@fiado/type-kit 3.662.0 → 3.664.0

package/_test_/unit/cognitoBackofficeConnector/dtos/CreatePoolRequest.allowAdminCreateUserOnly.test.ts

@@ -0,0 +1,37 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { CreatePoolRequest } from '../../../../src/cognitoBackofficeConnector/dtos/CreatePoolRequest';
+
+const BODY = {
+    region: 'us-east-1',
+    displayName: 'Clientes',
+    passwordPolicy: {},
+    customAttributes: [],
+    appClientConfig: {},
+};
+
+const toRequest = (body: object): CreatePoolRequest =>
+    plainToInstance(CreatePoolRequest, body, { excludeExtraneousValues: true });
+
+const hasFieldError = async (body: object): Promise<boolean> => {
+    const errors = await validate(toRequest(body), { skipMissingProperties: false });
+    return errors.some((error) => error.property === 'allowAdminCreateUserOnly');
+};
+
+describe('CreatePoolRequest.allowAdminCreateUserOnly', () => {
+    it('es opcional', async () => {
+        expect(await hasFieldError(BODY)).toBe(false);
+    });
+
+    it.each([true, false])('acepta %s y lo conserva', async (allowAdminCreateUserOnly) => {
+        const body = { ...BODY, allowAdminCreateUserOnly };
+
+        expect(await hasFieldError(body)).toBe(false);
+        expect(toRequest(body).allowAdminCreateUserOnly).toBe(allowAdminCreateUserOnly);
+    });
+
+    it('rechaza un valor no booleano', async () => {
+        expect(await hasFieldError({ ...BODY, allowAdminCreateUserOnly: 'true' })).toBe(true);
+    });
+});

package/_test_/unit/cognitoBackofficeConnector/dtos/OtpLoginConnectorDtos.test.ts

