create-safest-tools 0.3.1 → 0.4.1

package/template/public/styles.css

@@ -123,9 +123,6 @@ input:focus, select:focus { border-color: #68a380; box-shadow: 0 0 0 3px rgba(34
 .presence-dot.online { background: #55a271; }
 .presence-dot.viewing { background: #4d83a0; }
 .presence-dot.editing { background: #cf8a38; box-shadow: 0 0 0 3px rgba(207,138,56,.13); }
-.principle { margin-top: auto; padding: 14px; border-radius: 10px; color: #496054; background: #edf6f0; }
-.principle strong { font-size: 10px; }
-.principle p { margin: 7px 0 0; font-size: 9px; line-height: 1.5; }
 .content { min-width: 0; padding: clamp(25px, 4vw, 48px); }
 .page-head { max-width: 1400px; margin: 0 auto 24px; display: flex; justify-content: space-between; align-items: flex-start; gap: 16px; }
 .page-head p:last-child { margin: 0; color: var(--muted); font-size: 12px; }
@@ -259,6 +256,19 @@ td small { margin-top: 3px; color: var(--muted); }
 .detail-grid dl { margin: 0; display: grid; grid-template-columns: 115px 1fr; gap: 8px; font-size: 10px; }
 .detail-grid dt { color: var(--muted); }
 .detail-grid dd { margin: 0; overflow-wrap: anywhere; font-weight: 750; }
+.report-submission { grid-column: 1 / -1; }
+.submission-meta { margin-bottom: 14px !important; grid-template-columns: 115px minmax(0, 1fr) 115px minmax(0, 1fr) !important; }
+.answer-list { display: grid; gap: 8px; }
+.answer-record { padding: 11px 12px; display: grid; grid-template-columns: minmax(150px, .8fr) minmax(0, 1.4fr); gap: 16px; align-items: start; border: 1px solid #e5e9e4; border-radius: 8px; background: white; font-size: 11px; line-height: 1.5; }
+.answer-record strong, .answer-record small { display: block; }
+.answer-record strong { font-size: 11px; }
+.answer-record small { margin-top: 3px; color: var(--muted); font-size: 9px; }
+.answer-record > :last-child { min-width: 0; overflow-wrap: anywhere; }
+.answer-text { white-space: pre-wrap; }
+.answer-empty { color: var(--muted); font-style: italic; }
+.form-help { margin: -5px 0 12px; color: var(--muted); font-size: 10px; line-height: 1.45; }
+.mutation-status { margin: 0; padding: 11px 12px; border: 1px solid #d4e7d9; border-radius: 8px; color: #23543b; background: #eff8f1; font-size: 10px; line-height: 1.45; }
+.mutation-status:empty { display: none; }
 .evidence-list { display: grid; gap: 7px; }
 .evidence-item { padding: 8px; border-radius: 7px; color: #405249; background: white; font-size: 9px; overflow-wrap: anywhere; }
 .report-detail-content > section { margin-top: 14px; }
@@ -327,7 +337,6 @@ td small { margin-top: 3px; color: var(--muted); }
   .workspace { grid-template-columns: 1fr; }
   .sidebar { position: static; width: auto; height: auto; border-right: 0; border-bottom: 1px solid var(--line); }
   .sidebar nav { grid-template-columns: 1fr 1fr; }
-  .principle { display: none; }
   .metrics { grid-template-columns: 1fr 1fr; }
   .operation-metrics { grid-template-columns: 1fr 1fr; }
   .analytics-metrics { grid-template-columns: 1fr 1fr; }
@@ -388,8 +397,6 @@ td small { margin-top: 3px; color: var(--muted); }
 .sidebar nav a { min-height: 36px; color: #bdd0c8; font-size: 10px; }
 .sidebar nav a:hover { color: white; background: rgba(255,255,255,.07); }
 .sidebar nav a.active { color: #123b2b; background: #dafa72; box-shadow: 0 7px 18px rgba(0,0,0,.12); }
-.principle { color: #bcd2c8; background: rgba(255,255,255,.06); }
-.principle strong { color: white; }
 .content { min-width: 0; padding: 0; transition: margin-right .2s ease; }
 .queue-view { min-height: calc(100vh - 66px); }
 .page-head { max-width: none; min-height: 78px; margin: 0; padding: 15px 22px; align-items: center; border-bottom: 1px solid #dedfd8; background: #fbfaf7; }
@@ -498,7 +505,7 @@ body.report-open .content { margin-right: 408px; }
 @media (max-width: 900px) {
   .workspace { width: 100%; min-width: 0; grid-template-columns: minmax(0, 1fr); overflow-x: clip; }
   .sidebar { position: static; width: 100%; min-width: 0; max-width: 100vw; height: auto; padding: 10px; overflow: hidden; }
-  .sidebar .workspace-card, .sidebar .principle { display: none; }
+  .sidebar .workspace-card { display: none; }
   .sidebar nav { width: 100%; min-width: 0; max-width: 100%; margin: 0; display: flex; overflow-x: auto; overscroll-behavior-x: contain; }
   .sidebar nav, .active-analyst-list { scrollbar-width: none; }
   .sidebar nav::-webkit-scrollbar, .active-analyst-list::-webkit-scrollbar { display: none; }
@@ -851,8 +858,8 @@ body.report-open .content { margin-right: 0; }
 .sign-out-button:hover { background: #f7f9f6; }
 
