create-safest-tools 0.3.0 → 0.4.0

package/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safest-resolve-installation",
-  "version": "0.3.0",
-  "safestToolsVersion": "0.3.0-resolve",
+  "version": "0.4.0",
+  "safestToolsVersion": "0.4.0-resolve",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
@@ -13,7 +13,8 @@
     "setup:plan": "node scripts/reports-deploy.mjs --plan",
     "owner:setup": "node scripts/reports-owner-setup.mjs",
     "owner:recover": "node scripts/reports-owner-setup.mjs --recover",
-    "upgrade": "npm run backup && npm run build:console && node scripts/reports-deploy.mjs --upgrade",
+    "upgrade": "npm run backup && npm run upgrade:deploy",
+    "upgrade:deploy": "npm run build:console && node scripts/reports-deploy.mjs --upgrade",
     "upgrade:plan": "node scripts/reports-deploy.mjs --upgrade --plan",
     "backup": "node scripts/reports-backup.mjs",
     "backup:plan": "node scripts/reports-backup.mjs --plan",

package/template/public/console/auth-shell.js

@@ -17705,11 +17705,11 @@ function Aj({ session: l, currentView: r, reportCount: c, open: u, onClose: d })
   const m = (0, v.useMemo)(() => L0(l), [l]), S = (p, x) => {
     p.preventDefault(), tn(x), d();
   };
-  return /* @__PURE__ */ (0, n.jsxs)(n.Fragment, { children: [/* @__PURE__ */ (0, n.jsxs)("aside", {
+  return /* @__PURE__ */ (0, n.jsxs)(n.Fragment, { children: [/* @__PURE__ */ (0, n.jsx)("aside", {
     id: "workspace-navigation",
     className: `sidebar${u ? " open" : ""}`,
     "aria-label": "Workspace navigation",
-    children: [/* @__PURE__ */ (0, n.jsx)("nav", { children: m.map((p) => /* @__PURE__ */ (0, n.jsxs)(v.Fragment, { children: [/* @__PURE__ */ (0, n.jsx)("small", { children: p.label }), p.items.map((x) => /* @__PURE__ */ (0, n.jsxs)("a", {
+    children: /* @__PURE__ */ (0, n.jsx)("nav", { children: m.map((p) => /* @__PURE__ */ (0, n.jsxs)(v.Fragment, { children: [/* @__PURE__ */ (0, n.jsx)("small", { children: p.label }), p.items.map((x) => /* @__PURE__ */ (0, n.jsxs)("a", {
       className: x.view === r ? "active" : void 0,
       "data-nav": x.view,
       href: `#${x.view}`,
@@ -17727,13 +17727,7 @@ function Aj({ session: l, currentView: r, reportCount: c, open: u, onClose: d })
           children: c
         }) : null
       ]
-    }, x.view))] }, p.label)) }), /* @__PURE__ */ (0, n.jsxs)("div", {
-      className: "principle",
-      children: [/* @__PURE__ */ (0, n.jsx)("span", {
-        className: "principle-dot",
-        "aria-hidden": "true"
-      }), /* @__PURE__ */ (0, n.jsxs)("div", { children: [/* @__PURE__ */ (0, n.jsx)("strong", { children: "Customer-owned records" }), /* @__PURE__ */ (0, n.jsx)("p", { children: "Reports and decisions stay in this deployment." })] })]
-    })]
+    }, x.view))] }, p.label)) })
   }), /* @__PURE__ */ (0, n.jsx)("button", {
     className: "nav-scrim",
     type: "button",

