create-safest-tools 0.2.2 → 0.3.0

package/template/src/report-better-auth.ts

@@ -5,6 +5,9 @@ import type { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
 
 const INVITATION_COOKIE = "safest_invitation";
 const INVITATION_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
+const OWNER_SETUP_COOKIE = "safest_owner_setup";
+const OWNER_SETUP_RATE_LIMIT = 12;
+const OWNER_SETUP_WINDOW_SECONDS = 10 * 60;
 
 type AuthEmailBinding = {
   send(message: {
@@ -52,6 +55,20 @@ type InvitationRow = {
   expires_at: string;
 };
 
+export type OwnerSetupContext = {
+  id: string;
+  email: string;
+  purpose: "bootstrap" | "recovery";
+  expiresAt: string;
+};
+
+type OwnerSetupRow = {
+  id: string;
+  email: string;
+  purpose: "bootstrap" | "recovery";
+  expires_at: string;
+};
+
 const encoder = new TextEncoder();
 
 function bytesToBase64Url(bytes: Uint8Array): string {
@@ -116,6 +133,46 @@ async function invitationCookieValue(id: string, env: BetterAuthEnv): Promise<st
   return `${id}.${await hmac(`${INVITATION_COOKIE}:${id}`, authSecret(env))}`;
 }
 
+async function ownerSetupCookieValue(id: string, env: BetterAuthEnv): Promise<string> {
+  return `${id}.${await hmac(`${OWNER_SETUP_COOKIE}:${id}`, authSecret(env))}`;
+}
+
+function signedCookieId(value: string | undefined): { id: string; signature: string } | null {
+  if (!value) return null;
+  const separator = value.lastIndexOf(".");
+  if (separator <= 0) return null;
+  const id = value.slice(0, separator);
+  const signature = value.slice(separator + 1);
+  return /^[0-9a-f-]{36}$/iu.test(id) ? { id, signature } : null;
+}
+
+export async function ownerSetupContextFromRequest(
+  request: Request | undefined,
+  env: BetterAuthEnv,
+): Promise<OwnerSetupContext | null> {
+  const signed = signedCookieId(parseCookies(request?.headers.get("cookie") ?? null).get(OWNER_SETUP_COOKIE));
+  if (!signed) return null;
+  const expected = await hmac(`${OWNER_SETUP_COOKIE}:${signed.id}`, authSecret(env));
+  if (!constantTimeEqual(signed.signature, expected)) return null;
+  const row = await env.DB.prepare(`
+    SELECT id, email, purpose, expires_at
+    FROM owner_setup_tokens
+    WHERE id = ?1 AND status = 'pending' AND expires_at > ?2
+    LIMIT 1
+  `).bind(signed.id, new Date().toISOString()).first<OwnerSetupRow>();
+  return row ? { id: row.id, email: row.email, purpose: row.purpose, expiresAt: row.expires_at } : null;
+}
+
+async function ownerSetupAllowsEmail(
+  request: Request | undefined,
+  env: BetterAuthEnv,
+  emailValue: unknown,
+): Promise<boolean> {
+  const email = typeof emailValue === "string" ? emailValue.trim().toLowerCase() : "";
+  const setup = await ownerSetupContextFromRequest(request, env);
+  return setup?.purpose === "bootstrap" && setup.email.trim().toLowerCase() === email;
+}
+
 export async function invitationIdFromRequest(
   request: Request | undefined,
   env: BetterAuthEnv,
@@ -179,6 +236,7 @@ async function identityMayCreateUser(
     "SELECT id FROM operator_users WHERE email = ?1 AND status = 'active' LIMIT 1",
   ).bind(email).first();
   if (existing) return;
+  if (await ownerSetupAllowsEmail(request, env, email)) return;
   const invitationId = await invitationIdFromRequest(request, env);
   const invitation = invitationId ? await findPendingInvitationById(env, invitationId) : null;
   if (!invitation) {
@@ -202,6 +260,7 @@ async function identityMaySignIn(
     "SELECT status FROM operator_users WHERE email = ?1 LIMIT 1",
   ).bind(email).first<{ status: string }>() : null;
   if (operator?.status === "active") return;
+  if (request && await ownerSetupAllowsEmail(request, env, email)) return;
   if (request && await invitationAllowsEmail(request, env, email)) return;
   return { error: "account_unavailable", errorDescription: "This Safest Resolve account is unavailable." };
 }
@@ -393,7 +452,8 @@ function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
       sendOnSignIn: !development,
       autoSignInAfterVerification: true,
       expiresIn: 24 * 60 * 60,
-      async sendVerificationEmail({ user, url }) {
+      async sendVerificationEmail({ user, url }, request) {
+        if (await ownerSetupAllowsEmail(request, env, user.email)) return;
         await deliverAuthEmail(env, ctx, {
           to: user.email,
           subject: "Verify your Safest Resolve email",
@@ -543,6 +603,10 @@ export function appendBetterAuthCsrfCookie(
     "set-cookie",
     `${INVITATION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax${secure ? "; Secure" : ""}`,
   );
+  headers.append(
+    "set-cookie",
+    `${OWNER_SETUP_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax${secure ? "; Secure" : ""}`,
+  );
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,
@@ -550,6 +614,90 @@ export function appendBetterAuthCsrfCookie(
   });
 }
 
