create-safest-tools 0.2.0

package/template/src/workflow-simulator.ts

@@ -0,0 +1,211 @@
+import { canonicalJson } from "./audit";
+import { evaluateInputMapping, evaluateWorkflowExpression } from "./workflow-expressions";
+import type { JsonObject, JsonValue, WorkflowGraphV1, WorkflowNodeV1 } from "./workflow-platform-types";
+
+export interface WorkflowSimulationFixture {
+  input: JsonObject;
+  componentResults: JsonObject;
+  humanResponses: JsonObject;
+  failureInjection: JsonObject;
+}
+
+export interface WorkflowSimulationStep {
+  nodeId: string;
+  kind: string;
+  branchKey: string;
+  state: "succeeded" | "failed" | "timed_out" | "simulated";
+  port: string;
+  output: JsonObject;
+}
+
+export interface WorkflowSimulationResult {
+  status: "passed" | "failed";
+  terminalCode: string | null;
+  output: JsonObject | null;
+  steps: WorkflowSimulationStep[];
+  error: { code: string; nodeId?: string } | null;
+  canonicalResult: string;
+}
+
+class SimulationFailure extends Error {
+  constructor(readonly code: string, readonly nodeId?: string) {
+    super(code);
+  }
+}
+
+function object(value: JsonValue | undefined): JsonObject {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+function conditionCases(node: WorkflowNodeV1): { port: string; when: JsonValue }[] {
+  const configured = node.config.cases;
+  if (Array.isArray(configured)) {
+    return configured.flatMap((entry) => {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry) || typeof entry.port !== "string" || !("when" in entry)) return [];
+      return [{ port: entry.port, when: entry.when }];
+    });
+  }
+  return configured && typeof configured === "object"
+    ? Object.entries(configured).map(([port, when]) => ({ port, when })) : [];
+}
+
+function selectedFixtureResult(fixture: WorkflowSimulationFixture, node: WorkflowNodeV1): JsonObject | null {
+  const componentId = typeof node.config.component_version_id === "string" ? node.config.component_version_id : null;
+  const agentId = typeof node.config.agent_version_id === "string" ? node.config.agent_version_id : null;
+  const selected = fixture.componentResults[node.id]
+    ?? (componentId ? fixture.componentResults[componentId] : undefined)
+    ?? (agentId ? fixture.componentResults[agentId] : undefined);
+  return selected === undefined ? null : object(selected);
+}
+
+export function simulateWorkflow(graph: WorkflowGraphV1, fixture: WorkflowSimulationFixture): WorkflowSimulationResult {
+  const nodeById = new Map(graph.nodes.map((node) => [node.id, node]));
+  const outgoing = new Map(graph.nodes.map((node) => [node.id, graph.edges.filter((edge) => edge.from.nodeId === node.id)]));
+  const steps: WorkflowSimulationStep[] = [];
+  const stepOutputs: JsonObject = {};
+  const baseContext: JsonObject = { input: fixture.input, steps: stepOutputs, findings: {} };
+
+  const record = (node: WorkflowNodeV1, branchKey: string, state: WorkflowSimulationStep["state"], port: string, output: JsonObject) => {
+    const entry = { nodeId: node.id, kind: node.kind, branchKey, state, port, output };
+    steps.push(entry);
+    stepOutputs[node.id] = output;
+    return entry;
+  };
+  const next = (node: WorkflowNodeV1, port: string): string | null => {
+    const edge = (outgoing.get(node.id) ?? []).find((candidate) => candidate.from.port === port);
+    if (!edge) throw new SimulationFailure("simulation_port_unresolved", node.id);
+    return edge.to.nodeId;
+  };
+  const executePath = (initialNodeId: string, stopNodeId: string | null, branchKey: string): JsonObject => {
+    let nodeId: string | null = initialNodeId;
+    let last: JsonObject = {};
+    while (nodeId && nodeId !== stopNodeId) {
+      const node: WorkflowNodeV1 | undefined = nodeById.get(nodeId);
+      if (!node) throw new SimulationFailure("simulation_node_missing", nodeId);
+      const injected = fixture.failureInjection[node.id];
+      if (typeof injected === "string") {
+        const port = node.errorPort ?? (injected === "timeout" ? "timeout" : "error");
+        last = { port, error_code: injected };
+        record(node, branchKey, injected === "timeout" ? "timed_out" : "failed", port, last);
+        nodeId = next(node, port);
+        continue;
+      }
+      if (node.kind === "parallel_group") {
+        const joinNodeId = typeof node.config.join_node_id === "string" ? node.config.join_node_id : null;
+        if (!joinNodeId) throw new SimulationFailure("simulation_join_missing", node.id);
+        const branchPorts = Array.isArray(node.config.branch_ports) ? node.config.branch_ports.filter((port): port is string => typeof port === "string") : [];
+        const branchOutput: JsonObject = {};
+        for (const port of branchPorts) {
