create-safest-tools 0.4.2 → 0.5.1

package/template/public/index.html

@@ -11,7 +11,7 @@
     <link rel="manifest" href="./manifest.webmanifest" />
     <link rel="stylesheet" href="./styles.css" />
   </head>
-  <body class="login-mode">
+  <body class="auth-resolving">
     <svg class="svg-defs" aria-hidden="true">
       <defs>
         <symbol id="i-home" viewBox="0 0 24 24"><path d="m3 10 9-7 9 7v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><path d="M9 21v-8h6v8"/></symbol>
@@ -43,7 +43,15 @@
     </div>
 
     <main id="main">
-      <section id="login" class="login-layout" aria-labelledby="login-title">
+      <section id="session-loading" class="session-loading" aria-live="polite" aria-busy="true">
+        <div class="session-loading-card">
+          <span class="session-loading-mark" aria-hidden="true"></span>
+          <strong>Opening your workspace</strong>
+          <span>Restoring your secure session…</span>
+        </div>
+      </section>
+
+      <section id="login" class="login-layout" aria-labelledby="login-title" hidden>
         <div class="login-story">
           <p class="eyebrow light">Safest Resolve</p>
           <h1>Every report gets<br />a real next step.</h1>

package/template/public/styles.css

@@ -1107,6 +1107,81 @@ body.report-open .content { margin-right: 0; }
 /* Authoritative responsive contract for the console shell and dense editors. */
 body.login-mode .topbar { display: flex; justify-content: flex-start; }
 body.login-mode .top-actions { margin-left: auto; }
+.session-loading {
+  min-height: calc(100vh - 72px);
+  display: grid;
+  place-items: center;
+  padding: 32px;
+  background: var(--background, #f4f7f3);
+}
+.session-loading[hidden] { display: none; }
+.session-loading-card {
+  display: grid;
+  justify-items: center;
+  gap: 8px;
+  color: var(--text, #183228);
+  text-align: center;
+}
+.session-loading-card strong { font-size: 16px; }
+.session-loading-card > span:last-child { color: var(--muted, #66766f); font-size: 13px; }
+.session-loading-mark {
+  width: 30px;
+  height: 30px;
+  margin-bottom: 4px;
+  border: 3px solid color-mix(in srgb, var(--primary, #165b43) 18%, transparent);
+  border-top-color: var(--primary, #165b43);
+  border-radius: 50%;
+  animation: session-loading-spin .8s linear infinite;
+}
+@keyframes session-loading-spin { to { transform: rotate(360deg); } }
+@media (prefers-reduced-motion: reduce) { .session-loading-mark { animation: none; } }
+
+/* Report drawer: readable case record with technical execution kept secondary. */
+.report-drawer .report-detail-content {
+  display: block;
+  max-width: 1180px;
+  margin-inline: auto;
+  padding: 22px 24px 36px;
+}
+.report-drawer .report-detail-content > section,
+.report-drawer .detail-grid section,
+.report-drawer .detail-actions form {
+  border-color: #dce5de;
+  border-radius: 12px;
+  background: #fff;
+}
+.report-drawer .report-detail-content > section { margin-top: 16px; padding: 20px; }
+.report-drawer .detail-grid { grid-template-columns: 1fr 1fr; gap: 16px; }
+.report-drawer .claim-bar,
+.report-drawer .detail-actions,
+.report-drawer .surface-error { width: 100%; }
+.report-drawer .detail-actions { grid-template-columns: minmax(0, .85fr) minmax(0, 1.15fr); align-items: start; gap: 16px; }
+.case-activity-heading { display: flex; justify-content: space-between; align-items: flex-start; gap: 16px; margin-bottom: 20px; }
+.case-activity-heading h3 { margin: 0 !important; font-size: 20px; }
+.case-activity-heading p { margin: 5px 0 0; color: var(--muted); font-size: 12px; line-height: 1.5; }
+.case-activity-heading > span { flex: 0 0 auto; padding: 5px 9px; border-radius: 999px; color: #315b47; background: #edf5ef; font-size: 11px; font-weight: 750; }
+.case-activity-section .report-timeline { padding-left: 2px; }
+.case-activity-section .timeline-event { grid-template-columns: 36px minmax(0, 1fr); gap: 12px; min-height: 76px; }
+.case-activity-section .timeline-event:not(:last-child)::before { top: 32px; bottom: 0; left: 15px; width: 2px; background: #dfe8e1; }
+.case-activity-section .timeline-marker { width: 32px; height: 32px; border-width: 2px; font-size: 13px; }
+.case-activity-section .timeline-event > div { padding: 2px 0 18px; }
+.case-activity-section .timeline-event strong { color: #172d23; font-size: 13px; line-height: 1.35; }
+.case-activity-section .timeline-event span { margin-top: 4px; color: #40584c; font-size: 12px; line-height: 1.5; }
+.case-activity-section .timeline-event small { margin-top: 6px; color: #75827b; font-size: 10px; line-height: 1.4; }
+.workflow-technical { margin-top: 4px; border-top: 1px solid #e4eae5; }
+.workflow-technical summary { padding: 15px 2px 5px; color: #40564b; cursor: pointer; font-size: 12px; font-weight: 750; }
+.workflow-technical summary span { margin-left: 6px; color: var(--muted); font-weight: 550; }
+.workflow-technical .report-run-list { margin: 10px 0 0; }
+.technical-event-count { margin: 10px 2px 2px; color: var(--muted); font-size: 10px; }
+.report-drawer .case-message { max-width: min(82%, 720px); padding: 13px 15px; font-size: 12px; line-height: 1.55; }
+.report-drawer .case-message small { font-size: 10px; line-height: 1.45; }
+
+@media (max-width: 800px) {
+  .report-drawer .report-detail-content { padding: 14px 14px 28px; }
+  .report-drawer .detail-grid,
+  .report-drawer .detail-actions { grid-template-columns: 1fr; }
+  .report-drawer .submission-meta { grid-template-columns: 100px minmax(0, 1fr) !important; }
+}
 
