@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.d.ts

@@ -20,14 +20,17 @@
  *   #333, which retired that mode for the two-axis `ExternalProvider_ConnectionShape` and lifted
  *   the refusal — neither change reached this class, which is the point of asking the port.
  * - **It does not page.** `pagination` on an operation is a hint the caller reads.
- * - **It does not AUDIT — yet, and this is the one gap worth stating loudly.** The seam is built
- *   and called on every outbound call (`ProviderOperationAuditResolver`, the lazily-resolved thunk
- *   this repository uses for the same job in the HTTP-API repository), but the
- *   `CoreAuditableEventType` member and the audit-logs method behind it belong to S3b, which the
- *   plan's seam table requires to agree the event NAMES with S5a before either commits. So the
- *   emission point exists and answers nothing until S3b writes the sink. That is a real hole, not
- *   a design: an application calling a vendor on a user's behalf must leave a trail, and until
- *   S3b lands it leaves none.
+ * - **It does not OWN the trail, but it does emit one.** Two observations leave here on every call —
+ *   the outbound-call row (`CoreAuditableEventType.PROVIDER_OPERATION_CALL`, through the lazily
+ *   resolved `ProviderOperationAuditResolver`) and the credential-use stamp (through the registry,
+ *   which knows which store the credential came from). Both are fire-and-forget and neither can fail
+ *   the call it observes; both are counted when they are lost, which is the half that was missing.
+ *
+ *   Stated loudly because it was false for months and nothing said so: the two seams existed, were
+ *   called on every outbound call, and had NOTHING behind them — the container constructed this class
+ *   with two of its six parameters, so both resolvers were `undefined` for the process's whole life,
+ *   and one of the two sinks had never been written at all. An application calling a vendor on a
+ *   user's behalf left no trail whatsoever, and the code read as though it did.
  *
  * ## Bound by FACTORY, not by decoration
  *
@@ -51,6 +54,7 @@ import type { ProviderOperationExecute, ProviderRestOperation, ProviderRestOpera
 import type { ExecutionContext } from '../../runtime/models/execution-context.backend.schemas';
 import type { HttpApiFetchLike } from '../../base-classes/services/repositories/http-api/http-api-transport.backend';
 import type { HttpApiProviderAccessResolver } from '../../base-classes/services/repositories/http-api/http-api-provider-access.backend';
+import { type AuditObservationLossLogger, type AuditObservationLossMetricsResolver } from '../../monitoring/observability/audit-observation-emission.backend';
 import type { ExternalProvidersRegistryBackendService } from '../../external-providers/services/external-providers-registry.backend.service';
 /** Why an operation could not be reached at all — each member names a different remedy. */
 export declare enum ProviderOperationLookupFailureKind {
@@ -78,34 +82,21 @@ export declare class ProviderOperationLookupError extends Error {
     });
 }
 /**
- * The audit seam — structural and lazily resolved, the pattern this repository already uses for
- * the HTTP-API read-through trail. The executor never holds the audit service, only a thunk; an
- * absent binding means no emission, and an emission failure never fails the call it observes.
+ * The audit seam — structural and lazily resolved, the pattern this repository already uses for the
+ * HTTP-API read-through trail. The executor never holds the audit service, only a thunk; an absent
+ * binding means no emission, and an emission failure never fails the call it observes.
  *
- * TODO(assurance-control): WILDO.AUDIT.ATTRIBUTION — an outbound provider call made on a user's
- * behalf must be recorded with the real initiating user. The sink behind this thunk is S3b's, and
- * the `CoreAuditableEventType` member it writes must be agreed with S5a first (plan seam table).
- */
-/**
- * The credential store, reached the way the audit sink is — through a thunk, so this class takes no
- * dependency on `security/connected-accounts` and a unit harness needs neither.
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound provider call made on a user's behalf is
+ * recorded with the real initiating user. The sink is
+ * `AuditLogsBackendService.logProviderOperationCall`, writing
+ * `CoreAuditableEventType.PROVIDER_OPERATION_CALL`.
  *
- * Optional in both directions: a host that binds no store records nothing, and an APPLICATION-owned
- * call has no row to stamp.
