create-safest-tools 0.2.0

package/template/migrations/0031_shadow_quality_integrity.sql

@@ -0,0 +1,7 @@
+PRAGMA foreign_keys = ON;
+
+CREATE UNIQUE INDEX shadow_comparisons_one_per_shadow_run_idx
+  ON shadow_comparisons(shadow_run_id);
+
+CREATE INDEX findings_shadow_comparison_idx
+  ON findings(run_id, status, created_at DESC, id DESC);

package/template/migrations/0032_action_delivery_outbox.sql

@@ -0,0 +1,55 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE action_proposals ADD COLUMN delivery_attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (delivery_attempt_count >= 0);
+ALTER TABLE action_proposals ADD COLUMN next_attempt_at TEXT;
+ALTER TABLE action_proposals ADD COLUMN lease_expires_at TEXT;
+ALTER TABLE action_proposals ADD COLUMN last_error_code TEXT;
+ALTER TABLE action_proposals ADD COLUMN delivery_terminal INTEGER NOT NULL DEFAULT 0 CHECK (delivery_terminal IN (0, 1));
+
+CREATE INDEX action_proposals_delivery_due_idx
+  ON action_proposals(state, delivery_terminal, next_attempt_at, id);
+
+ALTER TABLE dead_letter_items RENAME TO dead_letter_items_v5;
+
+CREATE TABLE dead_letter_items (
+  id TEXT PRIMARY KEY,
+  fingerprint TEXT NOT NULL UNIQUE,
+  source_queue TEXT NOT NULL,
+  source_message_id TEXT NOT NULL,
+  job_type TEXT NOT NULL CHECK (job_type IN (
+    'route_report', 'process_ai_report', 'run_enrichment', 'fetch_evidence',
+    'dispatch_workflow', 'deliver_action', 'deliver_notification', 'deliver_email',
+    'apply_action_proposal', 'invalid'
+  )),
+  job_id TEXT,
+  report_id TEXT REFERENCES reports(id),
+  outbox_id TEXT,
+  incident_id TEXT REFERENCES operations_incidents(id) ON DELETE SET NULL,
+  state TEXT NOT NULL DEFAULT 'open' CHECK (state IN ('open', 'acknowledged', 'resolved')),
+  error_code TEXT NOT NULL,
+  occurrence_count INTEGER NOT NULL DEFAULT 1 CHECK (occurrence_count > 0),
+  details_json TEXT NOT NULL DEFAULT '{}',
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  resolved_at TEXT
+);
+
+INSERT INTO dead_letter_items (
+  id, fingerprint, source_queue, source_message_id, job_type, job_id,
+  report_id, outbox_id, incident_id, state, error_code, occurrence_count,
+  details_json, first_seen_at, last_seen_at, resolved_at
+)
+SELECT
+  id, fingerprint, source_queue, source_message_id, job_type, job_id,
+  report_id, outbox_id, incident_id, state, error_code, occurrence_count,
+  details_json, first_seen_at, last_seen_at, resolved_at
+FROM dead_letter_items_v5;
+
+DROP TABLE dead_letter_items_v5;
+
+CREATE INDEX dead_letter_items_state_idx
+  ON dead_letter_items(state, last_seen_at DESC, id DESC);
+CREATE INDEX dead_letter_items_report_idx
+  ON dead_letter_items(report_id, last_seen_at DESC, id DESC);
+CREATE INDEX dead_letter_items_incident_idx
+  ON dead_letter_items(incident_id, state, last_seen_at DESC, id DESC);

package/template/migrations/0033_configuration_and_assistant_drafts.sql

@@ -0,0 +1,43 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE configuration_drafts (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  configuration_type TEXT NOT NULL CHECK (configuration_type IN ('form', 'policy', 'template', 'routing_rules')),
+  configuration_key TEXT NOT NULL,
+  content_json TEXT NOT NULL,
+  content_digest TEXT NOT NULL,
+  validation_json TEXT NOT NULL DEFAULT '{"valid":false,"errors":[{"code":"not_validated"}]}',
+  validation_status TEXT NOT NULL DEFAULT 'not_validated' CHECK (validation_status IN ('not_validated', 'valid', 'invalid')),
+  revision INTEGER NOT NULL DEFAULT 1 CHECK (revision >= 1),
+  last_published_version_id TEXT,
+  created_by TEXT NOT NULL,
+  updated_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (installation_id, configuration_type, configuration_key)
+);
+
+CREATE INDEX configuration_drafts_type_idx
+  ON configuration_drafts(installation_id, configuration_type, configuration_key);
+
+CREATE TABLE assistant_drafts (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL REFERENCES assistant_sessions(id) ON DELETE CASCADE,
+  principal_id TEXT NOT NULL,
+  draft_type TEXT NOT NULL CHECK (draft_type IN ('workflow', 'form', 'policy', 'template', 'routing_rules')),
+  target_id TEXT,
+  title TEXT NOT NULL,
+  content_json TEXT NOT NULL,
+  content_digest TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'adopted', 'expired')),
+  idempotency_key TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  adopted_at TEXT,
+  adopted_target_id TEXT,
+  UNIQUE (session_id, idempotency_key)
+);
+
+CREATE INDEX assistant_drafts_principal_idx
+  ON assistant_drafts(principal_id, status, created_at DESC, id DESC);

package/template/migrations/0034_installation_integrations.sql

@@ -0,0 +1,31 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE installations ADD COLUMN settings_json TEXT NOT NULL DEFAULT '{}';
+ALTER TABLE application_integrations ADD COLUMN scopes_json TEXT NOT NULL DEFAULT '["submit_reports","mint_context_tokens"]';
+
+CREATE TABLE integration_api_keys (
+  id TEXT PRIMARY KEY,
+  integration_id TEXT NOT NULL REFERENCES application_integrations(id) ON DELETE CASCADE,
+  key_id TEXT NOT NULL UNIQUE,
+  key_hash TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'revoked', 'expired')),
+  valid_from TEXT NOT NULL,
+  expires_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  revoked_by TEXT,
+  revoked_at TEXT
+);
+
+CREATE INDEX integration_api_keys_auth_idx
+  ON integration_api_keys(integration_id, status, valid_from, expires_at, id);
+
+INSERT OR IGNORE INTO installation_features (
+  installation_id, feature_key, state, capability_json, checked_at, revision
+) VALUES
+  ('default', 'database', 'ready', '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 1),
+  ('default', 'workflow_runtime', 'setup_required', '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 1),
+  ('default', 'workers_ai', 'setup_required', '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 1),
+  ('default', 'object_storage', 'setup_required', '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 1),
+  ('default', 'queues', 'setup_required', '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 1),
+  ('default', 'email', 'disabled', '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 1);

package/template/migrations/0035_workspace_governance.sql

@@ -0,0 +1,21 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE saved_views (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  principal_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  filters_json TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (installation_id, principal_id, name)
+);
+
+CREATE INDEX saved_views_principal_idx
+  ON saved_views(installation_id, principal_id, updated_at DESC, id DESC);
+
+ALTER TABLE export_jobs ADD COLUMN idempotency_key TEXT;
+
+CREATE UNIQUE INDEX export_jobs_idempotency_idx
+  ON export_jobs(installation_id, requested_by, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;

package/template/migrations/0036_published_routing_baseline.sql

@@ -0,0 +1,15 @@
+PRAGMA foreign_keys = ON;
+
+INSERT INTO routing_rule_versions (
+  id, installation_id, version, rules_json, fixture_results_json,
+  published_at, created_by, created_at
+)
+SELECT
+  'default-routing-v1', 'default', 1,
+  '{"default_queue_id":"standard-human","safeguard_queue_id":"urgent-human","intake_enrichment_component_ids":[],"rules":[],"fixtures":[]}',
+  '{"valid":true,"tested_at":"migration"}',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE NOT EXISTS (
+  SELECT 1 FROM routing_rule_versions
+  WHERE installation_id = 'default' AND published_at IS NOT NULL
+);

package/template/migrations/0037_builtin_phishing_specialist.sql

@@ -0,0 +1,71 @@
+-- Supply the first immutable Safest-owned specialist component.
+
+INSERT OR IGNORE INTO component_definitions (
+  id, installation_id, component_key, name, description, component_kind,
+  effect_class, owner_kind, status, active_version_id, created_by,
+  created_at, updated_at
+) VALUES (
+  'safest-builtin-phishing-url', 'default', 'safest-builtin-phishing-url',
+  'Phishing URL specialist',
+  'Deterministic, read-only URL normalization and phishing-risk signals. It never fetches the submitted URL and records unavailable reputation/content checks as uncertainty.',
+  'specialist_agent', 'read_only', 'safest', 'active', NULL, 'system',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+);
+
+INSERT OR IGNORE INTO component_versions (
+  id, definition_id, version, implementation_kind, implementation_reference,
+  input_schema_json, output_schema_json, allowed_input_fields_json,
+  data_classifications_json, connection_version_id, risk_class,
+  timeout_policy_json, retry_policy_json, cache_policy_json,
+  concurrency_policy_json, budget_policy_json, approval_policy_json,
+  tool_manifest_json, compatibility_json, package_digest,
+  signature_metadata_json, published_at, retired_at, created_by, created_at
+)
+SELECT
+  'safest-builtin-phishing-url-v1', 'safest-builtin-phishing-url', 1,
+  'specialist_agent', 'phishing-url-v1',
+  '{"type":"object","additionalProperties":false,"required":["url"],"properties":{"url":{"type":"string","minLength":1,"maxLength":2048}}}',
+  '{"type":"object","additionalProperties":false,"required":["normalized_url","normalized_url_hash","hostname_hash","scheme","signals","conclusion","summary","uncertainty","confidence"],"properties":{"normalized_url":{"type":"string"},"normalized_url_hash":{"type":"string"},"hostname_hash":{"type":"string"},"scheme":{"type":"string","enum":["http","https"]},"signals":{"type":"array","items":{"type":"string"}},"conclusion":{"type":"string","enum":["likely_phishing","suspicious","no_phishing_signal","unavailable","escalate"]},"summary":{"type":"string"},"uncertainty":{"type":"array","items":{"type":"string"}},"confidence":{"type":"number","minimum":0,"maximum":1}}}',
+  '["target.customer_url","answers.url"]',
+  '["report_operational","potentially_sensitive_url"]', NULL, 'low',
+  '{"timeout_ms":1500}', '{"maximum_attempts":1}',
+  '{"enabled":true,"ttl_seconds":3600,"key_fields":["url"]}',
+  '{"maximum_concurrency":20}', '{"metric":"calls","maximum_per_day":10000}',
+  '{}', '["url_parser","hostname_heuristics"]',
+  '{"fixture_evidence":{"passed":true,"validated_by":"safest_release","fixtures":["suspicious-login-url"]},"network_access":false,"runtime_protocol":"1"}',
+  'sha256:a2072d7111273ad5038ae0f2e11c3e3e227972a56b8ed71162a5f402d889829d',
+  '{"publisher":"safest","source":"built_in","digest_basis":"src/component-executor.ts"}',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), NULL, 'system',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE EXISTS (SELECT 1 FROM component_definitions WHERE id = 'safest-builtin-phishing-url');
+
+UPDATE component_definitions
+SET active_version_id = 'safest-builtin-phishing-url-v1',
+    updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE id = 'safest-builtin-phishing-url'
+  AND EXISTS (SELECT 1 FROM component_versions WHERE id = 'safest-builtin-phishing-url-v1');
+
+INSERT OR IGNORE INTO component_fixtures (
+  id, component_version_id, name, input_json, expected_json,
+  expected_status, created_by, created_at
+)
+SELECT
+  'safest-builtin-phishing-url-v1-fixture-suspicious',
+  'safest-builtin-phishing-url-v1', 'suspicious-login-url',
+  '{"url":"http://login.verify.example.com/account"}',
+  '{"normalized_url":"http://login.verify.example.com/account","normalized_url_hash":"sha256:f19ea3e9f98e298edbff77f8bd16194a45dc0b8677fc43ef1430904cd91a8355","hostname_hash":"sha256:852ead493ae4fd09da4de58d1f1ba7f9f96a464fc73662f110fb8a1044ebd249","scheme":"http","signals":["credential_lure_term","plaintext_transport"],"conclusion":"suspicious","summary":"Observed 2 deterministic phishing-risk signal(s).","uncertainty":["dns_reputation_and_content_not_checked"],"confidence":0.69}',
+  'succeeded', 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE EXISTS (SELECT 1 FROM component_versions WHERE id = 'safest-builtin-phishing-url-v1');
+
+INSERT OR IGNORE INTO component_test_runs (
+  id, component_version_id, fixture_id, status, output_json,
+  error_code, started_by, started_at, finished_at
+)
+SELECT
+  'safest-builtin-phishing-url-v1-test-suspicious',
+  'safest-builtin-phishing-url-v1',
+  'safest-builtin-phishing-url-v1-fixture-suspicious', 'passed',
+  '{"mode":"simulated","validated_by":"safest_release","network_access":false}',
+  NULL, 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE EXISTS (SELECT 1 FROM component_fixtures WHERE id = 'safest-builtin-phishing-url-v1-fixture-suspicious');