 @media (max-width: 760px) {
   body { min-width: 0; overflow-x: clip; }

package/template/reports.schema.json

@@ -48,7 +48,7 @@
       "required": ["enabled", "fromAddress"],
       "properties": {
         "enabled": { "type": "boolean" },
-        "fromAddress": { "type": "string", "maxLength": 254 },
+        "fromAddress": { "type": "string", "maxLength": 254, "description": "Receivable reporter mailbox. Resolve routes signed plus-addressed replies for this exact address to the Worker." },
         "authFromAddress": { "type": "string", "maxLength": 254 }
       }
     },

package/template/scripts/reports-cloudflare-preflight.mjs

@@ -66,6 +66,55 @@ async function fetchWorkersAccountSettings(accountId, token, fetchImpl) {
   return { ok: true, settings: body.result };
 }
 
+async function cloudflareApi(path, token, fetchImpl, init = {}) {
+  const response = await fetchImpl(`https://api.cloudflare.com/client/v4${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${token}`,
+      accept: "application/json",
+      ...(init.body ? { "content-type": "application/json" } : {}),
+      ...init.headers,
+    },
+  });
+  const body = await response.json().catch(() => null);
+  if (!response.ok || body?.success !== true) {
+    const detail = Array.isArray(body?.errors) && body.errors[0]?.message ? `: ${body.errors[0].message}` : "";
+    throw new Error(`Cloudflare API ${response.status}${detail}`);
+  }
+  return body.result;
+}
+
+async function emailZone(domain, token, fetchImpl) {
+  const labels = domain.toLowerCase().split(".").filter(Boolean);
+  for (let index = 0; index <= Math.max(0, labels.length - 2); index += 1) {
+    const candidate = labels.slice(index).join(".");
+    const zones = await cloudflareApi(`/zones?name=${encodeURIComponent(candidate)}&status=active&per_page=5`, token, fetchImpl);
+    if (Array.isArray(zones) && zones.length === 1 && typeof zones[0]?.id === "string") return zones[0];
+  }
+  throw new Error(`Cloudflare could not find an active zone that owns the reporter email domain ${domain}.`);
+}
+
+export async function ensureReporterReplyRouting({ reporterAddress, wranglerToken, fetchImpl = fetch }) {
+  const separator = reporterAddress.lastIndexOf("@");
+  if (separator < 1) throw new Error("The reporter email address is invalid.");
+  const domain = reporterAddress.slice(separator + 1).toLowerCase();
+  const zone = await emailZone(domain, wranglerToken, fetchImpl);
+  const settings = await cloudflareApi(`/zones/${encodeURIComponent(zone.id)}/email/routing`, wranglerToken, fetchImpl);
+  if (settings?.enabled !== true || settings?.status !== "ready") {
+    throw new Error(
+      `Cloudflare Email Routing is not ready for ${zone.name}. Enable it before setup so ${reporterAddress} can receive case replies; ` +
+      "Resolve will not change a domain's MX records automatically.",
+    );
+  }
+  if (settings.support_subaddress !== true) {
+    await cloudflareApi(`/zones/${encodeURIComponent(zone.id)}/email/routing`, wranglerToken, fetchImpl, {
+      method: "PATCH",
+      body: JSON.stringify({ support_subaddress: true }),
+    });
+  }
+  return { zoneId: zone.id, zoneName: zone.name, address: reporterAddress, subaddressingEnabled: true };
+}
+
 export function isWorkersPaidUsageModel(value) {
   return String(value ?? "").trim().toLowerCase() === "standard";
 }