+ * The thunk's method stays OPTIONAL, and that is not laziness: a host may bind an older audit
+ * service, and a partially-mocked double routinely has fewer methods than the real one. What is no
+ * longer tolerated is the absence going unnoticed — the emission runs through
+ * {@link emitAuditObservation}, so a missing sink is counted as
+ * {@link AuditObservationLossReason.SERVICE_UNAVAILABLE} rather than silently doing nothing.
  */
-export type ProviderCredentialUseRecorder = () => {
-    recordCredentialUse?: (use: {
-        organizationId: string;
-        providerRef: string;
-        secretSlug: string;
-        source: string;
-        credentialId?: string;
-        outcome?: {
-            accepted: boolean;
-            providerMessage?: string;
-        };
-    }) => Promise<void>;
-} | undefined;
 export type ProviderOperationAuditResolver = () => {
     logProviderOperationCall?: (data: ProviderOperationAuditRecord, requestExecutionContext?: ExecutionContext<any>) => Promise<void>;
 } | undefined;
@@ -173,20 +164,53 @@ export interface ProviderOperationCallResult<TOutput = unknown> {
     rawBody: unknown;
     operation: ProviderRestOperation;
 }
+/**
+ * Everything the executor can be given beyond the two collaborators it cannot work without.
+ *
+ * Every field is optional and every one degrades to a documented behaviour rather than a failure:
+ * no `fetchImpl` uses the platform's, no `auditResolver` counts the drop, no `warn` swallows the
+ * deprecation notice, no `metricsResolver`/`logger` leaves the loss on the process-local total only.
+ */
+export interface ProviderOperationExecutorCollaborators {
+    /** The transport. Absent, the platform `fetch` is used — a test substitutes here. */
+    fetchImpl?: HttpApiFetchLike;
+    /** The outbound-call trail's sink, lazily resolved. See {@link ProviderOperationAuditResolver}. */
+    auditResolver?: ProviderOperationAuditResolver;
+    /** Where a vendor deprecation notice goes. Once per operation, never per call. */
+    warn?: (message: string) => void;
+    /** The loss counter behind both observations. Consulted ONLY when there is a drop to record. */
+    metricsResolver?: AuditObservationLossMetricsResolver;
+    /** The always-available loss channel — one throttled `error` line per `(observation, reason)`. */
+    logger?: AuditObservationLossLogger;
+}
 export declare class ProviderOperationExecutorBackendService {
     private readonly externalProvidersRegistry;
     private readonly providerAccessResolver;
-    private readonly fetchImpl?;
-    private readonly auditResolver?;
-    private readonly warn;
-    private readonly credentialUseRecorder?;
     /** Per `(providerRef, domain)`, exactly as the loader's contract promises. */
     private readonly catalogueCache;
     /** Per provider, so the rate window survives between calls. */
     private readonly clientCache;
     /** Deprecation is logged once per operation, never per call — a log nobody can read is not a warning. */
     private readonly deprecationsWarned;
-    constructor(externalProvidersRegistry: ExternalProvidersRegistryBackendService, providerAccessResolver: HttpApiProviderAccessResolver, fetchImpl?: HttpApiFetchLike, auditResolver?: ProviderOperationAuditResolver, warn?: (message: string) => void, credentialUseRecorder?: ProviderCredentialUseRecorder);
+    private readonly fetchImpl?;
+    private readonly auditResolver?;
+    private readonly warn;
+    private readonly metricsResolver?;
+    private readonly logger?;
+    /**
+     * Two required collaborators, then a BAG — and the bag is a correction rather than a style choice.
+     *
+     * The optional tail used to be five positional parameters, and inserting one silently reassigned
+     * whatever a caller had passed after it. That is measured, not hypothetical: adding the credential
+     * recorder before `warn` handed the deprecation test's spy to the recorder slot, so the warning was
+     * recorded by nobody and a pin about vendor deprecation failed for a reason that had nothing to do
+     * with it. The comment left behind told the next author to APPEND — which works exactly until two
+     * people append in parallel, and does nothing for a caller who miscounts `undefined`s.
+     *
+     * A bag removes the failure mode instead of documenting it: every collaborator is named at the call
+     * site, and adding one cannot move another.
+     */
+    constructor(externalProvidersRegistry: ExternalProvidersRegistryBackendService, providerAccessResolver: HttpApiProviderAccessResolver, collaborators?: ProviderOperationExecutorCollaborators);
     /**
      * The provider's `rest` runtime contract, refusing by NAME when there is none: every branch here
      * is an authoring or configuration gap someone must fix, never a transient.
