emilsoftware-utilities 2.0.0-dev.81 → 2.0.0-dev.83

package/deploy/README.md

@@ -0,0 +1,45 @@
+# Template di deployment multi-tenant
+
+File pronti da adattare. Non contengono segreti reali: usare `<placeholder>` o
+variabili d'ambiente/secret manager.
+
+| Percorso | Uso |
+| --- | --- |
+| `systemd/accessi-tenant@.service` | unità template, una istanza per tenant |
+| `systemd/tenant.secrets.example` | soli segreti, permessi `0600` |
+| `docker/docker-compose.yml` | due tenant con volumi config read-only |
+| `nginx/accessi-tenants.conf` | routing per host e variante path |
+| `traefik/dynamic.yml` | routing host, header e health check |
+
+## Flusso
+
+1. Creare `tenants/<id>.environment.ts` (vedi `docs/multi-tenancy.md`).
+2. Validare: `npm run accessi:tenants -- --dir ./tenants --check`.
+3. Preparare i segreti fuori dal repository (`/etc/accessi/tenants/<id>.secrets`
+   o `secrets/<id>.env` con permessi `0600`).
+4. Avviare il processo con `ACCESSI_TENANT_ENVIRONMENT` e, se serve,
+   `PORT`/`ACCESSI_TENANT_ID`.
+5. Configurare il proxy sull'host o sul path del tenant.
+6. Verificare `/health/live`, `/health/ready` e `/health/metrics`.
+
+La porta predefinita è `tenant.port`; `PORT` ha precedenza. I template non
+pubblicano le porte interne: il proxy è l'unico punto esposto.
+
+## Variante path
+
+Per `tenant.path = '/acme'` il proxy deve rimuovere `/acme` prima di inoltrare
+(vedi `nginx/accessi-tenants.conf` e `traefik/dynamic.yml`). In alternativa
+servire ogni tenant su un host dedicato.
+
+## Sicurezza
+
+- Non committare `.secrets`/`secrets/*.env`.
+- Montare la cartella configurazione in read-only.
+- `read_only: true`, `no-new-privileges`, utente non root (immagine
+  personalizzata) e `ProtectSystem=strict` nell'unità systemd.
+- Non usare l'header `x-accessi-tenant` dal client: solo il proxy può
+  impostarlo, con `allowHeader: true` lato router.
+- Un processo per tenant: non condividere `AccessiModule` tra tenant diversi.
+
+La CI esegue `npm run check:deploy` per verificare presenza e coerenza dei
+template e l'assenza di segreti.

package/deploy/docker/docker-compose.yml

@@ -0,0 +1,51 @@
+# Accessi multi-tenant con Docker Compose.
+#
+# I file *.environment.ts sono montati read-only; i segreti arrivano da
+# env_file esterni al repository. La porta viene da tenant.port; PORT puo
+# sovrascriverla.
+version: "3.9"
+
+x-accessi-tenant: &accessi-tenant
+  image: emilsoftware/accessi:2
+  restart: unless-stopped
+  read_only: true
+  tmpfs:
+    - /tmp
+  security_opt:
+    - no-new-privileges:true
+  healthcheck:
+    test:
+      - CMD-SHELL
+      - >-
+        node -e "fetch('http://127.0.0.1:' + (process.env.PORT || '3200') + '/health/live')
+        .then((response) => process.exit(response.ok ? 0 : 1))
+        .catch(() => process.exit(1))"
+    interval: 15s
+    timeout: 5s
+    retries: 5
+    start_period: 30s
+
+services:
+  accessi-acme:
+    <<: *accessi-tenant
+    environment:
+      ACCESSI_TENANT_ENVIRONMENT: /config/acme.environment.ts
+      ACCESSI_TENANT_ID: acme
+    env_file:
+      - ./secrets/acme.env
+    volumes:
+      - ./tenants:/config:ro
+    ports:
+      - "127.0.0.1:3201:3201"
+
+  accessi-beta:
+    <<: *accessi-tenant
+    environment:
+      ACCESSI_TENANT_ENVIRONMENT: /config/beta.environment.ts
+      ACCESSI_TENANT_ID: beta
+    env_file:
+      - ./secrets/beta.env
+    volumes:
+      - ./tenants:/config:ro
+    ports:
+      - "127.0.0.1:3202:3202"