+export function clearOwnerSetupCookie(response: Response, request: Request): Response {
+  const secure = new URL(request.url).protocol === "https:";
+  const headers = new Headers(response.headers);
+  headers.append(
+    "set-cookie",
+    `${OWNER_SETUP_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax${secure ? "; Secure" : ""}`,
+  );
+  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+
+async function enforceOwnerSetupRateLimit(request: Request, env: BetterAuthEnv): Promise<boolean> {
+  const pepper = env.RATE_LIMIT_PEPPER;
+  if (typeof pepper !== "string" || new TextEncoder().encode(pepper).byteLength < 32) {
+    throw new Error("RATE_LIMIT_PEPPER must be configured for owner setup.");
+  }
+  const now = new Date();
+  const windowStart = new Date(Math.floor(now.valueOf() / (OWNER_SETUP_WINDOW_SECONDS * 1_000))
+    * OWNER_SETUP_WINDOW_SECONDS * 1_000).toISOString();
+  const network = (request.headers.get("cf-connecting-ip") ?? "unknown").slice(0, 200);
+  const bucketKey = await sha256(`${pepper}:owner-setup:${windowStart}:${network}`);
+  const row = await env.DB.prepare(`
+    INSERT INTO owner_setup_rate_limits (bucket_key, window_start, request_count, updated_at)
+    VALUES (?1, ?2, 1, ?3)
+    ON CONFLICT(bucket_key) DO UPDATE SET
+      request_count = owner_setup_rate_limits.request_count + 1,
+      updated_at = excluded.updated_at
+    WHERE owner_setup_rate_limits.request_count < ?4
+    RETURNING request_count
+  `).bind(bucketKey, windowStart, now.toISOString(), OWNER_SETUP_RATE_LIMIT).first<{ request_count: number }>();
+  await env.DB.prepare(`DELETE FROM owner_setup_rate_limits WHERE updated_at < ?1`)
+    .bind(new Date(now.valueOf() - 60 * 60_000).toISOString()).run();
+  return Boolean(row);
+}
+
+function ownerSetupError(status = 400): Response {
+  return Response.json({
+    error: { code: "invalid_owner_setup", message: "This owner setup link is invalid or expired." },
+  }, { status, headers: { "cache-control": "no-store", "referrer-policy": "no-referrer" } });
+}
+
+export async function inspectOwnerSetup(request: Request, env: BetterAuthEnv): Promise<Response> {
+  if (request.method !== "POST") return new Response("Method Not Allowed", { status: 405, headers: { allow: "POST" } });
+  if (!await enforceOwnerSetupRateLimit(request, env)) {
+    return Response.json({
+      error: { code: "owner_setup_rate_limited", message: "Too many setup attempts. Try again in ten minutes." },
+    }, { status: 429, headers: { "cache-control": "no-store", "retry-after": String(OWNER_SETUP_WINDOW_SECONDS) } });
+  }
+  const body = await request.json().catch(() => null) as { token?: unknown } | null;
+  const token = typeof body?.token === "string" ? body.token : "";
+  if (!/^[A-Za-z0-9_-]{43,200}$/u.test(token)) return ownerSetupError();
+  const now = new Date().toISOString();
+  const setup = await env.DB.prepare(`
+    SELECT id, email, purpose, expires_at
+    FROM owner_setup_tokens
+    WHERE token_hash = ?1 AND status = 'pending' AND expires_at > ?2
+    LIMIT 1
+  `).bind(await sha256(token), now).first<OwnerSetupRow>();
+  if (!setup) return ownerSetupError();
+  const eligible = setup.purpose === "bootstrap"
+    ? !await env.DB.prepare(`
+        SELECT id FROM operator_users
+        WHERE status = 'active' AND roles_json LIKE '%"owner"%'
+        LIMIT 1
+      `).first()
+    : Boolean(await env.DB.prepare(`
+        SELECT id FROM operator_users
+        WHERE email = ?1 AND status = 'active' AND roles_json LIKE '%"owner"%'
+        LIMIT 1
+      `).bind(setup.email).first());
+  if (!eligible) return ownerSetupError();
+  const secure = new URL(request.url).protocol === "https:";
+  const maxAge = Math.max(0, Math.floor((Date.parse(setup.expires_at) - Date.now()) / 1_000));
+  const headers = new Headers({ "cache-control": "no-store", "referrer-policy": "no-referrer" });
+  headers.append(
+    "set-cookie",
+    `${OWNER_SETUP_COOKIE}=${await ownerSetupCookieValue(setup.id, env)}; Path=/; Max-Age=${maxAge}; ` +
+      `HttpOnly; SameSite=Lax${secure ? "; Secure" : ""}`,
+  );
+  return Response.json({
+    schema_version: "1",
+    setup: { email: setup.email, purpose: setup.purpose, expires_at: setup.expires_at },
+  }, { headers });
+}
+
 export async function inspectInvitation(
   request: Request,
   env: BetterAuthEnv,

