@de-otio/trellis 0.7.1 → 0.10.0

package/src/lambda/post-confirmation.ts

@@ -33,36 +33,49 @@ import type {
   PostConfirmationTriggerEvent,
   PostConfirmationTriggerHandler,
 } from "aws-lambda";
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
+import { Logger } from "@aws-lambda-powertools/logger";
+import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
+import { PrismaPg } from "@prisma/adapter-pg";
 import {
   PrismaClient,
+  Prisma,
   type AgeTier,
-  type Prisma,
   type TenantRole,
   type UserRole,
 } from "@prisma/client";
-import { ClaimsCache, createClaimsCacheFromEnv, type CachedClaims } from "../lib/auth/claims-cache";
-import { deriveEmailDomain } from "../lib/tenant/derive-domain";
-import { resolveTenantRole, type RoleMappingInput } from "../lib/tenant/resolve-role";
-import { deriveHandle } from "../lib/user/derive-handle";
+import { ClaimsCache, createClaimsCacheFromEnv, type CachedClaims } from "../lib/auth/claims-cache.js";
+import { deriveEmailDomain } from "../lib/tenant/derive-domain.js";
+import { resolveTenantRole, type RoleMappingInput } from "../lib/tenant/resolve-role.js";
+import { deriveHandle } from "../lib/user/derive-handle.js";
+import { computeAnonymousId } from "../lib/pseudonym.js";
+import {
+  emitSignupSecurityEvent,
+  signupUserData,
+} from "../lib/signup-metadata.js";
+import type { SignupMethod } from "@prisma/client";
 
-const secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION });
+const logger = new Logger({ serviceName: "post-confirmation" });
 let prisma: PrismaClient | null = null;
 let cache: ClaimsCache | null = null;
 
 async function getPrisma(): Promise<PrismaClient> {
   if (prisma) return prisma;
-  const secret = await secretsClient.send(
-    new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! }),
-  );
-  const { username, password, host, port, dbname } = JSON.parse(secret.SecretString!);
-  prisma = new PrismaClient({
-    datasources: {
-      db: {
-        url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
-      },
-    },
+  const { username, password, host, port, dbname } = (await getSecret(
+    process.env.DB_SECRET_ARN!,
+    { transform: "json" },
+  )) as unknown as {
+    username: string;
+    password: string;
+    host: string;
+    port: string | number;
+    dbname: string;
+  };
+  // Prisma 7 removed the `datasources` constructor option; the connection URL
+  // is now supplied via a driver adapter.
+  const adapter = new PrismaPg({
+    connectionString: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
   });
+  prisma = new PrismaClient({ adapter });
   return prisma;
 }
 
@@ -97,6 +110,24 @@ function isFederatedEvent(event: PostConfirmationTriggerEvent): boolean {
   }
 }
 
+/**
+ * Parse an explicit `signupMethod` hint from clientMetadata, if present and
+ * valid. Returns undefined for anything we don't recognize (the caller then
+ * derives the method from the invitation code / defaults to COGNITO).
+ */
+function parseSignupMethodHint(
+  raw: string | undefined | null,
+): SignupMethod | undefined {
+  switch (raw) {
+    case "COGNITO":
+    case "INVITE":
+    case "MAGIC_LINK":
+      return raw;
+    default:
+      return undefined;
+  }
+}
+
 function parseIdpGroups(raw: string | undefined | null): string[] {
   if (!raw) return [];
   // Split on `,` and `;` only — IdPs (notably Okta in displayName mode) may
@@ -118,6 +149,11 @@ interface ProvisioningResult {
   orgTenantId: string | null;
   orgTenantSlug: string | null;
   orgTenantRole: TenantRole | null;
+  // Signup-metadata (P3): how this account was created and which invitation it
+  // redeemed. Populated only for freshly created users (existing users keep
+  // their NULL legacy state — no backfill).
+  signupMethod: SignupMethod;
+  invitationId: string | null;
 }
 
 const SUPPORTED_TRIGGERS = new Set([
@@ -132,7 +168,7 @@ export const handler: PostConfirmationTriggerHandler = async (event) => {
   const attrs = event.request.userAttributes;
   const email = attrs.email?.toLowerCase();
   if (!email) {
-    console.warn(JSON.stringify({ event: "postconfirm.no_email", cognitoSub }));
+    logger.warn("postconfirm.no_email", { cognitoSub });
     return event;
   }
 
