create-safest-tools 0.2.0

package/template/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Safest Tools contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/template/README.md

@@ -0,0 +1,35 @@
+# Safest Resolve
+
+Safest Resolve handles abuse, safety, fraud, and policy reports in the Cloudflare account that owns this project. Reports arrive through the signed widget, public form, or server API. A published routing version assigns the queue, and the pinned workflow records evidence checks, human review, messages, decisions, application actions, and appeals.
+
+The service does not proxy or inspect normal application traffic. The customer application remains responsible for the content references it provides and for carrying out any approved action.
+
+This project deploys one Worker, one D1 database, four private R2 buckets, a Dynamic Workflow, report and delivery Queues, an operations dead-letter Queue, a presence Durable Object, static assets, a Worker Loader, and a Workers AI binding. The Cloudflare account owner creates the Access application and owns every secret, webhook, log, and retained row.
+
+Before deployment:
+
+1. Review `reports.config.json` and `npm run setup:plan`.
+2. Create a Cloudflare Access self-hosted application for `<reports-host>/v1/infrastructure/*`; put its 64-character AUD in `access.audience` and keep `access.ownerEmails` restricted to infrastructure owners.
+3. Under Cloudflare Email Service → Email Sending, onboard the configured sender domain. Password verification, invitations, and password recovery to arbitrary recipients depend on domain onboarding.
+4. Run `npm run setup`. The guided setup signs in through Wrangler, verifies Workers Paid before provisioning, creates owner-only local secrets, and walks through optional Google, GitHub, and Cloudflare OAuth credentials with exact callback URLs.
+5. Bootstrap the infrastructure owner, then invite administrators and analysts from People. Invited users do not need Cloudflare accounts and can upload a JPEG, PNG, or WebP profile picture up to 2 MB. Names and workspace roles are always displayed separately.
+6. Type the exact installation confirmation when setup requests it.
+
+Setup creates D1, four private R2 buckets, and three Queues, applies report migrations, and deploys the Worker with Dynamic Workflows. After bootstrap, verify the `database`, `workflow_runtime`, `workers_ai`, `object_storage`, and `queues` setup features, then require an authenticated `GET /ready` response of 200. Public `GET /health` is liveness only. Better Auth owns password hashing, email verification, OAuth accounts, sessions, and one-time password-reset tokens in D1. Upgrades always back up D1 before migrations and deployment.
+
+Administrators build and preview questions in **Configuration → Intake forms**, set the logo, colours, fonts, and shape in **Settings → Branding**, then choose a private hosted page, signed-in product widget, or anonymous product widget in **Settings → Reporting channels**. Hosted pages and anonymous widgets need no API key. Signed-in widgets use one small customer-backend endpoint; verified reporter, target, and registered trusted facts stay server-side while the browser receives only a short-lived opaque token. Every public submission is verified with Turnstile inside a Resolve-owned isolated frame.
+
+Cloudflare Email Service and an `--email-from reports@example.com` address on an onboarded Email Sending domain are required for invitations, email verification, and password recovery. Participant notifications may still use a configured signed customer notification webhook.
+
+```bash
+npm run backup:plan
+npm run backup
+npm run restore:verify -- .safest/backups/<backup-directory>
+npm run restore:plan -- .safest/backups/<backup-directory> --target-config reports.restore.config.json
+npm run upgrade:plan
+npm run upgrade
+```
+
+`npm run uninstall:plan` is deliberately read-only. It lists only the resources named by this installation and preserves D1, all private R2 buckets, and Access by default.
+
+Verified backups contain the D1 export plus all objects from the four private R2 buckets, with a stable inventory and SHA-256 digests. They intentionally exclude pending Queue messages, live Workflow engine state, Worker secrets, external webhook state, and ephemeral analyst presence. Restore planning requires a separately named target installation and does not mutate Cloudflare.