package/deploy/nginx/accessi-tenants.conf

@@ -0,0 +1,41 @@
+# Accessi multi-tenant dietro Nginx.
+#
+# Ogni tenant ha un processo sulla propria porta interna. Il proxy instrada per
+# host e non espone mai le porte interne. Sostituire i domini e le porte.
+
+map $host $accessi_tenant_upstream {
+    accessi.acme.example.com  http://127.0.0.1:3201;
+    accessi.beta.example.com  http://127.0.0.1:3202;
+    default                   http://127.0.0.1:3201;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name accessi.acme.example.com accessi.beta.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/accessi.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/accessi.example.com/privkey.pem;
+
+    client_max_body_size 10m;
+
+    location / {
+        proxy_pass $accessi_tenant_upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_read_timeout 60s;
+    }
+}
+
+# Variante path-based: il prefix /acme viene rimosso prima di inoltrare ad
+# Accessi, che serve il tenant alla radice.
+#
+# location /acme/ {
+#     rewrite ^/acme/(.*)$ /$1 break;
+#     proxy_pass http://127.0.0.1:3201;
+#     proxy_set_header Host $host;
+#     proxy_set_header X-Forwarded-Proto $scheme;
+# }

package/deploy/systemd/accessi-tenant@.service

@@ -0,0 +1,46 @@
+# Accessi multi-tenant con systemd
+#
+# Installazione:
+#   cp deploy/systemd/accessi-tenant@.service /etc/systemd/system/
+#   mkdir -p /etc/accessi/tenants
+#   cp tenants/acme.environment.ts /etc/accessi/tenants/acme.environment.ts
+#   install -m 0600 deploy/systemd/tenant.secrets.example /etc/accessi/tenants/acme.secrets
+#   systemctl daemon-reload
+#   systemctl enable --now accessi-tenant@acme
+#
+# La porta viene letta da tenant.port nel file *.environment.ts. Per forzarla:
+#   systemctl edit accessi-tenant@acme
+#   [Service]
+#   Environment=PORT=3201
+
+[Unit]
+Description=Accessi Service tenant %i
+Documentation=file:///opt/accessi/docs/multi-tenancy.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/accessi
+# Solo segreti (password DB, SMTP, chiavi JWT): il manifest tipizzato e' separato.
+EnvironmentFile=-/etc/accessi/tenants/%i.secrets
+Environment=ACCESSI_TENANT_ENVIRONMENT=/etc/accessi/tenants/%i.environment.ts
+Environment=ACCESSI_TENANT_ID=%i
+
+ExecStart=/usr/bin/node /opt/accessi/dist/scripts/startAccessiTenantService.js
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=30
+KillSignal=SIGTERM
+
+User=accessi
+Group=accessi
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/accessi
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target

package/deploy/systemd/tenant.secrets.example

@@ -0,0 +1,11 @@
+# Esempio di file segreti per un tenant systemd.
+# Copiare in /etc/accessi/tenants/<id>.secrets con permessi 0600.
+# Non committare valori reali.
+
+ACME_DB_PASSWORD=<db-password>
+ACME_JWT_SECRET=<jwt-secret-almeno-32-caratteri>
+ACME_JWT_PRIVATE_KEY=<pem-su-una-riga-con-\n>
+ACME_JWT_PUBLIC_KEY=<pem-su-una-riga-con-\n>
+ACME_ENCRYPTION_KEY=<32-caratteri-casuali>
+ACME_SMTP_USER=<smtp-user>
+ACME_SMTP_PASSWORD=<smtp-password>

