emilsoftware-utilities 2.0.0-dev.80 → 2.0.0-dev.82

package/deploy/README.md

@@ -0,0 +1,45 @@
+# Template di deployment multi-tenant
+
+File pronti da adattare. Non contengono segreti reali: usare `<placeholder>` o
+variabili d'ambiente/secret manager.
+
+| Percorso | Uso |
+| --- | --- |
+| `systemd/accessi-tenant@.service` | unità template, una istanza per tenant |
+| `systemd/tenant.secrets.example` | soli segreti, permessi `0600` |
+| `docker/docker-compose.yml` | due tenant con volumi config read-only |
+| `nginx/accessi-tenants.conf` | routing per host e variante path |
+| `traefik/dynamic.yml` | routing host, header e health check |
+
+## Flusso
+
+1. Creare `tenants/<id>.environment.ts` (vedi `docs/multi-tenancy.md`).
+2. Validare: `npm run accessi:tenants -- --dir ./tenants --check`.
+3. Preparare i segreti fuori dal repository (`/etc/accessi/tenants/<id>.secrets`
+   o `secrets/<id>.env` con permessi `0600`).
+4. Avviare il processo con `ACCESSI_TENANT_ENVIRONMENT` e, se serve,
+   `PORT`/`ACCESSI_TENANT_ID`.
+5. Configurare il proxy sull'host o sul path del tenant.
+6. Verificare `/health/live`, `/health/ready` e `/health/metrics`.
+
+La porta predefinita è `tenant.port`; `PORT` ha precedenza. I template non
+pubblicano le porte interne: il proxy è l'unico punto esposto.
+
+## Variante path
+
+Per `tenant.path = '/acme'` il proxy deve rimuovere `/acme` prima di inoltrare
+(vedi `nginx/accessi-tenants.conf` e `traefik/dynamic.yml`). In alternativa
+servire ogni tenant su un host dedicato.
+
+## Sicurezza
+
+- Non committare `.secrets`/`secrets/*.env`.
+- Montare la cartella configurazione in read-only.
+- `read_only: true`, `no-new-privileges`, utente non root (immagine
+  personalizzata) e `ProtectSystem=strict` nell'unità systemd.
+- Non usare l'header `x-accessi-tenant` dal client: solo il proxy può
+  impostarlo, con `allowHeader: true` lato router.
+- Un processo per tenant: non condividere `AccessiModule` tra tenant diversi.
+
+La CI esegue `npm run check:deploy` per verificare presenza e coerenza dei
+template e l'assenza di segreti.

package/deploy/docker/docker-compose.yml

@@ -0,0 +1,51 @@
+# Accessi multi-tenant con Docker Compose.
+#
+# I file *.environment.ts sono montati read-only; i segreti arrivano da
+# env_file esterni al repository. La porta viene da tenant.port; PORT puo
+# sovrascriverla.
+version: "3.9"
+
+x-accessi-tenant: &accessi-tenant
+  image: emilsoftware/accessi:2
+  restart: unless-stopped
+  read_only: true
+  tmpfs:
+    - /tmp
+  security_opt:
+    - no-new-privileges:true
+  healthcheck:
+    test:
+      - CMD-SHELL
+      - >-
+        node -e "fetch('http://127.0.0.1:' + (process.env.PORT || '3200') + '/health/live')
+        .then((response) => process.exit(response.ok ? 0 : 1))
+        .catch(() => process.exit(1))"
+    interval: 15s
+    timeout: 5s
+    retries: 5
+    start_period: 30s
+
+services:
+  accessi-acme:
+    <<: *accessi-tenant
+    environment:
+      ACCESSI_TENANT_ENVIRONMENT: /config/acme.environment.ts
+      ACCESSI_TENANT_ID: acme
+    env_file:
+      - ./secrets/acme.env
+    volumes:
+      - ./tenants:/config:ro
+    ports:
+      - "127.0.0.1:3201:3201"
+
+  accessi-beta:
+    <<: *accessi-tenant
+    environment:
+      ACCESSI_TENANT_ENVIRONMENT: /config/beta.environment.ts
+      ACCESSI_TENANT_ID: beta
+    env_file:
+      - ./secrets/beta.env
+    volumes:
+      - ./tenants:/config:ro
+    ports:
+      - "127.0.0.1:3202:3202"

package/deploy/nginx/accessi-tenants.conf

@@ -0,0 +1,41 @@
+# Accessi multi-tenant dietro Nginx.
+#
+# Ogni tenant ha un processo sulla propria porta interna. Il proxy instrada per
+# host e non espone mai le porte interne. Sostituire i domini e le porte.
+
+map $host $accessi_tenant_upstream {
+    accessi.acme.example.com  http://127.0.0.1:3201;
+    accessi.beta.example.com  http://127.0.0.1:3202;
+    default                   http://127.0.0.1:3201;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name accessi.acme.example.com accessi.beta.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/accessi.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/accessi.example.com/privkey.pem;
+
+    client_max_body_size 10m;
+
+    location / {
+        proxy_pass $accessi_tenant_upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_read_timeout 60s;
+    }
+}
+
+# Variante path-based: il prefix /acme viene rimosso prima di inoltrare ad
+# Accessi, che serve il tenant alla radice.
+#
+# location /acme/ {
+#     rewrite ^/acme/(.*)$ /$1 break;
+#     proxy_pass http://127.0.0.1:3201;
+#     proxy_set_header Host $host;
+#     proxy_set_header X-Forwarded-Proto $scheme;
+# }

