@de-otio/chaoskb-server 0.2.0 → 0.2.2

package/dist/lib/handler/routes/register.js

@@ -43,6 +43,7 @@ const audit_js_1 = require("./audit.js");
 const client_ssm_1 = require("@aws-sdk/client-ssm");
 const logger_js_1 = require("../logger.js");
 const github_js_1 = require("./github.js");
+const notifications_js_1 = require("./notifications.js");
 const CHALLENGE_EXPIRY_SECONDS = 60;
 const JSON_HEADERS = { 'Content-Type': 'application/json' };
 let cachedSignupsEnabled = null;
@@ -121,24 +122,24 @@ async function handleChallenge(ddb, tableName) {
     const nonce = crypto.randomBytes(32).toString('base64');
     const now = Math.floor(Date.now() / 1000);
     const ttl = now + CHALLENGE_EXPIRY_SECONDS + 60; // DynamoDB TTL: generous buffer
-    const expiresAt = new Date((now + CHALLENGE_EXPIRY_SECONDS) * 1000).toISOString();
+    const expiresAtISO = new Date((now + CHALLENGE_EXPIRY_SECONDS) * 1000).toISOString();
     await ddb.send(new lib_dynamodb_1.PutCommand({
         TableName: tableName,
         Item: {
             PK: `CHALLENGE#${nonce}`,
             SK: 'META',
-            expiresAt,
-            ttl,
+            expiresAtISO,
+            expiresAt: ttl,
         },
     }));
     logger_js_1.logger.info('Registration challenge created');
     return {
         statusCode: 200,
         headers: JSON_HEADERS,
-        body: JSON.stringify({ challenge: nonce, expiresAt }),
+        body: JSON.stringify({ challenge: nonce, expiresAt: expiresAtISO }),
     };
 }
-async function handleRegister(body, ddb, tableName, signupsParamName) {
+async function handleRegister(body, ddb, tableName, signupsParamName, headers = {}) {
     // Check if signups are enabled
     const signupsEnabled = await checkSignupsEnabled(signupsParamName);
     if (!signupsEnabled) {
@@ -188,39 +189,39 @@ async function handleRegister(body, ddb, tableName, signupsParamName) {
             body: JSON.stringify({ error: 'invalid_request', message: 'Invalid SSH public key format' }),
         };
     }
-    // Look up and consume the challenge nonce (single-use)
-    const challengeResult = await ddb.send(new lib_dynamodb_1.GetCommand({
-        TableName: tableName,
-        Key: {
-            PK: `CHALLENGE#${request.challengeNonce}`,
-            SK: 'META',
-        },
-    }));
-    if (!challengeResult.Item) {
-        return {
-            statusCode: 400,
-            headers: JSON_HEADERS,
-            body: JSON.stringify({ error: 'invalid_challenge', message: 'Challenge not found or already used' }),
-        };
-    }
-    // Check challenge expiry
-    if (new Date(challengeResult.Item['expiresAt']) < new Date()) {
-        // Clean up expired challenge
-        await ddb.send(new lib_dynamodb_1.DeleteCommand({
+    // Atomically consume the challenge nonce (single-use).
+    // Uses conditional delete to prevent TOCTOU race: only one request can consume a given nonce.
+    let challengeItem;
+    try {
+        const deleteResult = await ddb.send(new lib_dynamodb_1.DeleteCommand({
             TableName: tableName,
-            Key: { PK: `CHALLENGE#${request.challengeNonce}`, SK: 'META' },
+            Key: {
+                PK: `CHALLENGE#${request.challengeNonce}`,
+                SK: 'META',
+            },
+            ConditionExpression: 'attribute_exists(PK)',
+            ReturnValues: 'ALL_OLD',
         }));
+        challengeItem = deleteResult.Attributes;
+    }
+    catch (err) {
+        if (err.name === 'ConditionalCheckFailedException') {
+            return {
+                statusCode: 400,
+                headers: JSON_HEADERS,
+                body: JSON.stringify({ error: 'invalid_challenge', message: 'Challenge not found or already used' }),
+            };
+        }
+        throw err;
+    }
+    // Check challenge expiry on the consumed item
+    if (!challengeItem || new Date(challengeItem['expiresAtISO']) < new Date()) {
         return {
             statusCode: 400,
             headers: JSON_HEADERS,
             body: JSON.stringify({ error: 'challenge_expired', message: 'Challenge has expired' }),
         };
     }
-    // Consume the challenge (delete it — single-use)
-    await ddb.send(new lib_dynamodb_1.DeleteCommand({
-        TableName: tableName,
-        Key: { PK: `CHALLENGE#${request.challengeNonce}`, SK: 'META' },
-    }));
     // Verify the SSH signature of the challenge nonce against the public key
     const validSignature = verifyRegistrationSignature(request.publicKey, request.challengeNonce, request.signedChallenge);
     if (!validSignature) {
@@ -233,45 +234,79 @@ async function handleRegister(body, ddb, tableName, signupsParamName) {
     }
     // GitHub verification (if --github was provided)
     if (request.github) {
+        let keyVerified = false;
         try {
-            const keyOnGitHub = await (0, github_js_1.verifyKeyOnGitHub)(request.publicKey, request.github);
-            if (!keyOnGitHub) {
+            keyVerified = await (0, github_js_1.verifyKeyOnGitHub)(request.publicKey, request.github);
+        }
+        catch {
+            // GitHub unreachable or user not found — uniform response
+        }
+        if (!keyVerified) {
+            return {
+                statusCode: 400,
+                headers: JSON_HEADERS,
+                body: JSON.stringify({
