@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.js

@@ -19,11 +19,22 @@ import { ErrorBuilderBackendService } from '../../../errors/services/error-build
 import { projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
 import { AuditEventDispatcherBackendService } from './audit-event-dispatcher.backend.service.js';
-import { getAuditEventClassification, CoreAuditableEventType, ExecutionContext_ExecutionType, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourcePrimaryScope, CORE_APP_ROLES, PlatformAccessGrantAutoApprovalReason, } from '@wildo-ai/saas-models';
+import { ExternalOperation_Classification } from '@wildo-ai/external-connectors-models';
+import { getAuditEventClassification, CoreAuditableEventType, ExecutionContext_ExecutionType, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourcePrimaryScope, CORE_APP_ROLES, PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantScope, } from '@wildo-ai/saas-models';
 import { CoreResourceOperation, CoreResourceType, AuditableEvent_BaseSchema, AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema, deriveTrustedSystemWritePreservedFields } from '@wildo-ai/saas-models';
 import { buildApplicationAuthPolicySnapshot, computeApplicationAuthPolicySnapshotDigest, diffChangedApplicationAuthPolicyUserTypes, } from '../../../security/authentications/utils/application-auth-policy-audit.backend.utils.js';
+import { McpOutcomeKind } from '../../../flows-actors/models/mcp-client.backend.definitions.js';
 import { getRequestContextFrame } from '../../../runtime/models/request-context.als.backend.js';
 import { ExecutionContextCreatorBackendService } from '../../../runtime/services/execution-context-creator.backend.service.js';
+/**
+ * How much of a scanner's failure text reaches the audit row (#506).
+ *
+ * Bounded rather than omitted: an operator triaging "why did the scan not run" needs the scanner's
+ * own words, and a bare event type does not distinguish a dead socket from a malformed archive. The
+ * bound exists because that text routinely embeds a host, a socket path or a temporary file path,
+ * and this row is replicated to the organisation's SIEM and to the immutable store.
+ */
+const FILE_MALWARE_SCAN_FAILURE_REASON_MAX_LENGTH = 300;
 let AuditLogsBackendService = class AuditLogsBackendService {
     logger;
     errorBuilder;
@@ -433,11 +444,27 @@ let AuditLogsBackendService = class AuditLogsBackendService {
      *
      * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
      */
+    /**
+     * Record one access-grant transition — TENANT or APPLICATION-WIDE, on the same event.
+     *
+     * ONE method for both scopes, deliberately. The lifecycle really is the same lifecycle (requested,
+     * decided, revoked, expired), and a reviewer's question is *"what elevated access was granted, to
+     * whom, by whom?"* — a question that must be answerable with one query, not by remembering to union
+     * two event types. `grantScope` is what separates them within the answer, and it is a field rather
+     * than an inference from `targetOrganizationId`'s absence: a scrubbed or lost tenant id would
+     * otherwise read as an application-wide elevation, which is the more alarming of the two.
+     *
+     * The application-wide row is HIGH by default. It is not an exception path like
+     * `TENANT_CANNOT_APPROVE`; it is the ordinary shape of the widest elevation the system issues, and
+     * a reviewer who filters to HIGH should see every one of them.
+     */
     async logPlatformAccessGrantLifecycle(data) {
+        const grantScope = data.grantScope ?? PlatformAccessGrantScope.TENANT;
         await this._createAuditLog({
             userId: data.operatorUserId,
             organizationId: data.targetOrganizationId,
-            riskLevel: data.autoApprovalReason === PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE
+            riskLevel: grantScope === PlatformAccessGrantScope.APPLICATION_WIDE
+                || data.autoApprovalReason === PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE
                 ? ResourceOperationRiskLevel.HIGH
                 : ResourceOperationRiskLevel.MEDIUM,
             eventType: CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE,
@@ -445,6 +472,7 @@ let AuditLogsBackendService = class AuditLogsBackendService {
                 eventType: CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE,
                 transition: data.transition,
                 grantId: data.grantId,
+                grantScope,
                 targetOrganizationId: data.targetOrganizationId,
                 operatorUserId: data.operatorUserId,
                 justification: data.justification,
@@ -471,6 +499,7 @@ let AuditLogsBackendService = class AuditLogsBackendService {
                 variantType: data.variantType,
                 variantKey: data.variantKey,
                 targetResourceIds: data.targetResourceIds,
+                authorizingGrantScope: data.authorizingGrantScope,
                 authorizingGrantId: data.authorizingGrantId,
                 admissionDeclared: data.admissionDeclared,
                 initiatorRoles: data.initiatorRoles,
@@ -1187,6 +1216,112 @@ let AuditLogsBackendService = class AuditLogsBackendService {
             eventData: eventData,
         }, requestExecutionContext);
     }
+    /**
+     * Record ONE outbound call to a third-party provider — the trail behind
+     * {@link CoreAuditableEventType.PROVIDER_OPERATION_CALL}, emitted by the provider-operation
+     * executor on both the success and the failure path.
