emilsoftware-utilities 2.0.0-dev.7 → 2.0.0-dev.71

package/dist/accessi/resource-server/types.d.ts

@@ -0,0 +1,92 @@
+import type { AccessiAuthorizationOptions, AccessiGrant, GrantsResult } from "../contracts";
+import type { SessionRevocationStore } from "../../accessi-module/security/sessionRevocation";
+import type { AccessTokenRevocationStore } from "../../accessi-module/security/accessTokenRevocation";
+import type { RefreshTokenRotationStore } from "../../accessi-module/security/refreshTokenRotation";
+/** Algoritmi JWT supportati dal resource server. */
+export type AccessiJwtAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
+/** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */
+export interface AccessiResourceServerJwtOptions {
+    /** Chiave HMAC gia derivata (access key). Alternativa a `serverSecret`. */
+    secret?: string;
+    /**
+     * Segreto Accessi grezzo (`ACCESSI_JWT_SECRET`).
+     *
+     * Il resource server deriva automaticamente la chiave access con la stessa
+     * KDF del server: e il modo consigliato quando si condivide il segreto HS256.
+     */
+    serverSecret?: string;
+    /** Chiave pubblica PEM per algoritmi RS ed ES. */
+    publicKey?: string | Buffer;
+    /** JWKS remoto per verificare token firmati con chiavi asimmetriche. */
+    jwks?: {
+        url: string;
+        cacheTtlMs?: number;
+        timeoutMs?: number;
+        fetch?: typeof fetch;
+    };
+    /** Default: HS256 con `secret`, altrimenti RS/ES con `publicKey`/`jwks`. */
+    algorithms?: AccessiJwtAlgorithm[];
+    /** Issuer atteso (`iss`). */
+    issuer?: string;
+    /** Audience attesa (`aud`). */
+    audience?: string | string[];
+    /** Tolleranza orologio in secondi. Default: 5. */
+    clockToleranceSeconds?: number;
+}
+/** Configurazione del client di introspection verso Accessi Service. */
+export interface AccessiIntrospectionOptions {
+    /** URL completo, es. `https://accessi.example.com/api/accessi/auth/introspect`. */
+    url: string;
+    /** Service token Accessi con scope `accessi:introspect`. */
+    serviceToken: string;
+    /** TTL della cache locale dei risultati attivi. Default: 30000 ms. */
+    cacheTtlMs?: number;
+    /** Timeout HTTP. Default: 3000 ms. */
+    timeoutMs?: number;
+    /** Fetch iniettabile per test o runtime non-Node. */
+    fetch?: typeof fetch;
+}
+/** Risultato dell'introspection. */
+export interface AccessiIntrospectionResult {
+    active: boolean;
+    user?: Record<string, unknown>;
+    codiceUtente?: number;
+    grants?: GrantsResult;
+}
+/** Modalita di autenticazione del resource server. */
+export type AccessiResourceServerMode = "local" | "introspection";
+/**
+ * Configurazione di un backend fratello che non possiede il database Accessi.
+ *
+ * - `mode: "local"` verifica il JWT con chiave locale e, se servono grant, usa
+ *   l'introspection per leggerli.
+ * - `mode: "introspection"` delega la verifica del token ad Accessi Service.
+ */
+export interface AccessiResourceServerOptions {
+    mode?: AccessiResourceServerMode;
+    jwt?: AccessiResourceServerJwtOptions;
+    introspection?: AccessiIntrospectionOptions;
+    /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */
+    authorization?: AccessiAuthorizationOptions;
+    /** Store condiviso di revoca. Opzionale. */
+    revocation?: {
+        /** Revoca per utente: invalida tutti i token emessi prima del cutoff. */
+        store?: SessionRevocationStore;
+        /** Revoca dei singoli access token tramite `jti`. */
+        accessTokenStore?: AccessTokenRevocationStore;
+        /** Store di rotazione refresh: applica la revoca delle famiglie sospette. */
+        familyStore?: RefreshTokenRotationStore;
+    };
+    /** Audit strutturato degli errori di autenticazione. Default: true. */
+    audit?: boolean;
+}
+/** Dati allegati alla request dopo l'autenticazione. */
+export interface AccessiRequestContext {
+    token: string;
+    user: Record<string, unknown>;
+    codiceUtente?: number;
+    grants?: GrantsResult;
+    payload?: Record<string, unknown>;
+}
+/** Grant esposto per compatibilita con il middleware storico. */
+export type AccessiRequestGrants = AccessiGrant[];

