create-safest-tools 0.2.0

package/template/scripts/reports-plan.mjs

@@ -0,0 +1,226 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+
+const RESOURCE_NAME = /^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+const ACCESS_AUD = /^[a-f0-9]{64}$/iu;
+const AUTH_PROVIDERS = new Set(["google", "github", "cloudflare"]);
+const AUTH_SECRET_NAMES = {
+  google: ["AUTH_GOOGLE_CLIENT_ID", "AUTH_GOOGLE_CLIENT_SECRET"],
+  github: ["AUTH_GITHUB_CLIENT_ID", "AUTH_GITHUB_CLIENT_SECRET"],
+  cloudflare: ["AUTH_CLOUDFLARE_CLIENT_ID", "AUTH_CLOUDFLARE_CLIENT_SECRET"],
+};
+
+export class ReportsConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ReportsConfigError";
+  }
+}
+
+function object(value, field) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new ReportsConfigError(`${field} must be an object`);
+  return value;
+}
+
+function exactKeys(value, allowed, field) {
+  const unknown = Object.keys(value).find((key) => !allowed.has(key));
+  if (unknown) throw new ReportsConfigError(`${field} contains an unknown field: ${unknown}`);
+}
+
+function text(value, field, maximum = 500) {
+  if (typeof value !== "string" || !value.trim() || value.trim().length > maximum) {
+    throw new ReportsConfigError(`${field} must contain 1 to ${maximum} characters`);
+  }
+  return value.trim();
+}
+
+function resourceName(value, field) {
+  const result = text(value, field, 63).toLowerCase();
+  if (!RESOURCE_NAME.test(result)) throw new ReportsConfigError(`${field} must be a lowercase Cloudflare resource name`);
+  return result;
+}
+
+function origin(value, field) {
+  let url;
+  try { url = new URL(text(value, field)); } catch { throw new ReportsConfigError(`${field} must be a valid URL origin`); }
+  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || (url.pathname && url.pathname !== "/")) {
+    throw new ReportsConfigError(`${field} must be an HTTPS origin without credentials, path, query, or fragment`);
+  }
+  return url.origin;
+}
+
+function integer(value, field, minimum, maximum) {
+  if (!Number.isInteger(value) || value < minimum || value > maximum) {
+    throw new ReportsConfigError(`${field} must be an integer from ${minimum} to ${maximum}`);
+  }
+  return value;
+}
+
+function stringList(value, field, maximum, parse) {
+  if (!Array.isArray(value) || value.length < 1 || value.length > maximum) {
+    throw new ReportsConfigError(`${field} must contain 1 to ${maximum} values`);
+  }
+  const result = value.map((entry, index) => parse(entry, `${field}[${index}]`));
+  if (new Set(result).size !== result.length) throw new ReportsConfigError(`${field} cannot contain duplicates`);
+  return result;
+}
+
+export function parseReportsConfig(value) {
+  const input = object(value, "configuration");
+  exactKeys(input, new Set(["$schema", "schemaVersion", "installationId", "resources", "publicBaseUrl", "allowedOrigins", "access", "email", "auth", "retention"]), "configuration");
+  if (input.schemaVersion !== 1) throw new ReportsConfigError("schemaVersion must be 1");
+  const resources = object(input.resources, "resources");
+  exactKeys(resources, new Set(["workerName", "databaseName", "profileMediaBucketName", "workflowArtifactsBucketName", "evidenceBucketName", "exportsBucketName", "workflowName", "reportQueueName", "deliveryQueueName", "operationsDlqName"]), "resources");
+  const access = object(input.access, "access");
+  exactKeys(access, new Set(["audience", "ownerEmails"]), "access");
+  const ownerEmails = stringList(access.ownerEmails, "access.ownerEmails", 20, (email, field) => {
+    const result = text(email, field, 254).toLowerCase();
+    if (!EMAIL.test(result)) throw new ReportsConfigError(`${field} is invalid`);
+    return result;
+  });
+  const retention = object(input.retention, "retention");
+  exactKeys(retention, new Set(["reportsDays", "messagesDays", "appealWindowDays"]), "retention");
+  const email = input.email === undefined ? { enabled: false, fromAddress: "" } : object(input.email, "email");
+  exactKeys(email, new Set(["enabled", "fromAddress"]), "email");
+  if (typeof email.enabled !== "boolean") throw new ReportsConfigError("email.enabled must be boolean");
+  const emailFromAddress = String(email.fromAddress ?? "").trim().toLowerCase();
+  if (email.enabled && !EMAIL.test(emailFromAddress)) throw new ReportsConfigError("email.fromAddress must be a valid onboarded sender when email is enabled");