@@ -0,0 +1,90 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { CognitoBackofficeConnector } from '../../../../src/index';
+import { AppClientConfig } from '../../../../src/cognitoBackofficeConnector/dtos/AppClientConfig';
+import { RefreshTokensRequest } from '../../../../src/cognitoBackofficeConnector/dtos/RefreshTokensRequest';
+import { RespondToChallengeRequest } from '../../../../src/cognitoBackofficeConnector/dtos/RespondToChallengeRequest';
+import { StartOtpLoginRequest } from '../../../../src/cognitoBackofficeConnector/dtos/StartOtpLoginRequest';
+import { CognitoChallengeType } from '../../../../src/cognitoBackofficeConnector/enums/CognitoChallengeType';
+
+const START = { userPoolId: 'us-east-1_abc', region: 'us-east-1', clientId: 'client-1', username: 'sub-1' };
+const RESPOND = {
+    userPoolId: 'us-east-1_abc',
+    region: 'us-east-1',
+    clientId: 'client-1',
+    challengeName: CognitoChallengeType.CUSTOM_CHALLENGE,
+    session: 'sess-1',
+    challengeResponses: { USERNAME: 'sub-1', ANSWER: '1234' },
+};
+const REFRESH = { userPoolId: 'us-east-1_abc', region: 'us-east-1', clientId: 'client-1', refreshToken: 'ref-1' };
+const CLIENT = { explicitAuthFlows: ['ALLOW_CUSTOM_AUTH'] };
+
+const propertiesWithError = async (dtoClass: new () => object, body: object): Promise<string[]> => {
+    const errors = await validate(plainToInstance(dtoClass, body) as object);
+    return errors.map((error) => error.property);
+};
+
+describe('StartOtpLoginRequest', () => {
+    it('valida sin useClientSecret', async () => {
+        expect(await propertiesWithError(StartOtpLoginRequest, START)).toEqual([]);
+    });
+
+    it('acepta useClientSecret booleano', async () => {
+        expect(await propertiesWithError(StartOtpLoginRequest, { ...START, useClientSecret: true })).toEqual([]);
+    });
+
+    it('rechaza useClientSecret que no sea booleano', async () => {
+        expect(await propertiesWithError(StartOtpLoginRequest, { ...START, useClientSecret: 'si' })).toEqual(['useClientSecret']);
+    });
+
+    it.each(['userPoolId', 'region', 'clientId', 'username'])('exige %s', async (field) => {
+        expect(await propertiesWithError(StartOtpLoginRequest, { ...START, [field]: '' })).toEqual([field]);
+    });
+
+    it('sale por el index raíz', () => {
+        expect(CognitoBackofficeConnector.StartOtpLoginRequest).toBe(StartOtpLoginRequest);
+    });
+});
+
+describe('RespondToChallengeRequest.useClientSecret', () => {
+    it('es opcional', async () => {
+        expect(await propertiesWithError(RespondToChallengeRequest, RESPOND)).toEqual([]);
+    });
+
+    it('rechaza un valor no booleano', async () => {
+        expect(await propertiesWithError(RespondToChallengeRequest, { ...RESPOND, useClientSecret: 1 })).toEqual(['useClientSecret']);
+    });
+});
+
+describe('RefreshTokensRequest', () => {
+    it('username y useClientSecret son opcionales', async () => {
+        expect(await propertiesWithError(RefreshTokensRequest, REFRESH)).toEqual([]);
+    });
+
+    it('acepta username y useClientSecret', async () => {
+        expect(await propertiesWithError(RefreshTokensRequest, { ...REFRESH, username: 'sub-1', useClientSecret: true })).toEqual([]);
+    });
+
+    it('rechaza username vacío', async () => {
+        expect(await propertiesWithError(RefreshTokensRequest, { ...REFRESH, username: '' })).toEqual(['username']);
+    });
+
+    it('rechaza useClientSecret no booleano', async () => {
+        expect(await propertiesWithError(RefreshTokensRequest, { ...REFRESH, useClientSecret: 'no' })).toEqual(['useClientSecret']);
+    });
+});
+
+describe('AppClientConfig.generateSecret', () => {
+    it('es opcional', async () => {
+        expect(await propertiesWithError(AppClientConfig, CLIENT)).toEqual([]);
+    });
+
+    it('acepta true', async () => {
+        expect(await propertiesWithError(AppClientConfig, { ...CLIENT, generateSecret: true })).toEqual([]);
+    });
+
+    it('rechaza un valor no booleano', async () => {
+        expect(await propertiesWithError(AppClientConfig, { ...CLIENT, generateSecret: 'true' })).toEqual(['generateSecret']);
+    });
+});

package/_test_/unit/messagesConnector/otpLoginContract.test.ts

@@ -0,0 +1,47 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { MessagesConnector } from '../../../src/index';
+import { OtpLoginStateRequest } from '../../../src/messagesConnector/dtos/OtpLoginStateRequest';
+import { OtpLoginStateResponse } from '../../../src/messagesConnector/dtos/OtpLoginStateResponse';
+
+const BODY = { directoryId: 'sub-1', typeOfDirectoryId: 'BACKOFFICE_USER' };
+
+const propertiesWithError = async (body: object): Promise<string[]> => {
+    const errors = await validate(plainToInstance(OtpLoginStateRequest, body));
+    return errors.map((error) => error.property);
+};
+
+describe('OtpLoginStateRequest', () => {
+    it('valida el body completo', async () => {
+        expect(await propertiesWithError(BODY)).toEqual([]);
+    });
+
+    it.each(['directoryId', 'typeOfDirectoryId'])('exige %s', async (field) => {
+        expect(await propertiesWithError({ ...BODY, [field]: '' })).toEqual([field]);
+    });
+
+    it.each(['directoryId', 'typeOfDirectoryId'])('rechaza %s que no sea texto', async (field) => {
+        expect(await propertiesWithError({ ...BODY, [field]: 42 })).toEqual([field]);
+    });
+
+    it('sale por el index raíz', () => {
+        expect(MessagesConnector.OtpLoginStateRequest).toBe(OtpLoginStateRequest);
+    });
+});
+
+describe('OtpLoginStateResponse', () => {
+    it('sale por el index raíz', () => {
+        expect(MessagesConnector.OtpLoginStateResponse).toBe(OtpLoginStateResponse);
+    });
+
+    it('admite estado sin fallo y sin tope', () => {
+        const state: OtpLoginStateResponse = { lastFailureCode: null, lockedUntil: null };
+        expect(state.lastFailureCode).toBeNull();
+    });
+
+    it.each(['OTP_NOT_FOUND', 'OTP_EXPIRED', 'OTP_ALREADY_USED'] as const)('admite %s', (lastFailureCode) => {
+        const state: OtpLoginStateResponse = { lastFailureCode, lockedUntil: 1_800_000_000_000 };
+        expect(state.lastFailureCode).toBe(lastFailureCode);
+    });
+});

