@adaptic/backend-legacy 0.0.996 → 0.0.998

package/esm/auth/authorization-map.d.ts

@@ -0,0 +1,77 @@
+/**
+ * CORTEX-P0-001 phase 2 — `@Authorized()` coverage for generated CRUD resolvers
+ * (audit B01-backend-legacy-03).
+ *
+ * The `cortexAuthChecker` registered in `buildSchema` is only invoked by
+ * TypeGraphQL for fields carrying an `@Authorized()` decorator; the
+ * auto-generated typegraphql-prisma resolvers carry none, so the checker was
+ * registered-but-inert. This module applies decorators via
+ * `applyResolversEnhanceMap`, making the checker actually execute:
+ *
+ *   - FULL coverage (`_all`) for the five investor-relations models —
+ *     regulated PII (tax documents, KYC status, LP capital ledger) that must
+ *     never sit on an unauthenticated CRUD surface.
+ *   - DELETE mutations (`deleteOne*` / `deleteMany*`) for every other model —
+ *     the most destructive operations on the trading system-of-record.
+ *
+ * CRITICAL SAFETY CONTRACT — the checker itself remains SHADOW-FIRST: while
+ * `CORTEX_AUTHCHECKER_ENFORCE` is OFF (default) a would-deny operation is
+ * logged + counted and then ALLOWED, so engine service traffic cannot break.
+ * This module only determines WHERE the checker runs, not what it does.
+ * Graduation rule (audit B01-backend-legacy-07): enforce only after
+ * `cortex_authchecker_evaluations_total` > 0 and the would-deny series has
+ * been observed over a full trading week.
+ *
+ * Must be applied BEFORE `buildSchema` — decorators land in TypeGraphQL's
+ * global metadata storage, which `buildSchema` reads.
+ */
+import { type ResolversEnhanceMap } from '../generated/typegraphql-prisma';
+/** Model names accepted by the generated {@link ResolversEnhanceMap}. */
+type EnhanceModelName = keyof ResolversEnhanceMap;
+/**
+ * The five investor-relations models receiving FULL (`_all`) coverage:
+ * every generated query and mutation on these models invokes the authChecker.
+ */
+export declare const IR_MODELS: readonly EnhanceModelName[];
+/** Summary of the coverage applied, for the boot log and tests. */
+export interface AuthorizationMapSummary {
+    /** Models decorated with `_all` (full CRUD coverage). */
+    readonly fullCoverageModels: number;
+    /** Models whose delete mutations were decorated. */
+    readonly deleteCoverageModels: number;
+    /** Total decorated resolver actions (delete actions + `_all` markers). */
+    readonly decoratedActions: number;
+    /**
+     * Delete-action names skipped because the generated CRUD resolver does not
+     * expose them — non-empty output means the naming convention drifted and the
+     * map must be updated. Never silently ignored: logged at warn on apply.
+     */
+    readonly skippedActions: readonly string[];
+}
+/** Internal build output: the map plus its audit summary. */
+interface BuiltAuthorizationMap {
+    readonly map: ResolversEnhanceMap;
+    readonly summary: AuthorizationMapSummary;
+}
+/**
+ * Builds the CORTEX authorization enhance-map. Pure (no metadata mutation) so
+ * tests can pin its contents without touching TypeGraphQL global state.
+ *
+ * @returns The enhance map and a summary of the coverage it encodes.
+ */
+export declare function buildCortexAuthorizationMap(): BuiltAuthorizationMap;
+/**
+ * Applies the CORTEX authorization map to the generated resolvers. Idempotent:
+ * decorators land in TypeGraphQL's global metadata storage, so applying twice
+ * would duplicate `Authorized` metadata — subsequent calls return the cached
+ * summary without re-applying.
+ *
+ * Call BEFORE `buildSchema`. The registered `cortexAuthChecker` stays
+ * SHADOW-FIRST (log + count + allow) until `CORTEX_AUTHCHECKER_ENFORCE` is
+ * explicitly flipped on.
+ *
+ * @returns The {@link AuthorizationMapSummary} for the boot log.
+ */
+export declare function applyCortexAuthorizationMap(): AuthorizationMapSummary;
+export {};
+//# sourceMappingURL=authorization-map.d.ts.map

