emilsoftware-utilities 2.0.0-dev.66 → 2.0.0-dev.67

package/dist/EmilsoftwareModule.d.ts

@@ -1,7 +1,8 @@
 import { DynamicModule } from "@nestjs/common";
+import type { LoggerService } from "@nestjs/common";
 import { AccessiOptions } from "./accessi-module/AccessiModule";
 import { AllegatiOptions } from "./allegati-module/AllegatiModule";
-import type { SwaggerSetupOptions } from "./swagger/SwaggerConfig";
+import type { OpenApiSetupOptions } from "./openapi/OpenApiConfig";
 /**
  * Configuration options for the unified module that combines Accessi and Allegati functionality
  */
@@ -11,12 +12,19 @@ export interface EmilsoftwareOptions {
     /**
      * Documentazione OpenAPI del modulo unificato. Default: `accessi/openapi`
      * (UI) e `accessi/openapi.json` (spec).
+     *
+     * Precedenza: questo campo vince su `accessiOptions.openapi`, che a sua
+     * volta vince sui default storici.
      */
-    swagger?: SwaggerSetupOptions;
+    openapi?: OpenApiSetupOptions;
+    /** Logger Nest usato dal sotto-app unificato. Se assente Nest usa il proprio logger. */
+    logger?: LoggerService;
+    /** Buffer dei log di bootstrap del sotto-app. Default `true` (comportamento storico). */
+    bufferLogs?: boolean;
 }
 /**
  * Unified module that combines user access management (Accessi) and file attachment management (Allegati)
- * into a single NestJS module with shared Swagger documentation
+ * into a single NestJS module with shared OpenAPI documentation
  */
 export declare class EmilsoftwareModule {
     static forRoot(options: EmilsoftwareOptions): DynamicModule;

package/dist/EmilsoftwareModule.js

@@ -14,7 +14,7 @@ const AllegatiModule_1 = require("./allegati-module/AllegatiModule");
 const Logger_1 = require("./Logger");
 /**
  * Unified module that combines user access management (Accessi) and file attachment management (Allegati)
- * into a single NestJS module with shared Swagger documentation
+ * into a single NestJS module with shared OpenAPI documentation
  */
 let EmilsoftwareModule = EmilsoftwareModule_1 = class EmilsoftwareModule {
     static forRoot(options) {