package/_test_/unit/platformRbac/customerAccountDtos.test.ts

@@ -0,0 +1,84 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { PlatformRbac } from '../../../src/index';
+import { EnsureCustomerAccountRequest } from '../../../src/platformRbac/dtos/EnsureCustomerAccountRequest';
+import type { EnsureCustomerAccountResponse } from '../../../src/platformRbac/dtos/EnsureCustomerAccountResponse';
+import { OtpLoginRequest } from '../../../src/platformRbac/dtos/OtpLoginRequest';
+import type { UserProfileResponse } from '../../../src/platformRbac/dtos/UserProfileResponse';
+
+const BODY = {
+    phone: '+525512345678',
+    retailCustomerId: 'customer-1',
+    directoryId: 'directory-1',
+    displayName: 'Ana Pérez',
+    createdBy: 'wizard',
+};
+
+const propertiesWithError = async (body: object): Promise<string[]> => {
+    const errors = await validate(plainToInstance(EnsureCustomerAccountRequest, body));
+    return errors.map((error) => error.property);
+};
+
+describe('EnsureCustomerAccountRequest', () => {
+    it('valida el body completo', async () => {
+        expect(await propertiesWithError(BODY)).toEqual([]);
+    });
+
+    it.each(['retailCustomerId', 'directoryId', 'displayName', 'createdBy'])('exige %s', async (field) => {
+        expect(await propertiesWithError({ ...BODY, [field]: '' })).toEqual([field]);
+    });
+
+    it.each(['5512345678', '+15512345678', '+52551234567', '+5255123456789', ''])('rechaza el celular %s', async (phone) => {
+        expect(await propertiesWithError({ ...BODY, phone })).toEqual(['phone']);
+    });
+
+    it('sale por el index raíz', () => {
+        expect(PlatformRbac.EnsureCustomerAccountRequest).toBe(EnsureCustomerAccountRequest);
+    });
+});
+
+describe('OtpLoginRequest', () => {
+    const LOGIN = { phone: '+525512345678', tenantId: 'surekeep-customers' };
+
+    const loginErrors = async (body: object): Promise<string[]> => {
+        const errors = await validate(plainToInstance(OtpLoginRequest, body));
+        return errors.map((error) => error.property);
+    };
+
+    it('valida el body completo', async () => {
+        expect(await loginErrors(LOGIN)).toEqual([]);
+    });
+
+    it('deja la normalización del celular al endpoint', async () => {
+        expect(await loginErrors({ ...LOGIN, phone: '5512345678' })).toEqual([]);
+    });
+
+    it.each(['phone', 'tenantId'])('exige %s', async (field) => {
+        expect(await loginErrors({ ...LOGIN, [field]: '' })).toEqual([field]);
+    });
+
+    it.each(['phone', 'tenantId'])('rechaza %s que no sea texto', async (field) => {
+        expect(await loginErrors({ ...LOGIN, [field]: 42 })).toEqual([field]);
+    });
+
+    it('sale por el index raíz', () => {
+        expect(PlatformRbac.OtpLoginRequest).toBe(OtpLoginRequest);
+    });
+});
+
+describe('EnsureCustomerAccountResponse', () => {
+    it.each(['CREATED', 'EXISTING'] as const)('admite outcome %s', (outcome) => {
+        const response: EnsureCustomerAccountResponse = { outcome, cognitoSub: 'sub-1' };
+        expect(response.outcome).toBe(outcome);
+    });
+});
+
+describe('UserProfileResponse', () => {
+    it('admite los datos del cliente con valor y en null', () => {
+        const withData: UserProfileResponse = { cognitoSub: 's', tenantId: 't', retailCustomerId: 'c', directoryId: 'd' };
+        const empty: UserProfileResponse = { cognitoSub: 's', tenantId: 't', retailCustomerId: null, directoryId: null };
+        expect(withData.retailCustomerId).toBe('c');
+        expect(empty.directoryId).toBeNull();
+    });
+});

package/_test_/unit/platformRbac/customerPortalContract.test.ts

@@ -0,0 +1,39 @@
+import type { ApplicationDefaults } from '../../../src/platformRbac/application/Application';
+import { LoginModeEnum } from '../../../src/platformRbac/enums/LoginModeEnum';
+import {
+    Permission,
+    PERMISSION_BIT_ORDER,
+    bitsToPermissions,
+    permissionsToBits,
+} from '../../../src/platformRbac/enums/Permission';
+
+describe('Permission.CUSTOMER_PORTAL_READ', () => {
+    it('tiene la llave customer.portal.read', () => {
+        expect(Permission.CUSTOMER_PORTAL_READ).toBe('customer.portal.read');
+    });
+
+    it('va al final del orden de bits', () => {
+        expect(PERMISSION_BIT_ORDER[PERMISSION_BIT_ORDER.length - 1]).toBe(Permission.CUSTOMER_PORTAL_READ);
+    });
+
+    it('sobrevive la ida y vuelta por el bitset', () => {
+        expect(bitsToPermissions(permissionsToBits([Permission.CUSTOMER_PORTAL_READ]))).toEqual([Permission.CUSTOMER_PORTAL_READ]);
+    });
+});
+
+describe('ApplicationDefaults.loginMode', () => {
+    it('admite OTP_ONLY', () => {
+        const defaults: ApplicationDefaults = { loginMode: LoginModeEnum.OTP_ONLY };
+        expect(defaults.loginMode).toBe('OTP_ONLY');
+    });
+
+    it('admite null', () => {
+        const defaults: ApplicationDefaults = { loginMode: null };
+        expect(defaults.loginMode).toBeNull();
+    });
+
+    it('es opcional', () => {
+        const defaults: ApplicationDefaults = {};
+        expect(defaults.loginMode).toBeUndefined();
+    });
+});

package/_test_/unit/platformRbac/enums/__snapshots__/permissionBits.test.ts.snap

@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
-exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `1071810597`;
+exports[`PERMISSION_BIT_ORDER PERMS_VERSION es número estable 1`] = `2836776829`;
 
 exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe ante cualquier reorden/inserción) 1`] = `
 [
@@ -97,5 +97,6 @@ exports[`PERMISSION_BIT_ORDER append-only: snapshot del ORDEN COMPLETO (rompe an
   "tenant.integration.diagnostic",
   "tenant.api_user.manage",
   "platform.retail_integration.activate",
+  "customer.portal.read",
 ]
 `;

package/_test_/unit/platformRbac/enums/retailIntegrationPermission.test.ts

@@ -5,9 +5,8 @@ describe('Permiso de activación de la integración retail', () => {
         expect(Permission.PLATFORM_RETAIL_INTEGRATION_ACTIVATE).toBe('platform.retail_integration.activate');
     });
 
-    it('va al FINAL del orden de bits, justo después de tenant.api_user.manage', () => {
-        const last = PERMISSION_BIT_ORDER.length - 1;
-        expect(PERMISSION_BIT_ORDER[last]).toBe(Permission.PLATFORM_RETAIL_INTEGRATION_ACTIVATE);
-        expect(PERMISSION_BIT_ORDER[last - 1]).toBe(Permission.TENANT_API_USER_MANAGE);
+    it('conserva su bit, justo después de tenant.api_user.manage', () => {
+        const index = PERMISSION_BIT_ORDER.indexOf(Permission.PLATFORM_RETAIL_INTEGRATION_ACTIVATE);
+        expect(PERMISSION_BIT_ORDER[index - 1]).toBe(Permission.TENANT_API_USER_MANAGE);
     });
 });