@@ -150,20 +186,35 @@ export const handler: PostConfirmationTriggerHandler = async (event) => {
     }
   }
 
+  // Signup-metadata (P3): how the account was created. An explicit
+  // `signupMethod` hint in clientMetadata wins (e.g. a passwordless/MAGIC_LINK
+  // signup labels itself); otherwise an invitation code present at signup means
+  // INVITE, and the default is COGNITO. The invitation FK is resolved inside the
+  // transaction below (only when a matching Prisma Invitation exists).
+  const invitationCode =
+    event.request.clientMetadata?.invitationCode?.trim() || undefined;
+  const requestedMethod = parseSignupMethodHint(
+    event.request.clientMetadata?.signupMethod,
+  );
+
   const db = await getPrisma();
 
-  const result = await db.$transaction(
-    async (tx) => provisionUserAndTenancy(tx, {
-      cognitoSub,
-      email,
-      emailVerified: attrs.email_verified,
-      federated,
-      idpGroups,
-      dateOfBirth,
-      ageTier,
-      providedHandle: attrs["custom:handle"],
-    }),
-    { timeout: 8000 },
+  const result = await withHandleConflictRetry(() =>
+    db.$transaction(
+      async (tx) => provisionUserAndTenancy(tx, {
+        cognitoSub,
+        email,
+        emailVerified: attrs.email_verified,
+        federated,
+        idpGroups,
+        dateOfBirth,
+        ageTier,
+        providedHandle: attrs["custom:handle"],
+        invitationCode,
+        requestedMethod,
+      }),
+      { timeout: 8000 },
+    ),
   );
 
   if (ageTier === "CHILD") {
@@ -180,18 +231,38 @@ export const handler: PostConfirmationTriggerHandler = async (event) => {
     }
   }
 
+  // Populate the research pseudonym (best-effort, fail-safe). Done AFTER the
+  // provisioning transaction so a KMS hiccup can never roll back account
+  // creation. No backfill: only set when currently null (idempotent on Cognito
+  // retries). If no KMS HMAC key is configured, computeAnonymousId throws and
+  // we skip — never an unkeyed fallback. See lib/PSEUDONYM.md.
+  await populateAnonymousId(db, result.userId);
+
   await primeClaimsCache(cognitoSub, result);
 
-  console.log(
-    JSON.stringify({
-      event: "postconfirm.ok",
-      cognitoSub,
-      userId: result.userId,
-      personalTenantId: result.personalTenantId,
-      orgTenantId: result.orgTenantId,
-      federated,
-    }),
-  );
+  // Signup-metadata SecurityEvent (P3). Emitted AFTER the provisioning
+  // transaction commits so a telemetry hiccup can never roll back account
+  // creation; the helper itself also fails open. Cognito's PostConfirmation
+  // event exposes no client source IP/UA (callerContext carries only
+  // awsSdkVersion + clientId), so this records method + invitation + tenant
+  // only — no fabricated client signals. Retention is config-driven.
+  await emitSignupSecurityEvent({
+    db,
+    userId: result.userId,
+    method: result.signupMethod,
+    invitationId: result.invitationId,
+    tenantId: result.orgTenantId ?? result.personalTenantId,
+    config: { SIGNUP_EVENT_RETENTION_DAYS: process.env.SIGNUP_EVENT_RETENTION_DAYS },
+    logger: { warn: (...args) => console.warn(...args) },
+  });
+
+  logger.info("postconfirm.ok", {
+    cognitoSub,
+    userId: result.userId,
+    personalTenantId: result.personalTenantId,
+    orgTenantId: result.orgTenantId,
+    federated,
+  });
 