package/template/scripts/reports-deploy.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { configureAuthentication, requiredOAuthSecrets } from "./reports-auth-onboarding.mjs";
 import {
   chooseCloudflareAccount,
+  ensureReporterReplyRouting,
   ensureWranglerAuthentication,
   saveCloudflareAccountSelection,
   verifyWorkersPaid,
@@ -36,36 +37,83 @@ function parseArguments(argv) {
   return result;
 }
 
-function runWrangler(args, label) {
+function runWrangler(args, label, { stdin = "inherit" } = {}) {
   return new Promise((resolvePromise, reject) => {
     console.log(`\n${label}`);
-    const child = spawn(process.execPath, [wrangler, ...args], { cwd: projectRoot, env: process.env, stdio: "inherit" });
+    const child = spawn(process.execPath, [wrangler, ...args], {
+      cwd: projectRoot,
+      env: process.env,
+      stdio: [stdin, "inherit", "inherit"],
+    });
     child.once("error", reject);
     child.once("exit", (code, signal) => code === 0 ? resolvePromise() : reject(new Error(`${label} failed${signal ? ` with signal ${signal}` : ` with exit code ${code}`}`)));
   });
 }
 
+function captureWrangler(args, { stdin = "ignore" } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [wrangler, ...args], {
+      cwd: projectRoot,
+      env: process.env,
+      stdio: [stdin, "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolvePromise({ code, signal, stdout, stderr, output: `${stdout}\n${stderr}` }));
+  });
+}
+
+function printWranglerOutput({ stdout, stderr }) {
+  if (stdout) process.stdout.write(stdout);
+  if (stderr) process.stderr.write(stderr);
+}
+
 export function isExistingResourceError(output) {
   return /already exists|already (?:been )?taken|duplicate resource/iu.test(output);
 }
 
-function ensureWranglerResource(args, label) {
-  return new Promise((resolvePromise, reject) => {
-    console.log(`\n${label}`);
-    const child = spawn(process.execPath, [wrangler, ...args], { cwd: projectRoot, env: process.env, stdio: ["inherit", "pipe", "pipe"] });
-    let output = "";
-    child.stdout.on("data", (chunk) => { output += chunk; process.stdout.write(chunk); });
-    child.stderr.on("data", (chunk) => { output += chunk; process.stderr.write(chunk); });
-    child.once("error", reject);
-    child.once("exit", (code, signal) => {
-      if (code === 0) return resolvePromise();
-      if (isExistingResourceError(output)) {
-        console.log("Resource already exists; reusing the exact configured name.");
-        return resolvePromise();
-      }
-      reject(new Error(`${label} failed${signal ? ` with signal ${signal}` : ` with exit code ${code}`}`));
-    });
-  });
+export function isTransientWranglerAuthenticationError(output) {
+  return /authentication error[\s\S]{0,200}(?:code\s*:\s*10000|\[code:\s*10000\])/iu.test(output);
+}
+
+async function ensureWranglerResource(args, label) {
+  console.log(`\n${label}`);
+  const result = await captureWrangler(args);
+  if (result.code === 0) {
+    console.log("Created the exact configured resource.");
+    return;
+  }
+  if (isExistingResourceError(result.output)) {
+    console.log("Already exists; reusing the exact configured resource.");
+    return;
+  }
+  printWranglerOutput(result);
+  throw new Error(`${label} failed${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+}
+
+async function deployWithAuthenticationRetry(args, label) {
+  console.log(`\n${label}`);
+  let result = await captureWrangler(args, { stdin: "inherit" });
+  if (result.code === 0) {
+    printWranglerOutput(result);
+    return;
+  }
+  if (!isTransientWranglerAuthenticationError(result.output)) {
+    printWranglerOutput(result);
+    throw new Error(`${label} failed${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+  }
+
+  console.log("Cloudflare rejected the upload token. Refreshing Wrangler authentication and retrying once.");
+  await runWrangler(["whoami"], "Refresh Cloudflare authentication");
+  console.log(`\n${label} (automatic retry 1 of 1)`);
+  result = await captureWrangler(args, { stdin: "inherit" });
+  printWranglerOutput(result);
+  if (result.code !== 0) {
+    throw new Error(`${label} failed after one automatic authentication retry${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+  }
 }
 