package/template/src/report-operator-accounts.ts

@@ -202,7 +202,7 @@ function operatorAvatarUrl(user: OperatorUserRow): string | undefined {
 function operatorSession(
   user: OperatorUserRow,
   authorization?: { roles: OperatorRole[]; queueScope: string[] | null; fieldScope: Record<string, string[]> | null },
-  authMethod: OperatorSession["authMethod"] = "cloudflare_access",
+  authMethod: OperatorSession["authMethod"] = "owner_setup",
 ): OperatorSession {
   const roles = authorization?.roles ?? parseRoles(user.roles_json);
   const avatarUrl = operatorAvatarUrl(user);
@@ -275,10 +275,19 @@ export async function resolveBetterAuthOperator(
   db: D1Database,
   identity: { email: string; name: string; image?: string | null },
   invitationId: string | null,
+  ownerSetupId: string | null = null,
 ): Promise<OperatorSession | null> {
   const email = cleanEmail(identity.email);
   let user = await db.prepare(`SELECT * FROM operator_users WHERE email = ?1 LIMIT 1`)
     .bind(email).first<OperatorUserRow>();
+  if (ownerSetupId) {
+    const owner = await claimInitialOwner(db, ownerSetupId, {
+      email,
+      displayName: identity.name,
+      avatarUrl: identity.image,
+    });
+    if (owner) return owner;
+  }
   if (user) {
     if (user.status !== "active") return null;
     return operatorSession(user, await operatorAuthorization(db, user), "better_auth");
@@ -385,18 +394,6 @@ export function clearOperatorSessionCookies(response: Response, request: Request
   return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
 }
 
-async function issueSession(db: D1Database, user: OperatorUserRow): Promise<IssuedOperatorSession> {
-  const createdAt = new Date().toISOString();
-  const expiresAt = new Date(Date.parse(createdAt) + SESSION_HOURS * 3_600_000).toISOString();
-  const sessionToken = randomToken();
-  const csrfToken = randomToken();
-  await db.prepare(`
-    INSERT INTO infrastructure_owner_sessions (id, user_id, token_hash, csrf_hash, expires_at, last_seen_at, created_at)
-    VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?6)
-  `).bind(crypto.randomUUID(), user.id, await sha256(sessionToken), await sha256(csrfToken), expiresAt, createdAt).run();
-  return { session: operatorSession(user), sessionToken, csrfToken, expiresAt };
-}
-
 export async function resolveOperatorAccountSession(
   request: Request,
   db: D1Database,
@@ -427,37 +424,127 @@ export async function verifyOperatorCsrf(request: Request, csrfHash: string): Pr
   )) throw new ApiError(403, "csrf_validation_failed", "Refresh the page and try again.");
 }
 