+          const edge = (outgoing.get(node.id) ?? []).find((candidate) => candidate.from.port === port);
+          if (!edge) throw new SimulationFailure("simulation_branch_missing", node.id);
+          branchOutput[port] = executePath(edge.to.nodeId, joinNodeId, port);
+        }
+        const join = nodeById.get(joinNodeId);
+        if (!join) throw new SimulationFailure("simulation_join_missing", node.id);
+        last = { port: "success", branches: branchOutput };
+        record(join, branchKey, "succeeded", "success", last);
+        nodeId = next(join, "success");
+        continue;
+      }
+      const mapped = evaluateInputMapping(node.inputMapping, baseContext);
+      let state: WorkflowSimulationStep["state"] = "succeeded";
+      if (node.kind === "start" || node.kind === "join") last = { port: "success", input: mapped };
+      else if (node.kind === "enrichment") {
+        const result = selectedFixtureResult(fixture, node);
+        if (!result) throw new SimulationFailure("simulation_component_result_missing", node.id);
+        last = { port: "success", finding_id: `fixture:${node.id}`, data: result };
+      } else if (node.kind === "condition") {
+        const context = { ...baseContext, node_input: mapped };
+        const matches = conditionCases(node).filter((candidate) => evaluateWorkflowExpression(candidate.when, context) === true);
+        if (matches.length > 1) throw new SimulationFailure("condition_not_mutually_exclusive", node.id);
+        const port = matches[0]?.port ?? (typeof node.config.default_port === "string" ? node.config.default_port : null);
+        if (!port) throw new SimulationFailure("condition_no_match", node.id);
+        last = { port, matched: matches[0]?.port ?? null, input: mapped };
+      } else if (node.kind === "ai_proposal") {
+        const result = selectedFixtureResult(fixture, node);
+        if (!result) throw new SimulationFailure("simulation_ai_result_missing", node.id);
+        const resultCode = [result.result_code, result.outcome, result.conclusion, result.classification]
+          .find((value): value is string => typeof value === "string");
+        if (!resultCode) throw new SimulationFailure("simulation_ai_result_port_missing", node.id);
+        last = { port: resultCode, data: result };
+      } else if (node.kind === "human_task") {
+        const response = fixture.humanResponses[node.id];
+        if (response === undefined) {
+          state = "timed_out";
+          last = { port: "timeout", status: "timed_out" };
+        } else {
+          last = { port: "completed", status: "received", response };
+        }
+      } else if (node.kind === "wait_for_event") {
+        const response = fixture.humanResponses[node.id];
+        if (response === undefined) {
+          state = "timed_out";
+          last = { port: "timeout", status: "timed_out" };
+        } else last = { port: "received", event: response };
+      } else if (node.kind === "delay" || node.kind === "delay_until") {
+        state = "simulated";
+        last = { port: "completed", simulated: true };
+      } else if (node.kind === "send_message") {
+        state = "simulated";
+        last = { port: "sent", simulated: true, audience: node.config.audience ?? null };
+      } else if (node.kind === "decision") {
+        state = "simulated";
+        last = { port: "recorded", simulated: true, decision: mapped };
+      } else if (node.kind === "action") {
+        state = "simulated";
+        last = { port: "applied", simulated: true, action: mapped };
+      } else if (node.kind === "handoff") {
+        state = "simulated";
+        last = { port: "handed_off", simulated: true, handoff: mapped };
+      } else if (node.kind === "start_linked_workflow") {
+        state = "simulated";
+        last = { port: "started", simulated: true };
+      } else if (node.kind === "end") {
+        const terminalCode = typeof node.config.terminal_code === "string" ? node.config.terminal_code : null;
+        if (!terminalCode) throw new SimulationFailure("simulation_terminal_missing", node.id);
+        last = { port: "terminal", terminal_code: terminalCode, output: mapped };
+        record(node, branchKey, state, "terminal", last);
+        return last;
+      } else throw new SimulationFailure("simulation_node_unsupported", node.id);
+      const port = typeof last.port === "string" ? last.port : "success";
+      record(node, branchKey, state, port, last);
+      nodeId = next(node, port);
+    }
+    return last;
+  };
+
+  let terminalCode: string | null = null;
+  let output: JsonObject | null = null;
+  let error: WorkflowSimulationResult["error"] = null;
+  try {
+    output = executePath(graph.entryNodeId, null, "");