 async function validateSecrets(path, config) {
@@ -87,6 +135,23 @@ async function hasDatabaseId() {
   return typeof config?.d1_databases?.[0]?.database_id === "string" && config.d1_databases[0].database_id.length > 0;
 }
 
+async function fileExists(path) {
+  try {
+    await readFile(path);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+export function setupInstallationState({ databaseConfigured, installationRecorded }) {
+  if (installationRecorded && !databaseConfigured) return "inconsistent";
+  if (installationRecorded) return "installed";
+  if (databaseConfigured) return "resume";
+  return "fresh";
+}
+
 async function confirmation(installationId, yes) {
   if (yes) return;
   if (!process.stdin.isTTY) throw new Error("interactive confirmation is required; use --yes only after reviewing setup:plan");
@@ -104,6 +169,20 @@ export async function deployReports(argv = process.argv.slice(2)) {
   console.log(JSON.stringify({ action: options.upgrade ? "upgrade" : "install", ...plan }, null, 2));
   if (options.planOnly) return { status: "planned", plan };
   if (!plan.ready) throw new Error(plan.blockers.join(" "));
+  const installationPath = resolve(projectRoot, ".safest/installation.json");
+  const databaseConfigured = await hasDatabaseId();
+  const installationRecorded = await fileExists(installationPath);
+  const setupState = setupInstallationState({ databaseConfigured, installationRecorded });
+  if (options.upgrade && !databaseConfigured) throw new Error("upgrade requires an existing D1 database_id in wrangler.jsonc");
+  if (!options.upgrade && setupState === "installed") {
+    throw new Error("setup is already complete; use npm run owner:setup for a new owner link or npm run upgrade for an existing installation");
+  }
+  if (!options.upgrade && setupState === "inconsistent") {
+    throw new Error("the installation receipt exists but wrangler.jsonc has no D1 database_id; restore the database configuration before continuing");
+  }
+  if (!options.upgrade && setupState === "resume") {
+    console.log("\nInterrupted installation detected. Reusing the saved authentication choices and exact Cloudflare resources, then continuing setup.");
+  }
   const interactive = process.stdin.isTTY && !options.yes;
   const authentication = await ensureWranglerAuthentication({ wrangler, projectRoot, interactive });
   const accountSelection = await chooseCloudflareAccount({
@@ -126,7 +205,7 @@ export async function deployReports(argv = process.argv.slice(2)) {
     await initializeSecrets(secretsPath);
     console.log(`Created ${secretsPath} with generated owner-only secrets.`);
   }
-  if (!options.upgrade) {
+  if (!options.upgrade && setupState === "fresh") {
     const configured = await configureAuthentication({
       configPath: resolve(projectRoot, options.config),
       secretsPath,
@@ -138,10 +217,12 @@ export async function deployReports(argv = process.argv.slice(2)) {
   }
   await validateSecrets(secretsPath, config);
   await confirmation(config.installationId, options.yes);
-  const databaseConfigured = await hasDatabaseId();
-  if (options.upgrade && !databaseConfigured) throw new Error("upgrade requires an existing D1 database_id in wrangler.jsonc");
-  if (!options.upgrade && databaseConfigured) throw new Error("this project already has a D1 database_id; use npm run upgrade instead of setup");
-  if (!options.upgrade) {
+  const reporterRouting = await ensureReporterReplyRouting({
+    reporterAddress: config.email.fromAddress,
+    wranglerToken: authentication.token,
+  });
+  console.log(`\nReporter replies will route through ${reporterRouting.address}; plus-addressing is enabled and no catch-all is created.`);
+  if (!options.upgrade && setupState === "fresh") {
     await runWrangler(["d1", "create", config.resources.databaseName, "--binding", "DB", "--update-config"], "Create the customer-owned D1 database");
   }
   await ensureWranglerResource(["r2", "bucket", "create", config.resources.profileMediaBucketName], "Ensure the private profile-media R2 bucket exists");
@@ -151,9 +232,13 @@ export async function deployReports(argv = process.argv.slice(2)) {
   await ensureWranglerResource(["queues", "create", config.resources.reportQueueName], "Ensure the report jobs Queue exists");
   await ensureWranglerResource(["queues", "create", config.resources.deliveryQueueName], "Ensure the delivery jobs Queue exists");
   await ensureWranglerResource(["queues", "create", config.resources.operationsDlqName], "Ensure the operations dead-letter Queue exists");
-  await runWrangler(["d1", "migrations", "apply", "DB", "--remote"], "Apply forward-only report migrations");
-  await runWrangler(["deploy", "--secrets-file", secretsPath, "--strict"], "Deploy the reports Worker and bindings");
-  const installationPath = resolve(projectRoot, ".safest/installation.json");
+  await runWrangler(
+    ["d1", "migrations", "apply", "DB", "--remote"],
+    "Apply forward-only report migrations",
+    { stdin: "ignore" },
+  );
+  await deployWithAuthenticationRetry(["deploy", "--secrets-file", secretsPath, "--strict"], "Deploy the reports Worker and bindings");
+  const ownerSetup = options.upgrade ? null : await issueOwnerSetup({ config });
   await mkdir(dirname(installationPath), { recursive: true, mode: 0o700 });
   await writeFile(installationPath, `${JSON.stringify({
     schemaVersion: 2,
@@ -162,9 +247,9 @@ export async function deployReports(argv = process.argv.slice(2)) {
     resources: config.resources,
     ownerEmail: config.owner.email,
   }, null, 2)}\n`, { mode: 0o600 });
-  if (!options.upgrade) printOwnerSetup(await issueOwnerSetup({ config }));
+  if (ownerSetup) printOwnerSetup(ownerSetup);
   console.log("\nDeployment finished. Open the one-time owner setup link, run the authenticated setup feature checks until /ready succeeds, invite an administrator and analyst, then verify one server report and Queue consumption before production traffic.");
-  return { status: "deployed", plan };
+  return { status: "deployed", plan, resumed: !options.upgrade && setupState === "resume" };
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/template/scripts/reports-plan.mjs

