emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi/server/tenants.js

@@ -0,0 +1,357 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiTenantConfigurationError = void 0;
+exports.defineAccessiTenantEnvironment = defineAccessiTenantEnvironment;
+exports.getAccessiTenantRedisPrefix = getAccessiTenantRedisPrefix;
+exports.accessiOptionsFromTenantEnvironment = accessiOptionsFromTenantEnvironment;
+exports.loadAccessiTenantEnvironmentFile = loadAccessiTenantEnvironmentFile;
+exports.loadAccessiTenants = loadAccessiTenants;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const node_firebird_1 = require("node-firebird");
+const validateOptions_1 = require("../../accessi-module/security/validateOptions");
+/** Errore aggregato di configurazione tenant. */
+class AccessiTenantConfigurationError extends Error {
+    constructor(issues) {
+        super(`Configurazione tenant non valida:\n${issues.map((issue) => `- ${issue}`).join('\n')}`);
+        this.name = 'AccessiTenantConfigurationError';
+        this.issues = issues;
+    }
+}
+exports.AccessiTenantConfigurationError = AccessiTenantConfigurationError;
+/**
+ * Helper di tipizzazione per i file tenant.
+ *
+ * ```ts
+ * import type { AccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';
+ * import { defineAccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';
+ *
+ * export default defineAccessiTenantEnvironment({
+ *   tenant: { id: 'acme', hosts: ['accessi.acme.example.com'] },
+ *   database: { host: 'db-acme', database: '/data/acme.fdb' },
+ *   jwt: { secret: process.env.ACME_JWT_SECRET!, expiresIn: '1h' },
+ *   email: { ... },
+ *   encryptionKey: process.env.ACME_ENCRYPTION_KEY!,
+ *   confirmationEmailUrl: 'https://accessi.acme.example.com',
+ *   confirmationEmailReturnUrl: 'https://accessi.acme.example.com',
+ * });
+ * ```
+ */
+function defineAccessiTenantEnvironment(environment) {
+    return environment;
+}
+function normalizeHost(host) {
+    return host.trim().toLowerCase().replace(/\.$/, '');
+}
+function normalizeTenantPath(path) {
+    if (path === undefined || path.trim() === '')
+        return undefined;
+    const normalized = `/${path.trim().replace(/^\/+|\/+$/g, '')}`;
+    return normalized === '/' ? '/' : normalized;
+}
+function matchesHost(tenant, host) {
+    return tenant.hosts.some((candidate) => {
+        if (candidate === host)
+            return true;
+        if (candidate.startsWith('*.')) {
+            const suffix = candidate.slice(1);
+            return host.endsWith(suffix) && host.length > suffix.length;
+        }
+        return false;
+    });
+}
+function matchesPath(tenant, path) {
+    if (!tenant.path)
+        return false;
+    if (tenant.path === '/')
+        return true;
+    return path === tenant.path || path.startsWith(`${tenant.path}/`);
+}
+/** Prefisso Redis consigliato per isolare gli store del tenant. */
+function getAccessiTenantRedisPrefix(tenantId) {
+    return `accessi:${tenantId}:`;
+}
+/**
+ * Converte la configurazione tipizzata in `AccessiOptions`.
+ *
+ * Applica i default di Firebird e collega `tenantId`; non crea store o sink,
+ * che restano responsabilita del backend ospitante.
+ */
+function accessiOptionsFromTenantEnvironment(environment) {
+    var _a, _b, _c, _d;
+    const database = environment.database;
+    const databaseOptions = Object.assign(Object.assign({ host: database.host, port: (_a = database.port) !== null && _a !== void 0 ? _a : 3050, database: database.database, user: (_b = database.user) !== null && _b !== void 0 ? _b : 'SYSDBA', password: (_c = database.password) !== null && _c !== void 0 ? _c : 'masterkey' }, (database.pluginName ? { pluginName: database.pluginName } : {})), (database.wireCrypt === 'disabled'
+        ? { wireCrypt: node_firebird_1.WIRE_CRYPT_DISABLE }
+        : database.wireCrypt === 'optional'
+            ? { wireCrypt: node_firebird_1.WIRE_CRYPT_ENABLE }
+            : {}));
+    return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ databaseOptions, confirmationEmailUrl: environment.confirmationEmailUrl, confirmationEmailReturnUrl: environment.confirmationEmailReturnUrl }, (environment.confirmationEmailPrefix ? { confirmationEmailPrefix: environment.confirmationEmailPrefix } : {})), (environment.customResetPage ? { customResetPage: environment.customResetPage } : {})), (environment.publicBaseUrl ? { publicBaseUrl: environment.publicBaseUrl } : {})), (environment.consoleApiBaseUrl ? { consoleApiBaseUrl: environment.consoleApiBaseUrl } : {})), { encryptionKey: environment.encryptionKey, mockDemoUser: (_d = environment.mockDemoUser) !== null && _d !== void 0 ? _d : false }), (environment.passwordExpiration !== undefined ? { passwordExpiration: environment.passwordExpiration } : {})), (environment.passwordExpirationDays !== undefined ? { passwordExpirationDays: environment.passwordExpirationDays } : {})), (environment.legacyPasswordMigrationOnStartup !== undefined
+        ? { legacyPasswordMigrationOnStartup: environment.legacyPasswordMigrationOnStartup }
+        : {})), (environment.autoUpdateDatabase !== undefined ? { autoUpdateDatabase: environment.autoUpdateDatabase } : {})), { jwtOptions: environment.jwt, emailOptions: environment.email }), (environment.http ? { http: environment.http } : {})), (environment.authCookie ? { authCookie: environment.authCookie } : {})), (environment.publicAuthRateLimit ? { publicAuthRateLimit: environment.publicAuthRateLimit } : {})), (environment.publicRegistration ? { publicRegistration: environment.publicRegistration } : {})), (environment.federatedAuthentication ? { federatedAuthentication: environment.federatedAuthentication } : {})), (environment.extensionFieldsOptions ? { extensionFieldsOptions: environment.extensionFieldsOptions } : {})), (environment.serviceTokens ? { serviceTokens: environment.serviceTokens } : {})), (environment.catalogScripts ? { catalogScripts: environment.catalogScripts } : {})), (environment.systemSeeds ? { systemSeeds: environment.systemSeeds } : {})), (environment.adminBootstrap ? { adminBootstrap: environment.adminBootstrap } : {})), (environment.openapi ? { openapi: environment.openapi } : {})), (environment.consoleEntry ? { consoleEntry: environment.consoleEntry } : {})), (environment.edgeRateLimit ? { edgeRateLimit: environment.edgeRateLimit } : {})), (environment.sessionRevocation ? { sessionRevocation: environment.sessionRevocation } : {})), (environment.accessTokenRevocation ? { accessTokenRevocation: environment.accessTokenRevocation } : {})), (environment.refreshTokenRotation ? { refreshTokenRotation: environment.refreshTokenRotation } : {})), (environment.metrics ? { metrics: environment.metrics } : {})), (environment.audit ? { audit: environment.audit } : {})), (environment.bufferLogs !== undefined ? { bufferLogs: environment.bufferLogs } : {})), { tenantId: environment.tenant.id });
