@adaptic/backend-legacy 0.0.997 → 0.0.999

package/esm/auth/authorization-map.d.ts

@@ -0,0 +1,77 @@
+/**
+ * CORTEX-P0-001 phase 2 — `@Authorized()` coverage for generated CRUD resolvers
+ * (audit B01-backend-legacy-03).
+ *
+ * The `cortexAuthChecker` registered in `buildSchema` is only invoked by
+ * TypeGraphQL for fields carrying an `@Authorized()` decorator; the
+ * auto-generated typegraphql-prisma resolvers carry none, so the checker was
+ * registered-but-inert. This module applies decorators via
+ * `applyResolversEnhanceMap`, making the checker actually execute:
+ *
+ *   - FULL coverage (`_all`) for the five investor-relations models —
+ *     regulated PII (tax documents, KYC status, LP capital ledger) that must
+ *     never sit on an unauthenticated CRUD surface.
+ *   - DELETE mutations (`deleteOne*` / `deleteMany*`) for every other model —
+ *     the most destructive operations on the trading system-of-record.
+ *
+ * CRITICAL SAFETY CONTRACT — the checker itself remains SHADOW-FIRST: while
+ * `CORTEX_AUTHCHECKER_ENFORCE` is OFF (default) a would-deny operation is
+ * logged + counted and then ALLOWED, so engine service traffic cannot break.
+ * This module only determines WHERE the checker runs, not what it does.
+ * Graduation rule (audit B01-backend-legacy-07): enforce only after
+ * `cortex_authchecker_evaluations_total` > 0 and the would-deny series has
+ * been observed over a full trading week.
+ *
+ * Must be applied BEFORE `buildSchema` — decorators land in TypeGraphQL's
+ * global metadata storage, which `buildSchema` reads.
+ */
+import { type ResolversEnhanceMap } from '../generated/typegraphql-prisma';
+/** Model names accepted by the generated {@link ResolversEnhanceMap}. */
+type EnhanceModelName = keyof ResolversEnhanceMap;
+/**
+ * The five investor-relations models receiving FULL (`_all`) coverage:
+ * every generated query and mutation on these models invokes the authChecker.
+ */
+export declare const IR_MODELS: readonly EnhanceModelName[];
+/** Summary of the coverage applied, for the boot log and tests. */
+export interface AuthorizationMapSummary {
+    /** Models decorated with `_all` (full CRUD coverage). */
+    readonly fullCoverageModels: number;
+    /** Models whose delete mutations were decorated. */
+    readonly deleteCoverageModels: number;
+    /** Total decorated resolver actions (delete actions + `_all` markers). */
+    readonly decoratedActions: number;
+    /**
+     * Delete-action names skipped because the generated CRUD resolver does not
+     * expose them — non-empty output means the naming convention drifted and the
+     * map must be updated. Never silently ignored: logged at warn on apply.
+     */
+    readonly skippedActions: readonly string[];
+}
+/** Internal build output: the map plus its audit summary. */
+interface BuiltAuthorizationMap {
+    readonly map: ResolversEnhanceMap;
+    readonly summary: AuthorizationMapSummary;
+}
+/**
+ * Builds the CORTEX authorization enhance-map. Pure (no metadata mutation) so
+ * tests can pin its contents without touching TypeGraphQL global state.
+ *
+ * @returns The enhance map and a summary of the coverage it encodes.
+ */
+export declare function buildCortexAuthorizationMap(): BuiltAuthorizationMap;
+/**
+ * Applies the CORTEX authorization map to the generated resolvers. Idempotent:
+ * decorators land in TypeGraphQL's global metadata storage, so applying twice
+ * would duplicate `Authorized` metadata — subsequent calls return the cached
+ * summary without re-applying.
+ *
+ * Call BEFORE `buildSchema`. The registered `cortexAuthChecker` stays
+ * SHADOW-FIRST (log + count + allow) until `CORTEX_AUTHCHECKER_ENFORCE` is
+ * explicitly flipped on.
+ *
+ * @returns The {@link AuthorizationMapSummary} for the boot log.
+ */
+export declare function applyCortexAuthorizationMap(): AuthorizationMapSummary;
+export {};
+//# sourceMappingURL=authorization-map.d.ts.map

package/esm/auth/authorization-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-map.d.ts","sourceRoot":"","sources":["../../../src/auth/authorization-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AAIzC,yEAAyE;AACzE,KAAK,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,gBAAgB,EAMhD,CAAC;AAEF,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,oDAAoD;IACpD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAmBD,6DAA6D;AAC7D,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,qBAAqB,CA8CnE;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,IAAI,uBAAuB,CAcrE"}

package/esm/auth/authorization-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-map.js","sourceRoot":"","sources":["../../../src/auth/authorization-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EACL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,cAAc,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAKzC;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAgC;IACpD,UAAU;IACV,SAAS;IACT,qBAAqB;IACrB,kBAAkB;IAClB,aAAa;CACd,CAAC;AAkBF;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,KAAa;IAEb,MAAM,aAAa,GAAI,cAA0C,CAC/D,GAAG,KAAK,cAAc,CACvB,CAAC;IACF,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAC,SAAoC,CAAC;AAC5D,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;QACtC,gBAAgB,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,SAAS,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,uEAAuE;QACvE,6DAA6D;QAC7D,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAsC,EAAE,CAAC;QAC5D,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,aAAa,KAAK,EAAE,CAAC,EAAE,CAAC;YACjE,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;gBACzD,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBACvC,eAAe,IAAI,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,KAAyB,CAAC;gBAC5B,aAAsD,CAAC;YACzD,gBAAgB,IAAI,eAAe,CAAC;YACpC,oBAAoB,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,OAAO,EAAE;YACP,kBAAkB,EAAE,SAAS,CAAC,MAAM;YACpC,oBAAoB;YACpB,gBAAgB;YAChB,cAAc;SACf;KACF,CAAC;AACJ,CAAC;AAED,IAAI,cAAmD,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,2BAA2B,EAAE,CAAC;IACvD,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CACT,yGAAyG,EACzG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAC3C,CAAC;IACJ,CAAC;IACD,cAAc,GAAG,OAAO,CAAC;IACzB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/esm/auth/authorization-map.mjs

