create-safest-tools 0.2.2 → 0.3.0

package/README.md

@@ -6,7 +6,7 @@ Safest Resolve accepts explicit reports from an embedded widget, a public page,
 
 ## Quick start
 
-You need Node.js 20.12+, a Cloudflare account with Workers, Dynamic Workflows, Worker Loaders, D1, R2, Queues, Durable Objects, Workers AI, and Access available, plus an HTTPS hostname for the reports service.
+You need Node.js 20.12+, a Cloudflare account with Workers, Dynamic Workflows, Worker Loaders, D1, R2, Queues, Durable Objects, and Workers AI available, plus an HTTPS hostname for the reports service.
 
 ```bash
 npx create-safest-tools safest-resolve \
@@ -14,17 +14,12 @@ npx create-safest-tools safest-resolve \
   --name acme-resolve \
   --public-url https://reports.example.com \
   --origin https://app.example.com \
-  --admin-email infrastructure@example.com \
-  --access-aud <cloudflare-access-application-aud> \
+  --owner-email infrastructure@example.com \
   --email-from reports@example.com
 ```
 
 The `--email-from` address must belong to a domain onboarded under Cloudflare Email Service → Email Sending. Domain onboarding permits delivery to arbitrary invited users; invitations, email verification, and forgot-password delivery use this address.
 
-### Where to find the Cloudflare Access AUD
-
-In the Cloudflare dashboard, go to **Zero Trust → Access controls → Applications** and create a **Self-hosted and private** application named **Safest Resolve infrastructure**. Add the reports hostname with **Path** `v1/infrastructure/*` only; do not protect the entire hostname. Add or create a policy named **Safest infrastructure owners** with **Action: Allow** and an **Include → Emails** rule containing only the infrastructure-owner email supplied to `--admin-email`. Do not use **Everyone**. Create the application, select **Configure → Additional settings**, and copy the 64-character **Application Audience (AUD) Tag** into `--access-aud`. The tag stays the same unless the Access application is deleted or recreated. See Cloudflare's [application-path](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/app-paths/) and [Get your AUD tag](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/#get-your-aud-tag) instructions.
-
 The command creates a local project and prints a read-only infrastructure plan. It does not change Cloudflare unless `--deploy` is supplied or the generated project’s `npm run setup` command is run and explicitly confirmed.
 
 The generated installation owns:
@@ -35,8 +30,7 @@ The generated installation owns:
 - report jobs, delivery jobs, and operations dead-letter Queues;
 - one Dynamic Workflow and a Worker Loader for compiled durable workflow execution;
 - one SQLite-backed Durable Object class for analyst presence;
-- a Workers AI binding and customer-supplied secrets;
-- a customer-created Cloudflare Access application for infrastructure-owner bootstrap only.
+- a Workers AI binding and customer-supplied secrets.
 
 The reports service stores customer application references by default. Webhook enrichments receive only their explicitly published input allowlist and return schema-validated, expiring facts with signed provenance.
 
@@ -52,7 +46,9 @@ npm run setup
 
 `setup:plan` lists exact resource names and exits without modifying Cloudflare. `setup` opens Wrangler's Cloudflare login when needed, lets you choose the owning account, and verifies Workers Paid from the account's Workers usage model. Standard accounts need no separate billing token; only legacy or ambiguous account models use the temporary Billing Read fallback. It then guides Google, GitHub, and Cloudflare OAuth configuration with exact callback URLs and masked secret input. Nothing is provisioned until the exact `DEPLOY <installation-id>` confirmation.
 
-Create a Cloudflare Access self-hosted application for `<reports-host>/v1/infrastructure/*` first and copy its 64-character audience into `reports.config.json`. The allowlisted infrastructure engineer uses it to bootstrap the Safest owner account. The owner then invites administrators, and administrators invite analysts. Those invited users sign in with Safest accounts and do not need Cloudflare accounts.
+After deployment, setup prints a 256-bit, single-use owner link that expires after 15 minutes. The raw token stays in the URL fragment, D1 stores only its digest, and the installer never writes it to disk. Open it to create the Safest owner account. If it expires, run `npm run owner:setup`. For later break-glass recovery, authenticate Wrangler and run `npm run owner:recover`.
+
+The owner then invites administrators, and administrators invite analysts. All users sign in with Safest accounts and do not need Cloudflare accounts.
 