package/template/console/README.md

@@ -0,0 +1,28 @@
+# Operator console
+
+The console uses React, TypeScript, and Vite. Each product area keeps its DOM, typed state, controller, and API calls together.
+
+## What runs in React
+
+- **Account access:** sign-in, infrastructure-owner bootstrap, password reset, invitation acceptance, and optional profile-picture upload.
+- **Workspace shell:** header, responsive navigation, current route, health, analyst identity, and permission-aware navigation.
+- **Command centre:** metrics, work that needs attention, queue pressure, recent workflow runs, and setup actions.
+- **Reports and appeals:** queue filters, presence, claims, participant messages, decisions, delivery history, workflow evidence, and separate appeal ownership.
+- **Queues and workflows:** queue policy publication, routing rollout, workflow drafts, graph editing, checks, fixture tests, publishing, and queue pins.
+- **Components and configuration:** component and connection records, outbound allowlists, intake forms, routing rules, decision policies, message templates, and the visual form builder.
+- **Operations and quality:** AI samples, reviewer corrections, incidents, retries, dead-letter evidence, analytics, audit verification, and CSV export.
+- **People and settings:** invitations, password-reset emails, roles, personal profiles, deployment checks, branding, and reporting channels.
+- **Ask Safest:** scoped conversations, citations, read-only activity, and links back to reports.
+
+`console/components/PageHeader.tsx` defines the shared page-title pattern. `console/shell/controller.ts` handles session hydration, route selection, health, and sign-out. `console/lib/http.ts` is the authenticated HTTP boundary; event payloads never carry passwords or credentials.
+
+Build with `npm run build:console`. Vite writes the bundle to `public/console/auth-shell.js`, and the template build copies it into standalone installations.
+
+## Implementation rules
+
+1. Keep each complete user task in one product-area module.
+2. A DOM node has exactly one React owner.
+3. Put network and formatting logic in shared typed modules before a second screen needs it.
+4. Preserve URLs, IDs, accessibility names, and server contracts while a slice moves.
+5. Delete replaced listeners and selectors in the same change.
+6. Verify changes with TypeScript, unit tests, and desktop/mobile browser tests.