@@ -85,6 +85,13 @@ export function parseReportsConfig(value) {
   const defaultAuthEmail = emailDomain ? `${emailFromAddress.startsWith("accounts@") ? "auth" : "accounts"}@${emailDomain}` : "";
   const authEmailFromAddress = String(email.authFromAddress ?? defaultAuthEmail).trim().toLowerCase();
   if (email.enabled && !EMAIL.test(emailFromAddress)) throw new ReportsConfigError("email.fromAddress must be a valid onboarded sender when email is enabled");
+  const emailLocal = emailFromAddress.slice(0, emailFromAddress.lastIndexOf("@"));
+  if (email.enabled && /^no-?reply$/u.test(emailLocal)) {
+    throw new ReportsConfigError("email.fromAddress must be a receivable mailbox, not a no-reply address");
+  }
+  if (email.enabled && (emailLocal.includes("+") || emailLocal.length > 10)) {
+    throw new ReportsConfigError("email.fromAddress must use a base mailbox of 10 characters or fewer without plus-addressing so replies can be routed securely");
+  }
   if (email.enabled && !EMAIL.test(authEmailFromAddress)) throw new ReportsConfigError("email.authFromAddress must be a valid onboarded sender when email is enabled");
   if (email.enabled && authEmailFromAddress === emailFromAddress) throw new ReportsConfigError("email.authFromAddress must differ from email.fromAddress");
   if (!email.enabled && emailFromAddress) throw new ReportsConfigError("email.fromAddress must be empty when email is disabled");
@@ -156,6 +163,11 @@ export function buildReportsPlan(config) {
         reporter: `REPORTER_EMAIL (${config.email.fromAddress || "not configured"})`,
         authentication: `AUTH_EMAIL (${config.email.authFromAddress || "not configured"})`,
       },
+      inboundReporterEmail: {
+        address: config.email.fromAddress,
+        routingRule: `Exact ${config.email.fromAddress} address routed to this Worker (no catch-all)`,
+        subaddressing: "Enabled so signed per-case reply addresses are accepted",
+      },
       staticAssets: "public/",
       publicHostname,
       customDomain: customDomain ?? "workers.dev hostname (no custom domain mutation)",
@@ -184,7 +196,7 @@ export function buildReportsPlan(config) {
     },
     order: [
       "Review this plan and the initial infrastructure-owner email.",
-      "Onboard the sender domain to Cloudflare Email Service before deployment.",
+      "Onboard the sender domain to Cloudflare Email Service and enable Email Routing for the reporter address before deployment.",
       "Initialize local secrets without committing them.",
       "Create D1, four private R2 buckets, and the three Queues in the customer account.",
       "Apply the D1 schema baseline and any later forward-only migrations before accepting traffic.",