 Invited users may join with a password or any configured OAuth provider, then choose a natural display name and optional JPEG, PNG, or WebP profile picture up to 2 MB. Better Auth stores credentials, OAuth accounts, sessions, verification state, and one-time password-reset tokens in D1. Cloudflare Email Service sends invitations, verification links, and 30-minute password-reset links.
 
@@ -70,6 +66,6 @@ npm run uninstall:plan
 
 Backups contain the D1 export and every object in the four private R2 buckets, with stable inventories and SHA-256 verification. They intentionally exclude pending Queue messages, live Workflow engine state, Worker secrets, external provider state, and ephemeral presence. Restore verification is local; restore planning requires a separate target installation and never mutates Cloudflare. Upgrade runs a verified backup before forward-only migrations and deployment.
 
-The uninstall command is intentionally plan-only: it identifies the exact reporting resources but does not delete them. D1, all private R2 buckets, Access, and secrets are preserved by default.
+The uninstall command is intentionally plan-only: it identifies the exact reporting resources but does not delete them. D1, all private R2 buckets, and secrets are preserved by default.
 
 Run `npx create-safest-tools --help` for all options.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-safest-tools",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Create customer-owned abuse-reporting infrastructure on Cloudflare",
   "type": "module",
   "license": "Apache-2.0",

package/src/cli.mjs

@@ -9,23 +9,6 @@ import { scaffoldProject, validateGeneratedConfiguration } from "./scaffold.mjs"
 const packageRoot = fileURLToPath(new URL("..", import.meta.url));
 const packageVersion = JSON.parse(readFileSync(resolve(packageRoot, "package.json"), "utf8")).version;
 const defaultTemplateDirectory = resolve(packageRoot, "template");
-const accessAudienceDocumentation = "https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/#get-your-aud-tag";
-
-export function accessAudienceGuidance(publicBaseUrl = "", adminEmails = []) {
-  let reportsHost = "<reports-host>";
-  try { reportsHost = new URL(publicBaseUrl).host || reportsHost; } catch {}
-  const ownerEmail = adminEmails[0] || "<infrastructure-owner-email>";
-  return `Before entering the Cloudflare Access application AUD:
-  1. In Cloudflare, go to Zero Trust > Access controls > Applications.
-  2. Create a Self-hosted and private application named Safest Resolve infrastructure.
-  3. Add public hostname ${reportsHost} with Path v1/infrastructure/* only.
-  4. Add a policy named Safest infrastructure owners: Action Allow; Include Emails; Value ${ownerEmail}.
-     Do not select Everyone and do not protect the entire reporting hostname.
-  5. Create the application, then select Configure > Additional settings.
-  6. Copy the 64-character Application Audience (AUD) Tag.
-The tag stays the same unless you delete or recreate the Access application.
-Cloudflare guide: ${accessAudienceDocumentation}`;
-}
 
 function usage() {
   return `Create customer-owned abuse-reporting infrastructure on Cloudflare
@@ -34,15 +17,15 @@ Usage:
   npx create-safest-tools [directory]
   npx create-safest-tools safest-resolve --yes --name acme-resolve \\
     --public-url https://reports.example.com --origin https://app.example.com \\
-    --admin-email infrastructure@example.com --access-aud <cloudflare-access-aud> \\
+    --owner-email infrastructure@example.com \\
     --email-from reports@example.com
 