-export async function bootstrapOwner(
+export async function claimInitialOwner(
   db: D1Database,
-  identity: { email: string; displayName: string; avatarUrl?: string },
-): Promise<IssuedOperatorSession> {
+  setupId: string,
+  identity: { email: string; displayName: string; avatarUrl?: string | null },
+): Promise<OperatorSession | null> {
   const email = cleanEmail(identity.email);
   const displayName = cleanDisplayName(identity.displayName, email.split("@", 1)[0]);
   const avatarUrl = cleanAvatarUrl(identity.avatarUrl);
   const timestamp = new Date().toISOString();
-  let user = await db.prepare(`SELECT * FROM operator_users WHERE email = ?1`).bind(email).first<OperatorUserRow>();
-  if (user) {
-    await db.prepare(`
-      UPDATE operator_users SET display_name = ?2, avatar_url = ?3, roles_json = '["owner"]', status = 'active', updated_at = ?4
-      WHERE id = ?1
-    `).bind(user.id, displayName, avatarUrl, timestamp).run();
-    user = { ...user, display_name: displayName, avatar_url: avatarUrl, roles_json: '["owner"]', status: "active", updated_at: timestamp };
-  } else {
-    user = {
-      id: crypto.randomUUID(), email, display_name: displayName, avatar_url: avatarUrl,
-      avatar_object_key: null, avatar_uploaded_at: null,
-      roles_json: '["owner"]', status: "active", accepted_at: timestamp,
-      last_login_at: timestamp, created_at: timestamp, updated_at: timestamp,
-    };
-    await db.prepare(`
-      INSERT INTO operator_users (
-        id, email, display_name, avatar_url, roles_json, status, accepted_at, last_login_at, created_at, updated_at
-      ) VALUES (?1, ?2, ?3, ?4, ?5, 'active', ?6, ?6, ?6, ?6)
-    `).bind(user.id, user.email, user.display_name, user.avatar_url, user.roles_json, timestamp).run();
-  }
-  await db.prepare(`UPDATE operator_users SET last_login_at = ?2 WHERE id = ?1`).bind(user.id, timestamp).run();
-  await auditEvent(db, "operator.owner_bootstrap", user.id, "cloudflare_access", user.id, { email }, timestamp).run();
-  return issueSession(db, user);
+  const existing = await db.prepare(`SELECT * FROM operator_users WHERE email = ?1 LIMIT 1`)
+    .bind(email).first<OperatorUserRow>();
+  const userId = existing?.id ?? crypto.randomUUID();
+  const tokenPredicate = `
+    EXISTS (
+      SELECT 1 FROM owner_setup_tokens
+      WHERE id = ?1 AND email = ?2 AND purpose = 'bootstrap'
+        AND status = 'pending' AND expires_at > ?3
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM operator_users
+      WHERE status = 'active' AND roles_json LIKE '%"owner"%'
+    )
+  `;
+  const userStatement = existing
+    ? db.prepare(`
+        UPDATE operator_users
+        SET display_name = ?4, avatar_url = ?5, roles_json = '["owner"]', status = 'active',
+          accepted_at = COALESCE(accepted_at, ?3), last_login_at = ?3, updated_at = ?3
+        WHERE id = ?6 AND ${tokenPredicate}
+      `).bind(setupId, email, timestamp, displayName, avatarUrl, userId)
+    : db.prepare(`
+        INSERT INTO operator_users (
+          id, email, display_name, avatar_url, roles_json, status,
+          accepted_at, last_login_at, created_at, updated_at
+        )
+        SELECT ?6, ?2, ?4, ?5, '["owner"]', 'active', ?3, ?3, ?3, ?3
+        WHERE ${tokenPredicate}
+      `).bind(setupId, email, timestamp, displayName, avatarUrl, userId);
+  const auditId = crypto.randomUUID();
+  const results = await db.batch([