package/template/console/analytics/AnalyticsWorkspace.tsx

@@ -0,0 +1,55 @@
+import { useSyncExternalStore } from "react";
+import { PageHeader } from "../components/PageHeader";
+import { readable } from "../lib/format";
+import { dispatchAnalyticsPeriod, dispatchAnalyticsRefresh, dispatchAuditVerification, dispatchReportExport } from "./events";
+import { getAnalyticsWorkspaceSnapshot, subscribeToAnalyticsWorkspace } from "./store";
+import type { AnalyticsSeriesRow } from "./types";
+
+function metricTotal(series: AnalyticsSeriesRow[], metricKey: string, dimensionKey: string): number {
+  return series.filter((row) => row.metricKey === metricKey && row.dimensionKey === dimensionKey)
+    .reduce((sum, row) => sum + Number(row.value || 0), 0);
+}
+
+function readableDuration(seconds: number | null): string {
+  if (seconds === null) return "—";
+  if (seconds < 60) return `${seconds}s`;
+  if (seconds < 3600) return `${Math.round(seconds / 60)}m`;
+  if (seconds < 86400) return `${Math.round(seconds / 3600)}h`;
+  return `${Math.round(seconds / 86400)}d`;
+}
+
+export function AnalyticsWorkspace() {
+  const snapshot = useSyncExternalStore(subscribeToAnalyticsWorkspace, getAnalyticsWorkspaceSnapshot, getAnalyticsWorkspaceSnapshot);
+  const analytics = snapshot.analytics;
+  const received = analytics ? metricTotal(analytics.series, "reports_received", "source") : 0;
+  const decisions = analytics ? metricTotal(analytics.series, "decisions", "maker_type") : 0;
+  const backlog = analytics?.backlog.reduce((sum, row) => sum + Number(row.count || 0), 0) ?? 0;
+  const reasons = new Map<string, number>();
+  for (const row of analytics?.series ?? []) {
+    if (row.metricKey === "reports_received" && row.dimensionKey === "reason") reasons.set(row.dimensionValue, (reasons.get(row.dimensionValue) ?? 0) + Number(row.value || 0));
+  }
+  const reasonRows = [...reasons.entries()].sort((left, right) => right[1] - left[1]);
+
+  return (
+    <div className="page-stack" data-react-slice="analytics-workspace">
+      <PageHeader titleId="analytics-title" title="Reports and outcomes" description="Review report volume, decisions, backlogs, and audit checks.">
+        <div className="surface-buttons">
+          {snapshot.canVerifyAudit ? <button className="secondary" type="button" disabled={snapshot.auditPending} onClick={dispatchAuditVerification}>{snapshot.auditPending ? "Verifying…" : "Verify audit"}</button> : null}
+          {snapshot.canExport ? <button className="secondary" type="button" disabled={snapshot.exportPending} onClick={dispatchReportExport}>{snapshot.exportPending ? "Exporting…" : "Export CSV"}</button> : null}
+          <button className="secondary" type="button" disabled={snapshot.refreshing || !snapshot.canRead} onClick={dispatchAnalyticsRefresh}>{snapshot.refreshing ? "Refreshing…" : "Refresh"}</button>
+        </div>
+      </PageHeader>
+      <section className="surface analytics-surface" aria-labelledby="analytics-title">
+        <div className="surface-head analytics-toolbar"><div><h2>Last {snapshot.days} days</h2><p>Counts describe reports and recorded decisions, not verified incidents.</p></div><label>Period<select value={snapshot.days} onChange={(event) => dispatchAnalyticsPeriod(Number(event.currentTarget.value))}><option value="7">7 days</option><option value="30">30 days</option><option value="90">90 days</option><option value="180">180 days</option><option value="365">365 days</option></select></label></div>
+        <div className="analytics-metrics" aria-busy={snapshot.loading || snapshot.refreshing}>
+          <article><span>Reports received</span><strong>{snapshot.loading ? "—" : received}</strong><small>Allegations, not confirmed incidents</small></article>
+          <article><span>Decisions recorded</span><strong>{snapshot.loading ? "—" : decisions}</strong><small>Human and bounded AI</small></article>
+          <article><span>Median resolution</span><strong>{snapshot.loading ? "—" : readableDuration(analytics?.resolutionSeconds.median ?? null)}</strong><small>{snapshot.loading ? "P95 —" : `P95 ${readableDuration(analytics?.resolutionSeconds.p95 ?? null)}`}</small></article>
+          <article><span>Open backlog</span><strong>{snapshot.loading ? "—" : backlog}</strong><small>Across visible operational states</small></article>
+        </div>
+        {snapshot.loading ? <div className="skeleton-block" role="status" aria-label="Loading reports and outcomes" /> : <div className="analytics-body"><div><h3>Reports by allegation</h3><div className="analytics-list">{reasonRows.length ? reasonRows.map(([reason, count]) => <div key={reason}><span>{readable(reason)}</span><strong>{count}</strong></div>) : <p>No report reasons were recorded in this period.</p>}</div></div><div><h3>Safeguards</h3><p className="audit-verification">{snapshot.auditVerification}</p><ul>{(analytics?.limitations ?? []).map((limitation) => <li key={limitation}>{limitation}</li>)}</ul></div></div>}
+        <p className="error surface-error" role="alert">{snapshot.error}</p>
+      </section>
+    </div>
+  );
+}