+    terminalCode = typeof output.terminal_code === "string" ? output.terminal_code : null;
+    if (!terminalCode) throw new SimulationFailure("simulation_did_not_terminate");
+  } catch (caught) {
+    const failure = caught instanceof SimulationFailure ? caught : new SimulationFailure("simulation_failed");
+    error = { code: failure.code, ...(failure.nodeId ? { nodeId: failure.nodeId } : {}) };
+  }
+  const material = { terminalCode, output, steps, error };
+  return {
+    status: error ? "failed" : "passed",
+    terminalCode,
+    output,
+    steps,
+    error,
+    canonicalResult: canonicalJson(material),
+  };
+}
+
+export function simulationMatchesExpected(result: WorkflowSimulationResult, expected: JsonObject): boolean {
+  if (typeof expected.terminal_code === "string" && result.terminalCode !== expected.terminal_code) return false;
+  if (typeof expected.status === "string" && result.status !== expected.status) return false;
+  if (Array.isArray(expected.required_nodes)) {
+    const seen = new Set(result.steps.map((step) => step.nodeId));
+    if (expected.required_nodes.some((nodeId) => typeof nodeId !== "string" || !seen.has(nodeId))) return false;
+  }
+  if (Array.isArray(expected.forbidden_nodes)) {
+    const seen = new Set(result.steps.map((step) => step.nodeId));
+    if (expected.forbidden_nodes.some((nodeId) => typeof nodeId === "string" && seen.has(nodeId))) return false;
+  }
+  return true;
+}

package/template/src/workspace-branding.ts

@@ -0,0 +1,128 @@
+import { ApiError } from "./report-http";
+
+export interface WorkspaceBrand {
+  organization_name: string;
+  logo_url: string;
+  logo_alt: string;
+  primary_color: string;
+  primary_contrast_color: string;
+  accent_color: string;
+  background_color: string;
+  surface_color: string;
+  text_color: string;
+  muted_color: string;
+  border_color: string;
+  body_font_family: string;
+  heading_font_family: string;
+  font_css_url: string;
+  border_radius: number;
+}
+
+const DEFAULT_BRAND: Omit<WorkspaceBrand, "organization_name"> = {
+  logo_url: "",
+  logo_alt: "",
+  primary_color: "#154e3a",
+  primary_contrast_color: "#ffffff",
+  accent_color: "#cbef68",
+  background_color: "#f5f6f1",
+  surface_color: "#ffffff",
+  text_color: "#14231c",
+  muted_color: "#637168",
+  border_color: "#dfe6e0",
+  body_font_family: '"Safest Sans", Manrope, ui-sans-serif, system-ui, sans-serif',
+  heading_font_family: '"Safest Serif", Newsreader, Georgia, serif',
+  font_css_url: "",
+  border_radius: 12,
+};
+
+function object(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new ApiError(400, "brand_invalid", "Brand settings must be an object.");
+  }
+  return value as Record<string, unknown>;
+}
+
+function color(value: unknown, field: string, fallback: string): string {
+  const resolved = value === undefined || value === "" ? fallback : value;
+  if (typeof resolved !== "string" || !/^#[0-9a-f]{6}$/iu.test(resolved)) {
+    throw new ApiError(400, "brand_color_invalid", `${field} must be a six-digit hexadecimal color.`, { field: `settings.brand.${field}` });
+  }
+  return resolved.toLowerCase();
+}
+
+function text(value: unknown, field: string, fallback: string, minimum: number, maximum: number): string {
+  const resolved = value === undefined ? fallback : value;
+  if (typeof resolved !== "string" || resolved.trim().length < minimum || resolved.length > maximum) {
+    throw new ApiError(400, "brand_field_invalid", `${field} must contain ${minimum} to ${maximum} characters.`, { field: `settings.brand.${field}` });
+  }
+  return resolved.trim();
+}
+
+function optionalHttpsUrl(value: unknown, field: string): string {
+  if (value === undefined || value === null || value === "") return "";
+  if (typeof value !== "string" || value.length > 2_048) {
+    throw new ApiError(400, "brand_url_invalid", `${field} must be a valid HTTPS URL.`, { field: `settings.brand.${field}` });
+  }
+  try {
+    const url = new URL(value);
+    const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if ((url.protocol !== "https:" && !(local && url.protocol === "http:")) || url.username || url.password) throw new Error("unsafe URL");
+    return url.toString();
+  } catch {
+    throw new ApiError(400, "brand_url_invalid", `${field} must be a valid HTTPS URL.`, { field: `settings.brand.${field}` });
+  }
+}
+
+function fontFamily(value: unknown, field: string, fallback: string): string {
+  const resolved = text(value, field, fallback, 2, 180);
+  if (!/^[A-Za-z0-9\s"'(),._-]+$/u.test(resolved)) {
+    throw new ApiError(400, "brand_font_invalid", `${field} contains unsupported characters.`, { field: `settings.brand.${field}` });
+  }
+  return resolved;
+}
+