package/dist/accessi/resource-server/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/accessi/resource-server/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AccessiAuthorizationOptions,\n  AccessiGrant,\n  GrantsResult,\n} from \"../contracts\";\nimport type { SessionRevocationStore } from \"../../accessi-module/security/sessionRevocation\";\nimport type { AccessTokenRevocationStore } from \"../../accessi-module/security/accessTokenRevocation\";\nimport type { RefreshTokenRotationStore } from \"../../accessi-module/security/refreshTokenRotation\";\n\n/** Algoritmi JWT supportati dal resource server. */\nexport type AccessiJwtAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\n/** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */\nexport interface AccessiResourceServerJwtOptions {\n  /** Chiave HMAC gia derivata (access key). Alternativa a `serverSecret`. */\n  secret?: string;\n  /**\n   * Segreto Accessi grezzo (`ACCESSI_JWT_SECRET`).\n   *\n   * Il resource server deriva automaticamente la chiave access con la stessa\n   * KDF del server: e il modo consigliato quando si condivide il segreto HS256.\n   */\n  serverSecret?: string;\n  /** Chiave pubblica PEM per algoritmi RS ed ES. */\n  publicKey?: string | Buffer;\n  /** JWKS remoto per verificare token firmati con chiavi asimmetriche. */\n  jwks?: {\n    url: string;\n    cacheTtlMs?: number;\n    timeoutMs?: number;\n    fetch?: typeof fetch;\n  };\n  /** Default: HS256 con `secret`, altrimenti RS/ES con `publicKey`/`jwks`. */\n  algorithms?: AccessiJwtAlgorithm[];\n  /** Issuer atteso (`iss`). */\n  issuer?: string;\n  /** Audience attesa (`aud`). */\n  audience?: string | string[];\n  /** Tolleranza orologio in secondi. Default: 5. */\n  clockToleranceSeconds?: number;\n}\n\n/** Configurazione del client di introspection verso Accessi Service. */\nexport interface AccessiIntrospectionOptions {\n  /** URL completo, es. `https://accessi.example.com/api/accessi/auth/introspect`. */\n  url: string;\n  /** Service token Accessi con scope `accessi:introspect`. */\n  serviceToken: string;\n  /** TTL della cache locale dei risultati attivi. Default: 30000 ms. */\n  cacheTtlMs?: number;\n  /** Timeout HTTP. Default: 3000 ms. */\n  timeoutMs?: number;\n  /** Fetch iniettabile per test o runtime non-Node. */\n  fetch?: typeof fetch;\n}\n\n/** Risultato dell'introspection. */\nexport interface AccessiIntrospectionResult {\n  active: boolean;\n  user?: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n}\n\n/** Modalita di autenticazione del resource server. */\nexport type AccessiResourceServerMode = \"local\" | \"introspection\";\n\n/**\n * Configurazione di un backend fratello che non possiede il database Accessi.\n *\n * - `mode: \"local\"` verifica il JWT con chiave locale e, se servono grant, usa\n *   l'introspection per leggerli.\n * - `mode: \"introspection\"` delega la verifica del token ad Accessi Service.\n */\nexport interface AccessiResourceServerOptions {\n  mode?: AccessiResourceServerMode;\n  jwt?: AccessiResourceServerJwtOptions;\n  introspection?: AccessiIntrospectionOptions;\n  /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */\n  authorization?: AccessiAuthorizationOptions;\n  /** Store condiviso di revoca. Opzionale. */\n  revocation?: {\n    /** Revoca per utente: invalida tutti i token emessi prima del cutoff. */\n    store?: SessionRevocationStore;\n    /** Revoca dei singoli access token tramite `jti`. */\n    accessTokenStore?: AccessTokenRevocationStore;\n    /** Store di rotazione refresh: applica la revoca delle famiglie sospette. */\n    familyStore?: RefreshTokenRotationStore;\n  };\n  /** Audit strutturato degli errori di autenticazione. Default: true. */\n  audit?: boolean;\n}\n\n/** Dati allegati alla request dopo l'autenticazione. */\nexport interface AccessiRequestContext {\n  token: string;\n  user: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n  payload?: Record<string, unknown>;\n}\n\n/** Grant esposto per compatibilita con il middleware storico. */\nexport type AccessiRequestGrants = AccessiGrant[];\n"]}

package/dist/accessi/server/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Entry point server Accessi.
+ *
+ * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,
+ * console e servizi Nest completi. I backend fratelli devono usare
+ * `accessi/resource-server` e `accessi/client`.
+ */
+export * from "../../accessi-module";
+export * from "./standalone";
+export type { AccessiOptions as AccessiServerOptions } from "../../accessi-module";
+export { createAccessiOptionsFromEnv, createCatalogScriptsOptionsFromEnv, } from "../../accessi-module/database-updates/accessiOptionsFromEnv";

package/dist/accessi/server/index.js

@@ -0,0 +1,30 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCatalogScriptsOptionsFromEnv = exports.createAccessiOptionsFromEnv = void 0;
+/**
+ * Entry point server Accessi.
+ *
+ * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,
+ * console e servizi Nest completi. I backend fratelli devono usare
+ * `accessi/resource-server` e `accessi/client`.
+ */
+__exportStar(require("../../accessi-module"), exports);
+__exportStar(require("./standalone"), exports);
+var accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
+Object.defineProperty(exports, "createAccessiOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createAccessiOptionsFromEnv; } });
+Object.defineProperty(exports, "createCatalogScriptsOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createCatalogScriptsOptionsFromEnv; } });
+//# sourceMappingURL=index.js.map

package/dist/accessi/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AACrC,+CAA6B;AAE7B,qGAGqE;AAFnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport * from \"./standalone\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}