package/template/public/styles.css

@@ -123,9 +123,6 @@ input:focus, select:focus { border-color: #68a380; box-shadow: 0 0 0 3px rgba(34
 .presence-dot.online { background: #55a271; }
 .presence-dot.viewing { background: #4d83a0; }
 .presence-dot.editing { background: #cf8a38; box-shadow: 0 0 0 3px rgba(207,138,56,.13); }
-.principle { margin-top: auto; padding: 14px; border-radius: 10px; color: #496054; background: #edf6f0; }
-.principle strong { font-size: 10px; }
-.principle p { margin: 7px 0 0; font-size: 9px; line-height: 1.5; }
 .content { min-width: 0; padding: clamp(25px, 4vw, 48px); }
 .page-head { max-width: 1400px; margin: 0 auto 24px; display: flex; justify-content: space-between; align-items: flex-start; gap: 16px; }
 .page-head p:last-child { margin: 0; color: var(--muted); font-size: 12px; }
@@ -327,7 +324,6 @@ td small { margin-top: 3px; color: var(--muted); }
   .workspace { grid-template-columns: 1fr; }
   .sidebar { position: static; width: auto; height: auto; border-right: 0; border-bottom: 1px solid var(--line); }
   .sidebar nav { grid-template-columns: 1fr 1fr; }
-  .principle { display: none; }
   .metrics { grid-template-columns: 1fr 1fr; }
   .operation-metrics { grid-template-columns: 1fr 1fr; }
   .analytics-metrics { grid-template-columns: 1fr 1fr; }
@@ -388,8 +384,6 @@ td small { margin-top: 3px; color: var(--muted); }
 .sidebar nav a { min-height: 36px; color: #bdd0c8; font-size: 10px; }
 .sidebar nav a:hover { color: white; background: rgba(255,255,255,.07); }
 .sidebar nav a.active { color: #123b2b; background: #dafa72; box-shadow: 0 7px 18px rgba(0,0,0,.12); }
-.principle { color: #bcd2c8; background: rgba(255,255,255,.06); }
-.principle strong { color: white; }
 .content { min-width: 0; padding: 0; transition: margin-right .2s ease; }
 .queue-view { min-height: calc(100vh - 66px); }
 .page-head { max-width: none; min-height: 78px; margin: 0; padding: 15px 22px; align-items: center; border-bottom: 1px solid #dedfd8; background: #fbfaf7; }
@@ -498,7 +492,7 @@ body.report-open .content { margin-right: 408px; }
 @media (max-width: 900px) {
   .workspace { width: 100%; min-width: 0; grid-template-columns: minmax(0, 1fr); overflow-x: clip; }
   .sidebar { position: static; width: 100%; min-width: 0; max-width: 100vw; height: auto; padding: 10px; overflow: hidden; }
-  .sidebar .workspace-card, .sidebar .principle { display: none; }
+  .sidebar .workspace-card { display: none; }
   .sidebar nav { width: 100%; min-width: 0; max-width: 100%; margin: 0; display: flex; overflow-x: auto; overscroll-behavior-x: contain; }
   .sidebar nav, .active-analyst-list { scrollbar-width: none; }
   .sidebar nav::-webkit-scrollbar, .active-analyst-list::-webkit-scrollbar { display: none; }
@@ -862,10 +856,6 @@ body.report-open .content { margin-right: 0; }
 .sidebar nav a.active { color: #102f24; background: var(--safest-lime-400); box-shadow: none; font-weight: 750; }
 .sidebar .nav-count { min-width: 22px; margin-left: 0; color: #dceae3; background: rgba(255,255,255,.10); font-size: 9px; }
 .sidebar nav a.active .nav-count { color: white; background: var(--forest-dark); }
-.principle { margin-top: auto; padding: 12px 10px; display: flex; align-items: flex-start; gap: 9px; color: #8eb0a2; background: rgba(255,255,255,.055); }
-.principle-dot { width: 8px; height: 8px; margin-top: 3px; flex: 0 0 8px; border-radius: 50%; background: #55b27b; box-shadow: 0 0 0 5px rgba(85,178,123,.12); }
-.principle strong { display: block; color: #eef6f1; font-size: 11px; }
-.principle p { margin-top: 3px; color: #8eb0a2; font-size: 10px; line-height: 1.45; }
 