 Options:
   --name id              Stable installation/resource prefix
   --public-url origin    Public report, widget, and console origin
   --origin origin        Allowed embedding/application origin; repeat as needed
-  --admin-email email    Infrastructure owner allowed through Access; repeat as needed
-  --access-aud value     Audience of the owner-bootstrap Cloudflare Access app
+  --owner-email email    Initial infrastructure owner bound to one-time setup
+  --admin-email email    Deprecated alias for --owner-email
   --email-from address   Address on an onboarded Email Sending domain (required)
   --yes                  Do not prompt for omitted optional values
   --skip-install         Create files without running npm install or setup:plan
@@ -51,8 +34,6 @@ Options:
   --help                 Show this help
   --version              Show the package version
 
-${accessAudienceGuidance()}
-
 This product does not proxy or inspect application requests. Applications submit
 reports explicitly through the widget, public form, or server API.
 `;
@@ -67,7 +48,7 @@ function valueAfter(argv, index, option) {
 export function parseArguments(argv) {
   const result = {
     directory: null, installationName: null, publicBaseUrl: null, allowedOrigins: [],
-    adminEmails: [], accessAudience: null, emailFromAddress: null, yes: false, skipInstall: false,
+    ownerEmail: null, emailFromAddress: null, yes: false, skipInstall: false,
     deploy: false, dryRun: false, help: false, version: false,
   };
   for (let index = 0; index < argv.length; index += 1) {
@@ -81,14 +62,16 @@ export function parseArguments(argv) {
     else if (argument === "--dry-run") result.dryRun = true;
     else if (argument === "--help" || argument === "-h") result.help = true;
     else if (argument === "--version" || argument === "-v") result.version = true;
-    else if (["--name", "--public-url", "--origin", "--admin-email", "--access-aud", "--email-from"].includes(argument)) {
+    else if (["--name", "--public-url", "--origin", "--owner-email", "--admin-email", "--email-from"].includes(argument)) {
       const value = valueAfter(argv, index, argument);
       index += 1;
       if (argument === "--name") result.installationName = value;
       else if (argument === "--public-url") result.publicBaseUrl = value;
       else if (argument === "--origin") result.allowedOrigins.push(value);
-      else if (argument === "--admin-email") result.adminEmails.push(...value.split(","));
-      else if (argument === "--access-aud") result.accessAudience = value;
+      else if (argument === "--owner-email" || argument === "--admin-email") {
+        if (result.ownerEmail && result.ownerEmail !== value) throw new Error("provide only one infrastructure owner email");
+        result.ownerEmail = value;
+      }
       else result.emailFromAddress = value;
     } else throw new Error(`unknown option: ${argument}`);
   }
@@ -109,15 +92,11 @@ async function ask(input, prompt, fallback = "") {
   return answer || fallback;
 }
 
-async function completeInteractive(options, input, output) {
+async function completeInteractive(options, input) {
   options.installationName ||= await ask(input, "Installation name", "safest-resolve");
   options.publicBaseUrl ||= await ask(input, "Public reports origin", "https://reports.example.com");
   if (!options.allowedOrigins.length) options.allowedOrigins.push(await ask(input, "Application origin allowed to embed the report form", "https://app.example.com"));
-  if (!options.adminEmails.length) options.adminEmails.push(await ask(input, "Infrastructure owner email"));
-  if (!options.accessAudience) {
-    output.log(`\n${accessAudienceGuidance(options.publicBaseUrl, options.adminEmails)}\n`);
-    options.accessAudience = await ask(input, "Cloudflare Access application AUD (press Enter to use a deployment-blocking placeholder)", "replace-with-the-cloudflare-access-application-aud");
-  }
+  options.ownerEmail ||= await ask(input, "Infrastructure owner email");
   options.emailFromAddress ||= await ask(input, "Sender address on a Cloudflare Email Sending domain");
   return options;
 }
@@ -130,7 +109,7 @@ export async function runCli(argv, dependencies = {}) {
   const interactive = dependencies.interactive ?? (process.stdin.isTTY && !options.yes);
   if (interactive) {
     const input = createInterface({ input: process.stdin, output: process.stdout });
-    try { await completeInteractive(options, input, output); } finally { input.close(); }
+    try { await completeInteractive(options, input); } finally { input.close(); }
   }
   const configuration = buildConfiguration(options);
   const templateDirectory = dependencies.templateDirectory ?? defaultTemplateDirectory;