+  if (!email.enabled && emailFromAddress) throw new ReportsConfigError("email.fromAddress must be empty when email is disabled");
+  const auth = input.auth === undefined ? { password: true, providers: [] } : object(input.auth, "auth");
+  exactKeys(auth, new Set(["password", "providers"]), "auth");
+  if (auth.password !== true) throw new ReportsConfigError("auth.password must be true because password recovery is a required sign-in method");
+  if (!Array.isArray(auth.providers) || auth.providers.length > AUTH_PROVIDERS.size) {
+    throw new ReportsConfigError("auth.providers must be an array with up to three providers");
+  }
+  const authProviders = auth.providers.map((provider, index) => text(provider, `auth.providers[${index}]`, 20).toLowerCase());
+  if (authProviders.some((provider) => !AUTH_PROVIDERS.has(provider))) {
+    throw new ReportsConfigError("auth.providers may contain only google, github, or cloudflare");
+  }
+  if (new Set(authProviders).size !== authProviders.length) throw new ReportsConfigError("auth.providers cannot contain duplicates");
+  const parsed = {
+    schemaVersion: 1,
+    installationId: resourceName(input.installationId, "installationId"),
+    resources: {
+      workerName: resourceName(resources.workerName, "resources.workerName"),
+      databaseName: resourceName(resources.databaseName, "resources.databaseName"),
+      profileMediaBucketName: resourceName(resources.profileMediaBucketName, "resources.profileMediaBucketName"),
+      workflowArtifactsBucketName: resourceName(resources.workflowArtifactsBucketName, "resources.workflowArtifactsBucketName"),
+      evidenceBucketName: resourceName(resources.evidenceBucketName, "resources.evidenceBucketName"),
+      exportsBucketName: resourceName(resources.exportsBucketName, "resources.exportsBucketName"),
+      workflowName: resourceName(resources.workflowName, "resources.workflowName"),
+      reportQueueName: resourceName(resources.reportQueueName, "resources.reportQueueName"),
+      deliveryQueueName: resourceName(resources.deliveryQueueName, "resources.deliveryQueueName"),
+      operationsDlqName: resourceName(resources.operationsDlqName, "resources.operationsDlqName"),
+    },
+    publicBaseUrl: origin(input.publicBaseUrl, "publicBaseUrl"),
+    allowedOrigins: stringList(input.allowedOrigins, "allowedOrigins", 20, origin),
+    access: {
+      audience: text(access.audience, "access.audience", 200),
+      ownerEmails,
+    },
+    email: { enabled: email.enabled, fromAddress: emailFromAddress },
+    auth: { password: true, providers: authProviders },
+    retention: {
+      reportsDays: integer(retention.reportsDays, "retention.reportsDays", 30, 3_650),
+      messagesDays: integer(retention.messagesDays, "retention.messagesDays", 30, 3_650),
+      appealWindowDays: integer(retention.appealWindowDays, "retention.appealWindowDays", 1, 365),
+    },
+  };
+  const names = Object.values(parsed.resources);
+  if (new Set(names).size !== names.length) throw new ReportsConfigError("every Cloudflare resource name must be unique");
+  return parsed;
+}
+
+export function buildReportsPlan(config) {
+  const accessReady = ACCESS_AUD.test(config.access.audience);
+  const emailReady = config.email.enabled;
+  const publicHostname = new URL(config.publicBaseUrl).hostname;
+  const ownerBootstrapPath = `${publicHostname}/v1/infrastructure/*`;
+  const customDomain = publicHostname.endsWith(".workers.dev") ? null : publicHostname;
+  return {
+    product: "Safest Resolve",
+    schemaVersion: 1,
+    installationId: config.installationId,
+    ownership: "All resources, data, secrets, policies, and logs remain in the customer's Cloudflare account.",
+    ready: accessReady && emailReady,
+    blockers: [
+      ...(!accessReady ? ["Create the customer-owned Cloudflare Access application and replace access.audience with its 64-character AUD."] : []),
+      ...(!emailReady ? ["Onboard the sender domain in Cloudflare Email Sending and set email.fromAddress; invitations and password recovery cannot be deployed without email delivery."] : []),
+    ],
+    resources: {
+      worker: config.resources.workerName,
+      d1Database: config.resources.databaseName,
+      r2Buckets: [config.resources.profileMediaBucketName, config.resources.workflowArtifactsBucketName, config.resources.evidenceBucketName, config.resources.exportsBucketName],
+      dynamicWorkflow: config.resources.workflowName,