@@ -230,27 +254,53 @@ export declare class ProviderOperationExecutorBackendService {
         readonly domain?: string;
     }): ProviderOperationExecute;
     execute<TOutput = unknown>(call: ProviderOperationCallInput, executionContext: ExecutionContext<any>): Promise<ProviderOperationCallResult<TOutput>>;
-    /**
-     * Record one outbound call. Fire-and-forget and feature-detected, per the house pattern: a
-     * partial audit binding or a store failure must never fail the call it observes.
-     *
-     * Called on BOTH the success and the failure path deliberately — a refused or failed outbound
-     * call is exactly what a reviewer wants to see, and a trail that records only what worked is a
-     * trail that hides the attempts.
-     */
     /**
      * Stamp the stored credential with what the provider said. Best-effort, and after the call.
      *
-     * Fire-and-forget for the same reason the audit emit is: the outbound call has already happened, so
+     * Fire-and-forget for the reason the audit emit is: the outbound call has already happened, so
      * failing the caller because a bookkeeping write did not land would turn a successful integration
-     * into an error. Nothing downstream reads the result, and the store logs its own failures with the
-     * row named.
+     * into an error. What is NEW is that a drop is now COUNTED — this seam spent its whole life behind
+     * a constructor parameter the container never passed, so every outbound call found no recorder and
+     * wrote nothing, and every credential that had in fact just worked still read as never tried. A
+     * silence nobody counts is how that survives; {@link AuditObservationKind.PROVIDER_CREDENTIAL_USE}
+     * is what ends it.
+     *
+     * ## Why the REGISTRY and not a store
      *
-     * Only a tenant's OWN credential has a row. An APPLICATION-owned resolution carries no provenance
-     * and is skipped here rather than filtered later, so the deployment environment can never acquire a
-     * row describing a credential the tenant never set.
+     * Because the executor cannot route this correctly and must not try. `target.ownerId` is a USER id
+     * whenever `ownerScope` is `USER` (#333's two-axis connection shape), so a recorder typed with an
+     * `organizationId` — which is exactly what the dead parameter was — would have stamped a tenant row
+     * that does not exist and emitted an organization audit event naming a user id as the organization.
+     * `recordProviderSecretUseForTarget` dispatches by the same rule, in the same order, as the
+     * resolution that produced this credential, so *the store that was read is the store that is
+     * stamped* is a property of one function rather than an agreement between two.
+     *
+     * Only a call whose credential came from a STORE has a row: an APPLICATION-owned resolution carries
+     * no provenance and is skipped here rather than filtered later, so the deployment environment can
+     * never acquire a row describing a credential the tenant never set.
      */
     private recordCredentialOutcome;
+    /**
+     * Record one outbound call. Fire-and-forget and feature-detected, per the house pattern: a partial
+     * audit binding or a store failure must never fail the call it observes.
+     *
+     * Called on BOTH the success and the failure path deliberately — a refused or failed outbound call
+     * is exactly what a reviewer wants to see, and a trail that records only what worked is a trail
+     * that hides the attempts.
+     *
+     * Routed through {@link emitAuditObservation} so that an absent sink is COUNTED. That matters more
+     * here than almost anywhere: an empty outbound trail reads as "this deployment integrates with
+     * nothing", which is a sentence somebody will believe.
+     *
+     * assurance-control: WILDO.AUDIT.ATTRIBUTION
+     */
     private record;
+    /**
+     * The audit service, or `undefined` when nothing is bound.
+     *
+     * Its own `try`: resolving a container binding may throw, and that throw must be a
+     * SERVICE_UNAVAILABLE loss rather than an exception on the outbound call's own path.
