emilsoftware-utilities 2.0.0-dev.83 → 2.0.0-dev.85

package/dist/accessi/server/standalone.js.map

@@ -1 +1 @@
-{"version":3,"file":"standalone.js","sourceRoot":"","sources":["../../../src/accessi/server/standalone.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAuGA,oDAiGC;AAKD,kDAeC;AA5ND,sDAA8B;AAG9B,yCAAsC;AACtC,mCAAgC;AAChC,yDAA+D;AAK/D,uGAA0G;AAC1G,qEAI+C;AAE/C,mFAAkH;AAClH,wEAAkF;AA8BlF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB,EAAQ,EAAE;QAC1E,QAAQ,IAAI,CAAC,CAAC;QACd,QAAQ,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;;YACpB,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG;YACZ,2DAA2D;YAC3D,4CAA4C;YAC5C,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC5B,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,uCAAuC,MAAM,MAAM,KAAK,EAAE,CAChF;YACD,wDAAwD;YACxD,qCAAqC;YACrC,0BAA0B,QAAQ,EAAE;YACpC,4DAA4D;YAC5D,6CAA6C;YAC7C,kCAAkC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE;YAC/E,2DAA2D;YAC3D,2CAA2C;YAC3C,4CAA4C,MAAM,CAAC,GAAG,EAAE;YACxD,iDAAiD,MAAM,CAAC,QAAQ,EAAE;YAClE,kDAAkD,MAAM,CAAC,SAAS,EAAE;YACpE,oEAAoE;YACpE,oDAAoD;YACpD,uCAAuC,QAAQ,EAAE;SAClD,CAAC;QACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAsB,oBAAoB;yDACxC,UAAiC,EAAE;;QAEnC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,IAAA,mDAA2B,GAAE,CAAC;QAC/E,IAAA,2CAAyB,EAAC,cAAc,CAAC,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,IAAA,wCAAsB,EAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,2BAA2B,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAA,iBAAO,GAAE,CAAC;QACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;QACtD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,OAAiE,CAAC;QACtE,IAAI,QAAmE,CAAC;QACxE,IAAI,MAA0B,CAAC;QAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,mCAAuB,GAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,QAAQ,EAAE,CAAO,IAAa,EAAE,GAAa,EAAE,EAAE;YACpE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE;iBACzE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAqB,EAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,IAAA,+BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAA,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;gBAChE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAA,8BAAoB,GAAE,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAuB,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,WAAW,GAAG,IAAI,CAAC;QAEnB,MAAM,IAAI,GAAG,GAAwB,EAAE;;YACrC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAM,CAAC,CAAC;YACrE,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC5B,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAA,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAA,CAAC;QAEF,MAAM,KAAK,GAAG,GAA0B,EAAE;;YACxC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,IAAI,mCAAI,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,wCAAwC,MAAA,OAAO,CAAC,IAAI,mCAAI,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC;QAChB,CAAC,CAAA,CAAC;QAEF,OAAO;YACL,GAAG;YACH,IAAI,OAAO;gBACT,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,QAAQ;gBACV,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACrE,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,KAAK;YACL,IAAI;SACL,CAAC;IACJ,CAAC;CAAA;AAED;;GAEG;AACH,SAAsB,mBAAmB;yDAAC,UAAiC,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAEtB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAO,MAAc,EAAiB,EAAE;YACvD,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,MAAM,qBAAqB,CAAC,CAAC;YAC3E,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAA,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;CAAA","sourcesContent":["import express from 'express';\nimport type { Application, Request, Response } from 'express';\nimport type { Server } from 'http';\nimport { Logger } from '../../Logger';\nimport { Orm } from '../../Orm';\nimport { initializeAccessiModule } from '../../accessi-module';\nimport type {\n  AccessiModuleInitializationResult,\n} from '../../accessi-module';\nimport type { AccessiOptions } from '../../accessi-module/AccessiModule';\nimport { createAccessiOptionsFromEnv } from '../../accessi-module/database-updates/accessiOptionsFromEnv';\nimport {\n  checkAccessiReadiness,\n  createAccessiLiveReport,\n  readinessHttpStatus,\n} from '../../accessi-module/health/readiness';\nimport type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';\nimport { assertValidAccessiOptions, validateAccessiOptions } from '../../accessi-module/security/validateOptions';\nimport { renderAccessiMetrics } from '../../accessi-module/observability/metrics';\n\nexport type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';\n\n\nexport interface AccessiServiceOptions {\n  /** Applicazione Express gia esistente. Default: nuova app. */\n  app?: Application;\n  /** Configurazione completa. Default: `createAccessiOptionsFromEnv()`. */\n  accessiOptions?: AccessiOptions;\n  port?: number;\n  host?: string;\n  /** Path base degli endpoint health. Default: `/health`. */\n  healthPath?: string;\n  /** Espone `/health/metrics` in formato Prometheus. Default: true. */\n  metrics?: boolean;\n  /** Check aggiuntivi per la readiness. */\n  readinessChecks?: AccessiReadinessCheck[];\n  /** Timeout chiusura server. Default: 10000 ms. */\n  shutdownTimeoutMs?: number;\n}\n\nexport interface AccessiService {\n  app: Application;\n  nestApp: AccessiModuleInitializationResult['nestApp'];\n  document: AccessiModuleInitializationResult['document'];\n  start(): Promise<Server>;\n  stop(): Promise<void>;\n}\n\nfunction normalizePath(value: string): string {\n  return `/${value.replace(/^\\/+|\\/+$/g, '')}`;\n}\n\nfunction createMetrics() {\n  const startedAt = Date.now();\n  let requests = 0;\n  let inFlight = 0;\n  const statuses = new Map<string, number>();\n\n  const middleware = (_req: Request, res: Response, next: () => void): void => {\n    requests += 1;\n    inFlight += 1;\n    res.on('finish', () => {\n      inFlight = Math.max(0, inFlight - 1);\n      const status = String(res.statusCode);\n      statuses.set(status, (statuses.get(status) ?? 0) + 1);\n    });\n    next();\n  };\n\n  const render = (): string => {\n    const memory = process.memoryUsage();\n    const lines = [\n      '# HELP accessi_http_requests_total Richieste HTTP totali.',\n      '# TYPE accessi_http_requests_total counter',\n      ...[...statuses.entries()].map(\n        ([status, count]) => `accessi_http_requests_total{status=\"${status}\"} ${count}`,\n      ),\n      '# HELP accessi_http_in_flight Richieste HTTP in corso.',\n      '# TYPE accessi_http_in_flight gauge',\n      `accessi_http_in_flight ${inFlight}`,\n      '# HELP accessi_process_uptime_seconds Uptime del processo.',\n      '# TYPE accessi_process_uptime_seconds gauge',\n      `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,\n      '# HELP accessi_process_memory_bytes Memoria del processo.',\n      '# TYPE accessi_process_memory_bytes gauge',\n      `accessi_process_memory_bytes{type=\"rss\"} ${memory.rss}`,\n      `accessi_process_memory_bytes{type=\"heapUsed\"} ${memory.heapUsed}`,\n      `accessi_process_memory_bytes{type=\"heapTotal\"} ${memory.heapTotal}`,\n      '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',\n      '# TYPE accessi_http_requests_started_total counter',\n      `accessi_http_requests_started_total ${requests}`,\n    ];\n    return `${lines.join('\\n')}\\n`;\n  };\n\n  return { middleware, render };\n}\n\n/**\n * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.\n *\n * Non apre la porta finche non viene chiamato `start()`.\n */\nexport async function createAccessiService(\n  options: AccessiServiceOptions = {},\n): Promise<AccessiService> {\n  const logger = new Logger('AccessiService');\n  const accessiOptions = options.accessiOptions ?? createAccessiOptionsFromEnv();\n  assertValidAccessiOptions(accessiOptions);\n  for (const warning of validateAccessiOptions(accessiOptions).warnings) {\n    logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);\n  }\n\n  const app = options.app ?? express();\n  const healthPath = normalizePath(options.healthPath ?? '/health');\n  const metrics = createMetrics();\n  const readinessChecks = options.readinessChecks ?? [];\n  let initialized = false;\n  let nestApp: AccessiModuleInitializationResult['nestApp'] | undefined;\n  let document: AccessiModuleInitializationResult['document'] | undefined;\n  let server: Server | undefined;\n  let stopping = false;\n\n  app.use(metrics.middleware);\n\n  app.get(`${healthPath}/live`, (_req: Request, res: Response) => {\n    res.status(200).json(createAccessiLiveReport());\n  });\n\n  app.get(`${healthPath}/ready`, async (_req: Request, res: Response) => {\n    if (!initialized || !nestApp) {\n      res.status(503).json({\n        status: 'error',\n        checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },\n      });\n      return;\n    }\n\n    const report = await checkAccessiReadiness(accessiOptions, readinessChecks);\n    res.status(readinessHttpStatus(report)).json(report);\n  });\n\n  if (options.metrics !== false) {\n    app.get(`${healthPath}/metrics`, (_req: Request, res: Response) => {\n      res.setHeader('Content-Type', 'text/plain; version=0.0.4');\n      res.status(200).send(`${metrics.render()}${renderAccessiMetrics()}`);\n    });\n  }\n\n  const result = await initializeAccessiModule(app, accessiOptions);\n  nestApp = result.nestApp;\n  document = result.document;\n  initialized = true;\n\n  const stop = async (): Promise<void> => {\n    if (stopping) return;\n    stopping = true;\n    const timeout = Math.max(1_000, options.shutdownTimeoutMs ?? 10_000);\n    await Promise.race([\n      new Promise<void>((resolve) => {\n        if (!server) return resolve();\n        server.close(() => resolve());\n      }),\n      new Promise<void>((resolve) => setTimeout(resolve, timeout)),\n    ]);\n    try {\n      await nestApp?.close();\n    } finally {\n      await Orm.closePools();\n    }\n  };\n\n  const start = async (): Promise<Server> => {\n    if (server) return server;\n    const port = options.port ?? Number(process.env.PORT ?? 3000);\n    server = await new Promise<Server>((resolve, reject) => {\n      const listener = options.host\n        ? app.listen(port, options.host, () => resolve(listener))\n        : app.listen(port, () => resolve(listener));\n      listener.once('error', reject);\n    });\n    const address = server.address();\n    const actualPort = typeof address === 'object' && address ? address.port : port;\n    logger.info(`Accessi Service in ascolto su http://${options.host ?? '0.0.0.0'}:${actualPort}`);\n    return server;\n  };\n\n  return {\n    app,\n    get nestApp() {\n      if (!nestApp) throw new Error('Accessi Service non inizializzato.');\n      return nestApp;\n    },\n    get document() {\n      if (!document) throw new Error('Documento OpenAPI non disponibile.');\n      return document;\n    },\n    start,\n    stop,\n  };\n}\n\n/**\n * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.\n */\nexport async function startAccessiService(options: AccessiServiceOptions = {}): Promise<AccessiService> {\n  const service = await createAccessiService(options);\n  await service.start();\n\n  let shuttingDown = false;\n  const shutdown = async (signal: string): Promise<void> => {\n    if (shuttingDown) return;\n    shuttingDown = true;\n    new Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);\n    await service.stop();\n  };\n\n  process.once('SIGTERM', () => { void shutdown('SIGTERM'); });\n  process.once('SIGINT', () => { void shutdown('SIGINT'); });\n  return service;\n}\n"]}
+{"version":3,"file":"standalone.js","sourceRoot":"","sources":["../../../src/accessi/server/standalone.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAuGA,oDAiGC;AAKD,kDAeC;AA5ND,sDAA8B;AAG9B,yCAAsC;AACtC,mCAAgC;AAChC,2DAAgE;AAKhE,wGAA2G;AAC3G,sEAIgD;AAEhD,oFAAmH;AACnH,yEAAmF;AA8BnF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB,EAAQ,EAAE;QAC1E,QAAQ,IAAI,CAAC,CAAC;QACd,QAAQ,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;;YACpB,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG;YACZ,2DAA2D;YAC3D,4CAA4C;YAC5C,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC5B,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,uCAAuC,MAAM,MAAM,KAAK,EAAE,CAChF;YACD,wDAAwD;YACxD,qCAAqC;YACrC,0BAA0B,QAAQ,EAAE;YACpC,4DAA4D;YAC5D,6CAA6C;YAC7C,kCAAkC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE;YAC/E,2DAA2D;YAC3D,2CAA2C;YAC3C,4CAA4C,MAAM,CAAC,GAAG,EAAE;YACxD,iDAAiD,MAAM,CAAC,QAAQ,EAAE;YAClE,kDAAkD,MAAM,CAAC,SAAS,EAAE;YACpE,oEAAoE;YACpE,oDAAoD;YACpD,uCAAuC,QAAQ,EAAE;SAClD,CAAC;QACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAsB,oBAAoB;yDACxC,UAAiC,EAAE;;QAEnC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,IAAA,mDAA2B,GAAE,CAAC;QAC/E,IAAA,2CAAyB,EAAC,cAAc,CAAC,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,IAAA,wCAAsB,EAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,2BAA2B,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAA,iBAAO,GAAE,CAAC;QACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;QACtD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,OAAiE,CAAC;QACtE,IAAI,QAAmE,CAAC;QACxE,IAAI,MAA0B,CAAC;QAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,mCAAuB,GAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,QAAQ,EAAE,CAAO,IAAa,EAAE,GAAa,EAAE,EAAE;YACpE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE;iBACzE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAqB,EAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,IAAA,+BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAA,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;gBAChE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAA,8BAAoB,GAAE,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,yCAAuB,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,WAAW,GAAG,IAAI,CAAC;QAEnB,MAAM,IAAI,GAAG,GAAwB,EAAE;;YACrC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAM,CAAC,CAAC;YACrE,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC5B,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAA,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAA,CAAC;QAEF,MAAM,KAAK,GAAG,GAA0B,EAAE;;YACxC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,IAAI,mCAAI,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,wCAAwC,MAAA,OAAO,CAAC,IAAI,mCAAI,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC;QAChB,CAAC,CAAA,CAAC;QAEF,OAAO;YACL,GAAG;YACH,IAAI,OAAO;gBACT,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,QAAQ;gBACV,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACrE,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,KAAK;YACL,IAAI;SACL,CAAC;IACJ,CAAC;CAAA;AAED;;GAEG;AACH,SAAsB,mBAAmB;yDAAC,UAAiC,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAEtB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAO,MAAc,EAAiB,EAAE;YACvD,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,MAAM,qBAAqB,CAAC,CAAC;YAC3E,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAA,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;CAAA","sourcesContent":["import express from 'express';\nimport type { Application, Request, Response } from 'express';\nimport type { Server } from 'http';\nimport { Logger } from '../../Logger';\nimport { Orm } from '../../Orm';\nimport { initializeAccessiModule } from '../../accessi-service';\nimport type {\n  AccessiModuleInitializationResult,\n} from '../../accessi-service';\nimport type { AccessiOptions } from '../../accessi-service/AccessiModule';\nimport { createAccessiOptionsFromEnv } from '../../accessi-service/database-updates/accessiOptionsFromEnv';\nimport {\n  checkAccessiReadiness,\n  createAccessiLiveReport,\n  readinessHttpStatus,\n} from '../../accessi-service/health/readiness';\nimport type { AccessiReadinessCheck } from '../../accessi-service/health/readiness';\nimport { assertValidAccessiOptions, validateAccessiOptions } from '../../accessi-service/security/validateOptions';\nimport { renderAccessiMetrics } from '../../accessi-service/observability/metrics';\n\nexport type { AccessiReadinessCheck } from '../../accessi-service/health/readiness';\n\n\nexport interface AccessiServiceOptions {\n  /** Applicazione Express gia esistente. Default: nuova app. */\n  app?: Application;\n  /** Configurazione completa. Default: `createAccessiOptionsFromEnv()`. */\n  accessiOptions?: AccessiOptions;\n  port?: number;\n  host?: string;\n  /** Path base degli endpoint health. Default: `/health`. */\n  healthPath?: string;\n  /** Espone `/health/metrics` in formato Prometheus. Default: true. */\n  metrics?: boolean;\n  /** Check aggiuntivi per la readiness. */\n  readinessChecks?: AccessiReadinessCheck[];\n  /** Timeout chiusura server. Default: 10000 ms. */\n  shutdownTimeoutMs?: number;\n}\n\nexport interface AccessiService {\n  app: Application;\n  nestApp: AccessiModuleInitializationResult['nestApp'];\n  document: AccessiModuleInitializationResult['document'];\n  start(): Promise<Server>;\n  stop(): Promise<void>;\n}\n\nfunction normalizePath(value: string): string {\n  return `/${value.replace(/^\\/+|\\/+$/g, '')}`;\n}\n\nfunction createMetrics() {\n  const startedAt = Date.now();\n  let requests = 0;\n  let inFlight = 0;\n  const statuses = new Map<string, number>();\n\n  const middleware = (_req: Request, res: Response, next: () => void): void => {\n    requests += 1;\n    inFlight += 1;\n    res.on('finish', () => {\n      inFlight = Math.max(0, inFlight - 1);\n      const status = String(res.statusCode);\n      statuses.set(status, (statuses.get(status) ?? 0) + 1);\n    });\n    next();\n  };\n\n  const render = (): string => {\n    const memory = process.memoryUsage();\n    const lines = [\n      '# HELP accessi_http_requests_total Richieste HTTP totali.',\n      '# TYPE accessi_http_requests_total counter',\n      ...[...statuses.entries()].map(\n        ([status, count]) => `accessi_http_requests_total{status=\"${status}\"} ${count}`,\n      ),\n      '# HELP accessi_http_in_flight Richieste HTTP in corso.',\n      '# TYPE accessi_http_in_flight gauge',\n      `accessi_http_in_flight ${inFlight}`,\n      '# HELP accessi_process_uptime_seconds Uptime del processo.',\n      '# TYPE accessi_process_uptime_seconds gauge',\n      `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,\n      '# HELP accessi_process_memory_bytes Memoria del processo.',\n      '# TYPE accessi_process_memory_bytes gauge',\n      `accessi_process_memory_bytes{type=\"rss\"} ${memory.rss}`,\n      `accessi_process_memory_bytes{type=\"heapUsed\"} ${memory.heapUsed}`,\n      `accessi_process_memory_bytes{type=\"heapTotal\"} ${memory.heapTotal}`,\n      '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',\n      '# TYPE accessi_http_requests_started_total counter',\n      `accessi_http_requests_started_total ${requests}`,\n    ];\n    return `${lines.join('\\n')}\\n`;\n  };\n\n  return { middleware, render };\n}\n\n/**\n * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.\n *\n * Non apre la porta finche non viene chiamato `start()`.\n */\nexport async function createAccessiService(\n  options: AccessiServiceOptions = {},\n): Promise<AccessiService> {\n  const logger = new Logger('AccessiService');\n  const accessiOptions = options.accessiOptions ?? createAccessiOptionsFromEnv();\n  assertValidAccessiOptions(accessiOptions);\n  for (const warning of validateAccessiOptions(accessiOptions).warnings) {\n    logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);\n  }\n\n  const app = options.app ?? express();\n  const healthPath = normalizePath(options.healthPath ?? '/health');\n  const metrics = createMetrics();\n  const readinessChecks = options.readinessChecks ?? [];\n  let initialized = false;\n  let nestApp: AccessiModuleInitializationResult['nestApp'] | undefined;\n  let document: AccessiModuleInitializationResult['document'] | undefined;\n  let server: Server | undefined;\n  let stopping = false;\n\n  app.use(metrics.middleware);\n\n  app.get(`${healthPath}/live`, (_req: Request, res: Response) => {\n    res.status(200).json(createAccessiLiveReport());\n  });\n\n  app.get(`${healthPath}/ready`, async (_req: Request, res: Response) => {\n    if (!initialized || !nestApp) {\n      res.status(503).json({\n        status: 'error',\n        checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },\n      });\n      return;\n    }\n\n    const report = await checkAccessiReadiness(accessiOptions, readinessChecks);\n    res.status(readinessHttpStatus(report)).json(report);\n  });\n\n  if (options.metrics !== false) {\n    app.get(`${healthPath}/metrics`, (_req: Request, res: Response) => {\n      res.setHeader('Content-Type', 'text/plain; version=0.0.4');\n      res.status(200).send(`${metrics.render()}${renderAccessiMetrics()}`);\n    });\n  }\n\n  const result = await initializeAccessiModule(app, accessiOptions);\n  nestApp = result.nestApp;\n  document = result.document;\n  initialized = true;\n\n  const stop = async (): Promise<void> => {\n    if (stopping) return;\n    stopping = true;\n    const timeout = Math.max(1_000, options.shutdownTimeoutMs ?? 10_000);\n    await Promise.race([\n      new Promise<void>((resolve) => {\n        if (!server) return resolve();\n        server.close(() => resolve());\n      }),\n      new Promise<void>((resolve) => setTimeout(resolve, timeout)),\n    ]);\n    try {\n      await nestApp?.close();\n    } finally {\n      await Orm.closePools();\n    }\n  };\n\n  const start = async (): Promise<Server> => {\n    if (server) return server;\n    const port = options.port ?? Number(process.env.PORT ?? 3000);\n    server = await new Promise<Server>((resolve, reject) => {\n      const listener = options.host\n        ? app.listen(port, options.host, () => resolve(listener))\n        : app.listen(port, () => resolve(listener));\n      listener.once('error', reject);\n    });\n    const address = server.address();\n    const actualPort = typeof address === 'object' && address ? address.port : port;\n    logger.info(`Accessi Service in ascolto su http://${options.host ?? '0.0.0.0'}:${actualPort}`);\n    return server;\n  };\n\n  return {\n    app,\n    get nestApp() {\n      if (!nestApp) throw new Error('Accessi Service non inizializzato.');\n      return nestApp;\n    },\n    get document() {\n      if (!document) throw new Error('Documento OpenAPI non disponibile.');\n      return document;\n    },\n    start,\n    stop,\n  };\n}\n\n/**\n * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.\n */\nexport async function startAccessiService(options: AccessiServiceOptions = {}): Promise<AccessiService> {\n  const service = await createAccessiService(options);\n  await service.start();\n\n  let shuttingDown = false;\n  const shutdown = async (signal: string): Promise<void> => {\n    if (shuttingDown) return;\n    shuttingDown = true;\n    new Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);\n    await service.stop();\n  };\n\n  process.once('SIGTERM', () => { void shutdown('SIGTERM'); });\n  process.once('SIGINT', () => { void shutdown('SIGINT'); });\n  return service;\n}\n"]}