package/deploy/traefik/dynamic.yml

@@ -0,0 +1,57 @@
+# Accessi multi-tenant con Traefik (file provider).
+#
+# I servizi Accessi ascoltano su porte interne; Traefik termina TLS e instrada
+# per host. Per la variante path usare un middleware StripPrefix.
+
+http:
+  routers:
+    accessi-acme:
+      rule: Host(`accessi.acme.example.com`)
+      entryPoints:
+        - websecure
+      tls: {}
+      service: accessi-acme
+      middlewares:
+        - accessi-headers
+
+    accessi-beta:
+      rule: Host(`accessi.beta.example.com`)
+      entryPoints:
+        - websecure
+      tls: {}
+      service: accessi-beta
+      middlewares:
+        - accessi-headers
+
+  middlewares:
+    accessi-headers:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        contentTypeNosniff: true
+        referrerPolicy: no-referrer
+        customResponseHeaders:
+          Permissions-Policy: "camera=(), microphone=(), geolocation=()"
+    # Variante path-based:
+    # accessi-strip-acme:
+    #   stripPrefix:
+    #     prefixes:
+    #       - /acme
+
+  services:
+    accessi-acme:
+      loadBalancer:
+        healthCheck:
+          path: /health/ready
+          interval: 15s
+          timeout: 3s
+        servers:
+          - url: http://127.0.0.1:3201
+    accessi-beta:
+      loadBalancer:
+        healthCheck:
+          path: /health/ready
+          interval: 15s
+          timeout: 3s
+        servers:
+          - url: http://127.0.0.1:3202

package/dist/accessi/server/index.d.ts

@@ -9,5 +9,6 @@ export * from "../../accessi-module";
 export * from "./standalone";
 export * from "./tenants";
 export * from "./tenantStores";
+export * from "./tenantSupervisor";
 export type { AccessiOptions as AccessiServerOptions } from "../../accessi-module";
 export { createAccessiOptionsFromEnv, createCatalogScriptsOptionsFromEnv, parseAccessiPreviousPublicKeys, } from "../../accessi-module/database-updates/accessiOptionsFromEnv";

package/dist/accessi/server/index.js

@@ -26,6 +26,7 @@ __exportStar(require("../../accessi-module"), exports);
 __exportStar(require("./standalone"), exports);
 __exportStar(require("./tenants"), exports);
 __exportStar(require("./tenantStores"), exports);
+__exportStar(require("./tenantSupervisor"), exports);
 var accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
 Object.defineProperty(exports, "createAccessiOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createAccessiOptionsFromEnv; } });
 Object.defineProperty(exports, "createCatalogScriptsOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createCatalogScriptsOptionsFromEnv; } });

package/dist/accessi/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AACrC,+CAA6B;AAC7B,4CAA0B;AAC1B,iDAA+B;AAE/B,qGAIqE;AAHnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA;AAClC,uIAAA,8BAA8B,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport * from \"./standalone\";\nexport * from \"./tenants\";\nexport * from \"./tenantStores\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n  parseAccessiPreviousPublicKeys,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AACrC,+CAA6B;AAC7B,4CAA0B;AAC1B,iDAA+B;AAC/B,qDAAmC;AAEnC,qGAIqE;AAHnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA;AAClC,uIAAA,8BAA8B,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport * from \"./standalone\";\nexport * from \"./tenants\";\nexport * from \"./tenantStores\";\nexport * from \"./tenantSupervisor\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n  parseAccessiPreviousPublicKeys,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}