+export function parseWorkspaceBrand(value: unknown, displayName: string): WorkspaceBrand {
+  const input = value === undefined || value === null ? {} : object(value);
+  const allowed = new Set([
+    "organization_name", "logo_url", "logo_alt", "primary_color", "primary_contrast_color", "accent_color",
+    "background_color", "surface_color", "text_color", "muted_color", "border_color", "body_font_family",
+    "heading_font_family", "font_css_url", "border_radius",
+  ]);
+  if (Object.keys(input).some((key) => !allowed.has(key))) {
+    throw new ApiError(400, "brand_field_unsupported", "Brand settings contain unsupported fields.");
+  }
+  const borderRadius = input.border_radius === undefined ? DEFAULT_BRAND.border_radius : input.border_radius;
+  if (!Number.isInteger(borderRadius) || Number(borderRadius) < 0 || Number(borderRadius) > 32) {
+    throw new ApiError(400, "brand_radius_invalid", "border_radius must be an integer from 0 to 32.", { field: "settings.brand.border_radius" });
+  }
+  return {
+    organization_name: text(input.organization_name, "organization_name", displayName || "Safest Resolve", 2, 120),
+    logo_url: optionalHttpsUrl(input.logo_url, "logo_url"),
+    logo_alt: text(input.logo_alt, "logo_alt", "", 0, 160),
+    primary_color: color(input.primary_color, "primary_color", DEFAULT_BRAND.primary_color),
+    primary_contrast_color: color(input.primary_contrast_color, "primary_contrast_color", DEFAULT_BRAND.primary_contrast_color),
+    accent_color: color(input.accent_color, "accent_color", DEFAULT_BRAND.accent_color),
+    background_color: color(input.background_color, "background_color", DEFAULT_BRAND.background_color),
+    surface_color: color(input.surface_color, "surface_color", DEFAULT_BRAND.surface_color),
+    text_color: color(input.text_color, "text_color", DEFAULT_BRAND.text_color),
+    muted_color: color(input.muted_color, "muted_color", DEFAULT_BRAND.muted_color),
+    border_color: color(input.border_color, "border_color", DEFAULT_BRAND.border_color),
+    body_font_family: fontFamily(input.body_font_family, "body_font_family", DEFAULT_BRAND.body_font_family),
+    heading_font_family: fontFamily(input.heading_font_family, "heading_font_family", DEFAULT_BRAND.heading_font_family),
+    font_css_url: optionalHttpsUrl(input.font_css_url, "font_css_url"),
+    border_radius: Number(borderRadius),
+  };
+}
+
+export async function loadWorkspaceBrand(db: D1Database): Promise<WorkspaceBrand> {
+  const row = await db.prepare(`SELECT display_name AS displayName, settings_json AS settingsJson FROM installations WHERE id = 'default' LIMIT 1`)
+    .first<{ displayName: string; settingsJson: string }>();
+  if (!row) return parseWorkspaceBrand({}, "Safest Resolve");
+  let settings: Record<string, unknown> = {};
+  try {
+    const parsed: unknown = JSON.parse(row.settingsJson || "{}");
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) settings = parsed as Record<string, unknown>;
+  } catch { /* Invalid legacy settings fall back to the workspace name. */ }
+  try { return parseWorkspaceBrand(settings.brand, row.displayName); }
+  catch { return parseWorkspaceBrand({}, row.displayName); }
+}

package/template/src/workspace-governance.ts

@@ -0,0 +1,279 @@
+import { canonicalJson } from "./audit";
+import { sha256 } from "./report-crypto";
+import { ApiError } from "./report-http";
+import { reportsCsv } from "./report-governance";
+import type { OperatorSession } from "./report-types";
+
+function now(): string { return new Date().toISOString(); }
+
+function object(value: unknown, field = "filters"): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new ApiError(400, "governance_input_invalid", `${field} must be an object.`);
+  return value as Record<string, unknown>;
+}
+
+function parsed(value: unknown, fallback: unknown): unknown {
+  if (typeof value !== "string") return fallback;
+  try { return JSON.parse(value) as unknown; } catch { return fallback; }
+}
+
+export async function searchWorkspace(
+  db: D1Database,
+  term: string,
+  allowedQueueIds: string[] | null | undefined,
+  limit: number,
+): Promise<Record<string, unknown>[]> {
+  const normalized = term.trim().slice(0, 120);
+  if (normalized.length < 2) throw new ApiError(400, "search_term_required", "q must contain at least two characters.");
+  const escaped = normalized.replace(/[\\%_]/gu, (value) => `\\${value}`);
+  const pattern = `%${escaped}%`;
+  const rows = await db.prepare(`
+    SELECT r.id, r.public_reference AS reference, r.state, r.queue_id AS queueId,
+      r.reason_code AS reasonCode, r.priority, r.received_at AS receivedAt,
+      t.target_type AS targetType, t.target_reference AS targetReference,