+      queues: [config.resources.reportQueueName, config.resources.deliveryQueueName, config.resources.operationsDlqName],
+      durableObject: "WorkspacePresence (SQLite-backed, declared by Worker migration)",
+      workersAiBinding: "AI",
+      emailServiceBinding: `EMAIL (${config.email.fromAddress || "not configured"})`,
+      staticAssets: "public/",
+      publicHostname,
+      customDomain: customDomain ?? "workers.dev hostname (no custom domain mutation)",
+      secrets: [
+        "BETTER_AUTH_SECRET", "ADMIN_API_KEY", "CONTEXT_SIGNING_SECRET", "CREDENTIAL_ENCRYPTION_KEY", "RATE_LIMIT_PEPPER", "INTEGRATION_API_KEYS_JSON",
+        ...config.auth.providers.flatMap((provider) => AUTH_SECRET_NAMES[provider]),
+      ],
+      optionalSecrets: ["TURNSTILE_SECRET_KEY", "ACTION_WEBHOOK_SECRET", "NOTIFICATION_WEBHOOK_SECRET", "OPERATOR_NOTIFICATION_WEBHOOK_SECRET", "one secret per published connection or enrichment"],
+      authentication: {
+        password: true,
+        passwordRecovery: "email",
+        oauthProviders: config.auth.providers,
+        callbackUrls: Object.fromEntries(config.auth.providers.map((provider) => [provider, `${config.publicBaseUrl}/api/auth/callback/${provider}`])),
+      },
+      access: {
+        applicationPath: ownerBootstrapPath,
+        audience: accessReady ? config.access.audience : "not configured",
+        ownerEmails: config.access.ownerEmails,
+        purpose: "Infrastructure-owner bootstrap and recovery only. Invited admins and analysts use Safest accounts.",
+      },
+    },
+    networkContract: {
+      publicBaseUrl: config.publicBaseUrl,
+      allowedOrigins: config.allowedOrigins,
+      requestInspection: false,
+      reportSubmissionOnly: true,
+    },
+    order: [
+      "Review this plan, the infrastructure-owner allowlist, and the Access application path.",
+      "Create or select the Cloudflare Access application for /v1/infrastructure/* and record its AUD.",
+      "Onboard the sender domain to Cloudflare Email Service before deployment.",
+      "Initialize local secrets without committing them.",
+      "Create D1, four private R2 buckets, and the three Queues in the customer account.",
+      "Apply all report migrations before accepting traffic.",
+      `Deploy the Worker, assets, Worker Loader, Dynamic Workflow, presence Durable Object, Queue consumers, cron, Workers AI binding${customDomain ? `, and ${customDomain} Custom Domain` : ""}.`,
+      "Bootstrap the infrastructure owner, verify required setup features and authenticated /ready, invite an administrator, invite an analyst, then verify report intake, routing, and delivery recovery.",
+    ],
+    lifecycle: {
+      backup: "D1 SQL export plus all four private R2 buckets, stable inventory, per-object SHA-256 digests, and a durable verification record; Queue and live Workflow state remain separate.",
+      restore: "Verify every D1/R2 digest locally, then produce a non-mutating plan for a separately named target environment with live effects disabled.",
+      upgrade: "Backup first, apply forward-only migrations, then deploy and verify.",
+      uninstall: "Plan only. No generic uninstall command is generated; inspect exact owned resources and take a fresh backup before manual removal.",
+    },
+  };
+}
+
+export async function loadReportsPlan(path = "reports.config.json") {
+  const absolute = resolve(path);
+  let value;
+  try { value = JSON.parse(await readFile(absolute, "utf8")); } catch (error) {
+    if (error?.code === "ENOENT") throw new ReportsConfigError(`configuration not found: ${absolute}`);
+    if (error instanceof SyntaxError) throw new ReportsConfigError(`configuration is not valid JSON: ${error.message}`);
+    throw error;
+  }
+  const config = parseReportsConfig(value);
+  return { config, plan: buildReportsPlan(config), path: absolute };
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === new URL(import.meta.url).pathname) {
+  loadReportsPlan(process.argv[2] ?? "reports.config.json").then(({ plan }) => {
+    console.log(JSON.stringify(plan, null, 2));
+    if (!plan.ready) process.exitCode = 2;
+  }).catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  });
+}

package/template/scripts/reports-restore.mjs

@@ -0,0 +1,180 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadReportsPlan } from "./reports-plan.mjs";
+
+const projectRoot = fileURLToPath(new URL("..", import.meta.url));