   return event;
 };
@@ -205,6 +276,62 @@ interface ProvisioningInput {
   dateOfBirth: Date | undefined;
   ageTier: AgeTier;
   providedHandle: string | undefined;
+  /** Invitation code presented at signup (clientMetadata), if any. */
+  invitationCode: string | undefined;
+  /** Explicit signupMethod hint from clientMetadata, if recognized. */
+  requestedMethod: SignupMethod | undefined;
+}
+
+/**
+ * S-CP2: the canonical ActivityPub actor URI for a user, derived from the
+ * stable, unique `handle` — `{baseUrl}/users/{handle}`. Returns null when no
+ * base domain is configured for this lambda; the actorUri column then stays
+ * null and the AP dispatcher derives it on demand. No hard dependency on the
+ * env var, so this is safe whether or not the deploy plumbs APP_DOMAIN in.
+ */
+function canonicalActorUri(handle: string): string | null {
+  const raw = process.env.ACTIVITYPUB_BASE_URL || process.env.APP_DOMAIN;
+  if (!raw) return null;
+  try {
+    // Accept both a full URL ("https://host") and a bare hostname ("host").
+    const withProtocol = /^https?:\/\//.test(raw) ? raw : `https://${raw}`;
+    const url = new URL(withProtocol);
+    return `${url.protocol}//${url.hostname}/users/${encodeURIComponent(handle)}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * S-CP2: retry the provisioning transaction when two concurrent signups race to
+ * the same derived handle. `handle` is DB-unique, so the loser of the race gets
+ * a P2002; re-running the transaction re-derives the handle (now seeing the
+ * committed conflict) and picks the next suffix. The transaction rolls back
+ * fully on failure, so retries have no partial-write side effects.
+ */
+async function withHandleConflictRetry<T>(
+  fn: () => Promise<T>,
+  maxAttempts = 3,
+): Promise<T> {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      const isHandleConflict =
+        err instanceof Prisma.PrismaClientKnownRequestError &&
+        err.code === "P2002" &&
+        String(
+          (err.meta as { target?: unknown } | undefined)?.target ?? "",
+        ).includes("handle");
+      if (isHandleConflict && attempt < maxAttempts) {
+        logger.warn("Handle collision during provisioning; retrying", {
+          attempt,
+        });
+        continue;
+      }
+      throw err;
+    }
+  }
 }
 
 async function provisionUserAndTenancy(
@@ -219,12 +346,35 @@ async function provisionUserAndTenancy(
     dateOfBirth,
     ageTier,
     providedHandle,
+    invitationCode,
+    requestedMethod,
   } = input;
 
   const existing = await tx.user.findFirst({
     where: { OR: [{ cognitoSub }, { email }] },
   });
 
+  // Signup-metadata (P3): resolve the redeemed Prisma Invitation (if the code
+  // presented at signup matches one) so we can set the FK. Codes are stored
+  // upper-cased on the Invitation model. A code that doesn't resolve to a
+  // Prisma invitation simply yields no FK (still a valid signup).
+  let redeemedInvitationId: string | null = null;
+  if (invitationCode) {
+    const inv = await tx.invitation.findUnique({
+      where: { code: invitationCode.toUpperCase() },
+      select: { id: true },
+    });
+    redeemedInvitationId = inv?.id ?? null;
+  }
+  // Method precedence: explicit hint > resolved invitation FK > COGNITO default.
+  const signupMethod: SignupMethod =
+    requestedMethod ?? (redeemedInvitationId ? "INVITE" : "COGNITO");
+  // Choke point: the only place User signup-metadata is assembled.
+  const signupFields = signupUserData({
+    method: signupMethod,
+    invitationId: redeemedInvitationId,
+  });
+
   let user = existing;
   if (!user) {
     const initialHandle =
@@ -238,7 +388,18 @@ async function provisionUserAndTenancy(
         cognitoSub,
         email,
         handle: initialHandle,
+        // S-CP2: lock in the AP-actor-shaped URI from the stable handle at
+        // creation (null when no base domain is configured for this lambda).
+        actorUri: canonicalActorUri(initialHandle),
         role: federated ? "B2B_PARTNER" : "END_USER",
+        // Fail-CLOSED research age signal: a new account is NOT age-verified
+        // until an explicit verification flow sets it. Distinct from `ageTier`
+        // (which fails open at ADULT). See prisma User.ageVerified doc + PSEUDONYM.md.
+        ageVerified: false,
+        // Signup-metadata (P3): how the account was created + redeemed
+        // invitation FK. Client signals (IP/UA) go to SecurityEvent, never here.
+        signupMethod: signupFields.signupMethod,
+        invitationId: signupFields.invitationId,
         ...(dateOfBirth && { dateOfBirth, ageTier }),
       },
     });
@@ -246,13 +407,16 @@ async function provisionUserAndTenancy(
     const updates: Prisma.UserUpdateInput = {};
     if (!user.cognitoSub) updates.cognitoSub = cognitoSub;
     if (!user.handle) {
-      updates.handle = await deriveHandle(email, async (h) => {
+      const backfilledHandle = await deriveHandle(email, async (h) => {
         const found = await tx.user.findFirst({
           where: { handle: h, NOT: { id: user!.id } },
           select: { id: true },
         });
         return !!found;
       });
+      updates.handle = backfilledHandle;
+      // S-CP2: derive the AP actor URI from the handle we just assigned.
+      if (!user.actorUri) updates.actorUri = canonicalActorUri(backfilledHandle);
     }
     if (Object.keys(updates).length > 0) {
       user = await tx.user.update({ where: { id: user.id }, data: updates });
@@ -320,9 +484,7 @@ async function provisionUserAndTenancy(
     // creation above is unaffected — Cognito has already authenticated them.
     const emailVerified = input.emailVerified === "true";
     if (!emailVerified) {
-      console.warn(
-        JSON.stringify({ event: "postconfirm.federated.email_unverified", cognitoSub }),
-      );
+      logger.warn("postconfirm.federated.email_unverified", { cognitoSub });
       return {
         userId: user.id,
         globalRole: user.role,
@@ -332,11 +494,13 @@ async function provisionUserAndTenancy(
         orgTenantId: null,
         orgTenantSlug: null,
         orgTenantRole: null,
+        signupMethod,
+        invitationId: redeemedInvitationId,
       };
     }
     const domain = deriveEmailDomain(email);
     if (!domain) {
-      console.warn(JSON.stringify({ event: "postconfirm.federated.invalid_email", cognitoSub }));
+      logger.warn("postconfirm.federated.invalid_email", { cognitoSub });
     } else {
       const tenantDomain = await tx.tenantDomain.findUnique({
         where: { domain },
@@ -355,28 +519,20 @@ async function provisionUserAndTenancy(
       });
 
       if (!tenantDomain) {
-        console.warn(
-          JSON.stringify({ event: "postconfirm.federated.no_domain_match", cognitoSub }),
-        );
+        logger.warn("postconfirm.federated.no_domain_match", { cognitoSub });
       } else if (!tenantDomain.verifiedAt) {
-        console.warn(
-          JSON.stringify({
-            event: "postconfirm.federated.unverified_domain",
-            cognitoSub,
-            tenantId: tenantDomain.tenantId,
-          }),
-        );
+        logger.warn("postconfirm.federated.unverified_domain", {
+          cognitoSub,
+          tenantId: tenantDomain.tenantId,
+        });
       } else if (
         !tenantDomain.tenant.identityProvider ||
         tenantDomain.tenant.identityProvider.status !== "ACTIVE"
       ) {
-        console.warn(
-          JSON.stringify({
-            event: "postconfirm.federated.inactive_idp",
-            cognitoSub,
-            tenantId: tenantDomain.tenantId,
-          }),
-        );
+        logger.warn("postconfirm.federated.inactive_idp", {
+          cognitoSub,
+          tenantId: tenantDomain.tenantId,
+        });
       } else {
         const role = resolveTenantRole(
           idpGroups,
@@ -384,13 +540,10 @@ async function provisionUserAndTenancy(
           tenantDomain.tenant.identityProvider.defaultRole,
         );
         if (!role) {
-          console.warn(
-            JSON.stringify({
-              event: "postconfirm.federated.no_role",
-              cognitoSub,
-              tenantId: tenantDomain.tenantId,
-            }),
-          );
+          logger.warn("postconfirm.federated.no_role", {
+            cognitoSub,
+            tenantId: tenantDomain.tenantId,
+          });
         } else {
           await tx.tenantMember.upsert({
             where: {
@@ -427,9 +580,45 @@ async function provisionUserAndTenancy(
     orgTenantId,
     orgTenantSlug,
     orgTenantRole,
+    signupMethod,
+    invitationId: redeemedInvitationId,
   };
 }
 