package/esm/auth/authorization-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-map.d.ts","sourceRoot":"","sources":["../../../src/auth/authorization-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AAIzC,yEAAyE;AACzE,KAAK,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,gBAAgB,EAMhD,CAAC;AAEF,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,oDAAoD;IACpD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAmBD,6DAA6D;AAC7D,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,qBAAqB,CA8CnE;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,IAAI,uBAAuB,CAcrE"}

package/esm/auth/authorization-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-map.js","sourceRoot":"","sources":["../../../src/auth/authorization-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EACL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,cAAc,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAKzC;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAgC;IACpD,UAAU;IACV,SAAS;IACT,qBAAqB;IACrB,kBAAkB;IAClB,aAAa;CACd,CAAC;AAkBF;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,KAAa;IAEb,MAAM,aAAa,GAAI,cAA0C,CAC/D,GAAG,KAAK,cAAc,CACvB,CAAC;IACF,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAC,SAAoC,CAAC;AAC5D,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;QACtC,gBAAgB,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,SAAS,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,uEAAuE;QACvE,6DAA6D;QAC7D,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAsC,EAAE,CAAC;QAC5D,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,aAAa,KAAK,EAAE,CAAC,EAAE,CAAC;YACjE,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;gBACzD,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBACvC,eAAe,IAAI,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,KAAyB,CAAC;gBAC5B,aAAsD,CAAC;YACzD,gBAAgB,IAAI,eAAe,CAAC;YACpC,oBAAoB,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,OAAO,EAAE;YACP,kBAAkB,EAAE,SAAS,CAAC,MAAM;YACpC,oBAAoB;YACpB,gBAAgB;YAChB,cAAc;SACf;KACF,CAAC;AACJ,CAAC;AAED,IAAI,cAAmD,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,2BAA2B,EAAE,CAAC;IACvD,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CACT,yGAAyG,EACzG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAC3C,CAAC;IACJ,CAAC;IACD,cAAc,GAAG,OAAO,CAAC;IACzB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/esm/auth/authorization-map.mjs