+                    error: 'github_verification_failed',
+                    message: 'Could not verify key against this GitHub account',
+                }),
+            };
+        }
+        // Check if an existing tenant is associated with this GitHub username (auto-link)
+        const existingTenantId = await (0, github_js_1.findTenantByGitHub)(request.github, ddb, tableName);
+        if (existingTenantId) {
+            // Fresh-fetch GitHub keys (bypass cache) to ensure both device keys still appear
+            let freshKeys;
+            try {
+                freshKeys = await (0, github_js_1.fetchGitHubKeysFresh)(request.github);
+            }
+            catch {
+                // GitHub unreachable at auto-link time — fall back to normal registration
+                freshKeys = [];
+            }
+            // Verify the new device's key appears on the GitHub account (fresh data)
+            if (freshKeys.length > 0 && !(0, github_js_1.keyAppearsInGitHubKeys)(request.publicKey, freshKeys)) {
                 return {
                     statusCode: 400,
                     headers: JSON_HEADERS,
                     body: JSON.stringify({
-                        error: 'github_key_not_found',
-                        message: `Public key not found on GitHub account "${request.github}"`,
+                        error: 'github_verification_failed',
+                        message: 'Could not verify key against this GitHub account',
                     }),
                 };
             }
-        }
-        catch (err) {
-            if (err instanceof github_js_1.GitHubVerificationError) {
+            if (freshKeys.length > 0) {
+                // Resolve location from CloudFront headers for the notification
+                const location = (0, notifications_js_1.resolveIpLocation)(headers);
+                const deviceInfo = {
+                    ...request.deviceInfo,
+                    location,
+                };
+                // Create notification for existing devices
+                await (0, notifications_js_1.createNotification)(existingTenantId, 'device_linked', deviceInfo, ddb, tableName);
+                // Audit event
+                await (0, audit_js_1.logAuditEvent)(ddb, tableName, existingTenantId, {
+                    eventType: 'device-linked',
+                    fingerprint: '',
+                    metadata: {
+                        publicKey: request.publicKey,
+                        github: request.github,
+                        ...(deviceInfo.hostname && { hostname: deviceInfo.hostname }),
+                    },
+                });
+                logger_js_1.logger.info('GitHub auto-link: existing tenant found', {
+                    existingTenantId,
+                    github: request.github,
+                });
                 return {
-                    statusCode: 400,
+                    statusCode: 200,
                     headers: JSON_HEADERS,
-                    body: JSON.stringify({ error: err.code, message: err.message }),
+                    body: JSON.stringify({
+                        status: 'auto_linked',
+                        github: request.github,
+                    }),
                 };
             }
-            throw err;
-        }
-        // Check if an existing tenant is associated with this GitHub username (auto-link)
-        const existingTenantId = await (0, github_js_1.findTenantByGitHub)(request.github, ddb, tableName);
-        if (existingTenantId) {
-            logger_js_1.logger.info('GitHub auto-link: existing tenant found', {
-                existingTenantId,
-                github: request.github,
-            });
-            return {
-                statusCode: 200,
-                headers: JSON_HEADERS,
-                body: JSON.stringify({
-                    status: 'auto_linked',
-                    tenantId: existingTenantId,
-                    github: request.github,
-                }),
-            };
+            // If fresh keys unavailable, fall through to normal registration
         }
     }
     const tenantId = tenantIdFromPublicKey(request.publicKey);
@@ -292,8 +327,19 @@ async function handleRegister(body, ddb, tableName, signupsParamName) {
         logger_js_1.logger.info('Tenant registered', { tenantId, operation: 'register' });
         // Store GitHub association if provided
         if (request.github) {
+            const claimed = await (0, github_js_1.storeGitHubReverseLookup)(request.github, tenantId, ddb, tableName);
+            if (!claimed) {
+                // Another tenant already claimed this GitHub username — uniform error
+                return {
+                    statusCode: 400,
+                    headers: JSON_HEADERS,
+                    body: JSON.stringify({
+                        error: 'github_verification_failed',
+                        message: 'Could not verify key against this GitHub account',
+                    }),
+                };
+            }
             await (0, github_js_1.storeGitHubAssociation)(tenantId, request.github, ddb, tableName);
-            await (0, github_js_1.storeGitHubReverseLookup)(request.github, tenantId, ddb, tableName);
         }
         await (0, audit_js_1.logAuditEvent)(ddb, tableName, tenantId, {
             eventType: 'registered',