 .workspace { min-height: calc(100vh - var(--product-topbar)); grid-template-columns: var(--product-sidebar) minmax(0, 1fr); background: var(--canvas); }
-.sidebar { top: var(--product-topbar); height: calc(100vh - var(--product-topbar)); padding: 16px 12px 14px; background: var(--forest-dark); }
-.sidebar nav { margin-top: 0; display: grid; gap: 3px; }
+.sidebar { top: var(--product-topbar); height: calc(100vh - var(--product-topbar)); height: calc(100dvh - var(--product-topbar)); min-height: 0; padding: 16px 12px 14px; overflow-y: auto; overscroll-behavior: contain; scrollbar-gutter: stable; scrollbar-width: thin; background: var(--forest-dark); }
+.sidebar nav { min-height: min-content; margin-top: 0; padding-bottom: 10px; display: grid; gap: 3px; }
 .sidebar nav > small { margin: 11px 10px 5px; color: #7fa596; font-size: 9px; font-weight: 800; letter-spacing: .11em; text-transform: uppercase; }
 .sidebar nav > small:first-child { margin-top: 9px; }
 .sidebar nav a { min-height: 40px; padding: 0 10px; display: grid; grid-template-columns: 20px minmax(0, 1fr) auto; gap: 10px; color: #c5d7cf; font-size: 13px; font-weight: 560; }
@@ -862,10 +869,6 @@ body.report-open .content { margin-right: 0; }
 .sidebar nav a.active { color: #102f24; background: var(--safest-lime-400); box-shadow: none; font-weight: 750; }
 .sidebar .nav-count { min-width: 22px; margin-left: 0; color: #dceae3; background: rgba(255,255,255,.10); font-size: 9px; }
 .sidebar nav a.active .nav-count { color: white; background: var(--forest-dark); }
-.principle { margin-top: auto; padding: 12px 10px; display: flex; align-items: flex-start; gap: 9px; color: #8eb0a2; background: rgba(255,255,255,.055); }
-.principle-dot { width: 8px; height: 8px; margin-top: 3px; flex: 0 0 8px; border-radius: 50%; background: #55b27b; box-shadow: 0 0 0 5px rgba(85,178,123,.12); }
-.principle strong { display: block; color: #eef6f1; font-size: 11px; }
-.principle p { margin-top: 3px; color: #8eb0a2; font-size: 10px; line-height: 1.45; }
 