package/dist/accessi/server/standalone.d.ts

@@ -0,0 +1,41 @@
+import type { Application } from 'express';
+import type { Server } from 'http';
+import type { AccessiModuleInitializationResult } from '../../accessi-module';
+import type { AccessiOptions } from '../../accessi-module/AccessiModule';
+export interface AccessiReadinessCheck {
+    name: string;
+    check: () => boolean | Promise<boolean>;
+}
+export interface AccessiServiceOptions {
+    /** Applicazione Express gia esistente. Default: nuova app. */
+    app?: Application;
+    /** Configurazione completa. Default: `createAccessiOptionsFromEnv()`. */
+    accessiOptions?: AccessiOptions;
+    port?: number;
+    host?: string;
+    /** Path base degli endpoint health. Default: `/health`. */
+    healthPath?: string;
+    /** Espone `/health/metrics` in formato Prometheus. Default: true. */
+    metrics?: boolean;
+    /** Check aggiuntivi per la readiness. */
+    readinessChecks?: AccessiReadinessCheck[];
+    /** Timeout chiusura server. Default: 10000 ms. */
+    shutdownTimeoutMs?: number;
+}
+export interface AccessiService {
+    app: Application;
+    nestApp: AccessiModuleInitializationResult['nestApp'];
+    document: AccessiModuleInitializationResult['document'];
+    start(): Promise<Server>;
+    stop(): Promise<void>;
+}
+/**
+ * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.
+ *
+ * Non apre la porta finche non viene chiamato `start()`.
+ */
+export declare function createAccessiService(options?: AccessiServiceOptions): Promise<AccessiService>;
+/**
+ * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.
+ */
+export declare function startAccessiService(options?: AccessiServiceOptions): Promise<AccessiService>;