@@ -0,0 +1,132 @@
+/**
+ * CORTEX-P0-001 phase 2 — `@Authorized()` coverage for generated CRUD resolvers
+ * (audit B01-backend-legacy-03).
+ *
+ * The `cortexAuthChecker` registered in `buildSchema` is only invoked by
+ * TypeGraphQL for fields carrying an `@Authorized()` decorator; the
+ * auto-generated typegraphql-prisma resolvers carry none, so the checker was
+ * registered-but-inert. This module applies decorators via
+ * `applyResolversEnhanceMap`, making the checker actually execute:
+ *
+ *   - FULL coverage (`_all`) for the five investor-relations models —
+ *     regulated PII (tax documents, KYC status, LP capital ledger) that must
+ *     never sit on an unauthenticated CRUD surface.
+ *   - DELETE mutations (`deleteOne*` / `deleteMany*`) for every other model —
+ *     the most destructive operations on the trading system-of-record.
+ *
+ * CRITICAL SAFETY CONTRACT — the checker itself remains SHADOW-FIRST: while
+ * `CORTEX_AUTHCHECKER_ENFORCE` is OFF (default) a would-deny operation is
+ * logged + counted and then ALLOWED, so engine service traffic cannot break.
+ * This module only determines WHERE the checker runs, not what it does.
+ * Graduation rule (audit B01-backend-legacy-07): enforce only after
+ * `cortex_authchecker_evaluations_total` > 0 and the would-deny series has
+ * been observed over a full trading week.
+ *
+ * Must be applied BEFORE `buildSchema` — decorators land in TypeGraphQL's
+ * global metadata storage, which `buildSchema` reads.
+ */
+import { Authorized } from 'type-graphql';
+import { Prisma } from '@prisma/client';
+import { applyResolversEnhanceMap, } from '../generated/typegraphql-prisma/index.mjs';
+import * as generatedIndex from '../generated/typegraphql-prisma/index.mjs';
+import { logger } from '../utils/logger.mjs';
+/**
+ * The five investor-relations models receiving FULL (`_all`) coverage:
+ * every generated query and mutation on these models invokes the authChecker.
+ */
+export const IR_MODELS = [
+    'Investor',
+    'Holding',
+    'InvestorTransaction',
+    'InvestorDocument',
+    'TaxDocument',
+];
+/**
+ * Looks up the generated `<Model>CrudResolver` class for a model, so delete
+ * action names can be validated against the real resolver surface instead of
+ * being assumed by convention.
+ */
+function crudResolverPrototype(model) {
+    const resolverClass = generatedIndex[`${model}CrudResolver`];
+    if (typeof resolverClass !== 'function') {
+        return undefined;
+    }
+    return resolverClass.prototype;
+}
+/**
+ * Builds the CORTEX authorization enhance-map. Pure (no metadata mutation) so
+ * tests can pin its contents without touching TypeGraphQL global state.
+ *
+ * @returns The enhance map and a summary of the coverage it encodes.
+ */
+export function buildCortexAuthorizationMap() {
+    const map = {};
+    const skippedActions = [];
+    let decoratedActions = 0;
+    let deleteCoverageModels = 0;
+    for (const model of IR_MODELS) {
+        map[model] = { _all: [Authorized()] };
+        decoratedActions += 1;
+    }
+    const irModelSet = new Set(IR_MODELS);
+    for (const model of Object.values(Prisma.ModelName)) {
+        // IR models already have full coverage; decorating deletes again would
+        // register duplicate Authorized metadata on the same fields.
+        if (irModelSet.has(model)) {
+            continue;
+        }
+        const prototype = crudResolverPrototype(model);
+        const actionsConfig = {};
+        let coveredForModel = 0;
+        for (const action of [`deleteOne${model}`, `deleteMany${model}`]) {
+            if (prototype && typeof prototype[action] === 'function') {
+                actionsConfig[action] = [Authorized()];
+                coveredForModel += 1;
+            }
+            else {
+                skippedActions.push(action);
+            }
+        }
+        if (coveredForModel > 0) {
+            map[model] =
+                actionsConfig;
+            decoratedActions += coveredForModel;
+            deleteCoverageModels += 1;
+        }
+    }
+    return {
+        map,
+        summary: {
+            fullCoverageModels: IR_MODELS.length,
+            deleteCoverageModels,
+            decoratedActions,
+            skippedActions,
+        },
+    };
+}
+let appliedSummary;
+/**
+ * Applies the CORTEX authorization map to the generated resolvers. Idempotent:
+ * decorators land in TypeGraphQL's global metadata storage, so applying twice
+ * would duplicate `Authorized` metadata — subsequent calls return the cached
+ * summary without re-applying.
+ *
+ * Call BEFORE `buildSchema`. The registered `cortexAuthChecker` stays
+ * SHADOW-FIRST (log + count + allow) until `CORTEX_AUTHCHECKER_ENFORCE` is
+ * explicitly flipped on.
+ *
+ * @returns The {@link AuthorizationMapSummary} for the boot log.
+ */
+export function applyCortexAuthorizationMap() {
+    if (appliedSummary) {
+        return appliedSummary;
+    }
+    const { map, summary } = buildCortexAuthorizationMap();
+    applyResolversEnhanceMap(map);
+    if (summary.skippedActions.length > 0) {
+        logger.warn('[cortex-authz] delete actions missing from generated resolvers — authorization map drifted from codegen', { skippedActions: summary.skippedActions });
+    }
+    appliedSummary = summary;
+    return summary;
+}
+//# sourceMappingURL=authorization-map.js.map