package/dist/lib/handler/routes/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../../lib/handler/routes/register.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,kDAkBC;AAGD,gDAEC;AAyDD,0CA4BC;AAED,wCA0NC;AA1WD,+CAAiC;AACjC,wDAAsG;AACtG,yCAA2C;AAC3C,oDAAqE;AACrE,4CAAsC;AACtC,2CAMqB;AAerB,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;AAE5D,IAAI,oBAAoB,GAAiD,IAAI,CAAC;AAC9E,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEhD,MAAM,SAAS,GAAG,IAAI,sBAAS,CAAC,EAAE,CAAC,CAAC;AAE7B,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,oBAAoB,IAAI,GAAG,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;QACjE,OAAO,oBAAoB,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CACjC,IAAI,gCAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAC7C,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,KAAK,OAAO,CAAC;QAClD,oBAAoB,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,YAAY,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kBAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,8CAA8C;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uBAAuB;AACvB,SAAgB,kBAAkB;IAChC,oBAAoB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,eAAuB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,yDAAyD;IACzD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,2BAA2B,CAClC,eAAuB,EACvB,KAAa,EACb,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;QAEvD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;gBACjB,8CAA8C;gBAC9C,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC;gBAC9C,eAAe;aAChB,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,GAA2B,EAC3B,SAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,wBAAwB,GAAG,EAAE,CAAC,CAAC,gCAAgC;IACjF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAElF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE;YACJ,EAAE,EAAE,aAAa,KAAK,EAAE;YACxB,EAAE,EAAE,MAAM;YACV,SAAS;YACT,GAAG;SACJ;KACF,CAAC,CACH,CAAC;IAEF,kBAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAE9C,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,IAA+B,EAC/B,GAA2B,EAC3B,SAAiB,EACjB,gBAAwB;IAExB,+BAA+B;IAC/B,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IACnE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;SACzG,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACxD,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;SAC/G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;SAC7F,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,IAAI,CACpC,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE;YACH,EAAE,EAAE,aAAa,OAAO,CAAC,cAAc,EAAE;YACzC,EAAE,EAAE,MAAM;SACX;KACF,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;SACrG,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAW,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvE,6BAA6B;QAC7B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;YAChB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;SAC/D,CAAC,CACH,CAAC;QACF,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;SACvF,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;KAC/D,CAAC,CACH,CAAC;IAEF,yEAAyE;IACzE,MAAM,cAAc,GAAG,2BAA2B,CAChD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,eAAe,CACxB,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,kBAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;SACzG,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAiB,EAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,YAAY;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,sBAAsB;wBAC7B,OAAO,EAAE,2CAA2C,OAAO,CAAC,MAAM,GAAG;qBACtE,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mCAAuB,EAAE,CAAC;gBAC3C,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,YAAY;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;iBAChE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,kFAAkF;QAClF,MAAM,gBAAgB,GAAG,MAAM,IAAA,8BAAkB,EAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAClF,IAAI,gBAAgB,EAAE,CAAC;YACrB,kBAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;gBACrD,gBAAgB;gBAChB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,yBAAU,CAAC;YACb,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,UAAU,QAAQ,EAAE;gBACxB,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;gBACd,gBAAgB,EAAE,CAAC;aACpB;YACD,mBAAmB,EAAE,0BAA0B;SAChD,CAAC,CACH,CAAC;QAEF,kBAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QAEtE,uCAAuC;QACvC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAA,kCAAsB,EAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YACvE,MAAM,IAAA,oCAAwB,EAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAA,wBAAa,EAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC5C,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAClD;SACF,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAClD,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAAyB,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC1E,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;aACxG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../../lib/handler/routes/register.