package/src/config.mjs

@@ -17,12 +17,6 @@ function httpsOrigin(value, field) {
   return url.origin;
 }
 
-function emails(values) {
-  const result = [...new Set((values ?? []).map((value) => String(value).trim().toLowerCase()).filter(Boolean))];
-  if (result.some((value) => !EMAIL.test(value))) throw new Error("every --admin-email must be a valid email address");
-  return result;
-}
-
 function optionalEmail(value, field) {
   const result = String(value ?? "").trim().toLowerCase();
   if (result && !EMAIL.test(result)) throw new Error(`${field} must be a valid email address`);
@@ -39,9 +33,8 @@ export function buildConfiguration(options) {
   const publicBaseUrl = httpsOrigin(options.publicBaseUrl, "public URL");
   const allowedOrigins = [...new Set((options.allowedOrigins ?? []).map((value, index) => httpsOrigin(value, `allowed origin ${index + 1}`)))];
   if (!allowedOrigins.length) throw new Error("at least one --origin is required for widget and API embedding");
-  const adminEmails = emails(options.adminEmails);
-  if (!adminEmails.length) throw new Error("at least one --admin-email is required");
-  const accessAudience = String(options.accessAudience ?? "replace-with-the-cloudflare-access-application-aud").trim();
+  const ownerEmail = optionalEmail(options.ownerEmail ?? options.adminEmails?.[0], "owner email");
+  if (!ownerEmail) throw new Error("--owner-email is required");
   const emailFromAddress = optionalEmail(options.emailFromAddress, "email sender");
   if (!emailFromAddress) throw new Error("--email-from is required and its domain must be onboarded to Cloudflare Email Sending");
   const resources = {
@@ -62,15 +55,12 @@ export function buildConfiguration(options) {
   }
   return {
     $schema: "./reports.schema.json",
-    schemaVersion: 1,
+    schemaVersion: 2,
     installationId,
     resources,
     publicBaseUrl,
     allowedOrigins,
-    access: {
-      audience: accessAudience,
-      ownerEmails: adminEmails,
-    },
+    owner: { email: ownerEmail },
     email: { enabled: true, fromAddress: emailFromAddress },
     auth: { password: true, providers: [] },
     retention: { reportsDays: 365, messagesDays: 180, appealWindowDays: 30 },
@@ -131,8 +121,6 @@ export function buildWranglerConfiguration(config) {
       PUBLIC_INTEGRATION_ID: "default",
       PUBLIC_REPORT_LIMIT_PER_10_MINUTES: "5",
       PUBLIC_REPORT_SURGE_PER_5_MINUTES: "250",
-      ACCESS_AUD: config.access.audience,
-      INFRASTRUCTURE_OWNER_EMAILS: config.access.ownerEmails.join(","),
       TURNSTILE_SITE_KEY: "",
       ACTION_WEBHOOK_URL: "",
       NOTIFICATION_WEBHOOK_URL: "",

package/template/README.md

@@ -4,18 +4,19 @@ Safest Resolve handles abuse, safety, fraud, and policy reports in the Cloudflar
 
 The service does not proxy or inspect normal application traffic. The customer application remains responsible for the content references it provides and for carrying out any approved action.
 
-This project deploys one Worker, one D1 database, four private R2 buckets, a Dynamic Workflow, report and delivery Queues, an operations dead-letter Queue, a presence Durable Object, static assets, a Worker Loader, and a Workers AI binding. The Cloudflare account owner creates the Access application and owns every secret, webhook, log, and retained row.
+This project deploys one Worker, one D1 database, four private R2 buckets, a Dynamic Workflow, report and delivery Queues, an operations dead-letter Queue, a presence Durable Object, static assets, a Worker Loader, and a Workers AI binding. The Cloudflare account owner owns every secret, webhook, log, and retained row.
 