package/template/console/analytics/controller.ts

@@ -0,0 +1,133 @@
+import { authorizedFetch, errorMessage, requestJson } from "../lib/http";
+import { readable } from "../lib/format";
+import { getShellSnapshot, subscribeToShell } from "../shell/store";
+import { analyticsEvents } from "./events";
+import { getAnalyticsWorkspaceSnapshot, setAnalyticsWorkspaceSnapshot } from "./store";
+import type { AnalyticsRecord, AnalyticsWorkspaceSnapshot } from "./types";
+
+interface AnalyticsResponse { analytics: AnalyticsRecord }
+interface AuditVerificationResponse {
+  verification: {
+    valid: boolean;
+    verifiedEntries: number;
+    verifiedAt: string;
+    failedSequence?: string | number;
+    reason?: string;
+  };
+}
+
+const initialSnapshot = (): AnalyticsWorkspaceSnapshot => ({
+  loading: true,
+  refreshing: false,
+  error: "",
+  days: 30,
+  canRead: false,
+  canVerifyAudit: false,
+  canExport: false,
+  auditPending: false,
+  exportPending: false,
+  auditVerification: "Audit not verified in this session.",
+  analytics: null,
+});
+
+let actorId = "";
+let started = false;
+
+function withPermissions(snapshot: AnalyticsWorkspaceSnapshot): AnalyticsWorkspaceSnapshot {
+  const permissions = getShellSnapshot().session?.permissions;
+  return {
+    ...snapshot,
+    canRead: permissions?.readAnalytics === true,
+    canVerifyAudit: permissions?.viewAudit === true,
+    canExport: permissions?.exportData === true,
+  };
+}
+
+function reset(): void {
+  setAnalyticsWorkspaceSnapshot(initialSnapshot());
+}
+
+async function loadAnalytics(): Promise<void> {
+  const session = getShellSnapshot().session;
+  if (!session?.permissions.readAnalytics) {
+    setAnalyticsWorkspaceSnapshot(withPermissions({ ...initialSnapshot(), loading: false }));
+    return;
+  }
+  const current = getAnalyticsWorkspaceSnapshot();
+  setAnalyticsWorkspaceSnapshot(withPermissions({ ...current, error: "", refreshing: !current.loading }));
+  try {
+    const result = await requestJson<AnalyticsResponse>(`/v1/admin/analytics?days=${current.days}`);
+    setAnalyticsWorkspaceSnapshot((snapshot) => withPermissions({ ...snapshot, analytics: result.analytics }));
+  } catch (cause) {
+    setAnalyticsWorkspaceSnapshot((snapshot) => ({ ...snapshot, error: errorMessage(cause, "Analytics could not be loaded.") }));
+  } finally {
+    setAnalyticsWorkspaceSnapshot((snapshot) => withPermissions({ ...snapshot, loading: false, refreshing: false }));
+  }
+}
+
+async function exportReports(): Promise<void> {
+  const snapshot = getAnalyticsWorkspaceSnapshot();
+  if (!snapshot.canExport || snapshot.exportPending) return;
+  setAnalyticsWorkspaceSnapshot({ ...snapshot, error: "", exportPending: true });
+  try {
+    const response = await authorizedFetch(`/v1/admin/exports/reports.csv?days=${snapshot.days}`);
+    if (!response.ok) {
+      const result = await response.json().catch(() => ({})) as { error?: { message?: string } };
+      throw new Error(result.error?.message || "The report export could not be created.");
+    }
+    const url = URL.createObjectURL(await response.blob());
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = `safest-resolve-${new Date().toISOString().slice(0, 10)}.csv`;
+    link.click();
+    URL.revokeObjectURL(url);
+  } catch (cause) {
+    setAnalyticsWorkspaceSnapshot((current) => ({ ...current, error: errorMessage(cause, "The report export could not be created.") }));
+  } finally {
+    setAnalyticsWorkspaceSnapshot((current) => ({ ...current, exportPending: false }));
+  }
+}
+
+async function verifyAudit(): Promise<void> {
+  const snapshot = getAnalyticsWorkspaceSnapshot();
+  if (!snapshot.canVerifyAudit || snapshot.auditPending) return;
+  setAnalyticsWorkspaceSnapshot({ ...snapshot, error: "", auditPending: true });
+  try {
+    const result = await requestJson<AuditVerificationResponse>("/v1/admin/audit/verify");
+    const verification = result.verification;
+    const message = verification.valid
+      ? `${verification.verifiedEntries} chained entries verified at ${new Date(verification.verifiedAt).toLocaleTimeString()}.`
+      : `Audit verification failed at sequence ${verification.failedSequence || "unknown"}: ${readable(verification.reason)}.`;
+    setAnalyticsWorkspaceSnapshot((current) => ({ ...current, auditVerification: message }));
+  } catch (cause) {
+    setAnalyticsWorkspaceSnapshot((current) => ({ ...current, error: errorMessage(cause, "The audit chain could not be verified.") }));
+  } finally {
+    setAnalyticsWorkspaceSnapshot((current) => ({ ...current, auditPending: false }));
+  }
+}
+
+export function startAnalyticsController(): void {
+  if (started) return;
+  started = true;
+  subscribeToShell(() => {
+    const session = getShellSnapshot().session;
+    const nextActorId = session?.actor.id || "";
+    if (nextActorId === actorId) {
+      setAnalyticsWorkspaceSnapshot((snapshot) => withPermissions(snapshot));
+      return;
+    }
+    actorId = nextActorId;
+    reset();
+    if (session) void loadAnalytics();
+  });
+  window.addEventListener(analyticsEvents.refresh, () => { void loadAnalytics(); });
+  window.addEventListener(analyticsEvents.period, (event) => {
+    if (!(event instanceof CustomEvent)) return;
+    const days = Number(event.detail?.days);
+    if (![7, 30, 90, 180, 365].includes(days)) return;
+    setAnalyticsWorkspaceSnapshot((snapshot) => ({ ...snapshot, days }));
+    void loadAnalytics();
+  });
+  window.addEventListener(analyticsEvents.verifyAudit, () => { void verifyAudit(); });
+  window.addEventListener(analyticsEvents.exportReports, () => { void exportReports(); });
+}