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,kDAkBC;AAGD,gDAEC;AAyDD,0CA4BC;AAED,wCAsQC;AAzZD,+CAAiC;AACjC,wDAA0F;AAC1F,yCAA2C;AAC3C,oDAAqE;AACrE,4CAAsC;AACtC,2CAOqB;AACrB,yDAA4F;AAgB5F,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;AAE5D,IAAI,oBAAoB,GAAiD,IAAI,CAAC;AAC9E,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEhD,MAAM,SAAS,GAAG,IAAI,sBAAS,CAAC,EAAE,CAAC,CAAC;AAE7B,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,oBAAoB,IAAI,GAAG,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;QACjE,OAAO,oBAAoB,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CACjC,IAAI,gCAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAC7C,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,KAAK,OAAO,CAAC;QAClD,oBAAoB,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,YAAY,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kBAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,8CAA8C;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uBAAuB;AACvB,SAAgB,kBAAkB;IAChC,oBAAoB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,eAAuB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,yDAAyD;IACzD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,2BAA2B,CAClC,eAAuB,EACvB,KAAa,EACb,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;QAEvD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;gBACjB,8CAA8C;gBAC9C,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC;gBAC9C,eAAe;aAChB,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,GAA2B,EAC3B,SAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,wBAAwB,GAAG,EAAE,CAAC,CAAC,gCAAgC;IACjF,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAErF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE;YACJ,EAAE,EAAE,aAAa,KAAK,EAAE;YACxB,EAAE,EAAE,MAAM;YACV,YAAY;YACZ,SAAS,EAAE,GAAG;SACf;KACF,CAAC,CACH,CAAC;IAEF,kBAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAE9C,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,IAA+B,EAC/B,GAA2B,EAC3B,SAAiB,EACjB,gBAAwB,EACxB,UAAkC,EAAE;IAEpC,+BAA+B;IAC/B,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IACnE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;SACzG,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACxD,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;SAC/G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;SAC7F,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,8FAA8F;IAC9F,IAAI,aAAkD,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,IAAI,CACjC,IAAI,4BAAa,CAAC;YAChB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE;gBACH,EAAE,EAAE,aAAa,OAAO,CAAC,cAAc,EAAE;gBACzC,EAAE,EAAE,MAAM;aACX;YACD,mBAAmB,EAAE,sBAAsB;YAC3C,YAAY,EAAE,SAAS;SACxB,CAAC,CACH,CAAC;QACF,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAAyB,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC1E,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;aACrG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,8CAA8C;IAC9C,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,cAAc,CAAW,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACrF,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;SACvF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,cAAc,GAAG,2BAA2B,CAChD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,eAAe,CACxB,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,kBAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;SACzG,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAA,6BAAiB,EAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,4BAA4B;oBACnC,OAAO,EAAE,kDAAkD;iBAC5D,CAAC;aACH,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,MAAM,gBAAgB,GAAG,MAAM,IAAA,8BAAkB,EAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAClF,IAAI,gBAAgB,EAAE,CAAC;YACrB,iFAAiF;YACjF,IAAI,SAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,IAAA,gCAAoB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;gBAC1E,SAAS,GAAG,EAAE,CAAC;YACjB,CAAC;YAED,yEAAyE;YACzE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAA,kCAAsB,EAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;gBAClF,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,YAAY;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,4BAA4B;wBACnC,OAAO,EAAE,kDAAkD;qBAC5D,CAAC;iBACH,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,IAAA,oCAAiB,EAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,UAAU,GAAe;oBAC7B,GAAG,OAAO,CAAC,UAAU;oBACrB,QAAQ;iBACT,CAAC;gBAEF,2CAA2C;gBAC3C,MAAM,IAAA,qCAAkB,EAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;gBAExF,cAAc;gBACd,MAAM,IAAA,wBAAa,EAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE;oBACpD,SAAS,EAAE,eAAe;oBAC1B,WAAW,EAAE,EAAE;oBACf,QAAQ,EAAE;wBACR,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;qBAC9D;iBACF,CAAC,CAAC;gBAEH,kBAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACrD,gBAAgB;oBAChB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,YAAY;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC;iBACH,CAAC;YACJ,CAAC;YACD,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,yBAAU,CAAC;YACb,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,UAAU,QAAQ,EAAE;gBACxB,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;gBACd,gBAAgB,EAAE,CAAC;aACpB;YACD,mBAAmB,EAAE,0BAA0B;SAChD,CAAC,CACH,CAAC;QAEF,kBAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QAEtE,uCAAuC;QACvC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,IAAA,oCAAwB,EAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,sEAAsE;gBACtE,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,YAAY;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,4BAA4B;wBACnC,OAAO,EAAE,kDAAkD;qBAC5D,CAAC;iBACH,CAAC;YACJ,CAAC;YACD,MAAM,IAAA,kCAAsB,EAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,IAAA,wBAAa,EAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC5C,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAClD;SACF,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAClD,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAAyB,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC1E,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;aACxG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/lib/handler/routes/register.ts