package/template/migrations/0038_remove_deprecated_enrichment_runtime.sql

@@ -0,0 +1,228 @@
+PRAGMA foreign_keys = ON;
+
+-- Preserve webhook definitions created after the component registry was introduced.
+INSERT OR IGNORE INTO connection_definitions (
+  id, installation_id, connection_key, name, description, kind, status,
+  active_version_id, created_by, created_at, updated_at
+)
+SELECT
+  'legacy-enrichment-connection:' || d.id,
+  d.installation_id,
+  'legacy-' || d.enrichment_key,
+  d.name || ' connection',
+  d.description,
+  'webhook',
+  CASE d.status WHEN 'paused' THEN 'paused' WHEN 'archived' THEN 'archived' ELSE 'active' END,
+  'legacy-enrichment-connection-version:' || d.active_version_id,
+  d.created_by,
+  d.created_at,
+  d.updated_at
+FROM enrichment_definitions d;
+
+INSERT OR IGNORE INTO connection_versions (
+  id, connection_id, version, base_url, service_binding_name,
+  allowed_hosts_json, allowed_methods_json, allowed_path_prefixes_json,
+  redirect_policy_json, request_limit_bytes, response_limit_bytes,
+  response_content_types_json, timeout_ms, concurrency_limit,
+  requests_per_window, window_seconds, credential_strategy, secret_reference,
+  signing_strategy_json, oauth_configuration_json, published_at, retired_at,
+  created_by, created_at
+)
+SELECT
+  'legacy-enrichment-connection-version:' || v.id,
+  'legacy-enrichment-connection:' || v.definition_id,
+  v.version,
+  v.webhook_url,
+  NULL,
+  '[]',
+  '["POST"]',
+  '["/"]',
+  '{"follow":false,"maximum":0}',
+  65536,
+  262144,
+  '["application/json"]',
+  v.timeout_ms,
+  8,
+  60,
+  60,
+  'hmac',
+  v.secret_binding,
+  '{"kind":"safest_hmac_v1"}',
+  '{}',
+  v.published_at,
+  NULL,
+  v.created_by,
+  v.created_at
+FROM enrichment_definition_versions v;
+
+UPDATE connection_versions
+SET allowed_hosts_json = json_array(
+  substr(
+    base_url,
+    instr(base_url, '://') + 3,
+    CASE
+      WHEN instr(substr(base_url, instr(base_url, '://') + 3), '/') = 0
+        THEN length(base_url)
+      ELSE instr(substr(base_url, instr(base_url, '://') + 3), '/') - 1
+    END
+  )
+)
+WHERE id LIKE 'legacy-enrichment-connection-version:%';
+
+INSERT OR IGNORE INTO connection_health (
+  connection_version_id, state, consecutive_failures, revision, updated_at
+)
+SELECT
+  'legacy-enrichment-connection-version:' || v.id,
+  'unknown',
+  0,
+  1,
+  v.created_at
+FROM enrichment_definition_versions v;
+
+INSERT OR IGNORE INTO component_definitions (
+  id, installation_id, component_key, name, description, component_kind,
+  effect_class, owner_kind, status, active_version_id, created_by, created_at, updated_at
+)
+SELECT
+  d.id,
+  d.installation_id,
+  d.enrichment_key,
+  d.name,
+  d.description,
+  'webhook_enrichment',
+  'read_only',
+  'customer',
+  CASE d.status WHEN 'paused' THEN 'paused' WHEN 'archived' THEN 'archived' ELSE 'active' END,
+  d.active_version_id,
+  d.created_by,
+  d.created_at,
+  d.updated_at
+FROM enrichment_definitions d;
+
+INSERT OR IGNORE INTO component_versions (
+  id, definition_id, version, implementation_kind, implementation_reference,
+  input_schema_json, output_schema_json, allowed_input_fields_json,
+  data_classifications_json, connection_version_id, risk_class,
+  timeout_policy_json, retry_policy_json, cache_policy_json,
+  concurrency_policy_json, budget_policy_json, approval_policy_json,
+  tool_manifest_json, compatibility_json, published_at, created_by, created_at
+)
+SELECT
+  v.id,
+  v.definition_id,
+  v.version,
+  'webhook',
+  v.webhook_url,
+  json_object('type', 'object', 'properties', json(v.input_fields_json)),
+  v.output_schema_json,
+  v.input_fields_json,
+  '["report_operational"]',
+  'legacy-enrichment-connection-version:' || v.id,
+  'low',
+  json_object('timeout_ms', v.timeout_ms),
+  json_object('maximum_attempts', v.max_attempts, 'backoff', 'exponential'),