package/esm/auth/cortex-auth-checker.d.ts

@@ -0,0 +1,114 @@
+/**
+ * CORTEX-P0-001 — resolver-level authorization AuthChecker (SHADOW-FIRST).
+ *
+ * A TypeGraphQL {@link AuthChecker} that evaluates whether an operation WOULD be
+ * allowed under resolver-level authorization, closing the residual vector called
+ * out in the tenancy-scoping middleware docs: a governed model reached
+ * transitively through a non-governed root, and — more broadly — any
+ * `@Authorized()`-decorated field executed without a verified principal.
+ *
+ * CRITICAL SAFETY CONTRACT — this change is additive and default-OFF. When
+ * enforcement is OFF (the default), the checker NEVER denies: it returns `true`
+ * for every operation, emitting a structured warn log and incrementing a
+ * Prometheus counter for any operation that enforcement WOULD deny. Live
+ * behaviour is byte-identical to before this change until
+ * `CORTEX_AUTHCHECKER_ENFORCE` is flipped on. Additionally, TypeGraphQL only
+ * invokes an AuthChecker for fields decorated with `@Authorized()`; the
+ * auto-generated typegraphql-prisma resolvers carry no such decorator, so
+ * registering this checker via `buildSchema({ authChecker })` is inert at
+ * runtime until decorators are added in the separate enforcement phase.
+ *
+ * Decision model (mirrors the token-verifier principal kinds):
+ *
+ *   - `server`            — trusted server-to-server caller. ALWAYS allowed; the
+ *     engine + utils call the CRUD resolvers with a server principal and must
+ *     retain full access, bypassing any role gate.
+ *   - `admin` / `user`    — verified end-user. Allowed when the field requires no
+ *     specific role, or when the principal carries one of the required roles;
+ *     otherwise a would-deny with reason `insufficient_role`.
+ *   - `null` (no verified principal) — a genuinely unauthenticated caller on a
+ *     non-public (i.e. `@Authorized()`) operation. A would-deny with reason
+ *     `unauthenticated`.
+ *
+ * @see src/auth/tenancy-scope.ts for the row-level (data-scope) counterpart.
+ * @see src/auth/token-verifier.ts for `BackendPrincipal`.
+ */
+import { Counter } from 'prom-client';
+import type { AuthChecker } from 'type-graphql';
+import type { BackendPrincipal } from './token-verifier';
+/**
+ * Environment variable gating enforcement. When set to `true`/`1`, the checker
+ * fails closed (returns `false`) for any would-deny operation. Unset or any
+ * other value keeps the checker in SHADOW mode (observe + count + allow).
+ */
+export declare const CORTEX_AUTHCHECKER_ENFORCE_ENV = "CORTEX_AUTHCHECKER_ENFORCE";
+/**
+ * Whether resolver-level authorization enforcement is ON. Read fresh on each
+ * call (a cheap env read) so the shadow→enforce graduation can be flipped
+ * operationally without a process restart — the same pattern the tenancy-scoping
+ * middleware uses. Defaults to OFF (shadow) for any unset/unrecognised value.
+ *
+ * @param env - Environment source (defaults to `process.env`); injectable for tests.
+ * @returns `true` only when the flag is explicitly `true`/`1`.
+ */
+export declare function isAuthCheckerEnforced(env?: Record<string, string | undefined>): boolean;
+/**
+ * Finite set of reasons enforcement WOULD deny an operation. Used as the sole
+ * label on {@link cortexAuthCheckerWouldDenyTotal}.
+ */
+export type WouldDenyReason = 'unauthenticated' | 'insufficient_role';
+/**
+ * Counts EVERY AuthChecker invocation, regardless of outcome (audit
+ * B01-backend-legacy-07). A flat-zero {@link cortexAuthCheckerWouldDenyTotal}
+ * is ambiguous on its own: it can mean "no traffic would be denied" OR "the
+ * checker never ran" (no `@Authorized()` field was ever executed) — exactly the
+ * false-confidence pattern that preceded the beta-net-cap fail-open. Graduation
+ * rule: enforce only when this counter is > 0 and the would-deny series has
+ * been observed over a full trading week.
+ */
+export declare const cortexAuthCheckerEvaluationsTotal: Counter<string>;
+/**
+ * Counts operations that resolver-level authorization WOULD deny. In shadow mode
+ * this is the primary signal proving whether flipping `CORTEX_AUTHCHECKER_ENFORCE`
+ * to `enforce` would reject any legitimate platform or engine traffic. Labelled
+ * by the discriminated {@link WouldDenyReason}.
+ */
+export declare const cortexAuthCheckerWouldDenyTotal: Counter<"reason">;
+/** The outcome of evaluating whether an operation would be allowed. */
+interface AuthEvaluation {
+    readonly wouldAllow: boolean;
+    /** Populated only when `wouldAllow` is `false`. */
+    readonly reason?: WouldDenyReason;
+}
+/**
+ * Pure evaluation of whether a principal would satisfy the required roles for an
+ * operation. Performs no I/O and no logging.
+ *
+ * @param principal - The verified principal, or `null` for an unauthenticated caller.
+ * @param requiredRoles - Roles declared on the field's `@Authorized(...)` decorator
+ *   (empty when the field only requires authentication).
+ * @returns The {@link AuthEvaluation}.
+ */
+export declare function evaluateWouldAllow(principal: BackendPrincipal | null, requiredRoles: readonly string[]): AuthEvaluation;
+/**
+ * GraphQL context shape this checker reads. `principal` is the verified
+ * `BackendPrincipal` attached to the context in `server.ts` (`null` for an
+ * unauthenticated caller).
+ */
+export interface CortexAuthContext {
+    principal?: BackendPrincipal | null;
+}
+/**
+ * The CORTEX-P0-001 AuthChecker. Register via
+ * `buildSchema({ authChecker: cortexAuthChecker })`.
+ *
+ * SHADOW (default): a would-deny operation increments
+ * {@link cortexAuthCheckerWouldDenyTotal}, emits a warn log, and RETURNS TRUE —
+ * no behaviour change. ENFORCE (`CORTEX_AUTHCHECKER_ENFORCE=true`): a would-deny
+ * operation is logged, the counter is incremented, and the checker RETURNS FALSE
+ * (fail closed). Operations that would be allowed always return `true` with no
+ * metric or log emission.
+ */
+export declare const cortexAuthChecker: AuthChecker<CortexAuthContext>;
+export {};
+//# sourceMappingURL=cortex-auth-checker.d.ts.map

