[backend] Emit Missing Audit Events for Critical Bond Lifecycle Actions

[josueazc]

DESCRIPTION

Several critical actions in Velar do not emit any event to the audit_events table, creating gaps in the audit trail that undermine the platform's core promise of full traceability. This task adds the missing event emissions in the appropriate NestJS services using the existing AuditService.emit() pattern.

GOAL

Every critical lifecycle action on a bond or actor emits a corresponding audit event, making the on-chain and off-chain audit trail complete and gap-free.

REQUIREMENTS

• party_created → PartiesService.create()
• wallet_provisioned → WalletService.provisionWallet()
• bond_published → BondsService.publish()
• offer_rejected → TransfersService.reject()
• counter_offer_sent → TransfersService.counterOffer()
• Each event must include: type, bondTokenId (if applicable), actorId, payload (JSON), txHash (if applicable)
• Use the existing AuditService.emit() pattern — do not create new emission methods
• Add new event type constants to the AuditEventType enum in @velar/types

ACCEPTANCE CRITERIA

• All 5 events appear in audit_events after their corresponding actions are triggered
• Each event contains at minimum: type, actorId, payload, created_at
• New types are exported from packages/types
• Updated docs/audit-events.md or equivalent
• Work follows Velar monorepo structure
• No existing audit events or services are broken
• Can be reviewed by the team

NOTES

Relevant files: apps/api/src/parties/parties.service.ts, apps/api/src/wallets/wallet.service.ts, apps/api/src/bonds/bonds.service.ts, apps/api/src/transfers/transfers.service.ts, apps/api/src/audit/audit.service.ts, packages/types/. txHash may be null for non-blockchain actions (e.g. party_created). Confirm the audit_events table schema in supabase/migrations/ before inserting.

---

Difficulty: Intermediate
Priority: High

[Damidesign]

I would love to tackle this backend issue. I have strong experience building decentralized applications and setting up robust server-side monitoring and tracking logic. I can systematically trace the bond lifecycle flows in the codebase, identify where the missing audit events need to be triggered, and implement clean, structured event emissions for all critical actions. I can get started immediately and submit a PR within 2 days.