 Before deployment:
 
 1. Review `reports.config.json` and `npm run setup:plan`.
-2. In Cloudflare, go to **Zero Trust → Access controls → Applications** and create a **Self-hosted and private** application named **Safest Resolve infrastructure**. Add the reports hostname with **Path** `v1/infrastructure/*` only; do not protect the entire hostname. Add a reusable policy named **Safest infrastructure owners** with **Action: Allow** and an **Include → Emails** rule containing only the email addresses in `access.ownerEmails`; do not use **Everyone**. Create the application, select **Configure → Additional settings**, and copy the 64-character **Application Audience (AUD) Tag** into `access.audience`. The tag stays stable unless the Access application is deleted or recreated. See Cloudflare's [application-path](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/app-paths/), [policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/policy-management/), and [Get your AUD tag](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/#get-your-aud-tag) instructions.
-3. Under Cloudflare Email Service → Email Sending, onboard the configured sender domain. Password verification, invitations, and password recovery to arbitrary recipients depend on domain onboarding.
-4. Run `npm run setup`. The guided setup signs in through Wrangler and verifies Workers Paid from the account's Workers usage model before provisioning. Standard accounts need no separate billing token; only legacy or ambiguous models use the temporary Billing Read fallback. Setup then creates owner-only local secrets and walks through optional Google, GitHub, and Cloudflare OAuth credentials with exact callback URLs.
-5. Bootstrap the infrastructure owner, then invite administrators and analysts from People. Invited users do not need Cloudflare accounts and can upload a JPEG, PNG, or WebP profile picture up to 2 MB. Names and workspace roles are always displayed separately.
-6. Type the exact installation confirmation when setup requests it.
+2. Under Cloudflare Email Service → Email Sending, onboard the configured sender domain. Invitations and password recovery to arbitrary recipients depend on domain onboarding.
+3. Run `npm run setup`. The guided setup signs in through Wrangler and verifies Workers Paid from the account's Workers usage model before provisioning. Standard accounts need no separate billing token; only legacy or ambiguous models use the temporary Billing Read fallback. Setup then creates owner-only local secrets and walks through optional Google, GitHub, and Cloudflare OAuth credentials with exact callback URLs.
+4. Type the exact installation confirmation when setup requests it. After deployment, setup prints a 256-bit, single-use owner link that expires after 15 minutes and is never written to disk.
+5. Open the owner link, create the Safest owner account, then invite administrators and analysts from People. Nobody needs a Cloudflare account to sign in. Names and workspace roles are always displayed separately.
 
-Setup creates D1, four private R2 buckets, and three Queues, applies report migrations, and deploys the Worker with Dynamic Workflows. After bootstrap, verify the `database`, `workflow_runtime`, `workers_ai`, `object_storage`, and `queues` setup features, then require an authenticated `GET /ready` response of 200. Public `GET /health` is liveness only. Better Auth owns password hashing, email verification, OAuth accounts, sessions, and one-time password-reset tokens in D1. Upgrades always back up D1 before migrations and deployment.
+Setup creates D1, four private R2 buckets, and three Queues, applies report migrations, and deploys the Worker with Dynamic Workflows. After owner setup, verify the `database`, `workflow_runtime`, `workers_ai`, `object_storage`, and `queues` setup features, then require an authenticated `GET /ready` response of 200. Public `GET /health` is liveness only. Better Auth owns password hashing, OAuth accounts, sessions, and one-time password-reset tokens in D1. Upgrades always back up D1 before migrations and deployment.
+
+If the setup link expires, run `npm run owner:setup`. If the owner loses access later, authenticate Wrangler as the Cloudflare account owner and run `npm run owner:recover`; the resulting single-use link creates a 12-hour break-glass session and is recorded in the audit log.
 
 Administrators build and preview questions in **Configuration → Intake forms**, set the logo, colours, fonts, and shape in **Settings → Branding**, then choose a private hosted page, signed-in product widget, or anonymous product widget in **Settings → Reporting channels**. Hosted pages and anonymous widgets need no API key. Signed-in widgets use one small customer-backend endpoint; verified reporter, target, and registered trusted facts stay server-side while the browser receives only a short-lived opaque token. Every public submission is verified with Turnstile inside a Resolve-owned isolated frame.
 
