFF'` como invariante
+ * de código al crear el pool — no es negociable vía contrato.
  */
 class CreatePoolRequest {
 }
@@ -36,12 +40,6 @@ __decorate([
     (0, class_validator_1.IsString)(),
     __metadata("design:type", String)
 ], CreatePoolRequest.prototype, "displayName", void 0);
-__decorate([
-    (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.ValidateNested)(),
-    (0, class_transformer_1.Type)(() => MfaPoolConfig_1.MfaPoolConfig),
-    __metadata("design:type", MfaPoolConfig_1.MfaPoolConfig)
-], CreatePoolRequest.prototype, "mfaConfig", void 0);
 __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.ValidateNested)(),

package/bin/cognitoBackofficeConnector/index.d.ts

@@ -10,7 +10,6 @@
 export * from './enums/CognitoChallengeType';
 export * from './enums/CognitoUserStatus';
 export * from './validators/NoTenantIdInCustomAttrs';
-export * from './validators/MfaTypesRequiresOne';
 export * from './dtos/CreateUserRequest';
 export * from './dtos/CreateUserResponse';
 export * from './dtos/UpdateUserAttributesRequest';
@@ -43,7 +42,6 @@ export * from './dtos/UpdateEmailRequest';
 export * from './dtos/VerifyEmailRequest';
 export * from './dtos/UpdateProfileRequest';
 export * from './dtos/HealthcheckResponse';
-export * from './dtos/MfaPoolConfig';
 export * from './dtos/PasswordPolicyConfig';
 export * from './dtos/CustomAttributeSpec';
 export * from './dtos/AppClientConfig';

package/bin/cognitoBackofficeConnector/index.js

@@ -26,7 +26,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./enums/CognitoChallengeType"), exports);
 __exportStar(require("./enums/CognitoUserStatus"), exports);
 __exportStar(require("./validators/NoTenantIdInCustomAttrs"), exports);
-__exportStar(require("./validators/MfaTypesRequiresOne"), exports);
 __exportStar(require("./dtos/CreateUserRequest"), exports);
 __exportStar(require("./dtos/CreateUserResponse"), exports);
 __exportStar(require("./dtos/UpdateUserAttributesRequest"), exports);
@@ -59,7 +58,6 @@ __exportStar(require("./dtos/UpdateEmailRequest"), exports);
 __exportStar(require("./dtos/VerifyEmailRequest"), exports);
 __exportStar(require("./dtos/UpdateProfileRequest"), exports);
 __exportStar(require("./dtos/HealthcheckResponse"), exports);
-__exportStar(require("./dtos/MfaPoolConfig"), exports);
 __exportStar(require("./dtos/PasswordPolicyConfig"), exports);
 __exportStar(require("./dtos/CustomAttributeSpec"), exports);
 __exportStar(require("./dtos/AppClientConfig"), exports);

package/bin/platformRbac/dtos/CreateTenantRequest.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
+ * Consumido por el controller `backofficeCreateTenant` del platform-rbac-business y, a futuro,
+ * por el frontend de staff. La `idempotencyKey` viaja en header HTTP (no en el body).
+ * El `temporaryPassword` NO viaja en el request: vive solo en el response como fallback
+ * out-of-band mientras el correo de invitación no entrega.
+ */
+export declare class CreateTenantRequest {
+    tenantId: string;
+    displayName: string;
+    emailDomain: string;
+    tablePrefix: string;
+    adminEmail: string;
+    adminName: string;
+    region: string;
+    mfaRequired?: boolean;
+    passwordMinLength?: number;
+}

package/bin/platformRbac/dtos/CreateTenantRequest.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateTenantRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Input del POST backoffice de creación de tenant (F-11 — onboarding de tenant en SureKeep).
+ * Consumido por el controller `backofficeCreateTenant` del platform-rbac-business y, a futuro,
+ * por el frontend de staff. La `idempotencyKey` viaja en header HTTP (no en el body).
+ * El `temporaryPassword` NO viaja en el request: vive solo en el response como fallback
+ * out-of-band mientras el correo de invitación no entrega.
+ */
+class CreateTenantRequest {
+}
+exports.CreateTenantRequest = CreateTenantRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Matches)(/^[a-z0-9-]+$/),
+    __metadata("design:type", String)
+], CreateTenantRequest.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateTenantRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateTenantRequest.prototype, "emailDomain", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateTenantRequest.prototype, "tablePrefix", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], CreateTenantRequest.prototype, "adminEmail", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateTenantRequest.prototype, "adminName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateTenantRequest.prototype, "region", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], CreateTenantRequest.prototype, "mfaRequired", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(8),
+    __metadata("design:type", Number)
+], CreateTenantRequest.prototype, "passwordMinLength", void 0);

package/bin/platformRbac/dtos/CreateTenantResponse.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Output del POST backoffice de creación de tenant (F-11). Response plain sin validators
+ * (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ */
+export interface CreateTenantResponse {
+    tenantId: string;
+    userPoolId: string;
+    appClientId: string;
+    adminCognitoSub: string;
+    /** Fallback out-of-band mientras el correo de invitación no entrega (F-11). */
+    temporaryPassword: string;
+}

package/bin/platformRbac/dtos/CreateTenantResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });