@de-otio/trellis 0.7.0 → 0.9.0

package/src/lambda/nightly-cron.ts

@@ -1,14 +1,18 @@
 import { DynamoDBClient, PutItemCommand, DeleteItemCommand } from "@aws-sdk/client-dynamodb";
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 import { S3Client, DeleteObjectsCommand, ListObjectsV2Command } from "@aws-sdk/client-s3";
 import { CognitoIdentityProviderClient, AdminDeleteUserCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CloudWatchClient, PutMetricDataCommand } from "@aws-sdk/client-cloudwatch";
 import { SESClient, SendEmailCommand } from "@aws-sdk/client-ses";
 import { marshall } from "@aws-sdk/util-dynamodb";
+import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient } from "@prisma/client";
+import { Logger } from "@aws-lambda-powertools/logger";
+import { Metrics, MetricUnit } from "@aws-lambda-powertools/metrics";
+import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
+
+const logger = new Logger({ serviceName: "nightly-cron" });
+const metrics = new Metrics({ namespace: "Trellis/Deletion", serviceName: "nightly-cron" });
 
 const dynamo = new DynamoDBClient({ region: process.env.AWS_REGION });
-const secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION });
 const s3 = new S3Client({ region: process.env.AWS_REGION });
 const TABLE = process.env.DYNAMODB_TABLE!;
 const MEDIA_BUCKET = process.env.MEDIA_BUCKET_NAME!;
@@ -17,11 +21,19 @@ let prisma: PrismaClient | null = null;
 
 async function getPrisma(): Promise<PrismaClient> {
   if (prisma) return prisma;
-  const secret = await secretsClient.send(new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! }));
-  const { username, password, host, port, dbname } = JSON.parse(secret.SecretString!);
-  prisma = new PrismaClient({
-    datasources: { db: { url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1` } },
+  const { username, password, host, port, dbname } = (await getSecret(process.env.DB_SECRET_ARN!, { transform: "json" })) as unknown as {
+    username: string;
+    password: string;
+    host: string;
+    port: string | number;
+    dbname: string;
+  };
+  // Prisma 7 removed the `datasources` constructor option; the connection URL
+  // is now supplied via a driver adapter.
+  const adapter = new PrismaPg({
+    connectionString: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
   });
+  prisma = new PrismaClient({ adapter });
   return prisma;
 }
 
@@ -43,11 +55,11 @@ export const handler = async (): Promise<void> => {
       ExpressionAttributeValues: marshall({ ":now": now }),
     }));
   } catch {
-    console.log(JSON.stringify({ level: "info", msg: "Nightly cron already running, skipping" }));
+    logger.info("Nightly cron already running, skipping");
     return;
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "Nightly cron started" }));
+  logger.info("Nightly cron started");
 
   const db = await getPrisma();
 
@@ -78,7 +90,7 @@ export const handler = async (): Promise<void> => {
               Delete: { Objects: batch.map((Key) => ({ Key })) },
             }));
           } catch (err) {
-            console.error(JSON.stringify({ level: "error", msg: "S3 batch delete failed", error: String(err), batchSize: batch.length }));
+            logger.error("S3 batch delete failed", { error: err, batchSize: batch.length });
           }
         }
       }
@@ -87,10 +99,10 @@ export const handler = async (): Promise<void> => {
       const result = await db.mediaFile.deleteMany({
         where: { id: { in: mediaToDelete.map((m) => m.id) } },
       });
-      console.log(JSON.stringify({ level: "info", msg: "Soft-deleted media purged", dbDeleted: result.count, s3Keys: keys.length }));
+      logger.info("Soft-deleted media purged", { dbDeleted: result.count, s3Keys: keys.length });
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Media purge failed", error: String(err) }));
+    logger.error("Media purge failed", { error: err });
   }
 
   // 2. Clean up expired invitations
@@ -99,10 +111,10 @@ export const handler = async (): Promise<void> => {
       where: { expiresAt: { lte: new Date() }, usedAt: null },
     });
     if (result.count > 0) {
-      console.log(JSON.stringify({ level: "info", msg: "Expired invitations cleaned", deleted: result.count }));
+      logger.info("Expired invitations cleaned", { deleted: result.count });
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Invitation cleanup failed", error: String(err) }));
+    logger.error("Invitation cleanup failed", { error: err });
   }
 
   // 3. Follower counts removed — relationships now live in graph DB (AuraDB)
@@ -110,7 +122,7 @@ export const handler = async (): Promise<void> => {
 