package/_test_/unit/platformRbac/loginModeChallengeDtos.test.ts

@@ -0,0 +1,58 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { PlatformRbac } from '../../../src/index';
+import { DefineNextChallengeResponse } from '../../../src/platformRbac/auth/DefineNextChallengeResponse';
+import { PrepareChallengeRequest } from '../../../src/platformRbac/auth/PrepareChallengeRequest';
+import { ChallengeNameEnum } from '../../../src/platformRbac/enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../../../src/platformRbac/enums/LoginModeEnum';
+
+const PREPARE = { cognitoSub: 'sub-1', challengeName: ChallengeNameEnum.SMS_OTP, phone: '+525512345678' };
+const DECISION = { nextChallenge: ChallengeNameEnum.SMS_OTP, issueTokens: false, failAuthentication: false };
+
+const propertiesWithError = async (dtoClass: new () => object, body: object): Promise<string[]> => {
+    const errors = await validate(plainToInstance(dtoClass, body) as object);
+    return errors.map((error) => error.property);
+};
+
+describe('LoginModeEnum', () => {
+    it('solo tiene OTP_ONLY', () => {
+        expect(Object.values(LoginModeEnum)).toEqual(['OTP_ONLY']);
+    });
+
+    it('sale por el index raíz', () => {
+        expect(PlatformRbac.LoginModeEnum.OTP_ONLY).toBe('OTP_ONLY');
+    });
+});
+
+describe('DefineNextChallengeResponse.loginMode', () => {
+    it('es opcional', async () => {
+        expect(await propertiesWithError(DefineNextChallengeResponse, DECISION)).toEqual([]);
+    });
+
+    it('acepta OTP_ONLY', async () => {
+        expect(await propertiesWithError(DefineNextChallengeResponse, { ...DECISION, loginMode: 'OTP_ONLY' })).toEqual([]);
+    });
+
+    it('rechaza un valor fuera del enum', async () => {
+        expect(await propertiesWithError(DefineNextChallengeResponse, { ...DECISION, loginMode: 'PASSWORD' })).toEqual(['loginMode']);
+    });
+});
+
+describe('PrepareChallengeRequest', () => {
+    it('loginMode e isRetry son opcionales', async () => {
+        expect(await propertiesWithError(PrepareChallengeRequest, PREPARE)).toEqual([]);
+    });
+
+    it('acepta loginMode e isRetry válidos', async () => {
+        expect(await propertiesWithError(PrepareChallengeRequest, { ...PREPARE, loginMode: 'OTP_ONLY', isRetry: true })).toEqual([]);
+    });
+
+    it('rechaza loginMode fuera del enum', async () => {
+        expect(await propertiesWithError(PrepareChallengeRequest, { ...PREPARE, loginMode: 'OTRO' })).toEqual(['loginMode']);
+    });
+
+    it('rechaza isRetry que no sea booleano', async () => {
+        expect(await propertiesWithError(PrepareChallengeRequest, { ...PREPARE, isRetry: 'true' })).toEqual(['isRetry']);
+    });
+});

package/bin/cognitoBackofficeConnector/dtos/AppClientConfig.d.ts

@@ -2,10 +2,7 @@
 export declare const COGNITO_EXPLICIT_AUTH_FLOWS: readonly string[];
 /** Unidades de vigencia de token; el conector aplica una sola a los tres tokens. */
 export declare const COGNITO_TOKEN_VALIDITY_UNITS: readonly string[];
-/**
- * Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients).
- * Sin `generateSecret`: el conector fija GenerateSecret false (A21).
- */
+/** Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients). */
 export declare class AppClientConfig {
     clientName?: string;
     explicitAuthFlows: string[];
@@ -17,4 +14,6 @@ export declare class AppClientConfig {
     enableTokenRevocation?: boolean;
     /** Atributos que el usuario puede escribir con su propio token. Ausente ⇒ todos (default de Cognito). */
     writeAttributes?: string[];
+    /** Crea el client con secreto. Ausente ⇒ sin secreto. */
+    generateSecret?: boolean;
 }