+     *
+     * The top-level `userId` is the REAL initiating user, and `organizationId` is the tenant the
+     * REQUEST was scoped to — NOT the tenant whose account was spent. Those two differ exactly where
+     * it matters: one user action fanning out to every organization that user belongs to spends N
+     * accounts under one initiating scope, and the account actually spent rides
+     * `eventData.connectionOwnerScope` / `connectionOwnerId`. Writing the connection owner into the
+     * row's `organizationId` would make the fan-out's calls read as if each had been requested by the
+     * tenant it reached.
+     *
+     * `riskLevel` is per-emission because the static severity cannot be: an outbound WRITE to a third
+     * party is a materially different act from a read, and the operation catalogue's own
+     * classification vocabulary says so ("a caller decides retry-safety, an audit decides severity").
+     * MEDIUM for a WRITE, LOW for a READ — the same shape `COLLECTION_DATA_EXPORT` uses to separate a
+     * page download from a whole-table dump without splitting the event type.
+     *
+     * assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound provider call made on a user's behalf
+     * is recorded with the real initiating user beside the account it spent.
+     */
+    async logProviderOperationCall(data, requestExecutionContext) {
+        const eventData = {
+            eventType: CoreAuditableEventType.PROVIDER_OPERATION_CALL,
+            ...data,
+        };
+        await this._createAuditLog({
+            userId: data.initiatorUserId,
+            organizationId: data.organizationId,
+            riskLevel: data.classification === ExternalOperation_Classification.WRITE
+                ? ResourceOperationRiskLevel.MEDIUM
+                : ResourceOperationRiskLevel.LOW,
+            eventType: CoreAuditableEventType.PROVIDER_OPERATION_CALL,
+            eventData: eventData,
+        }, requestExecutionContext);
+    }
+    /**
+     * Record that an AGENT reached an MCP server on somebody's behalf (#491) — the outbound trail for
+     * a tool call that leaves the trust boundary.
+     *
+     * One row per ATTEMPT, whatever the outcome. Recording only what worked would hide precisely what
+     * a reviewer looks for first: the refused targets, the calls that timed out, and the tools that
+     * answered with their own error. `outcome` carries the client's own vocabulary so the trail and
+     * the logs use the same words for the same thing.
+     *
+     * The top-level `userId` is the REAL initiating user and `organizationId` the tenant the TURN was
+     * scoped to — never the tenant whose credential was spent, which rides
+     * `eventData.connectionOwnerScope`. Same separation as the provider-call sibling above, for the
+     * same reason.
+     *
+     * `riskLevel` is per-emission and keys on the OUTCOME rather than on a declared verb, because an
+     * MCP tool has no declared verb: the tool list is discovered from the server at turn start and
+     * nothing says whether a tool reads or writes. MEDIUM for a refused target — an attempted egress a
+     * guard blocked is the row a reviewer wants raised — and LOW for everything else, including
+     * ordinary failures, which are noise until somebody is looking for them.
+     *
+     * assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the
+     * real initiating user beside the account it spent.