package/dist/accessi/server/tenantRouter.d.ts

@@ -0,0 +1,35 @@
+import type { Request, RequestHandler } from 'express';
+import type { AccessiTenant, AccessiTenantRegistry } from './tenants';
+/** Request arricchita dal router con il tenant risolto. */
+export interface AccessiTenantAwareRequest extends Request {
+    accessiTenant?: AccessiTenant;
+}
+export interface CreateAccessiTenantRouterOptions {
+    registry: AccessiTenantRegistry;
+    /**
+     * Handler per tenant. Ogni handler deve essere indipendente (per esempio
+     * l'app Express di un `createAccessiService` gia inizializzato).
+     */
+    handlers: Record<string, RequestHandler> | Map<string, RequestHandler>;
+    /** Abilita l'header `x-accessi-tenant`. Default: false. */
+    allowHeader?: boolean;
+    /** Nome header tenant. Default `x-accessi-tenant`. */
+    headerName?: string;
+    /** Risposta quando nessun tenant corrisponde. Default: 404 JSON Accessi. */
+    onNotFound?: RequestHandler;
+    /** Risposta quando il tenant esiste ma non ha handler. Default: 501 JSON. */
+    onMissingHandler?: RequestHandler;
+}
+/**
+ * Router multi-tenant in-process (opt-in, fase 4 ADR).
+ *
+ * Risolve il tenant da host, path e header fidato, poi delega al suo handler
+ * dentro `runWithAccessiTenant`: audit e metriche emessi durante la richiesta
+ * ricevono il label `tenant`. Nessun fallback implicito: un host/path
+ * sconosciuto risponde 404 e non usa il primo tenant disponibile.
+ *
+ * Non sostituisce il processo-per-tenant come default: gli handler restano
+ * applicazioni indipendenti e le API globali (`authorizeAccessi`,
+ * `setAccessiAuthService`) non sono tenant-aware.
+ */
+export declare function createAccessiTenantRouter(options: CreateAccessiTenantRouterOptions): RequestHandler;

package/dist/accessi/server/tenantRouter.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiTenantRouter = createAccessiTenantRouter;
+const tenantContext_1 = require("../../accessi-service/tenancy/tenantContext");
+function defaultHeader(request, name) {
+    const value = request.headers[name];
+    if (Array.isArray(value))
+        return value[0];
+    return typeof value === 'string' ? value : undefined;
+}
+function requestPath(request) {
+    if (typeof request.path === 'string' && request.path !== '')
+        return request.path;
+    const url = typeof request.url === 'string' ? request.url : '/';
+    const query = url.indexOf('?');
+    return query >= 0 ? url.slice(0, query) : url;
+}
+function getHandler(handlers, tenantId) {
+    if (handlers instanceof Map)
+        return handlers.get(tenantId);
+    return Object.prototype.hasOwnProperty.call(handlers, tenantId)
+        ? handlers[tenantId]
+        : undefined;
+}
+function sendTenantError(res, status, code, message) {
+    return res.status(status).json({
+        severity: 'error',
+        status,
+        statusCode: 2,
+        code,
+        error: code,
+        message,
+    });
+}
+/**
+ * Router multi-tenant in-process (opt-in, fase 4 ADR).
+ *
+ * Risolve il tenant da host, path e header fidato, poi delega al suo handler
+ * dentro `runWithAccessiTenant`: audit e metriche emessi durante la richiesta
+ * ricevono il label `tenant`. Nessun fallback implicito: un host/path
+ * sconosciuto risponde 404 e non usa il primo tenant disponibile.
+ *
+ * Non sostituisce il processo-per-tenant come default: gli handler restano
+ * applicazioni indipendenti e le API globali (`authorizeAccessi`,
+ * `setAccessiAuthService`) non sono tenant-aware.
+ */
+function createAccessiTenantRouter(options) {
+    var _a, _b, _c;
+    if (!(options === null || options === void 0 ? void 0 : options.registry))
+        throw new Error('createAccessiTenantRouter: registry obbligatorio.');
+    if (!options.handlers)
+        throw new Error('createAccessiTenantRouter: handlers obbligatorio.');
+    const headerName = ((_a = options.headerName) !== null && _a !== void 0 ? _a : 'x-accessi-tenant').toLowerCase();
+    const notFound = (_b = options.onNotFound) !== null && _b !== void 0 ? _b : ((_req, res) => sendTenantError(res, 404, 'ACCESSI_TENANT_NOT_FOUND', 'Nessun tenant Accessi configurato per questa richiesta.'));
+    const missingHandler = (_c = options.onMissingHandler) !== null && _c !== void 0 ? _c : ((_req, res) => sendTenantError(res, 501, 'ACCESSI_TENANT_HANDLER_MISSING', 'Tenant risolto ma nessun handler configurato.'));
+    return (request, response, next) => {
+        const resolution = options.registry.resolve(Object.assign(Object.assign(Object.assign({}, (typeof request.headers.host === 'string' ? { host: request.headers.host } : {})), { path: requestPath(request) }), (defaultHeader(request, headerName) ? { header: defaultHeader(request, headerName) } : {})), options.allowHeader !== undefined ? { allowHeader: options.allowHeader } : undefined);
+        if (!resolution) {
+            notFound(request, response, next);
+            return;
+        }
+        const handler = getHandler(options.handlers, resolution.tenant.id);
+        if (!handler) {
+            missingHandler(request, response, next);
+            return;
+        }
+        request.accessiTenant = resolution.tenant;
+        return (0, tenantContext_1.runWithAccessiTenant)(resolution.tenant.id, () => handler(request, response, next));
+    };
+}
+//# sourceMappingURL=tenantRouter.js.map

package/dist/accessi/server/tenantRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantRouter.js","sourceRoot":"","sources":["../../../src/accessi/server/tenantRouter.ts"],"names":[],"mappings":";;AA6EA,8DA2CC;AAtHD,+EAAmF;AAwBnF,SAAS,aAAa,CAAC,OAAgB,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACjF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CACjB,QAAsD,EACtD,QAAgB;IAEhB,IAAI,QAAQ,YAAY,GAAG;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC7D,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,GAAa,EACb,MAAc,EACd,IAAY,EACZ,OAAe;IAEf,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAC7B,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,UAAU,EAAE,CAAC;QACb,IAAI;QACJ,KAAK,EAAE,IAAI;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,yBAAyB,CACvC,OAAyC;;IAEzC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7F,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAE5F,MAAM,UAAU,GAAG,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE,CAAC,eAAe,CACvF,GAAG,EACH,GAAG,EACH,0BAA0B,EAC1B,yDAAyD,CAC1D,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE,CAAC,eAAe,CACnG,GAAG,EACH,GAAG,EACH,gCAAgC,EAChC,+CAA+C,CAChD,CAAC,CAAC;IAEH,OAAO,CAAC,OAAgB,EAAE,QAAkB,EAAE,IAAkB,EAAwB,EAAE;QACxF,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,+CAEpC,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACnF,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KACvB,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAE/F,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CACrF,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAEA,OAAqC,CAAC,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC;QACzE,OAAO,IAAA,oCAAoB,EAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAyB,CAAC;IACpH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\nimport type { AccessiTenant, AccessiTenantRegistry } from './tenants';\nimport { runWithAccessiTenant } from '../../accessi-service/tenancy/tenantContext';\n\n/** Request arricchita dal router con il tenant risolto. */\nexport interface AccessiTenantAwareRequest extends Request {\n  accessiTenant?: AccessiTenant;\n}\n\nexport interface CreateAccessiTenantRouterOptions {\n  registry: AccessiTenantRegistry;\n  /**\n   * Handler per tenant. Ogni handler deve essere indipendente (per esempio\n   * l'app Express di un `createAccessiService` gia inizializzato).\n   */\n  handlers: Record<string, RequestHandler> | Map<string, RequestHandler>;\n  /** Abilita l'header `x-accessi-tenant`. Default: false. */\n  allowHeader?: boolean;\n  /** Nome header tenant. Default `x-accessi-tenant`. */\n  headerName?: string;\n  /** Risposta quando nessun tenant corrisponde. Default: 404 JSON Accessi. */\n  onNotFound?: RequestHandler;\n  /** Risposta quando il tenant esiste ma non ha handler. Default: 501 JSON. */\n  onMissingHandler?: RequestHandler;\n}\n\nfunction defaultHeader(request: Request, name: string): string | undefined {\n  const value = request.headers[name];\n  if (Array.isArray(value)) return value[0];\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction requestPath(request: Request): string {\n  if (typeof request.path === 'string' && request.path !== '') return request.path;\n  const url = typeof request.url === 'string' ? request.url : '/';\n  const query = url.indexOf('?');\n  return query >= 0 ? url.slice(0, query) : url;\n}\n\nfunction getHandler(\n  handlers: CreateAccessiTenantRouterOptions['handlers'],\n  tenantId: string,\n): RequestHandler | undefined {\n  if (handlers instanceof Map) return handlers.get(tenantId);\n  return Object.prototype.hasOwnProperty.call(handlers, tenantId)\n    ? handlers[tenantId]\n    : undefined;\n}\n\nfunction sendTenantError(\n  res: Response,\n  status: number,\n  code: string,\n  message: string,\n): Response {\n  return res.status(status).json({\n    severity: 'error',\n    status,\n    statusCode: 2,\n    code,\n    error: code,\n    message,\n  });\n}\n\n/**\n * Router multi-tenant in-process (opt-in, fase 4 ADR).\n *\n * Risolve il tenant da host, path e header fidato, poi delega al suo handler\n * dentro `runWithAccessiTenant`: audit e metriche emessi durante la richiesta\n * ricevono il label `tenant`. Nessun fallback implicito: un host/path\n * sconosciuto risponde 404 e non usa il primo tenant disponibile.\n *\n * Non sostituisce il processo-per-tenant come default: gli handler restano\n * applicazioni indipendenti e le API globali (`authorizeAccessi`,\n * `setAccessiAuthService`) non sono tenant-aware.\n */\nexport function createAccessiTenantRouter(\n  options: CreateAccessiTenantRouterOptions,\n): RequestHandler {\n  if (!options?.registry) throw new Error('createAccessiTenantRouter: registry obbligatorio.');\n  if (!options.handlers) throw new Error('createAccessiTenantRouter: handlers obbligatorio.');\n\n  const headerName = (options.headerName ?? 'x-accessi-tenant').toLowerCase();\n  const notFound = options.onNotFound ?? ((_req: Request, res: Response) => sendTenantError(\n    res,\n    404,\n    'ACCESSI_TENANT_NOT_FOUND',\n    'Nessun tenant Accessi configurato per questa richiesta.',\n  ));\n  const missingHandler = options.onMissingHandler ?? ((_req: Request, res: Response) => sendTenantError(\n    res,\n    501,\n    'ACCESSI_TENANT_HANDLER_MISSING',\n    'Tenant risolto ma nessun handler configurato.',\n  ));\n\n  return (request: Request, response: Response, next: NextFunction): void | Promise<void> => {\n    const resolution = options.registry.resolve(\n      {\n        ...(typeof request.headers.host === 'string' ? { host: request.headers.host } : {}),\n        path: requestPath(request),\n        ...(defaultHeader(request, headerName) ? { header: defaultHeader(request, headerName) } : {}),\n      },\n      options.allowHeader !== undefined ? { allowHeader: options.allowHeader } : undefined,\n    );\n\n    if (!resolution) {\n      notFound(request, response, next);\n      return;\n    }\n    const handler = getHandler(options.handlers, resolution.tenant.id);\n    if (!handler) {\n      missingHandler(request, response, next);\n      return;\n    }\n\n    (request as AccessiTenantAwareRequest).accessiTenant = resolution.tenant;\n    return runWithAccessiTenant(resolution.tenant.id, () => handler(request, response, next)) as void | Promise<void>;\n  };\n}\n"]}