package/dist/EmilsoftwareModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmilsoftwareModule.js","sourceRoot":"","sources":["../src/EmilsoftwareModule.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuD;AACvD,kEAA+E;AAC/E,qEAAmF;AACnF,qCAAkC;AAgBlC;;;GAGG;AAEI,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAA4B;QAEvC,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,EAAE,CAAC;QAEjB,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC5F,CAAC;QAGD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,6BAAa,CAAC,CAAC;QAChC,CAAC;aACI,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,+BAAc,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,+BAAc,CAAC,CAAC;QACjC,CAAC;aACI,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAC;QACjG,CAAC;QAED,OAAO;YACH,MAAM,EAAE,oBAAkB;YAC1B,OAAO;YACP,OAAO;SACV,CAAC;IACN,CAAC;CACJ,CAAA;AApCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,kBAAkB,CAoC9B","sourcesContent":["import { DynamicModule, Module } from \"@nestjs/common\";\nimport { AccessiModule, AccessiOptions } from \"./accessi-module/AccessiModule\";\nimport { AllegatiModule, AllegatiOptions } from \"./allegati-module/AllegatiModule\";\nimport { Logger } from \"./Logger\";\nimport type { SwaggerSetupOptions } from \"./swagger/SwaggerConfig\";\n\n/**\n * Configuration options for the unified module that combines Accessi and Allegati functionality\n */\nexport interface EmilsoftwareOptions {\n    accessiOptions: AccessiOptions;\n    allegatiOptions: AllegatiOptions;\n    /**\n     * Documentazione OpenAPI del modulo unificato. Default: `accessi/openapi`\n     * (UI) e `accessi/openapi.json` (spec).\n     */\n    swagger?: SwaggerSetupOptions;\n}\n\n/**\n * Unified module that combines user access management (Accessi) and file attachment management (Allegati)\n * into a single NestJS module with shared Swagger documentation\n */\n@Module({})\nexport class EmilsoftwareModule {\n    static forRoot(options: EmilsoftwareOptions): DynamicModule {\n\n        const logger: Logger = new Logger(EmilsoftwareModule.name);\n        let imports = [];\n        let exports = [];\n\n        if (!options) {\n            throw new Error(\"EmilsoftwareModule requires valid accessiOptions and allegatiOptions\");\n        }\n\n\n        if (options.accessiOptions) {\n            logger.info(\"Initializing AccessiModule with provided options.\");\n            imports.push(AccessiModule.forRoot(options.accessiOptions));\n            exports.push(AccessiModule);\n        }\n        else {\n            logger.warning(\"Accessi options are not provided. AccessiModule will not be initialized.\");\n        }\n\n        if (options.allegatiOptions) {\n            logger.info(\"Initializing AllegatiModule with provided options.\");\n            imports.push(AllegatiModule.forRoot(options.allegatiOptions));\n            exports.push(AllegatiModule);\n        }\n        else {\n            logger.warning(\"Allegati options are not provided. AllegatiModule will not be initialized.\");\n        }\n\n        return {\n            module: EmilsoftwareModule,\n            imports,\n            exports\n        };\n    }\n} "]}
+{"version":3,"file":"EmilsoftwareModule.js","sourceRoot":"","sources":["../src/EmilsoftwareModule.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuD;AAEvD,kEAA+E;AAC/E,qEAAmF;AACnF,qCAAkC;AAuBlC;;;GAGG;AAEI,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAA4B;QAEvC,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,EAAE,CAAC;QAEjB,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC5F,CAAC;QAGD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,6BAAa,CAAC,CAAC;QAChC,CAAC;aACI,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,+BAAc,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,+BAAc,CAAC,CAAC;QACjC,CAAC;aACI,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAC;QACjG,CAAC;QAED,OAAO;YACH,MAAM,EAAE,oBAAkB;YAC1B,OAAO;YACP,OAAO;SACV,CAAC;IACN,CAAC;CACJ,CAAA;AApCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,kBAAkB,CAoC9B","sourcesContent":["import { DynamicModule, Module } from \"@nestjs/common\";\nimport type { LoggerService } from \"@nestjs/common\";\nimport { AccessiModule, AccessiOptions } from \"./accessi-module/AccessiModule\";\nimport { AllegatiModule, AllegatiOptions } from \"./allegati-module/AllegatiModule\";\nimport { Logger } from \"./Logger\";\nimport type { OpenApiSetupOptions } from \"./openapi/OpenApiConfig\";\n\n/**\n * Configuration options for the unified module that combines Accessi and Allegati functionality\n */\nexport interface EmilsoftwareOptions {\n    accessiOptions: AccessiOptions;\n    allegatiOptions: AllegatiOptions;\n    /**\n     * Documentazione OpenAPI del modulo unificato. Default: `accessi/openapi`\n     * (UI) e `accessi/openapi.json` (spec).\n     *\n     * Precedenza: questo campo vince su `accessiOptions.openapi`, che a sua\n     * volta vince sui default storici.\n     */\n    openapi?: OpenApiSetupOptions;\n    /** Logger Nest usato dal sotto-app unificato. Se assente Nest usa il proprio logger. */\n    logger?: LoggerService;\n    /** Buffer dei log di bootstrap del sotto-app. Default `true` (comportamento storico). */\n    bufferLogs?: boolean;\n}\n\n/**\n * Unified module that combines user access management (Accessi) and file attachment management (Allegati)\n * into a single NestJS module with shared OpenAPI documentation\n */\n@Module({})\nexport class EmilsoftwareModule {\n    static forRoot(options: EmilsoftwareOptions): DynamicModule {\n\n        const logger: Logger = new Logger(EmilsoftwareModule.name);\n        let imports = [];\n        let exports = [];\n\n        if (!options) {\n            throw new Error(\"EmilsoftwareModule requires valid accessiOptions and allegatiOptions\");\n        }\n\n\n        if (options.accessiOptions) {\n            logger.info(\"Initializing AccessiModule with provided options.\");\n            imports.push(AccessiModule.forRoot(options.accessiOptions));\n            exports.push(AccessiModule);\n        }\n        else {\n            logger.warning(\"Accessi options are not provided. AccessiModule will not be initialized.\");\n        }\n\n        if (options.allegatiOptions) {\n            logger.info(\"Initializing AllegatiModule with provided options.\");\n            imports.push(AllegatiModule.forRoot(options.allegatiOptions));\n            exports.push(AllegatiModule);\n        }\n        else {\n            logger.warning(\"Allegati options are not provided. AllegatiModule will not be initialized.\");\n        }\n\n        return {\n            module: EmilsoftwareModule,\n            imports,\n            exports\n        };\n    }\n} "]}

package/dist/accessi/client/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Client HTTP generato dal contratto OpenAPI di Accessi.
+ *
+ * Il client e pensato per essere usato da backend fratelli, frontend e tool
+ * amministrativi. Configurare base URL e token provider prima della prima call.
+ */
+export * from "../../accessi-module/Console/generated/emilsoftware-utilities";
+export * from "../../accessi-module/Console/generated/model";
+export { AccessiRequestError } from "../../accessi-module/Console/accessiFetch";
+export { ACCESSI_UNAUTHORIZED_EVENT, setAccessiFetchBaseUrl, setAccessiFetchTokenProvider, } from "../../accessi-module/Console/accessiFetch";
+/** Configurazione globale del client. */
+export interface AccessiClientConfig {
+    /** Base URL di Accessi Service, es. `https://accessi.example.com`. */
+    baseUrl?: string | null;
+    /** Token statico. Preferire `getToken` per token che cambiano nel tempo. */
+    token?: string | null;
+    /** Provider asincrono/sincrono del token corrente. */
+    getToken?: () => string | null | Promise<string | null>;
+}
+/**
+ * Configura il trasporto del client generato.
+ *
+ * Uso tipico backend: `configureAccessiClient({ baseUrl, getToken })`.
+ * Uso tipico frontend: `configureAccessiClient({ baseUrl, token })` dopo il login.
+ */
+export declare function configureAccessiClient(config?: AccessiClientConfig): void;

