create-safest-tools 0.5.0 → 0.5.1

package/README.md

@@ -44,7 +44,7 @@ npm run setup:plan
 npm run setup
 ```
 
-`setup:plan` lists exact resource names and the reporter email route, then exits without modifying Cloudflare. `setup` opens Wrangler's Cloudflare login when needed, lets you choose the owning account, and verifies Workers Paid from the account's Workers usage model. Standard accounts need no separate billing token; only legacy or ambiguous account models use the temporary Billing Read fallback. It then guides Google, GitHub, and Cloudflare OAuth configuration with exact callback URLs and masked secret input. Nothing is provisioned until the exact `DEPLOY <installation-id>` confirmation. After confirmation it verifies Email Routing, enables subaddressing, and deploys only the exact reporter-address route.
+`setup:plan` lists exact resource names and the reporter email route, then exits without modifying Cloudflare. `setup` opens Wrangler's Cloudflare login when needed, lets you choose the owning account, and verifies Workers Paid from the account's Workers usage model. Standard accounts need no separate billing token; only legacy or ambiguous account models use the temporary Billing Read fallback. It then guides Google, GitHub, and Cloudflare OAuth configuration with exact callback URLs and masked secret input. Nothing is provisioned until the exact `DEPLOY <installation-id>` confirmation. After confirmation it verifies Email Routing, enables subaddressing, and deploys only the exact reporter-address route. If Cloudflare interrupts the deployment, run `npm run setup` again; it detects the unfinished installation, reuses the saved authentication choices and exact resources, suppresses expected already-exists errors, and continues through the owner-link step.
 
 A new installation applies one current D1 schema baseline. Later releases add only forward-compatible upgrade migrations.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-safest-tools",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Create customer-owned abuse-reporting infrastructure on Cloudflare",
   "type": "module",
   "license": "Apache-2.0",

package/template/README.md

@@ -10,7 +10,7 @@ Before deployment:
 
 1. Review `reports.config.json` and `npm run setup:plan`.
 2. Under Cloudflare Email Service → Email Sending, onboard the configured sender domain. Enable Email Routing for that domain and use a real reporter mailbox such as `reports@example.com`; setup creates only that exact Worker route, enables plus-addressing for signed case replies, and never enables catch-all routing. Reporter updates and account mail use separate sender addresses and sender-restricted bindings.
-3. Run `npm run setup`. The guided setup signs in through Wrangler and verifies Workers Paid from the account's Workers usage model before provisioning. Standard accounts need no separate billing token; only legacy or ambiguous models use the temporary Billing Read fallback. Setup then creates owner-only local secrets and walks through optional Google, GitHub, and Cloudflare OAuth credentials with exact callback URLs.
+3. Run `npm run setup`. The guided setup signs in through Wrangler and verifies Workers Paid from the account's Workers usage model before provisioning. Standard accounts need no separate billing token; only legacy or ambiguous models use the temporary Billing Read fallback. Setup then creates owner-only local secrets and walks through optional Google, GitHub, and Cloudflare OAuth credentials with exact callback URLs. If Cloudflare interrupts deployment, run the same command again: setup detects the unfinished installation, reuses the saved choices and exact resources, skips the repeated OAuth questions, and continues to the owner link.
 4. Type the exact installation confirmation when setup requests it. After deployment, setup prints a 256-bit, single-use owner link that expires after 15 minutes and is never written to disk.
 5. Open the owner link, create the Safest owner account, then invite administrators and analysts from People. Nobody needs a Cloudflare account to sign in. Names and workspace roles are always displayed separately.
 

package/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safest-resolve-installation",
-  "version": "0.5.0",
-  "safestToolsVersion": "0.5.0-resolve",
+  "version": "0.5.1",
+  "safestToolsVersion": "0.5.1-resolve",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
@@ -46,5 +46,9 @@
   },
   "engines": {
     "node": ">=20.12.0"
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "workerd": true
   }
 }

package/template/scripts/reports-deploy.mjs

@@ -37,36 +37,83 @@ function parseArguments(argv) {
   return result;
 }
 
-function runWrangler(args, label) {
+function runWrangler(args, label, { stdin = "inherit" } = {}) {
   return new Promise((resolvePromise, reject) => {
     console.log(`\n${label}`);
-    const child = spawn(process.execPath, [wrangler, ...args], { cwd: projectRoot, env: process.env, stdio: "inherit" });
+    const child = spawn(process.execPath, [wrangler, ...args], {
+      cwd: projectRoot,
+      env: process.env,
+      stdio: [stdin, "inherit", "inherit"],
+    });
     child.once("error", reject);
     child.once("exit", (code, signal) => code === 0 ? resolvePromise() : reject(new Error(`${label} failed${signal ? ` with signal ${signal}` : ` with exit code ${code}`}`)));
   });
 }
 
+function captureWrangler(args, { stdin = "ignore" } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [wrangler, ...args], {
+      cwd: projectRoot,
+      env: process.env,
+      stdio: [stdin, "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolvePromise({ code, signal, stdout, stderr, output: `${stdout}\n${stderr}` }));
+  });
+}
+
+function printWranglerOutput({ stdout, stderr }) {
+  if (stdout) process.stdout.write(stdout);
+  if (stderr) process.stderr.write(stderr);
+}
+
 export function isExistingResourceError(output) {
   return /already exists|already (?:been )?taken|duplicate resource/iu.test(output);
 }
 
-function ensureWranglerResource(args, label) {
-  return new Promise((resolvePromise, reject) => {