   // 4. Process scheduled account deletions (GDPR Article 17 compliance)
   try {
-    const { deleteUserData } = await import("../lib/services/user-data-deletion");
+    const { deleteUserData } = await import("../lib/services/user-data-deletion.js");
 
     const usersToDelete = await db.user.findMany({
       where: {
@@ -137,7 +149,7 @@ export const handler = async (): Promise<void> => {
           const MAX_PAGES = 100;
           do {
             if (pages >= MAX_PAGES) {
-              console.log(JSON.stringify({ level: "warn", msg: "S3 pagination circuit breaker hit", userId: user.id, pages: MAX_PAGES }));
+              logger.warn("S3 pagination circuit breaker hit", { userId: user.id, pages: MAX_PAGES });
               break;
             }
             const list = await s3.send(new ListObjectsV2Command({
@@ -153,7 +165,7 @@ export const handler = async (): Promise<void> => {
             pages++;
           } while (continuationToken);
         } catch (s3Err) {
-          console.error(JSON.stringify({ level: "error", msg: "S3 media deletion failed", userId: user.id, error: String(s3Err) }));
+          logger.error("S3 media deletion failed", { userId: user.id, error: s3Err });
         }
 
         // 4c. Delete Cognito identity
@@ -166,7 +178,7 @@ export const handler = async (): Promise<void> => {
             }));
           } catch (cognitoErr) {
             // Log but don't fail — user may already be deleted from Cognito
-            console.warn(JSON.stringify({ level: "warn", msg: "Cognito deletion failed", userId: user.id, error: String(cognitoErr) }));
+            logger.warn("Cognito deletion failed", { userId: user.id, error: cognitoErr });
           }
         }
 
@@ -192,7 +204,7 @@ export const handler = async (): Promise<void> => {
             },
           });
         } catch (auditErr) {
-          console.error(JSON.stringify({ level: "error", msg: "Audit log write failed", userId: user.id, error: String(auditErr) }));
+          logger.error("Audit log write failed", { userId: user.id, error: auditErr });
         }
 
         // 4f. Send deletion completion email
@@ -212,20 +224,15 @@ export const handler = async (): Promise<void> => {
               },
             }));
           } catch (emailErr) {
-            console.warn(JSON.stringify({ level: "warn", msg: "Deletion email failed", userId: user.id, error: String(emailErr) }));
+            logger.warn("Deletion email failed", { userId: user.id, error: emailErr });
           }
         }
 
         deletedCount++;
-        console.log(JSON.stringify({
-          level: "info",
-          msg: "Account deleted",
-          userId: user.id,
-          itemsDeleted: result,
-        }));
+        logger.info("Account deleted", { userId: user.id, itemsDeleted: result });
       } catch (err) {
         failedCount++;
-        console.error(JSON.stringify({ level: "error", msg: "Account deletion failed", userId: user.id, error: String(err) }));
+        logger.error("Account deletion failed", { userId: user.id, error: err });
       }
     }
 
@@ -239,52 +246,44 @@ export const handler = async (): Promise<void> => {
 
     // Emit CloudWatch metrics
     try {
-      const cw = new CloudWatchClient({ region: process.env.AWS_REGION });
-      const timestamp = new Date();
-      await cw.send(new PutMetricDataCommand({
-        Namespace: "Trellis/Deletion",
-        MetricData: [
-          { MetricName: "ProcessedCount", Value: deletedCount, Unit: "Count", Timestamp: timestamp },
-          { MetricName: "FailedCount", Value: failedCount, Unit: "Count", Timestamp: timestamp },
-          { MetricName: "PendingCount", Value: pendingCount, Unit: "Count", Timestamp: timestamp },
-        ],
-      }));
+      metrics.addMetric("ProcessedCount", MetricUnit.Count, deletedCount);
+      metrics.addMetric("FailedCount", MetricUnit.Count, failedCount);
+      metrics.addMetric("PendingCount", MetricUnit.Count, pendingCount);
+      metrics.publishStoredMetrics();
     } catch (cwErr) {
-      console.error(JSON.stringify({ level: "error", msg: "CloudWatch metrics failed", error: String(cwErr) }));
+      logger.error("CloudWatch metrics failed", { error: cwErr });
     }
 
     if (usersToDelete.length > 0) {
-      console.log(JSON.stringify({
-        level: "info",
-        msg: "Scheduled account deletions processed",
+      logger.info("Scheduled account deletions processed", {
         total: usersToDelete.length,
         deleted: deletedCount,
         failed: failedCount,
         pending: pendingCount,
-      }));
+      });
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Scheduled deletion processing failed", error: String(err) }));
+    logger.error("Scheduled deletion processing failed", { error: err });
   }
 