+     */
+    private resolveAuditLogsService;
 }
 //# sourceMappingURL=provider-operation-executor.backend.service.d.ts.map

package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-operation-executor.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/external-providers/operations/provider-operation-executor.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAOH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,KAAK,EAAE,wBAAwB,EAA6B,qBAAqB,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAEvK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2FAA2F,CAAC;AAClI,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iGAAiG,CAAC;AAErJ,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAK1J,2FAA2F;AAC3F,oBAAY,kCAAkC;IAC5C,4FAA4F;IAC5F,iBAAiB,sBAAsB;IACvC,kFAAkF;IAClF,+BAA+B,oCAAoC;IACnE,8DAA8D;IAC9D,0BAA0B,+BAA+B;IACzD,uCAAuC;IACvC,qBAAqB,0BAA0B;CAChD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;aAGnC,MAAM,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;QAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;KAC1B;gBAND,OAAO,EAAE,MAAM,EACC,MAAM,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;QAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;KAC1B;CAKJ;AAED;;;;;;;;GAQG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG,MAAM;IAChD,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE;QAC1B,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3D,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB,GAAG,SAAS,CAAC;AAEd,MAAM,MAAM,8BAA8B,GAAG,MAAM;IACjD,wBAAwB,CAAC,EAAE,CACzB,IAAI,EAAE,4BAA4B,EAClC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,GAAG,SAAS,CAAC;AAEd;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,iCAAiC,CAAC;CAChD;AAED,MAAM,WAAW,2BAA2B,CAAC,OAAO,GAAG,OAAO;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,MAAM,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,qBAAa,uCAAuC;IAShD,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAKrB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAjBzC,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8D;IAC7F,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IACzE,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;gBAGrC,yBAAyB,EAAE,uCAAuC,EAClE,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,CAAC,EAAE,gBAAgB,EAC5B,aAAa,CAAC,EAAE,8BAA8B,EAC9C,IAAI,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAsB,EAKjD,qBAAqB,CAAC,EAAE,6BAA6B;IAGxE;;;OAGG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;OAMG;IACU,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA0CzG,4BAA4B;IACf,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAexH,OAAO,CAAC,SAAS;IAUjB,iDAAiD;IACjD;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,YAAY,CACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,iCAAiC,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/F,wBAAwB;IAgBd,OAAO,CAAC,OAAO,GAAG,OAAO,EACpC,IAAI,EAAE,0BAA0B,EAChC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAuEhD;;;;;;;OAOG;IACH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;IAwB/B,OAAO,CAAC,MAAM;CA6Bf"}
+{"version":3,"file":"provider-operation-executor.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/operations/provider-operation-executor.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAOH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,KAAK,EAAE,wBAAwB,EAA6B,qBAAqB,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAEvK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2FAA2F,CAAC;AAClI,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,iGAAiG,CAAC;AAC5K,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,mCAAmC,EACzC,MAAM,gFAAgF,CAAC;AAExF,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAK1J,2FAA2F;AAC3F,oBAAY,kCAAkC;IAC5C,4FAA4F;IAC5F,iBAAiB,sBAAsB;IACvC,kFAAkF;IAClF,+BAA+B,oCAAoC;IACnE,8DAA8D;IAC9D,0BAA0B,+BAA+B;IACzD,uCAAuC;IACvC,qBAAqB,0BAA0B;CAChD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;aAGnC,MAAM,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;QAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;KAC1B;gBAND,OAAO,EAAE,MAAM,EACC,MAAM,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;QAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;KAC1B;CAKJ;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,8BAA8B,GAAG,MAAM;IACjD,wBAAwB,CAAC,EAAE,CACzB,IAAI,EAAE,4BAA4B,EAClC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,GAAG,SAAS,CAAC;AAEd;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,iCAAiC,CAAC;CAChD;AAED,MAAM,WAAW,2BAA2B,CAAC,OAAO,GAAG,OAAO;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,MAAM,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sCAAsC;IACrD,qFAAqF;IACrF,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,mGAAmG;IACnG,aAAa,CAAC,EAAE,8BAA8B,CAAC;IAC/C,kFAAkF;IAClF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,gGAAgG;IAChG,eAAe,CAAC,EAAE,mCAAmC,CAAC;IACtD,kGAAkG;IAClG,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED,qBAAa,uCAAuC;IA4BhD,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IA5BzC,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8D;IAC7F,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IACzE,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IAExD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAsC;IACvE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA6B;IAErD;;;;;;;;;;;;OAYG;gBAEgB,yBAAyB,EAAE,uCAAuC,EAClE,sBAAsB,EAAE,6BAA6B,EACtE,aAAa,GAAE,sCAA2C;IAS5D;;;OAGG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;OAMG;IACU,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA0CzG,4BAA4B;IACf,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAexH,OAAO,CAAC,SAAS;IAUjB,iDAAiD;IACjD;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,YAAY,CACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,iCAAiC,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/F,wBAAwB;IAgBd,OAAO,CAAC,OAAO,GAAG,OAAO,EACpC,IAAI,EAAE,0BAA0B,EAChC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAuEhD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,uBAAuB;IAuB/B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,MAAM;IAkCd;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;CAOhC"}

package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.js

@@ -20,14 +20,17 @@
  *   #333, which retired that mode for the two-axis `ExternalProvider_ConnectionShape` and lifted
  *   the refusal — neither change reached this class, which is the point of asking the port.