package/dist/accessi/client/index.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setAccessiFetchTokenProvider = exports.setAccessiFetchBaseUrl = exports.ACCESSI_UNAUTHORIZED_EVENT = exports.AccessiRequestError = void 0;
+exports.configureAccessiClient = configureAccessiClient;
+/**
+ * Client HTTP generato dal contratto OpenAPI di Accessi.
+ *
+ * Il client e pensato per essere usato da backend fratelli, frontend e tool
+ * amministrativi. Configurare base URL e token provider prima della prima call.
+ */
+__exportStar(require("../../accessi-module/Console/generated/emilsoftware-utilities"), exports);
+__exportStar(require("../../accessi-module/Console/generated/model"), exports);
+var accessiFetch_1 = require("../../accessi-module/Console/accessiFetch");
+Object.defineProperty(exports, "AccessiRequestError", { enumerable: true, get: function () { return accessiFetch_1.AccessiRequestError; } });
+var accessiFetch_2 = require("../../accessi-module/Console/accessiFetch");
+Object.defineProperty(exports, "ACCESSI_UNAUTHORIZED_EVENT", { enumerable: true, get: function () { return accessiFetch_2.ACCESSI_UNAUTHORIZED_EVENT; } });
+Object.defineProperty(exports, "setAccessiFetchBaseUrl", { enumerable: true, get: function () { return accessiFetch_2.setAccessiFetchBaseUrl; } });
+Object.defineProperty(exports, "setAccessiFetchTokenProvider", { enumerable: true, get: function () { return accessiFetch_2.setAccessiFetchTokenProvider; } });
+const accessiFetch_3 = require("../../accessi-module/Console/accessiFetch");
+/**
+ * Configura il trasporto del client generato.
+ *
+ * Uso tipico backend: `configureAccessiClient({ baseUrl, getToken })`.
+ * Uso tipico frontend: `configureAccessiClient({ baseUrl, token })` dopo il login.
+ */
+function configureAccessiClient(config = {}) {
+    var _a;
+    (0, accessiFetch_3.setAccessiFetchBaseUrl)((_a = config.baseUrl) !== null && _a !== void 0 ? _a : null);
+    if (config.getToken) {
+        (0, accessiFetch_3.setAccessiFetchTokenProvider)(config.getToken);
+        return;
+    }
+    (0, accessiFetch_3.setAccessiFetchTokenProvider)(() => { var _a; return (_a = config.token) !== null && _a !== void 0 ? _a : null; });
+}
+//# sourceMappingURL=index.js.map

package/dist/accessi/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAoCA,wDAOC;AA3CD;;;;;GAKG;AACH,gGAA8E;AAC9E,+EAA6D;AAC7D,0EAAgF;AAAvE,mHAAA,mBAAmB,OAAA;AAC5B,0EAImD;AAHjD,0HAAA,0BAA0B,OAAA;AAC1B,sHAAA,sBAAsB,OAAA;AACtB,4HAAA,4BAA4B,OAAA;AAG9B,4EAGmD;AAYnD;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,SAA8B,EAAE;;IACrE,IAAA,qCAAsB,EAAC,MAAA,MAAM,CAAC,OAAO,mCAAI,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,IAAA,2CAA4B,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAA,2CAA4B,EAAC,GAAG,EAAE,WAAC,OAAA,MAAA,MAAM,CAAC,KAAK,mCAAI,IAAI,CAAA,EAAA,CAAC,CAAC;AAC3D,CAAC","sourcesContent":["/**\n * Client HTTP generato dal contratto OpenAPI di Accessi.\n *\n * Il client e pensato per essere usato da backend fratelli, frontend e tool\n * amministrativi. Configurare base URL e token provider prima della prima call.\n */\nexport * from \"../../accessi-module/Console/generated/emilsoftware-utilities\";\nexport * from \"../../accessi-module/Console/generated/model\";\nexport { AccessiRequestError } from \"../../accessi-module/Console/accessiFetch\";\nexport {\n  ACCESSI_UNAUTHORIZED_EVENT,\n  setAccessiFetchBaseUrl,\n  setAccessiFetchTokenProvider,\n} from \"../../accessi-module/Console/accessiFetch\";\n\nimport {\n  setAccessiFetchBaseUrl,\n  setAccessiFetchTokenProvider,\n} from \"../../accessi-module/Console/accessiFetch\";\n\n/** Configurazione globale del client. */\nexport interface AccessiClientConfig {\n  /** Base URL di Accessi Service, es. `https://accessi.example.com`. */\n  baseUrl?: string | null;\n  /** Token statico. Preferire `getToken` per token che cambiano nel tempo. */\n  token?: string | null;\n  /** Provider asincrono/sincrono del token corrente. */\n  getToken?: () => string | null | Promise<string | null>;\n}\n\n/**\n * Configura il trasporto del client generato.\n *\n * Uso tipico backend: `configureAccessiClient({ baseUrl, getToken })`.\n * Uso tipico frontend: `configureAccessiClient({ baseUrl, token })` dopo il login.\n */\nexport function configureAccessiClient(config: AccessiClientConfig = {}): void {\n  setAccessiFetchBaseUrl(config.baseUrl ?? null);\n  if (config.getToken) {\n    setAccessiFetchTokenProvider(config.getToken);\n    return;\n  }\n  setAccessiFetchTokenProvider(() => config.token ?? null);\n}\n"]}