 .content { background: var(--canvas); }
 .command-view { max-width: 1184px; margin: 0 auto; padding: 28px; }
@@ -947,9 +937,8 @@ body.report-open .content { margin-right: 0; }
   .topbar { grid-template-columns: 190px minmax(210px, 1fr) auto; }
   .top-workspace { display: none; }
   .sidebar { padding-inline: 10px; }
-  .sidebar nav > small, .sidebar nav a span, .sidebar nav a b, .principle div { display: none; }
+  .sidebar nav > small, .sidebar nav a span, .sidebar nav a b { display: none; }
   .sidebar nav a { grid-template-columns: 1fr; justify-items: center; padding-inline: 0; }
-  .principle { justify-content: center; }
   .command-grid { grid-template-columns: 1fr; }
   .queue-load-list { grid-template-columns: 1fr 1fr; }
 }
@@ -969,8 +958,6 @@ body.report-open .content { margin-right: 0; }
   .sidebar nav a { min-width: 0; display: grid; grid-template-columns: 20px minmax(0, 1fr) auto; justify-items: stretch; padding: 0 10px; }
   .sidebar nav a span { display: block; white-space: normal; }
   .sidebar nav a b { display: inline-block; }
-  .principle { display: flex; }
-  .principle div { display: block; }
   .nav-scrim { position: fixed; z-index: 65; inset: var(--product-topbar) 0 0; width: 100%; height: auto; display: block; border: 0; border-radius: 0; background: rgba(5,28,20,.33); backdrop-filter: blur(1px); }
   .nav-scrim[hidden] { display: none; }
   .content { padding: 0; }

package/template/scripts/reports-owner-setup.mjs

@@ -13,11 +13,18 @@ function sqlLiteral(value) {
   return `'${String(value).replaceAll("'", "''")}'`;
 }
 
+export function ownerSetupWranglerEnvironment(env = process.env) {
+  return { ...env, WRANGLER_LOG: "log", WRANGLER_WRITE_LOGS: "false" };
+}
+
 function runWrangler(args) {
   return new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [wrangler, ...args], {
       cwd: projectRoot,
-      env: { ...process.env, WRANGLER_LOG: "none", WRANGLER_WRITE_LOGS: "false" },
+      // Wrangler 4.127 emits `d1 execute --json` through its logger. Keep log
+      // output in the captured pipe while preventing the OAuth-backed response
+      // from being persisted to Wrangler's log directory.
+      env: ownerSetupWranglerEnvironment(),
       stdio: ["ignore", "pipe", "pipe"],
     });
     let stdout = "";
@@ -82,18 +89,26 @@ RETURNING id, email, purpose, expires_at;
 `.trim();
 }
 
-function executionRows(stdout) {
-  let parsed;
-  try { parsed = JSON.parse(stdout.trim()); } catch { throw new Error("Wrangler returned unreadable D1 JSON while creating the owner setup token"); }
-  const results = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.result) ? parsed.result : [parsed];
-  return results.flatMap((entry) => Array.isArray(entry?.results) ? entry.results : []);
+export function ownerSetupExecutionRows(output) {
+  const candidates = typeof output === "string" ? [output] : [output?.stdout, output?.stderr];
+  for (const candidate of candidates) {
+    if (typeof candidate !== "string" || !candidate.trim()) continue;
+    try {
+      const parsed = JSON.parse(candidate.trim());
+      const results = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.result) ? parsed.result : [parsed];
+      return results.flatMap((entry) => Array.isArray(entry?.results) ? entry.results : []);
+    } catch {
+      // Try the other captured stream before reporting incompatible output.
+    }
+  }
+  throw new Error("Wrangler returned unreadable D1 JSON while creating the owner setup token");
 }
 
 export async function issueOwnerSetup({ config, email, purpose = "bootstrap", runner = runWrangler, now, token, id } = {}) {
   if (!config?.publicBaseUrl || !config?.owner?.email) throw new Error("owner setup requires a parsed Safest Resolve configuration");
   const record = createOwnerSetupRecord({ email: email || config.owner.email, purpose, now, token, id });
   const result = await runner(["d1", "execute", "DB", "--remote", "--command", ownerSetupSql(record), "--json", "--yes"]);
-  const created = executionRows(result.stdout).find((row) => row?.id === record.id);
+  const created = ownerSetupExecutionRows(result).find((row) => row?.id === record.id);
   if (!created) {
     throw new Error(purpose === "bootstrap"
       ? "An active infrastructure owner already exists. Use `npm run owner:recover` for break-glass access."