package/deploy/systemd/accessi-tenant@.service

@@ -0,0 +1,46 @@
+# Accessi multi-tenant con systemd
+#
+# Installazione:
+#   cp deploy/systemd/accessi-tenant@.service /etc/systemd/system/
+#   mkdir -p /etc/accessi/tenants
+#   cp tenants/acme.environment.ts /etc/accessi/tenants/acme.environment.ts
+#   install -m 0600 deploy/systemd/tenant.secrets.example /etc/accessi/tenants/acme.secrets
+#   systemctl daemon-reload
+#   systemctl enable --now accessi-tenant@acme
+#
+# La porta viene letta da tenant.port nel file *.environment.ts. Per forzarla:
+#   systemctl edit accessi-tenant@acme
+#   [Service]
+#   Environment=PORT=3201
+
+[Unit]
+Description=Accessi Service tenant %i
+Documentation=file:///opt/accessi/docs/multi-tenancy.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/accessi
+# Solo segreti (password DB, SMTP, chiavi JWT): il manifest tipizzato e' separato.
+EnvironmentFile=-/etc/accessi/tenants/%i.secrets
+Environment=ACCESSI_TENANT_ENVIRONMENT=/etc/accessi/tenants/%i.environment.ts
+Environment=ACCESSI_TENANT_ID=%i
+
+ExecStart=/usr/bin/node /opt/accessi/dist/scripts/startAccessiTenantService.js
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=30
+KillSignal=SIGTERM
+
+User=accessi
+Group=accessi
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/accessi
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target

package/deploy/systemd/tenant.secrets.example

@@ -0,0 +1,11 @@
+# Esempio di file segreti per un tenant systemd.
+# Copiare in /etc/accessi/tenants/<id>.secrets con permessi 0600.
+# Non committare valori reali.
+
+ACME_DB_PASSWORD=<db-password>
+ACME_JWT_SECRET=<jwt-secret-almeno-32-caratteri>
+ACME_JWT_PRIVATE_KEY=<pem-su-una-riga-con-\n>
+ACME_JWT_PUBLIC_KEY=<pem-su-una-riga-con-\n>
+ACME_ENCRYPTION_KEY=<32-caratteri-casuali>
+ACME_SMTP_USER=<smtp-user>
+ACME_SMTP_PASSWORD=<smtp-password>

package/deploy/traefik/dynamic.yml

@@ -0,0 +1,57 @@
+# Accessi multi-tenant con Traefik (file provider).
+#
+# I servizi Accessi ascoltano su porte interne; Traefik termina TLS e instrada
+# per host. Per la variante path usare un middleware StripPrefix.
+
+http:
+  routers:
+    accessi-acme:
+      rule: Host(`accessi.acme.example.com`)
+      entryPoints:
+        - websecure
+      tls: {}
+      service: accessi-acme
+      middlewares:
+        - accessi-headers
+
+    accessi-beta:
+      rule: Host(`accessi.beta.example.com`)
+      entryPoints:
+        - websecure
+      tls: {}
+      service: accessi-beta
+      middlewares:
+        - accessi-headers
+
+  middlewares:
+    accessi-headers:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        contentTypeNosniff: true
+        referrerPolicy: no-referrer
+        customResponseHeaders:
+          Permissions-Policy: "camera=(), microphone=(), geolocation=()"
+    # Variante path-based:
+    # accessi-strip-acme:
+    #   stripPrefix:
+    #     prefixes:
+    #       - /acme
+
+  services:
+    accessi-acme:
+      loadBalancer:
+        healthCheck:
+          path: /health/ready
+          interval: 15s
+          timeout: 3s
+        servers:
+          - url: http://127.0.0.1:3201
+    accessi-beta:
+      loadBalancer:
+        healthCheck:
+          path: /health/ready
+          interval: 15s
+          timeout: 3s
+        servers:
+          - url: http://127.0.0.1:3202

package/dist/accessi/server/index.d.ts

@@ -8,5 +8,6 @@
 export * from "../../accessi-module";
 export * from "./standalone";
 export * from "./tenants";
+export * from "./tenantStores";
 export type { AccessiOptions as AccessiServerOptions } from "../../accessi-module";
 export { createAccessiOptionsFromEnv, createCatalogScriptsOptionsFromEnv, parseAccessiPreviousPublicKeys, } from "../../accessi-module/database-updates/accessiOptionsFromEnv";

package/dist/accessi/server/index.js

@@ -25,6 +25,7 @@ exports.parseAccessiPreviousPublicKeys = exports.createCatalogScriptsOptionsFrom
 __exportStar(require("../../accessi-module"), exports);
 __exportStar(require("./standalone"), exports);
 __exportStar(require("./tenants"), exports);
+__exportStar(require("./tenantStores"), exports);
 var accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
 Object.defineProperty(exports, "createAccessiOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createAccessiOptionsFromEnv; } });
 Object.defineProperty(exports, "createCatalogScriptsOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createCatalogScriptsOptionsFromEnv; } });

package/dist/accessi/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AACrC,+CAA6B;AAC7B,4CAA0B;AAE1B,qGAIqE;AAHnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA;AAClC,uIAAA,8BAA8B,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport * from \"./standalone\";\nexport * from \"./tenants\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n  parseAccessiPreviousPublicKeys,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AACrC,+CAA6B;AAC7B,4CAA0B;AAC1B,iDAA+B;AAE/B,qGAIqE;AAHnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA;AAClC,uIAAA,8BAA8B,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport * from \"./standalone\";\nexport * from \"./tenants\";\nexport * from \"./tenantStores\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n  parseAccessiPreviousPublicKeys,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}