   // 5. Check age tier transitions (Safer Social Design)
   try {
-    const { checkAgeTierTransitions } = await import("../lib/age-tier-transition");
-    const { buildEnv } = await import("../env");
+    const { checkAgeTierTransitions } = await import("../lib/age-tier-transition.js");
+    const { buildEnv } = await import("../env.js");
     const appEnv = await buildEnv();
     const result = await checkAgeTierTransitions(appEnv);
     if (result.transitioned > 0 || result.errors > 0) {
-      console.log(JSON.stringify({ level: "info", msg: "Age tier transitions processed", transitioned: result.transitioned, errors: result.errors }));
+      logger.info("Age tier transitions processed", { transitioned: result.transitioned, errors: result.errors });
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Age tier transition check failed", error: String(err) }));
+    logger.error("Age tier transition check failed", { error: err });
   }
 
   // 6. Generate sentiment digest notifications (Safer Social Design)
   try {
-    const { generateSentimentDigest } = await import("../lib/sentiment-digest");
-    const { NotificationHandler } = await import("../lib/notification-handler");
-    const { buildEnv } = await import("../env");
+    const { generateSentimentDigest } = await import("../lib/sentiment-digest.js");
+    const { NotificationHandler } = await import("../lib/notification-handler.js");
+    const { buildEnv } = await import("../env.js");
     const appEnv = await buildEnv();
     const notificationHandler = new NotificationHandler();
 
@@ -326,16 +325,16 @@ export const handler = async (): Promise<void> => {
         }
       } catch (digestErr) {
         // Don't fail the whole batch for one user
-        console.error(JSON.stringify({ level: "error", msg: "Digest generation failed for user", userId: user.id, error: String(digestErr) }));
+        logger.error("Digest generation failed for user", { userId: user.id, error: digestErr });
       }
     }
 
     if (digestCount > 0) {
-      console.log(JSON.stringify({ level: "info", msg: "Sentiment digest notifications created", count: digestCount }));
+      logger.info("Sentiment digest notifications created", { count: digestCount });
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Sentiment digest delivery failed", error: String(err) }));
+    logger.error("Sentiment digest delivery failed", { error: err });
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "Nightly cron complete" }));
+  logger.info("Nightly cron complete");
 };

package/src/lambda/post-confirmation.ts

@@ -33,7 +33,9 @@ import type {
   PostConfirmationTriggerEvent,
   PostConfirmationTriggerHandler,
 } from "aws-lambda";
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
+import { Logger } from "@aws-lambda-powertools/logger";
+import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
+import { PrismaPg } from "@prisma/adapter-pg";
 import {
   PrismaClient,
   type AgeTier,
@@ -41,28 +43,39 @@ import {
   type TenantRole,
   type UserRole,
 } from "@prisma/client";
-import { ClaimsCache, createClaimsCacheFromEnv, type CachedClaims } from "../lib/auth/claims-cache";
-import { deriveEmailDomain } from "../lib/tenant/derive-domain";
-import { resolveTenantRole, type RoleMappingInput } from "../lib/tenant/resolve-role";
-import { deriveHandle } from "../lib/user/derive-handle";
+import { ClaimsCache, createClaimsCacheFromEnv, type CachedClaims } from "../lib/auth/claims-cache.js";
+import { deriveEmailDomain } from "../lib/tenant/derive-domain.js";
+import { resolveTenantRole, type RoleMappingInput } from "../lib/tenant/resolve-role.js";
+import { deriveHandle } from "../lib/user/derive-handle.js";
+import { computeAnonymousId } from "../lib/pseudonym.js";
+import {
+  emitSignupSecurityEvent,
+  signupUserData,
+} from "../lib/signup-metadata.js";
+import type { SignupMethod } from "@prisma/client";
 