package/dist/accessi/console/index.d.ts

@@ -0,0 +1,15 @@
+/** Path standard della console amministrativa Accessi. */
+export declare const ACCESSI_CONSOLE_PATH = "/api/accessi/console";
+export interface AccessiConsoleUrlOptions {
+    /** Ticket monouso ottenuto da `POST /api/accessi/console/entry`. */
+    entryTicket?: string;
+    /** Challenge 2FA da completare sulla console. */
+    twoFactorChallengeId?: string;
+}
+/**
+ * Costruisce l'URL della console centrale.
+ *
+ * Il base URL e quello di Accessi Service (es. `https://accessi.example.com`).
+ * Il JWT non passa mai nell'URL: usare `entryTicket` o il flusso 2FA.
+ */
+export declare function buildAccessiConsoleUrl(baseUrl: string, options?: AccessiConsoleUrlOptions): string;

package/dist/accessi/console/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESSI_CONSOLE_PATH = void 0;
+exports.buildAccessiConsoleUrl = buildAccessiConsoleUrl;
+/** Path standard della console amministrativa Accessi. */
+exports.ACCESSI_CONSOLE_PATH = "/api/accessi/console";
+/**
+ * Costruisce l'URL della console centrale.
+ *
+ * Il base URL e quello di Accessi Service (es. `https://accessi.example.com`).
+ * Il JWT non passa mai nell'URL: usare `entryTicket` o il flusso 2FA.
+ */
+function buildAccessiConsoleUrl(baseUrl, options = {}) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const url = new URL(`${base}${exports.ACCESSI_CONSOLE_PATH}`);
+    const fragment = options.entryTicket
+        ? `entry=${encodeURIComponent(options.entryTicket)}`
+        : options.twoFactorChallengeId
+            ? `two-factor=${encodeURIComponent(options.twoFactorChallengeId)}`
+            : "";
+    if (fragment)
+        url.hash = fragment;
+    return url.toString();
+}
+//# sourceMappingURL=index.js.map

package/dist/accessi/console/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/console/index.ts"],"names":[],"mappings":";;;AAgBA,wDAaC;AA7BD,0DAA0D;AAC7C,QAAA,oBAAoB,GAAG,sBAAsB,CAAC;AAS3D;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAAe,EACf,UAAoC,EAAE;IAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,4BAAoB,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW;QAClC,CAAC,CAAC,SAAS,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;QACpD,CAAC,CAAC,OAAO,CAAC,oBAAoB;YAC5B,CAAC,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;IAClC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC","sourcesContent":["/** Path standard della console amministrativa Accessi. */\nexport const ACCESSI_CONSOLE_PATH = \"/api/accessi/console\";\n\nexport interface AccessiConsoleUrlOptions {\n  /** Ticket monouso ottenuto da `POST /api/accessi/console/entry`. */\n  entryTicket?: string;\n  /** Challenge 2FA da completare sulla console. */\n  twoFactorChallengeId?: string;\n}\n\n/**\n * Costruisce l'URL della console centrale.\n *\n * Il base URL e quello di Accessi Service (es. `https://accessi.example.com`).\n * Il JWT non passa mai nell'URL: usare `entryTicket` o il flusso 2FA.\n */\nexport function buildAccessiConsoleUrl(\n  baseUrl: string,\n  options: AccessiConsoleUrlOptions = {},\n): string {\n  const base = baseUrl.replace(/\\/+$/, \"\");\n  const url = new URL(`${base}${ACCESSI_CONSOLE_PATH}`);\n  const fragment = options.entryTicket\n    ? `entry=${encodeURIComponent(options.entryTicket)}`\n    : options.twoFactorChallengeId\n      ? `two-factor=${encodeURIComponent(options.twoFactorChallengeId)}`\n      : \"\";\n  if (fragment) url.hash = fragment;\n  return url.toString();\n}\n"]}

package/dist/accessi/contracts/dtos.d.ts

@@ -0,0 +1,8 @@
+/**
+ * DTO server-side Accessi.
+ *
+ * Questi modelli usano `class-validator`, `class-transformer` e i decoratori
+ * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:
+ * per i frontend usare i tipi generati dal client OpenAPI.
+ */
+export * from "../../accessi-module/Dtos";

package/dist/accessi/contracts/dtos.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * DTO server-side Accessi.
+ *
+ * Questi modelli usano `class-validator`, `class-transformer` e i decoratori
+ * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:
+ * per i frontend usare i tipi generati dal client OpenAPI.
+ */
+__exportStar(require("../../accessi-module/Dtos"), exports);
+//# sourceMappingURL=dtos.js.map