+     */
+    async logMcpToolCall(data, requestExecutionContext) {
+        const eventData = {
+            eventType: CoreAuditableEventType.MCP_TOOL_CALL,
+            ...data,
+        };
+        await this._createAuditLog({
+            userId: data.initiatorUserId,
+            organizationId: data.organizationId,
+            riskLevel: data.outcome === McpOutcomeKind.REFUSED_TARGET
+                ? ResourceOperationRiskLevel.MEDIUM
+                : ResourceOperationRiskLevel.LOW,
+            eventType: CoreAuditableEventType.MCP_TOOL_CALL,
+            eventData: eventData,
+        }, requestExecutionContext);
+    }
+    /**
+     * Record that a human approver AUTHORED the arguments an approval-gated tool then ran with (#566).
+     *
+     * One row per MODIFIED approval. An approval that ran the call as proposed writes nothing here —
+     * this event answers "who wrote the arguments", and an approval that changed none did not.
+     *
+     * The top-level `userId` is the APPROVER, which on this plane is the only identity that can exist:
+     * a turn whose principal cannot answer a decision is denied rather than suspended, so nobody but a
+     * present, accountable human ever reaches this method.
+     *
+     * `riskLevel` is HIGH and does not vary. Every other per-emission risk level in this service keys
+     * on something the act might or might not have been; there is no such axis here, because the act
+     * itself is the whole finding — a person substituted their own arguments for the model's on a tool
+     * an author gated precisely because it was dangerous enough to need a human.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — an authorization decision that
+     * REWROTE the act it authorized is recorded with the person who wrote it.
+     */
+    async logAgentToolApprovalModified(data, requestExecutionContext) {
+        const eventData = {
+            eventType: CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED,
+            ...data,
+        };
+        await this._createAuditLog({
+            userId: data.approverUserId,
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED,
+            eventData: eventData,
+        }, requestExecutionContext);
+    }
     /**
      * Record that a subject erasure invoked an HTTP_API binding's DECLARED external-erasure
      * operation (ETL D6 stance 6b) — remote rows linked to the erased subject were deleted in a
@@ -1413,6 +1548,13 @@ let AuditLogsBackendService = class AuditLogsBackendService {
      * one per stranded tenant: a single deactivation can strand several, and an operator who learns
      * about them one at a time cannot plan the remediation.
      *
+     * ALSO emitted by the BOOT report, under `detectedBy: BOOT_REPORT` — see
+     * {@link AdministrativeContinuityBreachDetection}. The boot report used to write log lines and
+     * nothing else, so a tenant stranded by a route no guard ever saw (a direct database edit, a
+     * restore taken mid-erasure, a role-table change) produced no queryable evidence and reached no
+     * SIEM, while its APPLICATION twin `logApplicationSuperAdminFloorBreached` had been audited from
+     * the start. The action fields are absent on that path because there is no action to name.
+     *
      * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that a tenant has no
      * accountable administrative principal, and which allowed action caused it.
      */
@@ -1420,11 +1562,15 @@ let AuditLogsBackendService = class AuditLogsBackendService {
         const eventData = {
             eventType: CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED,
             organizationId: data.organizationId,
-            reducedMemberIds: data.reducedMemberIds,
+            detectedBy: data.detectedBy,
             remainingUsableOwners: data.remainingUsableOwners,
-            operationIdentifier: data.operationIdentifier,
-            subjectUserId: data.subjectUserId,
-            subjectNextStatus: data.subjectNextStatus,
+            // Omitted rather than emitted as undefined: the boot observation has no action to name, and a
+            // key present with no value reads in a SIEM as "we looked and found nothing" instead of "there
+            // was nothing to look for".
+            ...(data.reducedMemberIds ? { reducedMemberIds: data.reducedMemberIds } : {}),
+            ...(data.operationIdentifier ? { operationIdentifier: data.operationIdentifier } : {}),
+            ...(data.subjectUserId ? { subjectUserId: data.subjectUserId } : {}),
+            ...(data.subjectNextStatus ? { subjectNextStatus: data.subjectNextStatus } : {}),
         };
         await this._createAuditLog({
             riskLevel: ResourceOperationRiskLevel.CRITICAL,
@@ -1856,14 +2002,32 @@ let AuditLogsBackendService = class AuditLogsBackendService {
     async logApplicationAuthPolicyChanged(data) {
         const eventData = {
             eventType: CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED,
-            applicationId: data.applicationId,
             changedUserTypes: data.changedUserTypes,
             snapshotDigest: data.snapshotDigest,
             before: data.before,
             after: data.after,
         };
+        /*
+         * NO `applicationId` PASSED — and that is the fix, not an omission (2026-09-09).