package/bin/cognitoBackofficeConnector/dtos/AppClientConfig.js

@@ -23,10 +23,7 @@ exports.COGNITO_EXPLICIT_AUTH_FLOWS = [
 ];
 /** Unidades de vigencia de token; el conector aplica una sola a los tres tokens. */
 exports.COGNITO_TOKEN_VALIDITY_UNITS = ['seconds', 'minutes', 'hours', 'days'];
-/**
- * Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients).
- * Sin `generateSecret`: el conector fija GenerateSecret false (A21).
- */
+/** Config de un app client (el del pool nuevo de POST /pools o uno extra de POST /pools/{id}/clients). */
 class AppClientConfig {
 }
 exports.AppClientConfig = AppClientConfig;
@@ -85,3 +82,9 @@ __decorate([
     (0, class_validator_1.IsString)({ each: true }),
     __metadata("design:type", Array)
 ], AppClientConfig.prototype, "writeAttributes", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], AppClientConfig.prototype, "generateSecret", void 0);

package/bin/cognitoBackofficeConnector/dtos/CreatePoolClientResponse.d.ts

@@ -1,4 +1,4 @@
-/** Respuesta de POST /pools/{userPoolId}/clients. Sin secret: el client nace con GenerateSecret false. */
+/** Respuesta de POST /pools/{userPoolId}/clients. Nunca expone el secreto del client. */
 export declare class CreatePoolClientResponse {
     appClientId: string;
 }

package/bin/cognitoBackofficeConnector/dtos/CreatePoolClientResponse.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CreatePoolClientResponse = void 0;
-/** Respuesta de POST /pools/{userPoolId}/clients. Sin secret: el client nace con GenerateSecret false. */
+/** Respuesta de POST /pools/{userPoolId}/clients. Nunca expone el secreto del client. */
 class CreatePoolClientResponse {
 }
 exports.CreatePoolClientResponse = CreatePoolClientResponse;

package/bin/cognitoBackofficeConnector/dtos/CreatePoolRequest.d.ts

@@ -24,4 +24,6 @@ export declare class CreatePoolRequest {
      * default-ea a ['email'] (backward-compatible con los pools ya creados).
      */
     usernameAttributes?: Array<'email' | 'phone_number'>;
+    /** Solo un administrador puede crear usuarios en el pool. Ausente ⇒ default de Cognito. */
+    allowAdminCreateUserOnly?: boolean;
 }

package/bin/cognitoBackofficeConnector/dtos/CreatePoolRequest.js

@@ -66,3 +66,9 @@ __decorate([
     (0, class_validator_1.IsIn)(['email', 'phone_number'], { each: true }),
     __metadata("design:type", Array)
 ], CreatePoolRequest.prototype, "usernameAttributes", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], CreatePoolRequest.prototype, "allowAdminCreateUserOnly", void 0);

package/bin/cognitoBackofficeConnector/dtos/CreatePoolResponse.d.ts

@@ -1,10 +1,4 @@
-/**
- * Response del endpoint POST /pools (pivote v1.4.1 stateless).
- *
- * NO expone `clientSecret` — el SDK Cognito no lo devuelve cuando
- * `GenerateSecret: false` (BFF pattern A21). Si aparece consumer B2B/M2M
- * que requiera client secret, evaluar con líder + bump major del connector.
- */
+/** Respuesta de POST /pools. Nunca expone el secreto del app client. */
 export declare class CreatePoolResponse {
     userPoolId: string;
     userPoolArn: string;

package/bin/cognitoBackofficeConnector/dtos/CreatePoolResponse.js

@@ -1,13 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CreatePoolResponse = void 0;
-/**
- * Response del endpoint POST /pools (pivote v1.4.1 stateless).
- *
- * NO expone `clientSecret` — el SDK Cognito no lo devuelve cuando
- * `GenerateSecret: false` (BFF pattern A21). Si aparece consumer B2B/M2M
- * que requiera client secret, evaluar con líder + bump major del connector.
- */
+/** Respuesta de POST /pools. Nunca expone el secreto del app client. */
 class CreatePoolResponse {
 }
 exports.CreatePoolResponse = CreatePoolResponse;