-const secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION });
+const logger = new Logger({ serviceName: "post-confirmation" });
 let prisma: PrismaClient | null = null;
 let cache: ClaimsCache | null = null;
 
 async function getPrisma(): Promise<PrismaClient> {
   if (prisma) return prisma;
-  const secret = await secretsClient.send(
-    new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! }),
-  );
-  const { username, password, host, port, dbname } = JSON.parse(secret.SecretString!);
-  prisma = new PrismaClient({
-    datasources: {
-      db: {
-        url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
-      },
-    },
+  const { username, password, host, port, dbname } = (await getSecret(
+    process.env.DB_SECRET_ARN!,
+    { transform: "json" },
+  )) as unknown as {
+    username: string;
+    password: string;
+    host: string;
+    port: string | number;
+    dbname: string;
+  };
+  // Prisma 7 removed the `datasources` constructor option; the connection URL
+  // is now supplied via a driver adapter.
+  const adapter = new PrismaPg({
+    connectionString: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
   });
+  prisma = new PrismaClient({ adapter });
   return prisma;
 }
 
@@ -97,6 +110,24 @@ function isFederatedEvent(event: PostConfirmationTriggerEvent): boolean {
   }
 }
 
+/**
+ * Parse an explicit `signupMethod` hint from clientMetadata, if present and
+ * valid. Returns undefined for anything we don't recognize (the caller then
+ * derives the method from the invitation code / defaults to COGNITO).
+ */
+function parseSignupMethodHint(
+  raw: string | undefined | null,
+): SignupMethod | undefined {
+  switch (raw) {
+    case "COGNITO":
+    case "INVITE":
+    case "MAGIC_LINK":
+      return raw;
+    default:
+      return undefined;
+  }
+}
+
 function parseIdpGroups(raw: string | undefined | null): string[] {
   if (!raw) return [];
   // Split on `,` and `;` only — IdPs (notably Okta in displayName mode) may
@@ -118,6 +149,11 @@ interface ProvisioningResult {
   orgTenantId: string | null;
   orgTenantSlug: string | null;
   orgTenantRole: TenantRole | null;
+  // Signup-metadata (P3): how this account was created and which invitation it
+  // redeemed. Populated only for freshly created users (existing users keep
+  // their NULL legacy state — no backfill).
+  signupMethod: SignupMethod;
+  invitationId: string | null;
 }
 
 const SUPPORTED_TRIGGERS = new Set([
@@ -132,7 +168,7 @@ export const handler: PostConfirmationTriggerHandler = async (event) => {
   const attrs = event.request.userAttributes;
   const email = attrs.email?.toLowerCase();
   if (!email) {
-    console.warn(JSON.stringify({ event: "postconfirm.no_email", cognitoSub }));
+    logger.warn("postconfirm.no_email", { cognitoSub });
     return event;
   }
 
@@ -150,6 +186,17 @@ export const handler: PostConfirmationTriggerHandler = async (event) => {
     }
   }
 
+  // Signup-metadata (P3): how the account was created. An explicit
+  // `signupMethod` hint in clientMetadata wins (e.g. a passwordless/MAGIC_LINK
+  // signup labels itself); otherwise an invitation code present at signup means
+  // INVITE, and the default is COGNITO. The invitation FK is resolved inside the
+  // transaction below (only when a matching Prisma Invitation exists).
+  const invitationCode =
+    event.request.clientMetadata?.invitationCode?.trim() || undefined;
+  const requestedMethod = parseSignupMethodHint(
+    event.request.clientMetadata?.signupMethod,
+  );
+
   const db = await getPrisma();
 
   const result = await db.$transaction(
@@ -162,6 +209,8 @@ export const handler: PostConfirmationTriggerHandler = async (event) => {
       dateOfBirth,
       ageTier,
       providedHandle: attrs["custom:handle"],
+      invitationCode,
+      requestedMethod,
     }),
     { timeout: 8000 },
   );
@@ -180,18 +229,38 @@ export const handler: PostConfirmationTriggerHandler = async (event) => {
     }
   }
 
+  // Populate the research pseudonym (best-effort, fail-safe). Done AFTER the
+  // provisioning transaction so a KMS hiccup can never roll back account
+  // creation. No backfill: only set when currently null (idempotent on Cognito
+  // retries). If no KMS HMAC key is configured, computeAnonymousId throws and
+  // we skip — never an unkeyed fallback. See lib/PSEUDONYM.md.
+  await populateAnonymousId(db, result.userId);
+
   await primeClaimsCache(cognitoSub, result);
 