package/dist/accessi/server/tenantSupervisor.d.ts

@@ -0,0 +1,60 @@
+import type { AccessiTenant } from './tenants';
+/** Handle minimo di un processo figlio (compatibile con `child_process.ChildProcess`). */
+export interface AccessiTenantProcessHandle {
+    readonly pid?: number;
+    kill(signal?: NodeJS.Signals | number): boolean;
+    once(event: 'exit', listener: (code: number | null, signal: NodeJS.Signals | null) => void): unknown;
+}
+export type AccessiTenantSpawn = (tenant: AccessiTenant, port: number) => AccessiTenantProcessHandle;
+export interface AccessiTenantSupervisorLoggerEvent {
+    level: 'info' | 'warn' | 'error';
+    message: string;
+}
+export interface AccessiTenantSupervisorOptions {
+    directory: string;
+    basePort: number;
+    spawn: AccessiTenantSpawn;
+    allowHeader?: boolean;
+    /** Intervallo di polling della cartella quando `watch()` e attivo. Default 1000 ms. */
+    pollIntervalMs?: number;
+    /** Attesa prima di applicare un reload dopo una modifica. Default 200 ms. */
+    debounceMs?: number;
+    /** Timeout per SIGTERM prima di SIGKILL. Default 5000 ms. */
+    stopTimeoutMs?: number;
+    logger?: (event: AccessiTenantSupervisorLoggerEvent) => void;
+}
+export interface AccessiTenantSupervisorState {
+    id: string;
+    port: number;
+    file: string;
+    signature: string;
+}
+export interface AccessiTenantReloadResult {
+    added: string[];
+    removed: string[];
+    restarted: string[];
+    unchanged: string[];
+}
+export interface AccessiTenantSupervisor {
+    start(): Promise<void>;
+    reload(): Promise<AccessiTenantReloadResult>;
+    stop(): Promise<void>;
+    state(): AccessiTenantSupervisorState[];
+    watch(): void;
+    unwatch(): void;
+}
+/** Firma della cartella: file + contenuto, ordinata per nome. */
+export declare function accessiTenantDirectorySignature(directory: string): string;
+/**
+ * Supervisore multi-tenant: avvia un processo per tenant e, con `watch()`,
+ * riapplica la configurazione quando i file `*.environment.ts` cambiano.
+ *
+ * Regole di reload:
+ * - un file invalido non tocca i tenant attivi;
+ * - i tenant invariati non vengono riavviati;
+ * - aggiunte/rimozioni/modifiche producono spawn/stop/restart;
+ * - la porta di un tenant esistente non cambia durante un restart.
+ */
+export declare function createAccessiTenantSupervisor(options: AccessiTenantSupervisorOptions): AccessiTenantSupervisor;
+/** Attende che una condizione diventi vera (utile nei test e nei runbook). */
+export declare function waitForTenantState(supervisor: AccessiTenantSupervisor, predicate: (state: AccessiTenantSupervisorState[]) => boolean, timeoutMs?: number): Promise<void>;