+      d.decision_code AS latestDecisionCode, d.policy_code AS latestPolicyCode,
+      CASE
+        WHEN r.public_reference LIKE ?1 ESCAPE '\\' THEN 'reference'
+        WHEN t.target_reference LIKE ?1 ESCAPE '\\' THEN 'target'
+        WHEN r.reason_code LIKE ?1 ESCAPE '\\' THEN 'reason'
+        ELSE 'decision'
+      END AS matchKind
+    FROM reports r JOIN report_targets t ON t.report_id = r.id
+    LEFT JOIN decisions d ON d.id = (
+      SELECT id FROM decisions WHERE report_id = r.id ORDER BY created_at DESC, id DESC LIMIT 1
+    )
+    WHERE (r.public_reference LIKE ?1 ESCAPE '\\' OR t.target_reference LIKE ?1 ESCAPE '\\'
+      OR r.reason_code LIKE ?1 ESCAPE '\\' OR d.decision_code LIKE ?1 ESCAPE '\\'
+      OR d.policy_code LIKE ?1 ESCAPE '\\')
+      AND (?2 = 1 OR r.queue_id IN (SELECT value FROM json_each(?3)))
+    ORDER BY r.updated_at DESC, r.id DESC LIMIT ?4
+  `).bind(
+    pattern,
+    allowedQueueIds === null || allowedQueueIds === undefined ? 1 : 0,
+    canonicalJson(allowedQueueIds ?? []),
+    Math.max(1, Math.min(100, limit)),
+  ).all<Record<string, unknown>>();
+  return rows.results;
+}
+
+export async function listSavedViews(db: D1Database, principalId: string): Promise<Record<string, unknown>[]> {
+  const rows = await db.prepare(`SELECT id, name, filters_json AS filtersJson, created_at AS createdAt, updated_at AS updatedAt FROM saved_views WHERE installation_id = 'default' AND principal_id = ?1 ORDER BY updated_at DESC, id DESC`)
+    .bind(principalId).all<Record<string, unknown>>();
+  return rows.results.map((row) => ({ ...row, filters: parsed(row.filtersJson, {}), filtersJson: undefined }));
+}
+
+export async function createSavedView(
+  db: D1Database,
+  principalId: string,
+  value: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  const name = typeof value.name === "string" ? value.name.trim() : "";
+  if (name.length < 2 || name.length > 100) throw new ApiError(400, "saved_view_name_invalid", "name must contain 2 to 100 characters.");
+  const filters = object(value.filters);
+  const filtersJson = canonicalJson(filters);
+  if (new TextEncoder().encode(filtersJson).byteLength > 32_768) throw new ApiError(413, "saved_view_too_large", "The saved filters are too large.");
+  const id = crypto.randomUUID();
+  const timestamp = now();
+  try {
+    await db.prepare(`INSERT INTO saved_views (id, installation_id, principal_id, name, filters_json, created_at, updated_at) VALUES (?1, 'default', ?2, ?3, ?4, ?5, ?5)`)
+      .bind(id, principalId, name, filtersJson, timestamp).run();
+  } catch {
+    throw new ApiError(409, "saved_view_name_exists", "You already have a saved view with this name.");
+  }
+  return { id, name, filters, createdAt: timestamp, updatedAt: timestamp };
+}
+
+export async function updateSavedView(
+  db: D1Database,
+  principalId: string,
+  viewId: string,
+  value: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  const current = await db.prepare(`SELECT name, filters_json AS filtersJson, created_at AS createdAt FROM saved_views WHERE id = ?1 AND principal_id = ?2 LIMIT 1`)
+    .bind(viewId, principalId).first<{ name: string; filtersJson: string; createdAt: string }>();
+  if (!current) throw new ApiError(404, "saved_view_not_found", "The saved view does not exist.");
+  const name = value.name === undefined ? current.name : typeof value.name === "string" ? value.name.trim() : "";
+  if (name.length < 2 || name.length > 100) throw new ApiError(400, "saved_view_name_invalid", "name must contain 2 to 100 characters.");
+  const filters = value.filters === undefined ? object(parsed(current.filtersJson, {})) : object(value.filters);
+  const timestamp = now();
+  try {
+    await db.prepare(`UPDATE saved_views SET name = ?3, filters_json = ?4, updated_at = ?5 WHERE id = ?1 AND principal_id = ?2`)
+      .bind(viewId, principalId, name, canonicalJson(filters), timestamp).run();
+  } catch {
+    throw new ApiError(409, "saved_view_name_exists", "You already have a saved view with this name.");
+  }
+  return { id: viewId, name, filters, createdAt: current.createdAt, updatedAt: timestamp };
+}
+
+export async function deleteSavedView(db: D1Database, principalId: string, viewId: string): Promise<void> {
+  const result = await db.prepare(`DELETE FROM saved_views WHERE id = ?1 AND principal_id = ?2`).bind(viewId, principalId).run();
+  if (!result.meta.changes) throw new ApiError(404, "saved_view_not_found", "The saved view does not exist.");
+}
+
+export async function listLegalHolds(db: D1Database, limit: number): Promise<Record<string, unknown>[]> {
+  const rows = await db.prepare(`SELECT h.id, h.report_id AS reportId, r.public_reference AS reportReference, h.reason, h.state, h.placed_by AS placedBy, h.created_at AS createdAt, h.released_by AS releasedBy, h.released_at AS releasedAt FROM legal_holds h JOIN reports r ON r.id = h.report_id ORDER BY h.created_at DESC, h.id DESC LIMIT ?1`)