package/esm/auth/cortex-auth-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cortex-auth-checker.d.ts","sourceRoot":"","sources":["../../../src/auth/cortex-auth-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAK3E;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAGT;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,iBAI5C,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mBAK1C,CAAC;AAEH,uEAAuE;AACvE,UAAU,cAAc;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,GAAG,IAAI,EAClC,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,cAAc,CAyBhB;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAcD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,CAkC5D,CAAC"}

package/esm/auth/cortex-auth-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cortex-auth-checker.js","sourceRoot":"","sources":["../../../src/auth/cortex-auth-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE3E,kFAAkF;AAClF,MAAM,UAAU,GAAG,OAAO,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,OAAO,CAAC;IAC3D,IAAI,EAAE,sCAAsC;IAC5C,IAAI,EAAE,6HAA6H;IACnI,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,OAAO,CAAC;IACzD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wGAAwG;IAC9G,UAAU,EAAE,CAAC,QAAQ,CAAU;IAC/B,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AASH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAkC,EAClC,aAAgC;IAEhC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,8EAA8E;IAC9E,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,cAAc,GAClB,SAAS,CAAC,IAAI,KAAK,OAAO;QACxB,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,OAAO,eAAe;QACpB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;QACtB,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACzD,CAAC;AAeD,4EAA4E;AAC5E,SAAS,iBAAiB,CACxB,YAA6C;IAE7C,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IAC9B,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;QACvC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS;QAC3D,KAAK,EAAE,IAAI,CAAC,SAAS;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmC,CAC/D,YAAY,EACZ,KAAK,EACI,EAAE;IACX,+DAA+D;IAC/D,0EAA0E;IAC1E,iCAAiC,CAAC,GAAG,EAAE,CAAC;IAExC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAExD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,iBAAiB,CAAC;IACtD,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAElD,+BAA+B,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CACT,QAAQ;QACN,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,mDAAmD,EACvD;QACE,GAAG,SAAS;QACZ,MAAM;QACN,QAAQ;QACR,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,MAAM;QACxC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC;KAC1B,CACF,CAAC;IAEF,OAAO,CAAC,QAAQ,CAAC;AACnB,CAAC,CAAC"}