package/template/scripts/reports-plan.mjs

@@ -178,7 +178,7 @@ export function buildReportsPlan(config) {
       "Onboard the sender domain to Cloudflare Email Service before deployment.",
       "Initialize local secrets without committing them.",
       "Create D1, four private R2 buckets, and the three Queues in the customer account.",
-      "Apply all report migrations before accepting traffic.",
+      "Apply the D1 schema baseline and any later forward-only migrations before accepting traffic.",
       `Deploy the Worker, assets, Worker Loader, Dynamic Workflow, presence Durable Object, Queue consumers, cron, Workers AI binding${customDomain ? `, and ${customDomain} Custom Domain` : ""}.`,
       "Open the generated one-time owner setup link, create the owner account, verify required setup features and authenticated /ready, invite an administrator and analyst, then verify report intake, routing, and delivery recovery.",
     ],

package/template/migrations/0001_reports_foundation.sql

@@ -1,444 +0,0 @@
-PRAGMA foreign_keys = ON;
-
-CREATE TABLE installations (
-  id TEXT PRIMARY KEY,
-  display_name TEXT NOT NULL,
-  default_locale TEXT NOT NULL DEFAULT 'en',
-  anonymous_reporting_enabled INTEGER NOT NULL DEFAULT 0 CHECK (anonymous_reporting_enabled IN (0, 1)),
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL
-);
-
-CREATE TABLE application_integrations (
-  id TEXT PRIMARY KEY,
-  installation_id TEXT NOT NULL REFERENCES installations(id),
-  name TEXT NOT NULL,
-  key_id TEXT NOT NULL UNIQUE,
-  allowed_origins_json TEXT NOT NULL DEFAULT '[]',
-  enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL
-);
-
-CREATE TABLE report_form_versions (
-  id TEXT PRIMARY KEY,
-  installation_id TEXT NOT NULL REFERENCES installations(id),
-  form_key TEXT NOT NULL,
-  version INTEGER NOT NULL CHECK (version > 0),
-  title TEXT NOT NULL,
-  description TEXT NOT NULL DEFAULT '',
-  target_types_json TEXT NOT NULL,
-  reasons_json TEXT NOT NULL,
-  fields_json TEXT NOT NULL,
-  consent_notice TEXT NOT NULL,
-  published_at TEXT,
-  retired_at TEXT,
-  created_by TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  UNIQUE (installation_id, form_key, version)
-);
-
-CREATE TABLE policy_versions (
-  id TEXT PRIMARY KEY,
-  installation_id TEXT NOT NULL REFERENCES installations(id),
-  policy_key TEXT NOT NULL,
-  version INTEGER NOT NULL CHECK (version > 0),
-  title TEXT NOT NULL,
-  rules_json TEXT NOT NULL,
-  published_at TEXT,
-  created_by TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  UNIQUE (installation_id, policy_key, version)
-);
-
-CREATE TABLE queue_definitions (
-  id TEXT PRIMARY KEY,
-  installation_id TEXT NOT NULL REFERENCES installations(id),
-  queue_key TEXT NOT NULL,
-  name TEXT NOT NULL,
-  queue_kind TEXT NOT NULL CHECK (queue_kind IN ('human', 'ai', 'appeal', 'operations')),
-  enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL,
-  UNIQUE (installation_id, queue_key)
-);
-
-CREATE TABLE queue_versions (
-  id TEXT PRIMARY KEY,
-  queue_id TEXT NOT NULL REFERENCES queue_definitions(id),
-  version INTEGER NOT NULL CHECK (version > 0),
-  mode TEXT NOT NULL CHECK (mode IN ('off', 'shadow', 'assist', 'autonomous_low_priority')),
-  priority INTEGER NOT NULL DEFAULT 50 CHECK (priority BETWEEN 0 AND 100),
-  response_sla_minutes INTEGER,
-  resolution_sla_minutes INTEGER,
-  claim_ttl_minutes INTEGER NOT NULL DEFAULT 15 CHECK (claim_ttl_minutes BETWEEN 1 AND 1440),
-  fallback_queue_id TEXT REFERENCES queue_definitions(id),
-  configuration_json TEXT NOT NULL DEFAULT '{}',
-  published_at TEXT,
-  created_by TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  UNIQUE (queue_id, version)
-);
-
-CREATE TABLE routing_rule_versions (