@@ -0,0 +1,132 @@
+/**
+ * CORTEX-P0-001 phase 2 — `@Authorized()` coverage for generated CRUD resolvers
+ * (audit B01-backend-legacy-03).
+ *
+ * The `cortexAuthChecker` registered in `buildSchema` is only invoked by
+ * TypeGraphQL for fields carrying an `@Authorized()` decorator; the
+ * auto-generated typegraphql-prisma resolvers carry none, so the checker was
+ * registered-but-inert. This module applies decorators via
+ * `applyResolversEnhanceMap`, making the checker actually execute:
+ *
+ *   - FULL coverage (`_all`) for the five investor-relations models —
+ *     regulated PII (tax documents, KYC status, LP capital ledger) that must
+ *     never sit on an unauthenticated CRUD surface.
+ *   - DELETE mutations (`deleteOne*` / `deleteMany*`) for every other model —
+ *     the most destructive operations on the trading system-of-record.
+ *
+ * CRITICAL SAFETY CONTRACT — the checker itself remains SHADOW-FIRST: while
+ * `CORTEX_AUTHCHECKER_ENFORCE` is OFF (default) a would-deny operation is
+ * logged + counted and then ALLOWED, so engine service traffic cannot break.
+ * This module only determines WHERE the checker runs, not what it does.
+ * Graduation rule (audit B01-backend-legacy-07): enforce only after
+ * `cortex_authchecker_evaluations_total` > 0 and the would-deny series has
+ * been observed over a full trading week.
+ *
+ * Must be applied BEFORE `buildSchema` — decorators land in TypeGraphQL's
+ * global metadata storage, which `buildSchema` reads.
+ */
+import { Authorized } from 'type-graphql';
+import { Prisma } from '@prisma/client';
+import { applyResolversEnhanceMap, } from '../generated/typegraphql-prisma/index.mjs';
+import * as generatedIndex from '../generated/typegraphql-prisma/index.mjs';
+import { logger } from '../utils/logger.mjs';
+/**
+ * The five investor-relations models receiving FULL (`_all`) coverage:
+ * every generated query and mutation on these models invokes the authChecker.
+ */
+export const IR_MODELS = [
+    'Investor',
+    'Holding',
+    'InvestorTransaction',
+    'InvestorDocument',
+    'TaxDocument',
+];
+/**
+ * Looks up the generated `<Model>CrudResolver` class for a model, so delete
+ * action names can be validated against the real resolver surface instead of
+ * being assumed by convention.
+ */
+function crudResolverPrototype(model) {
+    const resolverClass = generatedIndex[`${model}CrudResolver`];
+    if (typeof resolverClass !== 'function') {
+        return undefined;
+    }
+    return resolverClass.prototype;
+}
+/**
+ * Builds the CORTEX authorization enhance-map. Pure (no metadata mutation) so
+ * tests can pin its contents without touching TypeGraphQL global state.
+ *
+ * @returns The enhance map and a summary of the coverage it encodes.
+ */
+export function buildCortexAuthorizationMap() {
+    const map = {};
+    const skippedActions = [];
+    let decoratedActions = 0;
+    let deleteCoverageModels = 0;
+    for (const model of IR_MODELS) {
+        map[model] = { _all: [Authorized()] };
+        decoratedActions += 1;
+    }
+    const irModelSet = new Set(IR_MODELS);
+    for (const model of Object.values(Prisma.ModelName)) {
+        // IR models already have full coverage; decorating deletes again would
+        // register duplicate Authorized metadata on the same fields.
+        if (irModelSet.has(model)) {
+            continue;
+        }
+        const prototype = crudResolverPrototype(model);
+        const actionsConfig = {};
+        let coveredForModel = 0;
+        for (const action of [`deleteOne${model}`, `deleteMany${model}`]) {
+            if (prototype && typeof prototype[action] === 'function') {
+                actionsConfig[action] = [Authorized()];
+                coveredForModel += 1;
+            }
+            else {
+                skippedActions.push(action);
+            }
+        }
+        if (coveredForModel > 0) {
+            map[model] =
+                actionsConfig;
+            decoratedActions += coveredForModel;
+            deleteCoverageModels += 1;
+        }
+    }
+    return {
+        map,
+        summary: {
+            fullCoverageModels: IR_MODELS.length,
+            deleteCoverageModels,
+            decoratedActions,
+            skippedActions,
+        },
+    };
+}
+let appliedSummary;
+/**
+ * Applies the CORTEX authorization map to the generated resolvers. Idempotent:
+ * decorators land in TypeGraphQL's global metadata storage, so applying twice
+ * would duplicate `Authorized` metadata — subsequent calls return the cached
+ * summary without re-applying.
+ *
+ * Call BEFORE `buildSchema`. The registered `cortexAuthChecker` stays
+ * SHADOW-FIRST (log + count + allow) until `CORTEX_AUTHCHECKER_ENFORCE` is
+ * explicitly flipped on.
+ *
+ * @returns The {@link AuthorizationMapSummary} for the boot log.
+ */
+export function applyCortexAuthorizationMap() {
+    if (appliedSummary) {
+        return appliedSummary;
+    }
+    const { map, summary } = buildCortexAuthorizationMap();
+    applyResolversEnhanceMap(map);
+    if (summary.skippedActions.length > 0) {
+        logger.warn('[cortex-authz] delete actions missing from generated resolvers — authorization map drifted from codegen', { skippedActions: summary.skippedActions });
+    }
+    appliedSummary = summary;
+    return summary;
+}
+//# sourceMappingURL=authorization-map.js.map

package/esm/auth/cortex-auth-checker.d.ts

@@ -57,6 +57,16 @@ export declare function isAuthCheckerEnforced(env?: Record<string, string | unde
  * label on {@link cortexAuthCheckerWouldDenyTotal}.
  */
 export type WouldDenyReason = 'unauthenticated' | 'insufficient_role';
+/**
+ * Counts EVERY AuthChecker invocation, regardless of outcome (audit
+ * B01-backend-legacy-07). A flat-zero {@link cortexAuthCheckerWouldDenyTotal}
+ * is ambiguous on its own: it can mean "no traffic would be denied" OR "the
+ * checker never ran" (no `@Authorized()` field was ever executed) — exactly the
+ * false-confidence pattern that preceded the beta-net-cap fail-open. Graduation
+ * rule: enforce only when this counter is > 0 and the would-deny series has
+ * been observed over a full trading week.
+ */
+export declare const cortexAuthCheckerEvaluationsTotal: Counter<string>;
 /**
  * Counts operations that resolver-level authorization WOULD deny. In shadow mode
  * this is the primary signal proving whether flipping `CORTEX_AUTHCHECKER_ENFORCE`

package/esm/auth/cortex-auth-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cortex-auth-checker.d.ts","sourceRoot":"","sources":["../../../src/auth/cortex-auth-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAK3E;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAGT;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mBAK1C,CAAC;AAEH,uEAAuE;AACvE,UAAU,cAAc;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,GAAG,IAAI,EAClC,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,cAAc,CAyBhB;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAcD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,CA8B5D,CAAC"}
+{"version":3,"file":"cortex-auth-checker.d.ts","sourceRoot":"","sources":["../../../src/auth/cortex-auth-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAK3E;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAGT;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,iBAI5C,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mBAK1C,CAAC;AAEH,uEAAuE;AACvE,UAAU,cAAc;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,GAAG,IAAI,EAClC,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,cAAc,CAyBhB;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAcD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,CAkC5D,CAAC"}

package/esm/auth/cortex-auth-checker.js.map

@@ -1 +1 @@
-{"version":3,"file":"cortex-auth-checker.js","sourceRoot":"","sources":["../../../src/auth/cortex-auth-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE3E,kFAAkF;AAClF,MAAM,UAAU,GAAG,OAAO,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,OAAO,CAAC;IACzD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wGAAwG;IAC9G,UAAU,EAAE,CAAC,QAAQ,CAAU;IAC/B,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AASH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAkC,EAClC,aAAgC;IAEhC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,8EAA8E;IAC9E,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,cAAc,GAClB,SAAS,CAAC,IAAI,KAAK,OAAO;QACxB,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,OAAO,eAAe;QACpB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;QACtB,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACzD,CAAC;AAeD,4EAA4E;AAC5E,SAAS,iBAAiB,CACxB,YAA6C;IAE7C,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IAC9B,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;QACvC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS;QAC3D,KAAK,EAAE,IAAI,CAAC,SAAS;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmC,CAC/D,YAAY,EACZ,KAAK,EACI,EAAE;IACX,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAExD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,iBAAiB,CAAC;IACtD,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAElD,+BAA+B,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CACT,QAAQ;QACN,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,mDAAmD,EACvD;QACE,GAAG,SAAS;QACZ,MAAM;QACN,QAAQ;QACR,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,MAAM;QACxC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC;KAC1B,CACF,CAAC;IAEF,OAAO,CAAC,QAAQ,CAAC;AACnB,CAAC,CAAC"}
+{"version":3,"file":"cortex-auth-checker.js","sourceRoot":"","sources":["../../../src/auth/cortex-auth-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE3E,kFAAkF;AAClF,MAAM,UAAU,GAAG,OAAO,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,OAAO,CAAC;IAC3D,IAAI,EAAE,sCAAsC;IAC5C,IAAI,EAAE,6HAA6H;IACnI,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,OAAO,CAAC;IACzD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wGAAwG;IAC9G,UAAU,EAAE,CAAC,QAAQ,CAAU;IAC/B,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AASH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAkC,EAClC,aAAgC;IAEhC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,8EAA8E;IAC9E,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,cAAc,GAClB,SAAS,CAAC,IAAI,KAAK,OAAO;QACxB,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,OAAO,eAAe;QACpB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;QACtB,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACzD,CAAC;AAeD,4EAA4E;AAC5E,SAAS,iBAAiB,CACxB,YAA6C;IAE7C,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IAC9B,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;QACvC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS;QAC3D,KAAK,EAAE,IAAI,CAAC,SAAS;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmC,CAC/D,YAAY,EACZ,KAAK,EACI,EAAE;IACX,+DAA+D;IAC/D,0EAA0E;IAC1E,iCAAiC,CAAC,GAAG,EAAE,CAAC;IAExC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAExD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,iBAAiB,CAAC;IACtD,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAElD,+BAA+B,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CACT,QAAQ;QACN,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,mDAAmD,EACvD;QACE,GAAG,SAAS;QACZ,MAAM;QACN,QAAQ;QACR,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,MAAM;QACxC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC;KAC1B,CACF,CAAC;IAEF,OAAO,CAAC,QAAQ,CAAC;AACnB,CAAC,CAAC"}