package/template/console/analytics/events.ts

@@ -0,0 +1,33 @@
+import type { AnalyticsWorkspaceSnapshot } from "./types";
+
+export const analyticsEvents = {
+  state: "safest:analytics:state",
+  refresh: "safest:analytics:refresh",
+  period: "safest:analytics:period",
+  verifyAudit: "safest:analytics:verify-audit",
+  exportReports: "safest:analytics:export-reports",
+} as const;
+
+function dispatch<TDetail>(type: string, detail?: TDetail): void {
+  window.dispatchEvent(detail === undefined ? new Event(type) : new CustomEvent(type, { detail }));
+}
+
+export function dispatchAnalyticsRefresh(): void { dispatch(analyticsEvents.refresh); }
+export function dispatchAnalyticsPeriod(days: number): void { dispatch(analyticsEvents.period, { days }); }
+export function dispatchAuditVerification(): void { dispatch(analyticsEvents.verifyAudit); }
+export function dispatchReportExport(): void { dispatch(analyticsEvents.exportReports); }
+
+export function isAnalyticsWorkspaceSnapshot(value: unknown): value is AnalyticsWorkspaceSnapshot {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value as Partial<AnalyticsWorkspaceSnapshot>;
+  return typeof candidate.loading === "boolean"
+    && typeof candidate.refreshing === "boolean"
+    && typeof candidate.error === "string"
+    && typeof candidate.days === "number"
+    && typeof candidate.canRead === "boolean"
+    && typeof candidate.canVerifyAudit === "boolean"
+    && typeof candidate.canExport === "boolean"
+    && typeof candidate.auditPending === "boolean"
+    && typeof candidate.exportPending === "boolean"
+    && typeof candidate.auditVerification === "string";
+}

package/template/console/analytics/store.ts

@@ -0,0 +1,33 @@
+import { analyticsEvents, isAnalyticsWorkspaceSnapshot } from "./events";
+import type { AnalyticsWorkspaceSnapshot } from "./types";
+
+const subscribers = new Set<() => void>();
+let snapshot: AnalyticsWorkspaceSnapshot = {
+  loading: true,
+  refreshing: false,
+  error: "",
+  days: 30,
+  canRead: false,
+  canVerifyAudit: false,
+  canExport: false,
+  auditPending: false,
+  exportPending: false,
+  auditVerification: "Audit not verified in this session.",
+  analytics: null,
+};
+
+window.addEventListener(analyticsEvents.state, (event) => {
+  if (!(event instanceof CustomEvent) || !isAnalyticsWorkspaceSnapshot(event.detail)) return;
+  snapshot = event.detail;
+  for (const subscriber of subscribers) subscriber();
+});
+
+export function getAnalyticsWorkspaceSnapshot(): AnalyticsWorkspaceSnapshot { return snapshot; }
+export function setAnalyticsWorkspaceSnapshot(next: AnalyticsWorkspaceSnapshot | ((current: AnalyticsWorkspaceSnapshot) => AnalyticsWorkspaceSnapshot)): void {
+  snapshot = typeof next === "function" ? next(snapshot) : next;
+  for (const subscriber of subscribers) subscriber();
+}
+export function subscribeToAnalyticsWorkspace(callback: () => void): () => void {
+  subscribers.add(callback);
+  return () => subscribers.delete(callback);
+}