-  id TEXT PRIMARY KEY,
-  installation_id TEXT NOT NULL REFERENCES installations(id),
-  version INTEGER NOT NULL CHECK (version > 0),
-  rules_json TEXT NOT NULL,
-  fixture_results_json TEXT NOT NULL,
-  published_at TEXT,
-  created_by TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  UNIQUE (installation_id, version)
-);
-
-CREATE TABLE reports (
-  id TEXT PRIMARY KEY,
-  public_reference TEXT NOT NULL UNIQUE,
-  installation_id TEXT NOT NULL REFERENCES installations(id),
-  integration_id TEXT NOT NULL REFERENCES application_integrations(id),
-  idempotency_key TEXT NOT NULL,
-  source TEXT NOT NULL CHECK (source IN ('signed_widget', 'public_page', 'server_api')),
-  form_version_id TEXT REFERENCES report_form_versions(id),
-  policy_version_id TEXT REFERENCES policy_versions(id),
-  routing_rule_version_id TEXT REFERENCES routing_rule_versions(id),
-  queue_id TEXT REFERENCES queue_definitions(id),
-  state TEXT NOT NULL CHECK (state IN (
-    'received', 'human_review', 'ai_review', 'awaiting_reporter', 'resolved_by_human',
-    'resolved_by_ai', 'human_review_requested', 'appealed', 'closed'
-  )),
-  priority INTEGER NOT NULL DEFAULT 50 CHECK (priority BETWEEN 0 AND 100),
-  reason_code TEXT NOT NULL,
-  locale TEXT NOT NULL,
-  consent_notice TEXT NOT NULL,
-  consented_at TEXT NOT NULL,
-  submitted_at TEXT NOT NULL,
-  received_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL,
-  due_at TEXT,
-  resolved_at TEXT,
-  routing_status TEXT NOT NULL DEFAULT 'pending' CHECK (routing_status IN ('pending', 'enqueued', 'processing', 'complete', 'failed')),
-  routing_attempts INTEGER NOT NULL DEFAULT 0 CHECK (routing_attempts >= 0),
-  routing_error_code TEXT,
-  UNIQUE (integration_id, idempotency_key)
-);
-
-CREATE INDEX reports_queue_state_priority_idx
-  ON reports(queue_id, state, priority DESC, received_at ASC, id ASC);
-CREATE INDEX reports_routing_status_idx
-  ON reports(routing_status, received_at ASC, id ASC);
-CREATE INDEX reports_target_time_idx
-  ON reports(installation_id, received_at DESC, id DESC);
-
-CREATE TABLE report_participants (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
-  audience TEXT NOT NULL CHECK (audience IN ('reporter', 'affected_user')),
-  reference TEXT,
-  contact_mode TEXT NOT NULL CHECK (contact_mode IN ('portal', 'customer_notification', 'none')),
-  contact_ciphertext TEXT,
-  created_at TEXT NOT NULL,
-  UNIQUE (report_id, audience)
-);
-
-CREATE TABLE report_targets (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
-  target_type TEXT NOT NULL,
-  target_reference TEXT NOT NULL,
-  owner_reference TEXT,
-  customer_url TEXT,
-  signed_facts_json TEXT NOT NULL DEFAULT '{}',
-  created_at TEXT NOT NULL,
-  UNIQUE (report_id, target_type, target_reference)
-);
-
-CREATE INDEX report_targets_reference_idx
-  ON report_targets(target_type, target_reference, report_id);
-
-CREATE TABLE report_answers (
-  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
-  field_key TEXT NOT NULL,
-  value_json TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  PRIMARY KEY (report_id, field_key)
-);
-
-CREATE TABLE evidence_references (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
-  evidence_kind TEXT NOT NULL CHECK (evidence_kind IN ('allegation', 'signed_fact', 'customer_reference', 'fetched_record', 'snapshot')),
-  reference TEXT NOT NULL,
-  availability TEXT NOT NULL DEFAULT 'available' CHECK (availability IN ('available', 'unavailable', 'deleted', 'changed')),
-  retention_class TEXT NOT NULL DEFAULT 'reference',
-  created_at TEXT NOT NULL,
-  UNIQUE (report_id, evidence_kind, reference)
-);
-
-CREATE TABLE report_state_history (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