+/**
+ * Best-effort, fail-safe population of `User.anonymousId` (the research
+ * pseudonym). Only sets it when currently null (no backfill, idempotent on
+ * Cognito's up-to-3 retries). A KMS / config failure is logged and swallowed —
+ * account provisioning has already committed and must not be undone by a
+ * pseudonym hiccup. NEVER falls back to an unkeyed hash (computeAnonymousId
+ * throws when no KMS HMAC key is configured).
+ */
+async function populateAnonymousId(db: PrismaClient, userId: string): Promise<void> {
+  try {
+    const existing = await db.user.findUnique({
+      where: { id: userId },
+      select: { anonymousId: true },
+    });
+    if (existing?.anonymousId) return; // no backfill / already set
+
+    const anonymousId = await computeAnonymousId(userId, {
+      PSEUDONYM_HMAC_KMS_KEY_ID: process.env.PSEUDONYM_HMAC_KMS_KEY_ID,
+      AWS_REGION: process.env.AWS_REGION,
+    });
+
+    // Guard against the unique-collision race on concurrent retries.
+    await db.user.update({
+      where: { id: userId },
+      data: { anonymousId },
+    });
+  } catch (err) {
+    logger.warn("postconfirm.anonymous_id_skipped", {
+      userId,
+      reason: (err as { name?: string }).name ?? "unknown",
+    });
+  }
+}
+
 async function primeClaimsCache(cognitoSub: string, result: ProvisioningResult): Promise<void> {
   const activeTenantId = result.orgTenantId ?? result.personalTenantId;
   const activeTenantSlug = result.orgTenantSlug ?? result.personalTenantSlug;
@@ -445,12 +634,9 @@ async function primeClaimsCache(cognitoSub: string, result: ProvisioningResult):
   try {
     await getCache().put(cognitoSub, claims);
   } catch (err) {
-    console.warn(
-      JSON.stringify({
-        event: "postconfirm.cache_prime_failed",
-        cognitoSub,
-        error: (err as { code?: string }).code ?? "unknown",
-      }),
-    );
+    logger.warn("postconfirm.cache_prime_failed", {
+      cognitoSub,
+      error: (err as { code?: string }).code ?? "unknown",
+    });
   }
 }

package/src/lambda/pre-token-generation.ts

@@ -23,33 +23,40 @@ import type {
   PreTokenGenerationV2TriggerEvent,
   PreTokenGenerationV2TriggerHandler,
 } from "aws-lambda";
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
+import { Logger } from "@aws-lambda-powertools/logger";
+import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
+import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient, type TenantRole } from "@prisma/client";
 import {
   ClaimsCache,
   createClaimsCacheFromEnv,
   DEFAULT_CACHE_TTL_SECONDS,
   type CachedClaims,
-} from "../lib/auth/claims-cache";
-import { resolveTenantRole, type RoleMappingInput } from "../lib/tenant/resolve-role";
+} from "../lib/auth/claims-cache.js";
+import { resolveTenantRole, type RoleMappingInput } from "../lib/tenant/resolve-role.js";
 
-const secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION });
+const logger = new Logger({ serviceName: "pre-token-generation" });
 let prisma: PrismaClient | null = null;
 let cache: ClaimsCache | null = null;
 
 async function getPrisma(): Promise<PrismaClient> {
   if (prisma) return prisma;
-  const secret = await secretsClient.send(
-    new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! }),
-  );
-  const { username, password, host, port, dbname } = JSON.parse(secret.SecretString!);
-  prisma = new PrismaClient({
-    datasources: {
-      db: {
-        url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
-      },
-    },
+  const { username, password, host, port, dbname } = (await getSecret(
+    process.env.DB_SECRET_ARN!,
+    { transform: "json" },
+  )) as unknown as {
+    username: string;
+    password: string;
+    host: string;
+    port: string | number;
+    dbname: string;
+  };
+  // Prisma 7 removed the `datasources` constructor option; the connection URL
+  // is now supplied via a driver adapter.
+  const adapter = new PrismaPg({
+    connectionString: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
   });
+  prisma = new PrismaClient({ adapter });
   return prisma;
 }
 