package/dist/accessi/server/tenantStores.d.ts

@@ -1,9 +1,9 @@
-import type { AccessiOptions } from '../../accessi-module/AccessiModule';
-import type { RateLimitStore } from '../../accessi-module/security/rateLimitStore';
-import type { ConsoleEntryStore } from '../../accessi-module/security/consoleEntry';
-import type { SessionRevocationStore } from '../../accessi-module/security/sessionRevocation';
-import type { AccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';
-import type { RefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';
+import type { AccessiOptions } from '../../accessi-service/AccessiModule';
+import type { RateLimitStore } from '../../accessi-service/security/rateLimitStore';
+import type { ConsoleEntryStore } from '../../accessi-service/security/consoleEntry';
+import type { SessionRevocationStore } from '../../accessi-service/security/sessionRevocation';
+import type { AccessTokenRevocationStore } from '../../accessi-service/security/accessTokenRevocation';
+import type { RefreshTokenRotationStore } from '../../accessi-service/security/refreshTokenRotation';
 /** Client Redis minimo accettato dagli store Accessi. */
 export interface AccessiTenantRedisClient {
     eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;

package/dist/accessi/server/tenantStores.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAccessiTenantStorePrefixes = getAccessiTenantStorePrefixes;
 exports.createAccessiTenantStores = createAccessiTenantStores;
 const tenants_1 = require("./tenants");
-const rateLimitStore_1 = require("../../accessi-module/security/rateLimitStore");
-const consoleEntry_1 = require("../../accessi-module/security/consoleEntry");
-const sessionRevocation_1 = require("../../accessi-module/security/sessionRevocation");
-const accessTokenRevocation_1 = require("../../accessi-module/security/accessTokenRevocation");
-const refreshTokenRotation_1 = require("../../accessi-module/security/refreshTokenRotation");
+const rateLimitStore_1 = require("../../accessi-service/security/rateLimitStore");
+const consoleEntry_1 = require("../../accessi-service/security/consoleEntry");
+const sessionRevocation_1 = require("../../accessi-service/security/sessionRevocation");
+const accessTokenRevocation_1 = require("../../accessi-service/security/accessTokenRevocation");
+const refreshTokenRotation_1 = require("../../accessi-service/security/refreshTokenRotation");
 /**
  * Prefissi Redis isolati per tenant.
  *