package/dist/accessi/server/standalone.js

@@ -0,0 +1,265 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiService = createAccessiService;
+exports.startAccessiService = startAccessiService;
+const express_1 = __importDefault(require("express"));
+const Logger_1 = require("../../Logger");
+const Orm_1 = require("../../Orm");
+const accessi_module_1 = require("../../accessi-module");
+const accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
+const accessiSchema_1 = require("../../accessi-module/database-updates/accessiSchema");
+const AccessiDatabaseUpdater_1 = require("../../accessi-module/database-updates/AccessiDatabaseUpdater");
+const validateOptions_1 = require("../../accessi-module/security/validateOptions");
+function normalizePath(value) {
+    return `/${value.replace(/^\/+|\/+$/g, '')}`;
+}
+function createMetrics() {
+    const startedAt = Date.now();
+    let requests = 0;
+    let inFlight = 0;
+    const statuses = new Map();
+    const middleware = (_req, res, next) => {
+        requests += 1;
+        inFlight += 1;
+        res.on('finish', () => {
+            var _a;
+            inFlight = Math.max(0, inFlight - 1);
+            const status = String(res.statusCode);
+            statuses.set(status, ((_a = statuses.get(status)) !== null && _a !== void 0 ? _a : 0) + 1);
+        });
+        next();
+    };
+    const render = () => {
+        const memory = process.memoryUsage();
+        const lines = [
+            '# HELP accessi_http_requests_total Richieste HTTP totali.',
+            '# TYPE accessi_http_requests_total counter',
+            ...[...statuses.entries()].map(([status, count]) => `accessi_http_requests_total{status="${status}"} ${count}`),
+            '# HELP accessi_http_in_flight Richieste HTTP in corso.',
+            '# TYPE accessi_http_in_flight gauge',
+            `accessi_http_in_flight ${inFlight}`,
+            '# HELP accessi_process_uptime_seconds Uptime del processo.',
+            '# TYPE accessi_process_uptime_seconds gauge',
+            `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,
+            '# HELP accessi_process_memory_bytes Memoria del processo.',
+            '# TYPE accessi_process_memory_bytes gauge',
+            `accessi_process_memory_bytes{type="rss"} ${memory.rss}`,
+            `accessi_process_memory_bytes{type="heapUsed"} ${memory.heapUsed}`,
+            `accessi_process_memory_bytes{type="heapTotal"} ${memory.heapTotal}`,
+            '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',
+            '# TYPE accessi_http_requests_started_total counter',
+            `accessi_http_requests_started_total ${requests}`,
+        ];
+        return `${lines.join('\n')}\n`;
+    };
+    return { middleware, render };
+}
+function collectHealthStores(options) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const stores = [];
+    const seen = new Set();
+    const add = (name, store) => {
+        if (!store || seen.has(store) || typeof store.healthCheck !== 'function')
+            return;
+        seen.add(store);
+        stores.push({ name, store });
+    };
+    add('publicAuthRateLimit', (_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.store);
+    add('serviceTokenRateLimit', (_b = options.serviceTokens) === null || _b === void 0 ? void 0 : _b.rateLimitStore);
+    add('consoleEntry', (_c = options.consoleEntry) === null || _c === void 0 ? void 0 : _c.store);
+    add('edgeRateLimit', (_d = options.edgeRateLimit) === null || _d === void 0 ? void 0 : _d.store);
+    add('sessionRevocation', (_e = options.sessionRevocation) === null || _e === void 0 ? void 0 : _e.store);
+    add('accessTokenRevocation', (_f = options.accessTokenRevocation) === null || _f === void 0 ? void 0 : _f.store);
+    add('refreshTokenRotation', (_g = options.refreshTokenRotation) === null || _g === void 0 ? void 0 : _g.store);
+    return stores;
+}
+function checkDatabase(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const version = yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.getCurrentVersion(options);
+            if (!version) {
+                return { ok: false, detail: 'schema Accessi non inizializzato' };
+            }
+            return {
+                ok: true,
+                detail: version === accessiSchema_1.ACCESSI_SCHEMA_VERSION
+                    ? version
+                    : `${version} (atteso ${accessiSchema_1.ACCESSI_SCHEMA_VERSION})`,
+            };
+        }
+        catch (error) {
+            return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+        }
+    });
+}
+/**
+ * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.
+ *
+ * Non apre la porta finche non viene chiamato `start()`.
+ */
+function createAccessiService() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a, _b, _c, _d;
+        const logger = new Logger_1.Logger('AccessiService');
+        const accessiOptions = (_a = options.accessiOptions) !== null && _a !== void 0 ? _a : (0, accessiOptionsFromEnv_1.createAccessiOptionsFromEnv)();
+        (0, validateOptions_1.assertValidAccessiOptions)(accessiOptions);
+        for (const warning of (0, validateOptions_1.validateAccessiOptions)(accessiOptions).warnings) {
+            logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);
+        }
+        const app = (_b = options.app) !== null && _b !== void 0 ? _b : (0, express_1.default)();
+        const healthPath = normalizePath((_c = options.healthPath) !== null && _c !== void 0 ? _c : '/health');
+        const metrics = createMetrics();
+        const readinessChecks = (_d = options.readinessChecks) !== null && _d !== void 0 ? _d : [];
+        let initialized = false;
+        let nestApp;
+        let document;
+        let server;
+        let stopping = false;
+        app.use(metrics.middleware);
+        app.get(`${healthPath}/live`, (_req, res) => {
+            res.status(200).json({
+                status: 'ok',
+                uptimeSeconds: Math.floor(process.uptime()),
+            });
+        });
+        app.get(`${healthPath}/ready`, (_req, res) => __awaiter(this, void 0, void 0, function* () {
+            if (!initialized || !nestApp) {
+                res.status(503).json({
+                    status: 'error',
+                    checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },
+                });
+                return;
+            }
+            const checks = {
+                bootstrap: { ok: true },
+                database: yield checkDatabase(accessiOptions),
+            };
+            const stores = collectHealthStores(accessiOptions);
+            yield Promise.all(stores.map((_a) => __awaiter(this, [_a], void 0, function* ({ name, store }) {
+                var _b;
+                try {
+                    checks[name] = { ok: Boolean(yield ((_b = store.healthCheck) === null || _b === void 0 ? void 0 : _b.call(store))) };
+                }
+                catch (error) {
+                    checks[name] = {
+                        ok: false,
+                        detail: error instanceof Error ? error.message : String(error),
+                    };
+                }
+            })));
+            for (const check of readinessChecks) {
+                try {
+                    const ok = yield check.check();
+                    checks[check.name] = { ok: Boolean(ok) };
+                }
+                catch (error) {
+                    checks[check.name] = {
+                        ok: false,
+                        detail: error instanceof Error ? error.message : String(error),
+                    };
+                }
+            }
+            const ok = Object.values(checks).every((check) => check.ok);
+            res.status(ok ? 200 : 503).json({
+                status: ok ? 'ok' : 'error',
+                checks,
+                timestamp: new Date().toISOString(),
+            });
+        }));
+        if (options.metrics !== false) {
+            app.get(`${healthPath}/metrics`, (_req, res) => {
+                res.setHeader('Content-Type', 'text/plain; version=0.0.4');
+                res.status(200).send(metrics.render());
+            });
+        }
+        const result = yield (0, accessi_module_1.initializeAccessiModule)(app, accessiOptions);
+        nestApp = result.nestApp;
+        document = result.document;
+        initialized = true;
+        const stop = () => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (stopping)
+                return;
+            stopping = true;
+            const timeout = Math.max(1000, (_a = options.shutdownTimeoutMs) !== null && _a !== void 0 ? _a : 10000);
+            yield Promise.race([
+                new Promise((resolve) => {
+                    if (!server)
+                        return resolve();
+                    server.close(() => resolve());
+                }),
+                new Promise((resolve) => setTimeout(resolve, timeout)),
+            ]);
+            try {
+                yield (nestApp === null || nestApp === void 0 ? void 0 : nestApp.close());
+            }
+            finally {
+                yield Orm_1.Orm.closePools();
+            }
+        });
+        const start = () => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            if (server)
+                return server;
+            const port = (_a = options.port) !== null && _a !== void 0 ? _a : Number((_b = process.env.PORT) !== null && _b !== void 0 ? _b : 3000);
+            server = yield new Promise((resolve, reject) => {
+                const listener = options.host
+                    ? app.listen(port, options.host, () => resolve(listener))
+                    : app.listen(port, () => resolve(listener));
+                listener.once('error', reject);
+            });
+            const address = server.address();
+            const actualPort = typeof address === 'object' && address ? address.port : port;
+            logger.info(`Accessi Service in ascolto su http://${(_c = options.host) !== null && _c !== void 0 ? _c : '0.0.0.0'}:${actualPort}`);
+            return server;
+        });
+        return {
+            app,
+            get nestApp() {
+                if (!nestApp)
+                    throw new Error('Accessi Service non inizializzato.');
+                return nestApp;
+            },
+            get document() {
+                if (!document)
+                    throw new Error('Documento OpenAPI non disponibile.');
+                return document;
+            },
+            start,
+            stop,
+        };
+    });
+}
+/**
+ * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.
+ */
+function startAccessiService() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        const service = yield createAccessiService(options);
+        yield service.start();
+        let shuttingDown = false;
+        const shutdown = (signal) => __awaiter(this, void 0, void 0, function* () {
+            if (shuttingDown)
+                return;
+            shuttingDown = true;
+            new Logger_1.Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);
+            yield service.stop();
+        });
+        process.once('SIGTERM', () => { void shutdown('SIGTERM'); });
+        process.once('SIGINT', () => { void shutdown('SIGINT'); });
+        return service;
+    });
+}
+//# sourceMappingURL=standalone.js.map