package/bin/cognitoBackofficeConnector/dtos/RefreshTokensRequest.d.ts

@@ -3,4 +3,6 @@ export declare class RefreshTokensRequest {
     region: string;
     clientId: string;
     refreshToken: string;
+    username?: string;
+    useClientSecret?: boolean;
 }

package/bin/cognitoBackofficeConnector/dtos/RefreshTokensRequest.js

@@ -39,3 +39,16 @@ __decorate([
     (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], RefreshTokensRequest.prototype, "refreshToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], RefreshTokensRequest.prototype, "username", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], RefreshTokensRequest.prototype, "useClientSecret", void 0);

package/bin/cognitoBackofficeConnector/dtos/RespondToChallengeRequest.d.ts

@@ -6,4 +6,5 @@ export declare class RespondToChallengeRequest {
     challengeName: CognitoChallengeType;
     session: string;
     challengeResponses: Record<string, string>;
+    useClientSecret?: boolean;
 }

package/bin/cognitoBackofficeConnector/dtos/RespondToChallengeRequest.js

@@ -50,3 +50,9 @@ __decorate([
     (0, class_validator_1.IsObject)(),
     __metadata("design:type", Object)
 ], RespondToChallengeRequest.prototype, "challengeResponses", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], RespondToChallengeRequest.prototype, "useClientSecret", void 0);

package/bin/cognitoBackofficeConnector/dtos/StartOtpLoginRequest.d.ts

@@ -0,0 +1,8 @@
+/** Body de POST /auth/start-otp-login: inicia CUSTOM_AUTH sin SRP ni contraseña. */
+export declare class StartOtpLoginRequest {
+    userPoolId: string;
+    region: string;
+    clientId: string;
+    username: string;
+    useClientSecret?: boolean;
+}

package/bin/cognitoBackofficeConnector/dtos/StartOtpLoginRequest.js

@@ -0,0 +1,48 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StartOtpLoginRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Body de POST /auth/start-otp-login: inicia CUSTOM_AUTH sin SRP ni contraseña. */
+class StartOtpLoginRequest {
+}
+exports.StartOtpLoginRequest = StartOtpLoginRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], StartOtpLoginRequest.prototype, "userPoolId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], StartOtpLoginRequest.prototype, "region", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], StartOtpLoginRequest.prototype, "clientId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], StartOtpLoginRequest.prototype, "username", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], StartOtpLoginRequest.prototype, "useClientSecret", void 0);

package/bin/cognitoBackofficeConnector/index.d.ts

@@ -23,6 +23,7 @@ export * from './dtos/AuthEventResponse';
 export * from './dtos/AuthTokensResponse';
 export * from './dtos/AuthStartLoginRequest';
 export * from './dtos/AuthStartLoginResponse';
+export * from './dtos/StartOtpLoginRequest';
 export * from './dtos/InitiateAuthRequest';
 export * from './dtos/InitiateAuthResponse';
 export * from './dtos/VerifyPasswordRequest';

package/bin/cognitoBackofficeConnector/index.js

@@ -39,6 +39,7 @@ __exportStar(require("./dtos/AuthEventResponse"), exports);
 __exportStar(require("./dtos/AuthTokensResponse"), exports);
 __exportStar(require("./dtos/AuthStartLoginRequest"), exports);
 __exportStar(require("./dtos/AuthStartLoginResponse"), exports);
+__exportStar(require("./dtos/StartOtpLoginRequest"), exports);
 __exportStar(require("./dtos/InitiateAuthRequest"), exports);
 __exportStar(require("./dtos/InitiateAuthResponse"), exports);
 __exportStar(require("./dtos/VerifyPasswordRequest"), exports);

package/bin/messagesConnector/dtos/OtpLoginStateRequest.d.ts

@@ -0,0 +1,5 @@
+/** Body de POST /messages/otp/login-state. */
+export declare class OtpLoginStateRequest {
+    directoryId: string;
+    typeOfDirectoryId: string;
+}