-  console.log(
-    JSON.stringify({
-      event: "postconfirm.ok",
-      cognitoSub,
-      userId: result.userId,
-      personalTenantId: result.personalTenantId,
-      orgTenantId: result.orgTenantId,
-      federated,
-    }),
-  );
+  // Signup-metadata SecurityEvent (P3). Emitted AFTER the provisioning
+  // transaction commits so a telemetry hiccup can never roll back account
+  // creation; the helper itself also fails open. Cognito's PostConfirmation
+  // event exposes no client source IP/UA (callerContext carries only
+  // awsSdkVersion + clientId), so this records method + invitation + tenant
+  // only — no fabricated client signals. Retention is config-driven.
+  await emitSignupSecurityEvent({
+    db,
+    userId: result.userId,
+    method: result.signupMethod,
+    invitationId: result.invitationId,
+    tenantId: result.orgTenantId ?? result.personalTenantId,
+    config: { SIGNUP_EVENT_RETENTION_DAYS: process.env.SIGNUP_EVENT_RETENTION_DAYS },
+    logger: { warn: (...args) => console.warn(...args) },
+  });
+
+  logger.info("postconfirm.ok", {
+    cognitoSub,
+    userId: result.userId,
+    personalTenantId: result.personalTenantId,
+    orgTenantId: result.orgTenantId,
+    federated,
+  });
 
   return event;
 };
@@ -205,6 +274,10 @@ interface ProvisioningInput {
   dateOfBirth: Date | undefined;
   ageTier: AgeTier;
   providedHandle: string | undefined;
+  /** Invitation code presented at signup (clientMetadata), if any. */
+  invitationCode: string | undefined;
+  /** Explicit signupMethod hint from clientMetadata, if recognized. */
+  requestedMethod: SignupMethod | undefined;
 }
 
 async function provisionUserAndTenancy(
@@ -219,12 +292,35 @@ async function provisionUserAndTenancy(
     dateOfBirth,
     ageTier,
     providedHandle,
+    invitationCode,
+    requestedMethod,
   } = input;
 
   const existing = await tx.user.findFirst({
     where: { OR: [{ cognitoSub }, { email }] },
   });
 
+  // Signup-metadata (P3): resolve the redeemed Prisma Invitation (if the code
+  // presented at signup matches one) so we can set the FK. Codes are stored
+  // upper-cased on the Invitation model. A code that doesn't resolve to a
+  // Prisma invitation simply yields no FK (still a valid signup).
+  let redeemedInvitationId: string | null = null;
+  if (invitationCode) {
+    const inv = await tx.invitation.findUnique({
+      where: { code: invitationCode.toUpperCase() },
+      select: { id: true },
+    });
+    redeemedInvitationId = inv?.id ?? null;
+  }
+  // Method precedence: explicit hint > resolved invitation FK > COGNITO default.
+  const signupMethod: SignupMethod =
+    requestedMethod ?? (redeemedInvitationId ? "INVITE" : "COGNITO");
+  // Choke point: the only place User signup-metadata is assembled.
+  const signupFields = signupUserData({
+    method: signupMethod,
+    invitationId: redeemedInvitationId,
+  });
+
   let user = existing;
   if (!user) {
     const initialHandle =
@@ -239,6 +335,14 @@ async function provisionUserAndTenancy(
         email,
         handle: initialHandle,
         role: federated ? "B2B_PARTNER" : "END_USER",
+        // Fail-CLOSED research age signal: a new account is NOT age-verified
+        // until an explicit verification flow sets it. Distinct from `ageTier`
+        // (which fails open at ADULT). See prisma User.ageVerified doc + PSEUDONYM.md.
+        ageVerified: false,
+        // Signup-metadata (P3): how the account was created + redeemed
+        // invitation FK. Client signals (IP/UA) go to SecurityEvent, never here.
+        signupMethod: signupFields.signupMethod,
+        invitationId: signupFields.invitationId,
         ...(dateOfBirth && { dateOfBirth, ageTier }),
       },
     });
@@ -320,9 +424,7 @@ async function provisionUserAndTenancy(
     // creation above is unaffected — Cognito has already authenticated them.
     const emailVerified = input.emailVerified === "true";
     if (!emailVerified) {
-      console.warn(
-        JSON.stringify({ event: "postconfirm.federated.email_unverified", cognitoSub }),
-      );
+      logger.warn("postconfirm.federated.email_unverified", { cognitoSub });
       return {
         userId: user.id,
         globalRole: user.role,
@@ -332,11 +434,13 @@ async function provisionUserAndTenancy(
         orgTenantId: null,
         orgTenantSlug: null,
         orgTenantRole: null,
+        signupMethod,
+        invitationId: redeemedInvitationId,
       };
     }
     const domain = deriveEmailDomain(email);
     if (!domain) {
-      console.warn(JSON.stringify({ event: "postconfirm.federated.invalid_email", cognitoSub }));
+      logger.warn("postconfirm.federated.invalid_email", { cognitoSub });
     } else {
       const tenantDomain = await tx.tenantDomain.findUnique({
         where: { domain },
@@ -355,28 +459,20 @@ async function provisionUserAndTenancy(
       });
 