+         *
+         * `applicationId` is this resource's declared PRIMARY-SCOPE field, so when an emitter does not
+         * author it the repository's write-path enrichment injects the writer's own application id.
+         * 103 of the 109 emitters in this class rely on exactly that, and the trail proves it works:
+         * 2,175 of 2,178 rows on the dogfood application carry the correct id.
+         *
+         * Passing one is what broke this event. `deriveTrustedSystemWritePreservedFields` preserves any
+         * key present on `auditLogData`, so an authored value SURVIVES the strict re-parse and wins over
+         * the enrichment — and the only value this emitter could reach was the app SLUG, because the
+         * backend has no application id on `appIdentity` (that field is merged for the frontend
+         * projection alone). The row therefore landed under `wonder-todos` and was reachable through no
+         * API, on the very door #317 built for unscoped and application-wide security events.
+         *
+         * So the rule for this class: author `applicationId` only when the event is genuinely ABOUT a
+         * DIFFERENT application from the writer. An application-wide auth-policy change is about the
+         * writer's own, so authoring it can only restate what the enrichment already knows — or, as
+         * here, contradict it.
+         */
         await this._createAuditLog({
-            applicationId: data.applicationId,
             riskLevel: ResourceOperationRiskLevel.MEDIUM,
             eventType: CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED,
             eventData: eventData,
@@ -1903,7 +2067,6 @@ let AuditLogsBackendService = class AuditLogsBackendService {
             const before = prior?.after ?? null;
             const changedUserTypes = diffChangedApplicationAuthPolicyUserTypes(before, currentSnapshot);
             await this.logApplicationAuthPolicyChanged({
-                applicationId: data.applicationId,
                 changedUserTypes,
                 snapshotDigest: currentDigest,
                 before,
@@ -2063,14 +2226,29 @@ let AuditLogsBackendService = class AuditLogsBackendService {
         });
     }
     /**
-     * Log emergency access used (break-glass account used)
+     * A named break-glass account signed in past its tenant's own SSO requirement (#423).
+     *
+     * Scoped to an ORGANIZATION or an APPLICATION, never both — the caller says which.
+     *
+     * `emergencyAccess` lives on the POLYMORPHIC SSO config, so an application-scope policy carries
+     * break-glass accounts for the application itself and has no organization id. This method was
+     * organization-only for one release and the gate REFUSED the other case rather than emit without
+     * a record; that was the right fail-closed answer while the event contract could not express it,
+     * and it is no longer needed. The schema admits either scope and refuses anything but exactly
+     * one, so an unscoped call cannot be written.
+     *
+     * `riskLevel` is HIGH — the risk band of the resource operation. The event's own severity is
+     * CRITICAL, set once in `SECURITY_AUDIT_EVENT_ENVELOPE` where every consumer reads it; the two
+     * are different axes and the envelope is what a SIEM rule keys on.
      */
     async logEmergencyAccessUsed(data) {
         const eventData = {
             eventType: CoreAuditableEventType.EMERGENCY_ACCESS_USED,
             userId: data.userId,
             email: data.email,
+            scopeType: data.scopeType,
             organizationId: data.organizationId,
+            applicationId: data.applicationId,
             reason: data.reason,
             ipAddress: data.ipAddress,
             userAgent: data.userAgent,
@@ -2079,6 +2257,7 @@ let AuditLogsBackendService = class AuditLogsBackendService {
         await this._createAuditLog({
             userId: data.userId,
             organizationId: data.organizationId,
+            applicationId: data.applicationId,
             riskLevel: ResourceOperationRiskLevel.HIGH,
             eventType: CoreAuditableEventType.EMERGENCY_ACCESS_USED,
             eventData: eventData,
@@ -2339,6 +2518,91 @@ let AuditLogsBackendService = class AuditLogsBackendService {
             eventData: eventData,
         });
     }
+    /**
+     * Log a passkey assertion whose signature VERIFIED and whose counter did not advance.
+     *
+     * Emitted only AFTER signature verification, which is what makes it worth alerting on: an
+     * unauthenticated caller who knows a credential id cannot forge this row. Risk level HIGH and
+     * severity CRITICAL — it is the one authentication signal that means a private key may exist in
+     * two places, and it used to be indistinguishable from a typo'd credential in the trail.