package/dist/accessi/server/tenantStores.d.ts

@@ -0,0 +1,74 @@
+import type { AccessiOptions } from '../../accessi-module/AccessiModule';
+import type { RateLimitStore } from '../../accessi-module/security/rateLimitStore';
+import type { ConsoleEntryStore } from '../../accessi-module/security/consoleEntry';
+import type { SessionRevocationStore } from '../../accessi-module/security/sessionRevocation';
+import type { AccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';
+import type { RefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';
+/** Client Redis minimo accettato dagli store Accessi. */
+export interface AccessiTenantRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+/** Prefissi Redis per singolo store, tutti relativi al tenant. */
+export interface AccessiTenantStorePrefixes {
+    base?: string;
+    rateLimit?: string;
+    serviceTokenRateLimit?: string;
+    sessionRevocation?: string;
+    accessTokenRevocation?: string;
+    refreshTokenRotation?: string;
+    refreshTokenFamily?: string;
+    consoleEntry?: string;
+}
+export interface ResolvedAccessiTenantStorePrefixes {
+    base: string;
+    rateLimit: string;
+    serviceTokenRateLimit: string;
+    sessionRevocation: string;
+    accessTokenRevocation: string;
+    refreshTokenRotation: string;
+    refreshTokenFamily: string;
+    consoleEntry: string;
+}
+export interface CreateAccessiTenantStoresOptions {
+    tenantId: string;
+    client: AccessiTenantRedisClient;
+    /** Segreto per cifrare i ticket console a riposo. Usare un segreto del tenant. */
+    encryptionKey: string | Buffer;
+    /** Base prefix. Default: `accessi:<tenantId>:`. */
+    prefix?: string;
+    prefixes?: AccessiTenantStorePrefixes;
+    /** TTL revoca sessioni. Default dello store (365 giorni). */
+    sessionRevocationTtlMs?: number;
+    /** TTL revoca jti. Default dello store (24 ore). */
+    accessTokenRevocationTtlMs?: number;
+    consoleEntryMaxIssueAttempts?: number;
+    /** Attiva la rotazione refresh token nell'options risultante. Default: true. */
+    enableRefreshTokenRotation?: boolean;
+}
+export interface AccessiTenantStores {
+    tenantId: string;
+    prefixes: ResolvedAccessiTenantStorePrefixes;
+    rateLimit: RateLimitStore;
+    serviceTokenRateLimit: RateLimitStore;
+    sessionRevocation: SessionRevocationStore;
+    accessTokenRevocation: AccessTokenRevocationStore;
+    refreshTokenRotation: RefreshTokenRotationStore;
+    consoleEntry: ConsoleEntryStore;
+    /** Collega tutti gli store alle opzioni Accessi del tenant. */
+    applyTo(options: AccessiOptions): AccessiOptions;
+}
+/**
+ * Prefissi Redis isolati per tenant.
+ *
+ * Ogni store ha un namespace distinto: condividere un prefisso tra tenant
+ * significherebbe condividere rate limit, revoche o refresh token.
+ */
+export declare function getAccessiTenantStorePrefixes(tenantId: string, overrides?: AccessiTenantStorePrefixes): ResolvedAccessiTenantStorePrefixes;
+/**
+ * Crea tutti gli store Redis di un tenant con prefissi gia isolati.
+ *
+ * `applyTo` restituisce una copia delle opzioni con gli store collegati:
+ * `publicAuthRateLimit`, `serviceTokens`, `sessionRevocation`,
+ * `accessTokenRevocation`, `refreshTokenRotation` e `consoleEntry`.
+ */
+export declare function createAccessiTenantStores(options: CreateAccessiTenantStoresOptions): AccessiTenantStores;