package/esm/auth/cortex-auth-checker.mjs

@@ -60,6 +60,20 @@ export function isAuthCheckerEnforced(env = process.env) {
     const raw = (env[CORTEX_AUTHCHECKER_ENFORCE_ENV] ?? '').trim().toLowerCase();
     return raw === 'true' || raw === '1';
 }
+/**
+ * Counts EVERY AuthChecker invocation, regardless of outcome (audit
+ * B01-backend-legacy-07). A flat-zero {@link cortexAuthCheckerWouldDenyTotal}
+ * is ambiguous on its own: it can mean "no traffic would be denied" OR "the
+ * checker never ran" (no `@Authorized()` field was ever executed) — exactly the
+ * false-confidence pattern that preceded the beta-net-cap fail-open. Graduation
+ * rule: enforce only when this counter is > 0 and the would-deny series has
+ * been observed over a full trading week.
+ */
+export const cortexAuthCheckerEvaluationsTotal = new Counter({
+    name: 'cortex_authchecker_evaluations_total',
+    help: 'Total AuthChecker invocations, any outcome (zero means no @Authorized field was executed — distinct from "no would-denies")',
+    registers: [metricsRegistry],
+});
 /**
  * Counts operations that resolver-level authorization WOULD deny. In shadow mode
  * this is the primary signal proving whether flipping `CORTEX_AUTHCHECKER_ENFORCE`
@@ -123,6 +137,9 @@ function describeOperation(resolverData) {
  * metric or log emission.
  */
 export const cortexAuthChecker = (resolverData, roles) => {
+    // Unconditional: proves the checker is actually reachable (see
+    // cortexAuthCheckerEvaluationsTotal TSDoc / audit B01-backend-legacy-07).
+    cortexAuthCheckerEvaluationsTotal.inc();
     const principal = resolverData.context.principal ?? null;
     const evaluation = evaluateWouldAllow(principal, roles);
     if (evaluation.wouldAllow) {

package/esm/middleware/__tests__/rate-limit-test-utils.d.ts

@@ -0,0 +1,60 @@
+import { vi } from 'vitest';
+import type { Counter } from 'prom-client';
+import type { Request, Response } from 'express';
+import type { RateLimitConfig } from '../rate-limiter';
+/**
+ * Shared fixtures for the rate-limiter test files (audit
+ * B01-backend-legacy-08). Pure helpers only — each test file remains
+ * responsible for setting `process.env.JWT_SECRET` via `vi.hoisted` BEFORE its
+ * first import pulls in `config/jwtConfig` (which reads the env at load time).
+ */
+/** Window used by every test config. */
+export declare const WINDOW_MS = 60000;
+/**
+ * Builds a small test limiter config.
+ *
+ * @param overrides - Field overrides applied over the defaults.
+ * @returns A complete {@link RateLimitConfig}.
+ */
+export declare function makeConfig(overrides?: Partial<RateLimitConfig>): RateLimitConfig;
+/** A mock Express response with observable spies. */
+export interface MockResponse {
+    res: Response;
+    setHeader: ReturnType<typeof vi.fn>;
+    status: ReturnType<typeof vi.fn>;
+    json: ReturnType<typeof vi.fn>;
+}
+/**
+ * Creates a mock response whose header/status/json calls are observable —
+ * the shadow contract is proven by these spies staying untouched.
+ *
+ * @returns The {@link MockResponse}.
+ */
+export declare function makeRes(): MockResponse;
+/**
+ * Creates a mock request. Defaults to an anonymous POST from a fixed IP.
+ *
+ * @param overrides - Request field overrides (headers, ip, method, …).
+ * @returns A Request usable by the limiter middleware.
+ */
+export declare function makeReq(overrides?: Record<string, unknown>): Request;
+/**
+ * Reads the current value of a limiter counter for a label pair.
+ *
+ * @param counter - The prom-client counter to read.
+ * @param labels - The limiter/tier label pair identifying the series.
+ * @returns The current value (0 when the series does not exist yet).
+ */
+export declare function counterValue(counter: Counter<'limiter' | 'tier'>, labels: {
+    limiter: string;
+    tier: string;
+}): Promise<number>;
+/**
+ * Signs a real HS256 user JWT with the ambient `JWT_SECRET` (the same secret
+ * `config/jwtConfig` resolved at load), so the tier resolver verifies it.
+ *
+ * @param sub - Subject claim for the token.
+ * @returns A signed JWT string.
+ */
+export declare function signUserToken(sub: string): string;
+//# sourceMappingURL=rate-limit-test-utils.d.ts.map

package/esm/middleware/__tests__/rate-limit-test-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-test-utils.d.ts","sourceRoot":"","sources":["../../../../src/middleware/__tests__/rate-limit-test-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;;;GAKG;AAEH,wCAAwC;AACxC,eAAO,MAAM,SAAS,QAAS,CAAC;AAEhC;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,SAAS,GAAE,OAAO,CAAC,eAAe,CAAM,GACvC,eAAe,CAUjB;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,QAAQ,CAAC;IACd,SAAS,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,IAAI,YAAY,CAMtC;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAQxE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,EACpC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASjD"}

package/esm/middleware/__tests__/rate-limit-test-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-test-utils.js","sourceRoot":"","sources":["../../../../src/middleware/__tests__/rate-limit-test-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC5B,OAAO,GAAG,MAAM,cAAc,CAAC;AAK/B;;;;;GAKG;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,YAAsC,EAAE;IAExC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,IAAI;QACrB,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE;QACvD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,OAAO;IACrB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAyB,CAAC;IAC/D,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,YAAqC,EAAE;IAC7D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE;QACX,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;QACzC,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAoC,EACpC,MAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAC5E,CAAC;IACF,OAAO,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE;QAChD,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC"}

package/esm/middleware/__tests__/rate-limit-test-utils.mjs

@@ -0,0 +1,85 @@
+import { vi } from 'vitest';
+import jwt from 'jsonwebtoken';
+/**
+ * Shared fixtures for the rate-limiter test files (audit
+ * B01-backend-legacy-08). Pure helpers only — each test file remains
+ * responsible for setting `process.env.JWT_SECRET` via `vi.hoisted` BEFORE its
+ * first import pulls in `config/jwtConfig` (which reads the env at load time).
+ */
+/** Window used by every test config. */
+export const WINDOW_MS = 60_000;
+/**
+ * Builds a small test limiter config.
+ *
+ * @param overrides - Field overrides applied over the defaults.
+ * @returns A complete {@link RateLimitConfig}.
+ */
+export function makeConfig(overrides = {}) {
+    return {
+        name: 'graphql',
+        windowMs: WINDOW_MS,
+        maxAuthenticated: 100,
+        maxUnauthenticated: 2,
+        standardHeaders: true,
+        message: { errors: [{ message: 'Too many requests' }] },
+        ...overrides,
+    };
+}
+/**
+ * Creates a mock response whose header/status/json calls are observable —
+ * the shadow contract is proven by these spies staying untouched.
+ *
+ * @returns The {@link MockResponse}.
+ */
+export function makeRes() {
+    const setHeader = vi.fn();
+    const json = vi.fn();
+    const status = vi.fn(() => ({ json }));
+    const res = { setHeader, status, json };
+    return { res, setHeader, status, json };
+}
+/**
+ * Creates a mock request. Defaults to an anonymous POST from a fixed IP.
+ *
+ * @param overrides - Request field overrides (headers, ip, method, …).
+ * @returns A Request usable by the limiter middleware.
+ */
+export function makeReq(overrides = {}) {
+    return {
+        method: 'POST',
+        headers: {},
+        ip: '203.0.113.10',
+        socket: { remoteAddress: '203.0.113.10' },
+        ...overrides,
+    };
+}
+/**
+ * Reads the current value of a limiter counter for a label pair.
+ *
+ * @param counter - The prom-client counter to read.
+ * @param labels - The limiter/tier label pair identifying the series.
+ * @returns The current value (0 when the series does not exist yet).
+ */
+export async function counterValue(counter, labels) {
+    const metric = await counter.get();
+    const sample = metric.values.find((v) => v.labels.limiter === labels.limiter && v.labels.tier === labels.tier);
+    return sample?.value ?? 0;
+}
+/**
+ * Signs a real HS256 user JWT with the ambient `JWT_SECRET` (the same secret
+ * `config/jwtConfig` resolved at load), so the tier resolver verifies it.
+ *
+ * @param sub - Subject claim for the token.
+ * @returns A signed JWT string.
+ */
+export function signUserToken(sub) {
+    const secret = process.env.JWT_SECRET;
+    if (!secret) {
+        throw new Error('JWT_SECRET must be set by the test file before signing');
+    }
+    return jwt.sign({ sub, roles: ['user'] }, secret, {
+        algorithm: 'HS256',
+        expiresIn: '1h',
+    });
+}
+//# sourceMappingURL=rate-limit-test-utils.js.map