@@ -1,21 +1,24 @@
 import * as crypto from 'crypto';
-import { DynamoDBDocumentClient, PutCommand, GetCommand, DeleteCommand } from '@aws-sdk/lib-dynamodb';
+import { DynamoDBDocumentClient, PutCommand, DeleteCommand } from '@aws-sdk/lib-dynamodb';
 import { logAuditEvent } from './audit.js';
 import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
 import { logger } from '../logger.js';
 import {
   verifyKeyOnGitHub,
+  fetchGitHubKeysFresh,
+  keyAppearsInGitHubKeys,
   storeGitHubAssociation,
   storeGitHubReverseLookup,
   findTenantByGitHub,
-  GitHubVerificationError,
 } from './github.js';
+import { createNotification, resolveIpLocation, type DeviceInfo } from './notifications.js';
 
 interface RegisterRequest {
   publicKey: string;
   signedChallenge: string;
   challengeNonce: string;
   github?: string;
+  deviceInfo?: DeviceInfo;
 }
 
 interface HandlerResponse {
@@ -119,7 +122,7 @@ export async function handleChallenge(
   const nonce = crypto.randomBytes(32).toString('base64');
   const now = Math.floor(Date.now() / 1000);
   const ttl = now + CHALLENGE_EXPIRY_SECONDS + 60; // DynamoDB TTL: generous buffer
-  const expiresAt = new Date((now + CHALLENGE_EXPIRY_SECONDS) * 1000).toISOString();
+  const expiresAtISO = new Date((now + CHALLENGE_EXPIRY_SECONDS) * 1000).toISOString();
 
   await ddb.send(
     new PutCommand({
@@ -127,8 +130,8 @@ export async function handleChallenge(
       Item: {
         PK: `CHALLENGE#${nonce}`,
         SK: 'META',
-        expiresAt,
-        ttl,
+        expiresAtISO,
+        expiresAt: ttl,
       },
     }),
   );
@@ -138,7 +141,7 @@ export async function handleChallenge(
   return {
     statusCode: 200,
     headers: JSON_HEADERS,
-    body: JSON.stringify({ challenge: nonce, expiresAt }),
+    body: JSON.stringify({ challenge: nonce, expiresAt: expiresAtISO }),
   };
 }
 
@@ -147,6 +150,7 @@ export async function handleRegister(
   ddb: DynamoDBDocumentClient,
   tableName: string,
   signupsParamName: string,
+  headers: Record<string, string> = {},
 ): Promise<HandlerResponse> {
   // Check if signups are enabled
   const signupsEnabled = await checkSignupsEnabled(signupsParamName);
@@ -202,34 +206,35 @@ export async function handleRegister(
     };
   }
 