+     */
+    async logUserPasskeyCloneSuspected(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED,
+            userId: data.userId,
+            credentialId: data.credentialId,
+            storedCounter: data.storedCounter,
+            receivedCounter: data.receivedCounter,
+            credentialDeviceType: data.credentialDeviceType,
+            credentialBackedUp: data.credentialBackedUp,
+            ...(data.aaguid ? { aaguid: data.aaguid } : {}),
+            ceremony: data.ceremony,
+            ipAddress: data.ipAddress,
+            userAgent: data.userAgent,
+        };
+        await this._createAuditLog({
+            userId: data.userId,
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * Record that a scanner found an uploaded file INFECTED (#506).
+     *
+     * Called AFTER the file's terminal transition, so `fileStatus` describes a state the record
+     * actually holds rather than one the caller intends. `HIGH` risk — the same level the passkey
+     * clone suspicion carries, and for the same reason: a security mechanism reached a conclusion
+     * about a real threat.
+     */
+    async logFileMalwareDetected(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.FILE_MALWARE_DETECTED,
+            fileId: data.fileId,
+            scannerRef: data.scannerRef,
+            ...(data.threatName ? { threatName: data.threatName } : {}),
+            ...(data.resourceType ? { resourceType: data.resourceType } : {}),
+            ...(data.resourceId ? { resourceId: data.resourceId } : {}),
+            ...(data.organizationId ? { organizationId: data.organizationId } : {}),
+            fileStatus: data.fileStatus,
+        };
+        await this._createAuditLog({
+            userId: data.userId,
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.FILE_MALWARE_DETECTED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * Record that a scan could NOT be completed (#506).
+     *
+     * A different story from a detection and therefore a different event: the control did not run.
+     * `failureReason` is TRUNCATED here rather than at the call site, so every caller gets the bound
+     * — a scanner error routinely embeds a host, a socket path or a temporary file path, and this row
+     * is replicated to the organisation's SIEM and to the immutable store.
+     */
+    async logFileMalwareScanFailed(data, requestExecutionContext, routingOrgIds) {
+        const truncatedReason = data.failureReason?.slice(0, FILE_MALWARE_SCAN_FAILURE_REASON_MAX_LENGTH);
+        const eventData = {
+            eventType: CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED,
+            fileId: data.fileId,
+            scannerRef: data.scannerRef,
+            ...(truncatedReason ? { failureReason: truncatedReason } : {}),
+            ...(data.resourceType ? { resourceType: data.resourceType } : {}),
+            ...(data.resourceId ? { resourceId: data.resourceId } : {}),
+            ...(data.organizationId ? { organizationId: data.organizationId } : {}),
+            fileStatus: data.fileStatus,
+        };
+        await this._createAuditLog({
+            userId: data.userId,
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.MEDIUM,
+            eventType: CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
     /**
      * Log passkey removed
      */
@@ -2548,6 +2812,34 @@ let AuditLogsBackendService = class AuditLogsBackendService {
             eventData: typedEventData,
         });
     }
+    /**
+     * An enterprise OIDC login refused because the provider did not report the demanded authentication
+     * context (issue #444).
+     *
+     * NO tenant scope on the payload, and that is deliberate rather than an omission: the refusal
+     * happens during the callback, before the claimant is provisioned or linked, so there is no
+     * verified organization to attribute it to. Inventing one from an unverified email domain would
+     * put an attacker-chosen tenant id on a security event.
+     *
+     * HIGH risk, unlike its `OAUTH2_PROVIDER_BLOCKED` neighbour at MEDIUM. That one records a policy
+     * that worked; this one records a step-up demand the identity provider did NOT satisfy, which is
+     * either a misconfiguration leaving an operator's strongest control inert or a provider behaving
+     * differently from what was agreed. Both want a reader.