-  background_job_id TEXT UNIQUE REFERENCES background_jobs(id),
-  from_state TEXT,
-  to_state TEXT NOT NULL,
-  reason_code TEXT NOT NULL,
-  actor_type TEXT NOT NULL,
-  actor_id TEXT NOT NULL,
-  created_at TEXT NOT NULL
-);
-
-CREATE INDEX report_state_history_report_idx
-  ON report_state_history(report_id, created_at ASC, id ASC);
-
-CREATE TABLE portal_sessions (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
-  audience TEXT NOT NULL CHECK (audience IN ('reporter', 'affected_user')),
-  token_hash TEXT NOT NULL UNIQUE,
-  expires_at TEXT NOT NULL,
-  revoked_at TEXT,
-  created_at TEXT NOT NULL,
-  last_used_at TEXT
-);
-
-CREATE INDEX portal_sessions_report_idx ON portal_sessions(report_id, audience, expires_at);
-
-CREATE TABLE context_token_uses (
-  jti TEXT PRIMARY KEY,
-  integration_id TEXT NOT NULL REFERENCES application_integrations(id),
-  report_id TEXT NOT NULL UNIQUE REFERENCES reports(id) ON DELETE CASCADE,
-  used_at TEXT NOT NULL
-);
-
-CREATE TABLE case_messages (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
-  audience TEXT NOT NULL CHECK (audience IN ('internal', 'reporter', 'affected_user')),
-  direction TEXT NOT NULL CHECK (direction IN ('inbound', 'outbound', 'internal')),
-  sender_type TEXT NOT NULL CHECK (sender_type IN ('reporter', 'affected_user', 'human', 'ai', 'system')),
-  sender_id TEXT NOT NULL,
-  body TEXT NOT NULL,
-  template_version_id TEXT,
-  automated INTEGER NOT NULL DEFAULT 0 CHECK (automated IN (0, 1)),
-  delivery_state TEXT NOT NULL DEFAULT 'not_required' CHECK (delivery_state IN ('not_required', 'queued', 'delivered', 'failed', 'suppressed')),
-  created_at TEXT NOT NULL
-);
-
-CREATE INDEX case_messages_report_audience_idx
-  ON case_messages(report_id, audience, created_at ASC, id ASC);
-
-CREATE TABLE review_claims (
-  report_id TEXT PRIMARY KEY REFERENCES reports(id) ON DELETE CASCADE,
-  reviewer_id TEXT NOT NULL,
-  claimed_at TEXT NOT NULL,
-  expires_at TEXT NOT NULL,
-  version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0)
-);
-
-CREATE TABLE decisions (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id),
-  decision_code TEXT NOT NULL,
-  policy_version_id TEXT NOT NULL REFERENCES policy_versions(id),
-  policy_code TEXT NOT NULL,
-  rationale TEXT NOT NULL,
-  evidence_references_json TEXT NOT NULL,
-  maker_type TEXT NOT NULL CHECK (maker_type IN ('human', 'ai')),
-  maker_id TEXT NOT NULL,
-  queue_version_id TEXT REFERENCES queue_versions(id),
-  ai_run_id TEXT,
-  proposed_action_code TEXT,
-  supersedes_decision_id TEXT REFERENCES decisions(id),
-  created_at TEXT NOT NULL
-);
-
-CREATE INDEX decisions_report_idx ON decisions(report_id, created_at DESC, id DESC);
-
-CREATE TABLE notices (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id),
-  decision_id TEXT REFERENCES decisions(id),
-  audience TEXT NOT NULL CHECK (audience IN ('reporter', 'affected_user')),
-  template_version_id TEXT NOT NULL,
-  rendered_body TEXT NOT NULL,
-  delivery_state TEXT NOT NULL CHECK (delivery_state IN ('queued', 'delivered', 'failed', 'suppressed')),
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL
-);
-
-CREATE TABLE action_outbox (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id),
-  decision_id TEXT NOT NULL REFERENCES decisions(id),
-  idempotency_key TEXT NOT NULL UNIQUE,
-  action_code TEXT NOT NULL,
-  target_reference TEXT NOT NULL,
-  payload_json TEXT NOT NULL,
-  status TEXT NOT NULL CHECK (status IN ('pending', 'delivering', 'accepted', 'rejected', 'already_applied', 'failed')),
-  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
-  next_attempt_at TEXT NOT NULL,
-  last_error_code TEXT,
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL
-);
-