package/dist/accessi/server/tenantStores.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenantStores.js","sourceRoot":"","sources":["../../../src/accessi/server/tenantStores.ts"],"names":[],"mappings":";;AA6EA,sEAeC;AASD,8DA2FC;AA/LD,uCAAwD;AACxD,iFAAyF;AAEzF,6EAA0F;AAE1F,uFAAoG;AAEpG,+FAA4G;AAE5G,6FAA0G;AA6D1G;;;;;GAKG;AACH,SAAgB,6BAA6B,CAC3C,QAAgB,EAChB,YAAwC,EAAE;;IAE1C,MAAM,IAAI,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,IAAA,qCAA2B,EAAC,QAAQ,CAAC,CAAC;IACrE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,MAAA,SAAS,CAAC,SAAS,mCAAI,GAAG,IAAI,OAAO;QAChD,qBAAqB,EAAE,MAAA,SAAS,CAAC,qBAAqB,mCAAI,GAAG,IAAI,qBAAqB;QACtF,iBAAiB,EAAE,MAAA,SAAS,CAAC,iBAAiB,mCAAI,GAAG,IAAI,UAAU;QACnE,qBAAqB,EAAE,MAAA,SAAS,CAAC,qBAAqB,mCAAI,GAAG,IAAI,MAAM;QACvE,oBAAoB,EAAE,MAAA,SAAS,CAAC,oBAAoB,mCAAI,GAAG,IAAI,UAAU;QACzE,kBAAkB,EAAE,MAAA,SAAS,CAAC,kBAAkB,mCAAI,GAAG,IAAI,iBAAiB;QAC5E,YAAY,EAAE,MAAA,SAAS,CAAC,YAAY,mCAAI,GAAG,IAAI,gBAAgB;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACvC,OAAyC;;IAEzC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,QAAQ,kCAC1D,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChD,CAAC,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE,CAAC,EAC3B,CAAC;IACH,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,KAAK,KAAK,CAAC;IAEhF,MAAM,SAAS,GAAG,IAAA,0CAAyB,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,MAAM,qBAAqB,GAAG,IAAA,0CAAyB,EAAC;QACtD,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,IAAA,qDAAiC,kBACzD,MAAM,EACN,SAAS,EAAE,QAAQ,CAAC,iBAAiB,IAClC,CAAC,OAAO,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClG,CAAC;IACH,MAAM,qBAAqB,GAAG,IAAA,6DAAqC,kBACjE,MAAM,EACN,SAAS,EAAE,QAAQ,CAAC,qBAAqB,IACtC,CAAC,OAAO,CAAC,0BAA0B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1G,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAA,2DAAoC,EAAC;QAChE,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,oBAAoB;QACxC,eAAe,EAAE,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAA,2CAA4B,kBAC/C,MAAM;QACN,aAAa,EACb,SAAS,EAAE,QAAQ,CAAC,YAAY,IAC7B,CAAC,OAAO,CAAC,4BAA4B,KAAK,SAAS;QACpD,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,4BAA4B,EAAE;QAC5D,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,SAAS;QACT,qBAAqB;QACrB,iBAAiB;QACjB,qBAAqB;QACrB,oBAAoB;QACpB,YAAY;QACZ,OAAO,CAAC,cAAc;;YACpB,uCACK,cAAc,KACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAC1B,mBAAmB,kCACd,cAAc,CAAC,mBAAmB,KACrC,KAAK,EAAE,SAAS,KAElB,aAAa,kCACR,cAAc,CAAC,aAAa,KAC/B,cAAc,EAAE,qBAAqB,KAEvC,iBAAiB,kCACZ,cAAc,CAAC,iBAAiB,KACnC,KAAK,EAAE,iBAAiB,KAE1B,qBAAqB,kCAChB,cAAc,CAAC,qBAAqB,KACvC,KAAK,EAAE,qBAAqB,KAE9B,oBAAoB,kCACf,cAAc,CAAC,oBAAoB,KACtC,OAAO,EAAE,MAAA,MAAA,cAAc,CAAC,oBAAoB,0CAAE,OAAO,mCAAI,0BAA0B,EACnF,KAAK,EAAE,oBAAoB,KAE7B,YAAY,kCACP,cAAc,CAAC,YAAY,KAC9B,KAAK,EAAE,YAAY,OAErB;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AccessiOptions } from '../../accessi-module/AccessiModule';\nimport { getAccessiTenantRedisPrefix } from './tenants';\nimport { createRedisRateLimitStore } from '../../accessi-module/security/rateLimitStore';\nimport type { RateLimitStore } from '../../accessi-module/security/rateLimitStore';\nimport { createRedisConsoleEntryStore } from '../../accessi-module/security/consoleEntry';\nimport type { ConsoleEntryStore } from '../../accessi-module/security/consoleEntry';\nimport { createRedisSessionRevocationStore } from '../../accessi-module/security/sessionRevocation';\nimport type { SessionRevocationStore } from '../../accessi-module/security/sessionRevocation';\nimport { createRedisAccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';\nimport type { AccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';\nimport { createRedisRefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';\nimport type { RefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';\n\n/** Client Redis minimo accettato dagli store Accessi. */\nexport interface AccessiTenantRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\n/** Prefissi Redis per singolo store, tutti relativi al tenant. */\nexport interface AccessiTenantStorePrefixes {\n  base?: string;\n  rateLimit?: string;\n  serviceTokenRateLimit?: string;\n  sessionRevocation?: string;\n  accessTokenRevocation?: string;\n  refreshTokenRotation?: string;\n  refreshTokenFamily?: string;\n  consoleEntry?: string;\n}\n\nexport interface ResolvedAccessiTenantStorePrefixes {\n  base: string;\n  rateLimit: string;\n  serviceTokenRateLimit: string;\n  sessionRevocation: string;\n  accessTokenRevocation: string;\n  refreshTokenRotation: string;\n  refreshTokenFamily: string;\n  consoleEntry: string;\n}\n\nexport interface CreateAccessiTenantStoresOptions {\n  tenantId: string;\n  client: AccessiTenantRedisClient;\n  /** Segreto per cifrare i ticket console a riposo. Usare un segreto del tenant. */\n  encryptionKey: string | Buffer;\n  /** Base prefix. Default: `accessi:<tenantId>:`. */\n  prefix?: string;\n  prefixes?: AccessiTenantStorePrefixes;\n  /** TTL revoca sessioni. Default dello store (365 giorni). */\n  sessionRevocationTtlMs?: number;\n  /** TTL revoca jti. Default dello store (24 ore). */\n  accessTokenRevocationTtlMs?: number;\n  consoleEntryMaxIssueAttempts?: number;\n  /** Attiva la rotazione refresh token nell'options risultante. Default: true. */\n  enableRefreshTokenRotation?: boolean;\n}\n\nexport interface AccessiTenantStores {\n  tenantId: string;\n  prefixes: ResolvedAccessiTenantStorePrefixes;\n  rateLimit: RateLimitStore;\n  serviceTokenRateLimit: RateLimitStore;\n  sessionRevocation: SessionRevocationStore;\n  accessTokenRevocation: AccessTokenRevocationStore;\n  refreshTokenRotation: RefreshTokenRotationStore;\n  consoleEntry: ConsoleEntryStore;\n  /** Collega tutti gli store alle opzioni Accessi del tenant. */\n  applyTo(options: AccessiOptions): AccessiOptions;\n}\n\n/**\n * Prefissi Redis isolati per tenant.\n *\n * Ogni store ha un namespace distinto: condividere un prefisso tra tenant\n * significherebbe condividere rate limit, revoche o refresh token.\n */\nexport function getAccessiTenantStorePrefixes(\n  tenantId: string,\n  overrides: AccessiTenantStorePrefixes = {},\n): ResolvedAccessiTenantStorePrefixes {\n  const base = overrides.base ?? getAccessiTenantRedisPrefix(tenantId);\n  return {\n    base,\n    rateLimit: overrides.rateLimit ?? `${base}rate:`,\n    serviceTokenRateLimit: overrides.serviceTokenRateLimit ?? `${base}service-token-rate:`,\n    sessionRevocation: overrides.sessionRevocation ?? `${base}session:`,\n    accessTokenRevocation: overrides.accessTokenRevocation ?? `${base}jti:`,\n    refreshTokenRotation: overrides.refreshTokenRotation ?? `${base}refresh:`,\n    refreshTokenFamily: overrides.refreshTokenFamily ?? `${base}refresh-family:`,\n    consoleEntry: overrides.consoleEntry ?? `${base}console-entry:`,\n  };\n}\n\n/**\n * Crea tutti gli store Redis di un tenant con prefissi gia isolati.\n *\n * `applyTo` restituisce una copia delle opzioni con gli store collegati:\n * `publicAuthRateLimit`, `serviceTokens`, `sessionRevocation`,\n * `accessTokenRevocation`, `refreshTokenRotation` e `consoleEntry`.\n */\nexport function createAccessiTenantStores(\n  options: CreateAccessiTenantStoresOptions,\n): AccessiTenantStores {\n  if (!options?.tenantId || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(options.tenantId)) {\n    throw new Error('createAccessiTenantStores: tenantId non valido.');\n  }\n  if (!options.client || typeof options.client.eval !== 'function') {\n    throw new Error('createAccessiTenantStores: client.eval non configurato.');\n  }\n  const encryptionKey = options.encryptionKey;\n  if (encryptionKey === undefined || encryptionKey === null || encryptionKey.length === 0) {\n    throw new Error('createAccessiTenantStores: encryptionKey obbligatoria per i ticket console.');\n  }\n\n  const prefixes = getAccessiTenantStorePrefixes(options.tenantId, {\n    ...(options.prefix ? { base: options.prefix } : {}),\n    ...(options.prefixes ?? {}),\n  });\n  const { client } = options;\n  const enableRefreshTokenRotation = options.enableRefreshTokenRotation !== false;\n\n  const rateLimit = createRedisRateLimitStore({ client, keyPrefix: prefixes.rateLimit });\n  const serviceTokenRateLimit = createRedisRateLimitStore({\n    client,\n    keyPrefix: prefixes.serviceTokenRateLimit,\n  });\n  const sessionRevocation = createRedisSessionRevocationStore({\n    client,\n    keyPrefix: prefixes.sessionRevocation,\n    ...(options.sessionRevocationTtlMs !== undefined ? { ttlMs: options.sessionRevocationTtlMs } : {}),\n  });\n  const accessTokenRevocation = createRedisAccessTokenRevocationStore({\n    client,\n    keyPrefix: prefixes.accessTokenRevocation,\n    ...(options.accessTokenRevocationTtlMs !== undefined ? { ttlMs: options.accessTokenRevocationTtlMs } : {}),\n  });\n  const refreshTokenRotation = createRedisRefreshTokenRotationStore({\n    client,\n    keyPrefix: prefixes.refreshTokenRotation,\n    familyKeyPrefix: prefixes.refreshTokenFamily,\n  });\n  const consoleEntry = createRedisConsoleEntryStore({\n    client,\n    encryptionKey,\n    keyPrefix: prefixes.consoleEntry,\n    ...(options.consoleEntryMaxIssueAttempts !== undefined\n      ? { maxIssueAttempts: options.consoleEntryMaxIssueAttempts }\n      : {}),\n  });\n\n  return {\n    tenantId: options.tenantId,\n    prefixes,\n    rateLimit,\n    serviceTokenRateLimit,\n    sessionRevocation,\n    accessTokenRevocation,\n    refreshTokenRotation,\n    consoleEntry,\n    applyTo(accessiOptions) {\n      return {\n        ...accessiOptions,\n        tenantId: options.tenantId,\n        publicAuthRateLimit: {\n          ...accessiOptions.publicAuthRateLimit,\n          store: rateLimit,\n        },\n        serviceTokens: {\n          ...accessiOptions.serviceTokens,\n          rateLimitStore: serviceTokenRateLimit,\n        },\n        sessionRevocation: {\n          ...accessiOptions.sessionRevocation,\n          store: sessionRevocation,\n        },\n        accessTokenRevocation: {\n          ...accessiOptions.accessTokenRevocation,\n          store: accessTokenRevocation,\n        },\n        refreshTokenRotation: {\n          ...accessiOptions.refreshTokenRotation,\n          enabled: accessiOptions.refreshTokenRotation?.enabled ?? enableRefreshTokenRotation,\n          store: refreshTokenRotation,\n        },\n        consoleEntry: {\n          ...accessiOptions.consoleEntry,\n          store: consoleEntry,\n        },\n      };\n    },\n  };\n}\n"]}
+{"version":3,"file":"tenantStores.js","sourceRoot":"","sources":["../../../src/accessi/server/tenantStores.ts"],"names":[],"mappings":";;AA6EA,sEAeC;AASD,8DA2FC;AA/LD,uCAAwD;AACxD,kFAA0F;AAE1F,8EAA2F;AAE3F,wFAAqG;AAErG,gGAA6G;AAE7G,8FAA2G;AA6D3G;;;;;GAKG;AACH,SAAgB,6BAA6B,CAC3C,QAAgB,EAChB,YAAwC,EAAE;;IAE1C,MAAM,IAAI,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,IAAA,qCAA2B,EAAC,QAAQ,CAAC,CAAC;IACrE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,MAAA,SAAS,CAAC,SAAS,mCAAI,GAAG,IAAI,OAAO;QAChD,qBAAqB,EAAE,MAAA,SAAS,CAAC,qBAAqB,mCAAI,GAAG,IAAI,qBAAqB;QACtF,iBAAiB,EAAE,MAAA,SAAS,CAAC,iBAAiB,mCAAI,GAAG,IAAI,UAAU;QACnE,qBAAqB,EAAE,MAAA,SAAS,CAAC,qBAAqB,mCAAI,GAAG,IAAI,MAAM;QACvE,oBAAoB,EAAE,MAAA,SAAS,CAAC,oBAAoB,mCAAI,GAAG,IAAI,UAAU;QACzE,kBAAkB,EAAE,MAAA,SAAS,CAAC,kBAAkB,mCAAI,GAAG,IAAI,iBAAiB;QAC5E,YAAY,EAAE,MAAA,SAAS,CAAC,YAAY,mCAAI,GAAG,IAAI,gBAAgB;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACvC,OAAyC;;IAEzC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,QAAQ,kCAC1D,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChD,CAAC,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE,CAAC,EAC3B,CAAC;IACH,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,KAAK,KAAK,CAAC;IAEhF,MAAM,SAAS,GAAG,IAAA,0CAAyB,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,MAAM,qBAAqB,GAAG,IAAA,0CAAyB,EAAC;QACtD,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,IAAA,qDAAiC,kBACzD,MAAM,EACN,SAAS,EAAE,QAAQ,CAAC,iBAAiB,IAClC,CAAC,OAAO,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClG,CAAC;IACH,MAAM,qBAAqB,GAAG,IAAA,6DAAqC,kBACjE,MAAM,EACN,SAAS,EAAE,QAAQ,CAAC,qBAAqB,IACtC,CAAC,OAAO,CAAC,0BAA0B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1G,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAA,2DAAoC,EAAC;QAChE,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,oBAAoB;QACxC,eAAe,EAAE,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAA,2CAA4B,kBAC/C,MAAM;QACN,aAAa,EACb,SAAS,EAAE,QAAQ,CAAC,YAAY,IAC7B,CAAC,OAAO,CAAC,4BAA4B,KAAK,SAAS;QACpD,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,4BAA4B,EAAE;QAC5D,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,SAAS;QACT,qBAAqB;QACrB,iBAAiB;QACjB,qBAAqB;QACrB,oBAAoB;QACpB,YAAY;QACZ,OAAO,CAAC,cAAc;;YACpB,uCACK,cAAc,KACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAC1B,mBAAmB,kCACd,cAAc,CAAC,mBAAmB,KACrC,KAAK,EAAE,SAAS,KAElB,aAAa,kCACR,cAAc,CAAC,aAAa,KAC/B,cAAc,EAAE,qBAAqB,KAEvC,iBAAiB,kCACZ,cAAc,CAAC,iBAAiB,KACnC,KAAK,EAAE,iBAAiB,KAE1B,qBAAqB,kCAChB,cAAc,CAAC,qBAAqB,KACvC,KAAK,EAAE,qBAAqB,KAE9B,oBAAoB,kCACf,cAAc,CAAC,oBAAoB,KACtC,OAAO,EAAE,MAAA,MAAA,cAAc,CAAC,oBAAoB,0CAAE,OAAO,mCAAI,0BAA0B,EACnF,KAAK,EAAE,oBAAoB,KAE7B,YAAY,kCACP,cAAc,CAAC,YAAY,KAC9B,KAAK,EAAE,YAAY,OAErB;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AccessiOptions } from '../../accessi-service/AccessiModule';\nimport { getAccessiTenantRedisPrefix } from './tenants';\nimport { createRedisRateLimitStore } from '../../accessi-service/security/rateLimitStore';\nimport type { RateLimitStore } from '../../accessi-service/security/rateLimitStore';\nimport { createRedisConsoleEntryStore } from '../../accessi-service/security/consoleEntry';\nimport type { ConsoleEntryStore } from '../../accessi-service/security/consoleEntry';\nimport { createRedisSessionRevocationStore } from '../../accessi-service/security/sessionRevocation';\nimport type { SessionRevocationStore } from '../../accessi-service/security/sessionRevocation';\nimport { createRedisAccessTokenRevocationStore } from '../../accessi-service/security/accessTokenRevocation';\nimport type { AccessTokenRevocationStore } from '../../accessi-service/security/accessTokenRevocation';\nimport { createRedisRefreshTokenRotationStore } from '../../accessi-service/security/refreshTokenRotation';\nimport type { RefreshTokenRotationStore } from '../../accessi-service/security/refreshTokenRotation';\n\n/** Client Redis minimo accettato dagli store Accessi. */\nexport interface AccessiTenantRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\n/** Prefissi Redis per singolo store, tutti relativi al tenant. */\nexport interface AccessiTenantStorePrefixes {\n  base?: string;\n  rateLimit?: string;\n  serviceTokenRateLimit?: string;\n  sessionRevocation?: string;\n  accessTokenRevocation?: string;\n  refreshTokenRotation?: string;\n  refreshTokenFamily?: string;\n  consoleEntry?: string;\n}\n\nexport interface ResolvedAccessiTenantStorePrefixes {\n  base: string;\n  rateLimit: string;\n  serviceTokenRateLimit: string;\n  sessionRevocation: string;\n  accessTokenRevocation: string;\n  refreshTokenRotation: string;\n  refreshTokenFamily: string;\n  consoleEntry: string;\n}\n\nexport interface CreateAccessiTenantStoresOptions {\n  tenantId: string;\n  client: AccessiTenantRedisClient;\n  /** Segreto per cifrare i ticket console a riposo. Usare un segreto del tenant. */\n  encryptionKey: string | Buffer;\n  /** Base prefix. Default: `accessi:<tenantId>:`. */\n  prefix?: string;\n  prefixes?: AccessiTenantStorePrefixes;\n  /** TTL revoca sessioni. Default dello store (365 giorni). */\n  sessionRevocationTtlMs?: number;\n  /** TTL revoca jti. Default dello store (24 ore). */\n  accessTokenRevocationTtlMs?: number;\n  consoleEntryMaxIssueAttempts?: number;\n  /** Attiva la rotazione refresh token nell'options risultante. Default: true. */\n  enableRefreshTokenRotation?: boolean;\n}\n\nexport interface AccessiTenantStores {\n  tenantId: string;\n  prefixes: ResolvedAccessiTenantStorePrefixes;\n  rateLimit: RateLimitStore;\n  serviceTokenRateLimit: RateLimitStore;\n  sessionRevocation: SessionRevocationStore;\n  accessTokenRevocation: AccessTokenRevocationStore;\n  refreshTokenRotation: RefreshTokenRotationStore;\n  consoleEntry: ConsoleEntryStore;\n  /** Collega tutti gli store alle opzioni Accessi del tenant. */\n  applyTo(options: AccessiOptions): AccessiOptions;\n}\n\n/**\n * Prefissi Redis isolati per tenant.\n *\n * Ogni store ha un namespace distinto: condividere un prefisso tra tenant\n * significherebbe condividere rate limit, revoche o refresh token.\n */\nexport function getAccessiTenantStorePrefixes(\n  tenantId: string,\n  overrides: AccessiTenantStorePrefixes = {},\n): ResolvedAccessiTenantStorePrefixes {\n  const base = overrides.base ?? getAccessiTenantRedisPrefix(tenantId);\n  return {\n    base,\n    rateLimit: overrides.rateLimit ?? `${base}rate:`,\n    serviceTokenRateLimit: overrides.serviceTokenRateLimit ?? `${base}service-token-rate:`,\n    sessionRevocation: overrides.sessionRevocation ?? `${base}session:`,\n    accessTokenRevocation: overrides.accessTokenRevocation ?? `${base}jti:`,\n    refreshTokenRotation: overrides.refreshTokenRotation ?? `${base}refresh:`,\n    refreshTokenFamily: overrides.refreshTokenFamily ?? `${base}refresh-family:`,\n    consoleEntry: overrides.consoleEntry ?? `${base}console-entry:`,\n  };\n}\n\n/**\n * Crea tutti gli store Redis di un tenant con prefissi gia isolati.\n *\n * `applyTo` restituisce una copia delle opzioni con gli store collegati:\n * `publicAuthRateLimit`, `serviceTokens`, `sessionRevocation`,\n * `accessTokenRevocation`, `refreshTokenRotation` e `consoleEntry`.\n */\nexport function createAccessiTenantStores(\n  options: CreateAccessiTenantStoresOptions,\n): AccessiTenantStores {\n  if (!options?.tenantId || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(options.tenantId)) {\n    throw new Error('createAccessiTenantStores: tenantId non valido.');\n  }\n  if (!options.client || typeof options.client.eval !== 'function') {\n    throw new Error('createAccessiTenantStores: client.eval non configurato.');\n  }\n  const encryptionKey = options.encryptionKey;\n  if (encryptionKey === undefined || encryptionKey === null || encryptionKey.length === 0) {\n    throw new Error('createAccessiTenantStores: encryptionKey obbligatoria per i ticket console.');\n  }\n\n  const prefixes = getAccessiTenantStorePrefixes(options.tenantId, {\n    ...(options.prefix ? { base: options.prefix } : {}),\n    ...(options.prefixes ?? {}),\n  });\n  const { client } = options;\n  const enableRefreshTokenRotation = options.enableRefreshTokenRotation !== false;\n\n  const rateLimit = createRedisRateLimitStore({ client, keyPrefix: prefixes.rateLimit });\n  const serviceTokenRateLimit = createRedisRateLimitStore({\n    client,\n    keyPrefix: prefixes.serviceTokenRateLimit,\n  });\n  const sessionRevocation = createRedisSessionRevocationStore({\n    client,\n    keyPrefix: prefixes.sessionRevocation,\n    ...(options.sessionRevocationTtlMs !== undefined ? { ttlMs: options.sessionRevocationTtlMs } : {}),\n  });\n  const accessTokenRevocation = createRedisAccessTokenRevocationStore({\n    client,\n    keyPrefix: prefixes.accessTokenRevocation,\n    ...(options.accessTokenRevocationTtlMs !== undefined ? { ttlMs: options.accessTokenRevocationTtlMs } : {}),\n  });\n  const refreshTokenRotation = createRedisRefreshTokenRotationStore({\n    client,\n    keyPrefix: prefixes.refreshTokenRotation,\n    familyKeyPrefix: prefixes.refreshTokenFamily,\n  });\n  const consoleEntry = createRedisConsoleEntryStore({\n    client,\n    encryptionKey,\n    keyPrefix: prefixes.consoleEntry,\n    ...(options.consoleEntryMaxIssueAttempts !== undefined\n      ? { maxIssueAttempts: options.consoleEntryMaxIssueAttempts }\n      : {}),\n  });\n\n  return {\n    tenantId: options.tenantId,\n    prefixes,\n    rateLimit,\n    serviceTokenRateLimit,\n    sessionRevocation,\n    accessTokenRevocation,\n    refreshTokenRotation,\n    consoleEntry,\n    applyTo(accessiOptions) {\n      return {\n        ...accessiOptions,\n        tenantId: options.tenantId,\n        publicAuthRateLimit: {\n          ...accessiOptions.publicAuthRateLimit,\n          store: rateLimit,\n        },\n        serviceTokens: {\n          ...accessiOptions.serviceTokens,\n          rateLimitStore: serviceTokenRateLimit,\n        },\n        sessionRevocation: {\n          ...accessiOptions.sessionRevocation,\n          store: sessionRevocation,\n        },\n        accessTokenRevocation: {\n          ...accessiOptions.accessTokenRevocation,\n          store: accessTokenRevocation,\n        },\n        refreshTokenRotation: {\n          ...accessiOptions.refreshTokenRotation,\n          enabled: accessiOptions.refreshTokenRotation?.enabled ?? enableRefreshTokenRotation,\n          store: refreshTokenRotation,\n        },\n        consoleEntry: {\n          ...accessiOptions.consoleEntry,\n          store: consoleEntry,\n        },\n      };\n    },\n  };\n}\n"]}

package/dist/accessi/server/tenants.d.ts

@@ -1,11 +1,11 @@
-import type { AccessiOptions, AccessiHttpOptions, AdminBootstrapOptions, CatalogScriptsOptions, ConsoleEntryOptions, EmailOptions, ExtensionFieldsOptions, FederatedAuthenticationOptions, JwtOptions, PublicAuthRateLimitOptions, PublicRegistrationOptions, ServiceTokenOptions, SystemSeedsOptions } from '../../accessi-module/AccessiModule';
-import type { AccessiEdgeRateLimitOptions } from '../../accessi-module/security/edgeRateLimit';
-import type { AccessiAuthCookieOptions } from '../../accessi-module/security/authCookies';
-import type { AccessiMetricsOptions } from '../../accessi-module/observability/metrics';
-import type { AccessiAuditOptions } from '../../accessi-module/security/audit';
-import type { SessionRevocationOptions } from '../../accessi-module/security/sessionRevocation';
-import type { AccessTokenRevocationOptions } from '../../accessi-module/security/accessTokenRevocation';
-import type { RefreshTokenRotationOptions } from '../../accessi-module/security/refreshTokenRotation';
+import type { AccessiOptions, AccessiHttpOptions, AdminBootstrapOptions, CatalogScriptsOptions, ConsoleEntryOptions, EmailOptions, ExtensionFieldsOptions, FederatedAuthenticationOptions, JwtOptions, PublicAuthRateLimitOptions, PublicRegistrationOptions, ServiceTokenOptions, SystemSeedsOptions } from '../../accessi-service/AccessiModule';
+import type { AccessiEdgeRateLimitOptions } from '../../accessi-service/security/edgeRateLimit';
+import type { AccessiAuthCookieOptions } from '../../accessi-service/security/authCookies';
+import type { AccessiMetricsOptions } from '../../accessi-service/observability/metrics';
+import type { AccessiAuditOptions } from '../../accessi-service/security/audit';
+import type { SessionRevocationOptions } from '../../accessi-service/security/sessionRevocation';
+import type { AccessTokenRevocationOptions } from '../../accessi-service/security/accessTokenRevocation';
+import type { RefreshTokenRotationOptions } from '../../accessi-service/security/refreshTokenRotation';
 import type { OpenApiSetupOptions } from '../../openapi/OpenApiConfig';
 /** Identita e routing del tenant. */
 export interface AccessiTenantSettings {

package/dist/accessi/server/tenants.js

@@ -9,7 +9,7 @@ exports.loadAccessiTenants = loadAccessiTenants;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const node_firebird_1 = require("node-firebird");
-const validateOptions_1 = require("../../accessi-module/security/validateOptions");
+const validateOptions_1 = require("../../accessi-service/security/validateOptions");
 /** Errore aggregato di configurazione tenant. */
 class AccessiTenantConfigurationError extends Error {
     constructor(issues) {