@@ -30,6 +31,6 @@ npm run upgrade:plan
 npm run upgrade
 ```
 
-`npm run uninstall:plan` is deliberately read-only. It lists only the resources named by this installation and preserves D1, all private R2 buckets, and Access by default.
+`npm run uninstall:plan` is deliberately read-only. It lists only the resources named by this installation and preserves D1 and all private R2 buckets by default.
 
 Verified backups contain the D1 export plus all objects from the four private R2 buckets, with a stable inventory and SHA-256 digests. They intentionally exclude pending Queue messages, live Workflow engine state, Worker secrets, external webhook state, and ephemeral analyst presence. Restore planning requires a separately named target installation and does not mutate Cloudflare.

package/template/console/auth/AccountJourney.tsx

@@ -4,6 +4,7 @@ import { removeAccountHash } from "./browser-navigation";
 import { authEvents, type AuthErrorDetail } from "./events";
 import { InvitationAcceptance } from "./InvitationAcceptance";
 import { OperatorLogin } from "./OperatorLogin";
+import { OwnerSetup } from "./OwnerSetup";
 import { PasswordRecovery, PasswordReset } from "./PasswordRecovery";
 
 export function AccountJourney() {
@@ -63,6 +64,7 @@ export function AccountJourney() {
       {route.view === "forgot" ? <PasswordRecovery email={email} onEmailChange={(value) => { setEmail(value); setError(""); }} onBack={() => showLogin(false)} onError={setError} /> : null}
       {route.view === "reset" ? <PasswordReset token={route.token} onBack={() => showLogin(true)} onError={setError} /> : null}
       {route.view === "invite" ? <InvitationAcceptance token={route.token} onBack={() => showLogin(true)} onError={setError} /> : null}
+      {route.view === "setup" ? <OwnerSetup token={route.token} onBack={() => showLogin(true)} onError={setError} /> : null}
       <p id="operator-login-error" className="error auth-error" role="alert">{error}</p>
     </div>
   );

package/template/console/auth/OperatorLogin.tsx

@@ -55,7 +55,7 @@ export function OperatorLogin({ email, emailInput, onEmailChange, onForgotPasswo
       <p className="eyebrow">Private safety workspace</p>
       <h2 id="login-title">Sign in to Safest</h2>
       <p id="operator-login-help" className="auth-copy">
-        Admins and analysts use their invited Safest account. They do not need a Cloudflare account.
+        Owners, admins, and analysts use their Safest account. They do not need a Cloudflare account.
       </p>
       <OAuthButtons disabled={pending} onError={onError} />
       <form id="operator-login-form" aria-busy={pending} onSubmit={signIn}>
@@ -93,18 +93,6 @@ export function OperatorLogin({ email, emailInput, onEmailChange, onForgotPasswo
       <button id="forgot-password-link" className="text-button" type="button" onClick={requestPasswordReset}>
         Forgot password?
       </button>
-      <details className="infrastructure-access">
-        <summary>Infrastructure owner access</summary>
-        <p>This separate route is only for the allowlisted infrastructure owner. Cloudflare Access handles authentication and recovery.</p>
-        <button
-          id="access-login"
-          className="secondary wide"
-          type="button"
-          onClick={() => window.location.assign("/v1/infrastructure/bootstrap")}
-        >
-          Continue with Cloudflare Access
-        </button>
-      </details>
     </div>
   );
 }

package/template/console/auth/OwnerSetup.tsx

@@ -0,0 +1,110 @@
+import { useEffect, useState, type FormEvent } from "react";
+import { authEvents, dispatchAuthEvent } from "./events";
+import { replaceWithWorkspaceRoute } from "./browser-navigation";
+import { errorMessage, postJson } from "../lib/http";
+import { OAuthButtons } from "./OAuthButtons";
+
+interface OwnerSetupProps {
+  token: string;
+  onBack: () => void;