package/template/src/index.ts

@@ -56,6 +56,7 @@ import { sha256, signContextToken, verifyContextToken } from "./report-crypto";
 import { createStoredReportContext, loadStoredReportContext, pruneReportContexts } from "./report-context";
 import { parseContextSchema, routingContextFacts, validateContextFacts } from "./report-context-schema";
 import { pendingDeliveryJobs, processDeliveryJob, RetryableDeliveryError } from "./report-delivery";
+import { receiveReporterEmail } from "./report-email-inbound";
 import { ApiError, allowedOrigin, apiErrorResponse, json, methodNotAllowed, readJsonObject, withCors } from "./report-http";
 import {
   cancelHumanTask,
@@ -613,6 +614,7 @@ async function handleWidgetReport(request: Request, env: Env, ctx: ExecutionCont
   });
   if (result.route) queueRoutingJob(env, ctx, result.jobId, result.receipt.reportId);
   queueDeliveryJobs(env, ctx, result.deliveryJobs);
+  if (result.created) publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId: result.receipt.reportId });
   return json(receiptJson(result.receipt), { status: result.created ? 201 : 200 });
 }
 
@@ -649,6 +651,7 @@ async function handleAnonymousWidgetReport(request: Request, env: Env, ctx: Exec
   });
   if (result.route) queueRoutingJob(env, ctx, result.jobId, result.receipt.reportId);
   queueDeliveryJobs(env, ctx, result.deliveryJobs);
+  if (result.created) publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId: result.receipt.reportId });
   return json(receiptJson(result.receipt), { status: result.created ? 201 : 200 });
 }
 
@@ -670,6 +673,7 @@ async function handleServerReport(request: Request, env: Env, ctx: ExecutionCont
   });
   if (result.route) queueRoutingJob(env, ctx, result.jobId, result.receipt.reportId);
   queueDeliveryJobs(env, ctx, result.deliveryJobs);
+  if (result.created) publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId: result.receipt.reportId });
   return json(receiptJson(result.receipt), { status: result.created ? 201 : 200 });
 }
 
@@ -743,6 +747,7 @@ async function handlePublicReport(request: Request, env: Env, ctx: ExecutionCont
   });
   if (result.route) queueRoutingJob(env, ctx, result.jobId, result.receipt.reportId);
   queueDeliveryJobs(env, ctx, result.deliveryJobs);
+  if (result.created) publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId: result.receipt.reportId });
   return json(receiptJson(result.receipt), { status: result.created ? 201 : 200 });
 }
 
@@ -3879,11 +3884,13 @@ async function handleQueue(batch: MessageBatch<unknown>, env: Env, ctx: Executio
       }
       if (isWorkflowDispatchJob(message.body)) {
         await processWorkflowDispatchJob(env, ctx, message.body);
+        publishWorkspaceEvent(env, ctx, { type: "reports_changed" });
         message.ack();
         continue;
       }
       if (isEvidenceFetchJob(message.body)) {
         await processEvidenceFetch(env, message.body);
+        publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId: message.body.reportId });
         message.ack();
         continue;
       }
@@ -3907,6 +3914,7 @@ async function handleQueue(batch: MessageBatch<unknown>, env: Env, ctx: Executio
               await Promise.all(jobs.filter(isAiJob).map((job) => markAiJobEnqueued(env.DB, job.jobId, false)));
             }
           }
+          publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId: message.body.reportId });
           message.ack();
         } catch (error) {
           await markJobEnqueueFailed(env.DB, message.body.jobId, "routing_processing_failed");
@@ -3933,16 +3941,19 @@ async function handleQueue(batch: MessageBatch<unknown>, env: Env, ctx: Executio
             });
           }
         }
+        publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId: message.body.reportId });
         message.ack();
         continue;
       }
       if (isDeliveryJob(message.body)) {
         await processDeliveryJob(env.DB, message.body, env);
+        publishWorkspaceEvent(env, ctx, { type: "reports_changed" });
         message.ack();
         continue;
       }
       if (isActionProposalJob(message.body)) {
         await processActionProposalJob(env, message.body);
+        publishWorkspaceEvent(env, ctx, { type: "reports_changed" });
         message.ack();
         continue;
       }
@@ -4142,6 +4153,11 @@ export default {
     await handleQueue(batch, env, ctx);
   },
 