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function runtimeIssues(environment, file) {
+    const issues = [];
+    if (!isRecord(environment)) {
+        return [`${file}: il file deve esportare un oggetto (default export o export environment).`];
+    }
+    const tenant = environment.tenant;
+    if (!isRecord(tenant)) {
+        issues.push(`${file}: tenant mancante.`);
+    }
+    else {
+        if (typeof tenant.id !== 'string' || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(tenant.id)) {
+            issues.push(`${file}: tenant.id non valido (minuscole, numeri, - e _, max 63).`);
+        }
+        if (tenant.hosts !== undefined && (!Array.isArray(tenant.hosts) || tenant.hosts.some((host) => typeof host !== 'string'))) {
+            issues.push(`${file}: tenant.hosts deve essere un array di stringhe.`);
+        }
+        if (tenant.path !== undefined && typeof tenant.path !== 'string') {
+            issues.push(`${file}: tenant.path deve essere una stringa.`);
+        }
+        if (tenant.port !== undefined
+            && (typeof tenant.port !== 'number' || !Number.isInteger(tenant.port) || tenant.port < 1 || tenant.port > 65535)) {
+            issues.push(`${file}: tenant.port non valida.`);
+        }
+    }
+    const database = environment.database;
+    if (!isRecord(database)) {
+        issues.push(`${file}: database mancante.`);
+    }
+    else {
+        if (typeof database.host !== 'string' || database.host.trim() === '') {
+            issues.push(`${file}: database.host obbligatorio.`);
+        }
+        if (typeof database.database !== 'string' || database.database.trim() === '') {
+            issues.push(`${file}: database.database obbligatorio.`);
+        }
+        if (database.port !== undefined
+            && (typeof database.port !== 'number' || !Number.isInteger(database.port) || database.port < 1 || database.port > 65535)) {
+            issues.push(`${file}: database.port non valida.`);
+        }
+    }
+    if (!isRecord(environment.jwt))
+        issues.push(`${file}: jwt mancante.`);
+    else {
+        if (typeof environment.jwt.secret !== 'string' || environment.jwt.secret === '') {
+            issues.push(`${file}: jwt.secret obbligatorio.`);
+        }
+        if (typeof environment.jwt.expiresIn !== 'string' || environment.jwt.expiresIn === '') {
+            issues.push(`${file}: jwt.expiresIn obbligatorio.`);
+        }
+    }
+    if (!isRecord(environment.email))
+        issues.push(`${file}: email mancante.`);
+    if (typeof environment.encryptionKey !== 'string' || environment.encryptionKey === '') {
+        issues.push(`${file}: encryptionKey obbligatoria.`);
+    }
+    if (typeof environment.confirmationEmailUrl !== 'string') {
+        issues.push(`${file}: confirmationEmailUrl obbligatoria.`);
+    }
+    if (typeof environment.confirmationEmailReturnUrl !== 'string') {
+        issues.push(`${file}: confirmationEmailReturnUrl obbligatoria.`);
+    }
+    return issues;
+}
+function loadEnvironmentModule(file) {
+    if (/\.(ts|mts|cts)$/i.test(file)) {
+        // Caricamento lazy: jiti serve solo ai file tenant TypeScript.
+        const { createJiti } = require('jiti');
+        const jiti = createJiti(file, { interopDefault: true, moduleCache: false, fsCache: false });
+        return jiti(file);
+    }
+    return require(file);
+}
+/**
+ * Carica un singolo file `*.environment.ts`.
+ *
+ * Usa jiti per eseguire TypeScript anche nel pacchetto compilato, senza
+ * richiedere un passo di build separato per i file tenant.
+ */
+function loadAccessiTenantEnvironmentFile(file) {
+    var _a, _b, _c;
+    const absolute = (0, path_1.resolve)(file);
+    let loaded;
+    try {
+        loaded = loadEnvironmentModule(absolute);
+    }
+    catch (error) {
+        throw new AccessiTenantConfigurationError([
+            `${(0, path_1.basename)(file)}: impossibile caricare il file (${error instanceof Error ? error.message : String(error)}).`,
+        ]);
+    }
+    const record = isRecord(loaded) ? loaded : {};
+    const environment = ((_b = (_a = record.default) !== null && _a !== void 0 ? _a : record.environment) !== null && _b !== void 0 ? _b : loaded);
+    const issues = runtimeIssues(environment, (0, path_1.basename)(file));
+    if (issues.length > 0)
+        throw new AccessiTenantConfigurationError(issues);
+    const typed = environment;
+    const settings = typed.tenant;
+    const options = accessiOptionsFromTenantEnvironment(typed);
+    const validation = (0, validateOptions_1.validateAccessiOptions)(options);
+    const validationIssues = validation.errors.map((issue) => `${(0, path_1.basename)(file)}: ${issue.code}: ${issue.message}`);
+    if (validationIssues.length > 0)
+        throw new AccessiTenantConfigurationError(validationIssues);
+    const hosts = ((_c = settings.hosts) !== null && _c !== void 0 ? _c : []).map(normalizeHost).filter(Boolean);
+    const path = normalizeTenantPath(settings.path);
+    if (hosts.length === 0 && !path) {
+        throw new AccessiTenantConfigurationError([
+            `${(0, path_1.basename)(file)}: configurare tenant.hosts oppure tenant.path.`,
+        ]);
+    }
+    const tenant = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ id: settings.id, hosts }, (path ? { path } : {})), { enabled: settings.enabled !== false }), (settings.description ? { description: settings.description } : {})), (settings.port ? { port: settings.port } : {})), { file: (0, path_1.basename)(file), environmentFile: absolute, options });
+    return { tenant, environment: typed };
+}
+/**
+ * Carica i tenant da una cartella di file `<id>.environment.ts`.
+ *
+ * La validazione e aggregata: un errore blocca l'intera cartella, cosi non si
+ * avvia un tenant con configurazione parziale. Nessun segreto viene stampato.