package/dist/accessi/server/standalone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone.js","sourceRoot":"","sources":["../../../src/accessi/server/standalone.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAgJA,oDAqIC;AAKD,kDAeC;AAzSD,sDAA8B;AAG9B,yCAAsC;AACtC,mCAAgC;AAChC,yDAA+D;AAK/D,uGAA0G;AAC1G,uFAE6D;AAC7D,yGAAsG;AACtG,mFAAkH;AAqClH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB,EAAQ,EAAE;QAC1E,QAAQ,IAAI,CAAC,CAAC;QACd,QAAQ,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;;YACpB,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG;YACZ,2DAA2D;YAC3D,4CAA4C;YAC5C,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC5B,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,uCAAuC,MAAM,MAAM,KAAK,EAAE,CAChF;YACD,wDAAwD;YACxD,qCAAqC;YACrC,0BAA0B,QAAQ,EAAE;YACpC,4DAA4D;YAC5D,6CAA6C;YAC7C,kCAAkC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE;YAC/E,2DAA2D;YAC3D,2CAA2C;YAC3C,4CAA4C,MAAM,CAAC,GAAG,EAAE;YACxD,iDAAiD,MAAM,CAAC,QAAQ,EAAE;YAClE,kDAAkD,MAAM,CAAC,SAAS,EAAE;YACpE,oEAAoE;YACpE,oDAAoD;YACpD,uCAAuC,QAAQ,EAAE;SAClD,CAAC;QACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;;IAClD,MAAM,MAAM,GAA6E,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAEhC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAA2D,EAAQ,EAAE;QAC9F,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU;YAAE,OAAO;QACjF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,GAAG,CAAC,qBAAqB,EAAE,MAAA,OAAO,CAAC,mBAAmB,0CAAE,KAAK,CAAC,CAAC;IAC/D,GAAG,CAAC,uBAAuB,EAAE,MAAA,OAAO,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;IACpE,GAAG,CAAC,cAAc,EAAE,MAAA,OAAO,CAAC,YAAY,0CAAE,KAAK,CAAC,CAAC;IACjD,GAAG,CAAC,eAAe,EAAE,MAAA,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,CAAC;IACnD,GAAG,CAAC,mBAAmB,EAAE,MAAA,OAAO,CAAC,iBAAiB,0CAAE,KAAK,CAAC,CAAC;IAC3D,GAAG,CAAC,uBAAuB,EAAE,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK,CAAC,CAAC;IACnE,GAAG,CAAC,sBAAsB,EAAE,MAAA,OAAO,CAAC,oBAAoB,0CAAE,KAAK,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAe,aAAa,CAAC,OAAuB;;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,+CAAsB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACnE,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,OAAO,KAAK,sCAAsB;oBACxC,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,OAAO,YAAY,sCAAsB,GAAG;aACpD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;CAAA;AAED;;;;GAIG;AACH,SAAsB,oBAAoB;yDACxC,UAAiC,EAAE;;QAEnC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,IAAA,mDAA2B,GAAE,CAAC;QAC/E,IAAA,2CAAyB,EAAC,cAAc,CAAC,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,IAAA,wCAAsB,EAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,2BAA2B,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAA,iBAAO,GAAE,CAAC;QACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;QACtD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,OAAiE,CAAC;QACtE,IAAI,QAAmE,CAAC;QACxE,IAAI,MAA0B,CAAC;QAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,QAAQ,EAAE,CAAO,IAAa,EAAE,GAAa,EAAE,EAAE;YACpE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE;iBACzE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAsC;gBAChD,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;gBACvB,QAAQ,EAAE,MAAM,aAAa,CAAC,cAAc,CAAC;aAC9C,CAAC;YAEF,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;YACnD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAwB,EAAE,0CAAnB,EAAE,IAAI,EAAE,KAAK,EAAE;;gBACjD,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAA,MAAA,KAAK,CAAC,WAAW,qDAAI,CAAA,CAAC,EAAE,CAAC;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,GAAG;wBACb,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC/D,CAAC;gBACJ,CAAC;YACH,CAAC,CAAA,CAAC,CAAC,CAAC;YAEJ,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;oBAC/B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;wBACnB,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC/D,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC9B,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;gBAC3B,MAAM;gBACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAA,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;gBAChE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAuB,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,WAAW,GAAG,IAAI,CAAC;QAEnB,MAAM,IAAI,GAAG,GAAwB,EAAE;;YACrC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAM,CAAC,CAAC;YACrE,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC5B,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAA,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAA,CAAC;QAEF,MAAM,KAAK,GAAG,GAA0B,EAAE;;YACxC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,IAAI,mCAAI,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,wCAAwC,MAAA,OAAO,CAAC,IAAI,mCAAI,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC;QAChB,CAAC,CAAA,CAAC;QAEF,OAAO;YACL,GAAG;YACH,IAAI,OAAO;gBACT,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,QAAQ;gBACV,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACrE,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,KAAK;YACL,IAAI;SACL,CAAC;IACJ,CAAC;CAAA;AAED;;GAEG;AACH,SAAsB,mBAAmB;yDAAC,UAAiC,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAEtB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAO,MAAc,EAAiB,EAAE;YACvD,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,MAAM,qBAAqB,CAAC,CAAC;YAC3E,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAA,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;CAAA","sourcesContent":["import