package/dist/accessi/contracts/dtos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dtos.js","sourceRoot":"","sources":["../../../src/accessi/contracts/dtos.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,4DAA0C","sourcesContent":["/**\n * DTO server-side Accessi.\n *\n * Questi modelli usano `class-validator`, `class-transformer` e i decoratori\n * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:\n * per i frontend usare i tipi generati dal client OpenAPI.\n */\nexport * from \"../../accessi-module/Dtos\";\n"]}

package/dist/accessi/contracts/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Contratti Accessi browser-safe.
+ *
+ * Questo entry point non importa NestJS, il database, SMTP o servizi server.
+ * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e
+ * resource server.
+ */
+export { StatoRegistrazione, StatoRegistrazioneValues } from "../../accessi-module/Dtos/StatoRegistrazione";
+export { TipoAbilitazione } from "../../accessi-module/Dtos/TipoAbilitazione";
+export { accessiRequirement, buildRequirementTree, evaluateRequirement, RequirementEvaluationError, } from "../../accessi-module/middleware/accessiRequirements";
+export type { AccessiGrant, GrantsResult, AccessiPermissionRequirement, AccessiAllRequirement, AccessiAnyRequirement, AccessiNotRequirement, AccessiCustomRequirement, AccessiRequirementNode, AccessiAuthorizationOptions, AccessiCustomRequirementContext, AccessiCustomRequirementHandler, } from "../../accessi-module/middleware/accessiRequirements";
+export { extractAccessiBearerToken, resolveCodiceUtenteFromTokenPayload, buildAuthenticatedTokenPayload, isLoginAsTokenPayload, isAccessiTokenAllowedForUser, isAuthenticatedUserEnabledForJwt, } from "../../accessi-module/security/authenticatedToken";
+export type { AccessiAuthenticatedUserSnapshot, } from "../../accessi-module/security/authenticatedToken";
+/** Payload di un access token Accessi verificato. Le claim extra restano disponibili. */
+export interface AccessiAccessTokenPayload extends Record<string, unknown> {
+    /** Obbligatorio: distingue un access token da reset token e token 2FA. */
+    typ: "access";
+    /** Metodi di autenticazione usati (es. `password`, `otp`, `login_as`). */
+    amr?: string[];
+    codiceUtente?: number;
+    utente?: Record<string, unknown>;
+    userData?: {
+        utente?: Record<string, unknown>;
+    };
+}

package/dist/accessi/contracts/index.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAuthenticatedUserEnabledForJwt = exports.isAccessiTokenAllowedForUser = exports.isLoginAsTokenPayload = exports.buildAuthenticatedTokenPayload = exports.resolveCodiceUtenteFromTokenPayload = exports.extractAccessiBearerToken = exports.RequirementEvaluationError = exports.evaluateRequirement = exports.buildRequirementTree = exports.accessiRequirement = exports.TipoAbilitazione = exports.StatoRegistrazioneValues = exports.StatoRegistrazione = void 0;
+/**
+ * Contratti Accessi browser-safe.
+ *
+ * Questo entry point non importa NestJS, il database, SMTP o servizi server.
+ * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e
+ * resource server.
+ */
+var StatoRegistrazione_1 = require("../../accessi-module/Dtos/StatoRegistrazione");
+Object.defineProperty(exports, "StatoRegistrazione", { enumerable: true, get: function () { return StatoRegistrazione_1.StatoRegistrazione; } });
+Object.defineProperty(exports, "StatoRegistrazioneValues", { enumerable: true, get: function () { return StatoRegistrazione_1.StatoRegistrazioneValues; } });
+var TipoAbilitazione_1 = require("../../accessi-module/Dtos/TipoAbilitazione");
+Object.defineProperty(exports, "TipoAbilitazione", { enumerable: true, get: function () { return TipoAbilitazione_1.TipoAbilitazione; } });
+var accessiRequirements_1 = require("../../accessi-module/middleware/accessiRequirements");
+Object.defineProperty(exports, "accessiRequirement", { enumerable: true, get: function () { return accessiRequirements_1.accessiRequirement; } });
+Object.defineProperty(exports, "buildRequirementTree", { enumerable: true, get: function () { return accessiRequirements_1.buildRequirementTree; } });
+Object.defineProperty(exports, "evaluateRequirement", { enumerable: true, get: function () { return accessiRequirements_1.evaluateRequirement; } });
+Object.defineProperty(exports, "RequirementEvaluationError", { enumerable: true, get: function () { return accessiRequirements_1.RequirementEvaluationError; } });
+var authenticatedToken_1 = require("../../accessi-module/security/authenticatedToken");
+Object.defineProperty(exports, "extractAccessiBearerToken", { enumerable: true, get: function () { return authenticatedToken_1.extractAccessiBearerToken; } });
+Object.defineProperty(exports, "resolveCodiceUtenteFromTokenPayload", { enumerable: true, get: function () { return authenticatedToken_1.resolveCodiceUtenteFromTokenPayload; } });
+Object.defineProperty(exports, "buildAuthenticatedTokenPayload", { enumerable: true, get: function () { return authenticatedToken_1.buildAuthenticatedTokenPayload; } });
+Object.defineProperty(exports, "isLoginAsTokenPayload", { enumerable: true, get: function () { return authenticatedToken_1.isLoginAsTokenPayload; } });
+Object.defineProperty(exports, "isAccessiTokenAllowedForUser", { enumerable: true, get: function () { return authenticatedToken_1.isAccessiTokenAllowedForUser; } });
+Object.defineProperty(exports, "isAuthenticatedUserEnabledForJwt", { enumerable: true, get: function () { return authenticatedToken_1.isAuthenticatedUserEnabledForJwt; } });
+//# sourceMappingURL=index.js.map