package/esm/auth/cortex-auth-checker.mjs

@@ -0,0 +1,163 @@
+/**
+ * CORTEX-P0-001 — resolver-level authorization AuthChecker (SHADOW-FIRST).
+ *
+ * A TypeGraphQL {@link AuthChecker} that evaluates whether an operation WOULD be
+ * allowed under resolver-level authorization, closing the residual vector called
+ * out in the tenancy-scoping middleware docs: a governed model reached
+ * transitively through a non-governed root, and — more broadly — any
+ * `@Authorized()`-decorated field executed without a verified principal.
+ *
+ * CRITICAL SAFETY CONTRACT — this change is additive and default-OFF. When
+ * enforcement is OFF (the default), the checker NEVER denies: it returns `true`
+ * for every operation, emitting a structured warn log and incrementing a
+ * Prometheus counter for any operation that enforcement WOULD deny. Live
+ * behaviour is byte-identical to before this change until
+ * `CORTEX_AUTHCHECKER_ENFORCE` is flipped on. Additionally, TypeGraphQL only
+ * invokes an AuthChecker for fields decorated with `@Authorized()`; the
+ * auto-generated typegraphql-prisma resolvers carry no such decorator, so
+ * registering this checker via `buildSchema({ authChecker })` is inert at
+ * runtime until decorators are added in the separate enforcement phase.
+ *
+ * Decision model (mirrors the token-verifier principal kinds):
+ *
+ *   - `server`            — trusted server-to-server caller. ALWAYS allowed; the
+ *     engine + utils call the CRUD resolvers with a server principal and must
+ *     retain full access, bypassing any role gate.
+ *   - `admin` / `user`    — verified end-user. Allowed when the field requires no
+ *     specific role, or when the principal carries one of the required roles;
+ *     otherwise a would-deny with reason `insufficient_role`.
+ *   - `null` (no verified principal) — a genuinely unauthenticated caller on a
+ *     non-public (i.e. `@Authorized()`) operation. A would-deny with reason
+ *     `unauthenticated`.
+ *
+ * @see src/auth/tenancy-scope.ts for the row-level (data-scope) counterpart.
+ * @see src/auth/token-verifier.ts for `BackendPrincipal`.
+ */
+import { Counter } from 'prom-client';
+import { metricsRegistry } from '../config/metrics.mjs';
+import { logger } from '../utils/logger.mjs';
+// -----------------------------------------------------------------------------
+// Enforcement flag
+// -----------------------------------------------------------------------------
+/**
+ * Environment variable gating enforcement. When set to `true`/`1`, the checker
+ * fails closed (returns `false`) for any would-deny operation. Unset or any
+ * other value keeps the checker in SHADOW mode (observe + count + allow).
+ */
+export const CORTEX_AUTHCHECKER_ENFORCE_ENV = 'CORTEX_AUTHCHECKER_ENFORCE';
+/** The `admin` role string used to satisfy admin-gated `@Authorized()` fields. */
+const ADMIN_ROLE = 'admin';
+/**
+ * Whether resolver-level authorization enforcement is ON. Read fresh on each
+ * call (a cheap env read) so the shadow→enforce graduation can be flipped
+ * operationally without a process restart — the same pattern the tenancy-scoping
+ * middleware uses. Defaults to OFF (shadow) for any unset/unrecognised value.
+ *
+ * @param env - Environment source (defaults to `process.env`); injectable for tests.
+ * @returns `true` only when the flag is explicitly `true`/`1`.
+ */
+export function isAuthCheckerEnforced(env = process.env) {
+    const raw = (env[CORTEX_AUTHCHECKER_ENFORCE_ENV] ?? '').trim().toLowerCase();
+    return raw === 'true' || raw === '1';
+}
+/**
+ * Counts EVERY AuthChecker invocation, regardless of outcome (audit
+ * B01-backend-legacy-07). A flat-zero {@link cortexAuthCheckerWouldDenyTotal}
+ * is ambiguous on its own: it can mean "no traffic would be denied" OR "the
+ * checker never ran" (no `@Authorized()` field was ever executed) — exactly the
+ * false-confidence pattern that preceded the beta-net-cap fail-open. Graduation
+ * rule: enforce only when this counter is > 0 and the would-deny series has
+ * been observed over a full trading week.
+ */