package/dist/accessi/server/tenants.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenants.js","sourceRoot":"","sources":["../../../src/accessi/server/tenants.ts"],"names":[],"mappings":";;;AA2LA,wEAIC;AA8BD,kEAEC;AAQD,kFAyDC;AA8FD,4EA2CC;AAQD,gDA+JC;AAhlBD,2BAAiC;AACjC,+BAA+C;AAC/C,iDAAsE;AAyBtE,mFAAuF;AAmIvF,iDAAiD;AACjD,MAAa,+BAAgC,SAAQ,KAAK;IAGxD,YAAY,MAAgB;QAC1B,KAAK,CAAC,sCAAsC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AARD,0EAQC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,8BAA8B,CAC5C,WAAc;IAEd,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB;IACnD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;IAC/D,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACrC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,mEAAmE;AACnE,SAAgB,2BAA2B,CAAC,QAAgB;IAC1D,OAAO,WAAW,QAAQ,GAAG,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mCAAmC,CACjD,WAAqC;;IAErC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,MAAM,eAAe,iCACnB,IAAI,EAAE,QAAQ,CAAC,IAAI,EACnB,IAAI,EAAE,MAAA,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAC3B,IAAI,EAAE,MAAA,QAAQ,CAAC,IAAI,mCAAI,QAAQ,EAC/B,QAAQ,EAAE,MAAA,QAAQ,CAAC,QAAQ,mCAAI,WAAW,IACvC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChE,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU;QACnC,CAAC,CAAC,EAAE,SAAS,EAAE,kCAAkB,EAAE;QACnC,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU;YACjC,CAAC,CAAC,EAAE,SAAS,EAAE,iCAAiB,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;IAEF,6aACE,eAAe,EACf,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EACtD,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,IAC/D,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,WAAW,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7G,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACrF,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC9F,aAAa,EAAE,WAAW,CAAC,aAAa,EACxC,YAAY,EAAE,MAAA,WAAW,CAAC,YAAY,mCAAI,KAAK,KAC5C,CAAC,WAAW,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5G,CAAC,WAAW,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxH,CAAC,WAAW,CAAC,gCAAgC,KAAK,SAAS;QAC5D,CAAC,CAAC,EAAE,gCAAgC,EAAE,WAAW,CAAC,gCAAgC,EAAE;QACpF,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,WAAW,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC/G,UAAU,EAAE,WAAW,CAAC,GAAG,EAC3B,YAAY,EAAE,WAAW,CAAC,KAAK,KAC5B,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpD,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtE,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACjG,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC9F,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,WAAW,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7G,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1G,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACzE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7D,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5E,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC3F,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,WAAW,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACvG,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7D,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACvD,CAAC,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACvF,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAC/B;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,IAAI,4EAA4E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;QAC/D,CAAC;QACD,IACE,MAAM,CAAC,IAAI,KAAK,SAAS;eACtB,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,EAChH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;QAC1D,CAAC;QACD,IACE,QAAQ,CAAC,IAAI,KAAK,SAAS;eACxB,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,EACxH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;SACjE,CAAC;QACJ,IAAI,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,WAAW,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC1E,IAAI,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,0BAA0B,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,+DAA+D;QAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAKpC,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gCAAgC,CAAC,IAAY;;IAC3D,MAAM,QAAQ,GAAG,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,+BAA+B,CAAC;YACxC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;SAC/G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,CAAC,MAAA,MAAA,MAAM,CAAC,OAAO,mCAAI,MAAM,CAAC,WAAW,mCAAI,MAAM,CAAY,CAAC;IAChF,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAG,WAAuC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAA,wCAAsB,EAAC,OAAO,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAChH,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IAE7F,MAAM,KAAK,GAAG,CAAC,MAAA,QAAQ,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,+BAA+B,CAAC;YACxC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,gDAAgD;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,2EACV,EAAE,EAAE,QAAQ,CAAC,EAAE,EACf,KAAK,IACF,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzB,OAAO,EAAE,QAAQ,CAAC,OAAO,KAAK,KAAK,KAChC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACnE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACjD,IAAI,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,EACpB,eAAe,EAAE,QAAQ,EACzB,OAAO,GACR,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,OAAkC;;IACnE,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAA;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,gBAAW,EAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC/F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,+BAA+B,CAAC;YACxC,kCAAkC,SAAS,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC1G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,+BAA+B,CAAC,CAAC,+CAA+C,SAAS,GAAG,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,+BAA+B;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;;gBAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,IAAI,MAAM,MAAA,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,0CAAE,IAAI,IAAI,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,QAAQ,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;;gBACnF,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,kBAAkB,QAAQ,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;;gBAC1F,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;;gBACzF,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,mCAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5F,MAAM,cAAc,GAAG,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,IAAI,UAAU,EAAE,CAAC;QACzF,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,6BAA6B,WAAW,QAAQ,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,mCAAI,WAAW,CAAC;QAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9C,CAAC,CAAC,CAAC,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,mCAAI,WAAW,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,cAAc,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,SAAS,oBAAoB,cAAc,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACtG,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACjG,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,EAAE,qEAAqE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAA0B;QACtC,SAAS;QACT,OAAO;QACP,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI;QACzC,IAAI;QACJ,OAAO,CAAC,KAAK,EAAE,cAAc;;YAC3B,MAAM,WAAW,GAAG,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,WAAW,mCAAI,QAAQ,CAAC,WAAW,CAAC;YACxE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAA,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACnE,IAAI,MAAM;oBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAC3D,CAAC;YAED,MAAM,WAAW,GAAG,MAAA,KAAK,CAAC,IAAI,mCAAI,GAAG,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO;iBACnB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;iBACpD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,uBAAC,OAAA,CAAC,MAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,MAAM,mCAAI,CAAC,CAAC,GAAG,CAAC,MAAA,MAAA,IAAI,CAAC,IAAI,0CAAE,MAAM,mCAAI,CAAC,CAAC,CAAA,EAAA,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAEhF,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAClC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YAC9D,CAAC;YAED,IAAI,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;;gBAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,eAK/B,CAAC;gBACF,2GACE,EAAE,EAAE,MAAM,CAAC,EAAE,EACb,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IACrB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7C,OAAO,EAAE,MAAM,CAAC,OAAO,KACpB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/D,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,EACjB,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;qBACpB,EACD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KACrC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;oBACpC,CAAC,CAAC;wBACE,QAAQ,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ;4BAC9D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;4BACpC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;qBACjD;oBACH,CAAC,CAAC,EAAE,CAAC,KACP,YAAY,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,EAC5D,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,IACnE;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { readdirSync } from 'fs';\nimport { basename, join, resolve } from 'path';\nimport { WIRE_CRYPT_DISABLE, WIRE_CRYPT_ENABLE } from 'node-firebird';\nimport type { Options } from 'node-firebird';\nimport type {\n  AccessiOptions,\n  AccessiHttpOptions,\n  AdminBootstrapOptions,\n  CatalogScriptsOptions,\n  ConsoleEntryOptions,\n  EmailOptions,\n  ExtensionFieldsOptions,\n  FederatedAuthenticationOptions,\n  JwtOptions,\n  PublicAuthRateLimitOptions,\n  PublicRegistrationOptions,\n  ServiceTokenOptions,\n  SystemSeedsOptions,\n} from '../../accessi-module/AccessiModule';\nimport type { AccessiEdgeRateLimitOptions } from '../../accessi-module/security/edgeRateLimit';\nimport type { AccessiAuthCookieOptions } from '../../accessi-module/security/authCookies';\nimport type { AccessiMetricsOptions } from '../../accessi-module/observability/metrics';\nimport type { AccessiAuditOptions } from '../../accessi-module/security/audit';\nimport type { SessionRevocationOptions } from '../../accessi-module/security/sessionRevocation';\nimport type { AccessTokenRevocationOptions } from '../../accessi-module/security/accessTokenRevocation';\nimport type { RefreshTokenRotationOptions } from '../../accessi-module/security/refreshTokenRotation';\nimport type { OpenApiSetupOptions } from '../../openapi/OpenApiConfig';\nimport { validateAccessiOptions } from '../../accessi-module/security/validateOptions';\n\n/** Identita e routing del tenant. */\nexport interface AccessiTenantSettings {\n  /** Minuscole, numeri, `-` e `_`; max 63 caratteri. */\n  id: string;\n  /** Host esatti o wildcard `*.example.com`. */\n  hosts?: string[];\n  /** Prefisso path, es. `/acme`. */\n  path?: string;\n  /** Porta del processo quando si usa il supervisore. */\n  port?: number;\n  /** Default `true`. */\n  enabled?: boolean;\n  description?: string;\n}\n\n/** Connessione Firebird del tenant, tipizzata senza callback. */\nexport interface AccessiTenantDatabaseOptions {\n  host: string;\n  port?: number;\n  database: string;\n  user?: string;\n  password?: string;\n  /** `disabled`/`optional`; `required` e il default del driver. */\n  wireCrypt?: 'required' | 'optional' | 'disabled';\n  pluginName?: string;\n}\n\n/**\n * Configurazione serializzabile di un tenant.\n *\n * I campi che contengono store, callback o logger (`store`, `sink`, `match`,\n * `onDocument`, `logger`, ...) sono esclusi: vanno collegati dal backend\n * ospitante, non da un file di configurazione.\n */\nexport interface AccessiTenantEnvironment {\n  tenant: AccessiTenantSettings;\n  database: AccessiTenantDatabaseOptions;\n  jwt: JwtOptions;\n  email: EmailOptions;\n  encryptionKey: string;\n  confirmationEmailUrl: string;\n  confirmationEmailReturnUrl: string;\n  confirmationEmailPrefix?: string;\n  customResetPage?: string;\n  publicBaseUrl?: string;\n  consoleApiBaseUrl?: string;\n  mockDemoUser?: boolean;\n  passwordExpiration?: boolean;\n  passwordExpirationDays?: number;\n  legacyPasswordMigrationOnStartup?: boolean;\n  autoUpdateDatabase?: boolean;\n  http?: AccessiHttpOptions;\n  authCookie?: AccessiAuthCookieOptions;\n  publicAuthRateLimit?: Omit<PublicAuthRateLimitOptions, 'store'>;\n  publicRegistration?: PublicRegistrationOptions;\n  federatedAuthentication?: FederatedAuthenticationOptions;\n  extensionFieldsOptions?: ExtensionFieldsOptions[];\n  serviceTokens?: Omit<ServiceTokenOptions, 'rateLimitStore'>;\n  catalogScripts?: CatalogScriptsOptions;\n  systemSeeds?: SystemSeedsOptions;\n  adminBootstrap?: AdminBootstrapOptions;\n  openapi?: Omit<OpenApiSetupOptions, 'onDocument'>;\n  consoleEntry?: Omit<ConsoleEntryOptions, 'store'>;\n  edgeRateLimit?: Omit<AccessiEdgeRateLimitOptions, 'store' | 'match'>;\n  sessionRevocation?: Omit<SessionRevocationOptions, 'store'>;\n  accessTokenRevocation?: Omit<AccessTokenRevocationOptions, 'store'>;\n  refreshTokenRotation?: Omit<RefreshTokenRotationOptions, 'store'>;\n  metrics?: Omit<AccessiMetricsOptions, 'sink'>;\n  audit?: Omit<AccessiAuditOptions, 'sinks' | 'store' | 'tenantId'>;\n  bufferLogs?: boolean;\n}\n\nexport interface AccessiTenant {\n  id: string;\n  hosts: string[];\n  path?: string;\n  enabled: boolean;\n  description?: string;\n  port?: number;\n  /** Nome del file `*.environment.ts` di origine (mai il contenuto). */\n  file: string;\n  environmentFile: string;\n  options: AccessiOptions;\n}\n\nexport interface AccessiTenantSummary {\n  id: string;\n  hosts: string[];\n  path?: string;\n  enabled: boolean;\n  description?: string;\n  port?: number;\n  file: string;\n  database: {\n    host?: string;\n    port?: number;\n    database?: string;\n    user?: string;\n  };\n  issuer?: string;\n  audience?: string;\n  jwtAlgorithm: string;\n  refreshEnabled: boolean;\n}\n\nexport interface AccessiTenantResolution {\n  tenant: AccessiTenant;\n  matchedBy: 'host' | 'path' | 'header';\n}\n\nexport interface AccessiTenantRegistry {\n  directory: string;\n  tenants: AccessiTenant[];\n  warnings: string[];\n  allowHeader: boolean;\n  byId: ReadonlyMap<string, AccessiTenant>;\n  resolve(input: { host?: string; path?: string; header?: string }, options?: { allowHeader?: boolean }): AccessiTenantResolution | undefined;\n  summary(): AccessiTenantSummary[];\n}\n\nexport interface LoadAccessiTenantsOptions {\n  /** Cartella con `<id>.environment.ts`. */\n  directory: string;\n  /** Abilita la risoluzione via header `x-accessi-tenant`. Default: false. */\n  allowHeader?: boolean;\n  /** Consente issuer/audience uguali tra tenant (sconsigliato). Default: false. */\n  allowSharedIssuer?: boolean;\n}\n\n/** Errore aggregato di configurazione tenant. */\nexport class AccessiTenantConfigurationError extends Error {\n  readonly issues: string[];\n\n  constructor(issues: string[]) {\n    super(`Configurazione tenant non valida:\\n${issues.map((issue) => `- ${issue}`).join('\\n')}`);\n    this.name = 'AccessiTenantConfigurationError';\n    this.issues = issues;\n  }\n}\n\n/**\n * Helper di tipizzazione per i file tenant.\n *\n * ```ts\n * import type { AccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';\n * import { defineAccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';\n *\n * export default defineAccessiTenantEnvironment({\n *   tenant: { id: 'acme', hosts: ['accessi.acme.example.com'] },\n *   database: { host: 'db-acme', database: '/data/acme.fdb' },\n *   jwt: { secret: process.env.ACME_JWT_SECRET!, expiresIn: '1h' },\n *   email: { ... },\n *   encryptionKey: process.env.ACME_ENCRYPTION_KEY!,\n *   confirmationEmailUrl: 'https://accessi.acme.example.com',\n *   confirmationEmailReturnUrl: 'https://accessi.acme.example.com',\n * });\n * ```\n */\nexport function defineAccessiTenantEnvironment<const T extends AccessiTenantEnvironment>(\n  environment: T,\n): T {\n  return environment;\n}\n\nfunction normalizeHost(host: string): string {\n  return host.trim().toLowerCase().replace(/\\.$/, '');\n}\n\nfunction normalizeTenantPath(path: string | undefined): string | undefined {\n  if (path === undefined || path.trim() === '') return undefined;\n  const normalized = `/${path.trim().replace(/^\\/+|\\/+$/g, '')}`;\n  return normalized === '/' ? '/' : normalized;\n}\n\nfunction matchesHost(tenant: AccessiTenant, host: string): boolean {\n  return tenant.hosts.some((candidate) => {\n    if (candidate === host) return true;\n    if (candidate.startsWith('*.')) {\n      const suffix = candidate.slice(1);\n      return host.endsWith(suffix) && host.length > suffix.length;\n    }\n    return false;\n  });\n}\n\nfunction matchesPath(tenant: AccessiTenant, path: string): boolean {\n  if (!tenant.path) return false;\n  if (tenant.path === '/') return true;\n  return path === tenant.path || path.startsWith(`${tenant.path}/`);\n}\n\n/** Prefisso Redis consigliato per isolare gli store del tenant. */\nexport function getAccessiTenantRedisPrefix(tenantId: string): string {\n  return `accessi:${tenantId}:`;\n}\n\n/**\n * Converte la configurazione tipizzata in `AccessiOptions`.