 .content { background: var(--canvas); }
 .command-view { max-width: 1184px; margin: 0 auto; padding: 28px; }
@@ -947,9 +950,8 @@ body.report-open .content { margin-right: 0; }
   .topbar { grid-template-columns: 190px minmax(210px, 1fr) auto; }
   .top-workspace { display: none; }
   .sidebar { padding-inline: 10px; }
-  .sidebar nav > small, .sidebar nav a span, .sidebar nav a b, .principle div { display: none; }
+  .sidebar nav > small, .sidebar nav a span, .sidebar nav a b { display: none; }
   .sidebar nav a { grid-template-columns: 1fr; justify-items: center; padding-inline: 0; }
-  .principle { justify-content: center; }
   .command-grid { grid-template-columns: 1fr; }
   .queue-load-list { grid-template-columns: 1fr 1fr; }
 }
@@ -969,8 +971,6 @@ body.report-open .content { margin-right: 0; }
   .sidebar nav a { min-width: 0; display: grid; grid-template-columns: 20px minmax(0, 1fr) auto; justify-items: stretch; padding: 0 10px; }
   .sidebar nav a span { display: block; white-space: normal; }
   .sidebar nav a b { display: inline-block; }
-  .principle { display: flex; }
-  .principle div { display: block; }
   .nav-scrim { position: fixed; z-index: 65; inset: var(--product-topbar) 0 0; width: 100%; height: auto; display: block; border: 0; border-radius: 0; background: rgba(5,28,20,.33); backdrop-filter: blur(1px); }
   .nav-scrim[hidden] { display: none; }
   .content { padding: 0; }
@@ -1503,6 +1503,8 @@ body.login-mode .top-actions { margin-left: auto; }
   .configuration-dialog .detail-head, .registry-dialog .detail-head { padding: 14px; }
   .configuration-dialog .editor-form, .registry-dialog .editor-form { padding: 14px; }
   .configuration-tabs { scrollbar-width: thin; }
+  .submission-meta { grid-template-columns: 100px minmax(0, 1fr) !important; }
+  .answer-record { grid-template-columns: 1fr; gap: 5px; }
   .configuration-tabs button { flex: 0 0 auto; }
 }
 

package/template/reports.config.example.json

@@ -21,7 +21,8 @@
   "owner": { "email": "infrastructure@example.com" },
   "email": {
     "enabled": true,
-    "fromAddress": "reports@example.com"
+    "fromAddress": "reports@example.com",
+    "authFromAddress": "accounts@example.com"
   },
   "auth": {
     "password": true,

package/template/reports.schema.json

@@ -48,7 +48,8 @@
       "required": ["enabled", "fromAddress"],
       "properties": {
         "enabled": { "type": "boolean" },
-        "fromAddress": { "type": "string", "maxLength": 254 }
+        "fromAddress": { "type": "string", "maxLength": 254 },
+        "authFromAddress": { "type": "string", "maxLength": 254 }
       }
     },
     "auth": {

package/template/scripts/reports-auth-onboarding.mjs

@@ -58,13 +58,14 @@ function providerConfigured(provider, selected, secrets) {
 }
 
 export async function confirmEmailSending(config, ui = clack) {
-  const sender = config.email?.fromAddress ?? "";
-  const domain = sender.includes("@") ? sender.slice(sender.lastIndexOf("@") + 1) : sender;
+  const reporterSender = config.email?.fromAddress ?? "";
+  const authSender = config.email?.authFromAddress ?? "";
+  const domains = [...new Set([reporterSender, authSender].filter(Boolean).map((sender) => sender.slice(sender.lastIndexOf("@") + 1)))];
   ui.note(
-    `Sender: ${sender}\nDomain: ${domain}\n\n` +
+    `Reporter updates: ${reporterSender}\nAccount and invitation mail: ${authSender}\nDomain${domains.length === 1 ? "" : "s"}: ${domains.join(", ")}\n\n` +
       `1. In Cloudflare, open Compute → Email Service → Email Sending.\n` +
-      `2. Onboard ${domain} and wait for its sending DNS records to show configured.\n` +
-      `3. Return here. Domain onboarding is required to email arbitrary invited users.`,
+      `2. Onboard ${domains.join(" and ")} and wait for the sending DNS records to show configured.\n` +
+      `3. Return here. Resolve keeps participant mail separate from account and invitation mail.`,
     "Email delivery",
   );
   const action = await ui.select({