package/dist/accessi/server/tenantStores.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccessiTenantStorePrefixes = getAccessiTenantStorePrefixes;
+exports.createAccessiTenantStores = createAccessiTenantStores;
+const tenants_1 = require("./tenants");
+const rateLimitStore_1 = require("../../accessi-module/security/rateLimitStore");
+const consoleEntry_1 = require("../../accessi-module/security/consoleEntry");
+const sessionRevocation_1 = require("../../accessi-module/security/sessionRevocation");
+const accessTokenRevocation_1 = require("../../accessi-module/security/accessTokenRevocation");
+const refreshTokenRotation_1 = require("../../accessi-module/security/refreshTokenRotation");
+/**
+ * Prefissi Redis isolati per tenant.
+ *
+ * Ogni store ha un namespace distinto: condividere un prefisso tra tenant
+ * significherebbe condividere rate limit, revoche o refresh token.
+ */
+function getAccessiTenantStorePrefixes(tenantId, overrides = {}) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    const base = (_a = overrides.base) !== null && _a !== void 0 ? _a : (0, tenants_1.getAccessiTenantRedisPrefix)(tenantId);
+    return {
+        base,
+        rateLimit: (_b = overrides.rateLimit) !== null && _b !== void 0 ? _b : `${base}rate:`,
+        serviceTokenRateLimit: (_c = overrides.serviceTokenRateLimit) !== null && _c !== void 0 ? _c : `${base}service-token-rate:`,
+        sessionRevocation: (_d = overrides.sessionRevocation) !== null && _d !== void 0 ? _d : `${base}session:`,
+        accessTokenRevocation: (_e = overrides.accessTokenRevocation) !== null && _e !== void 0 ? _e : `${base}jti:`,
+        refreshTokenRotation: (_f = overrides.refreshTokenRotation) !== null && _f !== void 0 ? _f : `${base}refresh:`,
+        refreshTokenFamily: (_g = overrides.refreshTokenFamily) !== null && _g !== void 0 ? _g : `${base}refresh-family:`,
+        consoleEntry: (_h = overrides.consoleEntry) !== null && _h !== void 0 ? _h : `${base}console-entry:`,
+    };
+}
+/**
+ * Crea tutti gli store Redis di un tenant con prefissi gia isolati.
+ *
+ * `applyTo` restituisce una copia delle opzioni con gli store collegati:
+ * `publicAuthRateLimit`, `serviceTokens`, `sessionRevocation`,
+ * `accessTokenRevocation`, `refreshTokenRotation` e `consoleEntry`.
+ */
+function createAccessiTenantStores(options) {
+    var _a;
+    if (!(options === null || options === void 0 ? void 0 : options.tenantId) || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(options.tenantId)) {
+        throw new Error('createAccessiTenantStores: tenantId non valido.');
+    }
+    if (!options.client || typeof options.client.eval !== 'function') {
+        throw new Error('createAccessiTenantStores: client.eval non configurato.');
+    }
+    const encryptionKey = options.encryptionKey;
+    if (encryptionKey === undefined || encryptionKey === null || encryptionKey.length === 0) {
+        throw new Error('createAccessiTenantStores: encryptionKey obbligatoria per i ticket console.');
+    }
+    const prefixes = getAccessiTenantStorePrefixes(options.tenantId, Object.assign(Object.assign({}, (options.prefix ? { base: options.prefix } : {})), ((_a = options.prefixes) !== null && _a !== void 0 ? _a : {})));
+    const { client } = options;
+    const enableRefreshTokenRotation = options.enableRefreshTokenRotation !== false;
+    const rateLimit = (0, rateLimitStore_1.createRedisRateLimitStore)({ client, keyPrefix: prefixes.rateLimit });
+    const serviceTokenRateLimit = (0, rateLimitStore_1.createRedisRateLimitStore)({
+        client,
+        keyPrefix: prefixes.serviceTokenRateLimit,
+    });
+    const sessionRevocation = (0, sessionRevocation_1.createRedisSessionRevocationStore)(Object.assign({ client, keyPrefix: prefixes.sessionRevocation }, (options.sessionRevocationTtlMs !== undefined ? { ttlMs: options.sessionRevocationTtlMs } : {})));
+    const accessTokenRevocation = (0, accessTokenRevocation_1.createRedisAccessTokenRevocationStore)(Object.assign({ client, keyPrefix: prefixes.accessTokenRevocation }, (options.accessTokenRevocationTtlMs !== undefined ? { ttlMs: options.accessTokenRevocationTtlMs } : {})));
+    const refreshTokenRotation = (0, refreshTokenRotation_1.createRedisRefreshTokenRotationStore)({
+        client,
+        keyPrefix: prefixes.refreshTokenRotation,
+        familyKeyPrefix: prefixes.refreshTokenFamily,
+    });
+    const consoleEntry = (0, consoleEntry_1.createRedisConsoleEntryStore)(Object.assign({ client,
+        encryptionKey, keyPrefix: prefixes.consoleEntry }, (options.consoleEntryMaxIssueAttempts !== undefined
+        ? { maxIssueAttempts: options.consoleEntryMaxIssueAttempts }
+        : {})));
+    return {
+        tenantId: options.tenantId,
+        prefixes,
+        rateLimit,
+        serviceTokenRateLimit,
+        sessionRevocation,
+        accessTokenRevocation,
+        refreshTokenRotation,
+        consoleEntry,
+        applyTo(accessiOptions) {
+            var _a, _b;
+            return Object.assign(Object.assign({}, accessiOptions), { tenantId: options.tenantId, publicAuthRateLimit: Object.assign(Object.assign({}, accessiOptions.publicAuthRateLimit), { store: rateLimit }), serviceTokens: Object.assign(Object.assign({}, accessiOptions.serviceTokens), { rateLimitStore: serviceTokenRateLimit }), sessionRevocation: Object.assign(Object.assign({}, accessiOptions.sessionRevocation), { store: sessionRevocation }), accessTokenRevocation: Object.assign(Object.assign({}, accessiOptions.accessTokenRevocation), { store: accessTokenRevocation }), refreshTokenRotation: Object.assign(Object.assign({}, accessiOptions.refreshTokenRotation), { enabled: (_b = (_a = accessiOptions.refreshTokenRotation) === null || _a === void 0 ? void 0 : _a.enabled) !== null && _b !== void 0 ? _b : enableRefreshTokenRotation, store: refreshTokenRotation }), consoleEntry: Object.assign(Object.assign({}, accessiOptions.consoleEntry), { store: consoleEntry }) });
+        },
+    };
+}
+//# sourceMappingURL=tenantStores.js.map