@@ -213,18 +220,15 @@ export const handler: PreTokenGenerationV2TriggerHandler = async (event) => {
     try {
       preferredTenantId = await claimsCache.getActiveTenantPreference(cognitoSub);
     } catch (err) {
-      console.warn(
-        JSON.stringify({
-          event: "pretoken.preference_lookup_failed",
-          cognitoSub,
-          error: (err as { code?: string })?.code ?? "unknown",
-        }),
-      );
+      logger.warn("pretoken.preference_lookup_failed", {
+        cognitoSub,
+        error: (err as { code?: string })?.code ?? "unknown",
+      });
     }
     const loaded = await loadFromRds(db, cognitoSub, federated, preferredTenantId);
 
     if (!loaded.user) {
-      console.warn(JSON.stringify({ event: "pretoken.drift", cognitoSub }));
+      logger.warn("pretoken.drift", { cognitoSub });
       claims = { ...DRIFT_CLAIMS };
       writeAccessTokenClaims(event, claims);
       return event;
@@ -235,7 +239,7 @@ export const handler: PreTokenGenerationV2TriggerHandler = async (event) => {
     // value when present). Treat either signal as suspension. Defense-in-depth:
     // even if a writer forgets one column, the other still blocks issuance.
     if (loaded.user.suspended || loaded.user.suspendedAt !== null) {
-      console.warn(JSON.stringify({ event: "pretoken.suspended", cognitoSub }));
+      logger.warn("pretoken.suspended", { cognitoSub });
       claims = { ...DRIFT_CLAIMS };
       writeAccessTokenClaims(event, claims);
       return event;
@@ -274,34 +278,25 @@ export const handler: PreTokenGenerationV2TriggerHandler = async (event) => {
           });
           persisted = true;
         } catch (err) {
-          console.warn(
-            JSON.stringify({
-              event: "pretoken.role_refresh_persist_failed",
-              cognitoSub,
-              error: (err as { code?: string })?.code ?? "unknown",
-            }),
-          );
+          logger.warn("pretoken.role_refresh_persist_failed", {
+            cognitoSub,
+            error: (err as { code?: string })?.code ?? "unknown",
+          });
         }
         if (persisted) {
           claims = { ...claims, tenantRole: refreshed };
           cacheHit = false;
-          console.log(
-            JSON.stringify({
-              event: "pretoken.role_refreshed",
-              cognitoSub,
-              tenantId: claims.activeTenantId,
-            }),
-          );
+          logger.info("pretoken.role_refreshed", {
+            cognitoSub,
+            tenantId: claims.activeTenantId,
+          });
         }
       }
     } catch (err) {
-      console.warn(
-        JSON.stringify({
-          event: "pretoken.role_refresh_failed",
-          cognitoSub,
-          error: (err as { code?: string }).code ?? "unknown",
-        }),
-      );
+      logger.warn("pretoken.role_refresh_failed", {
+        cognitoSub,
+        error: (err as { code?: string }).code ?? "unknown",
+      });
     }
   }
 

package/src/lambda/verify-auth-challenge.ts

@@ -1,5 +1,8 @@
 import { timingSafeEqual, createHash } from "node:crypto";
 import { DynamoDBClient, DeleteItemCommand } from "@aws-sdk/client-dynamodb";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "verify-auth-challenge" });
 
 const dynamo = new DynamoDBClient({ region: process.env.AWS_REGION });
 const TABLE = process.env.DYNAMODB_TABLE!;
@@ -29,7 +32,7 @@ export const handler = async (event: any) => {
         },
       }));
     } catch (err) {
-      console.error("Failed to delete magic link token", err);
+      logger.error("Failed to delete magic link token", { error: err });
     }
   }