package/template/scripts/reports-plan.mjs

@@ -77,12 +77,18 @@ export function parseReportsConfig(value) {
   if (!EMAIL.test(ownerEmail)) throw new ReportsConfigError("owner.email is invalid");
   const retention = object(input.retention, "retention");
   exactKeys(retention, new Set(["reportsDays", "messagesDays", "appealWindowDays"]), "retention");
-  const email = input.email === undefined ? { enabled: false, fromAddress: "" } : object(input.email, "email");
-  exactKeys(email, new Set(["enabled", "fromAddress"]), "email");
+  const email = input.email === undefined ? { enabled: false, fromAddress: "", authFromAddress: "" } : object(input.email, "email");
+  exactKeys(email, new Set(["enabled", "fromAddress", "authFromAddress"]), "email");
   if (typeof email.enabled !== "boolean") throw new ReportsConfigError("email.enabled must be boolean");
   const emailFromAddress = String(email.fromAddress ?? "").trim().toLowerCase();
+  const emailDomain = emailFromAddress.includes("@") ? emailFromAddress.slice(emailFromAddress.lastIndexOf("@") + 1) : "";
+  const defaultAuthEmail = emailDomain ? `${emailFromAddress.startsWith("accounts@") ? "auth" : "accounts"}@${emailDomain}` : "";
+  const authEmailFromAddress = String(email.authFromAddress ?? defaultAuthEmail).trim().toLowerCase();
   if (email.enabled && !EMAIL.test(emailFromAddress)) throw new ReportsConfigError("email.fromAddress must be a valid onboarded sender when email is enabled");
+  if (email.enabled && !EMAIL.test(authEmailFromAddress)) throw new ReportsConfigError("email.authFromAddress must be a valid onboarded sender when email is enabled");
+  if (email.enabled && authEmailFromAddress === emailFromAddress) throw new ReportsConfigError("email.authFromAddress must differ from email.fromAddress");
   if (!email.enabled && emailFromAddress) throw new ReportsConfigError("email.fromAddress must be empty when email is disabled");
+  if (!email.enabled && email.authFromAddress) throw new ReportsConfigError("email.authFromAddress must be empty when email is disabled");
   const auth = input.auth === undefined ? { password: true, providers: [] } : object(input.auth, "auth");
   exactKeys(auth, new Set(["password", "providers"]), "auth");
   if (auth.password !== true) throw new ReportsConfigError("auth.password must be true because password recovery is a required sign-in method");
@@ -112,7 +118,7 @@ export function parseReportsConfig(value) {
     publicBaseUrl: origin(input.publicBaseUrl, "publicBaseUrl"),
     allowedOrigins: stringList(input.allowedOrigins, "allowedOrigins", 20, origin),
     owner: { email: ownerEmail },
-    email: { enabled: email.enabled, fromAddress: emailFromAddress },
+    email: { enabled: email.enabled, fromAddress: emailFromAddress, authFromAddress: authEmailFromAddress },
     auth: { password: true, providers: authProviders },
     retention: {
       reportsDays: integer(retention.reportsDays, "retention.reportsDays", 30, 3_650),
@@ -146,7 +152,10 @@ export function buildReportsPlan(config) {
       queues: [config.resources.reportQueueName, config.resources.deliveryQueueName, config.resources.operationsDlqName],
       durableObject: "WorkspacePresence (SQLite-backed, declared by Worker migration)",
       workersAiBinding: "AI",
-      emailServiceBinding: `EMAIL (${config.email.fromAddress || "not configured"})`,
+      emailServiceBindings: {
+        reporter: `REPORTER_EMAIL (${config.email.fromAddress || "not configured"})`,
+        authentication: `AUTH_EMAIL (${config.email.authFromAddress || "not configured"})`,
+      },
       staticAssets: "public/",
       publicHostname,
       customDomain: customDomain ?? "workers.dev hostname (no custom domain mutation)",
@@ -178,7 +187,7 @@ export function buildReportsPlan(config) {
       "Onboard the sender domain to Cloudflare Email Service before deployment.",
       "Initialize local secrets without committing them.",
       "Create D1, four private R2 buckets, and the three Queues in the customer account.",
-      "Apply all report migrations before accepting traffic.",
+      "Apply the D1 schema baseline and any later forward-only migrations before accepting traffic.",
       `Deploy the Worker, assets, Worker Loader, Dynamic Workflow, presence Durable Object, Queue consumers, cron, Workers AI binding${customDomain ? `, and ${customDomain} Custom Domain` : ""}.`,
       "Open the generated one-time owner setup link, create the owner account, verify required setup features and authenticated /ready, invite an administrator and analyst, then verify report intake, routing, and delivery recovery.",
     ],

package/template/src/index.ts

@@ -1,4 +1,5 @@
 import { canonicalJson } from "./audit";
+import { reporterEmailConfigured } from "./report-email";
 import { decodeApiCursor, encodeApiCursor } from "./api-cursor";
 import {
   assertBackupTransferAllowed,
@@ -409,15 +410,17 @@ function publishWorkspaceEvent(
 