+  json_object('enabled', CASE WHEN v.ttl_seconds > 0 THEN json('true') ELSE json('false') END, 'ttl_seconds', v.ttl_seconds),
+  '{"maximum_concurrency":8}',
+  '{}',
+  '{}',
+  '[]',
+  '{}',
+  v.published_at,
+  v.created_by,
+  v.created_at
+FROM enrichment_definition_versions v;
+
+UPDATE component_versions
+SET compatibility_json = json_remove(compatibility_json, '$.legacy_enrichment')
+WHERE json_type(compatibility_json, '$.legacy_enrichment') IS NOT NULL;
+
+-- Convert the pre-mapping routing field, then make the explicit mapping shape canonical.
+UPDATE routing_rule_versions
+SET rules_json = json_set(
+  rules_json,
+  '$.intake_enrichments',
+  COALESCE(
+    (
+      SELECT json_group_array(json_object(
+        'component_version_id', value,
+        'input_mapping', json('{}')
+      ))
+      FROM json_each(routing_rule_versions.rules_json, '$.intake_enrichment_component_ids')
+      WHERE type = 'text'
+    ),
+    json('[]')
+  )
+)
+WHERE json_type(rules_json, '$.intake_enrichment_component_ids') = 'array'
+  AND json_type(rules_json, '$.intake_enrichments') IS NULL;
+
+UPDATE routing_rule_versions
+SET rules_json = json_remove(rules_json, '$.intake_enrichment_component_ids')
+WHERE json_type(rules_json, '$.intake_enrichment_component_ids') IS NOT NULL;
+
+UPDATE queue_versions
+SET routing_criteria_json = '{"match":"all","conditions":[]}',
+    enrichment_requirements_json = '[]';
+
+DROP TABLE enrichment_results;
+DROP TABLE enrichment_attempts;
+DROP TABLE enrichment_requests;
+DROP TABLE enrichment_definition_versions;
+DROP TABLE enrichment_definitions;
+
+-- Retain direct human-decision and appeal action delivery as a distinct, accurately named outbox.
+DROP INDEX action_outbox_due_idx;
+DROP INDEX action_outbox_reconcile_idx;
+ALTER TABLE action_outbox RENAME TO decision_action_outbox;
+ALTER TABLE action_attempts RENAME TO decision_action_attempts;
+CREATE INDEX decision_action_outbox_due_idx
+  ON decision_action_outbox(status, next_attempt_at, id);
+CREATE INDEX decision_action_outbox_reconcile_idx
+  ON decision_action_outbox(terminal, status, next_attempt_at, lease_expires_at, id);
+
+ALTER TABLE dead_letter_items RENAME TO dead_letter_items_v6;
+
+CREATE TABLE dead_letter_items (
+  id TEXT PRIMARY KEY,
+  fingerprint TEXT NOT NULL UNIQUE,
+  source_queue TEXT NOT NULL,
+  source_message_id TEXT NOT NULL,
+  job_type TEXT NOT NULL CHECK (job_type IN (
+    'route_report', 'process_ai_report', 'fetch_evidence',
+    'dispatch_workflow', 'deliver_action', 'deliver_notification', 'deliver_email',
+    'apply_action_proposal', 'invalid'
+  )),
+  job_id TEXT,
+  report_id TEXT REFERENCES reports(id),
+  outbox_id TEXT,
+  incident_id TEXT REFERENCES operations_incidents(id) ON DELETE SET NULL,
+  state TEXT NOT NULL DEFAULT 'open' CHECK (state IN ('open', 'acknowledged', 'resolved')),
+  error_code TEXT NOT NULL,
+  occurrence_count INTEGER NOT NULL DEFAULT 1 CHECK (occurrence_count > 0),
+  details_json TEXT NOT NULL DEFAULT '{}',
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  resolved_at TEXT
+);
+
+INSERT INTO dead_letter_items (
+  id, fingerprint, source_queue, source_message_id, job_type, job_id,
+  report_id, outbox_id, incident_id, state, error_code, occurrence_count,
+  details_json, first_seen_at, last_seen_at, resolved_at
+)
+SELECT
+  id, fingerprint, source_queue, source_message_id,
+  CASE job_type WHEN 'run_enrichment' THEN 'invalid' ELSE job_type END,
+  job_id, report_id, outbox_id, incident_id, state, error_code, occurrence_count,
+  details_json, first_seen_at, last_seen_at, resolved_at
+FROM dead_letter_items_v6;
+
+DROP TABLE dead_letter_items_v6;
+
+CREATE INDEX dead_letter_items_state_idx
+  ON dead_letter_items(state, last_seen_at DESC, id DESC);
+CREATE INDEX dead_letter_items_report_idx
+  ON dead_letter_items(report_id, last_seen_at DESC, id DESC);
+CREATE INDEX dead_letter_items_incident_idx
+  ON dead_letter_items(incident_id, state, last_seen_at DESC, id DESC);