package/dist/accessi/server/tenantStores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantStores.js","sourceRoot":"","sources":["../../../src/accessi/server/tenantStores.ts"],"names":[],"mappings":";;AA6EA,sEAeC;AASD,8DA2FC;AA/LD,uCAAwD;AACxD,iFAAyF;AAEzF,6EAA0F;AAE1F,uFAAoG;AAEpG,+FAA4G;AAE5G,6FAA0G;AA6D1G;;;;;GAKG;AACH,SAAgB,6BAA6B,CAC3C,QAAgB,EAChB,YAAwC,EAAE;;IAE1C,MAAM,IAAI,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,IAAA,qCAA2B,EAAC,QAAQ,CAAC,CAAC;IACrE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,MAAA,SAAS,CAAC,SAAS,mCAAI,GAAG,IAAI,OAAO;QAChD,qBAAqB,EAAE,MAAA,SAAS,CAAC,qBAAqB,mCAAI,GAAG,IAAI,qBAAqB;QACtF,iBAAiB,EAAE,MAAA,SAAS,CAAC,iBAAiB,mCAAI,GAAG,IAAI,UAAU;QACnE,qBAAqB,EAAE,MAAA,SAAS,CAAC,qBAAqB,mCAAI,GAAG,IAAI,MAAM;QACvE,oBAAoB,EAAE,MAAA,SAAS,CAAC,oBAAoB,mCAAI,GAAG,IAAI,UAAU;QACzE,kBAAkB,EAAE,MAAA,SAAS,CAAC,kBAAkB,mCAAI,GAAG,IAAI,iBAAiB;QAC5E,YAAY,EAAE,MAAA,SAAS,CAAC,YAAY,mCAAI,GAAG,IAAI,gBAAgB;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACvC,OAAyC;;IAEzC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,QAAQ,kCAC1D,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChD,CAAC,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE,CAAC,EAC3B,CAAC;IACH,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,KAAK,KAAK,CAAC;IAEhF,MAAM,SAAS,GAAG,IAAA,0CAAyB,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,MAAM,qBAAqB,GAAG,IAAA,0CAAyB,EAAC;QACtD,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,IAAA,qDAAiC,kBACzD,MAAM,EACN,SAAS,EAAE,QAAQ,CAAC,iBAAiB,IAClC,CAAC,OAAO,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClG,CAAC;IACH,MAAM,qBAAqB,GAAG,IAAA,6DAAqC,kBACjE,MAAM,EACN,SAAS,EAAE,QAAQ,CAAC,qBAAqB,IACtC,CAAC,OAAO,CAAC,0BAA0B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1G,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAA,2DAAoC,EAAC;QAChE,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,oBAAoB;QACxC,eAAe,EAAE,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAA,2CAA4B,kBAC/C,MAAM;QACN,aAAa,EACb,SAAS,EAAE,QAAQ,CAAC,YAAY,IAC7B,CAAC,OAAO,CAAC,4BAA4B,KAAK,SAAS;QACpD,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,4BAA4B,EAAE;QAC5D,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,SAAS;QACT,qBAAqB;QACrB,iBAAiB;QACjB,qBAAqB;QACrB,oBAAoB;QACpB,YAAY;QACZ,OAAO,CAAC,cAAc;;YACpB,uCACK,cAAc,KACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAC1B,mBAAmB,kCACd,cAAc,CAAC,mBAAmB,KACrC,KAAK,EAAE,SAAS,KAElB,aAAa,kCACR,cAAc,CAAC,aAAa,KAC/B,cAAc,EAAE,qBAAqB,KAEvC,iBAAiB,kCACZ,cAAc,CAAC,iBAAiB,KACnC,KAAK,EAAE,iBAAiB,KAE1B,qBAAqB,kCAChB,cAAc,CAAC,qBAAqB,KACvC,KAAK,EAAE,qBAAqB,KAE9B,oBAAoB,kCACf,cAAc,CAAC,oBAAoB,KACtC,OAAO,EAAE,MAAA,MAAA,cAAc,CAAC,oBAAoB,0CAAE,OAAO,mCAAI,0BAA0B,EACnF,KAAK,EAAE,oBAAoB,KAE7B,YAAY,kCACP,cAAc,CAAC,YAAY,KAC9B,KAAK,EAAE,YAAY,OAErB;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AccessiOptions } from '../../accessi-module/AccessiModule';\nimport { getAccessiTenantRedisPrefix } from './tenants';\nimport { createRedisRateLimitStore } from '../../accessi-module/security/rateLimitStore';\nimport type { RateLimitStore } from '../../accessi-module/security/rateLimitStore';\nimport { createRedisConsoleEntryStore } from '../../accessi-module/security/consoleEntry';\nimport type { ConsoleEntryStore } from '../../accessi-module/security/consoleEntry';\nimport { createRedisSessionRevocationStore } from '../../accessi-module/security/sessionRevocation';\nimport type { SessionRevocationStore } from '../../accessi-module/security/sessionRevocation';\nimport { createRedisAccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';\nimport type { AccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';\nimport { createRedisRefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';\nimport type { RefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';\n\n/** Client Redis minimo accettato dagli store Accessi. */\nexport interface AccessiTenantRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\n/** Prefissi Redis per singolo store, tutti relativi al tenant. */\nexport interface AccessiTenantStorePrefixes {\n  base?: string;\n  rateLimit?: string;\n  serviceTokenRateLimit?: string;\n  sessionRevocation?: string;\n  accessTokenRevocation?: string;\n  refreshTokenRotation?: string;\n  refreshTokenFamily?: string;\n  consoleEntry?: string;\n}\n\nexport interface ResolvedAccessiTenantStorePrefixes {\n  base: string;\n  rateLimit: string;\n  serviceTokenRateLimit: string;\n  sessionRevocation: string;\n  accessTokenRevocation: string;\n  refreshTokenRotation: string;\n  refreshTokenFamily: string;\n  consoleEntry: string;\n}\n\nexport interface CreateAccessiTenantStoresOptions {\n  tenantId: string;\n  client: AccessiTenantRedisClient;\n  /** Segreto per cifrare i ticket console a riposo. Usare un segreto del tenant. */\n  encryptionKey: string | Buffer;\n  /** Base prefix. Default: `accessi:<tenantId>:`. */\n  prefix?: string;\n  prefixes?: AccessiTenantStorePrefixes;\n  /** TTL revoca sessioni. Default dello store (365 giorni). */\n  sessionRevocationTtlMs?: number;\n  /** TTL revoca jti. Default dello store (24 ore). */\n  accessTokenRevocationTtlMs?: number;\n  consoleEntryMaxIssueAttempts?: number;\n  /** Attiva la rotazione refresh token nell'options risultante. Default: true. */\n  enableRefreshTokenRotation?: boolean;\n}\n\nexport interface AccessiTenantStores {\n  tenantId: string;\n  prefixes: ResolvedAccessiTenantStorePrefixes;\n  rateLimit: RateLimitStore;\n  serviceTokenRateLimit: RateLimitStore;\n  sessionRevocation: SessionRevocationStore;\n  accessTokenRevocation: AccessTokenRevocationStore;\n  refreshTokenRotation: RefreshTokenRotationStore;\n  consoleEntry: ConsoleEntryStore;\n  /** Collega tutti gli store alle opzioni Accessi del tenant. */\n  applyTo(options: AccessiOptions): AccessiOptions;\n}\n\n/**\n * Prefissi Redis isolati per tenant.