+ */
+function loadAccessiTenants(options) {
+    var _a, _b, _c, _d, _e;
+    if (!(options === null || options === void 0 ? void 0 : options.directory))
+        throw new Error('loadAccessiTenants: directory obbligatoria.');
+    const directory = (0, path_1.resolve)(options.directory);
+    const issues = [];
+    const warnings = [];
+    let files;
+    try {
+        files = (0, fs_1.readdirSync)(directory, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && /\.environment\.(ts|mts|cts|js|mjs|cjs)$/.test(entry.name))
+            .map((entry) => entry.name)
+            .sort();
+    }
+    catch (error) {
+        throw new AccessiTenantConfigurationError([
+            `Cartella tenant non leggibile (${directory}): ${error instanceof Error ? error.message : String(error)}`,
+        ]);
+    }
+    if (files.length === 0) {
+        throw new AccessiTenantConfigurationError([`Nessun file *.environment.ts nella cartella ${directory}.`]);
+    }
+    const tenants = [];
+    for (const file of files) {
+        try {
+            tenants.push(loadAccessiTenantEnvironmentFile((0, path_1.join)(directory, file)).tenant);
+        }
+        catch (error) {
+            if (error instanceof AccessiTenantConfigurationError)
+                issues.push(...error.issues);
+            else
+                issues.push(`${file}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    const byId = new Map();
+    const hostsSeen = new Map();
+    const pathsSeen = new Map();
+    const jwtSecrets = new Map();
+    const issuerAudience = new Map();
+    for (const tenant of tenants) {
+        if (byId.has(tenant.id)) {
+            issues.push(`Tenant duplicato "${tenant.id}" (${tenant.file} e ${(_a = byId.get(tenant.id)) === null || _a === void 0 ? void 0 : _a.file}).`);
+        }
+        else {
+            byId.set(tenant.id, tenant);
+        }
+        for (const host of tenant.hosts) {
+            const existing = hostsSeen.get(host);
+            if (existing)
+                issues.push(`Host "${host}" assegnato a "${existing}" e "${tenant.id}".`);
+            else
+                hostsSeen.set(host, tenant.id);
+        }
+        if (tenant.path) {
+            const existing = pathsSeen.get(tenant.path);
+            if (existing)
+                issues.push(`Path "${tenant.path}" assegnato a "${existing}" e "${tenant.id}".`);
+            else
+                pathsSeen.set(tenant.path, tenant.id);
+        }
+        // Un segreto JWT condiviso rende un token valido su piu tenant.
+        const signingKey = (_b = tenant.options.jwtOptions.privateKey) !== null && _b !== void 0 ? _b : tenant.options.jwtOptions.secret;
+        const fingerprintKey = `${(_c = tenant.options.jwtOptions.algorithm) !== null && _c !== void 0 ? _c : 'HS256'}|${signingKey}`;
+        const existingKey = jwtSecrets.get(fingerprintKey);
+        if (existingKey) {
+            issues.push(`Chiave JWT condivisa tra "${existingKey}" e "${tenant.id}": usare segreti distinti.`);
+        }
+        else {
+            jwtSecrets.set(fingerprintKey, tenant.id);
+        }
+        const issuer = (_d = tenant.options.jwtOptions.issuer) !== null && _d !== void 0 ? _d : '(assente)';
+        const audience = Array.isArray(tenant.options.jwtOptions.audience)
+            ? tenant.options.jwtOptions.audience.join(',')
+            : ((_e = tenant.options.jwtOptions.audience) !== null && _e !== void 0 ? _e : '(assente)');
+        const issuerKey = `${issuer}|${audience}`;
+        const existingIssuer = issuerAudience.get(issuerKey);
+        if (existingIssuer && options.allowSharedIssuer !== true) {
+            warnings.push(`Issuer/audience "${issuerKey}" condivisi tra "${existingIssuer}" e "${tenant.id}".`);
+        }
+        else {
+            issuerAudience.set(issuerKey, tenant.id);
+        }
+    }
+    const enabled = tenants.filter((tenant) => tenant.enabled);
+    if (enabled.length > 1) {
+        const defaultTenant = enabled.find((tenant) => tenant.hosts.length === 0 && tenant.path === '/');
+        if (defaultTenant) {
+            issues.push(`Tenant "${defaultTenant.id}" intercetta tutte le richieste (path "/") insieme ad altri tenant.`);
+        }
+    }
+    if (issues.length > 0)
+        throw new AccessiTenantConfigurationError(issues);
+    const registry = {
+        directory,
+        tenants,
+        warnings,
+        allowHeader: options.allowHeader === true,
+        byId,
+        resolve(input, resolveOptions) {
+            var _a, _b, _c;
+            const allowHeader = (_a = resolveOptions === null || resolveOptions === void 0 ? void 0 : resolveOptions.allowHeader) !== null && _a !== void 0 ? _a : registry.allowHeader;
+            const host = input.host ? normalizeHost((_b = input.host.split(':')[0]) !== null && _b !== void 0 ? _b : input.host) : undefined;
+            if (host) {
+                const byHost = enabled.find((tenant) => matchesHost(tenant, host));
+                if (byHost)
+                    return { tenant: byHost, matchedBy: 'host' };
+            }
+            const requestPath = (_c = input.path) !== null && _c !== void 0 ? _c : '/';
+            const byPath = enabled
+                .filter((tenant) => matchesPath(tenant, requestPath))
+                .sort((left, right) => { var _a, _b, _c, _d; return ((_b = (_a = right.path) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) - ((_d = (_c = left.path) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0); })[0];
+            if (byPath && byPath.path !== '/')
+                return { tenant: byPath, matchedBy: 'path' };
+            if (allowHeader && input.header) {
+                const headerId = input.header.trim().toLowerCase();
+                const tenant = byId.get(headerId);
+                if (tenant === null || tenant === void 0 ? void 0 : tenant.enabled)
+                    return { tenant, matchedBy: 'header' };
+            }
+            if (byPath)
+                return { tenant: byPath, matchedBy: 'path' };
+            return undefined;
+        },
+        summary() {
+            return tenants.map((tenant) => {
+                var _a;
+                const database = tenant.options.databaseOptions;
+                return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ id: tenant.id, hosts: [...tenant.hosts] }, (tenant.path ? { path: tenant.path } : {})), { enabled: tenant.enabled }), (tenant.description ? { description: tenant.description } : {})), (tenant.port ? { port: tenant.port } : {})), { file: tenant.file, database: {
+                        host: database.host,
+                        port: database.port,
+                        database: database.database,
+                        user: database.user,
+                    }, issuer: tenant.options.jwtOptions.issuer }), (tenant.options.jwtOptions.audience
+                    ? {
+                        audience: typeof tenant.options.jwtOptions.audience === 'string'
+                            ? tenant.options.jwtOptions.audience
+                            : tenant.options.jwtOptions.audience.join(','),