 function deliveryOptions(env: Env) {
   return {
+    emailEnabled: reporterEmailConfigured(env),
+    contactEncryptionKey: env.CREDENTIAL_ENCRYPTION_KEY,
+    recipientHashPepper: env.RATE_LIMIT_PEPPER,
     notificationEnabled: Boolean(env.NOTIFICATION_WEBHOOK_URL?.trim() && env.NOTIFICATION_WEBHOOK_SECRET?.trim()),
   };
 }
 
 function intakeDeliveryOptions(env: Env) {
-  const emailBinding = (env as unknown as { EMAIL?: unknown }).EMAIL;
   return {
     contactEncryptionKey: env.CREDENTIAL_ENCRYPTION_KEY,
-    emailEnabled: Boolean(emailBinding && env.EMAIL_FROM_ADDRESS?.trim()),
+    emailEnabled: reporterEmailConfigured(env),
     notificationEnabled: Boolean(env.NOTIFICATION_WEBHOOK_URL?.trim() && env.NOTIFICATION_WEBHOOK_SECRET?.trim()),
   };
 }
@@ -2879,7 +2882,13 @@ async function handleAdminReportMessage(
   );
   queueDeliveryJobs(env, ctx, result.jobs);
   publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId });
-  return json({ schema_version: "1", message_id: result.messageId, idempotent_replay: result.idempotentReplay }, {
+  return json({
+    schema_version: "1",
+    message_id: result.messageId,
+    delivery_state: result.deliveryState,
+    delivery_channel: result.deliveryChannel,
+    idempotent_replay: result.idempotentReplay,
+  }, {
     status: result.idempotentReplay ? 200 : 201,
   });
 }

package/template/src/installation-admin.ts

@@ -1,6 +1,7 @@
 import { canonicalJson } from "./audit";
 import { sha256 } from "./report-crypto";
 import { ApiError } from "./report-http";
+import { reporterEmailConfigured } from "./report-email";
 import type { OperatorSession } from "./report-types";
 import { WORKFLOW_COMPILER_VERSION } from "./workflow-compiler";
 import { parseWorkspaceBrand } from "./workspace-branding";
@@ -280,7 +281,7 @@ export async function verifyFeature(env: Env, feature: string, actorId: string):
     else if (feature === "workers_ai") { ready = Boolean((env as unknown as { AI?: unknown }).AI); }
     else if (feature === "object_storage") { ready = Boolean(env.PROFILE_MEDIA && env.WORKFLOW_ARTIFACTS && env.EVIDENCE_OBJECTS && env.EXPORTS); capability = { buckets: ready ? 4 : 0 }; }
     else if (feature === "queues") { ready = Boolean(env.REPORT_JOBS && env.DELIVERY_JOBS && env.CONTROL_JOBS); capability = { producers: ready ? 3 : 0 }; }
-    else { ready = Boolean((env as unknown as { EMAIL?: unknown }).EMAIL && env.EMAIL_FROM_ADDRESS); capability = { optional: true }; }
+    else { ready = reporterEmailConfigured(env); capability = { optional: true, channel: "reporter_email" }; }
   } catch { errorCode = "feature_probe_failed"; }
   const state = ready ? "ready" : feature === "email" ? "disabled" : "setup_required";
   const timestamp = now();

package/template/src/report-ai.ts

@@ -1,5 +1,6 @@
 import { canonicalJson } from "./audit";
 import { evaluateAiFailurePause } from "./report-ai-quality";
+import { selectParticipantDelivery } from "./report-email";
 import type { AiJob, DeliveryJob, ReportState } from "./report-types";
 import type { AiMode, ValidatedAiResult } from "./report-ai-validation";
 import { validateAiResult } from "./report-ai-validation";
@@ -58,6 +59,7 @@ interface AiContextRow extends AiConfigRow {
   job_state: "pending" | "enqueued" | "processing" | "complete" | "failed" | "dead_letter";
   attempt_count: number;
   report_id: string;
+  installation_id: string;
   public_reference: string;
   source: string;
   report_state: ReportState;
@@ -67,6 +69,8 @@ interface AiContextRow extends AiConfigRow {
   target_reference: string;
   signed_facts_json: string;
   reporter_reference: string | null;
+  reporter_contact_mode: string;
+  reporter_contact_ciphertext: string | null;
   queue_ai_instructions: string | null;
 }
 