+const BUCKETS = new Set(["profile_media", "workflow_artifacts", "evidence", "exports"]);
+
+function parseArguments(argv) {
+  const result = { mode: null, directory: null, targetConfig: "reports.restore.config.json" };
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--verify" || argument === "--plan") {
+      if (result.mode) throw new Error("choose exactly one of --verify or --plan");
+      result.mode = argument.slice(2);
+      const value = argv[index + 1];
+      if (!value || value.startsWith("-")) throw new Error(`${argument} needs a backup directory`);
+      result.directory = value;
+      index += 1;
+    } else if (argument === "--target-config") {
+      const value = argv[index + 1];
+      if (!value || value.startsWith("-")) throw new Error("--target-config needs a path");
+      result.targetConfig = value;
+      index += 1;
+    } else throw new Error(`unknown option: ${argument}`);
+  }
+  if (!result.mode || !result.directory) throw new Error("use --verify <backup-directory> or --plan <backup-directory>");
+  return result;
+}
+
+async function hashFile(path) {
+  const hash = createHash("sha256");
+  let bytes = 0;
+  for await (const chunk of createReadStream(path)) {
+    hash.update(chunk);
+    bytes += chunk.length;
+  }
+  return { digest: `sha256:${hash.digest("hex")}`, bytes };
+}
+
+function safeRelativeFile(directory, value, field) {
+  if (typeof value !== "string" || !value || isAbsolute(value) || value.includes("\\") || value.split("/").includes("..")) {
+    throw new Error(`${field} is not a safe relative backup path`);
+  }
+  const path = resolve(directory, value);
+  const inside = relative(directory, path);
+  if (!inside || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`${field} escapes the backup directory`);
+  return path;
+}
+
+async function jsonFile(path, maximumBytes) {
+  const metadata = await stat(path);
+  if (!metadata.isFile() || metadata.size > maximumBytes) throw new Error(`backup manifest is missing or larger than ${maximumBytes} bytes`);
+  return JSON.parse(await readFile(path, "utf8"));
+}
+
+function expectedDigest(value, field) {
+  if (typeof value !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(value)) throw new Error(`${field} is not a SHA-256 digest`);
+  return value;
+}
+
+export async function verifyBackup(directoryValue) {
+  const directory = await realpath(resolve(projectRoot, directoryValue));
+  const manifestPath = resolve(directory, "manifest.json");
+  const manifest = await jsonFile(manifestPath, 2 * 1024 * 1024);
+  if (manifest?.schemaVersion !== 2 || manifest.status !== "verified" || typeof manifest.backupId !== "string") {
+    throw new Error("manifest.json is not a verified Safest backup v2 manifest");
+  }
+  const manifestHash = await hashFile(manifestPath);
+  const sidecar = (await readFile(resolve(directory, "manifest.sha256"), "utf8")).trim().split(/\s+/u)[0];
+  if (manifestHash.digest !== sidecar) throw new Error("manifest.json does not match manifest.sha256");
+  const databasePath = safeRelativeFile(directory, manifest.d1?.file, "manifest.d1.file");
+  const database = await hashFile(databasePath);
+  if (database.digest !== expectedDigest(manifest.d1?.digest, "manifest.d1.digest") || database.bytes !== manifest.d1?.bytes) {
+    throw new Error("database.sql failed digest or size verification");
+  }
+  const r2ManifestPath = safeRelativeFile(directory, manifest.r2?.manifest, "manifest.r2.manifest");
+  const r2ManifestHash = await hashFile(r2ManifestPath);
+  if (r2ManifestHash.digest !== expectedDigest(manifest.r2?.digest, "manifest.r2.digest")) throw new Error("r2-manifest.json failed digest verification");
+  const r2 = await jsonFile(r2ManifestPath, 256 * 1024 * 1024);
+  if (r2?.schemaVersion !== 1 || r2.backupId !== manifest.backupId || !r2.verifiedStableInventory || !Array.isArray(r2.objects)) {
+    throw new Error("r2-manifest.json is invalid or belongs to another backup");
+  }
+  const seenObjects = new Set();
+  const seenFiles = new Set();
+  let objectBytes = 0;
+  for (const object of r2.objects) {
+    if (!object || !BUCKETS.has(object.bucket) || typeof object.key !== "string" || !object.key || typeof object.etag !== "string") {
+      throw new Error("r2-manifest.json contains an invalid object record");
+    }
+    const identity = `${object.bucket}\0${object.key}`;