-CREATE INDEX action_outbox_due_idx ON action_outbox(status, next_attempt_at, id);
-
-CREATE TABLE action_attempts (
-  id TEXT PRIMARY KEY,
-  action_id TEXT NOT NULL REFERENCES action_outbox(id) ON DELETE CASCADE,
-  attempt_number INTEGER NOT NULL CHECK (attempt_number > 0),
-  response_class TEXT NOT NULL,
-  response_status INTEGER,
-  error_code TEXT,
-  started_at TEXT NOT NULL,
-  finished_at TEXT NOT NULL,
-  UNIQUE (action_id, attempt_number)
-);
-
-CREATE TABLE notification_outbox (
-  id TEXT PRIMARY KEY,
-  notice_id TEXT NOT NULL REFERENCES notices(id),
-  idempotency_key TEXT NOT NULL UNIQUE,
-  channel TEXT NOT NULL CHECK (channel IN ('customer_webhook', 'email')),
-  payload_json TEXT NOT NULL,
-  status TEXT NOT NULL CHECK (status IN ('pending', 'delivering', 'delivered', 'failed', 'suppressed')),
-  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
-  next_attempt_at TEXT NOT NULL,
-  last_error_code TEXT,
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL
-);
-
-CREATE INDEX notification_outbox_due_idx ON notification_outbox(status, next_attempt_at, id);
-
-CREATE TABLE notification_attempts (
-  id TEXT PRIMARY KEY,
-  notification_id TEXT NOT NULL REFERENCES notification_outbox(id) ON DELETE CASCADE,
-  attempt_number INTEGER NOT NULL CHECK (attempt_number > 0),
-  response_class TEXT NOT NULL,
-  response_status INTEGER,
-  error_code TEXT,
-  started_at TEXT NOT NULL,
-  finished_at TEXT NOT NULL,
-  UNIQUE (notification_id, attempt_number)
-);
-
-CREATE TABLE appeals (
-  id TEXT PRIMARY KEY,
-  report_id TEXT NOT NULL REFERENCES reports(id),
-  decision_id TEXT NOT NULL REFERENCES decisions(id),
-  appellant_audience TEXT NOT NULL CHECK (appellant_audience IN ('reporter', 'affected_user')),
-  reason TEXT NOT NULL,
-  state TEXT NOT NULL CHECK (state IN ('submitted', 'human_review', 'upheld', 'modified', 'reversed')),
-  queue_id TEXT NOT NULL REFERENCES queue_definitions(id),
-  submitted_at TEXT NOT NULL,
-  resolved_at TEXT,
-  UNIQUE (decision_id, appellant_audience)
-);
-
-CREATE INDEX appeals_queue_state_idx ON appeals(queue_id, state, submitted_at ASC, id ASC);
-
-CREATE TABLE appeal_decisions (
-  id TEXT PRIMARY KEY,
-  appeal_id TEXT NOT NULL UNIQUE REFERENCES appeals(id),
-  outcome TEXT NOT NULL CHECK (outcome IN ('upheld', 'modified', 'reversed')),
-  rationale TEXT NOT NULL,
-  reviewer_id TEXT NOT NULL,
-  corrective_action_id TEXT REFERENCES action_outbox(id),
-  created_at TEXT NOT NULL
-);
-
-CREATE TABLE background_jobs (
-  id TEXT PRIMARY KEY,
-  report_id TEXT REFERENCES reports(id),
-  job_type TEXT NOT NULL CHECK (job_type IN ('route_report', 'deliver_action', 'deliver_notification', 'resume_ai', 'retention')),
-  idempotency_key TEXT NOT NULL UNIQUE,
-  state TEXT NOT NULL CHECK (state IN ('pending', 'enqueued', 'processing', 'complete', 'failed', 'dead_letter')),
-  payload_json TEXT NOT NULL,
-  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
-  available_at TEXT NOT NULL,
-  last_error_code TEXT,
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL
-);
-
-CREATE INDEX background_jobs_reconcile_idx ON background_jobs(state, available_at, id);
-
-CREATE TABLE audit_entries (
-  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
-  id TEXT NOT NULL UNIQUE,
-  action TEXT NOT NULL,
-  actor_type TEXT NOT NULL,
-  actor_id TEXT NOT NULL,
-  target_type TEXT NOT NULL,
-  target_id TEXT NOT NULL,
-  details_json TEXT NOT NULL,
-  previous_hash TEXT NOT NULL UNIQUE,
-  entry_hash TEXT NOT NULL UNIQUE,
-  created_at TEXT NOT NULL
-);
-
-CREATE INDEX audit_entries_target_idx
-  ON audit_entries(target_type, target_id, sequence DESC);
-
-CREATE TABLE daily_aggregates (
-  aggregate_date TEXT NOT NULL,
-  metric_key TEXT NOT NULL,