\n *\n * Ogni store ha un namespace distinto: condividere un prefisso tra tenant\n * significherebbe condividere rate limit, revoche o refresh token.\n */\nexport function getAccessiTenantStorePrefixes(\n  tenantId: string,\n  overrides: AccessiTenantStorePrefixes = {},\n): ResolvedAccessiTenantStorePrefixes {\n  const base = overrides.base ?? getAccessiTenantRedisPrefix(tenantId);\n  return {\n    base,\n    rateLimit: overrides.rateLimit ?? `${base}rate:`,\n    serviceTokenRateLimit: overrides.serviceTokenRateLimit ?? `${base}service-token-rate:`,\n    sessionRevocation: overrides.sessionRevocation ?? `${base}session:`,\n    accessTokenRevocation: overrides.accessTokenRevocation ?? `${base}jti:`,\n    refreshTokenRotation: overrides.refreshTokenRotation ?? `${base}refresh:`,\n    refreshTokenFamily: overrides.refreshTokenFamily ?? `${base}refresh-family:`,\n    consoleEntry: overrides.consoleEntry ?? `${base}console-entry:`,\n  };\n}\n\n/**\n * Crea tutti gli store Redis di un tenant con prefissi gia isolati.\n *\n * `applyTo` restituisce una copia delle opzioni con gli store collegati:\n * `publicAuthRateLimit`, `serviceTokens`, `sessionRevocation`,\n * `accessTokenRevocation`, `refreshTokenRotation` e `consoleEntry`.\n */\nexport function createAccessiTenantStores(\n  options: CreateAccessiTenantStoresOptions,\n): AccessiTenantStores {\n  if (!options?.tenantId || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(options.tenantId)) {\n    throw new Error('createAccessiTenantStores: tenantId non valido.');\n  }\n  if (!options.client || typeof options.client.eval !== 'function') {\n    throw new Error('createAccessiTenantStores: client.eval non configurato.');\n  }\n  const encryptionKey = options.encryptionKey;\n  if (encryptionKey === undefined || encryptionKey === null || encryptionKey.length === 0) {\n    throw new Error('createAccessiTenantStores: encryptionKey obbligatoria per i ticket console.');\n  }\n\n  const prefixes = getAccessiTenantStorePrefixes(options.tenantId, {\n    ...(options.prefix ? { base: options.prefix } : {}),\n    ...(options.prefixes ?? {}),\n  });\n  const { client } = options;\n  const enableRefreshTokenRotation = options.enableRefreshTokenRotation !== false;\n\n  const rateLimit = createRedisRateLimitStore({ client, keyPrefix: prefixes.rateLimit });\n  const serviceTokenRateLimit = createRedisRateLimitStore({\n    client,\n    keyPrefix: prefixes.serviceTokenRateLimit,\n  });\n  const sessionRevocation = createRedisSessionRevocationStore({\n    client,\n    keyPrefix: prefixes.sessionRevocation,\n    ...(options.sessionRevocationTtlMs !== undefined ? { ttlMs: options.sessionRevocationTtlMs } : {}),\n  });\n  const accessTokenRevocation = createRedisAccessTokenRevocationStore({\n    client,\n    keyPrefix: prefixes.accessTokenRevocation,\n    ...(options.accessTokenRevocationTtlMs !== undefined ? { ttlMs: options.accessTokenRevocationTtlMs } : {}),\n  });\n  const refreshTokenRotation = createRedisRefreshTokenRotationStore({\n    client,\n    keyPrefix: prefixes.refreshTokenRotation,\n    familyKeyPrefix: prefixes.refreshTokenFamily,\n  });\n  const consoleEntry = createRedisConsoleEntryStore({\n    client,\n    encryptionKey,\n    keyPrefix: prefixes.consoleEntry,\n    ...(options.consoleEntryMaxIssueAttempts !== undefined\n      ? { maxIssueAttempts: options.consoleEntryMaxIssueAttempts }\n      : {}),\n  });\n\n  return {\n    tenantId: options.tenantId,\n    prefixes,\n    rateLimit,\n    serviceTokenRateLimit,\n    sessionRevocation,\n    accessTokenRevocation,\n    refreshTokenRotation,\n    consoleEntry,\n    applyTo(accessiOptions) {\n      return {\n        ...accessiOptions,\n        tenantId: options.tenantId,\n        publicAuthRateLimit: {\n          ...accessiOptions.publicAuthRateLimit,\n          store: rateLimit,\n        },\n        serviceTokens: {\n          ...accessiOptions.serviceTokens,\n          rateLimitStore: serviceTokenRateLimit,\n        },\n        sessionRevocation: {\n          ...accessiOptions.sessionRevocation,\n          store: sessionRevocation,\n        },\n        accessTokenRevocation: {\n          ...accessiOptions.accessTokenRevocation,\n          store: accessTokenRevocation,\n        },\n        refreshTokenRotation: {\n          ...accessiOptions.refreshTokenRotation,\n          enabled: accessiOptions.refreshTokenRotation?.enabled ?? enableRefreshTokenRotation,\n          store: refreshTokenRotation,\n        },\n        consoleEntry: {\n          ...accessiOptions.consoleEntry,\n          store: consoleEntry,\n        },\n      };\n    },\n  };\n}\n"]}