+                    }
+                    : {})), { jwtAlgorithm: (_a = tenant.options.jwtOptions.algorithm) !== null && _a !== void 0 ? _a : 'HS256', refreshEnabled: Boolean(tenant.options.jwtOptions.refreshExpiresIn) });
+            });
+        },
+    };
+    return registry;
+}
+//# sourceMappingURL=tenants.js.map

package/dist/accessi/server/tenants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.js","sourceRoot":"","sources":["../../../src/accessi/server/tenants.ts"],"names":[],"mappings":";;;AA2LA,wEAIC;AA8BD,kEAEC;AAQD,kFAyDC;AA8FD,4EA2CC;AAQD,gDAyJC;AA1kBD,2BAAiC;AACjC,+BAA+C;AAC/C,iDAAsE;AAyBtE,mFAAuF;AAmIvF,iDAAiD;AACjD,MAAa,+BAAgC,SAAQ,KAAK;IAGxD,YAAY,MAAgB;QAC1B,KAAK,CAAC,sCAAsC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AARD,0EAQC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,8BAA8B,CAC5C,WAAc;IAEd,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB;IACnD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;IAC/D,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACrC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,mEAAmE;AACnE,SAAgB,2BAA2B,CAAC,QAAgB;IAC1D,OAAO,WAAW,QAAQ,GAAG,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mCAAmC,CACjD,WAAqC;;IAErC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,MAAM,eAAe,iCACnB,IAAI,EAAE,QAAQ,CAAC,IAAI,EACnB,IAAI,EAAE,MAAA,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAC3B,IAAI,EAAE,MAAA,QAAQ,CAAC,IAAI,mCAAI,QAAQ,EAC/B,QAAQ,EAAE,MAAA,QAAQ,CAAC,QAAQ,mCAAI,WAAW,IACvC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChE,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU;QACnC,CAAC,CAAC,EAAE,SAAS,EAAE,kCAAkB,EAAE;QACnC,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU;YACjC,CAAC,CAAC,EAAE,SAAS,EAAE,iCAAiB,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;IAEF,6aACE,eAAe,EACf,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EACtD,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,IAC/D,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,WAAW,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7G,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACrF,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC9F,aAAa,EAAE,WAAW,CAAC,aAAa,EACxC,YAAY,EAAE,MAAA,WAAW,CAAC,YAAY,mCAAI,KAAK,KAC5C,CAAC,WAAW,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5G,CAAC,WAAW,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxH,CAAC,WAAW,CAAC,gCAAgC,KAAK,SAAS;QAC5D,CAAC,CAAC,EAAE,gCAAgC,EAAE,WAAW,CAAC,gCAAgC,EAAE;QACpF,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,WAAW,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC/G,UAAU,EAAE,WAAW,CAAC,GAAG,EAC3B,YAAY,EAAE,WAAW,CAAC,KAAK,KAC5B,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpD,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtE,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACjG,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC9F,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,WAAW,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7G,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1G,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACzE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7D,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5E,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC3F,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,WAAW,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACvG,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7D,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACvD,CAAC,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACvF,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAC/B;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,IAAI,4EAA4E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;QAC/D,CAAC;QACD,IACE,MAAM,CAAC,IAAI,KAAK,SAAS;eACtB,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,EAChH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;QAC1D,CAAC;QACD,IACE,QAAQ,CAAC,IAAI,KAAK,SAAS;eACxB,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,EACxH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;SACjE,CAAC;QACJ,IAAI,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,WAAW,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC1E,IAAI,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,0BAA0B,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,+DAA+D;QAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAKpC,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gCAAgC,CAAC,IAAY;;IAC3D,MAAM,QAAQ,GAAG,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,+BAA+B,CAAC;YACxC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;SAC/G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,CAAC,MAAA,MAAA,MAAM,CAAC,OAAO,mCAAI,MAAM,CAAC,WAAW,mCAAI,MAAM,CAAY,CAAC;IAChF,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAG,WAAuC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAA,wCAAsB,EAAC,OAAO,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAChH,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IAE7F,MAAM,KAAK,GAAG,CAAC,MAAA,QAAQ,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,+BAA+B,CAAC;YACxC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,gDAAgD;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,2EACV,EAAE,EAAE,QAAQ,CAAC,EAAE,EACf,KAAK,IACF,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzB,OAAO,EAAE,QAAQ,CAAC,OAAO,KAAK,KAAK,KAChC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACnE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACjD,IAAI,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,EACpB,eAAe,EAAE,QAAQ,EACzB,OAAO,GACR,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,OAAkC;;IACnE,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAA;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,gBAAW,EAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC/F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,+BAA+B,CAAC;YACxC,kCAAkC,SAAS,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC1G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,+BAA+B,CAAC,CAAC,+CAA+C,SAAS,GAAG,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,+BAA+B;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;;gBAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,IAAI,MAAM,MAAA,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,0CAAE,IAAI,IAAI,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,QAAQ,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;;gBACnF,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,kBAAkB,QAAQ,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;;gBAC1F,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,mCAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5F,MAAM,cAAc,GAAG,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,IAAI,UAAU,EAAE,CAAC;QACzF,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,6BAA6B,WAAW,QAAQ,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,mCAAI,WAAW,CAAC;QAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9C,CAAC,CAAC,CAAC,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,mCAAI,WAAW,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,cAAc,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