package/template/migrations/0039_secure_reporting_channels.sql

@@ -0,0 +1,45 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE application_integrations
+  ADD COLUMN channel_mode TEXT NOT NULL DEFAULT 'contextual'
+  CHECK (channel_mode IN ('contextual', 'anonymous'));
+
+ALTER TABLE application_integrations
+  ADD COLUMN form_version_id TEXT REFERENCES report_form_versions(id);
+
+ALTER TABLE application_integrations
+  ADD COLUMN context_schema_json TEXT NOT NULL
+  DEFAULT '{"version":1,"allow_unknown":true,"fields":[]}';
+
+ALTER TABLE report_targets
+  ADD COLUMN routing_facts_json TEXT NOT NULL DEFAULT '{}';
+
+UPDATE report_targets SET routing_facts_json = signed_facts_json;
+
+CREATE TABLE report_contexts (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  integration_id TEXT NOT NULL REFERENCES application_integrations(id) ON DELETE CASCADE,
+  form_version_id TEXT NOT NULL REFERENCES report_form_versions(id),
+  origin TEXT NOT NULL,
+  reporter_reference TEXT,
+  target_type TEXT NOT NULL,
+  target_reference TEXT NOT NULL,
+  target_owner_reference TEXT,
+  target_customer_url TEXT,
+  trusted_facts_json TEXT NOT NULL DEFAULT '{}',
+  routing_facts_json TEXT NOT NULL DEFAULT '{}',
+  context_schema_version INTEGER NOT NULL DEFAULT 1 CHECK (context_schema_version > 0),
+  assertion_source TEXT NOT NULL DEFAULT 'customer_backend'
+    CHECK (assertion_source IN ('customer_backend', 'resolve_hosted')),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  used_at TEXT,
+  report_id TEXT REFERENCES reports(id) ON DELETE SET NULL
+);
+
+CREATE INDEX report_contexts_expiry_idx
+  ON report_contexts(expires_at, used_at, id);
+
+CREATE INDEX report_contexts_integration_idx
+  ON report_contexts(integration_id, created_at DESC, id);

package/template/migrations/0040_notification_only_reporting.sql

@@ -0,0 +1,24 @@
+-- Status portals and bearer capabilities are intentionally retired.
+-- Reporter communication now leaves Resolve only through signed webhooks or email delivery.
+DROP TABLE portal_sessions;
+
+UPDATE report_participants
+SET contact_mode = CASE
+  WHEN reference IS NOT NULL OR contact_ciphertext IS NOT NULL THEN 'customer_notification'
+  ELSE 'none'
+END
+WHERE contact_mode = 'portal';
+
+CREATE TRIGGER report_participants_reject_portal_insert
+BEFORE INSERT ON report_participants
+WHEN NEW.contact_mode = 'portal'
+BEGIN
+  SELECT RAISE(ABORT, 'portal contact mode has been removed');
+END;
+
+CREATE TRIGGER report_participants_reject_portal_update
+BEFORE UPDATE OF contact_mode ON report_participants
+WHEN NEW.contact_mode = 'portal'
+BEGIN
+  SELECT RAISE(ABORT, 'portal contact mode has been removed');
+END;