express from 'express';\nimport type { Application, Request, Response } from 'express';\nimport type { Server } from 'http';\nimport { Logger } from '../../Logger';\nimport { Orm } from '../../Orm';\nimport { initializeAccessiModule } from '../../accessi-module';\nimport type {\n  AccessiModuleInitializationResult,\n} from '../../accessi-module';\nimport type { AccessiOptions } from '../../accessi-module/AccessiModule';\nimport { createAccessiOptionsFromEnv } from '../../accessi-module/database-updates/accessiOptionsFromEnv';\nimport {\n  ACCESSI_SCHEMA_VERSION,\n} from '../../accessi-module/database-updates/accessiSchema';\nimport { AccessiDatabaseUpdater } from '../../accessi-module/database-updates/AccessiDatabaseUpdater';\nimport { assertValidAccessiOptions, validateAccessiOptions } from '../../accessi-module/security/validateOptions';\n\nexport interface AccessiReadinessCheck {\n  name: string;\n  check: () => boolean | Promise<boolean>;\n}\n\nexport interface AccessiServiceOptions {\n  /** Applicazione Express gia esistente. Default: nuova app. */\n  app?: Application;\n  /** Configurazione completa. Default: `createAccessiOptionsFromEnv()`. */\n  accessiOptions?: AccessiOptions;\n  port?: number;\n  host?: string;\n  /** Path base degli endpoint health. Default: `/health`. */\n  healthPath?: string;\n  /** Espone `/health/metrics` in formato Prometheus. Default: true. */\n  metrics?: boolean;\n  /** Check aggiuntivi per la readiness. */\n  readinessChecks?: AccessiReadinessCheck[];\n  /** Timeout chiusura server. Default: 10000 ms. */\n  shutdownTimeoutMs?: number;\n}\n\nexport interface AccessiService {\n  app: Application;\n  nestApp: AccessiModuleInitializationResult['nestApp'];\n  document: AccessiModuleInitializationResult['document'];\n  start(): Promise<Server>;\n  stop(): Promise<void>;\n}\n\ninterface HealthCheckResult {\n  ok: boolean;\n  detail?: string;\n}\n\nfunction normalizePath(value: string): string {\n  return `/${value.replace(/^\\/+|\\/+$/g, '')}`;\n}\n\nfunction createMetrics() {\n  const startedAt = Date.now();\n  let requests = 0;\n  let inFlight = 0;\n  const statuses = new Map<string, number>();\n\n  const middleware = (_req: Request, res: Response, next: () => void): void => {\n    requests += 1;\n    inFlight += 1;\n    res.on('finish', () => {\n      inFlight = Math.max(0, inFlight - 1);\n      const status = String(res.statusCode);\n      statuses.set(status, (statuses.get(status) ?? 0) + 1);\n    });\n    next();\n  };\n\n  const render = (): string => {\n    const memory = process.memoryUsage();\n    const lines = [\n      '# HELP accessi_http_requests_total Richieste HTTP totali.',\n      '# TYPE accessi_http_requests_total counter',\n      ...[...statuses.entries()].map(\n        ([status, count]) => `accessi_http_requests_total{status=\"${status}\"} ${count}`,\n      ),\n      '# HELP accessi_http_in_flight Richieste HTTP in corso.',\n      '# TYPE accessi_http_in_flight gauge',\n      `accessi_http_in_flight ${inFlight}`,\n      '# HELP accessi_process_uptime_seconds Uptime del processo.',\n      '# TYPE accessi_process_uptime_seconds gauge',\n      `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,\n      '# HELP accessi_process_memory_bytes Memoria del processo.',\n      '# TYPE accessi_process_memory_bytes gauge',\n      `accessi_process_memory_bytes{type=\"rss\"} ${memory.rss}`,\n      `accessi_process_memory_bytes{type=\"heapUsed\"} ${memory.heapUsed}`,\n      `accessi_process_memory_bytes{type=\"heapTotal\"} ${memory.heapTotal}`,\n      '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',\n      '# TYPE accessi_http_requests_started_total counter',\n      `accessi_http_requests_started_total ${requests}`,\n    ];\n    return `${lines.join('\\n')}\\n`;\n  };\n\n  return { middleware, render };\n}\n\nfunction collectHealthStores(options: AccessiOptions): Array<{ name: string; store: { healthCheck?: () => Promise<boolean> } }> {\n  const stores: Array<{ name: string; store: { healthCheck?: () => Promise<boolean> } }> = [];\n  const seen = new Set<unknown>();\n\n  const add = (name: string, store: { healthCheck?: () => Promise<boolean> } | undefined): void => {\n    if (!store || seen.has(store) || typeof store.healthCheck !== 'function') return;\n    seen.add(store);\n    stores.push({ name, store });\n  };\n\n  add('publicAuthRateLimit', options.publicAuthRateLimit?.store);\n  add('serviceTokenRateLimit', options.serviceTokens?.rateLimitStore);\n  add('consoleEntry', options.consoleEntry?.store);\n  add('edgeRateLimit', options.edgeRateLimit?.store);\n  add('sessionRevocation', options.sessionRevocation?.store);\n  add('accessTokenRevocation', options.accessTokenRevocation?.store);\n  add('refreshTokenRotation', options.refreshTokenRotation?.store);\n  return stores;\n}\n\nasync function checkDatabase(options: AccessiOptions): Promise<HealthCheckResult> {\n  try {\n    const version = await AccessiDatabaseUpdater.getCurrentVersion(options);\n    if (!version) {\n      return { ok: false, detail: 'schema Accessi non inizializzato' };\n    }\n    return {\n      ok: true,\n      detail: version === ACCESSI_SCHEMA_VERSION\n        ? version\n        : `${version} (atteso ${ACCESSI_SCHEMA_VERSION})`,\n    };\n  } catch (error) {\n    return { ok: false, detail: error instanceof Error ? error.message : String(error) };\n  }\n}\n\n/**\n * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.