\n *\n * Applica i default di Firebird e collega `tenantId`; non crea store o sink,\n * che restano responsabilita del backend ospitante.\n */\nexport function accessiOptionsFromTenantEnvironment(\n  environment: AccessiTenantEnvironment,\n): AccessiOptions {\n  const database = environment.database;\n  const databaseOptions: Options = {\n    host: database.host,\n    port: database.port ?? 3050,\n    database: database.database,\n    user: database.user ?? 'SYSDBA',\n    password: database.password ?? 'masterkey',\n    ...(database.pluginName ? { pluginName: database.pluginName } : {}),\n    ...(database.wireCrypt === 'disabled'\n      ? { wireCrypt: WIRE_CRYPT_DISABLE }\n      : database.wireCrypt === 'optional'\n        ? { wireCrypt: WIRE_CRYPT_ENABLE }\n        : {}),\n  };\n\n  return {\n    databaseOptions,\n    confirmationEmailUrl: environment.confirmationEmailUrl,\n    confirmationEmailReturnUrl: environment.confirmationEmailReturnUrl,\n    ...(environment.confirmationEmailPrefix ? { confirmationEmailPrefix: environment.confirmationEmailPrefix } : {}),\n    ...(environment.customResetPage ? { customResetPage: environment.customResetPage } : {}),\n    ...(environment.publicBaseUrl ? { publicBaseUrl: environment.publicBaseUrl } : {}),\n    ...(environment.consoleApiBaseUrl ? { consoleApiBaseUrl: environment.consoleApiBaseUrl } : {}),\n    encryptionKey: environment.encryptionKey,\n    mockDemoUser: environment.mockDemoUser ?? false,\n    ...(environment.passwordExpiration !== undefined ? { passwordExpiration: environment.passwordExpiration } : {}),\n    ...(environment.passwordExpirationDays !== undefined ? { passwordExpirationDays: environment.passwordExpirationDays } : {}),\n    ...(environment.legacyPasswordMigrationOnStartup !== undefined\n      ? { legacyPasswordMigrationOnStartup: environment.legacyPasswordMigrationOnStartup }\n      : {}),\n    ...(environment.autoUpdateDatabase !== undefined ? { autoUpdateDatabase: environment.autoUpdateDatabase } : {}),\n    jwtOptions: environment.jwt,\n    emailOptions: environment.email,\n    ...(environment.http ? { http: environment.http } : {}),\n    ...(environment.authCookie ? { authCookie: environment.authCookie } : {}),\n    ...(environment.publicAuthRateLimit ? { publicAuthRateLimit: environment.publicAuthRateLimit } : {}),\n    ...(environment.publicRegistration ? { publicRegistration: environment.publicRegistration } : {}),\n    ...(environment.federatedAuthentication ? { federatedAuthentication: environment.federatedAuthentication } : {}),\n    ...(environment.extensionFieldsOptions ? { extensionFieldsOptions: environment.extensionFieldsOptions } : {}),\n    ...(environment.serviceTokens ? { serviceTokens: environment.serviceTokens } : {}),\n    ...(environment.catalogScripts ? { catalogScripts: environment.catalogScripts } : {}),\n    ...(environment.systemSeeds ? { systemSeeds: environment.systemSeeds } : {}),\n    ...(environment.adminBootstrap ? { adminBootstrap: environment.adminBootstrap } : {}),\n    ...(environment.openapi ? { openapi: environment.openapi } : {}),\n    ...(environment.consoleEntry ? { consoleEntry: environment.consoleEntry } : {}),\n    ...(environment.edgeRateLimit ? { edgeRateLimit: environment.edgeRateLimit } : {}),\n    ...(environment.sessionRevocation ? { sessionRevocation: environment.sessionRevocation } : {}),\n    ...(environment.accessTokenRevocation ? { accessTokenRevocation: environment.accessTokenRevocation } : {}),\n    ...(environment.refreshTokenRotation ? { refreshTokenRotation: environment.refreshTokenRotation } : {}),\n    ...(environment.metrics ? { metrics: environment.metrics } : {}),\n    ...(environment.audit ? { audit: environment.audit } : {}),\n    ...(environment.bufferLogs !== undefined ? { bufferLogs: environment.bufferLogs } : {}),\n    tenantId: environment.tenant.id,\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction runtimeIssues(environment: unknown, file: string): string[] {\n  const issues: string[] = [];\n  if (!isRecord(environment)) {\n    return [`${file}: il file deve esportare un oggetto (default export o export environment).`];\n  }\n  const tenant = environment.tenant;\n  if (!isRecord(tenant)) {\n    issues.push(`${file}: tenant mancante.`);\n  } else {\n    if (typeof tenant.id !== 'string' || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(tenant.id)) {\n      issues.push(`${file}: tenant.id non valido (minuscole, numeri, - e _, max 63).`);\n    }\n    if (tenant.hosts !== undefined && (!Array.isArray(tenant.hosts) || tenant.hosts.some((host) => typeof host !== 'string'))) {\n      issues.push(`${file}: tenant.hosts deve essere un array di stringhe.`);\n    }\n    if (tenant.path !== undefined && typeof tenant.path !== 'string') {\n      issues.push(`${file}: tenant.path deve essere una stringa.`);\n    }\n    if (\n      tenant.port !== undefined\n      && (typeof tenant.port !== 'number' || !Number.isInteger(tenant.port) || tenant.port < 1 || tenant.port > 65535)\n    ) {\n      issues.push(`${file}: tenant.port non valida.`);\n    }\n  }\n\n  const database = environment.database;\n  if (!isRecord(database)) {\n    issues.push(`${file}: database mancante.`);\n  } else {\n    if (typeof database.host !== 'string' || database.host.trim() === '') {\n      issues.push(`${file}: database.host obbligatorio.`);\n    }\n    if (typeof database.database !== 'string' || database.database.trim() === '') {\n      issues.push(`${file}: database.database obbligatorio.`);\n    }\n    if (\n      database.port !== undefined\n      && (typeof database.port !== 'number' || !Number.isInteger(database.port) || database.port < 1 || database.port > 65535)\n    ) {\n      issues.push(`${file}: database.port non valida.`);\n    }\n  }\n\n  if (!isRecord(environment.jwt)) issues.push(`${file}: jwt mancante.`);\n  else {\n    if (typeof environment.jwt.secret !== 'string' || environment.jwt.secret === '') {\n      issues.push(`${file}: jwt.secret obbligatorio.`);\n    }\n    if (typeof environment.jwt.expiresIn !== 'string' || environment.jwt.expiresIn === '') {\n      issues.push(`${file}: jwt.expiresIn obbligatorio.`);\n    }\n  }\n\n  if (!isRecord(environment.email)) issues.push(`${file}: email mancante.`);\n  if (typeof environment.encryptionKey !== 'string' || environment.encryptionKey === '') {\n    issues.push(`${file}: encryptionKey obbligatoria.`);\n  }\n  if (typeof environment.confirmationEmailUrl !== 'string') {\n    issues.push(`${file}: confirmationEmailUrl obbligatoria.`);\n  }\n  if (typeof environment.confirmationEmailReturnUrl !== 'string') {\n    issues.push(`${file}: confirmationEmailReturnUrl obbligatoria.`);\n  }\n  return issues;\n}\n\nfunction loadEnvironmentModule(file: string): unknown {\n  if (/\\.(ts|mts|cts)$/i.test(file)) {\n    // Caricamento lazy: jiti serve solo ai file tenant TypeScript.\n    const { createJiti } = require('jiti') as {\n      createJiti: (\n        id: string,\n        options?: { interopDefault?: boolean; moduleCache?: boolean; fsCache?: boolean },\n      ) => (id: string) => unknown;\n    };\n    const jiti = createJiti(file, { interopDefault: true, moduleCache: false, fsCache: false });\n    return jiti(file);\n  }\n  return require(file);\n}\n\n/**\n * Carica un singolo file `*.environment.ts`.\n *\n * Usa jiti per eseguire TypeScript anche nel pacchetto compilato, senza\n * richiedere un passo di build separato per i file tenant.\n */\nexport function loadAccessiTenantEnvironmentFile(file: string): { tenant: AccessiTenant; environment: AccessiTenantEnvironment } {\n  const absolute = resolve(file);\n  let loaded: unknown;\n  try {\n    loaded = loadEnvironmentModule(absolute);\n  } catch (error) {\n    throw new AccessiTenantConfigurationError([\n      `${basename(file)}: impossibile caricare il file (${error instanceof Error ? error.message : String(error)}).`,\n    ]);\n  }\n\n  const record = isRecord(loaded) ? loaded : {};\n  const environment = (record.default ?? record.environment ?? loaded) as unknown;\n  const issues = runtimeIssues(environment, basename(file));\n  if (issues.length > 0) throw new AccessiTenantConfigurationError(issues);\n\n  const typed = environment as AccessiTenantEnvironment;\n  const settings = typed.tenant;\n  const options = accessiOptionsFromTenantEnvironment(typed);\n  const validation = validateAccessiOptions(options);\n  const validationIssues = validation.errors.map((issue) => `${basename(file)}: ${issue.code}: ${issue.message}`);\n  if (validationIssues.length > 0) throw new AccessiTenantConfigurationError(validationIssues);\n\n  const hosts = (settings.hosts ?? []).map(normalizeHost).filter(Boolean);\n  const path = normalizeTenantPath(settings.path);\n  if (hosts.length === 0 && !path) {\n    throw new AccessiTenantConfigurationError([\n      `${basename(file)}: configurare tenant.hosts oppure tenant.path.`,\n    ]);\n  }\n\n  const tenant: AccessiTenant = {\n    id: settings.id,\n    hosts,\n    ...(path ? { path } : {}),\n    enabled: settings.enabled !== false,\n    ...(settings.description ? { description: settings.description } : {}),\n    ...(settings.port ? { port: settings.port } : {}),\n    file: basename(file),\n    environmentFile: absolute,\n    options,\n  };\n  return { tenant, environment: typed };\n}\n\n/**\n * Carica i tenant da una cartella di file `<id>.environment.ts`.\n *\n * La validazione e aggregata: un errore blocca l'intera cartella, cosi non si\n * avvia un tenant con configurazione parziale. Nessun segreto viene stampato.\n */\nexport function loadAccessiTenants(options: LoadAccessiTenantsOptions): AccessiTenantRegistry {\n  if (!options?.directory) throw new Error('loadAccessiTenants: directory obbligatoria.');\n  const directory = resolve(options.directory);\n  const issues: string[] = [];\n  const warnings: string[] = [];\n\n  let files: string[];\n  try {\n    files = readdirSync(directory, { withFileTypes: true })\n      .filter((entry) => entry.isFile() && /\\.environment\\.(ts|mts|cts|js|mjs|cjs)$/.test(entry.name))\n      .map((entry) => entry.name)\n      .sort();\n  } catch (error) {\n    throw new AccessiTenantConfigurationError([\n      `Cartella tenant non leggibile (${directory}): ${error instanceof Error ? error.message : String(error)}`,\n    ]);\n  }\n  if (files.length === 0) {\n    throw new AccessiTenantConfigurationError([`Nessun file *.environment.ts nella cartella ${directory}.`]);\n  }\n\n  const tenants: AccessiTenant[] = [];\n  for (const file of files) {\n    try {\n      tenants.push(loadAccessiTenantEnvironmentFile(join(directory, file)).tenant);\n    } catch (error) {\n      if (error instanceof AccessiTenantConfigurationError) issues.push(...error.issues);\n      else issues.push(`${file}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n\n  const byId = new Map<string, AccessiTenant>();\n  const hostsSeen = new Map<string, string>();\n  const pathsSeen = new Map<string, string>();\n  const jwtSecrets = new Map<string, string>();\n  const issuerAudience = new Map<string, string>();\n  const portsSeen = new Map<number, string>();\n  for (const tenant of tenants) {\n    if (byId.has(tenant.id)) {\n      issues.push(`Tenant duplicato \"${tenant.id}\" (${tenant.file} e ${byId.get(tenant.id)?.file}).`);\n    } else {\n      byId.set(tenant.id, tenant);\n    }\n    for (const host of tenant.hosts) {\n      const existing = hostsSeen.get(host);\n      if (existing) issues.push(`Host \"${host}\" assegnato a \"${existing}\" e \"${tenant.id}\".`);\n      else hostsSeen.set(host, tenant.id);\n    }\n    if (tenant.path) {\n      const existing = pathsSeen.get(tenant.path);\n      if (existing) issues.push(`Path \"${tenant.path}\" assegnato a \"${existing}\" e \"${tenant.id}\".`);\n      else pathsSeen.set(tenant.path, tenant.id);\n    }\n    if (tenant.port !== undefined) {\n      const existing = portsSeen.get(tenant.port);\n      if (existing) issues.push(`Porta ${tenant.port} assegnata a \"${existing}\" e \"${tenant.id}\".`);\n      else portsSeen.set(tenant.port, tenant.id);\n    }\n\n    // Un segreto JWT condiviso rende un token valido su piu tenant.\n    const signingKey = tenant.options.jwtOptions.privateKey ?? tenant.options.jwtOptions.secret;\n    const fingerprintKey = `${tenant.options.jwtOptions.algorithm ?? 'HS256'}|${signingKey}`;\n    const existingKey = jwtSecrets.get(fingerprintKey);\n    if (existingKey) {\n      issues.push(`Chiave JWT condivisa tra \"${existingKey}\" e \"${tenant.id}\": usare segreti distinti.`);\n    } else {\n      jwtSecrets.set(fingerprintKey, tenant.id);\n    }\n\n    const issuer = tenant.options.jwtOptions.issuer ?? '(assente)';\n    const audience = Array.isArray(tenant.options.jwtOptions.audience)\n      ? tenant.options.jwtOptions.audience.join(',')\n      : (tenant.options.jwtOptions.audience ?? '(assente)');\n    const issuerKey = `${issuer}|${audience}`;\n    const existingIssuer = issuerAudience.get(issuerKey);\n    if (existingIssuer && options.allowSharedIssuer !== true) {\n      warnings.push(`Issuer/audience \"${issuerKey}\" condivisi tra \"${existingIssuer}\" e \"${tenant.id}\".`);\n    } else {\n      issuerAudience.set(issuerKey, tenant.id);\n    }\n  }\n\n  const enabled = tenants.filter((tenant) => tenant.enabled);\n  if (enabled.length > 1) {\n    const defaultTenant = enabled.find((tenant) => tenant.hosts.length === 0 && tenant.path === '/');\n    if (defaultTenant) {\n      issues.push(`Tenant \"${defaultTenant.id}\" intercetta tutte le richieste (path \"/\") insieme ad altri tenant.`);\n    }\n  }\n\n  if (issues.length > 0) throw new AccessiTenantConfigurationError(issues);\n\n  const registry: AccessiTenantRegistry = {\n    directory,\n    tenants,\n    warnings,\n    allowHeader: options.allowHeader === true,\n    byId,\n    resolve(input, resolveOptions) {\n      const allowHeader = resolveOptions?.allowHeader ?? registry.allowHeader;\n      const host = input.host ? normalizeHost(input.host.split(':')[0] ?? input.host) : undefined;\n      if (host) {\n        const byHost = enabled.find((tenant) => matchesHost(tenant, host));\n        if (byHost) return { tenant: byHost, matchedBy: 'host' };\n      }\n\n      const requestPath = input.path ?? '/';\n      const byPath = enabled\n        .filter((tenant) => matchesPath(tenant, requestPath))\n        .sort((left, right) => (right.path?.length ?? 0) - (left.path?.length ?? 0))[0];\n      if (byPath && byPath.path !== '/') return { tenant: byPath, matchedBy: 'path' };\n\n      if (allowHeader && input.header) {\n        const headerId = input.header.trim().toLowerCase();\n        const tenant = byId.get(headerId);\n        if (tenant?.enabled) return { tenant, matchedBy: 'header' };\n      }\n\n      if (byPath) return { tenant: byPath, matchedBy: 'path' };\n      return undefined;\n    },\n    summary() {\n      return tenants.map((tenant) => {\n        const database = tenant.options.databaseOptions as {\n          host?: string;\n          port?: number;\n          database?: string;\n          user?: string;\n        };\n        return {\n          id: tenant.id,\n          hosts: [...tenant.hosts],\n          ...(tenant.path ? { path: tenant.path } : {}),\n          enabled: tenant.enabled,\n          ...(tenant.description ? { description: tenant.description } : {}),\n          ...(tenant.port ? { port: tenant.port } : {}),\n          file: tenant.file,\n          database: {\n            host: database.host,\n            port: database.port,\n            database: database.database,\n            user: database.user,\n          },\n          issuer: tenant.options.jwtOptions.issuer,\n          ...(tenant.options.jwtOptions.audience\n            ? {\n                audience: typeof tenant.options.jwtOptions.audience === 'string'\n                  ? tenant.options.jwtOptions.audience\n                  : tenant.options.jwtOptions.audience.join(','),\n              }\n            : {}),\n          jwtAlgorithm: tenant.options.jwtOptions.algorithm ?? 'HS256',\n          refreshEnabled: Boolean(tenant.options.jwtOptions.refreshExpiresIn),\n        };\n      });\n    },\n  };\n\n  return registry;\n}\n"]}