@@ -224,10 +228,12 @@ function randomSample(rate: number): boolean {
 
 async function aiContext(db: D1Database, jobId: string): Promise<AiContextRow | null> {
   return db.prepare(`
-    SELECT j.id AS job_id, j.state AS job_state, j.attempt_count, r.id AS report_id,
+    SELECT j.id AS job_id, j.state AS job_state, j.attempt_count, r.id AS report_id, r.installation_id,
       r.public_reference, r.source, r.state AS report_state, r.reason_code, r.form_version_id,
       t.target_type, t.target_reference, t.signed_facts_json,
-      p.reference AS reporter_reference, qv.ai_instructions AS queue_ai_instructions, c.*
+      p.reference AS reporter_reference, p.contact_mode AS reporter_contact_mode,
+      p.contact_ciphertext AS reporter_contact_ciphertext,
+      qv.ai_instructions AS queue_ai_instructions, c.*
     FROM background_jobs j
     JOIN reports r ON r.id = j.report_id
     JOIN report_targets t ON t.report_id = r.id
@@ -431,6 +437,9 @@ async function providerFailure(db: D1Database, context: AiContextRow, runId: str
 }
 
 export interface AiProcessOptions {
+  emailEnabled: boolean;
+  contactEncryptionKey: string;
+  recipientHashPepper: string;
   notificationEnabled: boolean;
 }
 
@@ -643,6 +652,14 @@ export async function processAiJob(
   const messageId = crypto.randomUUID();
   const noticeId = crypto.randomUUID();
   const notificationId = crypto.randomUUID();
+  const participantDelivery = await selectParticipantDelivery({
+    reportId: context.report_id,
+    audience: "reporter",
+    contactMode: context.reporter_contact_mode,
+    contactCiphertext: context.reporter_contact_ciphertext,
+    reference: context.reporter_reference,
+    ...options,
+  });
   let templateId: string;
   let variables: Record<string, string>;
   let nextState: ReportState;
@@ -721,7 +738,7 @@ export async function processAiJob(
       ) VALUES (?1, ?2, 'reporter', 'outbound', 'ai', ?3, ?4, ?5, 1, ?6, ?7, ?8)
     `).bind(
       messageId, context.report_id, context.id, renderedBody, templateId,
-      options.notificationEnabled ? "queued" : "suppressed", finishedAt, `ai-message:${storedRun.id}`,
+      participantDelivery.state, finishedAt, `ai-message:${storedRun.id}`,
     ),
     usageStatement(db, context.id, nextState === "resolved_by_ai" ? { resolved: 1 } : { waiting: 1 }, finishedAt),
     auditEvent(db, {
@@ -760,10 +777,18 @@ export async function processAiJob(
     ) VALUES (?1, ?2, ?3, 'reporter', ?4, ?5, ?6, ?7, ?7, ?8, ?9)
   `).bind(
     noticeId, context.report_id, nextState === "resolved_by_ai" ? decisionId : null, templateId, renderedBody,
-    options.notificationEnabled ? "queued" : "suppressed", finishedAt, `ai-notice:${storedRun.id}`, messageId,
+    participantDelivery.state, finishedAt, `ai-notice:${storedRun.id}`, messageId,
   ));
   const jobs: DeliveryJob[] = [];
-  if (options.notificationEnabled) {
+  if (participantDelivery.channel === "email" && participantDelivery.recipientHash) {
+    statements.push(db.prepare(`
+      INSERT INTO email_deliveries (
+        id, installation_id, message_id, audience, recipient_hash,
+        provider, state, attempt_count, next_attempt_at, created_at, updated_at
+      ) VALUES (?1, ?2, ?3, 'reporter', ?4, 'cloudflare_email_service', 'pending', 0, ?5, ?5, ?5)
+    `).bind(notificationId, context.installation_id, messageId, participantDelivery.recipientHash, finishedAt));
+    jobs.push({ version: 1, jobId: `email:${notificationId}`, type: "deliver_email", outboxId: notificationId });
+  } else if (participantDelivery.channel === "customer_webhook") {
     statements.push(db.prepare(`
       INSERT INTO notification_outbox (
         id, notice_id, idempotency_key, channel, payload_json, status, next_attempt_at, created_at, updated_at

package/template/src/report-better-auth.ts

@@ -2,6 +2,7 @@ import { betterAuth } from "better-auth";
 import { getMigrations } from "better-auth/db/migration";
 import { genericOAuth } from "better-auth/plugins";
 import type { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
+import { authenticationEmailBinding } from "./report-email";
 
 const INVITATION_COOKIE = "safest_invitation";
 const INVITATION_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
@@ -9,16 +10,6 @@ const OWNER_SETUP_COOKIE = "safest_owner_setup";
 const OWNER_SETUP_RATE_LIMIT = 12;
 const OWNER_SETUP_WINDOW_SECONDS = 10 * 60;
 