package/template/console/analytics/types.ts

@@ -0,0 +1,38 @@
+export interface AnalyticsSeriesRow {
+  aggregateDate: string;
+  metricKey: string;
+  dimensionKey: string;
+  dimensionValue: string;
+  value: number;
+}
+
+export interface AnalyticsBacklogRow {
+  queueId?: string | null;
+  state: string;
+  count: number;
+  oldestAgeSeconds?: number | null;
+}
+
+export interface AnalyticsRecord {
+  generatedAt: string;
+  fromDate: string;
+  days: number;
+  series: AnalyticsSeriesRow[];
+  backlog: AnalyticsBacklogRow[];
+  resolutionSeconds: { count: number; median: number | null; p90: number | null; p95: number | null };
+  limitations: string[];
+}
+
+export interface AnalyticsWorkspaceSnapshot {
+  loading: boolean;
+  refreshing: boolean;
+  error: string;
+  days: number;
+  canRead: boolean;
+  canVerifyAudit: boolean;
+  canExport: boolean;
+  auditPending: boolean;
+  exportPending: boolean;
+  auditVerification: string;
+  analytics: AnalyticsRecord | null;
+}

package/template/console/appeals/AppealWorkspace.tsx

@@ -0,0 +1,73 @@
+import { useEffect, useRef, useState, useSyncExternalStore, type FormEvent } from "react";
+import { readable, relativeTime } from "../lib/format";
+import { PageHeader } from "../components/PageHeader";
+import { dispatchAppealDecision, dispatchAppealRefresh, dispatchClaimAppeal, dispatchCloseAppeal, dispatchOpenAppeal } from "./events";
+import { getAppealWorkspaceSnapshot, subscribeToAppealWorkspace } from "./store";
+import type { AppealOutcome, AppealRecord } from "./types";
+
+function AppealRow({ appeal }: { appeal: AppealRecord }) {
+  return (
+    <article className="appeal-row">
+      <div><strong>{appeal.reportReference}</strong><small>{readable(appeal.appellantAudience)} · {relativeTime(appeal.submittedAt)}<span className="appeal-mobile-meta"> · {readable(appeal.state)} · {appeal.reviewerId ? "Claimed" : "Unclaimed"}</span></small></div>
+      <span>{readable(appeal.state)}</span>
+      <span>{appeal.reviewerId ? "Claimed" : "Unclaimed"}</span>
+      <button className="secondary" type="button" onClick={() => dispatchOpenAppeal(appeal.id)}>Review</button>
+    </article>
+  );
+}
+
+export function AppealWorkspace() {
+  const snapshot = useSyncExternalStore(subscribeToAppealWorkspace, getAppealWorkspaceSnapshot, getAppealWorkspaceSnapshot);
+  return (
+    <div className="page-stack" data-react-slice="appeal-workspace">
+      <PageHeader titleId="appeals-title" title="Appeals" description="Review contested decisions with a separate human owner.">
+        <div className="surface-buttons"><button className="secondary" type="button" disabled={snapshot.refreshing || !snapshot.canReview} onClick={dispatchAppealRefresh}>{snapshot.refreshing ? "Refreshing…" : "Refresh"}</button></div>
+      </PageHeader>
+      <section className="surface appeals-surface" aria-labelledby="appeals-title">
+        <div className="appeal-list" aria-busy={snapshot.loading || snapshot.refreshing}>
+          {snapshot.loading ? <div className="skeleton-block" role="status" aria-label="Loading appeals" /> : snapshot.appeals.length ? snapshot.appeals.map((appeal) => <AppealRow appeal={appeal} key={appeal.id} />) : <div className="empty"><span aria-hidden="true">✓</span><h3>No appeals in this view</h3><p>New appeals will appear here when a participant contests a decision.</p></div>}
+        </div>
+        <p className="error surface-error" role="alert">{snapshot.error}</p>