+    .bind(Math.max(1, Math.min(200, limit))).all<Record<string, unknown>>();
+  return rows.results;
+}
+
+export async function listDeletionRequests(db: D1Database, limit: number): Promise<Record<string, unknown>[]> {
+  const rows = await db.prepare(`SELECT d.id, d.report_id AS reportId, r.public_reference AS reportReference, d.scope, d.reason, d.state, d.requested_by AS requestedBy, d.requested_at AS requestedAt, d.completed_at AS completedAt, d.last_error_code AS errorCode FROM deletion_requests d JOIN reports r ON r.id = d.report_id ORDER BY d.requested_at DESC, d.id DESC LIMIT ?1`)
+    .bind(Math.max(1, Math.min(200, limit))).all<Record<string, unknown>>();
+  return rows.results;
+}
+
+export async function retentionOverview(
+  db: D1Database,
+  messageRetentionDays: number,
+  reportRetentionDays: number,
+): Promise<Record<string, unknown>> {
+  const latest = await db.prepare(`SELECT id, state, cutoff_at AS cutoffAt, messages_redacted AS messagesRedacted, reports_anonymized AS reportsAnonymized, error_code AS errorCode, started_at AS startedAt, finished_at AS finishedAt FROM retention_jobs WHERE job_kind = 'scheduled_retention' ORDER BY started_at DESC, id DESC LIMIT 1`).first<Record<string, unknown>>();
+  return { policy: { messageRetentionDays, reportRetentionDays }, latestRun: latest ?? null };
+}
+
+export async function previewRetention(
+  db: D1Database,
+  messageRetentionDays: number,
+  reportRetentionDays: number,
+): Promise<Record<string, unknown>> {
+  const timestamp = now();
+  const messageCutoff = new Date(Date.now() - messageRetentionDays * 86_400_000).toISOString();
+  const reportCutoff = new Date(Date.now() - reportRetentionDays * 86_400_000).toISOString();
+  const [messages, reports, holds] = await Promise.all([
+    db.prepare(`SELECT COUNT(*) AS count FROM case_messages WHERE created_at < ?1 AND redacted_at IS NULL`).bind(messageCutoff).first(),
+    db.prepare(`SELECT COUNT(*) AS count FROM reports r WHERE r.resolved_at < ?1 AND r.state IN ('resolved_by_human','resolved_by_ai','closed') AND NOT EXISTS (SELECT 1 FROM legal_holds h WHERE h.report_id = r.id AND h.state = 'active')`).bind(reportCutoff).first(),
+    db.prepare(`SELECT COUNT(*) AS count FROM legal_holds WHERE state = 'active'`).first(),
+  ]);
+  return { generatedAt: timestamp, cutoffs: { messages: messageCutoff, reports: reportCutoff }, impact: { messages, reports, activeLegalHolds: holds }, destructive: false };
+}
+
+type ExportType = "reports_csv" | "reports_ndjson" | "audit_ndjson" | "configuration";
+
+async function exportBody(
+  db: D1Database,
+  type: ExportType,
+  filters: Record<string, unknown>,
+  allowedQueueIds?: string[] | null,
+): Promise<{ body: string; contentType: string; rows: number }> {
+  const days = Number.isInteger(filters.days) ? Math.max(1, Math.min(366, Number(filters.days))) : 30;
+  if (type === "reports_csv") {
+    const body = await reportsCsv(db, days, allowedQueueIds);
+    return { body, contentType: "text/csv; charset=utf-8", rows: Math.max(0, body.split("\r\n").length - 2) };
+  }
+  if (type === "reports_ndjson") {
+    const since = new Date(Date.now() - days * 86_400_000).toISOString();
+    const rows = await db.prepare(`SELECT r.id, r.public_reference AS reference, r.source, r.state, r.queue_id AS queueId, r.reason_code AS reasonCode, r.priority, r.received_at AS receivedAt, r.resolved_at AS resolvedAt, t.target_type AS targetType FROM reports r JOIN report_targets t ON t.report_id = r.id WHERE r.received_at >= ?1 AND (?2 = 1 OR r.queue_id IN (SELECT value FROM json_each(?3))) ORDER BY r.received_at DESC, r.id DESC LIMIT 10000`).bind(
+      since,
+      allowedQueueIds === null || allowedQueueIds === undefined ? 1 : 0,
+      canonicalJson(allowedQueueIds ?? []),
+    ).all<Record<string, unknown>>();
+    return { body: rows.results.map(canonicalJson).join("\n") + (rows.results.length ? "\n" : ""), contentType: "application/x-ndjson", rows: rows.results.length };
+  }
+  if (type === "audit_ndjson") {
+    const rows = await db.prepare(`SELECT sequence, id, action, actor_type AS actorType, actor_id AS actorId, target_type AS targetType, target_id AS targetId, details_json AS detailsJson, previous_hash AS previousHash, entry_hash AS entryHash, created_at AS createdAt FROM audit_entries ORDER BY sequence DESC LIMIT 10000`).all<Record<string, unknown>>();
+    const values = rows.results.reverse().map((row) => ({ ...row, details: parsed(row.detailsJson, {}), detailsJson: undefined }));