package/esm/middleware/rate-limiter.d.ts

@@ -1,5 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
-import { Counter } from 'prom-client';
+import { Counter, Gauge } from 'prom-client';
 /**
  * Environment variable gating 429 enforcement. When set to `true`/`1`, the
  * limiters block over-limit requests with HTTP 429. Unset or any other value
@@ -16,24 +16,78 @@ export declare const CORTEX_RATE_LIMIT_ENFORCE_ENV = "CORTEX_RATE_LIMIT_ENFORCE"
  */
 export declare function isRateLimitEnforced(env?: Record<string, string | undefined>): boolean;
 /**
- * Counts requests that rate limiting WOULD block (HTTP 429). In shadow mode this
- * is the signal proving whether flipping `CORTEX_RATE_LIMIT_ENFORCE` to enforce
- * would reject legitimate traffic. Labelled by the `limiter` name
- * (`graphql`/`auth`) and the request `tier` (`auth`/`anon`).
+ * Counts requests that rate limiting WOULD block (HTTP 429) while in SHADOW
+ * mode. This is the signal proving whether flipping
+ * `CORTEX_RATE_LIMIT_ENFORCE` to enforce would reject legitimate traffic.
+ * Labelled by the `limiter` name (`graphql`/`auth`) and the request `tier`
+ * (`auth`/`anon`). Real enforce-mode denials count on
+ * {@link cortexRateLimitBlockedTotal} instead, keeping the observed-only and
+ * actually-blocked series distinct (audit B01-backend-legacy-14).
  */
 export declare const cortexRateLimitWouldBlockTotal: Counter<"limiter" | "tier">;
+/**
+ * Counts requests actually blocked with HTTP 429 in ENFORCE mode. Kept as a
+ * separate series from {@link cortexRateLimitWouldBlockTotal} so shadow
+ * observations and real blocks never mix (audit B01-backend-legacy-14).
+ */
+export declare const cortexRateLimitBlockedTotal: Counter<"limiter" | "tier">;
+/**
+ * Tracked bucket-key cardinality per limiter store. Bounds memory ahead of the
+ * trust-proxy fix, after which the identifier derives from X-Forwarded-For and
+ * an attacker rotating spoofed values could otherwise mint unbounded entries
+ * (audit B01-backend-legacy-12).
+ */
+export declare const cortexRateLimitStoreKeys: Gauge<"limiter">;
+/** Configuration for one rate limiter instance. */
+export interface RateLimitConfig {
+    /** Stable limiter identifier used as the `limiter` metric label. */
+    name: string;
+    windowMs: number;
+    maxAuthenticated: number;
+    maxUnauthenticated: number;
+    message: {
+        errors: Array<{
+            message: string;
+        }>;
+    };
+    standardHeaders?: boolean;
+    legacyHeaders?: boolean;
+    /** Cap on distinct bucket keys (defaults to {@link DEFAULT_MAX_TRACKED_KEYS}). */
+    maxTrackedKeys?: number;
+}
+/**
+ * Creates an in-memory rate limiter middleware with separate limits for
+ * verified (auth) and anonymous requests.
+ *
+ * Bucketing: verified callers are keyed per principal (`sub:<sub>`); anonymous
+ * callers are keyed by client IP, which resolves correctly behind the LB only
+ * with `trust proxy` configured in server.ts (audit B01-backend-legacy-02).
+ * The `auth` tier requires actual offline verification — a fabricated
+ * JWT-shaped header no longer earns the higher budget (B01-backend-legacy-09).
+ * CORS preflights (`OPTIONS`) are never counted (B01-backend-legacy-11).
+ *
+ * Response headers (enforce mode only, when standardHeaders is enabled):
+ *   X-RateLimit-Limit     - maximum requests allowed in the current window
+ *   X-RateLimit-Remaining - requests remaining in the current window
+ *   X-RateLimit-Reset     - seconds until the current window resets
+ *   Retry-After           - seconds to wait before retrying (only on 429)
+ *
+ * @param config - Rate limit configuration.
+ * @returns Express middleware function.
+ */
+export declare function createRateLimiter(config: RateLimitConfig): (req: Request, res: Response, next: NextFunction) => void;
 /**
  * Rate limiter for GraphQL endpoint.
  *
- * Authenticated requests:   1000 requests per 15 minutes (configurable via RATE_LIMIT_MAX)
- * Unauthenticated requests: 200 requests per 15 minutes (configurable via RATE_LIMIT_MAX_UNAUTH)
+ * Verified requests:  1000 requests per 15 minutes (configurable via RATE_LIMIT_MAX)
+ * Anonymous requests: 200 requests per 15 minutes (configurable via RATE_LIMIT_MAX_UNAUTH)
  */
 export declare const graphqlRateLimiter: (req: Request, res: Response, next: NextFunction) => void;
 /**
  * Rate limiter for authentication endpoints.
  *
- * Authenticated requests:   50 requests per 15 minutes
- * Unauthenticated requests: 20 requests per 15 minutes
+ * Verified requests:  50 requests per 15 minutes
+ * Anonymous requests: 20 requests per 15 minutes
  */
 export declare const authRateLimiter: (req: Request, res: Response, next: NextFunction) => void;
 //# sourceMappingURL=rate-limiter.d.ts.map

package/esm/middleware/rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/rate-limiter.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAGT;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,6BAKzC,CAAC;AAkIH;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QArEhB,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,IA+E1D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QAvFb,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,IA+F1D,CAAC"}
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/rate-limiter.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAK7C;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAGT;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,6BAKzC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,6BAKtC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,kBAKnC,CAAC;AAeH,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAChD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,GACtB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAgG3D;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAxGtB,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAK,IAkHtD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QA1HnB,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAK,IAkItD,CAAC"}

package/esm/middleware/rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/middleware/rate-limiter.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,iEAAiE;AACjE,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAG3E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,OAAO,CAAC;IACxD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,yGAAyG;IAC/G,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,CAAU;IACxC,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAsBH;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,mEAAmE;IACnE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,MAAuB;IAChD,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,wCAAwC;IACxC,WAAW,CAAC,GAAG,EAAE;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,IAAI,SAAS,CAAC;QACvE,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,MAAM,YAAY,GAAG,aAAa;YAChC,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACxD,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;aACjC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC;QAE/C,6EAA6E;QAC7E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC3B,IAAI,SAAS,EAAE,CAAC;gBACd,8BAA8B,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;oBAC/D,OAAO,EAAE,MAAM,CAAC,IAAI;oBACpB,UAAU;oBACV,IAAI;oBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,KAAK,EAAE,YAAY;oBACnB,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,qCAAqC;QACrC,IAAI,MAAM,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,oEAAoE;YACpE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtD,8BAA8B,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;IAClD,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,EAAE,EAAE,CAAC;IACpE,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,KAAK,EAAE,EAAE,CAAC;IAC5E,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;KACpE;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;IAC/C,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,EAAE;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,EAAE;CACxE,CAAC,CAAC"}
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/middleware/rate-limiter.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,sFAAsF;AACtF,uFAAuF;AACvF,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAG3E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,OAAO,CAAC;IACxD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,yIAAyI;IAC/I,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,CAAU;IACxC,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,OAAO,CAAC;IACrD,IAAI,EAAE,iCAAiC;IACvC,IAAI,EAAE,kFAAkF;IACxF,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,CAAU;IACxC,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,KAAK,CAAC;IAChD,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,0DAA0D;IAChE,UAAU,EAAE,CAAC,SAAS,CAAU;IAChC,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEzC,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAqBvC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAuB;IAEvB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAEzE,wEAAwE;IACxE,8DAA8D;IAC9D,iCAAiC;IACjC,WAAW,CAAC,GAAG,EAAE;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,EAAE,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC;IAEpC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,wEAAwE;QACxE,iCAAiC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,UAAU,GACd,YAAY,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAClE,MAAM,YAAY,GAChB,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACxE,IAAI,QAAQ,GAAG,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,sEAAsE;QACtE,oDAAoD;QACpD,iCAAiC;QACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACzD,QAAQ,GAAG,GAAG,mBAAmB,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YAC1C,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;YACpB,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC;QAE/C,6EAA6E;QAC7E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC3B,IAAI,SAAS,EAAE,CAAC;gBACd,8BAA8B,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,mEAAmE;gBACnE,sEAAsE;gBACtE,wEAAwE;gBACxE,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,GAAG,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;wBAC/D,OAAO,EAAE,MAAM,CAAC,IAAI;wBACpB,UAAU;wBACV,IAAI;wBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,KAAK,EAAE,YAAY;wBACnB,YAAY;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,qCAAqC;QACrC,IAAI,MAAM,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,oEAAoE;YACpE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtD,2BAA2B,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;IAClD,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,EAAE,EAAE,CAAC;IACpE,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,KAAK,EAAE,EAAE,CAAC;IAC5E,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;KACpE;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;IAC/C,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,EAAE;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,EAAE;CACxE,CAAC,CAAC"}