,SAAS,oBAAoB,cAAc,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACtG,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACjG,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,EAAE,qEAAqE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAA0B;QACtC,SAAS;QACT,OAAO;QACP,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI;QACzC,IAAI;QACJ,OAAO,CAAC,KAAK,EAAE,cAAc;;YAC3B,MAAM,WAAW,GAAG,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,WAAW,mCAAI,QAAQ,CAAC,WAAW,CAAC;YACxE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAA,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACnE,IAAI,MAAM;oBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAC3D,CAAC;YAED,MAAM,WAAW,GAAG,MAAA,KAAK,CAAC,IAAI,mCAAI,GAAG,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO;iBACnB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;iBACpD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,uBAAC,OAAA,CAAC,MAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,MAAM,mCAAI,CAAC,CAAC,GAAG,CAAC,MAAA,MAAA,IAAI,CAAC,IAAI,0CAAE,MAAM,mCAAI,CAAC,CAAC,CAAA,EAAA,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAEhF,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAClC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YAC9D,CAAC;YAED,IAAI,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;;gBAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,eAK/B,CAAC;gBACF,2GACE,EAAE,EAAE,MAAM,CAAC,EAAE,EACb,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IACrB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7C,OAAO,EAAE,MAAM,CAAC,OAAO,KACpB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/D,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,EACjB,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;qBACpB,EACD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KACrC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;oBACpC,CAAC,CAAC;wBACE,QAAQ,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ;4BAC9D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;4BACpC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;qBACjD;oBACH,CAAC,CAAC,EAAE,CAAC,KACP,YAAY,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,EAC5D,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,IACnE;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { readdirSync } from 'fs';\nimport { basename, join, resolve } from 'path';\nimport { WIRE_CRYPT_DISABLE, WIRE_CRYPT_ENABLE } from 'node-firebird';\nimport type { Options } from 'node-firebird';\nimport type {\n  AccessiOptions,\n  AccessiHttpOptions,\n  AdminBootstrapOptions,\n  CatalogScriptsOptions,\n  ConsoleEntryOptions,\n  EmailOptions,\n  ExtensionFieldsOptions,\n  FederatedAuthenticationOptions,\n  JwtOptions,\n  PublicAuthRateLimitOptions,\n  PublicRegistrationOptions,\n  ServiceTokenOptions,\n  SystemSeedsOptions,\n} from '../../accessi-module/AccessiModule';\nimport type { AccessiEdgeRateLimitOptions } from '../../accessi-module/security/edgeRateLimit';\nimport type { AccessiAuthCookieOptions } from '../../accessi-module/security/authCookies';\nimport type { AccessiMetricsOptions } from '../../accessi-module/observability/metrics';\nimport type { AccessiAuditOptions } from '../../accessi-module/security/audit';\nimport type { SessionRevocationOptions } from '../../accessi-module/security/sessionRevocation';\nimport type { AccessTokenRevocationOptions } from '../../accessi-module/security/accessTokenRevocation';\nimport type { RefreshTokenRotationOptions } from '../../accessi-module/security/refreshTokenRotation';\nimport type { OpenApiSetupOptions } from '../../openapi/OpenApiConfig';\nimport { validateAccessiOptions } from '../../accessi-module/security/validateOptions';\n\n/** Identita e routing del tenant. */\nexport interface AccessiTenantSettings {\n  /** Minuscole, numeri, `-` e `_`; max 63 caratteri. */\n  id: string;\n  /** Host esatti o wildcard `*.example.com`. */\n  hosts?: string[];\n  /** Prefisso path, es. `/acme`. */\n  path?: string;\n  /** Porta del processo quando si usa il supervisore. */\n  port?: number;\n  /** Default `true`. */\n  enabled?: boolean;\n  description?: string;\n}\n\n/** Connessione Firebird del tenant, tipizzata senza callback. */\nexport interface AccessiTenantDatabaseOptions {\n  host: string;\n  port?: number;\n  database: string;\n  user?: string;\n  password?: string;\n  /** `disabled`/`optional`; `required` e il default del driver. */\n  wireCrypt?: 'required' | 'optional' | 'disabled';\n  pluginName?: string;\n}\n\n/**\n * Configurazione serializzabile di un tenant.\n *\n * I campi che contengono store, callback o logger (`store`, `sink`, `match`,\n * `onDocument`, `logger`, ...) sono esclusi: vanno collegati dal backend\n * ospitante, non da un file di configurazione.\n */\nexport interface AccessiTenantEnvironment {\n  tenant: AccessiTenantSettings;\n  database: AccessiTenantDatabaseOptions;\n  jwt: JwtOptions;\n  email: EmailOptions;\n  encryptionKey: string;\n  confirmationEmailUrl: string;\n  confirmationEmailReturnUrl: string;\n  confirmationEmailPrefix?: string;\n  customResetPage?: string;\n  publicBaseUrl?: string;\n  consoleApiBaseUrl?: string;\n  mockDemoUser?: boolean;\n  passwordExpiration?: boolean;\n  passwordExpirationDays?: number;\n  legacyPasswordMigrationOnStartup?: boolean;\n  autoUpdateDatabase?: boolean;\n  http?: AccessiHttpOptions;\n  authCookie?: AccessiAuthCookieOptions;\n  publicAuthRateLimit?: Omit<PublicAuthRateLimitOptions, 'store'>;\n  publicRegistration?: PublicRegistrationOptions;\n  federatedAuthentication?: FederatedAuthenticationOptions;\n  extensionFieldsOptions?: ExtensionFieldsOptions[];\n  serviceTokens?: Omit<ServiceTokenOptions, 'rateLimitStore'>;\n  catalogScripts?: CatalogScriptsOptions;\n  systemSeeds?: SystemSeedsOptions;\n  adminBootstrap?: AdminBootstrapOptions;\n  openapi?: Omit<OpenApiSetupOptions, 'onDocument'>;\n  consoleEntry?: Omit<ConsoleEntryOptions, 'store'>;\n  edgeRateLimit?: Omit<AccessiEdgeRateLimitOptions, 'store' | 'match'>;\n  sessionRevocation?: Omit<SessionRevocationOptions, 'store'>;\n  accessTokenRevocation?: Omit<AccessTokenRevocationOptions, 'store'>;\n  refreshTokenRotation?: Omit<RefreshTokenRotationOptions, 'store'>;\n  metrics?: Omit<AccessiMetricsOptions, 'sink'>;\n  audit?: Omit<AccessiAuditOptions, 'sinks' | 'store' | 'tenantId'>;\n  bufferLogs?: boolean;\n}\n\nexport interface AccessiTenant {\n  id: string;\n  hosts: string[];\n  path?: string;\n  enabled: boolean;\n  description?: string;\n  port?: number;\n  /** Nome del file `*.environment.ts` di origine (mai il contenuto). */\n  file: string;\n  environmentFile: string;\n  options: AccessiOptions;\n}\n\nexport interface AccessiTenantSummary {\n  id: string;\n  hosts: string[];\n  path?: string;\n  enabled: boolean;\n  description?: string;\n  port?: number;\n  file: string;\n  database: {\n    host?: string;\n    port?: number;\n    database?: string;\n    user?: string;\n  };\n  issuer?: string;\n  audience?: string;\n  jwtAlgorithm: string;\n  refreshEnabled: boolean;\n}\n\nexport interface AccessiTenantResolution {\n  tenant: AccessiTenant;\n  matchedBy: 'host' | 'path' | 