+export const cortexAuthCheckerEvaluationsTotal = new Counter({
+    name: 'cortex_authchecker_evaluations_total',
+    help: 'Total AuthChecker invocations, any outcome (zero means no @Authorized field was executed — distinct from "no would-denies")',
+    registers: [metricsRegistry],
+});
+/**
+ * Counts operations that resolver-level authorization WOULD deny. In shadow mode
+ * this is the primary signal proving whether flipping `CORTEX_AUTHCHECKER_ENFORCE`
+ * to `enforce` would reject any legitimate platform or engine traffic. Labelled
+ * by the discriminated {@link WouldDenyReason}.
+ */
+export const cortexAuthCheckerWouldDenyTotal = new Counter({
+    name: 'cortex_authchecker_would_deny_total',
+    help: 'Operations resolver-level authorization would deny, by reason (counted in shadow mode without denying)',
+    labelNames: ['reason'],
+    registers: [metricsRegistry],
+});
+/**
+ * Pure evaluation of whether a principal would satisfy the required roles for an
+ * operation. Performs no I/O and no logging.
+ *
+ * @param principal - The verified principal, or `null` for an unauthenticated caller.
+ * @param requiredRoles - Roles declared on the field's `@Authorized(...)` decorator
+ *   (empty when the field only requires authentication).
+ * @returns The {@link AuthEvaluation}.
+ */
+export function evaluateWouldAllow(principal, requiredRoles) {
+    if (!principal) {
+        return { wouldAllow: false, reason: 'unauthenticated' };
+    }
+    // Server-to-server callers are unconditionally allowed and bypass role gates.
+    if (principal.kind === 'server') {
+        return { wouldAllow: true };
+    }
+    // Authenticated user/admin with no specific role requirement -> allowed.
+    if (requiredRoles.length === 0) {
+        return { wouldAllow: true };
+    }
+    const principalRoles = principal.kind === 'admin'
+        ? [...principal.roles, ADMIN_ROLE]
+        : principal.roles;
+    const roleSet = new Set(principalRoles);
+    const hasRequiredRole = requiredRoles.some((role) => roleSet.has(role));
+    return hasRequiredRole
+        ? { wouldAllow: true }
+        : { wouldAllow: false, reason: 'insufficient_role' };
+}
+/** Describe an operation for structured logs, without leaking arguments. */
+function describeOperation(resolverData) {
+    const { info } = resolverData;
+    return {
+        operationType: info.operation.operation,
+        operationName: info.operation.name?.value ?? info.fieldName,
+        field: info.fieldName,
+    };
+}
+/**
+ * The CORTEX-P0-001 AuthChecker. Register via
+ * `buildSchema({ authChecker: cortexAuthChecker })`.
+ *
+ * SHADOW (default): a would-deny operation increments
+ * {@link cortexAuthCheckerWouldDenyTotal}, emits a warn log, and RETURNS TRUE —
+ * no behaviour change. ENFORCE (`CORTEX_AUTHCHECKER_ENFORCE=true`): a would-deny
+ * operation is logged, the counter is incremented, and the checker RETURNS FALSE
+ * (fail closed). Operations that would be allowed always return `true` with no
+ * metric or log emission.
+ */
+export const cortexAuthChecker = (resolverData, roles) => {
+    // Unconditional: proves the checker is actually reachable (see
+    // cortexAuthCheckerEvaluationsTotal TSDoc / audit B01-backend-legacy-07).
+    cortexAuthCheckerEvaluationsTotal.inc();
+    const principal = resolverData.context.principal ?? null;
+    const evaluation = evaluateWouldAllow(principal, roles);
+    if (evaluation.wouldAllow) {
+        return true;
+    }
+    const reason = evaluation.reason ?? 'unauthenticated';
+    const enforced = isAuthCheckerEnforced();
+    const operation = describeOperation(resolverData);
+    cortexAuthCheckerWouldDenyTotal.inc({ reason });
+    logger.warn(enforced
+        ? '[cortex-authchecker] denying operation (enforce)'
+        : '[cortex-authchecker] shadow would-deny (allowing)', {
+        ...operation,
+        reason,
+        enforced,
+        principalKind: principal?.kind ?? 'none',
+        requiredRoles: [...roles],
+    });
+    return !enforced;
+};
+//# sourceMappingURL=cortex-auth-checker.js.map