  * - **It does not page.** `pagination` on an operation is a hint the caller reads.
- * - **It does not AUDIT — yet, and this is the one gap worth stating loudly.** The seam is built
- *   and called on every outbound call (`ProviderOperationAuditResolver`, the lazily-resolved thunk
- *   this repository uses for the same job in the HTTP-API repository), but the
- *   `CoreAuditableEventType` member and the audit-logs method behind it belong to S3b, which the
- *   plan's seam table requires to agree the event NAMES with S5a before either commits. So the
- *   emission point exists and answers nothing until S3b writes the sink. That is a real hole, not
- *   a design: an application calling a vendor on a user's behalf must leave a trail, and until
- *   S3b lands it leaves none.
+ * - **It does not OWN the trail, but it does emit one.** Two observations leave here on every call —
+ *   the outbound-call row (`CoreAuditableEventType.PROVIDER_OPERATION_CALL`, through the lazily
+ *   resolved `ProviderOperationAuditResolver`) and the credential-use stamp (through the registry,
+ *   which knows which store the credential came from). Both are fire-and-forget and neither can fail
+ *   the call it observes; both are counted when they are lost, which is the half that was missing.
+ *
+ *   Stated loudly because it was false for months and nothing said so: the two seams existed, were
+ *   called on every outbound call, and had NOTHING behind them — the container constructed this class
+ *   with two of its six parameters, so both resolvers were `undefined` for the process's whole life,
+ *   and one of the two sinks had never been written at all. An application calling a vendor on a
+ *   user's behalf left no trail whatsoever, and the code read as though it did.
  *
  * ## Bound by FACTORY, not by decoration
  *
@@ -48,6 +51,7 @@
  */
 import { ExternalProvider_ExchangeProtocol_Kind, ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-models';
 import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope, } from '@wildo-ai/external-connectors-models';
+import { AuditObservationKind, emitAuditObservation, } from '../../monitoring/observability/audit-observation-emission.backend.js';
 import { resolveHttpApiResultPath } from '../../base-classes/services/repositories/http-api/http-api-row-projection.backend.js';
 import { compileProviderOperationRequest, ProviderOperationRequestError, ProviderOperationRequestFailureKind } from './provider-operation-request.backend.js';
 import { DEFAULT_PROVIDER_REST_CALL_SEMANTICS, ProviderRestCallClient } from './provider-rest-call-client.backend.js';
@@ -74,28 +78,38 @@ export class ProviderOperationLookupError extends Error {
 export class ProviderOperationExecutorBackendService {
     externalProvidersRegistry;
     providerAccessResolver;
-    fetchImpl;
-    auditResolver;
-    warn;
-    credentialUseRecorder;
     /** Per `(providerRef, domain)`, exactly as the loader's contract promises. */
     catalogueCache = new Map();
     /** Per provider, so the rate window survives between calls. */
     clientCache = new Map();
     /** Deprecation is logged once per operation, never per call — a log nobody can read is not a warning. */
     deprecationsWarned = new Set();
-    constructor(externalProvidersRegistry, providerAccessResolver, fetchImpl, auditResolver, warn = () => undefined, 
-    // APPENDED rather than slotted beside its sibling thunk: every parameter here is positional, and
-    // inserting one silently reassigns whatever a caller passed after it. Measured — putting it
-    // before `warn` handed the deprecation test's spy to this slot, so the warning was recorded by
-    // nobody and a pin about vendor deprecation failed for a reason that had nothing to do with it.
-    credentialUseRecorder) {
+    fetchImpl;
+    auditResolver;
+    warn;
+    metricsResolver;
+    logger;
+    /**
+     * Two required collaborators, then a BAG — and the bag is a correction rather than a style choice.