+  async email(message: ForwardableEmailMessage, env: Env, ctx: ExecutionContext): Promise<void> {
+    const result = await receiveReporterEmail(message, env);
+    if (result.stored && result.reportId) publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId: result.reportId });
+  },
+
   async scheduled(_controller: ScheduledController, env: Env, ctx: ExecutionContext): Promise<void> {
     ctx.waitUntil((async () => {
       await Promise.all([

package/template/src/report-delivery.ts

@@ -2,7 +2,9 @@ import { canonicalJson } from "./audit";
 import type { DeliveryJob } from "./report-types";
 import { decryptReportContact } from "./report-crypto";
 import { BudgetControlError, reserveBudgets, settleBudgets } from "./budget-control";
-import { reporterEmailBinding, reporterEmailFrom, reporterEmailSubjectPrefix } from "./report-email";
+import { reporterEmailBinding, reporterEmailFrom, reporterEmailSubjectPrefix, reporterReplyAddress } from "./report-email";
+import { renderReporterEmail } from "./report-email-template";
+import { loadWorkspaceBrand } from "./workspace-branding";
 
 const MAX_ATTEMPTS = 8;
 const RESPONSE_LIMIT = 16 * 1024;
@@ -41,6 +43,7 @@ interface EmailDeliveryRow {
   recipientReference: string | null;
   contactCiphertext: string | null;
   body: string;
+  templateVersionId: string | null;
   reportReference: string;
   installationId: string;
   queueId: string | null;
@@ -227,7 +230,7 @@ async function claimEmail(db: D1Database, id: string): Promise<EmailDeliveryRow
     SELECT e.id, m.report_id AS reportId, e.message_id AS messageId,
       e.audience, e.state, e.attempt_count AS attemptCount,
       p.reference AS recipientReference, p.contact_ciphertext AS contactCiphertext,
-      m.body, r.public_reference AS reportReference,
+      m.body, m.template_version_id AS templateVersionId, r.public_reference AS reportReference,
       r.installation_id AS installationId, r.queue_id AS queueId
     FROM email_deliveries e
     JOIN case_messages m ON m.id = e.message_id
@@ -486,11 +489,30 @@ async function processEmail(db: D1Database, deliveryId: string, env: Env): Promi
       throw new DeliveryConfigurationError("Email sender or recipient configuration is invalid.");
     }
     const prefix = reporterEmailSubjectPrefix(env);
+    const [brand, replyTo] = await Promise.all([
+      loadWorkspaceBrand(db),
+      reporterReplyAddress({
+        fromAddress: from,
+        publicReference: row.reportReference,
+        signingSecret: env.CONTEXT_SIGNING_SECRET,
+        expiresAt: Math.floor(Date.now() / 1_000) + Math.max(
+          Number.parseInt(env.REPORT_RETENTION_DAYS, 10) || 365,
+          Number.parseInt(env.APPEAL_WINDOW_DAYS, 10) || 30,
+        ) * 86_400,
+      }),
+    ]);
+    const rendered = renderReporterEmail({
+      brand, body: row.body, reportReference: row.reportReference,
+      templateVersionId: row.templateVersionId, subjectPrefix: prefix,
+    });
     const result = await binding.send({
       to: email,
-      from,
-      subject: `${prefix} — ${row.reportReference}`,
-      text: `${row.body}\n\nReport reference: ${row.reportReference}`,
+      from: { email: from, name: `${brand.organization_name} Safety` },
+      replyTo: { email: replyTo, name: `${brand.organization_name} Safety` },
+      subject: rendered.subject,
+      text: rendered.text,
+      html: rendered.html,
+      headers: { "X-Safest-Report-Reference": row.reportReference },
     });
     providerMessageId = typeof result.messageId === "string" ? result.messageId.slice(0, 300) : null;
   } catch (error) {