+    return { body: values.map(canonicalJson).join("\n") + (values.length ? "\n" : ""), contentType: "application/x-ndjson", rows: values.length };
+  }
+  const [queues, workflows, components, connections, policies] = await Promise.all([
+    db.prepare(`SELECT id, queue_key AS key, name, purpose, status, active_version_id AS activeVersionId FROM queue_definitions ORDER BY id`).all(),
+    db.prepare(`SELECT id, workflow_key AS key, name, purpose, status, active_version_id AS activeVersionId FROM workflow_definitions ORDER BY id`).all(),
+    db.prepare(`SELECT id, component_key AS key, name, component_kind AS kind, effect_class AS effectClass, status, active_version_id AS activeVersionId FROM component_definitions ORDER BY id`).all(),
+    db.prepare(`SELECT id, connection_key AS key, name, kind, status, active_version_id AS activeVersionId FROM connection_definitions ORDER BY id`).all(),
+    db.prepare(`SELECT id, policy_key AS key, version, title, published_at AS publishedAt FROM policy_versions ORDER BY policy_key, version`).all(),
+  ]);
+  const body = canonicalJson({ schema_version: "1", queues: queues.results, workflows: workflows.results, components: components.results, connections: connections.results, policies: policies.results });
+  return { body, contentType: "application/json", rows: queues.results.length + workflows.results.length + components.results.length + connections.results.length + policies.results.length };
+}
+
+export async function listExports(db: D1Database, principalId: string, limit: number): Promise<Record<string, unknown>[]> {
+  const rows = await db.prepare(`SELECT id, requested_by AS requestedBy, export_type AS exportType, filters_json AS filtersJson, state, digest, size_bytes AS sizeBytes, row_count AS rowCount, error_code AS errorCode, requested_at AS requestedAt, ready_at AS readyAt, expires_at AS expiresAt FROM export_jobs WHERE installation_id = 'default' AND requested_by = ?1 AND deleted_at IS NULL ORDER BY requested_at DESC, id DESC LIMIT ?2`)
+    .bind(principalId, Math.max(1, Math.min(100, limit))).all<Record<string, unknown>>();
+  return rows.results.map((row) => ({ ...row, filters: parsed(row.filtersJson, {}), filtersJson: undefined }));
+}
+
+export async function createExport(
+  env: Env,
+  value: Record<string, unknown>,
+  session: OperatorSession,
+  idempotencyKey: string,
+): Promise<{ exportId: string; state: string; idempotentReplay: boolean }> {
+  const type = value.export_type;
+  if (!(["reports_csv", "reports_ndjson", "audit_ndjson", "configuration"] as unknown[]).includes(type)) throw new ApiError(400, "export_type_invalid", "export_type is unsupported.");
+  const filters = value.filters === undefined ? {} : object(value.filters);
+  if (session.queueScope !== null && session.queueScope !== undefined && type !== "reports_csv" && type !== "reports_ndjson") {
+    throw new ApiError(403, "export_scope_denied", "Queue-scoped operators may export only the report rows they are authorized to review.");
+  }
+  const existing = await env.DB.prepare(`SELECT id, state FROM export_jobs WHERE installation_id = 'default' AND requested_by = ?1 AND idempotency_key = ?2 LIMIT 1`)
+    .bind(session.actor.id, idempotencyKey).first<{ id: string; state: string }>();
+  if (existing) return { exportId: existing.id, state: existing.state, idempotentReplay: true };
+  const exportId = crypto.randomUUID();
+  const timestamp = now();
+  await env.DB.prepare(`INSERT INTO export_jobs (id, installation_id, requested_by, export_type, filters_json, redaction_policy_json, state, requested_at, idempotency_key) VALUES (?1, 'default', ?2, ?3, ?4, ?5, 'running', ?6, ?7)`)
+    .bind(exportId, session.actor.id, type, canonicalJson(filters), canonicalJson({ omitSecrets: true, omitMessageBodies: true, queueScope: session.queueScope ?? null }), timestamp, idempotencyKey).run();
+  let objectKey: string | null = null;
+  try {
+    const generated = await exportBody(env.DB, type as ExportType, filters, session.queueScope ?? null);
+    const digest = `sha256:${await sha256(generated.body)}`;
+    objectKey = `exports/default/${exportId}`;
+    await env.EXPORTS.put(objectKey, generated.body, { httpMetadata: { contentType: generated.contentType }, customMetadata: { digest, exportType: String(type) } });
+    const readyAt = now();
+    const expiresAt = new Date(Date.now() + 60 * 60_000).toISOString();
+    await env.DB.prepare(`UPDATE export_jobs SET state = 'ready', r2_object_key = ?2, digest = ?3, size_bytes = ?4, row_count = ?5, ready_at = ?6, expires_at = ?7 WHERE id = ?1`)
+      .bind(exportId, objectKey, digest, new TextEncoder().encode(generated.body).byteLength, generated.rows, readyAt, expiresAt).run();
+    return { exportId, state: "ready", idempotentReplay: false };