+      </section>
+    </div>
+  );
+}
+
+export function AppealDialog() {
+  const snapshot = useSyncExternalStore(subscribeToAppealWorkspace, getAppealWorkspaceSnapshot, getAppealWorkspaceSnapshot);
+  const dialogRef = useRef<HTMLDialogElement>(null);
+  const rationaleRef = useRef<HTMLTextAreaElement>(null);
+  const [outcome, setOutcome] = useState<AppealOutcome>("upheld");
+  const [rationale, setRationale] = useState("");
+  const [participantNotice, setParticipantNotice] = useState("");
+  const appeal = snapshot.detail.appeal;
+  const activeClaim = Boolean(appeal?.reviewerId && appeal.claimExpiresAt && Date.parse(appeal.claimExpiresAt) > Date.parse(snapshot.generatedAt));
+  const mine = Boolean(activeClaim && appeal?.reviewerId === snapshot.actorId);
+  const disabled = !mine || snapshot.detail.pendingAction === "decision";
+
+  useEffect(() => {
+    const dialog = dialogRef.current;
+    if (!dialog) return;
+    if (snapshot.detail.appealId && !dialog.open) dialog.showModal();
+    if (!snapshot.detail.appealId && dialog.open) dialog.close();
+  }, [snapshot.detail.appealId]);
+  useEffect(() => {
+    setOutcome("upheld");
+    setRationale("");
+    setParticipantNotice("");
+    if (snapshot.detail.appealId) rationaleRef.current?.focus();
+  }, [snapshot.detail.appealId]);
+
+  const submit = (event: FormEvent<HTMLFormElement>): void => {
+    event.preventDefault();
+    dispatchAppealDecision({ outcome, rationale, participantNotice });
+  };
+
+  return (
+    <dialog ref={dialogRef} className="detail-dialog appeal-dialog" aria-labelledby="appeal-reference" onCancel={(event) => { event.preventDefault(); dispatchCloseAppeal(); }} data-react-slice="appeal-dialog">
+      <div className="detail-head"><div><h2 id="appeal-reference">{appeal ? `${appeal.reportReference} appeal` : "Appeal"}</h2><p>{appeal ? readable(appeal.state) : "Loading appeal…"}</p></div><button className="icon-button" type="button" aria-label="Close appeal" onClick={dispatchCloseAppeal}>×</button></div>
+      {appeal ? <><p>{appeal.reason}</p><div className="claim-bar"><p>{mine ? "This appeal is claimed by you." : activeClaim ? "Another reviewer currently owns this appeal." : "Appeals require a separate human reviewer."}</p>{!activeClaim && snapshot.canReview ? <button className="primary" type="button" disabled={snapshot.detail.pendingAction === "claim"} onClick={dispatchClaimAppeal}>{snapshot.detail.pendingAction === "claim" ? "Claiming…" : "Claim appeal"}</button> : null}</div><form onSubmit={submit}><label>Outcome<select value={outcome} disabled={disabled} onChange={(event) => setOutcome(event.currentTarget.value as AppealOutcome)}><option value="upheld">Uphold</option><option value="modified">Modify</option><option value="reversed">Reverse</option></select></label><label>Internal rationale<textarea ref={rationaleRef} maxLength={8000} required disabled={disabled} value={rationale} onChange={(event) => setRationale(event.currentTarget.value)} /></label><label>Participant notice<textarea maxLength={4000} required disabled={disabled} value={participantNotice} onChange={(event) => setParticipantNotice(event.currentTarget.value)} /></label><button className="primary" type="submit" disabled={disabled}>{snapshot.detail.pendingAction === "decision" ? "Recording…" : "Record appeal decision"}</button></form></> : null}
+      <p className="error" role="alert">{snapshot.detail.error}</p>
+    </dialog>
+  );
+}