-type AuthEmailBinding = {
-  send(message: {
-    from: { email: string; name?: string };
-    to: string | string[];
-    subject: string;
-    text: string;
-    html: string;
-  }): Promise<unknown>;
-};
-
 type BetterAuthEnv = Env & {
   BETTER_AUTH_SECRET?: string;
   AUTH_EMAIL_FROM?: string;
@@ -28,7 +19,6 @@ type BetterAuthEnv = Env & {
   AUTH_GITHUB_CLIENT_SECRET?: string;
   AUTH_CLOUDFLARE_CLIENT_ID?: string;
   AUTH_CLOUDFLARE_CLIENT_SECRET?: string;
-  EMAIL?: AuthEmailBinding;
 };
 
 type BetterAuthSession = {
@@ -274,11 +264,12 @@ async function sendAuthEmail(
   env: BetterAuthEnv,
   message: { to: string; subject: string; heading: string; body: string; action: string; url: string },
 ): Promise<void> {
-  if (localDevelopment(env) && (!env.EMAIL || !env.AUTH_EMAIL_FROM)) {
+  const email = authenticationEmailBinding(env);
+  if (localDevelopment(env) && (!email || !env.AUTH_EMAIL_FROM)) {
     console.info(`Local authentication email (${message.subject}) for ${message.to}: ${message.url}`);
     return;
   }
-  if (!env.EMAIL || !env.AUTH_EMAIL_FROM) {
+  if (!email || !env.AUTH_EMAIL_FROM) {
     throw new Error("Cloudflare Email Service and AUTH_EMAIL_FROM are required for authentication email.");
   }
   const footer = "If you did not request this message, you can safely ignore it.";
@@ -288,7 +279,7 @@ async function sendAuthEmail(
     `<p><a href="${escapeHtml(message.url)}" style="display:inline-block;padding:10px 16px;` +
     `background:#171717;color:#fff;text-decoration:none;border-radius:6px">${escapeHtml(message.action)}</a></p>` +
     `<p style="font-size:12px;color:#666">${escapeHtml(footer)}</p></body></html>`;
-  await env.EMAIL.send({
+  await email.send({
     from: { name: "Safest Resolve", email: env.AUTH_EMAIL_FROM },
     to: message.to,
     subject: message.subject,

package/template/src/report-delivery.ts

@@ -2,6 +2,7 @@ import { canonicalJson } from "./audit";
 import type { DeliveryJob } from "./report-types";
 import { decryptReportContact } from "./report-crypto";
 import { BudgetControlError, reserveBudgets, settleBudgets } from "./budget-control";
+import { reporterEmailBinding, reporterEmailFrom, reporterEmailSubjectPrefix } from "./report-email";
 
 const MAX_ATTEMPTS = 8;
 const RESPONSE_LIMIT = 16 * 1024;
@@ -449,8 +450,8 @@ async function processEmail(db: D1Database, deliveryId: string, env: Env): Promi
   const email = row.contactCiphertext
     ? (await decryptReportContact(env.CREDENTIAL_ENCRYPTION_KEY, row.contactCiphertext, row.reportId, row.audience)).trim().toLowerCase()
     : row.recipientReference?.trim().toLowerCase() ?? "";
-  const from = env.EMAIL_FROM_ADDRESS?.trim().toLowerCase() ?? "";
-  const binding = (env as unknown as { EMAIL?: { send(message: Record<string, unknown>): Promise<{ messageId?: string }> } }).EMAIL;
+  const from = reporterEmailFrom(env);
+  const binding = reporterEmailBinding(env);
   let reservations;
   try {
     reservations = await reserveBudgets(db, {
@@ -484,7 +485,7 @@ async function processEmail(db: D1Database, deliveryId: string, env: Env): Promi
     if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(email) || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(from)) {
       throw new DeliveryConfigurationError("Email sender or recipient configuration is invalid.");
     }
-    const prefix = env.EMAIL_SUBJECT_PREFIX?.trim().slice(0, 120) || "Safest report update";
+    const prefix = reporterEmailSubjectPrefix(env);
     const result = await binding.send({
       to: email,
       from,