package/dist/accessi/server/tenantSupervisor.js

@@ -0,0 +1,296 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accessiTenantDirectorySignature = accessiTenantDirectorySignature;
+exports.createAccessiTenantSupervisor = createAccessiTenantSupervisor;
+exports.waitForTenantState = waitForTenantState;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const tenants_1 = require("./tenants");
+const ENVIRONMENT_FILE = /\.environment\.(ts|mts|cts|js|mjs|cjs)$/;
+function fileSignature(file) {
+    try {
+        return (0, crypto_1.createHash)('sha256').update((0, fs_1.readFileSync)(file)).digest('hex');
+    }
+    catch (_a) {
+        return 'unreadable';
+    }
+}
+/** Firma della cartella: file + contenuto, ordinata per nome. */
+function accessiTenantDirectorySignature(directory) {
+    let files;
+    try {
+        files = (0, fs_1.readdirSync)(directory, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && ENVIRONMENT_FILE.test(entry.name))
+            .map((entry) => entry.name)
+            .sort();
+    }
+    catch (error) {
+        return `error:${error instanceof Error ? error.message : String(error)}`;
+    }
+    return (0, crypto_1.createHash)('sha256')
+        .update(files.map((file) => `${file}:${fileSignature((0, path_1.join)(directory, file))}`).join('|'))
+        .digest('hex');
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function stopProcess(handle, timeoutMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        yield new Promise((resolve) => {
+            let settled = false;
+            const done = () => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve();
+            };
+            handle.once('exit', done);
+            try {
+                if (!handle.kill('SIGTERM'))
+                    done();
+            }
+            catch (_a) {
+                done();
+            }
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                try {
+                    handle.kill('SIGKILL');
+                }
+                catch (_a) {
+                    // Il processo potrebbe essere gia terminato.
+                }
+                done();
+            }, Math.max(50, timeoutMs));
+            if (typeof timer.unref === 'function')
+                timer.unref();
+        });
+    });
+}
+/**
+ * Supervisore multi-tenant: avvia un processo per tenant e, con `watch()`,
+ * riapplica la configurazione quando i file `*.environment.ts` cambiano.
+ *
+ * Regole di reload:
+ * - un file invalido non tocca i tenant attivi;
+ * - i tenant invariati non vengono riavviati;
+ * - aggiunte/rimozioni/modifiche producono spawn/stop/restart;
+ * - la porta di un tenant esistente non cambia durante un restart.
+ */
+function createAccessiTenantSupervisor(options) {
+    var _a;
+    if (!(options === null || options === void 0 ? void 0 : options.directory))
+        throw new Error('createAccessiTenantSupervisor: directory obbligatoria.');
+    if (!Number.isInteger(options.basePort) || options.basePort < 1) {
+        throw new Error('createAccessiTenantSupervisor: basePort non valida.');
+    }
+    if (typeof options.spawn !== 'function') {
+        throw new Error('createAccessiTenantSupervisor: spawn obbligatorio.');
+    }
+    const log = (_a = options.logger) !== null && _a !== void 0 ? _a : (() => undefined);
+    const running = new Map();
+    let lastSignature = '';
+    let watchTimer;
+    let reloading = false;
+    let stopping = false;
+    let pendingReload;
+    const nextPort = () => {
+        const used = new Set([...running.values()].map((entry) => entry.port));
+        let port = options.basePort;
+        while (used.has(port))
+            port += 1;
+        return port;
+    };
+    const spawnTenant = (tenant, port, signature) => {
+        try {
+            const process = options.spawn(tenant, port);
+            return { tenant, port, signature, process };
+        }
+        catch (error) {
+            log({
+                level: 'error',
+                message: `Avvio tenant ${tenant.id} fallito: ${error instanceof Error ? error.message : String(error)}`,
+            });
+            return undefined;
+        }
+    };
+    const load = () => {
+        const registry = (0, tenants_1.loadAccessiTenants)(Object.assign({ directory: options.directory }, (options.allowHeader !== undefined ? { allowHeader: options.allowHeader } : {})));
+        const signatures = new Map();
+        for (const tenant of registry.tenants) {
+            signatures.set(tenant.id, fileSignature(tenant.environmentFile));
+        }
+        return { registry, signatures };
+    };
+    const remove = (id) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const entry = running.get(id);
+        if (!entry)
+            return;
+        running.delete(id);
+        log({ level: 'info', message: `Stop tenant ${id} (porta ${entry.port}).` });
+        yield stopProcess(entry.process, (_a = options.stopTimeoutMs) !== null && _a !== void 0 ? _a : 5000);
+    });
+    const startTenant = (tenant, signatures, port) => {
+        var _a, _b, _c;
+        const assignedPort = (_a = port !== null && port !== void 0 ? port : tenant.port) !== null && _a !== void 0 ? _a : nextPort();
+        if ([...running.values()].some((entry) => entry.port === assignedPort)) {
+            log({ level: 'error', message: `Porta ${assignedPort} gia in uso: tenant ${tenant.id} non avviato.` });
+            return false;
+        }
+        const entry = spawnTenant(tenant, assignedPort, (_b = signatures.get(tenant.id)) !== null && _b !== void 0 ? _b : '');
+        if (!entry)
+            return false;
+        running.set(tenant.id, entry);