package/esm/middleware/__tests__/rate-limit-test-utils.d.ts

@@ -0,0 +1,60 @@
+import { vi } from 'vitest';
+import type { Counter } from 'prom-client';
+import type { Request, Response } from 'express';
+import type { RateLimitConfig } from '../rate-limiter';
+/**
+ * Shared fixtures for the rate-limiter test files (audit
+ * B01-backend-legacy-08). Pure helpers only — each test file remains
+ * responsible for setting `process.env.JWT_SECRET` via `vi.hoisted` BEFORE its
+ * first import pulls in `config/jwtConfig` (which reads the env at load time).
+ */
+/** Window used by every test config. */
+export declare const WINDOW_MS = 60000;
+/**
+ * Builds a small test limiter config.
+ *
+ * @param overrides - Field overrides applied over the defaults.
+ * @returns A complete {@link RateLimitConfig}.
+ */
+export declare function makeConfig(overrides?: Partial<RateLimitConfig>): RateLimitConfig;
+/** A mock Express response with observable spies. */
+export interface MockResponse {
+    res: Response;
+    setHeader: ReturnType<typeof vi.fn>;
+    status: ReturnType<typeof vi.fn>;
+    json: ReturnType<typeof vi.fn>;
+}
+/**
+ * Creates a mock response whose header/status/json calls are observable —
+ * the shadow contract is proven by these spies staying untouched.
+ *
+ * @returns The {@link MockResponse}.
+ */
+export declare function makeRes(): MockResponse;
+/**
+ * Creates a mock request. Defaults to an anonymous POST from a fixed IP.
+ *
+ * @param overrides - Request field overrides (headers, ip, method, …).
+ * @returns A Request usable by the limiter middleware.
+ */
+export declare function makeReq(overrides?: Record<string, unknown>): Request;
+/**
+ * Reads the current value of a limiter counter for a label pair.
+ *
+ * @param counter - The prom-client counter to read.
+ * @param labels - The limiter/tier label pair identifying the series.
+ * @returns The current value (0 when the series does not exist yet).
+ */
+export declare function counterValue(counter: Counter<'limiter' | 'tier'>, labels: {
+    limiter: string;
+    tier: string;
+}): Promise<number>;
+/**
+ * Signs a real HS256 user JWT with the ambient `JWT_SECRET` (the same secret
+ * `config/jwtConfig` resolved at load), so the tier resolver verifies it.
+ *
+ * @param sub - Subject claim for the token.
+ * @returns A signed JWT string.
+ */
+export declare function signUserToken(sub: string): string;
+//# sourceMappingURL=rate-limit-test-utils.d.ts.map

package/esm/middleware/__tests__/rate-limit-test-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-test-utils.d.ts","sourceRoot":"","sources":["../../../../src/middleware/__tests__/rate-limit-test-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;;;GAKG;AAEH,wCAAwC;AACxC,eAAO,MAAM,SAAS,QAAS,CAAC;AAEhC;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,SAAS,GAAE,OAAO,CAAC,eAAe,CAAM,GACvC,eAAe,CAUjB;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,QAAQ,CAAC;IACd,SAAS,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,IAAI,YAAY,CAMtC;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAQxE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,EACpC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASjD"}

package/esm/middleware/__tests__/rate-limit-test-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-test-utils.js","sourceRoot":"","sources":["../../../../src/middleware/__tests__/rate-limit-test-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC5B,OAAO,GAAG,MAAM,cAAc,CAAC;AAK/B;;;;;GAKG;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,YAAsC,EAAE;IAExC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,IAAI;QACrB,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE;QACvD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,OAAO;IACrB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAyB,CAAC;IAC/D,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,YAAqC,EAAE;IAC7D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE;QACX,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;QACzC,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAoC,EACpC,MAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAC5E,CAAC;IACF,OAAO,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE;QAChD,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC"}