-  dimension_key TEXT NOT NULL,
-  dimension_value TEXT NOT NULL,
-  value INTEGER NOT NULL DEFAULT 0,
-  updated_at TEXT NOT NULL,
-  PRIMARY KEY (aggregate_date, metric_key, dimension_key, dimension_value)
-);
-
-INSERT INTO installations (
-  id, display_name, default_locale, anonymous_reporting_enabled, created_at, updated_at
-) VALUES (
-  'default', 'Safest Resolve', 'en', 0, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-);
-
-INSERT INTO application_integrations (
-  id, installation_id, name, key_id, allowed_origins_json, enabled, created_at, updated_at
-) VALUES (
-  'default', 'default', 'Default integration', 'default', '["http://localhost:8787","http://localhost:8788"]', 1,
-  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-);
-
-INSERT INTO report_form_versions (
-  id, installation_id, form_key, version, title, description, target_types_json, reasons_json,
-  fields_json, consent_notice, published_at, created_by, created_at
-) VALUES (
-  'general-v1', 'default', 'general', 1, 'Report a safety concern',
-  'Tell the service owner about abuse or a safety concern.',
-  '["message","profile","listing","account","file","transaction","service"]',
-  '[{"code":"harassment","label":"Harassment"},{"code":"spam","label":"Spam or scam"},{"code":"threat","label":"Threat or immediate danger"},{"code":"other","label":"Something else"}]',
-  '[{"key":"details","label":"What happened?","type":"long_text","required":true,"max_length":4000}]',
-  'Your report will be shared with authorized safety reviewers and handled according to the service privacy policy.',
-  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-);
-
-INSERT INTO policy_versions (
-  id, installation_id, policy_key, version, title, rules_json, published_at, created_by, created_at
-) VALUES (
-  'general-policy-v1', 'default', 'general', 1, 'General safety policy',
-  '[{"code":"GENERAL-1","title":"Customer review required"}]',
-  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-);
-
-INSERT INTO queue_definitions (id, installation_id, queue_key, name, queue_kind, created_at, updated_at) VALUES
-  ('urgent-human', 'default', 'urgent-human', 'Urgent human', 'human', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  ('standard-human', 'default', 'standard-human', 'Standard human', 'human', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  ('low-priority-ai', 'default', 'low-priority-ai', 'Low-priority AI', 'ai', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  ('appeals', 'default', 'appeals', 'Appeals', 'appeal', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  ('operations', 'default', 'operations', 'Operations', 'operations', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));
-
-INSERT INTO queue_versions (
-  id, queue_id, version, mode, priority, response_sla_minutes, resolution_sla_minutes,
-  claim_ttl_minutes, fallback_queue_id, configuration_json, published_at, created_by, created_at
-) VALUES
-  ('urgent-human-v1', 'urgent-human', 1, 'off', 100, 15, 240, 15, NULL, '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  ('standard-human-v1', 'standard-human', 1, 'off', 50, 1440, 10080, 15, NULL, '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  ('low-priority-ai-v1', 'low-priority-ai', 1, 'shadow', 20, 1440, 10080, 15, 'standard-human', '{"allowed_outcomes":[],"protected_categories":[],"daily_volume_budget":0}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  ('appeals-v1', 'appeals', 1, 'off', 60, 1440, 10080, 30, NULL, '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  ('operations-v1', 'operations', 1, 'off', 80, 60, 1440, 30, NULL, '{}', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), 'system', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));