+     */
+    async logOidcAcrDemandUnsatisfied(data) {
+        const typedEventData = {
+            eventType: CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED,
+            providerRef: data.providerRef,
+            demandedAcrValues: data.demandedAcrValues,
+            receivedAcr: data.receivedAcr,
+            failureReason: data.failureReason,
+        };
+        await this._createAuditLog({
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED,
+            eventData: typedEventData,
+        });
+    }
     // ===============================
     // METHOD MANAGEMENT AUDIT METHODS (#13f)
     // ===============================
@@ -2690,6 +2982,266 @@ let AuditLogsBackendService = class AuditLogsBackendService {
             eventData: eventData,
         }, requestExecutionContext, routingOrgIds);
     }
+    // ═══════════════════════════════════════════════════════════════════════════════════════════
+    // Organization provider credentials — an organization's OWN authority toward a third party.
+    //
+    // Four verbs, four methods, and NONE of them takes the credential value as a parameter. That is
+    // the enforcement: a caller cannot pass a secret to a method with no parameter to receive it, so
+    // the "value never in an audit payload" requirement is a property of these signatures rather than
+    // a redaction step somebody has to remember at each call site.
+    // ═══════════════════════════════════════════════════════════════════════════════════════════════
+    /**
+     * A tenant granted this application authority to act as it toward a named third party.
+     *
+     * MEDIUM rather than HIGH: the act is an administrator deliberately configuring an integration,
+     * which is ordinary tenant administration. What makes it worth recording is that it is the moment
+     * the application's outbound identity for this tenant STOPS being the deployment's shared one.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — organization authorizes delegated
+     * access to a named third party.
+     */
+    async logOrganizationProviderCredentialSet(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET,
+            organizationId: data.organizationId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            credentialId: data.credentialId,
+            setBy: data.setBy,
+        };
+        await this._createAuditLog({
+            userId: data.setBy,
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.MEDIUM,
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * The stored VALUE changed for a credential that already existed.
+     *
+     * HIGH, unlike its `_SET` sibling, and the difference is the incident question. Rotation is what a
+     * tenant does after a suspected compromise — and it is also what an ATTACKER does to lock a tenant
+     * out of its own integration while keeping the application acting on their behalf. A first
+     * configuration cannot be either of those.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is
+     * replaced.
+     */
+    async logOrganizationProviderCredentialRotated(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED,
+            organizationId: data.organizationId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            credentialId: data.credentialId,
+            rotatedBy: data.rotatedBy,
+            previousSecretSetAt: data.previousSecretSetAt,
+        };
+        await this._createAuditLog({
+            userId: data.rotatedBy,
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * The credential was RESOLVED for an outbound call — the application acted as the tenant.
+     *
+     * LOW, and high-volume by design. This is the only event that can show a leaked credential being
+     * EXERCISED; without it the trail records how an integration was configured and nothing about how
+     * it was used. `resolvedFrom` is the field that makes it worth the volume: it distinguishes a
+     * tenant acting as itself from a tenant silently falling back to the deployment's shared
+     * principal, which is the exact condition this whole subsystem exists to make visible.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.
+     */
+    async logOrganizationProviderCredentialUsed(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED,
+            organizationId: data.organizationId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            resolvedFrom: data.resolvedFrom,
+            credentialId: data.credentialId,
+        };
+        await this._createAuditLog({
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.LOW,
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * The grant ended — by an administrator revoking it, or by the tenant itself being purged.
+     *
+     * HIGH: a credential disappearing is how a tenant's integration stops working, and the first
+     * question afterwards is always whether a human did it. `reason` answers that without the reader
+     * having to correlate against the organization lifecycle trail.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority
+     * was withdrawn.
+     */
+    async logOrganizationProviderCredentialDeleted(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED,
+            organizationId: data.organizationId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            credentialId: data.credentialId,
+            reason: data.reason,
+            deletedBy: data.deletedBy,
+        };
+        await this._createAuditLog({
+            userId: data.deletedBy,
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * A person connected their own account at a third party.
+     *
+     * No `organizationId` on any of these four, and that is the substantive difference from the
+     * organization siblings rather than an omission. A person's credential belongs to the person, not
+     * to whichever tenant they happened to be looking at when they authored it — passing an
+     * organization would route the event into that tenant's SIEM stream and tell its administrators
+     * about an individual's personal vendor account. `userId` is both the subject and the actor,
+     * because the resource admits no administrative variant and nobody else can write the row.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user authorizes delegated access.