+     *
+     * The optional tail used to be five positional parameters, and inserting one silently reassigned
+     * whatever a caller had passed after it. That is measured, not hypothetical: adding the credential
+     * recorder before `warn` handed the deprecation test's spy to the recorder slot, so the warning was
+     * recorded by nobody and a pin about vendor deprecation failed for a reason that had nothing to do
+     * with it. The comment left behind told the next author to APPEND — which works exactly until two
+     * people append in parallel, and does nothing for a caller who miscounts `undefined`s.
+     *
+     * A bag removes the failure mode instead of documenting it: every collaborator is named at the call
+     * site, and adding one cannot move another.
+     */
+    constructor(externalProvidersRegistry, providerAccessResolver, collaborators = {}) {
         this.externalProvidersRegistry = externalProvidersRegistry;
         this.providerAccessResolver = providerAccessResolver;
-        this.fetchImpl = fetchImpl;
-        this.auditResolver = auditResolver;
-        this.warn = warn;
-        this.credentialUseRecorder = credentialUseRecorder;
+        this.fetchImpl = collaborators.fetchImpl;
+        this.auditResolver = collaborators.auditResolver;
+        this.warn = collaborators.warn ?? (() => undefined);
+        this.metricsResolver = collaborators.metricsResolver;
+        this.logger = collaborators.logger;
     }
     /**
      * The provider's `rest` runtime contract, refusing by NAME when there is none: every branch here
@@ -263,70 +277,102 @@ export class ProviderOperationExecutorBackendService {
             throw error;
         }
     }
-    /**
-     * Record one outbound call. Fire-and-forget and feature-detected, per the house pattern: a
-     * partial audit binding or a store failure must never fail the call it observes.
-     *
-     * Called on BOTH the success and the failure path deliberately — a refused or failed outbound
-     * call is exactly what a reviewer wants to see, and a trail that records only what worked is a
-     * trail that hides the attempts.
-     */
     /**
      * Stamp the stored credential with what the provider said. Best-effort, and after the call.
      *
-     * Fire-and-forget for the same reason the audit emit is: the outbound call has already happened, so
+     * Fire-and-forget for the reason the audit emit is: the outbound call has already happened, so
      * failing the caller because a bookkeeping write did not land would turn a successful integration
-     * into an error. Nothing downstream reads the result, and the store logs its own failures with the
-     * row named.
+     * into an error. What is NEW is that a drop is now COUNTED — this seam spent its whole life behind
+     * a constructor parameter the container never passed, so every outbound call found no recorder and
+     * wrote nothing, and every credential that had in fact just worked still read as never tried. A
+     * silence nobody counts is how that survives; {@link AuditObservationKind.PROVIDER_CREDENTIAL_USE}
+     * is what ends it.
+     *
+     * ## Why the REGISTRY and not a store
+     *
+     * Because the executor cannot route this correctly and must not try. `target.ownerId` is a USER id
+     * whenever `ownerScope` is `USER` (#333's two-axis connection shape), so a recorder typed with an
+     * `organizationId` — which is exactly what the dead parameter was — would have stamped a tenant row
+     * that does not exist and emitted an organization audit event naming a user id as the organization.
+     * `recordProviderSecretUseForTarget` dispatches by the same rule, in the same order, as the
+     * resolution that produced this credential, so *the store that was read is the store that is
+     * stamped* is a property of one function rather than an agreement between two.
      *
-     * Only a tenant's OWN credential has a row. An APPLICATION-owned resolution carries no provenance
-     * and is skipped here rather than filtered later, so the deployment environment can never acquire a
-     * row describing a credential the tenant never set.
+     * Only a call whose credential came from a STORE has a row: an APPLICATION-owned resolution carries
+     * no provenance and is skipped here rather than filtered later, so the deployment environment can
+     * never acquire a row describing a credential the tenant never set.
      */
     recordCredentialOutcome(providerRef, target, access, outcome) {
         const provenance = access.credentialProvenance;
         if (!provenance || target.ownerId === undefined)
             return;
-        try {
-            const store = this.credentialUseRecorder?.();
-            if (typeof store?.recordCredentialUse !== 'function')
-                return;
-            void store.recordCredentialUse({
-                organizationId: target.ownerId,
-                providerRef,
-                secretSlug: provenance.secretSlug,
-                source: provenance.source,
-                credentialId: provenance.credentialId,
-                outcome,
-            }).catch(() => undefined);
-        }
-        catch {
-            // A recorder that throws on resolution must not take the call down with it.