package/dist/accessi/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/contracts/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,mFAA4G;AAAnG,wHAAA,kBAAkB,OAAA;AAAE,8HAAA,wBAAwB,OAAA;AACrD,+EAA8E;AAArE,oHAAA,gBAAgB,OAAA;AAEzB,2FAK6D;AAJ3D,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,0HAAA,mBAAmB,OAAA;AACnB,iIAAA,0BAA0B,OAAA;AAiB5B,uFAO0D;AANxD,+HAAA,yBAAyB,OAAA;AACzB,yIAAA,mCAAmC,OAAA;AACnC,oIAAA,8BAA8B,OAAA;AAC9B,2HAAA,qBAAqB,OAAA;AACrB,kIAAA,4BAA4B,OAAA;AAC5B,sIAAA,gCAAgC,OAAA","sourcesContent":["/**\n * Contratti Accessi browser-safe.\n *\n * Questo entry point non importa NestJS, il database, SMTP o servizi server.\n * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e\n * resource server.\n */\nexport { StatoRegistrazione, StatoRegistrazioneValues } from \"../../accessi-module/Dtos/StatoRegistrazione\";\nexport { TipoAbilitazione } from \"../../accessi-module/Dtos/TipoAbilitazione\";\n\nexport {\n  accessiRequirement,\n  buildRequirementTree,\n  evaluateRequirement,\n  RequirementEvaluationError,\n} from \"../../accessi-module/middleware/accessiRequirements\";\n\nexport type {\n  AccessiGrant,\n  GrantsResult,\n  AccessiPermissionRequirement,\n  AccessiAllRequirement,\n  AccessiAnyRequirement,\n  AccessiNotRequirement,\n  AccessiCustomRequirement,\n  AccessiRequirementNode,\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  AccessiCustomRequirementHandler,\n} from \"../../accessi-module/middleware/accessiRequirements\";\n\nexport {\n  extractAccessiBearerToken,\n  resolveCodiceUtenteFromTokenPayload,\n  buildAuthenticatedTokenPayload,\n  isLoginAsTokenPayload,\n  isAccessiTokenAllowedForUser,\n  isAuthenticatedUserEnabledForJwt,\n} from \"../../accessi-module/security/authenticatedToken\";\n\nexport type {\n  AccessiAuthenticatedUserSnapshot,\n} from \"../../accessi-module/security/authenticatedToken\";\n\n/** Payload di un access token Accessi verificato. Le claim extra restano disponibili. */\nexport interface AccessiAccessTokenPayload extends Record<string, unknown> {\n  /** Obbligatorio: distingue un access token da reset token e token 2FA. */\n  typ: \"access\";\n  /** Metodi di autenticazione usati (es. `password`, `otp`, `login_as`). */\n  amr?: string[];\n  codiceUtente?: number;\n  utente?: Record<string, unknown>;\n  userData?: { utente?: Record<string, unknown> };\n}\n"]}

package/dist/accessi/openapi/index.d.ts

@@ -0,0 +1,2 @@
+export * from "../../openapi/OpenApiConfig";
+export * from "../../openapi/OpenApiMerge";

package/dist/accessi/openapi/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../../openapi/OpenApiConfig"), exports);
+__exportStar(require("../../openapi/OpenApiMerge"), exports);
+//# sourceMappingURL=index.js.map

package/dist/accessi/openapi/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/openapi/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8DAA4C;AAC5C,6DAA2C","sourcesContent":["export * from \"../../openapi/OpenApiConfig\";\nexport * from \"../../openapi/OpenApiMerge\";\n"]}

package/dist/accessi/resource-server/core.d.ts

@@ -0,0 +1,6 @@
+export * from "./types";
+export * from "./keys";
+export * from "./errors";
+export * from "./token";
+export * from "./introspection";
+export * from "./runtime";

package/dist/accessi/resource-server/core.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./keys"), exports);
+__exportStar(require("./errors"), exports);
+__exportStar(require("./token"), exports);
+__exportStar(require("./introspection"), exports);
+__exportStar(require("./runtime"), exports);
+//# sourceMappingURL=core.js.map