+    if (seenObjects.has(identity)) throw new Error("r2-manifest.json contains a duplicate bucket/key");
+    seenObjects.add(identity);
+    if (seenFiles.has(object.file)) throw new Error("r2-manifest.json reuses an object file");
+    seenFiles.add(object.file);
+    const objectPath = safeRelativeFile(directory, object.file, "R2 object file");
+    const actual = await hashFile(objectPath);
+    if (actual.digest !== expectedDigest(object.digest, "R2 object digest") || actual.bytes !== object.size) {
+      throw new Error(`R2 object failed digest or size verification: ${object.bucket}/${object.key}`);
+    }
+    objectBytes += actual.bytes;
+  }
+  if (r2.objectCount !== r2.objects.length || manifest.r2?.objectCount !== r2.objects.length
+    || r2.objectBytes !== objectBytes || manifest.r2?.objectBytes !== objectBytes) {
+    throw new Error("R2 object counts or byte totals do not match the manifests");
+  }
+  return {
+    directory,
+    manifest,
+    r2,
+    verification: {
+      manifestDigest: manifestHash.digest,
+      d1Digest: database.digest,
+      r2ManifestDigest: r2ManifestHash.digest,
+      objectCount: r2.objects.length,
+      objectBytes,
+      allObjectDigests: true,
+    },
+  };
+}
+
+export async function restoreReports(argv = process.argv.slice(2)) {
+  const options = parseArguments(argv);
+  const verified = await verifyBackup(options.directory);
+  if (options.mode === "verify") {
+    const result = { action: "restore_verify", backupId: verified.manifest.backupId, status: "verified", ...verified.verification };
+    console.log(JSON.stringify(result, null, 2));
+    return result;
+  }
+  const { config: target } = await loadReportsPlan(options.targetConfig);
+  if (target.installationId === verified.manifest.installationId) {
+    throw new Error("restore planning requires a different installationId so production data is first restored into a separate environment");
+  }
+  if (verified.manifest.sourcePublicBaseUrl && target.publicBaseUrl === verified.manifest.sourcePublicBaseUrl) {
+    throw new Error("restore planning requires a different publicBaseUrl from the source environment");
+  }
+  const bucketNames = {
+    profile_media: target.resources.profileMediaBucketName,
+    workflow_artifacts: target.resources.workflowArtifactsBucketName,
+    evidence: target.resources.evidenceBucketName,
+    exports: target.resources.exportsBucketName,
+  };
+  const plan = {
+    action: "restore_plan_only",
+    mutatesCloudflare: false,
+    backupId: verified.manifest.backupId,
+    sourceInstallationId: verified.manifest.installationId,
+    targetInstallationId: target.installationId,
+    targetPublicBaseUrl: target.publicBaseUrl,
+    verification: verified.verification,
+    order: [
+      "Provision the separate target environment from its reviewed setup plan.",
+      "Provision new target secrets separately; never copy secrets from the backup because they are not included.",
+      `Import database.sql into the target D1 database ${target.resources.databaseName}.`,
+      `Restore and verify ${verified.r2.objects.length} objects into the four exact target R2 buckets.`,
+      "Keep action, email, notification, and external connection delivery disabled in the target environment.",
+      "Verify workflow artifact digests, run authenticated setup checks, and create operations incidents for interrupted nonterminal runs.",
+      "Treat pending Queues and live Workflow engine state as nonrestorable; reconcile from authoritative D1 records.",
+    ],
+    d1: { sourceFile: "database.sql", targetDatabase: target.resources.databaseName },
+    r2: {
+      targetBuckets: bucketNames,
+      objectCount: verified.r2.objects.length,
+      objectBytes: verified.verification.objectBytes,
+      objects: verified.r2.objects.map((object) => ({ bucket: bucketNames[object.bucket], key: object.key, sourceFile: object.file, digest: object.digest })),
+    },
+    prohibited: ["restoring directly over the source installation", "restoring source secrets", "connecting restored staging data to live effects", "claiming Queue or Workflow engine state was captured"],
+  };
+  console.log(JSON.stringify(plan, null, 2));
+  return plan;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  restoreReports().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  });
+}

package/template/scripts/reports-secrets.mjs

@@ -0,0 +1,73 @@