package/esm/middleware/rate-limiter.mjs

@@ -1,12 +1,13 @@
 // CORTEX-P0-001: mounted in server.ts as
-//   app.use('/graphql', graphqlRateLimiter)   // GraphQL surface
-//   app.use('/api', authRateLimiter)          // authenticated Express surface
+//   app.use('/graphql', cors, graphqlRateLimiter, …)  // GraphQL surface (after CORS)
+//   app.use('/api', authRateLimiter)                  // authenticated Express surface
 // SHADOW-FIRST: 429 enforcement is gated behind CORTEX_RATE_LIMIT_ENFORCE.
 // While OFF (default), the limiters observe + count requests that WOULD be
 // blocked but never touch the response — live behaviour is byte-identical.
-import { Counter } from 'prom-client';
+import { Counter, Gauge } from 'prom-client';
 import { metricsRegistry } from '../config/metrics.mjs';
 import { logger } from '../utils/logger.mjs';
+import { resolveRateTier } from './rate-tier.mjs';
 /**
  * Environment variable gating 429 enforcement. When set to `true`/`1`, the
  * limiters block over-limit requests with HTTP 429. Unset or any other value
@@ -26,78 +27,116 @@ export function isRateLimitEnforced(env = process.env) {
     return raw === 'true' || raw === '1';
 }
 /**
- * Counts requests that rate limiting WOULD block (HTTP 429). In shadow mode this
- * is the signal proving whether flipping `CORTEX_RATE_LIMIT_ENFORCE` to enforce
- * would reject legitimate traffic. Labelled by the `limiter` name
- * (`graphql`/`auth`) and the request `tier` (`auth`/`anon`).
+ * Counts requests that rate limiting WOULD block (HTTP 429) while in SHADOW
+ * mode. This is the signal proving whether flipping
+ * `CORTEX_RATE_LIMIT_ENFORCE` to enforce would reject legitimate traffic.
+ * Labelled by the `limiter` name (`graphql`/`auth`) and the request `tier`
+ * (`auth`/`anon`). Real enforce-mode denials count on
+ * {@link cortexRateLimitBlockedTotal} instead, keeping the observed-only and
+ * actually-blocked series distinct (audit B01-backend-legacy-14).
  */
 export const cortexRateLimitWouldBlockTotal = new Counter({
     name: 'cortex_rate_limit_would_block_total',
-    help: 'Requests rate limiting would block (429), by limiter and tier (counted in shadow mode without blocking)',
+    help: 'Requests rate limiting would block (429), by limiter and tier (shadow mode only; real denials count on cortex_rate_limit_blocked_total)',
     labelNames: ['limiter', 'tier'],
     registers: [metricsRegistry],
 });
 /**
- * Checks whether a request carries a valid-looking authentication token.
- * Does not verify the token -- only checks for its presence in the
- * Authorization header as a Bearer token with three dot-separated parts
- * (standard JWT structure).
+ * Counts requests actually blocked with HTTP 429 in ENFORCE mode. Kept as a
+ * separate series from {@link cortexRateLimitWouldBlockTotal} so shadow
+ * observations and real blocks never mix (audit B01-backend-legacy-14).
  */
-function isAuthenticated(req) {
-    const authHeader = req.headers.authorization || '';
-    if (!authHeader.startsWith('Bearer ')) {
-        return false;
-    }
-    const token = authHeader.slice(7);
-    // Only count 3-segment JWT-shaped tokens as "authenticated" for rate-limit
-    // tiering. Opaque OAuth access tokens (e.g. `ya29.…`) are rejected by the
-    // verifier downstream — treating them as authenticated here would let a
-    // caller spamming opaque tokens enjoy the higher auth-tier limits.
-    return token.split('.').length === 3;
-}
+export const cortexRateLimitBlockedTotal = new Counter({
+    name: 'cortex_rate_limit_blocked_total',
+    help: 'Requests actually blocked with HTTP 429, by limiter and tier (enforce mode only)',
+    labelNames: ['limiter', 'tier'],
+    registers: [metricsRegistry],
+});
+/**
+ * Tracked bucket-key cardinality per limiter store. Bounds memory ahead of the
+ * trust-proxy fix, after which the identifier derives from X-Forwarded-For and
+ * an attacker rotating spoofed values could otherwise mint unbounded entries
+ * (audit B01-backend-legacy-12).
+ */
+export const cortexRateLimitStoreKeys = new Gauge({
+    name: 'cortex_rate_limit_store_keys',
+    help: 'Current tracked bucket-key cardinality per limiter store',
+    labelNames: ['limiter'],
+    registers: [metricsRegistry],
+});
+/** Sweep cadence for expired bucket entries. */
+const STORE_SWEEP_INTERVAL_MS = 60_000;
 /**
- * Creates a simple in-memory rate limiter middleware with separate limits
- * for authenticated and unauthenticated requests.
+ * Default cap on distinct bucket keys per limiter store. Past the cap, new
+ * identifiers aggregate into a shared per-tier overflow bucket instead of
+ * allocating — bounding memory under identifier-rotation abuse.
+ */
+const DEFAULT_MAX_TRACKED_KEYS = 100_000;
+/** Bucket-key prefix used once the store cardinality cap is reached. */
+const OVERFLOW_KEY_PREFIX = 'overflow';
+/**
+ * Creates an in-memory rate limiter middleware with separate limits for
+ * verified (auth) and anonymous requests.
  *
- * Response headers (when standardHeaders is enabled):
+ * Bucketing: verified callers are keyed per principal (`sub:<sub>`); anonymous
+ * callers are keyed by client IP, which resolves correctly behind the LB only
+ * with `trust proxy` configured in server.ts (audit B01-backend-legacy-02).
+ * The `auth` tier requires actual offline verification — a fabricated
+ * JWT-shaped header no longer earns the higher budget (B01-backend-legacy-09).
+ * CORS preflights (`OPTIONS`) are never counted (B01-backend-legacy-11).
+ *
+ * Response headers (enforce mode only, when standardHeaders is enabled):
  *   X-RateLimit-Limit     - maximum requests allowed in the current window
  *   X-RateLimit-Remaining - requests remaining in the current window
  *   X-RateLimit-Reset     - seconds until the current window resets
  *   Retry-After           - seconds to wait before retrying (only on 429)
  *
- * @param config - Rate limit configuration
- * @returns Express middleware function
+ * @param config - Rate limit configuration.
+ * @returns Express middleware function.
  */
-function createRateLimiter(config) {
-    const store = {};
-    // Clean up expired entries every minute
+export function createRateLimiter(config) {
+    const store = new Map();
+    const maxTrackedKeys = config.maxTrackedKeys ?? DEFAULT_MAX_TRACKED_KEYS;
+    // Sweep expired entries every minute. `unref()` so an importing process
+    // (tests, one-off scripts) is never kept alive by the sweeper
+    // (audit B01-backend-legacy-12).
     setInterval(() => {
         const now = Date.now();
-        Object.keys(store).forEach((key) => {
-            if (store[key].resetTime < now) {
-                delete store[key];
+        for (const [key, entry] of store) {
+            if (entry.resetTime < now) {
+                store.delete(key);
             }
-        });
-    }, 60000);
+        }
+        cortexRateLimitStoreKeys.set({ limiter: config.name }, store.size);
+    }, STORE_SWEEP_INTERVAL_MS).unref();
     return (req, res, next) => {
-        const identifier = req.ip || req.connection.remoteAddress || 'unknown';
-        const authenticated = isAuthenticated(req);
-        const tier = authenticated ? 'auth' : 'anon';
-        const effectiveMax = authenticated
-            ? config.maxAuthenticated
-            : config.maxUnauthenticated;
-        const storeKey = `${identifier}:${tier}`;
+        // CORS preflights carry no credentials and must not consume rate budget
+        // (audit B01-backend-legacy-11).
+        if (req.method === 'OPTIONS') {
+            next();
+            return;
+        }
+        const { tier, principalKey } = resolveRateTier(req);
+        const identifier = principalKey ?? req.ip ?? req.socket.remoteAddress ?? 'unknown';
+        const effectiveMax = tier === 'auth' ? config.maxAuthenticated : config.maxUnauthenticated;
+        let storeKey = `${identifier}:${tier}`;
         const now = Date.now();
-        if (!store[storeKey] || store[storeKey].resetTime < now) {
-            store[storeKey] = {
-                count: 1,
-                resetTime: now + config.windowMs,
-            };
+        // Cardinality cap: aggregate novel identifiers into a shared per-tier
+        // overflow bucket rather than growing without bound
+        // (audit B01-backend-legacy-12).
+        if (!store.has(storeKey) && store.size >= maxTrackedKeys) {
+            storeKey = `${OVERFLOW_KEY_PREFIX}:${tier}`;
+        }
+        const existing = store.get(storeKey);
+        let current;
+        if (!existing || existing.resetTime < now) {
+            current = { count: 1, resetTime: now + config.windowMs };
+            store.set(storeKey, current);
         }
         else {
-            store[storeKey].count += 1;
+            existing.count += 1;
+            current = existing;
         }
-        const current = store[storeKey];
         const remaining = Math.max(0, effectiveMax - current.count);
         const resetSeconds = Math.ceil((current.resetTime - now) / 1000);
         const overLimit = current.count > effectiveMax;
@@ -107,14 +146,19 @@ function createRateLimiter(config) {
         if (!isRateLimitEnforced()) {
             if (overLimit) {
                 cortexRateLimitWouldBlockTotal.inc({ limiter: config.name, tier });
-                logger.warn('[cortex-rate-limit] shadow would-block (allowing)', {
-                    limiter: config.name,
-                    identifier,
-                    tier,
-                    count: current.count,
-                    limit: effectiveMax,
-                    resetSeconds,
-                });
+                // Log only the FIRST over-limit request per (bucket, window) — the
+                // counter carries per-request cardinality; unthrottled logging floods
+                // Cloud Logging and buries real warnings (audit B01-backend-legacy-10).
+                if (current.count === effectiveMax + 1) {
+                    logger.warn('[cortex-rate-limit] shadow would-block (allowing)', {
+                        limiter: config.name,
+                        identifier,
+                        tier,
+                        count: current.count,
+                        limit: effectiveMax,
+                        resetSeconds,
+                    });
+                }
             }
             next();
             return;
@@ -129,7 +173,7 @@ function createRateLimiter(config) {
         if (overLimit) {
             // Include Retry-After header on 429 responses (RFC 6585 / RFC 7231)
             res.setHeader('Retry-After', resetSeconds.toString());
-            cortexRateLimitWouldBlockTotal.inc({ limiter: config.name, tier });
+            cortexRateLimitBlockedTotal.inc({ limiter: config.name, tier });
             res.status(429).json(config.message);
             return;
         }
@@ -139,8 +183,8 @@ function createRateLimiter(config) {
 /**
  * Rate limiter for GraphQL endpoint.
  *
- * Authenticated requests:   1000 requests per 15 minutes (configurable via RATE_LIMIT_MAX)
- * Unauthenticated requests: 200 requests per 15 minutes (configurable via RATE_LIMIT_MAX_UNAUTH)
+ * Verified requests:  1000 requests per 15 minutes (configurable via RATE_LIMIT_MAX)
+ * Anonymous requests: 200 requests per 15 minutes (configurable via RATE_LIMIT_MAX_UNAUTH)
  */
 export const graphqlRateLimiter = createRateLimiter({
     name: 'graphql',
@@ -156,8 +200,8 @@ export const graphqlRateLimiter = createRateLimiter({
 /**
  * Rate limiter for authentication endpoints.
  *
- * Authenticated requests:   50 requests per 15 minutes
- * Unauthenticated requests: 20 requests per 15 minutes
+ * Verified requests:  50 requests per 15 minutes
+ * Anonymous requests: 20 requests per 15 minutes
  */
 export const authRateLimiter = createRateLimiter({
     name: 'auth',