package/dist/accessi/server/tenants.d.ts

@@ -1,15 +1,80 @@
-import type { AccessiOptions } from '../../accessi-module/AccessiModule';
-/** Variabili usate dal manifest del tenant (oltre alle normali `ACCESSI_*`). */
-export interface AccessiTenantEnv extends NodeJS.ProcessEnv {
-    ACCESSI_TENANT_ID?: string;
-    /** Host separati da virgola; supporta `*.example.com`. */
-    ACCESSI_TENANT_HOSTS?: string;
-    /** Prefisso path, es. `/tenant-a`. */
-    ACCESSI_TENANT_PATH?: string;
-    ACCESSI_TENANT_ENABLED?: string;
-    /** Porta del servizio quando si usa `startAccessiTenants`. */
-    ACCESSI_TENANT_PORT?: string;
-    ACCESSI_TENANT_DESCRIPTION?: string;
+import type { AccessiOptions, AccessiHttpOptions, AdminBootstrapOptions, CatalogScriptsOptions, ConsoleEntryOptions, EmailOptions, ExtensionFieldsOptions, FederatedAuthenticationOptions, JwtOptions, PublicAuthRateLimitOptions, PublicRegistrationOptions, ServiceTokenOptions, SystemSeedsOptions } from '../../accessi-module/AccessiModule';
+import type { AccessiEdgeRateLimitOptions } from '../../accessi-module/security/edgeRateLimit';
+import type { AccessiAuthCookieOptions } from '../../accessi-module/security/authCookies';
+import type { AccessiMetricsOptions } from '../../accessi-module/observability/metrics';
+import type { AccessiAuditOptions } from '../../accessi-module/security/audit';
+import type { SessionRevocationOptions } from '../../accessi-module/security/sessionRevocation';
+import type { AccessTokenRevocationOptions } from '../../accessi-module/security/accessTokenRevocation';
+import type { RefreshTokenRotationOptions } from '../../accessi-module/security/refreshTokenRotation';
+import type { OpenApiSetupOptions } from '../../openapi/OpenApiConfig';
+/** Identita e routing del tenant. */
+export interface AccessiTenantSettings {
+    /** Minuscole, numeri, `-` e `_`; max 63 caratteri. */
+    id: string;
+    /** Host esatti o wildcard `*.example.com`. */
+    hosts?: string[];
+    /** Prefisso path, es. `/acme`. */
+    path?: string;
+    /** Porta del processo quando si usa il supervisore. */
+    port?: number;
+    /** Default `true`. */
+    enabled?: boolean;
+    description?: string;
+}
+/** Connessione Firebird del tenant, tipizzata senza callback. */
+export interface AccessiTenantDatabaseOptions {
+    host: string;
+    port?: number;
+    database: string;
+    user?: string;
+    password?: string;
+    /** `disabled`/`optional`; `required` e il default del driver. */
+    wireCrypt?: 'required' | 'optional' | 'disabled';
+    pluginName?: string;
+}
+/**
+ * Configurazione serializzabile di un tenant.
+ *
+ * I campi che contengono store, callback o logger (`store`, `sink`, `match`,
+ * `onDocument`, `logger`, ...) sono esclusi: vanno collegati dal backend
+ * ospitante, non da un file di configurazione.
+ */
+export interface AccessiTenantEnvironment {
+    tenant: AccessiTenantSettings;
+    database: AccessiTenantDatabaseOptions;
+    jwt: JwtOptions;
+    email: EmailOptions;
+    encryptionKey: string;
+    confirmationEmailUrl: string;
+    confirmationEmailReturnUrl: string;
+    confirmationEmailPrefix?: string;
+    customResetPage?: string;
+    publicBaseUrl?: string;
+    consoleApiBaseUrl?: string;
+    mockDemoUser?: boolean;
+    passwordExpiration?: boolean;
+    passwordExpirationDays?: number;
+    legacyPasswordMigrationOnStartup?: boolean;
+    autoUpdateDatabase?: boolean;
+    http?: AccessiHttpOptions;
+    authCookie?: AccessiAuthCookieOptions;
+    publicAuthRateLimit?: Omit<PublicAuthRateLimitOptions, 'store'>;
+    publicRegistration?: PublicRegistrationOptions;
+    federatedAuthentication?: FederatedAuthenticationOptions;
+    extensionFieldsOptions?: ExtensionFieldsOptions[];
+    serviceTokens?: Omit<ServiceTokenOptions, 'rateLimitStore'>;
+    catalogScripts?: CatalogScriptsOptions;
+    systemSeeds?: SystemSeedsOptions;
+    adminBootstrap?: AdminBootstrapOptions;
+    openapi?: Omit<OpenApiSetupOptions, 'onDocument'>;
+    consoleEntry?: Omit<ConsoleEntryOptions, 'store'>;
+    edgeRateLimit?: Omit<AccessiEdgeRateLimitOptions, 'store' | 'match'>;
+    sessionRevocation?: Omit<SessionRevocationOptions, 'store'>;