'header';\n}\n\nexport interface AccessiTenantRegistry {\n  directory: string;\n  tenants: AccessiTenant[];\n  warnings: string[];\n  allowHeader: boolean;\n  byId: ReadonlyMap<string, AccessiTenant>;\n  resolve(input: { host?: string; path?: string; header?: string }, options?: { allowHeader?: boolean }): AccessiTenantResolution | undefined;\n  summary(): AccessiTenantSummary[];\n}\n\nexport interface LoadAccessiTenantsOptions {\n  /** Cartella con `<id>.environment.ts`. */\n  directory: string;\n  /** Abilita la risoluzione via header `x-accessi-tenant`. Default: false. */\n  allowHeader?: boolean;\n  /** Consente issuer/audience uguali tra tenant (sconsigliato). Default: false. */\n  allowSharedIssuer?: boolean;\n}\n\n/** Errore aggregato di configurazione tenant. */\nexport class AccessiTenantConfigurationError extends Error {\n  readonly issues: string[];\n\n  constructor(issues: string[]) {\n    super(`Configurazione tenant non valida:\\n${issues.map((issue) => `- ${issue}`).join('\\n')}`);\n    this.name = 'AccessiTenantConfigurationError';\n    this.issues = issues;\n  }\n}\n\n/**\n * Helper di tipizzazione per i file tenant.\n *\n * ```ts\n * import type { AccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';\n * import { defineAccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';\n *\n * export default defineAccessiTenantEnvironment({\n *   tenant: { id: 'acme', hosts: ['accessi.acme.example.com'] },\n *   database: { host: 'db-acme', database: '/data/acme.fdb' },\n *   jwt: { secret: process.env.ACME_JWT_SECRET!, expiresIn: '1h' },\n *   email: { ... },\n *   encryptionKey: process.env.ACME_ENCRYPTION_KEY!,\n *   confirmationEmailUrl: 'https://accessi.acme.example.com',\n *   confirmationEmailReturnUrl: 'https://accessi.acme.example.com',\n * });\n * ```\n */\nexport function defineAccessiTenantEnvironment<const T extends AccessiTenantEnvironment>(\n  environment: T,\n): T {\n  return environment;\n}\n\nfunction normalizeHost(host: string): string {\n  return host.trim().toLowerCase().replace(/\\.$/, '');\n}\n\nfunction normalizeTenantPath(path: string | undefined): string | undefined {\n  if (path === undefined || path.trim() === '') return undefined;\n  const normalized = `/${path.trim().replace(/^\\/+|\\/+$/g, '')}`;\n  return normalized === '/' ? '/' : normalized;\n}\n\nfunction matchesHost(tenant: AccessiTenant, host: string): boolean {\n  return tenant.hosts.some((candidate) => {\n    if (candidate === host) return true;\n    if (candidate.startsWith('*.')) {\n      const suffix = candidate.slice(1);\n      return host.endsWith(suffix) && host.length > suffix.length;\n    }\n    return false;\n  });\n}\n\nfunction matchesPath(tenant: AccessiTenant, path: string): boolean {\n  if (!tenant.path) return false;\n  if (tenant.path === '/') return true;\n  return path === tenant.path || path.startsWith(`${tenant.path}/`);\n}\n\n/** Prefisso Redis consigliato per isolare gli store del tenant. */\nexport function getAccessiTenantRedisPrefix(tenantId: string): string {\n  return `accessi:${tenantId}:`;\n}\n\n/**\n * Converte la configurazione tipizzata in `AccessiOptions`.\n *\n * Applica i default di Firebird e collega `tenantId`; non crea store o sink,\n * che restano responsabilita del backend ospitante.\n */\nexport function accessiOptionsFromTenantEnvironment(\n  environment: AccessiTenantEnvironment,\n): AccessiOptions {\n  const database = environment.database;\n  const databaseOptions: Options = {\n    host: database.host,\n    port: database.port ?? 3050,\n    database: database.database,\n    user: database.user ?? 'SYSDBA',\n    password: database.password ?? 'masterkey',\n    ...(database.pluginName ? { pluginName: database.pluginName } : {}),\n    ...(database.wireCrypt === 'disabled'\n      ? { wireCrypt: WIRE_CRYPT_DISABLE }\n      : database.wireCrypt === 'optional'\n        ? { wireCrypt: WIRE_CRYPT_ENABLE }\n        : {}),\n  };\n\n  return {\n    databaseOptions,\n    confirmationEmailUrl: environment.confirmationEmailUrl,\n    confirmationEmailReturnUrl: environment.confirmationEmailReturnUrl,\n    ...(environment.confirmationEmailPrefix ? { confirmationEmailPrefix: environment.confirmationEmailPrefix } : {}),\n    ...(environment.customResetPage ? { customResetPage: environment.customResetPage } : {}),\n    ...(environment.publicBaseUrl ? { publicBaseUrl: environment.publicBaseUrl } : {}),\n    ...(environment.consoleApiBaseUrl ? { consoleApiBaseUrl: environment.consoleApiBaseUrl } : {}),\n    encryptionKey: environment.encryptionKey,\n    mockDemoUser: environment.mockDemoUser ?? false,\n    ...(environment.passwordExpiration !== undefined ? { passwordExpiration: environment.passwordExpiration } : {}),\n    ...(environment.passwordExpirationDays !== undefined ? { passwordExpirationDays: environment.passwordExpirationDays } : {}),\n    ...(environment.legacyPasswordMigrationOnStartup !== undefined\n      ? { legacyPasswordMigrationOnStartup: environment.legacyPasswordMigrationOnStartup }\n      : {}),\n    ...(environment.autoUpdateDatabase !== undefined ? { autoUpdateDatabase: environment.autoUpdateDatabase } : {}),\n    jwtOptions: environment.jwt,\n    emailOptions: environment.email,\n    ...(environment.http ? { http: environment.http } : {}),\n    ...(environment.authCookie ? { authCookie: environment.authCookie } : {}),\n    ...(environment.publicAuthRateLimit ? { publicAuthRateLimit: environment.publicAuthRateLimit } : {}),\n    ...(environment.publicRegistration ? { publicRegistration: environment.publicRegistration } : {}),\n    ...(environment.federatedAuthentication ? { federatedAuthentication: environment.federatedAuthentication } : {}),\n    ...(environment.extensionFieldsOptions ? { extensionFieldsOptions: environment.extensionFieldsOptions } : {}),\n    ...(environment.serviceTokens ? { serviceTokens: environment.serviceTokens } : {}),\n    ...(environment.catalogScripts ? { catalogScripts: environment.catalogScripts } : {}),\n    ...(environment.systemSeeds ? { systemSeeds: environment.systemSeeds } : {}),\n    ...(environment.adminBootstrap ? { adminBootstrap: environment.adminBootstrap } : {}),\n    ...(environment.openapi ? { openapi: environment.openapi } : {}),\n    ...(environment.consoleEntry ? { consoleEntry: environment.consoleEntry } : {}),\n    ...(environment.edgeRateLimit ? { edgeRateLimit: environment.edgeRateLimit } : {}),\n    ...(environment.sessionRevocation ? { sessionRevocation: environment.sessionRevocation } : {}),\n    ...(environment.accessTokenRevocation ? { accessTokenRevocation: environment.accessTokenRevocation } : {}),\n    ...(environment.refreshTokenRotation ? { refreshTokenRotation: environment.refreshTokenRotation } : {}),\n    ...(environment.metrics ? { metrics: environment.metrics } : {}),\n    ...(environment.audit ? { audit: environment.audit } : {}),\n    ...(environment.bufferLogs !== undefined ? { bufferLogs: environment.bufferLogs } : {}),\n    tenantId: environment.tenant.id,\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction runtimeIssues(environment: unknown, file: string): string[] {\n  const issues: string[] = [];\n  if (!isRecord(environment)) {\n    return [`${file}: il file deve esportare un oggetto (default export o export environment).