package/esm/middleware/rate-tier.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Rate-limit tier resolution (audit B01-backend-legacy-09).
+ *
+ * The rate limiter previously granted the 5x-higher authenticated tier to any
+ * request carrying a 3-dot-segment `Bearer` header — a trivially fabricated
+ * shape (`Bearer a.b.c`). This module keys the tier off ACTUAL verification
+ * instead, using the two offline-verifiable credential classes:
+ *
+ *   1. `SERVER_AUTH_TOKEN` exact match (the engine / server-to-server path).
+ *   2. App-issued HS256 JWTs verified against the shared `jwtSecret`.
+ *
+ * Google ID tokens (RS256, JWKS-verified) cannot be verified synchronously
+ * without a network dependency in the request hot path; they are deliberately
+ * tiered as `anon`. This is a metrics-only inaccuracy while the limiter is in
+ * shadow mode — before any enforce graduation, either extend this resolver
+ * with an async JWKS-backed path or raise the anon ceiling to cover browser
+ * traffic (tracked in the B01-02 graduation checklist).
+ *
+ * Verified results are memoised in a bounded, TTL'd cache keyed by the token's
+ * SHA-256 (raw tokens are never retained) so the per-request cost is one hash.
+ */
+import type { Request } from 'express';
+/** Rate-limit tier: `auth` = verified caller budget, `anon` = default budget. */
+export type RateTier = 'auth' | 'anon';
+/**
+ * Outcome of tier resolution for one request.
+ */
+export interface RateTierResolution {
+    /** The tier the request's rate budget is drawn from. */
+    readonly tier: RateTier;
+    /**
+     * Stable per-principal bucket key (`sub:<sub>`) for verified callers, so
+     * authenticated traffic is bucketed per principal rather than per IP
+     * (audit B01-backend-legacy-02). `null` for anonymous callers — the limiter
+     * falls back to the client IP.
+     */
+    readonly principalKey: string | null;
+}
+/**
+ * Clears the memoised token-verdict cache. Test-only.
+ *
+ * @internal exported for testing
+ */
+export declare function _resetRateTierCacheForTests(): void;
+/**
+ * Resolves the rate-limit tier and principal bucket key for a request.
+ *
+ * Cheap on the hot path: one SHA-256 over the token plus a bounded map lookup;
+ * the HMAC verification runs at most once per token per TTL window.
+ *
+ * @param req - Incoming Express request.
+ * @returns The request's {@link RateTierResolution}; `anon` when no `Bearer`
+ *   token is present or the token cannot be verified offline.
+ */
+export declare function resolveRateTier(req: Request): RateTierResolution;
+//# sourceMappingURL=rate-tier.d.ts.map

package/esm/middleware/rate-tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-tier.d.ts","sourceRoot":"","sources":["../../../src/middleware/rate-tier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC,iFAAiF;AACjF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAiBD;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CA6BhE"}

package/esm/middleware/rate-tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-tier.js","sourceRoot":"","sources":["../../../src/middleware/rate-tier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAoBhD,sEAAsE;AACtE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,eAAe,GAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAOjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACtD,IACE,OAAO,eAAe,KAAK,QAAQ;QACnC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC1B,KAAK,KAAK,eAAe,EACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,yEAAyE;QACzE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,wEAAwE;QACxE,kDAAkD;QAClD,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,SAAS,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC7C,0DAA0D;QAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,iBAAiB,EAAE,CAAC,CAAC;IAE5E,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/esm/middleware/rate-tier.mjs