+    userStatement,
+    db.prepare(`
+      INSERT INTO audit_events (
+        id, idempotency_key, action, actor_type, actor_id,
+        target_type, target_id, details_json, created_at
+      )
+      SELECT ?4, ?4, 'operator.owner_bootstrap', 'system', ?1,
+        'operator_user', ?5, ?6, ?3
+      FROM owner_setup_tokens
+      WHERE id = ?1 AND email = ?2 AND purpose = 'bootstrap'
+        AND status = 'pending' AND expires_at > ?3
+    `).bind(setupId, email, timestamp, auditId, userId, canonicalJson({ email, method: "one_time_setup" })),
+    db.prepare(`
+      UPDATE owner_setup_tokens
+      SET status = 'consumed', consumed_at = ?3
+      WHERE id = ?1 AND email = ?2 AND purpose = 'bootstrap'
+        AND status = 'pending' AND expires_at > ?3
+    `).bind(setupId, email, timestamp),
+  ]);
+  if (!results[0]?.meta.changes || !results[2]?.meta.changes) return null;
+  const user = await db.prepare(`SELECT * FROM operator_users WHERE id = ?1 LIMIT 1`)
+    .bind(userId).first<OperatorUserRow>();
+  return user ? operatorSession(user, undefined, "better_auth") : null;
+}
+
+export async function recoverOwnerWithSetup(
+  db: D1Database,
+  setupId: string,
+  emailValue: string,
+): Promise<IssuedOperatorSession | null> {
+  const email = cleanEmail(emailValue);
+  const timestamp = new Date().toISOString();
+  const user = await db.prepare(`
+    SELECT * FROM operator_users
+    WHERE email = ?1 AND status = 'active' AND roles_json LIKE '%"owner"%'
+    LIMIT 1
+  `).bind(email).first<OperatorUserRow>();
+  if (!user) return null;
+  const expiresAt = new Date(Date.parse(timestamp) + SESSION_HOURS * 3_600_000).toISOString();
+  const sessionToken = randomToken();
+  const csrfToken = randomToken();
+  const sessionId = crypto.randomUUID();
+  const auditId = crypto.randomUUID();
+  const results = await db.batch([
+    db.prepare(`
+      INSERT INTO infrastructure_owner_sessions (
+        id, user_id, token_hash, csrf_hash, expires_at, last_seen_at, created_at
+      )
+      SELECT ?4, ?5, ?6, ?7, ?8, ?3, ?3
+      FROM owner_setup_tokens
+      WHERE id = ?1 AND email = ?2 AND purpose = 'recovery'
+        AND status = 'pending' AND expires_at > ?3
+    `).bind(
+      setupId, email, timestamp, sessionId, user.id,
+      await sha256(sessionToken), await sha256(csrfToken), expiresAt,
+    ),
+    db.prepare(`
+      INSERT INTO audit_events (
+        id, idempotency_key, action, actor_type, actor_id,
+        target_type, target_id, details_json, created_at
+      )
+      SELECT ?4, ?4, 'operator.owner_recovered', 'system', ?1,
+        'operator_user', ?5, ?6, ?3
+      FROM owner_setup_tokens
+      WHERE id = ?1 AND email = ?2 AND purpose = 'recovery'
+        AND status = 'pending' AND expires_at > ?3
+    `).bind(setupId, email, timestamp, auditId, user.id, canonicalJson({ email, method: "one_time_setup" })),
+    db.prepare(`
+      UPDATE owner_setup_tokens
+      SET status = 'consumed', consumed_at = ?3
+      WHERE id = ?1 AND email = ?2 AND purpose = 'recovery'
+        AND status = 'pending' AND expires_at > ?3
+    `).bind(setupId, email, timestamp),
+  ]);
+  if (!results[0]?.meta.changes || !results[2]?.meta.changes) return null;
+  return {
+    session: operatorSession(user, await operatorAuthorization(db, user), "owner_setup"),
+    sessionToken,
+    csrfToken,
+    expiresAt,
+  };
 }
 