+  onError: (message: string) => void;
+}
+
+interface OwnerSetupDetails {
+  email: string;
+  purpose: "bootstrap" | "recovery";
+  expires_at: string;
+}
+
+export function OwnerSetup({ token, onBack, onError }: OwnerSetupProps) {
+  const [details, setDetails] = useState<OwnerSetupDetails | null>(null);
+  const [displayName, setDisplayName] = useState("");
+  const [password, setPassword] = useState("");
+  const [pending, setPending] = useState(true);
+
+  useEffect(() => {
+    let active = true;
+    if (!token) {
+      setPending(false);
+      onError("This owner setup link is invalid or expired.");
+      return () => { active = false; };
+    }
+    void postJson<{ setup: OwnerSetupDetails }>("/v1/auth/owner-setup/inspect", { token })
+      .then((result) => {
+        if (!active) return;
+        setDetails(result.setup);
+        onError("");
+        window.history.replaceState(null, "", `${window.location.pathname}${window.location.search}`);
+      })
+      .catch((cause) => {
+        if (active) onError(errorMessage(cause, "This owner setup link is invalid or expired."));
+      })
+      .finally(() => { if (active) setPending(false); });
+    return () => { active = false; };
+  }, [token, onError]);
+
+  async function finishSetup(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    if (pending || !details) return;
+    setPending(true);
+    onError("");
+    try {
+      await postJson("/v1/auth/owner-setup/accept", details.purpose === "bootstrap"
+        ? { display_name: displayName.trim(), password }
+        : {});
+      setPassword("");
+      sessionStorage.removeItem("safest-reports-force-login");
+      replaceWithWorkspaceRoute();
+      dispatchAuthEvent(authEvents.authenticated, {
+        destination: details.purpose === "recovery" ? "profile" : "reports",
+        ...(details.purpose === "recovery" ? {
+          profileMessage: "Break-glass access is active for 12 hours. Reset your owner password now.",
+        } : {}),
+      });
+    } catch (cause) {
+      setPending(false);
+      onError(errorMessage(cause, "The owner account could not be set up."));
+    }
+  }
+
+  if (details?.purpose === "recovery") {
+    return (
+      <div className="auth-panel" data-auth-view="owner-recovery">
+        <p className="eyebrow">Owner recovery</p>
+        <h2 id="login-title">Start break-glass access</h2>
+        <p className="auth-copy">
+          Continue as {details.email} for 12 hours. Once signed in, reset the owner password and review the audit log.
+        </p>
+        <form aria-busy={pending} onSubmit={finishSetup}>
+          <button className="primary wide" type="submit" disabled={pending}>
+            {pending ? "Starting recovery…" : "Continue securely"}
+          </button>
+        </form>
+        <button className="text-button auth-back" type="button" onClick={onBack}>Back to sign in</button>
+      </div>
+    );
+  }
+
+  return (
+    <div className="auth-panel" data-auth-view="owner-setup">
+      <p className="eyebrow">One-time owner setup</p>
+      <h2 id="login-title">Create your owner account</h2>
+      <p className="auth-copy">
+        This short-lived link came from the authenticated installer. It works once and replaces the Cloudflare Access setup step.
+      </p>
+      {details ? <p className="form-message">Owner account for {details.email}</p> : null}
+      <OAuthButtons disabled={pending || !details} onError={onError} />
+      <form id="owner-setup-form" aria-busy={pending} onSubmit={finishSetup}>
+        <label htmlFor="owner-setup-name">Full name</label>
+        <input id="owner-setup-name" name="display_name" autoComplete="name" maxLength={100} value={displayName} onChange={(event) => setDisplayName(event.currentTarget.value)} disabled={pending || !details} required autoFocus />
+        <label htmlFor="owner-setup-password">Create password</label>