@@ -0,0 +1,103 @@
+/**
+ * Rate-limit tier resolution (audit B01-backend-legacy-09).
+ *
+ * The rate limiter previously granted the 5x-higher authenticated tier to any
+ * request carrying a 3-dot-segment `Bearer` header — a trivially fabricated
+ * shape (`Bearer a.b.c`). This module keys the tier off ACTUAL verification
+ * instead, using the two offline-verifiable credential classes:
+ *
+ *   1. `SERVER_AUTH_TOKEN` exact match (the engine / server-to-server path).
+ *   2. App-issued HS256 JWTs verified against the shared `jwtSecret`.
+ *
+ * Google ID tokens (RS256, JWKS-verified) cannot be verified synchronously
+ * without a network dependency in the request hot path; they are deliberately
+ * tiered as `anon`. This is a metrics-only inaccuracy while the limiter is in
+ * shadow mode — before any enforce graduation, either extend this resolver
+ * with an async JWKS-backed path or raise the anon ceiling to cover browser
+ * traffic (tracked in the B01-02 graduation checklist).
+ *
+ * Verified results are memoised in a bounded, TTL'd cache keyed by the token's
+ * SHA-256 (raw tokens are never retained) so the per-request cost is one hash.
+ */
+import { createHash } from 'crypto';
+import jwt from 'jsonwebtoken';
+import { jwtSecret } from '../config/jwtConfig.mjs';
+/** Bound on memoised token verdicts; oldest entries evicted first. */
+const TIER_CACHE_MAX_ENTRIES = 2048;
+/** Memoised verdicts expire after one rate-limit window (15 minutes). */
+const TIER_CACHE_TTL_MS = 15 * 60 * 1000;
+const ANON_RESOLUTION = { tier: 'anon', principalKey: null };
+const tierCache = new Map();
+/**
+ * Clears the memoised token-verdict cache. Test-only.
+ *
+ * @internal exported for testing
+ */
+export function _resetRateTierCacheForTests() {
+    tierCache.clear();
+}
+/**
+ * Verifies a bearer token offline and classifies its rate tier.
+ *
+ * @param token - Raw bearer token value (after the `Bearer ` prefix).
+ * @returns The resolved tier; `anon` for anything that fails verification.
+ */
+function verifyTier(token) {
+    const serverAuthToken = process.env.SERVER_AUTH_TOKEN;
+    if (typeof serverAuthToken === 'string' &&
+        serverAuthToken.length > 0 &&
+        token === serverAuthToken) {
+        return { tier: 'auth', principalKey: 'sub:server' };
+    }
+    try {
+        // HS256 pinned for the same alg-confusion reasons as the token-verifier.
+        const payload = jwt.verify(token, jwtSecret, { algorithms: ['HS256'] });
+        if (typeof payload !== 'string' && typeof payload.sub === 'string') {
+            return { tier: 'auth', principalKey: `sub:${payload.sub}` };
+        }
+        return ANON_RESOLUTION;
+    }
+    catch {
+        // Unverifiable (bad signature, expired, RS256 Google ID token, garbage
+        // shape) — treated as anonymous for tier purposes. Never throws upward:
+        // the limiter must not be able to fail a request.
+        return ANON_RESOLUTION;
+    }
+}
+/**
+ * Resolves the rate-limit tier and principal bucket key for a request.
+ *
+ * Cheap on the hot path: one SHA-256 over the token plus a bounded map lookup;
+ * the HMAC verification runs at most once per token per TTL window.
+ *
+ * @param req - Incoming Express request.
+ * @returns The request's {@link RateTierResolution}; `anon` when no `Bearer`
+ *   token is present or the token cannot be verified offline.
+ */
+export function resolveRateTier(req) {
+    const authHeader = req.headers.authorization ?? '';
+    if (!authHeader.startsWith('Bearer ')) {
+        return ANON_RESOLUTION;
+    }
+    const token = authHeader.slice('Bearer '.length).trim();
+    if (token.length === 0) {
+        return ANON_RESOLUTION;
+    }
+    const cacheKey = createHash('sha256').update(token).digest('hex');
+    const now = Date.now();
+    const cached = tierCache.get(cacheKey);
+    if (cached && cached.expiresAt > now) {
+        return cached.resolution;
+    }
+    const resolution = verifyTier(token);
+    if (tierCache.size >= TIER_CACHE_MAX_ENTRIES) {
+        // Map preserves insertion order — evict the oldest entry.
+        const oldestKey = tierCache.keys().next().value;
+        if (oldestKey !== undefined) {
+            tierCache.delete(oldestKey);
+        }
+    }
+    tierCache.set(cacheKey, { resolution, expiresAt: now + TIER_CACHE_TTL_MS });
+    return resolution;
+}
+//# sourceMappingURL=rate-tier.js.map

package/esm/utils/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/utils/logger.ts"],"names":[],"mappings":"AAUA,UAAU,MAAM;IACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClE;AA2CD,eAAO,MAAM,MAAM,QAAiC,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/utils/logger.ts"],"names":[],"mappings":"AAUA,UAAU,MAAM;IACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClE;AAmED,eAAO,MAAM,MAAM,QAAiC,CAAC"}

package/esm/utils/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../src/utils/logger.ts"],"names":[],"mappings":"AAiBA,SAAS,cAAc,CACrB,KAAe,EACf,OAAe,EACf,OAAe,EACf,IAA8B;IAE9B,MAAM,KAAK,GAAa;QACtB,KAAK;QACL,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;QACP,GAAG,IAAI;KACR,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO;QACL,IAAI,EAAE,CAAC,OAAe,EAAE,IAA8B,EAAQ,EAAE;YAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,OAAe,EAAE,IAA8B,EAAQ,EAAE;YAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CACtD,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,OAAe,EAAE,IAA8B,EAAQ,EAAE;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CACvD,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,OAAe,EAAE,IAA8B,EAAQ,EAAE;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CACvD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../src/utils/logger.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAA6B;IAC3C,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;IACjD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3E,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,cAAc,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;AAErD,SAAS,cAAc,CACrB,KAAe,EACf,OAAe,EACf,OAAe,EACf,IAA8B;IAE9B,MAAM,KAAK,GAAa;QACtB,KAAK;QACL,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;QACP,GAAG,IAAI;KACR,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,CACZ,KAAe,EACf,MAA0B,EAC1B,OAAe,EACf,IAA8B,EACxB,EAAE;QACR,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,cAAc;YAAE,OAAO;QAC/C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;QAC3E,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;QAC3E,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAQ,EAAE,CAC7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAQ,EAAE,CAC7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC"}

package/esm/utils/logger.mjs

@@ -1,3 +1,29 @@
+/**
+ * Minimum-level filter, resolved once at module load from `LOG_LEVEL`.
+ *
+ * Default is `debug` — every call writes, byte-identical to the historical
+ * unconditional behaviour, so production output is unchanged unless an
+ * operator sets the variable. The test suite sets `LOG_LEVEL=error`
+ * (vitest.config.ts): the codegen pipeline emits tens of thousands of
+ * warn-level lines in-process, and under vitest that volume saturates the
+ * worker IPC channel until the run fails with an unhandled
+ * `[vitest-worker]: Timeout calling "onTaskUpdate"` even when every test
+ * passes (observed on publish-gate runs 31244014211 / 31249917514).
+ */
+const LEVEL_RANK = {
+    debug: 0,
+    info: 1,
+    warn: 2,
+    error: 3,
+};
+function resolveMinLevel() {
+    const raw = process.env.LOG_LEVEL?.toLowerCase();
+    if (raw === 'debug' || raw === 'info' || raw === 'warn' || raw === 'error') {
+        return raw;
+    }
+    return 'debug';
+}
+const MIN_LEVEL_RANK = LEVEL_RANK[resolveMinLevel()];
 function formatLogEntry(level, service, message, meta) {
     const entry = {
         level,
@@ -9,19 +35,16 @@ function formatLogEntry(level, service, message, meta) {
     return JSON.stringify(entry);
 }
 function createLogger(service) {
+    const write = (level, stream, message, meta) => {
+        if (LEVEL_RANK[level] < MIN_LEVEL_RANK)
+            return;
+        stream.write(formatLogEntry(level, service, message, meta) + '\n');
+    };
     return {
-        info: (message, meta) => {
-            process.stdout.write(formatLogEntry('info', service, message, meta) + '\n');
-        },
-        warn: (message, meta) => {
-            process.stdout.write(formatLogEntry('warn', service, message, meta) + '\n');
-        },
-        error: (message, meta) => {
-            process.stderr.write(formatLogEntry('error', service, message, meta) + '\n');
-        },
-        debug: (message, meta) => {
-            process.stdout.write(formatLogEntry('debug', service, message, meta) + '\n');
-        },
+        info: (message, meta) => write('info', process.stdout, message, meta),
+        warn: (message, meta) => write('warn', process.stdout, message, meta),
+        error: (message, meta) => write('error', process.stderr, message, meta),
+        debug: (message, meta) => write('debug', process.stdout, message, meta),
     };
 }
 export const logger = createLogger('backend-legacy');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adaptic/backend-legacy",
-  "version": "0.0.997",
+  "version": "0.0.999",
   "description": "Backend executable CRUD functions with dynamic variables construction, and type definitions for the Adaptic AI platform.",
   "type": "module",
   "types": "index.d.ts",