package/template/src/report-email.ts

@@ -0,0 +1,106 @@
+export type AuthenticationEmailBinding = {
+  send(message: {
+    from: { email: string; name?: string };
+    to: string | string[];
+    subject: string;
+    text: string;
+    html: string;
+  }): Promise<unknown>;
+};
+
+export type ReporterEmailBinding = {
+  send(message: {
+    from: string;
+    to: string;
+    subject: string;
+    text: string;
+  }): Promise<{ messageId?: string }>;
+};
+
+type EmailEnvironment = {
+  AUTH_EMAIL?: AuthenticationEmailBinding;
+  REPORTER_EMAIL?: ReporterEmailBinding;
+  /** Compatibility with installations created before the email channels were separated. */
+  EMAIL?: AuthenticationEmailBinding & ReporterEmailBinding;
+  AUTH_EMAIL_FROM?: string;
+  REPORTER_EMAIL_FROM?: string;
+  REPORTER_EMAIL_SUBJECT_PREFIX?: string;
+  /** Compatibility with installations created before the email channels were separated. */
+  EMAIL_FROM_ADDRESS?: string;
+  EMAIL_SUBJECT_PREFIX?: string;
+};
+
+function emailEnvironment(env: unknown): EmailEnvironment {
+  return env as EmailEnvironment;
+}
+
+export function authenticationEmailBinding(env: unknown): AuthenticationEmailBinding | undefined {
+  const bindings = emailEnvironment(env);
+  return bindings.AUTH_EMAIL ?? bindings.EMAIL;
+}
+
+export function reporterEmailBinding(env: unknown): ReporterEmailBinding | undefined {
+  const bindings = emailEnvironment(env);
+  return bindings.REPORTER_EMAIL ?? bindings.EMAIL;
+}
+
+export function reporterEmailFrom(env: unknown): string {
+  const bindings = emailEnvironment(env);
+  return (bindings.REPORTER_EMAIL_FROM ?? bindings.EMAIL_FROM_ADDRESS ?? "").trim().toLowerCase();
+}
+
+export function reporterEmailSubjectPrefix(env: unknown): string {
+  const bindings = emailEnvironment(env);
+  return (bindings.REPORTER_EMAIL_SUBJECT_PREFIX ?? bindings.EMAIL_SUBJECT_PREFIX ?? "").trim().slice(0, 120)
+    || "Safest report update";
+}
+
+export function reporterEmailConfigured(env: unknown): boolean {
+  return Boolean(reporterEmailBinding(env) && reporterEmailFrom(env));
+}
+
+export type ParticipantDelivery = {
+  channel: "email" | "customer_webhook" | null;
+  state: "queued" | "suppressed";
+  recipientHash?: string;
+};
+
+export async function selectParticipantDelivery(input: {
+  reportId: string;
+  audience: ParticipantAudience;
+  contactMode: string;
+  contactCiphertext: string | null;
+  reference: string | null;
+  emailEnabled: boolean;
+  notificationEnabled: boolean;
+  contactEncryptionKey: string;
+  recipientHashPepper: string;
+}): Promise<ParticipantDelivery> {
+  if (input.emailEnabled && input.contactMode === "customer_notification" && input.contactCiphertext) {
+    try {
+      const email = (await decryptReportContact(
+        input.contactEncryptionKey,
+        input.contactCiphertext,
+        input.reportId,
+        input.audience,
+      )).trim().toLowerCase();
+      if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(email)) {
+        return {
+          channel: "email",
+          state: "queued",
+          recipientHash: `sha256:${await sha256(`email-recipient-v1:${input.recipientHashPepper}:${email}`)}`,
+        };
+      }
+    } catch {
+      // A damaged encrypted contact can still fall back to a customer-owned
+      // notification webhook when the report has an eligible participant.
+    }
+  }
+  if (input.notificationEnabled && input.contactMode === "customer_notification"
+    && (input.reference || input.contactCiphertext)) {
+    return { channel: "customer_webhook", state: "queued" };
+  }
+  return { channel: null, state: "suppressed" };
+}
+import { decryptReportContact, sha256 } from "./report-crypto";
+import type { ParticipantAudience } from "./report-types";