+    accessTokenRevocation?: Omit<AccessTokenRevocationOptions, 'store'>;
+    refreshTokenRotation?: Omit<RefreshTokenRotationOptions, 'store'>;
+    metrics?: Omit<AccessiMetricsOptions, 'sink'>;
+    audit?: Omit<AccessiAuditOptions, 'sinks' | 'store' | 'tenantId'>;
+    bufferLogs?: boolean;
 }
 export interface AccessiTenant {
     id: string;
@@ -18,10 +83,9 @@ export interface AccessiTenant {
     enabled: boolean;
     description?: string;
     port?: number;
-    /** Nome del file `.env` di origine (mai il contenuto). */
+    /** Nome del file `*.environment.ts` di origine (mai il contenuto). */
     file: string;
-    /** Variabili risolte del tenant (base + file); non serializzarle nei log. */
-    env: NodeJS.ProcessEnv;
+    environmentFile: string;
     options: AccessiOptions;
 }
 export interface AccessiTenantSummary {
@@ -63,10 +127,8 @@ export interface AccessiTenantRegistry {
     summary(): AccessiTenantSummary[];
 }
 export interface LoadAccessiTenantsOptions {
-    /** Cartella con `<tenant>.env`. */
+    /** Cartella con `<id>.environment.ts`. */
     directory: string;
-    /** Variabili base (default `process.env`); il file tenant vince. */
-    env?: NodeJS.ProcessEnv;
     /** Abilita la risoluzione via header `x-accessi-tenant`. Default: false. */
     allowHeader?: boolean;
     /** Consente issuer/audience uguali tra tenant (sconsigliato). Default: false. */
@@ -78,20 +140,47 @@ export declare class AccessiTenantConfigurationError extends Error {
     constructor(issues: string[]);
 }
 /**
- * Parser minimale di un file `.env`.
+ * Helper di tipizzazione per i file tenant.
+ *
+ * ```ts
+ * import type { AccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';
+ * import { defineAccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';
  *
- * Supporta commenti, `export KEY=...`, valori tra apici singoli o doppi e le
- * sequenze `\n`, `\r`, `\t`, `\"` e `\\` nei valori tra doppi apici. Non
- * interpreta variabili annidate: la configurazione tenant deve restare esplicita.
+ * export default defineAccessiTenantEnvironment({
+ *   tenant: { id: 'acme', hosts: ['accessi.acme.example.com'] },
+ *   database: { host: 'db-acme', database: '/data/acme.fdb' },
+ *   jwt: { secret: process.env.ACME_JWT_SECRET!, expiresIn: '1h' },
+ *   email: { ... },
+ *   encryptionKey: process.env.ACME_ENCRYPTION_KEY!,
+ *   confirmationEmailUrl: 'https://accessi.acme.example.com',
+ *   confirmationEmailReturnUrl: 'https://accessi.acme.example.com',
+ * });
+ * ```
  */
-export declare function parseAccessiTenantEnvFile(content: string): Record<string, string>;
+export declare function defineAccessiTenantEnvironment<const T extends AccessiTenantEnvironment>(environment: T): T;
 /** Prefisso Redis consigliato per isolare gli store del tenant. */
 export declare function getAccessiTenantRedisPrefix(tenantId: string): string;
 /**
- * Carica i tenant da una cartella di file `<id>.env`.
+ * Converte la configurazione tipizzata in `AccessiOptions`.
+ *
+ * Applica i default di Firebird e collega `tenantId`; non crea store o sink,
+ * che restano responsabilita del backend ospitante.
+ */
+export declare function accessiOptionsFromTenantEnvironment(environment: AccessiTenantEnvironment): AccessiOptions;
+/**
+ * Carica un singolo file `*.environment.ts`.
+ *
+ * Usa jiti per eseguire TypeScript anche nel pacchetto compilato, senza
+ * richiedere un passo di build separato per i file tenant.
+ */
+export declare function loadAccessiTenantEnvironmentFile(file: string): {
+    tenant: AccessiTenant;
+    environment: AccessiTenantEnvironment;
+};
+/**
+ * Carica i tenant da una cartella di file `<id>.environment.ts`.
  *
- * Non modifica `process.env`: ogni tenant riceve una copia isolata delle
- * variabili. Un errore in un file blocca l'intero caricamento, cosi non si
- * avvia un tenant con configurazione parziale.
+ * La validazione e aggregata: un errore blocca l'intera cartella, cosi non si
+ * avvia un tenant con configurazione parziale. Nessun segreto viene stampato.
  */
 export declare function loadAccessiTenants(options: LoadAccessiTenantsOptions): AccessiTenantRegistry;