`];\n  }\n  const tenant = environment.tenant;\n  if (!isRecord(tenant)) {\n    issues.push(`${file}: tenant mancante.`);\n  } else {\n    if (typeof tenant.id !== 'string' || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(tenant.id)) {\n      issues.push(`${file}: tenant.id non valido (minuscole, numeri, - e _, max 63).`);\n    }\n    if (tenant.hosts !== undefined && (!Array.isArray(tenant.hosts) || tenant.hosts.some((host) => typeof host !== 'string'))) {\n      issues.push(`${file}: tenant.hosts deve essere un array di stringhe.`);\n    }\n    if (tenant.path !== undefined && typeof tenant.path !== 'string') {\n      issues.push(`${file}: tenant.path deve essere una stringa.`);\n    }\n    if (\n      tenant.port !== undefined\n      && (typeof tenant.port !== 'number' || !Number.isInteger(tenant.port) || tenant.port < 1 || tenant.port > 65535)\n    ) {\n      issues.push(`${file}: tenant.port non valida.`);\n    }\n  }\n\n  const database = environment.database;\n  if (!isRecord(database)) {\n    issues.push(`${file}: database mancante.`);\n  } else {\n    if (typeof database.host !== 'string' || database.host.trim() === '') {\n      issues.push(`${file}: database.host obbligatorio.`);\n    }\n    if (typeof database.database !== 'string' || database.database.trim() === '') {\n      issues.push(`${file}: database.database obbligatorio.`);\n    }\n    if (\n      database.port !== undefined\n      && (typeof database.port !== 'number' || !Number.isInteger(database.port) || database.port < 1 || database.port > 65535)\n    ) {\n      issues.push(`${file}: database.port non valida.`);\n    }\n  }\n\n  if (!isRecord(environment.jwt)) issues.push(`${file}: jwt mancante.`);\n  else {\n    if (typeof environment.jwt.secret !== 'string' || environment.jwt.secret === '') {\n      issues.push(`${file}: jwt.secret obbligatorio.`);\n    }\n    if (typeof environment.jwt.expiresIn !== 'string' || environment.jwt.expiresIn === '') {\n      issues.push(`${file}: jwt.expiresIn obbligatorio.`);\n    }\n  }\n\n  if (!isRecord(environment.email)) issues.push(`${file}: email mancante.`);\n  if (typeof environment.encryptionKey !== 'string' || environment.encryptionKey === '') {\n    issues.push(`${file}: encryptionKey obbligatoria.`);\n  }\n  if (typeof environment.confirmationEmailUrl !== 'string') {\n    issues.push(`${file}: confirmationEmailUrl obbligatoria.`);\n  }\n  if (typeof environment.confirmationEmailReturnUrl !== 'string') {\n    issues.push(`${file}: confirmationEmailReturnUrl obbligatoria.`);\n  }\n  return issues;\n}\n\nfunction loadEnvironmentModule(file: string): unknown {\n  if (/\\.(ts|mts|cts)$/i.test(file)) {\n    // Caricamento lazy: jiti serve solo ai file tenant TypeScript.\n    const { createJiti } = require('jiti') as {\n      createJiti: (\n        id: string,\n        options?: { interopDefault?: boolean; moduleCache?: boolean; fsCache?: boolean },\n      ) => (id: string) => unknown;\n    };\n    const jiti = createJiti(file, { interopDefault: true, moduleCache: false, fsCache: false });\n    return jiti(file);\n  }\n  return require(file);\n}\n\n/**\n * Carica un singolo file `*.environment.ts`.\n *\n * Usa jiti per eseguire TypeScript anche nel pacchetto compilato, senza\n * richiedere un passo di build separato per i file tenant.\n */\nexport function loadAccessiTenantEnvironmentFile(file: string): { tenant: AccessiTenant; environment: AccessiTenantEnvironment } {\n  const absolute = resolve(file);\n  let loaded: unknown;\n  try {\n    loaded = loadEnvironmentModule(absolute);\n  } catch (error) {\n    throw new AccessiTenantConfigurationError([\n      `${basename(file)}: impossibile caricare il file (${error instanceof Error ? error.message : String(error)}).`,\n    ]);\n  }\n\n  const record = isRecord(loaded) ? loaded : {};\n  const environment = (record.default ?? record.environment ?? loaded) as unknown;\n  const issues = runtimeIssues(environment, basename(file));\n  if (issues.length > 0) throw new AccessiTenantConfigurationError(issues);\n\n  const typed = environment as AccessiTenantEnvironment;\n  const settings = typed.tenant;\n  const options = accessiOptionsFromTenantEnvironment(typed);\n  const validation = validateAccessiOptions(options);\n  const validationIssues = validation.errors.map((issue) => `${basename(file)}: ${issue.code}: ${issue.message}`);\n  if (validationIssues.length > 0) throw new AccessiTenantConfigurationError(validationIssues);\n\n  const hosts = (settings.hosts ?? []).map(normalizeHost).filter(Boolean);\n  const path = normalizeTenantPath(settings.path);\n  if (hosts.length === 0 && !path) {\n    throw new AccessiTenantConfigurationError([\n      `${basename(file)}: configurare tenant.hosts oppure tenant.path.`,\n    ]);\n  }\n\n  const tenant: AccessiTenant = {\n    id: settings.id,\n    hosts,\n    ...(path ? { path } : {}),\n    enabled: settings.enabled !== false,\n    ...(settings.description ? { description: settings.description } : {}),\n    ...(settings.port ? { port: settings.port } : {}),\n    file: basename(file),\n    environmentFile: absolute,\n    options,\n  };\n  return { tenant, environment: typed };\n}\n\n/**\n * Carica i tenant da una cartella di file `<id>.environment.ts`.\n *\n * La validazione e aggregata: un errore blocca l'intera cartella, cosi non si\n * avvia un tenant con configurazione parziale. Nessun segreto viene stampato.\n */\nexport function loadAccessiTenants(options: LoadAccessiTenantsOptions): AccessiTenantRegistry {\n  if (!options?.directory) throw new Error('loadAccessiTenants: directory obbligatoria.');\n  const directory = resolve(options.directory);\n  const issues: string[] = [];\n  const warnings: string[] = [];\n\n  let files: string[];\n  try {\n    files = readdirSync(directory, { withFileTypes: true })\n      .filter((entry) => entry.isFile() && /\\.environment\\.(ts|mts|cts|js|mjs|cjs)$/.test(entry.name))\n      .map((entry) => entry.name)\n      .sort();\n  } catch (error) {\n    throw new AccessiTenantConfigurationError([\n      `Cartella tenant non leggibile (${directory}): ${error instanceof Error ? error.message : String(error)}`,\n    ]);\n  }\n  if (files.length === 0) {\n    throw new AccessiTenantConfigurationError([`Nessun file *.environment.ts nella cartella ${directory}.`]);\n  }\n\n  const tenants: AccessiTenant[] = [];\n  for (const file of files) {\n    try {\n      tenants.push(loadAccessiTenantEnvironmentFile(join(directory, file)).tenant);\n    } catch (error) {\n      if (error instanceof AccessiTenantConfigurationError) issues.push(...error.issues);\n      else issues.push(`${file}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n\n  const byId = new Map<string, AccessiTenant>();\n  const hostsSeen = new Map<string, string>();\n  const pathsSeen = new Map<string, string>();\n  const jwtSecrets = new Map<string, string>();\n  const issuerAudience = new Map<string, string>();\n  for (const tenant of tenants) {\n    if (byId.has(tenant.id)) {\n      issues.push(`Tenant duplicato \"${tenant.id}\" (${tenant.file} e ${byId.get(tenant.id)?.file}).