-  // Look up and consume the challenge nonce (single-use)
-  const challengeResult = await ddb.send(
-    new GetCommand({
-      TableName: tableName,
-      Key: {
-        PK: `CHALLENGE#${request.challengeNonce}`,
-        SK: 'META',
-      },
-    }),
-  );
-
-  if (!challengeResult.Item) {
-    return {
-      statusCode: 400,
-      headers: JSON_HEADERS,
-      body: JSON.stringify({ error: 'invalid_challenge', message: 'Challenge not found or already used' }),
-    };
-  }
-
-  // Check challenge expiry
-  if (new Date(challengeResult.Item['expiresAt'] as string) < new Date()) {
-    // Clean up expired challenge
-    await ddb.send(
+  // Atomically consume the challenge nonce (single-use).
+  // Uses conditional delete to prevent TOCTOU race: only one request can consume a given nonce.
+  let challengeItem: Record<string, unknown> | undefined;
+  try {
+    const deleteResult = await ddb.send(
       new DeleteCommand({
         TableName: tableName,
-        Key: { PK: `CHALLENGE#${request.challengeNonce}`, SK: 'META' },
+        Key: {
+          PK: `CHALLENGE#${request.challengeNonce}`,
+          SK: 'META',
+        },
+        ConditionExpression: 'attribute_exists(PK)',
+        ReturnValues: 'ALL_OLD',
       }),
     );
+    challengeItem = deleteResult.Attributes;
+  } catch (err: unknown) {
+    if ((err as { name?: string }).name === 'ConditionalCheckFailedException') {
+      return {
+        statusCode: 400,
+        headers: JSON_HEADERS,
+        body: JSON.stringify({ error: 'invalid_challenge', message: 'Challenge not found or already used' }),
+      };
+    }
+    throw err;
+  }
+
+  // Check challenge expiry on the consumed item
+  if (!challengeItem || new Date(challengeItem['expiresAtISO'] as string) < new Date()) {
     return {
       statusCode: 400,
       headers: JSON_HEADERS,
@@ -237,14 +242,6 @@ export async function handleRegister(
     };
   }
 
-  // Consume the challenge (delete it — single-use)
-  await ddb.send(
-    new DeleteCommand({
-      TableName: tableName,
-      Key: { PK: `CHALLENGE#${request.challengeNonce}`, SK: 'META' },
-    }),
-  );
-
   // Verify the SSH signature of the challenge nonce against the public key
   const validSignature = verifyRegistrationSignature(
     request.publicKey,
@@ -263,45 +260,84 @@ export async function handleRegister(
 
   // GitHub verification (if --github was provided)
   if (request.github) {
+    let keyVerified = false;
     try {
-      const keyOnGitHub = await verifyKeyOnGitHub(request.publicKey, request.github);
-      if (!keyOnGitHub) {
+      keyVerified = await verifyKeyOnGitHub(request.publicKey, request.github);
+    } catch {
+      // GitHub unreachable or user not found — uniform response
+    }
+
+    if (!keyVerified) {
+      return {
+        statusCode: 400,
+        headers: JSON_HEADERS,
+        body: JSON.stringify({
+          error: 'github_verification_failed',
+          message: 'Could not verify key against this GitHub account',
+        }),
+      };
+    }
+
+    // Check if an existing tenant is associated with this GitHub username (auto-link)
+    const existingTenantId = await findTenantByGitHub(request.github, ddb, tableName);
+    if (existingTenantId) {
+      // Fresh-fetch GitHub keys (bypass cache) to ensure both device keys still appear
+      let freshKeys: string[];
+      try {
+        freshKeys = await fetchGitHubKeysFresh(request.github);
+      } catch {
+        // GitHub unreachable at auto-link time — fall back to normal registration
+        freshKeys = [];
+      }
+
+      // Verify the new device's key appears on the GitHub account (fresh data)
+      if (freshKeys.length > 0 && !keyAppearsInGitHubKeys(request.publicKey, freshKeys)) {
         return {
           statusCode: 400,
           headers: JSON_HEADERS,
           body: JSON.stringify({
-            error: 'github_key_not_found',
-            message: `Public key not found on GitHub account "${request.github}"`,
+            error: 'github_verification_failed',
+            message: 'Could not verify key against this GitHub account',
           }),
         };
       }
-    } catch (err) {
-      if (err instanceof GitHubVerificationError) {
+
+      if (freshKeys.length > 0) {
+        // Resolve location from CloudFront headers for the notification
+        const location = resolveIpLocation(headers);
+        const deviceInfo: DeviceInfo = {
+          ...request.deviceInfo,
+          location,
+        };
+
+        // Create notification for existing devices
+        await createNotification(existingTenantId, 'device_linked', deviceInfo, ddb, tableName);
+
+        // Audit event
+        await logAuditEvent(ddb, tableName, existingTenantId, {
+          eventType: 'device-linked',
+          fingerprint: '',
+          metadata: {
+            publicKey: request.publicKey,
+            github: request.github,
+            ...(deviceInfo.hostname && { hostname: deviceInfo.hostname }),
+          },
+        });
+
+        logger.info('GitHub auto-link: existing tenant found', {
+          existingTenantId,
+          github: request.github,
+        });
         return {
-          statusCode: 400,
+          statusCode: 200,
           headers: JSON_HEADERS,
-          body: JSON.stringify({ error: err.code, message: err.message }),
+          body: JSON.stringify({
+            status: 'auto_linked',
+            github: request.github,
+          }),
         };
       }
-      throw err;
-    }
-
-    // Check if an existing tenant is associated with this GitHub username (auto-link)
-    const existingTenantId = await findTenantByGitHub(request.github, ddb, tableName);
-    if (existingTenantId) {
-      logger.info('GitHub auto-link: existing tenant found', {
-        existingTenantId,
-        github: request.github,
-      });
-      return {
-        statusCode: 200,
-        headers: JSON_HEADERS,
-        body: JSON.stringify({
-          status: 'auto_linked',
-          tenantId: existingTenantId,
-          github: request.github,
-        }),
-      };
+      // If fresh keys unavailable, fall through to normal registration
     }
   }
 