\n *\n * Non apre la porta finche non viene chiamato `start()`.\n */\nexport async function createAccessiService(\n  options: AccessiServiceOptions = {},\n): Promise<AccessiService> {\n  const logger = new Logger('AccessiService');\n  const accessiOptions = options.accessiOptions ?? createAccessiOptionsFromEnv();\n  assertValidAccessiOptions(accessiOptions);\n  for (const warning of validateAccessiOptions(accessiOptions).warnings) {\n    logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);\n  }\n\n  const app = options.app ?? express();\n  const healthPath = normalizePath(options.healthPath ?? '/health');\n  const metrics = createMetrics();\n  const readinessChecks = options.readinessChecks ?? [];\n  let initialized = false;\n  let nestApp: AccessiModuleInitializationResult['nestApp'] | undefined;\n  let document: AccessiModuleInitializationResult['document'] | undefined;\n  let server: Server | undefined;\n  let stopping = false;\n\n  app.use(metrics.middleware);\n\n  app.get(`${healthPath}/live`, (_req: Request, res: Response) => {\n    res.status(200).json({\n      status: 'ok',\n      uptimeSeconds: Math.floor(process.uptime()),\n    });\n  });\n\n  app.get(`${healthPath}/ready`, async (_req: Request, res: Response) => {\n    if (!initialized || !nestApp) {\n      res.status(503).json({\n        status: 'error',\n        checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },\n      });\n      return;\n    }\n\n    const checks: Record<string, HealthCheckResult> = {\n      bootstrap: { ok: true },\n      database: await checkDatabase(accessiOptions),\n    };\n\n    const stores = collectHealthStores(accessiOptions);\n    await Promise.all(stores.map(async ({ name, store }) => {\n      try {\n        checks[name] = { ok: Boolean(await store.healthCheck?.()) };\n      } catch (error) {\n        checks[name] = {\n          ok: false,\n          detail: error instanceof Error ? error.message : String(error),\n        };\n      }\n    }));\n\n    for (const check of readinessChecks) {\n      try {\n        const ok = await check.check();\n        checks[check.name] = { ok: Boolean(ok) };\n      } catch (error) {\n        checks[check.name] = {\n          ok: false,\n          detail: error instanceof Error ? error.message : String(error),\n        };\n      }\n    }\n\n    const ok = Object.values(checks).every((check) => check.ok);\n    res.status(ok ? 200 : 503).json({\n      status: ok ? 'ok' : 'error',\n      checks,\n      timestamp: new Date().toISOString(),\n    });\n  });\n\n  if (options.metrics !== false) {\n    app.get(`${healthPath}/metrics`, (_req: Request, res: Response) => {\n      res.setHeader('Content-Type', 'text/plain; version=0.0.4');\n      res.status(200).send(metrics.render());\n    });\n  }\n\n  const result = await initializeAccessiModule(app, accessiOptions);\n  nestApp = result.nestApp;\n  document = result.document;\n  initialized = true;\n\n  const stop = async (): Promise<void> => {\n    if (stopping) return;\n    stopping = true;\n    const timeout = Math.max(1_000, options.shutdownTimeoutMs ?? 10_000);\n    await Promise.race([\n      new Promise<void>((resolve) => {\n        if (!server) return resolve();\n        server.close(() => resolve());\n      }),\n      new Promise<void>((resolve) => setTimeout(resolve, timeout)),\n    ]);\n    try {\n      await nestApp?.close();\n    } finally {\n      await Orm.closePools();\n    }\n  };\n\n  const start = async (): Promise<Server> => {\n    if (server) return server;\n    const port = options.port ?? Number(process.env.PORT ?? 3000);\n    server = await new Promise<Server>((resolve, reject) => {\n      const listener = options.host\n        ? app.listen(port, options.host, () => resolve(listener))\n        : app.listen(port, () => resolve(listener));\n      listener.once('error', reject);\n    });\n    const address = server.address();\n    const actualPort = typeof address === 'object' && address ? address.port : port;\n    logger.info(`Accessi Service in ascolto su http://${options.host ?? '0.0.0.0'}:${actualPort}`);\n    return server;\n  };\n\n  return {\n    app,\n    get nestApp() {\n      if (!nestApp) throw new Error('Accessi Service non inizializzato.');\n      return nestApp;\n    },\n    get document() {\n      if (!document) throw new Error('Documento OpenAPI non disponibile.');\n      return document;\n    },\n    start,\n    stop,\n  };\n}\n\n/**\n * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.\n */\nexport async function startAccessiService(options: AccessiServiceOptions = {}): Promise<AccessiService> {\n  const service = await createAccessiService(options);\n  await service.start();\n\n  let shuttingDown = false;\n  const shutdown = async (signal: string): Promise<void> => {\n    if (shuttingDown) return;\n    shuttingDown = true;\n    new Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);\n    await service.stop();\n  };\n\n  process.once('SIGTERM', () => { void shutdown('SIGTERM'); });\n  process.once('SIGINT', () => { void shutdown('SIGINT'); });\n  return service;\n}\n"]}