`);\n    } else {\n      byId.set(tenant.id, tenant);\n    }\n    for (const host of tenant.hosts) {\n      const existing = hostsSeen.get(host);\n      if (existing) issues.push(`Host \"${host}\" assegnato a \"${existing}\" e \"${tenant.id}\".`);\n      else hostsSeen.set(host, tenant.id);\n    }\n    if (tenant.path) {\n      const existing = pathsSeen.get(tenant.path);\n      if (existing) issues.push(`Path \"${tenant.path}\" assegnato a \"${existing}\" e \"${tenant.id}\".`);\n      else pathsSeen.set(tenant.path, tenant.id);\n    }\n\n    // Un segreto JWT condiviso rende un token valido su piu tenant.\n    const signingKey = tenant.options.jwtOptions.privateKey ?? tenant.options.jwtOptions.secret;\n    const fingerprintKey = `${tenant.options.jwtOptions.algorithm ?? 'HS256'}|${signingKey}`;\n    const existingKey = jwtSecrets.get(fingerprintKey);\n    if (existingKey) {\n      issues.push(`Chiave JWT condivisa tra \"${existingKey}\" e \"${tenant.id}\": usare segreti distinti.`);\n    } else {\n      jwtSecrets.set(fingerprintKey, tenant.id);\n    }\n\n    const issuer = tenant.options.jwtOptions.issuer ?? '(assente)';\n    const audience = Array.isArray(tenant.options.jwtOptions.audience)\n      ? tenant.options.jwtOptions.audience.join(',')\n      : (tenant.options.jwtOptions.audience ?? '(assente)');\n    const issuerKey = `${issuer}|${audience}`;\n    const existingIssuer = issuerAudience.get(issuerKey);\n    if (existingIssuer && options.allowSharedIssuer !== true) {\n      warnings.push(`Issuer/audience \"${issuerKey}\" condivisi tra \"${existingIssuer}\" e \"${tenant.id}\".`);\n    } else {\n      issuerAudience.set(issuerKey, tenant.id);\n    }\n  }\n\n  const enabled = tenants.filter((tenant) => tenant.enabled);\n  if (enabled.length > 1) {\n    const defaultTenant = enabled.find((tenant) => tenant.hosts.length === 0 && tenant.path === '/');\n    if (defaultTenant) {\n      issues.push(`Tenant \"${defaultTenant.id}\" intercetta tutte le richieste (path \"/\") insieme ad altri tenant.`);\n    }\n  }\n\n  if (issues.length > 0) throw new AccessiTenantConfigurationError(issues);\n\n  const registry: AccessiTenantRegistry = {\n    directory,\n    tenants,\n    warnings,\n    allowHeader: options.allowHeader === true,\n    byId,\n    resolve(input, resolveOptions) {\n      const allowHeader = resolveOptions?.allowHeader ?? registry.allowHeader;\n      const host = input.host ? normalizeHost(input.host.split(':')[0] ?? input.host) : undefined;\n      if (host) {\n        const byHost = enabled.find((tenant) => matchesHost(tenant, host));\n        if (byHost) return { tenant: byHost, matchedBy: 'host' };\n      }\n\n      const requestPath = input.path ?? '/';\n      const byPath = enabled\n        .filter((tenant) => matchesPath(tenant, requestPath))\n        .sort((left, right) => (right.path?.length ?? 0) - (left.path?.length ?? 0))[0];\n      if (byPath && byPath.path !== '/') return { tenant: byPath, matchedBy: 'path' };\n\n      if (allowHeader && input.header) {\n        const headerId = input.header.trim().toLowerCase();\n        const tenant = byId.get(headerId);\n        if (tenant?.enabled) return { tenant, matchedBy: 'header' };\n      }\n\n      if (byPath) return { tenant: byPath, matchedBy: 'path' };\n      return undefined;\n    },\n    summary() {\n      return tenants.map((tenant) => {\n        const database = tenant.options.databaseOptions as {\n          host?: string;\n          port?: number;\n          database?: string;\n          user?: string;\n        };\n        return {\n          id: tenant.id,\n          hosts: [...tenant.hosts],\n          ...(tenant.path ? { path: tenant.path } : {}),\n          enabled: tenant.enabled,\n          ...(tenant.description ? { description: tenant.description } : {}),\n          ...(tenant.port ? { port: tenant.port } : {}),\n          file: tenant.file,\n          database: {\n            host: database.host,\n            port: database.port,\n            database: database.database,\n            user: database.user,\n          },\n          issuer: tenant.options.jwtOptions.issuer,\n          ...(tenant.options.jwtOptions.audience\n            ? {\n                audience: typeof tenant.options.jwtOptions.audience === 'string'\n                  ? tenant.options.jwtOptions.audience\n                  : tenant.options.jwtOptions.audience.join(','),\n              }\n            : {}),\n          jwtAlgorithm: tenant.options.jwtOptions.algorithm ?? 'HS256',\n          refreshEnabled: Boolean(tenant.options.jwtOptions.refreshExpiresIn),\n        };\n      });\n    },\n  };\n\n  return registry;\n}\n"]}

package/dist/accessi/ui/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Asset UI frameworkless pubblicati con il pacchetto.
+ *
+ * I componenti sono Web Components senza dipendenze runtime: vanno inclusi
+ * come `<script>` o copiati nel build dell'app. I percorsi sono relativi alla
+ * root del pacchetto distribuito (`dist/`).
+ */
+export declare const ACCESSI_UI_ASSETS: {
+    readonly areeDisponibili: "angular-components/aree-disponibili/aree-disponibili.js";
+};
+export type AccessiUiComponent = keyof typeof ACCESSI_UI_ASSETS;
+/** Restituisce il path dell'asset UI relativo a `dist/`. */
+export declare function getAccessiUiAssetPath(component: AccessiUiComponent): string;

package/dist/accessi/ui/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESSI_UI_ASSETS = void 0;
+exports.getAccessiUiAssetPath = getAccessiUiAssetPath;
+/**
+ * Asset UI frameworkless pubblicati con il pacchetto.
+ *
+ * I componenti sono Web Components senza dipendenze runtime: vanno inclusi
+ * come `<script>` o copiati nel build dell'app. I percorsi sono relativi alla
+ * root del pacchetto distribuito (`dist/`).
+ */
+exports.ACCESSI_UI_ASSETS = {
+    areeDisponibili: "angular-components/aree-disponibili/aree-disponibili.js",
+};
+/** Restituisce il path dell'asset UI relativo a `dist/`. */
+function getAccessiUiAssetPath(component) {
+    return exports.ACCESSI_UI_ASSETS[component];
+}
+//# sourceMappingURL=index.js.map

package/dist/accessi/ui/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/ui/index.ts"],"names":[],"mappings":";;;AAcA,sDAEC;AAhBD;;;;;;GAMG;AACU,QAAA,iBAAiB,GAAG;IAC/B,eAAe,EAAE,yDAAyD;CAClE,CAAC;AAIX,4DAA4D;AAC5D,SAAgB,qBAAqB,CAAC,SAA6B;IACjE,OAAO,yBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Asset UI frameworkless pubblicati con il pacchetto.\n *\n * I componenti sono Web Components senza dipendenze runtime: vanno inclusi\n * come `<script>` o copiati nel build dell'app. I percorsi sono relativi alla\n * root del pacchetto distribuito (`dist/`).\n */\nexport const ACCESSI_UI_ASSETS = {\n  areeDisponibili: \"angular-components/aree-disponibili/aree-disponibili.js\",\n} as const;\n\nexport type AccessiUiComponent = keyof typeof ACCESSI_UI_ASSETS;\n\n/** Restituisce il path dell'asset UI relativo a `dist/`. */\nexport function getAccessiUiAssetPath(component: AccessiUiComponent): string {\n  return ACCESSI_UI_ASSETS[component];\n}\n"]}