create-safest-tools 0.3.0 → 0.3.1

package/README.md

@@ -48,6 +48,8 @@ npm run setup
 
 After deployment, setup prints a 256-bit, single-use owner link that expires after 15 minutes. The raw token stays in the URL fragment, D1 stores only its digest, and the installer never writes it to disk. Open it to create the Safest owner account. If it expires, run `npm run owner:setup`. For later break-glass recovery, authenticate Wrangler and run `npm run owner:recover`.
 
+Custom-domain installations disable both the Worker’s `workers.dev` route and version preview URLs. A `workers.dev` public URL is available only when explicitly supplied as the installation URL.
+
 The owner then invites administrators, and administrators invite analysts. All users sign in with Safest accounts and do not need Cloudflare accounts.
 
 Invited users may join with a password or any configured OAuth provider, then choose a natural display name and optional JPEG, PNG, or WebP profile picture up to 2 MB. Better Auth stores credentials, OAuth accounts, sessions, verification state, and one-time password-reset tokens in D1. Cloudflare Email Service sends invitations, verification links, and 30-minute password-reset links.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-safest-tools",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Create customer-owned abuse-reporting infrastructure on Cloudflare",
   "type": "module",
   "license": "Apache-2.0",

package/src/config.mjs

@@ -69,14 +69,15 @@ export function buildConfiguration(options) {
 
 export function buildWranglerConfiguration(config) {
   const publicHostname = new URL(config.publicBaseUrl).hostname.toLowerCase();
+  const usesWorkersDev = publicHostname.endsWith(".workers.dev");
   const wrangler = {
     $schema: "node_modules/wrangler/config-schema.json",
     name: config.resources.workerName,
     main: "src/index.ts",
     compatibility_date: "2026-08-28",
     compatibility_flags: ["nodejs_compat"],
-    workers_dev: true,
-    preview_urls: true,
+    workers_dev: usesWorkersDev,
+    preview_urls: false,
     observability: { enabled: true },
     ai: { binding: "AI", remote: true },
     assets: { directory: "public", binding: "ASSETS", run_worker_first: true },
@@ -131,7 +132,7 @@ export function buildWranglerConfiguration(config) {
     },
     triggers: { crons: ["*/5 * * * *"] },
   };
-  if (!publicHostname.endsWith(".workers.dev")) {
+  if (!usesWorkersDev) {
     wrangler.routes = [{ pattern: publicHostname, custom_domain: true }];
   }
   wrangler.send_email = [{ name: "EMAIL" }];

package/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safest-resolve-installation",
-  "version": "0.3.0",
-  "safestToolsVersion": "0.3.0-resolve",
+  "version": "0.3.1",
+  "safestToolsVersion": "0.3.1-resolve",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/scripts/reports-owner-setup.mjs

@@ -13,11 +13,18 @@ function sqlLiteral(value) {
   return `'${String(value).replaceAll("'", "''")}'`;
 }
 
+export function ownerSetupWranglerEnvironment(env = process.env) {
+  return { ...env, WRANGLER_LOG: "log", WRANGLER_WRITE_LOGS: "false" };
+}
+
 function runWrangler(args) {
   return new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [wrangler, ...args], {
       cwd: projectRoot,
-      env: { ...process.env, WRANGLER_LOG: "none", WRANGLER_WRITE_LOGS: "false" },
+      // Wrangler 4.127 emits `d1 execute --json` through its logger. Keep log
+      // output in the captured pipe while preventing the OAuth-backed response
+      // from being persisted to Wrangler's log directory.
+      env: ownerSetupWranglerEnvironment(),
       stdio: ["ignore", "pipe", "pipe"],
     });
     let stdout = "";
@@ -82,18 +89,26 @@ RETURNING id, email, purpose, expires_at;
 `.trim();
 }
 
-function executionRows(stdout) {
-  let parsed;
-  try { parsed = JSON.parse(stdout.trim()); } catch { throw new Error("Wrangler returned unreadable D1 JSON while creating the owner setup token"); }
-  const results = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.result) ? parsed.result : [parsed];
-  return results.flatMap((entry) => Array.isArray(entry?.results) ? entry.results : []);
+export function ownerSetupExecutionRows(output) {
+  const candidates = typeof output === "string" ? [output] : [output?.stdout, output?.stderr];
+  for (const candidate of candidates) {
+    if (typeof candidate !== "string" || !candidate.trim()) continue;
+    try {
+      const parsed = JSON.parse(candidate.trim());
+      const results = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.result) ? parsed.result : [parsed];
+      return results.flatMap((entry) => Array.isArray(entry?.results) ? entry.results : []);
+    } catch {
+      // Try the other captured stream before reporting incompatible output.
+    }
+  }
+  throw new Error("Wrangler returned unreadable D1 JSON while creating the owner setup token");
 }
 
 export async function issueOwnerSetup({ config, email, purpose = "bootstrap", runner = runWrangler, now, token, id } = {}) {
   if (!config?.publicBaseUrl || !config?.owner?.email) throw new Error("owner setup requires a parsed Safest Resolve configuration");
   const record = createOwnerSetupRecord({ email: email || config.owner.email, purpose, now, token, id });
   const result = await runner(["d1", "execute", "DB", "--remote", "--command", ownerSetupSql(record), "--json", "--yes"]);
-  const created = executionRows(result.stdout).find((row) => row?.id === record.id);
+  const created = ownerSetupExecutionRows(result).find((row) => row?.id === record.id);
   if (!created) {
     throw new Error(purpose === "bootstrap"
       ? "An active infrastructure owner already exists. Use `npm run owner:recover` for break-glass access."