@@ -328,8 +364,19 @@ export async function handleRegister(
 
     // Store GitHub association if provided
     if (request.github) {
+      const claimed = await storeGitHubReverseLookup(request.github, tenantId, ddb, tableName);
+      if (!claimed) {
+        // Another tenant already claimed this GitHub username — uniform error
+        return {
+          statusCode: 400,
+          headers: JSON_HEADERS,
+          body: JSON.stringify({
+            error: 'github_verification_failed',
+            message: 'Could not verify key against this GitHub account',
+          }),
+        };
+      }
       await storeGitHubAssociation(tenantId, request.github, ddb, tableName);
-      await storeGitHubReverseLookup(request.github, tenantId, ddb, tableName);
     }
 
     await logAuditEvent(ddb, tableName, tenantId, {

package/dist/lib/handler/routes/restore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../../../lib/handler/routes/restore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA6B,MAAM,uBAAuB,CAAC;AAG1F,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CA0D1B"}
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../../../lib/handler/routes/restore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA6B,MAAM,uBAAuB,CAAC;AAG1F,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAyD1B"}

package/dist/lib/handler/routes/restore.js

@@ -31,8 +31,7 @@ async function handleRestore(blobId, tenantId, ddb, tableName) {
     await ddb.send(new lib_dynamodb_1.UpdateCommand({
         TableName: tableName,
         Key: { PK: `TENANT#${tenantId}`, SK: `BLOB#${blobId}` },
-        UpdateExpression: 'REMOVE deletedAt, #ttl SET updatedAt = :updatedAt',
-        ExpressionAttributeNames: { '#ttl': 'ttl' },
+        UpdateExpression: 'REMOVE deletedAt, expiresAt SET updatedAt = :updatedAt',
         ExpressionAttributeValues: { ':updatedAt': now },
     }));
     // Re-increment storage used