+{"version":3,"file":"tenants.js","sourceRoot":"","sources":["../../../src/accessi/server/tenants.ts"],"names":[],"mappings":";;;AA2LA,wEAIC;AA8BD,kEAEC;AAQD,kFAyDC;AA8FD,4EA2CC;AAQD,gDA+JC;AAhlBD,2BAAiC;AACjC,+BAA+C;AAC/C,iDAAsE;AAyBtE,oFAAwF;AAmIxF,iDAAiD;AACjD,MAAa,+BAAgC,SAAQ,KAAK;IAGxD,YAAY,MAAgB;QAC1B,KAAK,CAAC,sCAAsC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AARD,0EAQC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,8BAA8B,CAC5C,WAAc;IAEd,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB;IACnD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;IAC/D,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACrC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,mEAAmE;AACnE,SAAgB,2BAA2B,CAAC,QAAgB;IAC1D,OAAO,WAAW,QAAQ,GAAG,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mCAAmC,CACjD,WAAqC;;IAErC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,MAAM,eAAe,iCACnB,IAAI,EAAE,QAAQ,CAAC,IAAI,EACnB,IAAI,EAAE,MAAA,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAC3B,IAAI,EAAE,MAAA,QAAQ,CAAC,IAAI,mCAAI,QAAQ,EAC/B,QAAQ,EAAE,MAAA,QAAQ,CAAC,QAAQ,mCAAI,WAAW,IACvC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChE,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU;QACnC,CAAC,CAAC,EAAE,SAAS,EAAE,kCAAkB,EAAE;QACnC,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU;YACjC,CAAC,CAAC,EAAE,SAAS,EAAE,iCAAiB,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;IAEF,6aACE,eAAe,EACf,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EACtD,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,IAC/D,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,WAAW,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7G,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACrF,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC9F,aAAa,EAAE,WAAW,CAAC,aAAa,EACxC,YAAY,EAAE,MAAA,WAAW,CAAC,YAAY,mCAAI,KAAK,KAC5C,CAAC,WAAW,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5G,CAAC,WAAW,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxH,CAAC,WAAW,CAAC,gCAAgC,KAAK,SAAS;QAC5D,CAAC,CAAC,EAAE,gCAAgC,EAAE,WAAW,CAAC,gCAAgC,EAAE;QACpF,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,WAAW,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC/G,UAAU,EAAE,WAAW,CAAC,GAAG,EAC3B,YAAY,EAAE,WAAW,CAAC,KAAK,KAC5B,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpD,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtE,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACjG,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC9F,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,WAAW,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7G,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1G,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACzE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7D,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5E,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/E,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC3F,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,WAAW,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACvG,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7D,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACvD,CAAC,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACvF,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAC/B;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,WAAoB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,IAAI,4EAA4E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;QAC/D,CAAC;QACD,IACE,MAAM,CAAC,IAAI,KAAK,SAAS;eACtB,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,EAChH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;QAC1D,CAAC;QACD,IACE,QAAQ,CAAC,IAAI,KAAK,SAAS;eACxB,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,EACxH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;SACjE,CAAC;QACJ,IAAI,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,WAAW,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC1E,IAAI,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,0BAA0B,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,+DAA+D;QAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAKpC,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gCAAgC,CAAC,IAAY;;IAC3D,MAAM,QAAQ,GAAG,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,+BAA+B,CAAC;YACxC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;SAC/G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,CAAC,MAAA,MAAA,MAAM,CAAC,OAAO,mCAAI,MAAM,CAAC,WAAW,mCAAI,MAAM,CAAY,CAAC;IAChF,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAG,WAAuC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAA,wCAAsB,EAAC,OAAO,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAChH,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IAE7F,MAAM,KAAK,GAAG,CAAC,MAAA,QAAQ,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,+BAA+B,CAAC;YACxC,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,gDAAgD;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,2EACV,EAAE,EAAE,QAAQ,CAAC,EAAE,EACf,KAAK,IACF,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzB,OAAO,EAAE,QAAQ,CAAC,OAAO,KAAK,KAAK,KAChC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACnE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACjD,IAAI,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,EACpB,eAAe,EAAE,QAAQ,EACzB,OAAO,GACR,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,OAAkC;;IACnE,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAA;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,gBAAW,EAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC/F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,+BAA+B,CAAC;YACxC,kCAAkC,SAAS,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC1G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,+BAA+B,CAAC,CAAC,+CAA+C,SAAS,GAAG,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,+BAA+B;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;;gBAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,IAAI,MAAM,MAAA,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,0CAAE,IAAI,IAAI,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,QAAQ,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;;gBACnF,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,kBAAkB,QAAQ,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;;gBAC1F,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;;gBACzF,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,mCAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5F,MAAM,cAAc,GAAG,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,IAAI,UAAU,EAAE,CAAC;QACzF,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,6BAA6B,WAAW,QAAQ,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,mCAAI,WAAW,CAAC;QAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9C,CAAC,CAAC,CAAC,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,mCAAI,WAAW,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,cAAc,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,SAAS,oBAAoB,cAAc,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACtG,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACjG,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,EAAE,qEAAqE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAA0B;QACtC,SAAS;QACT,OAAO;QACP,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI;QACzC,IAAI;QACJ,OAAO,CAAC,KAAK,EAAE,cAAc;;YAC3B,MAAM,WAAW,GAAG,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,WAAW,mCAAI,QAAQ,CAAC,WAAW,CAAC;YACxE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAA,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACnE,IAAI,MAAM;oBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAC3D,CAAC;YAED,MAAM,WAAW,GAAG,MAAA,KAAK,CAAC,IAAI,mCAAI,GAAG,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO;iBACnB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;iBACpD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,uBAAC,OAAA,CAAC,MAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,MAAM,mCAAI,CAAC,CAAC,GAAG,CAAC,MAAA,MAAA,IAAI,CAAC,IAAI,0CAAE,MAAM,mCAAI,CAAC,CAAC,CAAA,EAAA,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAEhF,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAClC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YAC9D,CAAC;YAED,IAAI,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;;gBAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,eAK/B,CAAC;gBACF,2GACE,EAAE,EAAE,MAAM,CAAC,EAAE,EACb,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IACrB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7C,OAAO,EAAE,MAAM,CAAC,OAAO,KACpB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/D,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,EACjB,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;qBACpB,EACD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KACrC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;oBACpC,CAAC,CAAC;wBACE,QAAQ,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ;4BAC9D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;4BACpC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;qBACjD;oBACH,CAAC,CAAC,EAAE,CAAC,KACP,YAAY,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,EAC5D,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,IACnE;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { readdirSync } from 'fs';\nimport { basename, join, resolve } from 'path';\nimport { WIRE_CRYPT_DISABLE, WIRE_CRYPT_ENABLE } from 'node-firebird';\nimport type { Options } from 'node-firebird';\nimport type {\n  AccessiOptions,\n  AccessiHttpOptions,\n  AdminBootstrapOptions,\n  CatalogScriptsOptions,\n  ConsoleEntryOptions,\n  EmailOptions,\n  ExtensionFieldsOptions,\n  FederatedAuthenticationOptions,\n  JwtOptions,\n  PublicAuthRateLimitOptions,\n  PublicRegistrationOptions,\n  ServiceTokenOptions,\n  SystemSeedsOptions,\n} from '../../accessi-service/AccessiModule';\nimport type { AccessiEdgeRateLimitOptions } from '../../accessi-service/security/edgeRateLimit';\nimport type { AccessiAuthCookieOptions } from '../../accessi-service/security/authCookies';\nimport type { AccessiMetricsOptions } from '../../accessi-service/observability/metrics';\nimport type { AccessiAuditOptions } from '../../accessi-service/security/audit';\nimport type { SessionRevocationOptions } from '../../accessi-service/security/sessionRevocation';\nimport type { AccessTokenRevocationOptions } from '../../accessi-service/security/accessTokenRevocation';\nimport type { RefreshTokenRotationOptions } from '../../accessi-service/security/refreshTokenRotation';\nimport type { OpenApiSetupOptions } from '../../openapi/OpenApiConfig';\nimport { validateAccessiOptions } from '../../accessi-service/security/validateOptions';\n\n/** Identita e routing del tenant. */\nexport interface AccessiTenantSettings {\n  /** Minuscole, numeri, `-` e `_`; max 63 caratteri. */\n  id: string;\n  /** Host esatti o wildcard `*.example.com`. */\n  hosts?: string[];\n  /** Prefisso path, es. `/acme`. */\n  path?: string;\n  /** Porta del processo quando si usa il supervisore. */\n  port?: number;\n  /** Default `true`. */\n  enabled?: boolean;\n  description?: string;\n}\n\n/** Connessione Firebird del tenant, tipizzata senza callback. */\nexport interface AccessiTenantDatabaseOptions {\n  host: string;\n  port?: number;\n  database: string;\n  user?: string;\n  password?: string;\n  /** `disabled`/`optional`; `required` e il default del driver. */\n  wireCrypt?: 'required' | 'optional' | 'disabled';\n  pluginName?: string;\n}\n\n/**\n * Configurazione serializzabile di un tenant.\n *\n * I campi che contengono store, callback o logger (`store`, `sink`, `match`,\n * `onDocument`, `logger`, ...) sono esclusi: vanno collegati dal backend\n * ospitante, non da un file di configurazione.\n */\nexport interface AccessiTenantEnvironment {\n  tenant: AccessiTenantSettings;\n  database: AccessiTenantDatabaseOptions;\n  jwt: JwtOptions;\n  email: EmailOptions;\n  encryptionKey: string;\n  confirmationEmailUrl: string;\n  confirmationEmailReturnUrl: string;\n  confirmationEmailPrefix?: string;\n  customResetPage?: string;\n  publicBaseUrl?: string;\n  consoleApiBaseUrl?: string;\n  mockDemoUser?: boolean;\n  passwordExpiration?: boolean;\n  passwordExpirationDays?: number;\n  legacyPasswordMigrationOnStartup?: boolean;\n  autoUpdateDatabase?: boolean;\n  http?: AccessiHttpOptions;\n  authCookie?: AccessiAuthCookieOptions;\n  publicAuthRateLimit?: Omit<PublicAuthRateLimitOptions, 'store'>;\n  publicRegistration?: PublicRegistrationOptions;\n  federatedAuthentication?: FederatedAuthenticationOptions;\n  extensionFieldsOptions?: ExtensionFieldsOptions[];\n  serviceTokens?: Omit<ServiceTokenOptions, 'rateLimitStore'>;\n  catalogScripts?: CatalogScriptsOptions;\n  systemSeeds?: SystemSeedsOptions;\n  adminBootstrap?: AdminBootstrapOptions;\n  openapi?: Omit<OpenApiSetupOptions, 'onDocument'>;\n  consoleEntry?: Omit<ConsoleEntryOptions, 'store'>;\n  edgeRateLimit?: Omit<AccessiEdgeRateLimitOptions, 'store' | 'match'>;\n  sessionRevocation?: Omit<SessionRevocationOptions, 'store'>;\n  accessTokenRevocation?: Omit<AccessTokenRevocationOptions, 'store'>;\n  refreshTokenRotation?: Omit<RefreshTokenRotationOptions, 'store'>;\n  metrics?: Omit<AccessiMetricsOptions, 'sink'>;\n  audit?: Omit<AccessiAuditOptions, 'sinks' | 'store' | 'tenantId'>;\n  bufferLogs?: boolean;\n}\n\nexport interface AccessiTenant {\n  id: string;\n  hosts: string[];\n  path?: string;\n  enabled: boolean;\n  description?: string;\n  port?: number;\n  /** Nome del file `*.environment.ts` di origine (mai il contenuto). */\n  file: string;\n  environmentFile: string;\n  options: AccessiOptions;\n}\n\nexport interface AccessiTenantSummary {\n  id: string;\n  hosts: string[];\n  path?: string;\n  enabled: boolean;\n  description?: string;\n  port?: number;\n  file: string;\n  database: {\n    host?: string;\n    port?: number;\n    database?: string;\n    user?: string;\n  };\n  issuer?: string;\n  audience?: string;\n  jwtAlgorithm: string;\n  refreshEnabled: boolean;\n}\n\nexport interface AccessiTenantResolution {\n  tenant: AccessiTenant;\n  matchedBy: 'host' | 'path' | 'header';\n}\n\nexport interface AccessiTenantRegistry {\n  directory: string;\n  tenants: AccessiTenant[];\n  warnings: string[];\n  allowHeader: boolean;\n  byId: ReadonlyMap<string, AccessiTenant>;\n  resolve(input: { host?: string; path?: string; header?: string }, options?: { allowHeader?: boolean }): AccessiTenantResolution | undefined;\n  summary(): AccessiTenantSummary[];\n}\n\nexport interface LoadAccessiTenantsOptions {\n  /** Cartella con `<id>.environment.ts`. */\n  directory: string;\n  /** Abilita la risoluzione via header `x-accessi-tenant`. Default: false. */\n  allowHeader?: boolean;\n  /** Consente issuer/audience uguali tra tenant (sconsigliato). Default: false. */\n  allowSharedIssuer?: boolean;\n}\n\n/** Errore aggregato di configurazione tenant. */\nexport class AccessiTenantConfigurationError extends Error {\n  readonly issues: string[];\n\n  constructor(issues: string[]) {\n    super(`Configurazione tenant non valida:\\n${issues.map((issue) => `- ${issue}`).join('\\n')}`);\n    this.name = 'AccessiTenantConfigurationError';\n    this.issues = issues;\n  }\n}\n\n/**\n * Helper di tipizzazione per i file tenant.\n *\n * ```ts\n * import type { AccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';\n * import { defineAccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';\n *\n * export default defineAccessiTenantEnvironment({\n *   tenant: { id: 'acme', hosts: ['accessi.acme.example.com'] },\n *   database: { host: 'db-acme', database: '/data/acme.fdb' },\n *   jwt: { secret: process.env.ACME_JWT_SECRET!, expiresIn: '1h' },\n *   email: { ... },\n *   encryptionKey: process.env.ACME_ENCRYPTION_KEY!,\n *   confirmationEmailUrl: 'https://accessi.acme.example.com',\n *   confirmationEmailReturnUrl: 'https://accessi.acme.example.com',\n * });\n * ```\n */\nexport function defineAccessiTenantEnvironment<const T extends AccessiTenantEnvironment>(\n  environment: T,\n): T {\n  return environment;\n}\n\nfunction normalizeHost(host: string): string {\n  return host.trim().toLowerCase().replace(/\\.$/, '');\n}\n\nfunction normalizeTenantPath(path: string | undefined): string | undefined {\n  if (path === undefined || path.trim() === '') return undefined;\n  const normalized = `/${path.trim().replace(/^\\/+|\\/+$/g, '')}`;\n  return normalized === '/' ? '/' : normalized;\n}\n\nfunction matchesHost(tenant: AccessiTenant, host: string): boolean {\n  return tenant.hosts.some((candidate) => {\n    if (candidate === host) return true;\n    if (candidate.startsWith('*.')) {\n      const suffix = candidate.slice(1);\n      return host.endsWith(suffix) && host.length > suffix.length;\n    }\n    return false;\n  });\n}\n\nfunction matchesPath(tenant: AccessiTenant, path: string): boolean {\n  if (!tenant.path) return false;\n  if (tenant.path === '/') return true;\n  return path === tenant.path || path.startsWith(`${tenant.path}/`);\n}\n\n/** Prefisso Redis consigliato per isolare gli store del tenant. */\nexport function getAccessiTenantRedisPrefix(tenantId: string): string {\n  return `accessi:${tenantId}:`;\n}\n\n/**\n * Converte la configurazione tipizzata in `AccessiOptions`.