+     */
+    async logUserProviderCredentialSet(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET,
+            userId: data.userId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            credentialId: data.credentialId,
+        };
+        await this._createAuditLog({
+            userId: data.userId,
+            riskLevel: ResourceOperationRiskLevel.MEDIUM,
+            eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /** The stored value changed for a person's credential that already existed. */
+    async logUserProviderCredentialRotated(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED,
+            userId: data.userId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            credentialId: data.credentialId,
+            previousSecretSetAt: data.previousSecretSetAt,
+        };
+        await this._createAuditLog({
+            userId: data.userId,
+            riskLevel: ResourceOperationRiskLevel.MEDIUM,
+            eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * The application acted as that person toward the provider.
+     *
+     * `credentialId` is REQUIRED here where the organization sibling makes it optional, and the
+     * difference is the point: the organization event can describe a deployment-environment fallback,
+     * which has no row to name. A person's credential has no fallback at all, so an event without a
+     * row would describe something that must never happen.
+     */
+    async logUserProviderCredentialUsed(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED,
+            userId: data.userId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            resolvedFrom: data.resolvedFrom,
+            credentialId: data.credentialId,
+        };
+        await this._createAuditLog({
+            userId: data.userId,
+            riskLevel: ResourceOperationRiskLevel.LOW,
+            eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * The person's grant ended — by them removing it, or by their own erasure.
+     *
+     * HIGH, matching the organization sibling, and carrying a second reason here: when `reason` names
+     * an erasure cascade, this event is the ONLY remaining evidence that the subject's third-party
+     * credentials were destroyed. The row it describes no longer exists.
+     *
+     * assurance-control: WILDO.PRIVACY.ERASURE — evidence that erasure reached this store.
+     */
+    async logUserProviderCredentialDeleted(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED,
+            userId: data.userId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            credentialId: data.credentialId,
+            reason: data.reason,
+        };
+        await this._createAuditLog({
+            userId: data.userId,
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /**
+     * A PERSON completed a consent ceremony at a vendor and their grant is now stored.
+     *
+     * HIGH risk, matching the deletion beside it rather than the routine `_SET`: what is recorded here
+     * is a third party gaining the ability to act as somebody, which is the same magnitude of change
+     * as that ability being taken away. The severity an operator sees is the envelope's, which reads
+     * this as ordinary user lifecycle; the risk level is the framework's own view of the write.
+     */
+    async logUserProviderConnectionGranted(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED,
+            userId: data.userId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            credentialId: data.credentialId,
+            // Spread rather than assigned, so an absent scope set stays ABSENT. The vendor saying nothing
+            // and the vendor granting nothing are different facts, and `[]` would assert the second.
+            ...(data.grantedScopes === undefined ? {} : { grantedScopes: [...data.grantedScopes] }),
+            ...(data.accountRef === undefined ? {} : { accountRef: data.accountRef }),
+            replacedExistingConnection: data.replacedExistingConnection,
+        };
+        await this._createAuditLog({
+            userId: data.userId,
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
+    /** An ORGANIZATION's delegated authorization toward a vendor was granted. See the user sibling. */
+    async logOrganizationProviderConnectionGranted(data, requestExecutionContext, routingOrgIds) {
+        const eventData = {
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED,
+            organizationId: data.organizationId,
+            providerRef: data.providerRef,
+            secretSlug: data.secretSlug,
+            credentialId: data.credentialId,
+            ...(data.grantedByUserId === undefined ? {} : { grantedByUserId: data.grantedByUserId }),
+            ...(data.grantedScopes === undefined ? {} : { grantedScopes: [...data.grantedScopes] }),
+            ...(data.accountRef === undefined ? {} : { accountRef: data.accountRef }),
+            replacedExistingConnection: data.replacedExistingConnection,
+        };
+        await this._createAuditLog({
+            organizationId: data.organizationId,
+            riskLevel: ResourceOperationRiskLevel.HIGH,
+            eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED,
+            eventData: eventData,
+        }, requestExecutionContext, routingOrgIds);
+    }
     async logGenericEvent(data, requestExecutionContext, routingOrgIds) {
         await this._createAuditLog({
             userId: data.userId,