       if (!tenantDomain) {
-        console.warn(
-          JSON.stringify({ event: "postconfirm.federated.no_domain_match", cognitoSub }),
-        );
+        logger.warn("postconfirm.federated.no_domain_match", { cognitoSub });
       } else if (!tenantDomain.verifiedAt) {
-        console.warn(
-          JSON.stringify({
-            event: "postconfirm.federated.unverified_domain",
-            cognitoSub,
-            tenantId: tenantDomain.tenantId,
-          }),
-        );
+        logger.warn("postconfirm.federated.unverified_domain", {
+          cognitoSub,
+          tenantId: tenantDomain.tenantId,
+        });
       } else if (
         !tenantDomain.tenant.identityProvider ||
         tenantDomain.tenant.identityProvider.status !== "ACTIVE"
       ) {
-        console.warn(
-          JSON.stringify({
-            event: "postconfirm.federated.inactive_idp",
-            cognitoSub,
-            tenantId: tenantDomain.tenantId,
-          }),
-        );
+        logger.warn("postconfirm.federated.inactive_idp", {
+          cognitoSub,
+          tenantId: tenantDomain.tenantId,
+        });
       } else {
         const role = resolveTenantRole(
           idpGroups,
@@ -384,13 +480,10 @@ async function provisionUserAndTenancy(
           tenantDomain.tenant.identityProvider.defaultRole,
         );
         if (!role) {
-          console.warn(
-            JSON.stringify({
-              event: "postconfirm.federated.no_role",
-              cognitoSub,
-              tenantId: tenantDomain.tenantId,
-            }),
-          );
+          logger.warn("postconfirm.federated.no_role", {
+            cognitoSub,
+            tenantId: tenantDomain.tenantId,
+          });
         } else {
           await tx.tenantMember.upsert({
             where: {
@@ -427,9 +520,45 @@ async function provisionUserAndTenancy(
     orgTenantId,
     orgTenantSlug,
     orgTenantRole,
+    signupMethod,
+    invitationId: redeemedInvitationId,
   };
 }
 
+/**
+ * Best-effort, fail-safe population of `User.anonymousId` (the research
+ * pseudonym). Only sets it when currently null (no backfill, idempotent on
+ * Cognito's up-to-3 retries). A KMS / config failure is logged and swallowed —
+ * account provisioning has already committed and must not be undone by a
+ * pseudonym hiccup. NEVER falls back to an unkeyed hash (computeAnonymousId
+ * throws when no KMS HMAC key is configured).
+ */
+async function populateAnonymousId(db: PrismaClient, userId: string): Promise<void> {
+  try {
+    const existing = await db.user.findUnique({
+      where: { id: userId },
+      select: { anonymousId: true },
+    });
+    if (existing?.anonymousId) return; // no backfill / already set
+
+    const anonymousId = await computeAnonymousId(userId, {
+      PSEUDONYM_HMAC_KMS_KEY_ID: process.env.PSEUDONYM_HMAC_KMS_KEY_ID,
+      AWS_REGION: process.env.AWS_REGION,
+    });
+
+    // Guard against the unique-collision race on concurrent retries.
+    await db.user.update({
+      where: { id: userId },
+      data: { anonymousId },
+    });
+  } catch (err) {
+    logger.warn("postconfirm.anonymous_id_skipped", {
+      userId,
+      reason: (err as { name?: string }).name ?? "unknown",
+    });
+  }
+}
+
 async function primeClaimsCache(cognitoSub: string, result: ProvisioningResult): Promise<void> {
   const activeTenantId = result.orgTenantId ?? result.personalTenantId;
   const activeTenantSlug = result.orgTenantSlug ?? result.personalTenantSlug;
@@ -445,12 +574,9 @@ async function primeClaimsCache(cognitoSub: string, result: ProvisioningResult):
   try {
     await getCache().put(cognitoSub, claims);
   } catch (err) {
-    console.warn(
-      JSON.stringify({
-        event: "postconfirm.cache_prime_failed",
-        cognitoSub,
-        error: (err as { code?: string }).code ?? "unknown",
-      }),
-    );
+    logger.warn("postconfirm.cache_prime_failed", {
+      cognitoSub,
+      error: (err as { code?: string }).code ?? "unknown",
+    });
   }
 }