package/dist/accessi/resource-server/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/core.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,yCAAuB;AACvB,2CAAyB;AACzB,0CAAwB;AACxB,kDAAgC;AAChC,4CAA0B","sourcesContent":["export * from \"./types\";\nexport * from \"./keys\";\nexport * from \"./errors\";\nexport * from \"./token\";\nexport * from \"./introspection\";\nexport * from \"./runtime\";\n"]}

package/dist/accessi/resource-server/errors.d.ts

@@ -0,0 +1,10 @@
+/** Codici stabili del resource server, allineati al contratto HTTP Accessi. */
+export type AccessiResourceServerErrorCode = "AUTH_HEADER_MISSING" | "AUTH_TOKEN_MISSING" | "AUTH_TOKEN_INVALID" | "AUTH_USER_CODE_MISSING" | "AUTH_USER_DISABLED" | "AUTH_INSUFFICIENT_PERMISSIONS" | "AUTH_CONFIG_INVALID" | "AUTH_GRANTS_SOURCE_MISSING" | "AUTH_INTROSPECTION_UNAVAILABLE" | "AUTH_INTROSPECTION_UNAUTHORIZED" | "AUTH_JWKS_UNAVAILABLE" | "AUTH_INTERNAL_ERROR";
+/** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */
+export declare class AccessiResourceServerError extends Error {
+    readonly status: number;
+    readonly code: AccessiResourceServerErrorCode;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(status: number, code: AccessiResourceServerErrorCode, message: string, details?: Record<string, unknown> | undefined);
+}
+export declare function accessiAuthError(status: number, code: AccessiResourceServerErrorCode, message: string, details?: Record<string, unknown>): AccessiResourceServerError;

package/dist/accessi/resource-server/errors.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiResourceServerError = void 0;
+exports.accessiAuthError = accessiAuthError;
+/** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */
+class AccessiResourceServerError extends Error {
+    constructor(status, code, message, details) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.details = details;
+        this.name = "AccessiResourceServerError";
+    }
+}
+exports.AccessiResourceServerError = AccessiResourceServerError;
+function accessiAuthError(status, code, message, details) {
+    return new AccessiResourceServerError(status, code, message, details);
+}
+//# sourceMappingURL=errors.js.map

package/dist/accessi/resource-server/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/errors.ts"],"names":[],"mappings":";;;AA4BA,4CAOC;AApBD,4FAA4F;AAC5F,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YACkB,MAAc,EACd,IAAoC,EACpD,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAgC;QAEpC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAVD,gEAUC;AAED,SAAgB,gBAAgB,CAC9B,MAAc,EACd,IAAoC,EACpC,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC","sourcesContent":["/** Codici stabili del resource server, allineati al contratto HTTP Accessi. */\nexport type AccessiResourceServerErrorCode =\n  | \"AUTH_HEADER_MISSING\"\n  | \"AUTH_TOKEN_MISSING\"\n  | \"AUTH_TOKEN_INVALID\"\n  | \"AUTH_USER_CODE_MISSING\"\n  | \"AUTH_USER_DISABLED\"\n  | \"AUTH_INSUFFICIENT_PERMISSIONS\"\n  | \"AUTH_CONFIG_INVALID\"\n  | \"AUTH_GRANTS_SOURCE_MISSING\"\n  | \"AUTH_INTROSPECTION_UNAVAILABLE\"\n  | \"AUTH_INTROSPECTION_UNAUTHORIZED\"\n  | \"AUTH_JWKS_UNAVAILABLE\"\n  | \"AUTH_INTERNAL_ERROR\";\n\n/** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */\nexport class AccessiResourceServerError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: AccessiResourceServerErrorCode,\n    message: string,\n    public readonly details?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = \"AccessiResourceServerError\";\n  }\n}\n\nexport function accessiAuthError(\n  status: number,\n  code: AccessiResourceServerErrorCode,\n  message: string,\n  details?: Record<string, unknown>,\n): AccessiResourceServerError {\n  return new AccessiResourceServerError(status, code, message, details);\n}\n"]}

package/dist/accessi/resource-server/express.d.ts

@@ -0,0 +1,17 @@
+import type { NextFunction, Request, Response } from "express";
+import { AccessiResourceServerError } from "./errors";
+import type { AccessiResourceServerRuntime } from "./runtime";
+import type { AccessiResourceServerOptions } from "./types";
+/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */
+export declare function toAccessiResourceServerError(error: unknown): AccessiResourceServerError;
+/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */
+export declare function sendAccessiResourceServerError(res: Response, error: unknown): Response;
+/**
+ * Middleware Express per backend che non possiedono il database Accessi.
+ *
+ * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione
+ * popola anche `req.userGrants`.
+ */
+export declare function createAccessiAuthMiddleware(options: AccessiResourceServerOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/** Variante con runtime gia creato, utile per test o bootstrap manuale. */
+export declare function createAccessiAuthMiddlewareFromRuntime(runtime: AccessiResourceServerRuntime): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/accessi/resource-server/express.js