+  } catch (error) {
+    if (objectKey) await env.EXPORTS.delete(objectKey).catch(() => {});
+    await env.DB.prepare(`UPDATE export_jobs SET state = 'failed', error_code = 'export_generation_failed' WHERE id = ?1`).bind(exportId).run();
+    throw error;
+  }
+}
+
+export async function loadExport(db: D1Database, exportId: string, principalId: string): Promise<Record<string, unknown> | null> {
+  const row = await db.prepare(`SELECT id, requested_by AS requestedBy, export_type AS exportType, filters_json AS filtersJson, state, r2_object_key AS objectKey, digest, size_bytes AS sizeBytes, row_count AS rowCount, error_code AS errorCode, requested_at AS requestedAt, ready_at AS readyAt, expires_at AS expiresAt FROM export_jobs WHERE id = ?1 AND installation_id = 'default' AND requested_by = ?2 AND deleted_at IS NULL LIMIT 1`)
+    .bind(exportId, principalId).first<Record<string, unknown>>();
+  return row ? { ...row, filters: parsed(row.filtersJson, {}), filtersJson: undefined } : null;
+}
+
+export async function downloadExport(env: Env, exportId: string, principalId: string): Promise<Response> {
+  const job = await loadExport(env.DB, exportId, principalId);
+  if (!job) throw new ApiError(404, "export_not_found", "The export does not exist.");
+  if (job.state !== "ready" || typeof job.objectKey !== "string" || typeof job.expiresAt !== "string" || job.expiresAt <= now()) {
+    throw new ApiError(409, "export_not_ready", "The export is not ready or has expired.");
+  }
+  const objectValue = await env.EXPORTS.get(job.objectKey);
+  if (!objectValue) throw new ApiError(404, "export_object_missing", "The export object is unavailable.");
+  const headers = new Headers();
+  objectValue.writeHttpMetadata(headers);
+  headers.set("cache-control", "private, no-store");
+  headers.set("content-disposition", `attachment; filename="safest-${job.exportType}-${exportId}.data"`);
+  if (typeof job.digest === "string") headers.set("etag", `"${job.digest}"`);
+  return new Response(objectValue.body, { headers });
+}
+
+export async function expireExports(env: Env, limit = 100): Promise<number> {
+  const timestamp = now();
+  const rows = await env.DB.prepare(`
+    SELECT id, r2_object_key AS objectKey FROM export_jobs
+    WHERE installation_id = 'default' AND state = 'ready' AND expires_at <= ?1 AND deleted_at IS NULL
+    ORDER BY expires_at, id LIMIT ?2
+  `).bind(timestamp, Math.max(1, Math.min(500, limit))).all<{ id: string; objectKey: string | null }>();
+  let expired = 0;
+  for (const row of rows.results) {
+    if (row.objectKey) await env.EXPORTS.delete(row.objectKey);
+    const result = await env.DB.prepare(`
+      UPDATE export_jobs SET state = 'expired', r2_object_key = NULL, deleted_at = ?2
+      WHERE id = ?1 AND state = 'ready' AND expires_at <= ?2
+    `).bind(row.id, timestamp).run();
+    expired += Number(result.meta.changes ?? 0);
+  }
+  return expired;
+}
+
+export async function loadWorkflowAnalytics(db: D1Database, days: number): Promise<Record<string, unknown>> {
+  const since = new Date(Date.now() - Math.max(1, Math.min(366, days)) * 86_400_000).toISOString();
+  const [states, steps, components] = await Promise.all([
+    db.prepare(`SELECT state, run_kind AS runKind, COUNT(*) AS count, AVG((julianday(COALESCE(finished_at, ?2)) - julianday(COALESCE(started_at, created_at))) * 86400000) AS averageDurationMs FROM workflow_runs WHERE created_at >= ?1 GROUP BY state, run_kind ORDER BY run_kind, state`).bind(since, now()).all(),
+    db.prepare(`SELECT node_type AS nodeType, state, COUNT(*) AS count, AVG((julianday(COALESCE(finished_at, ?2)) - julianday(started_at)) * 86400000) AS averageDurationMs FROM workflow_step_runs WHERE updated_at >= ?1 GROUP BY node_type, state ORDER BY node_type, state`).bind(since, now()).all(),
+    db.prepare(`SELECT d.component_key AS componentKey, r.state, COUNT(*) AS count, AVG((julianday(COALESCE(r.finished_at, ?2)) - julianday(r.started_at)) * 86400000) AS averageDurationMs FROM component_runs r JOIN component_versions v ON v.id = r.component_version_id JOIN component_definitions d ON d.id = v.definition_id WHERE r.created_at >= ?1 GROUP BY d.component_key, r.state ORDER BY d.component_key, r.state`).bind(since, now()).all(),
+  ]);
+  return { since, runStates: states.results, stepPerformance: steps.results, componentPerformance: components.results };
+}

package/template/tsconfig.console.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "allowJs": false,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "strict": true,
+    "forceConsistentCasingInFileNames": true,
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "types": ["vite/client"]
+  },
+  "include": ["console/**/*.ts", "console/**/*.tsx"]
+}