+        <input id="owner-setup-password" name="password" type="password" autoComplete="new-password" minLength={12} maxLength={128} value={password} onChange={(event) => setPassword(event.currentTarget.value)} disabled={pending || !details} required />
+        <small className="field-help">Use at least 12 characters. A passphrase works well.</small>
+        <button className="primary wide" type="submit" disabled={pending || !details}>
+          {pending ? "Checking secure link…" : "Create owner account"}
+        </button>
+      </form>
+      <button className="text-button auth-back" type="button" onClick={onBack}>Back to sign in</button>
+    </div>
+  );
+}

package/template/console/auth/account-route.ts

@@ -1,4 +1,4 @@
-export type AccountView = "login" | "forgot" | "reset" | "invite";
+export type AccountView = "login" | "forgot" | "reset" | "invite" | "setup";
 
 export interface AccountRoute {
   view: AccountView;
@@ -7,6 +7,8 @@ export interface AccountRoute {
 
 export function accountRouteFromHash(hash: string): AccountRoute {
   const parameters = new URLSearchParams(hash.replace(/^#/u, ""));
+  const setupToken = parameters.get("setup") || "";
+  if (setupToken) return { view: "setup", token: setupToken };
   const invitationToken = parameters.get("invite") || "";
   if (invitationToken) return { view: "invite", token: invitationToken };
   const resetToken = parameters.get("reset") || "";

package/template/console/shell/types.ts

@@ -30,7 +30,7 @@ export interface ConsoleSession {
     type: "operator_user";
     id: string;
   };
-  authMethod: "cloudflare_access" | "better_auth";
+  authMethod: "owner_setup" | "better_auth";
   displayName: string;
   email?: string;
   avatarUrl?: string;

package/template/migrations/0042_owner_setup_tokens.sql

@@ -0,0 +1,29 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE owner_setup_tokens (
+  id TEXT PRIMARY KEY,
+  email TEXT NOT NULL COLLATE NOCASE,
+  token_hash TEXT NOT NULL UNIQUE,
+  purpose TEXT NOT NULL CHECK (purpose IN ('bootstrap', 'recovery')),
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'consumed', 'revoked')),
+  expires_at TEXT NOT NULL,
+  consumed_at TEXT,
+  revoked_at TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE UNIQUE INDEX owner_setup_tokens_pending_email_purpose_idx
+  ON owner_setup_tokens(email, purpose)
+  WHERE status = 'pending';
+CREATE INDEX owner_setup_tokens_expiry_idx
+  ON owner_setup_tokens(status, expires_at, created_at DESC, id);
+
+CREATE TABLE owner_setup_rate_limits (
+  bucket_key TEXT PRIMARY KEY,
+  window_start TEXT NOT NULL,
+  request_count INTEGER NOT NULL CHECK (request_count > 0),
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX owner_setup_rate_limits_expiry_idx
+  ON owner_setup_rate_limits(window_start, updated_at);

package/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safest-resolve-installation",
-  "version": "0.2.2",
-  "safestToolsVersion": "0.2.2-resolve",
+  "version": "0.3.0",
+  "safestToolsVersion": "0.3.0-resolve",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
@@ -11,6 +11,8 @@
     "secrets:init": "node scripts/reports-secrets.mjs",
     "setup": "npm run build:console && node scripts/reports-deploy.mjs",
     "setup:plan": "node scripts/reports-deploy.mjs --plan",
+    "owner:setup": "node scripts/reports-owner-setup.mjs",
+    "owner:recover": "node scripts/reports-owner-setup.mjs --recover",
     "upgrade": "npm run backup && npm run build:console && node scripts/reports-deploy.mjs --upgrade",
     "upgrade:plan": "node scripts/reports-deploy.mjs --upgrade --plan",
     "backup": "node scripts/reports-backup.mjs",
@@ -28,7 +30,6 @@
     "@clack/prompts": "^1.7.0",
     "@cloudflare/dynamic-workflows": "^0.1.1",
     "better-auth": "^1.7.2",
-    "jose": "^6.2.10",
     "react": "^19.2.8",
     "react-dom": "^19.2.8"
   },