-        }
+        // Feature-detected on the METHOD, not the object: a registry double built with `as never`
+        // (several proof harnesses are) is truthy and may model only what the call path needed. Detecting
+        // here reports the honest SERVICE_UNAVAILABLE instead of an EMISSION_THREW TypeError.
+        const registry = this.externalProvidersRegistry;
+        emitAuditObservation({
+            observation: AuditObservationKind.PROVIDER_CREDENTIAL_USE,
+            emit: typeof registry.recordProviderSecretUseForTarget === 'function'
+                ? () => registry.recordProviderSecretUseForTarget(target, providerRef, provenance, outcome)
+                : undefined,
+            metricsResolver: this.metricsResolver,
+            logger: this.logger,
+            context: { providerRef, ownerScope: target.ownerScope, secretSlug: provenance.secretSlug },
+        });
     }
+    /**
+     * Record one outbound call. Fire-and-forget and feature-detected, per the house pattern: a partial
+     * audit binding or a store failure must never fail the call it observes.
+     *
+     * Called on BOTH the success and the failure path deliberately — a refused or failed outbound call
+     * is exactly what a reviewer wants to see, and a trail that records only what worked is a trail
+     * that hides the attempts.
+     *
+     * Routed through {@link emitAuditObservation} so that an absent sink is COUNTED. That matters more
+     * here than almost anywhere: an empty outbound trail reads as "this deployment integrates with
+     * nothing", which is a sentence somebody will believe.
+     *
+     * assurance-control: WILDO.AUDIT.ATTRIBUTION
+     */
     record(providerRef, operation, target, executionContext, outcome) {
+        const auditLogsService = this.resolveAuditLogsService();
+        const initiatorIds = executionContext.initiatorIds;
+        const emit = auditLogsService?.logProviderOperationCall;
+        emitAuditObservation({
+            observation: AuditObservationKind.PROVIDER_OPERATION_CALL,
+            emit: typeof emit === 'function'
+                ? () => emit.call(auditLogsService, {
+                    providerRef,
+                    operationId: operation.operationId,
+                    domain: operation.domain,
+                    method: operation.method,
+                    classification: operation.classification,
+                    connectionOwnerScope: target.ownerScope,
+                    ...(target.ownerId === undefined ? {} : { connectionOwnerId: target.ownerId }),
+                    connectionDelegation: target.delegation,
+                    initiatorUserId: initiatorIds?.userId,
+                    organizationId: initiatorIds?.organizationId,
+                    executionType: executionContext.executionType,
+                    ...outcome,
+                }, executionContext)
+                : undefined,
+            metricsResolver: this.metricsResolver,
+            logger: this.logger,
+            context: { providerRef, operationId: operation.operationId },
+        });
+    }
+    /**
+     * The audit service, or `undefined` when nothing is bound.
+     *
+     * Its own `try`: resolving a container binding may throw, and that throw must be a
+     * SERVICE_UNAVAILABLE loss rather than an exception on the outbound call's own path.
+     */
+    resolveAuditLogsService() {
         try {
-            const auditLogsService = this.auditResolver?.();
-            if (typeof auditLogsService?.logProviderOperationCall !== 'function')
-                return;
-            const initiatorIds = executionContext.initiatorIds;
-            void auditLogsService.logProviderOperationCall({
-                providerRef,
-                operationId: operation.operationId,
-                domain: operation.domain,
-                method: operation.method,
-                classification: operation.classification,
-                connectionOwnerScope: target.ownerScope,
-                ...(target.ownerId === undefined ? {} : { connectionOwnerId: target.ownerId }),
-                connectionDelegation: target.delegation,
-                initiatorUserId: initiatorIds?.userId,
-                organizationId: initiatorIds?.organizationId,
-                executionType: executionContext.executionType,
-                ...outcome,
-            }, executionContext)?.catch?.(() => undefined);
+            return this.auditResolver?.();
         }
         catch {
-            // Observation only — never the reason a call fails.
+            return undefined;
         }
     }
 }