package/server.cjs

@@ -63,6 +63,7 @@ const rate_limiter_1 = require("./middleware/rate-limiter.cjs");
 const audit_logger_1 = require("./middleware/audit-logger.cjs");
 const tenancy_scoping_1 = require("./middleware/tenancy-scoping.cjs");
 const cortex_auth_checker_1 = require("./auth/cortex-auth-checker.cjs");
+const authorization_map_1 = require("./auth/authorization-map.cjs");
 const http_status_mapper_1 = require("./plugins/http-status-mapper.cjs");
 const graphql_validation_plugin_1 = require("./middleware/graphql-validation-plugin.cjs");
 const query_complexity_1 = require("./middleware/query-complexity.cjs");
@@ -102,7 +103,15 @@ function principalToUser(principal) {
             };
     }
 }
+/**
+ * Default number of proxy hops trusted for X-Forwarded-For resolution when
+ * `TRUST_PROXY` is unset. One hop matches a single fronting LB/ingress proxy;
+ * operators must set `TRUST_PROXY` to the exact hop count of their deployment
+ * (audit B01-backend-legacy-02 / -12).
+ */
+const DEFAULT_TRUST_PROXY_HOPS = 1;
 const startServer = async () => {
+    var _a;
     // Boot-time invariant: in production, `GOOGLE_OAUTH_CLIENT_IDS` must be set.
     // Without it, no Google ID token can be safely verified — and the verifier
     // would surface a per-request `misconfigured` error indefinitely. Refuse to
@@ -112,6 +121,21 @@ const startServer = async () => {
     // is on (defaults on in production/staging). Registers default Node.js metrics
     // and starts the uptime gauge ticker. See: src/config/metrics.ts.
     (0, metrics_1.initMetrics)();
+    // CORTEX-P0-001 phase 2 (audit B01-backend-legacy-03): decorate generated
+    // CRUD resolvers with @Authorized() — full coverage on the 5 investor-relations
+    // models, delete mutations elsewhere — so the authChecker below actually
+    // executes. Must run BEFORE buildSchema (decorators land in TypeGraphQL's
+    // metadata storage). The checker stays SHADOW-FIRST: would-denies are logged
+    // + counted but ALLOWED until CORTEX_AUTHCHECKER_ENFORCE is flipped on.
+    // The boot log satisfies audit B01-backend-legacy-07: a zero decorated-action
+    // count means the checker is unreachable and its metrics are meaningless.
+    const authzSummary = (0, authorization_map_1.applyCortexAuthorizationMap)();
+    logger_1.logger.info('[cortex-authz] applied @Authorized coverage (authChecker in shadow unless CORTEX_AUTHCHECKER_ENFORCE)', {
+        fullCoverageModels: authzSummary.fullCoverageModels,
+        deleteCoverageModels: authzSummary.deleteCoverageModels,
+        decoratedActions: authzSummary.decoratedActions,
+        skippedActions: authzSummary.skippedActions.length,
+    });
     const schema = await (0, type_graphql_1.buildSchema)({
         resolvers: [...typegraphql_prisma_1.resolvers, custom_1.OptionsGreeksHistoryCustomResolver],
         validate: false,
@@ -120,23 +144,41 @@ const startServer = async () => {
         // and unauthenticated callers are bypassed in every mode. Gated by
         // `TENANCY_SCOPING_MODE` (default `shadow`).
         globalMiddlewares: [(0, tenancy_scoping_1.createTenancyScopingMiddleware)()],
-        // Resolver-level authorization (CORTEX-P0-001). SHADOW-FIRST: only invoked
-        // for `@Authorized()`-decorated fields and, while `CORTEX_AUTHCHECKER_ENFORCE`
-        // is OFF (default), it observes + counts would-deny operations but always
-        // allows — byte-identical live behaviour until enforcement is flipped on.
+        // Resolver-level authorization (CORTEX-P0-001). Invoked for the
+        // `@Authorized()`-decorated fields applied by applyCortexAuthorizationMap
+        // above. SHADOW-FIRST: while `CORTEX_AUTHCHECKER_ENFORCE` is OFF (default),
+        // it observes + counts would-deny operations but always allows —
+        // byte-identical live behaviour until enforcement is flipped on.
         authChecker: cortex_auth_checker_1.cortexAuthChecker,
     });
     const app = (0, express_1.default)();
     const httpServer = (0, http_1.createServer)(app);
+    // Trust the load-balancer proxy chain so `req.ip` resolves the CLIENT address
+    // from X-Forwarded-For instead of the proxy hop (audit B01-backend-legacy-02).
+    // Without this, every external caller shares one rate-limit bucket per tier,
+    // invalidating the shadow signal and making any future enforce flip an outage
+    // switch for the whole /graphql surface. `TRUST_PROXY` accepts a hop count
+    // (recommended: the EXACT number of proxy hops, so a spoofed X-Forwarded-For
+    // cannot mint arbitrary identifiers — audit B01-backend-legacy-12) or an
+    // Express trust-proxy string (CIDR / preset). Defaults to 1 hop.
+    const rawTrustProxy = ((_a = process.env.TRUST_PROXY) !== null && _a !== void 0 ? _a : '').trim();
+    const trustProxy = rawTrustProxy === ''
+        ? DEFAULT_TRUST_PROXY_HOPS
+        : /^\d+$/.test(rawTrustProxy)
+            ? parseInt(rawTrustProxy, 10)
+            : rawTrustProxy;
+    app.set('trust proxy', trustProxy);
     // HTTP request metrics — must be mounted early to capture every request.
     // The middleware is a no-op when metrics are disabled.
     app.use(metrics_1.metricsMiddleware);
-    // Rate limiting (CORTEX-P0-001). SHADOW-FIRST: mounted on the GraphQL surface
-    // and the authenticated Express `/api` surface. While `CORTEX_RATE_LIMIT_ENFORCE`
-    // is OFF (default), they observe + count requests that WOULD be blocked but
-    // never touch the response, so live behaviour is byte-identical. Mounted
-    // before `/api` auth so limiting precedes the (more expensive) auth work.
-    app.use('/graphql', rate_limiter_1.graphqlRateLimiter);
+    // Rate limiting (CORTEX-P0-001). SHADOW-FIRST: while `CORTEX_RATE_LIMIT_ENFORCE`
+    // is OFF (default), the limiters observe + count requests that WOULD be blocked
+    // but never touch the response, so live behaviour is byte-identical. The
+    // GraphQL limiter is mounted INSIDE the /graphql chain after cors() (see below)
+    // so an enforce-mode 429 carries CORS headers and browser clients can read the
+    // Retry-After instead of seeing an opaque CORS failure
+    // (audit B01-backend-legacy-11). Mounted before `/api` auth so limiting
+    // precedes the (more expensive) auth work.
     app.use('/api', rate_limiter_1.authRateLimiter);
     app.use('/api', (req, res, next) => (0, auth_1.authMiddleware)(req, res, next));
     // APQ cache: in-memory LRU, gated by `APQ_ENABLED` (default on). The
@@ -256,7 +298,11 @@ const startServer = async () => {
         allowedHeaders: ['Content-Type', 'Authorization', 'X-Request-ID'],
         maxAge: 86400, // 24h preflight cache
     };
-    app.use('/graphql', (0, cors_1.default)(corsOptions), body_parser_1.default.json(), (0, express4_1.expressMiddleware)(server, {
+    app.use('/graphql', (0, cors_1.default)(corsOptions), 
+    // After cors() so enforce-mode 429s carry CORS headers; before body parsing
+    // so limiting stays cheap. OPTIONS preflights are skipped inside the
+    // limiter (audit B01-backend-legacy-11).
+    rate_limiter_1.graphqlRateLimiter, body_parser_1.default.json(), (0, express4_1.expressMiddleware)(server, {
         context: async ({ req }) => {
             // Ensure we're using the global prisma instance and never disconnecting it between requests
             if (!global.prisma) {