+import { randomBytes } from "node:crypto";
+import { chmod, mkdir, open, readFile, rename, unlink } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+
+export function createSecrets() {
+  const random = () => randomBytes(32).toString("base64url");
+  return {
+    BETTER_AUTH_SECRET: random(),
+    ADMIN_API_KEY: random(),
+    CONTEXT_SIGNING_SECRET: random(),
+    CREDENTIAL_ENCRYPTION_KEY: random(),
+    RATE_LIMIT_PEPPER: random(),
+    INTEGRATION_API_KEYS_JSON: JSON.stringify({ default: random() }),
+  };
+}
+
+export function renderSecrets(secrets) {
+  return `${Object.entries(secrets).map(([name, value]) => `${name}=${value}`).join("\n")}\n`;
+}
+
+export function parseSecrets(raw) {
+  const values = {};
+  for (const line of raw.split(/\r?\n/u)) {
+    const normalized = line.trim();
+    if (!normalized || normalized.startsWith("#")) continue;
+    const separator = normalized.indexOf("=");
+    if (separator > 0) values[normalized.slice(0, separator).trim()] = normalized.slice(separator + 1).trim();
+  }
+  return values;
+}
+
+export async function readSecrets(path = ".safest/secrets.env") {
+  return parseSecrets(await readFile(resolve(path), "utf8"));
+}
+
+export async function updateSecrets(path, secrets) {
+  const absolute = resolve(path);
+  const temporary = `${absolute}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  await mkdir(dirname(absolute), { recursive: true, mode: 0o700 });
+  const handle = await open(temporary, "wx", 0o600);
+  try {
+    await handle.writeFile(renderSecrets(secrets), "utf8");
+  } finally {
+    await handle.close();
+  }
+  try {
+    await rename(temporary, absolute);
+    await chmod(absolute, 0o600);
+  } catch (error) {
+    await unlink(temporary).catch(() => {});
+    throw error;
+  }
+  return absolute;
+}
+
+export async function initializeSecrets(path = ".safest/secrets.env") {
+  const absolute = resolve(path);
+  await mkdir(dirname(absolute), { recursive: true, mode: 0o700 });
+  const handle = await open(absolute, "wx", 0o600);
+  try { await handle.writeFile(renderSecrets(createSecrets()), "utf8"); } finally { await handle.close(); }
+  await chmod(absolute, 0o600);
+  return absolute;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === new URL(import.meta.url).pathname) {
+  initializeSecrets(process.argv[2]).then((path) => {
+    console.log(`Created ${path} with owner-only permissions. Store it securely and do not commit it.`);
+  }).catch((error) => {
+    if (error?.code === "EEXIST") console.error("Refusing to overwrite the existing secrets file.");
+    else console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  });
+}

package/template/scripts/reports-uninstall-plan.mjs

@@ -0,0 +1,32 @@
+import { loadReportsPlan } from "./reports-plan.mjs";
+
+export async function buildReportsUninstallPlan() {
+  const { config } = await loadReportsPlan();
+  return {
+    action: "uninstall_plan_only",
+    installationId: config.installationId,
+    warning: "This command never changes Cloudflare. Take and verify a fresh backup, drain Queues, inspect bindings and dependencies, then remove only the exact customer-owned resources below.",
+    inspectBeforeRemoval: [
+      "Queue backlog and dead letters",
+      "Worker service bindings and custom domains",
+      "verified D1 and R2 backup manifests and checksums",
+      "Access application policies",
+      "enrichment, notification, and action webhook dependencies",
+    ],
+    exactResources: {
+      worker: config.resources.workerName,
+      queues: [config.resources.reportQueueName, config.resources.deliveryQueueName, config.resources.operationsDlqName],
+      database: config.resources.databaseName,
+      r2Buckets: [config.resources.profileMediaBucketName, config.resources.workflowArtifactsBucketName, config.resources.evidenceBucketName, config.resources.exportsBucketName],
+      dynamicWorkflow: config.resources.workflowName,
+      accessAudience: config.access.audience,
+    },
+    defaultPreservation: ["D1 database", "all private R2 buckets", "Access application", "independent secrets recovery", "verified D1/R2 archive manifests"],
+    note: "Removal stays manual so data, dependencies, and exact resource ownership can be verified immediately beforehand.",
+  };
+}
+
+buildReportsUninstallPlan().then((plan) => console.log(JSON.stringify(plan, null, 2))).catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});