package/dist/accessi/ui/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Asset UI frameworkless pubblicati con il pacchetto.
+ *
+ * I componenti sono Web Components senza dipendenze runtime: vanno inclusi
+ * come `<script>` o copiati nel build dell'app. I percorsi sono relativi alla
+ * root del pacchetto distribuito (`dist/`).
+ */
+export declare const ACCESSI_UI_ASSETS: {
+    readonly areeDisponibili: "angular-components/aree-disponibili/aree-disponibili.js";
+};
+export type AccessiUiComponent = keyof typeof ACCESSI_UI_ASSETS;
+/** Restituisce il path dell'asset UI relativo a `dist/`. */
+export declare function getAccessiUiAssetPath(component: AccessiUiComponent): string;

package/dist/accessi/ui/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESSI_UI_ASSETS = void 0;
+exports.getAccessiUiAssetPath = getAccessiUiAssetPath;
+/**
+ * Asset UI frameworkless pubblicati con il pacchetto.
+ *
+ * I componenti sono Web Components senza dipendenze runtime: vanno inclusi
+ * come `<script>` o copiati nel build dell'app. I percorsi sono relativi alla
+ * root del pacchetto distribuito (`dist/`).
+ */
+exports.ACCESSI_UI_ASSETS = {
+    areeDisponibili: "angular-components/aree-disponibili/aree-disponibili.js",
+};
+/** Restituisce il path dell'asset UI relativo a `dist/`. */
+function getAccessiUiAssetPath(component) {
+    return exports.ACCESSI_UI_ASSETS[component];
+}
+//# sourceMappingURL=index.js.map

package/dist/accessi/ui/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/ui/index.ts"],"names":[],"mappings":";;;AAcA,sDAEC;AAhBD;;;;;;GAMG;AACU,QAAA,iBAAiB,GAAG;IAC/B,eAAe,EAAE,yDAAyD;CAClE,CAAC;AAIX,4DAA4D;AAC5D,SAAgB,qBAAqB,CAAC,SAA6B;IACjE,OAAO,yBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Asset UI frameworkless pubblicati con il pacchetto.\n *\n * I componenti sono Web Components senza dipendenze runtime: vanno inclusi\n * come `<script>` o copiati nel build dell'app. I percorsi sono relativi alla\n * root del pacchetto distribuito (`dist/`).\n */\nexport const ACCESSI_UI_ASSETS = {\n  areeDisponibili: \"angular-components/aree-disponibili/aree-disponibili.js\",\n} as const;\n\nexport type AccessiUiComponent = keyof typeof ACCESSI_UI_ASSETS;\n\n/** Restituisce il path dell'asset UI relativo a `dist/`. */\nexport function getAccessiUiAssetPath(component: AccessiUiComponent): string {\n  return ACCESSI_UI_ASSETS[component];\n}\n"]}