package/template/migrations/0041_better_auth_credentials.sql

@@ -0,0 +1,17 @@
+PRAGMA foreign_keys = ON;
+
+DROP TABLE operator_password_reset_limits;
+DROP TABLE operator_password_resets;
+DROP TABLE operator_login_limits;
+
+ALTER TABLE operator_sessions RENAME TO infrastructure_owner_sessions;
+DROP INDEX operator_sessions_user_idx;
+DROP INDEX operator_sessions_expiry_idx;
+CREATE INDEX infrastructure_owner_sessions_user_idx
+  ON infrastructure_owner_sessions(user_id, revoked_at, expires_at DESC, id);
+CREATE INDEX infrastructure_owner_sessions_expiry_idx
+  ON infrastructure_owner_sessions(revoked_at, expires_at, id);
+
+ALTER TABLE operator_users DROP COLUMN password_hash;
+ALTER TABLE operator_users DROP COLUMN password_salt;
+ALTER TABLE operator_users DROP COLUMN password_iterations;

package/template/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "safest-resolve-installation",
+  "version": "0.2.0",
+  "safestToolsVersion": "0.2.0-resolve",
+  "private": true,
+  "license": "Apache-2.0",
+  "type": "module",
+  "scripts": {
+    "build": "npm run build:console",
+    "build:console": "vite build --config vite.console.config.ts",
+    "secrets:init": "node scripts/reports-secrets.mjs",
+    "setup": "npm run build:console && node scripts/reports-deploy.mjs",
+    "setup:plan": "node scripts/reports-deploy.mjs --plan",
+    "upgrade": "npm run backup && npm run build:console && node scripts/reports-deploy.mjs --upgrade",
+    "upgrade:plan": "node scripts/reports-deploy.mjs --upgrade --plan",
+    "backup": "node scripts/reports-backup.mjs",
+    "backup:plan": "node scripts/reports-backup.mjs --plan",
+    "restore:verify": "node scripts/reports-restore.mjs --verify",
+    "restore:plan": "node scripts/reports-restore.mjs --plan",
+    "uninstall:plan": "node scripts/reports-uninstall-plan.mjs",
+    "check:browser": "node --check public/console/auth-shell.js && node --check public/widget.js && node --check public/embed/embed.js && node --check public/public-report.js",
+    "check:console": "tsc --project tsconfig.console.json --noEmit",
+    "check": "npm run check:browser && npm run check:console && tsc --noEmit",
+    "console:dev": "vite build --config vite.console.config.ts --watch",
+    "deploy:dry-run": "npm run build:console && wrangler deploy --dry-run --outdir dist/reports-worker"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.7.0",
+    "@cloudflare/dynamic-workflows": "^0.1.1",
+    "better-auth": "^1.7.2",
+    "jose": "^6.2.10",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^5.20260828.1",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.5",
+    "@vitejs/plugin-react": "^6.1.1",
+    "typescript": "^7.0.2",
+    "vite": "^8.2.2",
+    "wrangler": "^4.127.0"
+  },
+  "engines": {
+    "node": ">=20.12.0"
+  }
+}

package/template/public/_headers

@@ -0,0 +1,27 @@
+/*
+  Content-Security-Policy: default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https:; font-src 'self' data: https:; img-src 'self' data: https:; connect-src 'self' https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'
+  Referrer-Policy: no-referrer
+  X-Content-Type-Options: nosniff
+  X-Frame-Options: DENY
+  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+
+/
+  Cache-Control: public, max-age=0, must-revalidate
+
+/widget.js
+  Cache-Control: public, max-age=0, must-revalidate
+
+/widget.css
+  Cache-Control: public, max-age=0, must-revalidate
+
+/embed/*
+  Cache-Control: no-store
+
+/customer-brand.js
+  Cache-Control: public, max-age=0, must-revalidate
+
+/styles.css
+  Cache-Control: public, max-age=0, must-revalidate
+
+/report/*
+  Cache-Control: no-store

package/template/public/brand-icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-labelledby="title desc">
+  <title id="title">Safest app icon</title>
+  <desc id="desc">The Safest open-boundary mark on a deep evergreen tile.</desc>
+  <rect x="2" y="2" width="60" height="60" rx="17" fill="#0B2B20"/>
+  <path d="M 35.000 14.000 H 29.000 C 20.716 14.000 14.000 20.716 14.000 29.000 V 32.000" fill="none" stroke="#FFFFFF" stroke-width="11.500" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M 29.000 50.000 H 35.000 C 43.284 50.000 50.000 43.284 50.000 35.000 V 32.000" fill="none" stroke="#CBEF68" stroke-width="11.500" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>