+        log({
+            level: 'info',
+            message: `Avvio tenant ${tenant.id} sulla porta ${assignedPort} (pid ${(_c = entry.process.pid) !== null && _c !== void 0 ? _c : '?'}).`,
+        });
+        return true;
+    };
+    const apply = (registry, signatures) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const desired = new Map(registry.tenants.filter((tenant) => tenant.enabled).map((tenant) => [tenant.id, tenant]));
+        const result = { added: [], removed: [], restarted: [], unchanged: [] };
+        for (const id of [...running.keys()]) {
+            if (!desired.has(id)) {
+                yield remove(id);
+                result.removed.push(id);
+            }
+        }
+        for (const [id, tenant] of desired) {
+            const current = running.get(id);
+            if (!current) {
+                if (startTenant(tenant, signatures))
+                    result.added.push(id);
+                continue;
+            }
+            const signature = (_a = signatures.get(id)) !== null && _a !== void 0 ? _a : '';
+            if (signature === current.signature) {
+                result.unchanged.push(id);
+                continue;
+            }
+            // Riavvio sulla stessa porta: il proxy non cambia configurazione.
+            const port = current.port;
+            yield remove(id);
+            if (startTenant(tenant, signatures, port))
+                result.restarted.push(id);
+        }
+        return result;
+    });
+    const unwatch = () => {
+        if (watchTimer)
+            clearInterval(watchTimer);
+        if (pendingReload)
+            clearTimeout(pendingReload);
+        watchTimer = undefined;
+        pendingReload = undefined;
+    };
+    const reload = () => __awaiter(this, void 0, void 0, function* () {
+        if (reloading || stopping)
+            return { added: [], removed: [], restarted: [], unchanged: [] };
+        reloading = true;
+        try {
+            const signature = accessiTenantDirectorySignature(options.directory);
+            let loaded;
+            try {
+                loaded = load();
+            }
+            catch (error) {
+                log({
+                    level: 'error',
+                    message: `Reload annullato, configurazione non valida: ${error instanceof Error ? error.message : String(error)}`,
+                });
+                lastSignature = signature;
+                return { added: [], removed: [], restarted: [], unchanged: [] };
+            }
+            const result = yield apply(loaded.registry, loaded.signatures);
+            lastSignature = signature;
+            log({
+                level: 'info',
+                message: `Reload tenant: +${result.added.length} -${result.removed.length} ~${result.restarted.length} =${result.unchanged.length}.`,
+            });
+            return result;
+        }
+        finally {
+            reloading = false;
+        }
+    });
+    const stop = () => __awaiter(this, void 0, void 0, function* () {
+        if (stopping)
+            return;
+        stopping = true;
+        unwatch();
+        yield Promise.all([...running.keys()].map((id) => remove(id)));
+    });
+    const watch = () => {
+        var _a, _b;
+        if (watchTimer)
+            return;
+        const interval = Math.max(100, (_a = options.pollIntervalMs) !== null && _a !== void 0 ? _a : 1000);
+        const debounce = Math.max(0, (_b = options.debounceMs) !== null && _b !== void 0 ? _b : 200);
+        watchTimer = setInterval(() => {
+            if (stopping || reloading)
+                return;
+            const signature = accessiTenantDirectorySignature(options.directory);
+            if (signature === lastSignature)
+                return;
+            if (pendingReload)
+                clearTimeout(pendingReload);
+            pendingReload = setTimeout(() => {
+                pendingReload = undefined;
+                void reload();
+            }, debounce);
+        }, interval);
+        if (typeof watchTimer.unref === 'function')
+            watchTimer.unref();
+        log({ level: 'info', message: `Watch attivo su ${options.directory} (${interval} ms).` });
+    };
+    return {
+        start() {
+            return __awaiter(this, void 0, void 0, function* () {
+                const { registry, signatures } = load();
+                lastSignature = accessiTenantDirectorySignature(options.directory);
+                yield apply(registry, signatures);
+                for (const tenant of registry.tenants.filter((entry) => !entry.enabled)) {
+                    log({ level: 'info', message: `Tenant ${tenant.id} disabilitato: non avviato.` });
+                }
+            });
+        },
+        reload,
+        stop,
+        state() {
+            return [...running.values()].map((entry) => ({
+                id: entry.tenant.id,
+                port: entry.port,
+                file: entry.tenant.file,
+                signature: entry.signature,
+            }));
+        },
+        watch,
+        unwatch,
+    };
+}
+/** Attende che una condizione diventi vera (utile nei test e nei runbook). */
+function waitForTenantState(supervisor_1, predicate_1) {
+    return __awaiter(this, arguments, void 0, function* (supervisor, predicate, timeoutMs = 5000) {
+        const deadline = Date.now() + timeoutMs;
+        while (!predicate(supervisor.state())) {
+            if (Date.now() > deadline)
+                throw new Error('timeout in attesa dello stato tenant');
+            yield delay(25);
+        }
+    });
+}
+//# sourceMappingURL=tenantSupervisor.js.map