package/dist/lib/handler/routes/restore.js.map

@@ -1 +1 @@
-{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../../lib/handler/routes/restore.ts"],"names":[],"mappings":";;AASA,sCA+DC;AAxED,wDAA0F;AAC1F,4CAAsC;AAQ/B,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,QAAgB,EAChB,GAA2B,EAC3B,SAAiB;IAEjB,kDAAkD;IAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,MAAM,EAAE,EAAE;QACvD,oBAAoB,EAAE,eAAe;QACrC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KAC3C,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAY,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,2BAA2B;IAC3B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,MAAM,EAAE,EAAE;QACvD,gBAAgB,EAAE,mDAAmD;QACrE,wBAAwB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3C,yBAAyB,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE;KACjD,CAAC,CACH,CAAC;IAEF,4BAA4B;IAC5B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;QAC7C,gBAAgB,EAAE,iDAAiD;QACnE,yBAAyB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;KACjD,CAAC,CACH,CAAC;IAEF,kBAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAEjE,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../../lib/handler/routes/restore.ts"],"names":[],"mappings":";;AASA,sCA8DC;AAvED,wDAA0F;AAC1F,4CAAsC;AAQ/B,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,QAAgB,EAChB,GAA2B,EAC3B,SAAiB;IAEjB,kDAAkD;IAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,MAAM,EAAE,EAAE;QACvD,oBAAoB,EAAE,eAAe;QACrC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KAC3C,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAY,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,2BAA2B;IAC3B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,MAAM,EAAE,EAAE;QACvD,gBAAgB,EAAE,wDAAwD;QAC1E,yBAAyB,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE;KACjD,CAAC,CACH,CAAC;IAEF,4BAA4B;IAC5B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;QAC7C,gBAAgB,EAAE,iDAAiD;QACnE,yBAAyB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;KACjD,CAAC,CACH,CAAC;IAEF,kBAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAEjE,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/lib/handler/routes/restore.ts

@@ -47,8 +47,7 @@ export async function handleRestore(
     new UpdateCommand({
       TableName: tableName,
       Key: { PK: `TENANT#${tenantId}`, SK: `BLOB#${blobId}` },
-      UpdateExpression: 'REMOVE deletedAt, #ttl SET updatedAt = :updatedAt',
-      ExpressionAttributeNames: { '#ttl': 'ttl' },
+      UpdateExpression: 'REMOVE deletedAt, expiresAt SET updatedAt = :updatedAt',
       ExpressionAttributeValues: { ':updatedAt': now },
     }),
   );

package/dist/lib/handler/routes/rotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../../lib/handler/routes/rotation.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EAMvB,MAAM,uBAAuB,CAAC;AAG/B,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AA6BD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAoH1B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CA6F1B"}
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../../lib/handler/routes/rotation.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EAMvB,MAAM,uBAAuB,CAAC;AAG/B,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AA6BD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAoI1B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CA6F1B"}

package/dist/lib/handler/routes/rotation.js

@@ -44,8 +44,7 @@ function fingerprintFromPublicKey(publicKeyBase64) {
     return crypto.createHash('sha256').update(Buffer.from(publicKeyBase64, 'base64')).digest('base64');
 }
 function tenantIdFromPublicKey(publicKeyBase64) {
-    const hash = crypto.createHash('sha256').update(publicKeyBase64).digest('hex');
-    return hash.slice(0, 32);
+    return crypto.createHash('sha256').update(publicKeyBase64).digest('hex').slice(0, 32);
 }
 function isValidBase64(value) {
     if (!value || value.length < 4 || value.length > 8192)
@@ -153,6 +152,19 @@ async function handleRotateStart(tenantId, oldFingerprint, rawBody, ddb, tableNa
             updatedAt: now,
         },
     }));
+    // Write a KEY_ALIAS record so auth middleware can resolve the new key's
+    // derived tenantId back to this tenant during rotation
+    const newKeyTenantId = tenantIdFromPublicKey(request.newPublicKey);
+    await ddb.send(new lib_dynamodb_1.PutCommand({
+        TableName: tableName,
+        Item: {
+            PK: `KEY_ALIAS#${newKeyTenantId}`,
+            SK: 'META',
+            originalTenantId: tenantId,
+            newPublicKey: request.newPublicKey,
+            createdAt: now,
+        },
+    }));
     logger_js_1.logger.info('Key rotation started', { tenantId, oldFingerprint, newFingerprint });
     return {
         statusCode: 200,
@@ -287,5 +299,14 @@ async function completeRotation(tenantId, rotation, ddb, tableName) {
             SK: 'ROTATION',
         },
     }));
+    // Delete the KEY_ALIAS lookup record for the new key
+    const newKeyTenantId = tenantIdFromPublicKey(newPublicKey);
+    await ddb.send(new lib_dynamodb_1.DeleteCommand({
+        TableName: tableName,
+        Key: {
+            PK: `KEY_ALIAS#${newKeyTenantId}`,
+            SK: 'META',
+        },
+    }));
 }
 //# sourceMappingURL=rotation.js.map