@@ -0,0 +1,66 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toAccessiResourceServerError = toAccessiResourceServerError;
+exports.sendAccessiResourceServerError = sendAccessiResourceServerError;
+exports.createAccessiAuthMiddleware = createAccessiAuthMiddleware;
+exports.createAccessiAuthMiddlewareFromRuntime = createAccessiAuthMiddlewareFromRuntime;
+const errors_1 = require("./errors");
+const runtime_1 = require("./runtime");
+/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */
+function toAccessiResourceServerError(error) {
+    if (error instanceof errors_1.AccessiResourceServerError)
+        return error;
+    return (0, errors_1.accessiAuthError)(500, "AUTH_INTERNAL_ERROR", "Errore interno durante l'autenticazione.");
+}
+/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */
+function sendAccessiResourceServerError(res, error) {
+    const normalized = toAccessiResourceServerError(error);
+    return res.status(normalized.status).json({
+        severity: "error",
+        status: normalized.status,
+        statusCode: 2,
+        code: normalized.code,
+        error: normalized.code,
+        message: normalized.message,
+    });
+}
+/**
+ * Middleware Express per backend che non possiedono il database Accessi.
+ *
+ * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione
+ * popola anche `req.userGrants`.
+ */
+function createAccessiAuthMiddleware(options) {
+    const runtime = (0, runtime_1.createAccessiResourceServer)(options);
+    return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield (0, runtime_1.authenticateAccessiRequest)(req, runtime);
+            next();
+        }
+        catch (error) {
+            sendAccessiResourceServerError(res, error);
+        }
+    });
+}
+/** Variante con runtime gia creato, utile per test o bootstrap manuale. */
+function createAccessiAuthMiddlewareFromRuntime(runtime) {
+    return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield (0, runtime_1.authenticateAccessiRequest)(req, runtime);
+            next();
+        }
+        catch (error) {
+            sendAccessiResourceServerError(res, error);
+        }
+    });
+}
+//# sourceMappingURL=express.js.map

package/dist/accessi/resource-server/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/express.ts"],"names":[],"mappings":";;;;;;;;;;;AAOA,oEAGC;AAGD,wEAUC;AAQD,kEAaC;AAGD,wFAWC;AAzDD,qCAAwE;AACxE,uCAAoF;AAIpF,wEAAwE;AACxE,SAAgB,4BAA4B,CAAC,KAAc;IACzD,IAAI,KAAK,YAAY,mCAA0B;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;AAClG,CAAC;AAED,wFAAwF;AACxF,SAAgB,8BAA8B,CAAC,GAAa,EAAE,KAAc;IAC1E,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACxC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,IAAI;QACtB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAErD,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sCAAsC,CACpD,OAAqC;IAErC,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from \"express\";\nimport { AccessiResourceServerError, accessiAuthError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerRuntime } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\n/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */\nexport function toAccessiResourceServerError(error: unknown): AccessiResourceServerError {\n  if (error instanceof AccessiResourceServerError) return error;\n  return accessiAuthError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n}\n\n/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */\nexport function sendAccessiResourceServerError(res: Response, error: unknown): Response {\n  const normalized = toAccessiResourceServerError(error);\n  return res.status(normalized.status).json({\n    severity: \"error\",\n    status: normalized.status,\n    statusCode: 2,\n    code: normalized.code,\n    error: normalized.code,\n    message: normalized.message,\n  });\n}\n\n/**\n * Middleware Express per backend che non possiedono il database Accessi.\n *\n * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione\n * popola anche `req.userGrants`.\n */\nexport function createAccessiAuthMiddleware(\n  options: AccessiResourceServerOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  const runtime = createAccessiResourceServer(options);\n\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n\n/** Variante con runtime gia creato, utile per test o bootstrap manuale. */\nexport function createAccessiAuthMiddlewareFromRuntime(\n  runtime: AccessiResourceServerRuntime,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n"]}

package/dist/accessi/resource-server/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./core";
+export * from "./express";
+export * from "./nest";

package/dist/accessi/resource-server/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./core"), exports);
+__exportStar(require("./express"), exports);
+__exportStar(require("./nest"), exports);
+//# sourceMappingURL=index.js.map

package/dist/accessi/resource-server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,4CAA0B;AAC1B,yCAAuB","sourcesContent":["export * from \"./core\";\nexport * from \"./express\";\nexport * from \"./nest\";\n"]}

package/dist/accessi/resource-server/introspection.d.ts

@@ -0,0 +1,16 @@
+import type { AccessiIntrospectionOptions, AccessiIntrospectionResult } from "./types";
+/** Client di introspection verso Accessi Service, con cache locale dei risultati attivi. */
+export interface AccessiIntrospectionClient {
+    introspect(token: string, options?: {
+        forceRefresh?: boolean;
+    }): Promise<AccessiIntrospectionResult>;
+    clearCache(): void;
+}
+/**
+ * Crea il client di introspection.
+ *
+ * Il service token deve avere scope `accessi:introspect`. I risultati attivi
+ * sono memorizzati per `cacheTtlMs` (default 30s); i risultati inattivi non
+ * vengono cachati per permettere un retry immediato dopo un login.
+ */
+export declare function createAccessiIntrospectionClient(options: AccessiIntrospectionOptions): AccessiIntrospectionClient;