\n *\n * Applica i default di Firebird e collega `tenantId`; non crea store o sink,\n * che restano responsabilita del backend ospitante.\n */\nexport function accessiOptionsFromTenantEnvironment(\n  environment: AccessiTenantEnvironment,\n): AccessiOptions {\n  const database = environment.database;\n  const databaseOptions: Options = {\n    host: database.host,\n    port: database.port ?? 3050,\n    database: database.database,\n    user: database.user ?? 'SYSDBA',\n    password: database.password ?? 'masterkey',\n    ...(database.pluginName ? { pluginName: database.pluginName } : {}),\n    ...(database.wireCrypt === 'disabled'\n      ? { wireCrypt: WIRE_CRYPT_DISABLE }\n      : database.wireCrypt === 'optional'\n        ? { wireCrypt: WIRE_CRYPT_ENABLE }\n        : {}),\n  };\n\n  return {\n    databaseOptions,\n    confirmationEmailUrl: environment.confirmationEmailUrl,\n    confirmationEmailReturnUrl: environment.confirmationEmailReturnUrl,\n    ...(environment.confirmationEmailPrefix ? { confirmationEmailPrefix: environment.confirmationEmailPrefix } : {}),\n    ...(environment.customResetPage ? { customResetPage: environment.customResetPage } : {}),\n    ...(environment.publicBaseUrl ? { publicBaseUrl: environment.publicBaseUrl } : {}),\n    ...(environment.consoleApiBaseUrl ? { consoleApiBaseUrl: environment.consoleApiBaseUrl } : {}),\n    encryptionKey: environment.encryptionKey,\n    mockDemoUser: environment.mockDemoUser ?? false,\n    ...(environment.passwordExpiration !== undefined ? { passwordExpiration: environment.passwordExpiration } : {}),\n    ...(environment.passwordExpirationDays !== undefined ? { passwordExpirationDays: environment.passwordExpirationDays } : {}),\n    ...(environment.legacyPasswordMigrationOnStartup !== undefined\n      ? { legacyPasswordMigrationOnStartup: environment.legacyPasswordMigrationOnStartup }\n      : {}),\n    ...(environment.autoUpdateDatabase !== undefined ? { autoUpdateDatabase: environment.autoUpdateDatabase } : {}),\n    jwtOptions: environment.jwt,\n    emailOptions: environment.email,\n    ...(environment.http ? { http: environment.http } : {}),\n    ...(environment.authCookie ? { authCookie: environment.authCookie } : {}),\n    ...(environment.publicAuthRateLimit ? { publicAuthRateLimit: environment.publicAuthRateLimit } : {}),\n    ...(environment.publicRegistration ? { publicRegistration: environment.publicRegistration } : {}),\n    ...(environment.federatedAuthentication ? { federatedAuthentication: environment.federatedAuthentication } : {}),\n    ...(environment.extensionFieldsOptions ? { extensionFieldsOptions: environment.extensionFieldsOptions } : {}),\n    ...(environment.serviceTokens ? { serviceTokens: environment.serviceTokens } : {}),\n    ...(environment.catalogScripts ? { catalogScripts: environment.catalogScripts } : {}),\n    ...(environment.systemSeeds ? { systemSeeds: environment.systemSeeds } : {}),\n    ...(environment.adminBootstrap ? { adminBootstrap: environment.adminBootstrap } : {}),\n    ...(environment.openapi ? { openapi: environment.openapi } : {}),\n    ...(environment.consoleEntry ? { consoleEntry: environment.consoleEntry } : {}),\n    ...(environment.edgeRateLimit ? { edgeRateLimit: environment.edgeRateLimit } : {}),\n    ...(environment.sessionRevocation ? { sessionRevocation: environment.sessionRevocation } : {}),\n    ...(environment.accessTokenRevocation ? { accessTokenRevocation: environment.accessTokenRevocation } : {}),\n    ...(environment.refreshTokenRotation ? { refreshTokenRotation: environment.refreshTokenRotation } : {}),\n    ...(environment.metrics ? { metrics: environment.metrics } : {}),\n    ...(environment.audit ? { audit: environment.audit } : {}),\n    ...(environment.bufferLogs !== undefined ? { bufferLogs: environment.bufferLogs } : {}),\n    tenantId: environment.tenant.id,\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction runtimeIssues(environment: unknown, file: string): string[] {\n  const issues: string[] = [];\n  if (!isRecord(environment)) {\n    return [`${file}: il file deve esportare un oggetto (default export o export environment).`];\n  }\n  const tenant = environment.tenant;\n  if (!isRecord(tenant)) {\n    issues.push(`${file}: tenant mancante.`);\n  } else {\n    if (typeof tenant.id !== 'string' || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(tenant.id)) {\n      issues.push(`${file}: tenant.id non valido (minuscole, numeri, - e _, max 63).`);\n    }\n    if (tenant.hosts !== undefined && (!Array.isArray(tenant.hosts) || tenant.hosts.some((host) => typeof host !== 'string'))) {\n      issues.push(`${file}: tenant.hosts deve essere un array di stringhe.`);\n    }\n    if (tenant.path !== undefined && typeof tenant.path !== 'string') {\n      issues.push(`${file}: tenant.path deve essere una stringa.`);\n    }\n    if (\n      tenant.port !== undefined\n      && (typeof tenant.port !== 'number' || !Number.isInteger(tenant.port) || tenant.port < 1 || tenant.port > 65535)\n    ) {\n      issues.push(`${file}: tenant.port non valida.`);\n    }\n  }\n\n  const database = environment.database;\n  if (!isRecord(database)) {\n    issues.push(`${file}: database mancante.`);\n  } else {\n    if (typeof database.host !== 'string' || database.host.trim() === '') {\n      issues.push(`${file}: database.host obbligatorio.`);\n    }\n    if (typeof database.database !== 'string' || database.database.trim() === '') {\n      issues.push(`${file}: database.database obbligatorio.`);\n    }\n    if (\n      database.port !== undefined\n      && (typeof database.port !== 'number' || !Number.isInteger(database.port) || database.port < 1 || database.port > 65535)\n    ) {\n      issues.push(`${file}: database.port non valida.`);\n    }\n  }\n\n  if (!isRecord(environment.jwt)) issues.push(`${file}: jwt mancante.`);\n  else {\n    if (typeof environment.jwt.secret !== 'string' || environment.jwt.secret === '') {\n      issues.push(`${file}: jwt.secret obbligatorio.`);\n    }\n    if (typeof environment.jwt.expiresIn !== 'string' || environment.jwt.expiresIn === '') {\n      issues.push(`${file}: jwt.expiresIn obbligatorio.`);\n    }\n  }\n\n  if (!isRecord(environment.email)) issues.push(`${file}: email mancante.`);\n  if (typeof environment.encryptionKey !== 'string' || environment.encryptionKey === '') {\n    issues.push(`${file}: encryptionKey obbligatoria.`);\n  }\n  if (typeof environment.confirmationEmailUrl !== 'string') {\n    issues.push(`${file}: confirmationEmailUrl obbligatoria.`);\n  }\n  if (typeof environment.confirmationEmailReturnUrl !== 'string') {\n    issues.push(`${file}: confirmationEmailReturnUrl obbligatoria.`);\n  }\n  return issues;\n}\n\nfunction loadEnvironmentModule(file: string): unknown {\n  if (/\\.(ts|mts|cts)$/i.test(file)) {\n    // Caricamento lazy: jiti serve solo ai file tenant TypeScript.\n    const { createJiti } = require('jiti') as {\n      createJiti: (\n        id: string,\n        options?: { interopDefault?: boolean; moduleCache?: boolean; fsCache?: boolean },\n      ) => (id: string) => unknown;\n    };\n    const jiti = createJiti(file, { interopDefault: true, moduleCache: false, fsCache: false });\n    return jiti(file);\n  }\n  return require(file);\n}\n\n/**\n * Carica un singolo file `*.environment.ts`.\n *\n * Usa jiti per eseguire TypeScript anche nel pacchetto compilato, senza\n * richiedere un passo di build separato per i file tenant.\n */\nexport function loadAccessiTenantEnvironmentFile(file: string): { tenant: AccessiTenant; environment: AccessiTenantEnvironment } {\n  const absolute = resolve(file);\n  let loaded: unknown;\n  try {\n    loaded = loadEnvironmentModule(absolute);\n  } catch (error) {\n    throw new AccessiTenantConfigurationError([\n      `${basename(file)}: impossibile caricare il file (${error instanceof Error ? error.message : String(error)}).`,\n    ]);\n  }\n\n  const record = isRecord(loaded) ? loaded : {};\n  const environment = (record.default ?? record.environment ?? loaded) as unknown;\n  const issues = runtimeIssues(environment, basename(file));\n  if (issues.length > 0) throw new AccessiTenantConfigurationError(issues);\n\n  const typed = environment as AccessiTenantEnvironment;\n  const settings = typed.tenant;\n  const options = accessiOptionsFromTenantEnvironment(typed);\n  const validation = validateAccessiOptions(options);\n  const validationIssues = validation.errors.map((issue) => `${basename(file)}: ${issue.code}: ${issue.message}`);\n  if (validationIssues.length > 0) throw new AccessiTenantConfigurationError(validationIssues);\n\n  const hosts = (settings.hosts ?? []).map(normalizeHost).filter(Boolean);\n  const path = normalizeTenantPath(settings.path);\n  if (hosts.length === 0 && !path) {\n    throw new AccessiTenantConfigurationError([\n      `${basename(file)}: configurare tenant.hosts oppure tenant.path.`,\n    ]);\n  }\n\n  const tenant: AccessiTenant = {\n    id: settings.id,\n    hosts,\n    ...(path ? { path } : {}),\n    enabled: settings.enabled !== false,\n    ...(settings.description ? { description: settings.description } : {}),\n    ...(settings.port ? { port: settings.port } : {}),\n    file: basename(file),\n    environmentFile: absolute,\n    options,\n  };\n  return { tenant, environment: typed };\n}\n\n/**\n * Carica i tenant da una cartella di file `<id>.environment.ts`.\n *\n * La validazione e aggregata: un errore blocca l'intera cartella, cosi non si\n * avvia un tenant con configurazione parziale. Nessun segreto viene stampato.\n */\nexport function loadAccessiTenants(options: LoadAccessiTenantsOptions): AccessiTenantRegistry {\n  if (!options?.directory) throw new Error('loadAccessiTenants: directory obbligatoria.');\n  const directory = resolve(options.directory);\n  const issues: string[] = [];\n  const warnings: string[] = [];\n\n  let files: string[];\n  try {\n    files = readdirSync(directory, { withFileTypes: true })\n      .filter((entry) => entry.isFile() && /\\.environment\\.(ts|mts|cts|js|mjs|cjs)$/.test(entry.name))\n      .map((entry) => entry.name)\n      .sort();\n  } catch (error) {\n    throw new AccessiTenantConfigurationError([\n      `Cartella tenant non leggibile (${directory}): ${error instanceof Error ? error.message : String(error)}`,\n    ]);\n  }\n  if (files.length === 0) {\n    throw new AccessiTenantConfigurationError([`Nessun file *.environment.ts nella cartella ${directory}.`]);\n  }\n\n  const tenants: AccessiTenant[] = [];\n  for (const file of files) {\n    try {\n      tenants.push(loadAccessiTenantEnvironmentFile(join(directory, file)).tenant);\n    } catch (error) {\n      if (error instanceof AccessiTenantConfigurationError) issues.push(...error.issues);\n      else issues.push(`${file}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n\n  const byId = new Map<string, AccessiTenant>();\n  const hostsSeen = new Map<string, string>();\n  const pathsSeen = new Map<string, string>();\n  const jwtSecrets = new Map<string, string>();\n  const issuerAudience = new Map<string, string>();\n  const portsSeen = new Map<number, string>();\n  for (const tenant of tenants) {\n    if (byId.has(tenant.id)) {\n      issues.push(`Tenant duplicato \"${tenant.id}\" (${tenant.file} e ${byId.get(tenant.id)?.file}).`);\n    } else {\n      byId.set(tenant.id, tenant);\n    }\n    for (const host of tenant.hosts) {\n      const existing = hostsSeen.get(host);\n      if (existing) issues.push(`Host \"${host}\" assegnato a \"${existing}\" e \"${tenant.id}\".`);\n      else hostsSeen.set(host, tenant.id);\n    }\n    if (tenant.path) {\n      const existing = pathsSeen.get(tenant.path);\n      if (existing) issues.push(`Path \"${tenant.path}\" assegnato a \"${existing}\" e \"${tenant.id}\".`);\n      else pathsSeen.set(tenant.path, tenant.id);\n    }\n    if (tenant.port !== undefined) {\n      const existing = portsSeen.get(tenant.port);\n      if (existing) issues.push(`Porta ${tenant.port} assegnata a \"${existing}\" e \"${tenant.id}\".`);\n      else portsSeen.set(tenant.port, tenant.id);\n    }\n\n    // Un segreto JWT condiviso rende un token valido su piu tenant.\n    const signingKey = tenant.options.jwtOptions.privateKey ?? tenant.options.jwtOptions.secret;\n    const fingerprintKey = `${tenant.options.jwtOptions.algorithm ?? 'HS256'}|${signingKey}`;\n    const existingKey = jwtSecrets.get(fingerprintKey);\n    if (existingKey) {\n      issues.push(`Chiave JWT condivisa tra \"${existingKey}\" e \"${tenant.id}\": usare segreti distinti.`);\n    } else {\n      jwtSecrets.set(fingerprintKey, tenant.id);\n    }\n\n    const issuer = tenant.options.jwtOptions.issuer ?? '(assente)';\n    const audience = Array.isArray(tenant.options.jwtOptions.audience)\n      ? tenant.options.jwtOptions.audience.join(',')\n      : (tenant.options.jwtOptions.audience ?? '(assente)');\n    const issuerKey = `${issuer}|${audience}`;\n    const existingIssuer = issuerAudience.get(issuerKey);\n    if (existingIssuer && options.allowSharedIssuer !== true) {\n      warnings.push(`Issuer/audience \"${issuerKey}\" condivisi tra \"${existingIssuer}\" e \"${tenant.id}\".`);\n    } else {\n      issuerAudience.set(issuerKey, tenant.id);\n    }\n  }\n\n  const enabled = tenants.filter((tenant) => tenant.enabled);\n  if (enabled.length > 1) {\n    const defaultTenant = enabled.find((tenant) => tenant.hosts.length === 0 && tenant.path === '/');\n    if (defaultTenant) {\n      issues.push(`Tenant \"${defaultTenant.id}\" intercetta tutte le richieste (path \"/\") insieme ad altri tenant.`);\n    }\n  }\n\n  if (issues.length > 0) throw new AccessiTenantConfigurationError(issues);\n\n  const registry: AccessiTenantRegistry = {\n    directory,\n    tenants,\n    warnings,\n    allowHeader: options.allowHeader === true,\n    byId,\n    resolve(input, resolveOptions) {\n      const allowHeader = resolveOptions?.allowHeader ?? registry.allowHeader;\n      const host = input.host ? normalizeHost(input.host.split(':')[0] ?? input.host) : undefined;\n      if (host) {\n        const byHost = enabled.find((tenant) => matchesHost(tenant, host));\n        if (byHost) return { tenant: byHost, matchedBy: 'host' };\n      }\n\n      const requestPath = input.path ?? '/';\n      const byPath = enabled\n        .filter((tenant) => matchesPath(tenant, requestPath))\n        .sort((left, right) => (right.path?.length ?? 0) - (left.path?.length ?? 0))[0];\n      if (byPath && byPath.path !== '/') return { tenant: byPath, matchedBy: 'path' };\n\n      if (allowHeader && input.header) {\n        const headerId = input.header.trim().toLowerCase();\n        const tenant = byId.get(headerId);\n        if (tenant?.enabled) return { tenant, matchedBy: 'header' };\n      }\n\n      if (byPath) return { tenant: byPath, matchedBy: 'path' };\n      return undefined;\n    },\n    summary() {\n      return tenants.map((tenant) => {\n        const database = tenant.options.databaseOptions as {\n          host?: string;\n          port?: number;\n          database?: string;\n          user?: string;\n        };\n        return {\n          id: tenant.id,\n          hosts: [...tenant.hosts],\n          ...(tenant.path ? { path: tenant.path } : {}),\n          enabled: tenant.enabled,\n          ...(tenant.description ? { description: tenant.description } : {}),\n          ...(tenant.port ? { port: tenant.port } : {}),\n          file: tenant.file,\n          database: {\n            host: database.host,\n            port: database.port,\n            database: database.database,\n            user: database.user,\n          },\n          issuer: tenant.options.jwtOptions.issuer,\n          ...(tenant.options.jwtOptions.audience\n            ? {\n                audience: typeof tenant.options.jwtOptions.audience === 'string'\n                  ? tenant.options.jwtOptions.audience\n                  : tenant.options.jwtOptions.audience.join(','),\n              }\n            : {}),\n          jwtAlgorithm: tenant.options.jwtOptions.algorithm ?? 'HS256',\n          refreshEnabled: Boolean(tenant.options.jwtOptions.refreshExpiresIn),\n        };\n      });\n    },\n  };\n\n  return registry;\n}\n"]}