 function auditEvent(

package/template/src/report-types.ts

@@ -65,7 +65,7 @@ export interface OperatorPermissions {
 
 export interface OperatorSession {
   actor: { type: "cloudflare_access" | "admin_key" | "operator_user"; id: string };
-  authMethod: "cloudflare_access" | "admin_key" | "better_auth";
+  authMethod: "cloudflare_access" | "owner_setup" | "admin_key" | "better_auth";
   verified: boolean;
   displayName: string;
   email?: string;

package/template/worker-configuration.d.ts

@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types --env-file=config/dev.vars.example --include-runtime=false --strict-vars=false` (hash: 4f5ea689965d3fb5059f8a820ffef604)
+// Generated by Wrangler by running `wrangler types --env-file=config/dev.vars.example --include-runtime=false --strict-vars=false` (hash: 2cca359aa7fa3dcf738a197c47478066)
 interface __BaseEnv_Env {
 	PROFILE_MEDIA: R2Bucket;
 	WORKFLOW_ARTIFACTS: R2Bucket;
@@ -34,8 +34,6 @@ interface __BaseEnv_Env {
 	CREDENTIAL_ENCRYPTION_KEY: string;
 	RATE_LIMIT_PEPPER: string;
 	INTEGRATION_API_KEYS_JSON: string;
-	ACCESS_AUD: string;
-	INFRASTRUCTURE_OWNER_EMAILS: string;
 	TURNSTILE_SITE_KEY: string;
 	TURNSTILE_SECRET_KEY: string;
 	ACTION_WEBHOOK_URL: string;
@@ -61,5 +59,5 @@ type StringifyValues<EnvType extends Record<string, unknown>> = {
 	[Binding in keyof EnvType]: EnvType[Binding] extends string ? EnvType[Binding] : string;
 };
 declare namespace NodeJS {
-	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "PUBLIC_BASE_URL" | "ALLOWED_ORIGINS" | "CONTEXT_TOKEN_TTL_SECONDS" | "CLAIM_TTL_MINUTES" | "REPORT_RETENTION_DAYS" | "MESSAGE_RETENTION_DAYS" | "APPEAL_WINDOW_DAYS" | "ALLOWED_ACTION_CODES" | "OPERATIONS_DLQ_NAME" | "PUBLIC_INTEGRATION_ID" | "PUBLIC_REPORT_LIMIT_PER_10_MINUTES" | "PUBLIC_REPORT_SURGE_PER_5_MINUTES" | "OPERATOR_NOTIFICATION_WEBHOOK_URL" | "EMAIL_FROM_ADDRESS" | "EMAIL_SUBJECT_PREFIX" | "ADMIN_API_KEY" | "BETTER_AUTH_SECRET" | "AUTH_EMAIL_FROM" | "CONTEXT_SIGNING_SECRET" | "CREDENTIAL_ENCRYPTION_KEY" | "RATE_LIMIT_PEPPER" | "INTEGRATION_API_KEYS_JSON" | "ACCESS_AUD" | "INFRASTRUCTURE_OWNER_EMAILS" | "TURNSTILE_SITE_KEY" | "TURNSTILE_SECRET_KEY" | "ACTION_WEBHOOK_URL" | "ACTION_WEBHOOK_SECRET" | "NOTIFICATION_WEBHOOK_URL" | "NOTIFICATION_WEBHOOK_SECRET" | "OPERATOR_NOTIFICATION_WEBHOOK_SECRET" | "EXAMPLE_ENRICHMENT_SECRET" | "AI_LOCAL_FIXTURE_ENABLED" | "AI_LOCAL_FIXTURE_JSON">> {}
+	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "PUBLIC_BASE_URL" | "ALLOWED_ORIGINS" | "CONTEXT_TOKEN_TTL_SECONDS" | "CLAIM_TTL_MINUTES" | "REPORT_RETENTION_DAYS" | "MESSAGE_RETENTION_DAYS" | "APPEAL_WINDOW_DAYS" | "ALLOWED_ACTION_CODES" | "OPERATIONS_DLQ_NAME" | "PUBLIC_INTEGRATION_ID" | "PUBLIC_REPORT_LIMIT_PER_10_MINUTES" | "PUBLIC_REPORT_SURGE_PER_5_MINUTES" | "OPERATOR_NOTIFICATION_WEBHOOK_URL" | "EMAIL_FROM_ADDRESS" | "EMAIL_SUBJECT_PREFIX" | "ADMIN_API_KEY" | "BETTER_AUTH_SECRET" | "AUTH_EMAIL_FROM" | "CONTEXT_SIGNING_SECRET" | "CREDENTIAL_ENCRYPTION_KEY" | "RATE_LIMIT_PEPPER" | "INTEGRATION_API_KEYS_JSON" | "TURNSTILE_SITE_KEY" | "TURNSTILE_SECRET_KEY" | "ACTION_WEBHOOK_URL" | "ACTION_WEBHOOK_SECRET" | "NOTIFICATION_WEBHOOK_URL" | "NOTIFICATION_WEBHOOK_SECRET" | "OPERATOR_NOTIFICATION_WEBHOOK_SECRET" | "EXAMPLE_ENRICHMENT_SECRET" | "AI_LOCAL_FIXTURE_ENABLED" | "AI_LOCAL_FIXTURE_JSON">> {}
 }