-    console.log(`\n${label}`);
-    const child = spawn(process.execPath, [wrangler, ...args], { cwd: projectRoot, env: process.env, stdio: ["inherit", "pipe", "pipe"] });
-    let output = "";
-    child.stdout.on("data", (chunk) => { output += chunk; process.stdout.write(chunk); });
-    child.stderr.on("data", (chunk) => { output += chunk; process.stderr.write(chunk); });
-    child.once("error", reject);
-    child.once("exit", (code, signal) => {
-      if (code === 0) return resolvePromise();
-      if (isExistingResourceError(output)) {
-        console.log("Resource already exists; reusing the exact configured name.");
-        return resolvePromise();
-      }
-      reject(new Error(`${label} failed${signal ? ` with signal ${signal}` : ` with exit code ${code}`}`));
-    });
-  });
+export function isTransientWranglerAuthenticationError(output) {
+  return /authentication error[\s\S]{0,200}(?:code\s*:\s*10000|\[code:\s*10000\])/iu.test(output);
+}
+
+async function ensureWranglerResource(args, label) {
+  console.log(`\n${label}`);
+  const result = await captureWrangler(args);
+  if (result.code === 0) {
+    console.log("Created the exact configured resource.");
+    return;
+  }
+  if (isExistingResourceError(result.output)) {
+    console.log("Already exists; reusing the exact configured resource.");
+    return;
+  }
+  printWranglerOutput(result);
+  throw new Error(`${label} failed${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+}
+
+async function deployWithAuthenticationRetry(args, label) {
+  console.log(`\n${label}`);
+  let result = await captureWrangler(args, { stdin: "inherit" });
+  if (result.code === 0) {
+    printWranglerOutput(result);
+    return;
+  }
+  if (!isTransientWranglerAuthenticationError(result.output)) {
+    printWranglerOutput(result);
+    throw new Error(`${label} failed${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+  }
+
+  console.log("Cloudflare rejected the upload token. Refreshing Wrangler authentication and retrying once.");
+  await runWrangler(["whoami"], "Refresh Cloudflare authentication");
+  console.log(`\n${label} (automatic retry 1 of 1)`);
+  result = await captureWrangler(args, { stdin: "inherit" });
+  printWranglerOutput(result);
+  if (result.code !== 0) {
+    throw new Error(`${label} failed after one automatic authentication retry${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+  }
 }
 
 async function validateSecrets(path, config) {
@@ -88,6 +135,23 @@ async function hasDatabaseId() {
   return typeof config?.d1_databases?.[0]?.database_id === "string" && config.d1_databases[0].database_id.length > 0;
 }
 
+async function fileExists(path) {
+  try {
+    await readFile(path);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+export function setupInstallationState({ databaseConfigured, installationRecorded }) {
+  if (installationRecorded && !databaseConfigured) return "inconsistent";
+  if (installationRecorded) return "installed";
+  if (databaseConfigured) return "resume";
+  return "fresh";
+}
+
 async function confirmation(installationId, yes) {
   if (yes) return;
   if (!process.stdin.isTTY) throw new Error("interactive confirmation is required; use --yes only after reviewing setup:plan");
@@ -105,6 +169,20 @@ export async function deployReports(argv = process.argv.slice(2)) {
   console.log(JSON.stringify({ action: options.upgrade ? "upgrade" : "install", ...plan }, null, 2));
   if (options.planOnly) return { status: "planned", plan };
   if (!plan.ready) throw new Error(plan.blockers.join(" "));
+  const installationPath = resolve(projectRoot, ".safest/installation.json");
+  const databaseConfigured = await hasDatabaseId();
+  const installationRecorded = await fileExists(installationPath);
+  const setupState = setupInstallationState({ databaseConfigured, installationRecorded });
+  if (options.upgrade && !databaseConfigured) throw new Error("upgrade requires an existing D1 database_id in wrangler.jsonc");
+  if (!options.upgrade && setupState === "installed") {
+    throw new Error("setup is already complete; use npm run owner:setup for a new owner link or npm run upgrade for an existing installation");
+  }
+  if (!options.upgrade && setupState === "inconsistent") {
+    throw new Error("the installation receipt exists but wrangler.jsonc has no D1 database_id; restore the database configuration before continuing");
+  }
+  if (!options.upgrade && setupState === "resume") {
+    console.log("\nInterrupted installation detected. Reusing the saved authentication choices and exact Cloudflare resources, then continuing setup.");
+  }
   const interactive = process.stdin.isTTY && !options.yes;
   const authentication = await ensureWranglerAuthentication({ wrangler, projectRoot, interactive });
   const accountSelection = await chooseCloudflareAccount({
@@ -127,7 +205,7 @@ export async function deployReports(argv = process.argv.slice(2)) {
     await initializeSecrets(secretsPath);
     console.log(`Created ${secretsPath} with generated owner-only secrets.`);
   }
-  if (!options.upgrade) {
+  if (!options.upgrade && setupState === "fresh") {
     const configured = await configureAuthentication({
       configPath: resolve(projectRoot, options.config),
       secretsPath,
@@ -144,10 +222,7 @@ export async function deployReports(argv = process.argv.slice(2)) {
     wranglerToken: authentication.token,
   });
   console.log(`\nReporter replies will route through ${reporterRouting.address}; plus-addressing is enabled and no catch-all is created.`);
-  const databaseConfigured = await hasDatabaseId();
-  if (options.upgrade && !databaseConfigured) throw new Error("upgrade requires an existing D1 database_id in wrangler.jsonc");
-  if (!options.upgrade && databaseConfigured) throw new Error("this project already has a D1 database_id; use npm run upgrade instead of setup");
-  if (!options.upgrade) {
+  if (!options.upgrade && setupState === "fresh") {
     await runWrangler(["d1", "create", config.resources.databaseName, "--binding", "DB", "--update-config"], "Create the customer-owned D1 database");
   }
   await ensureWranglerResource(["r2", "bucket", "create", config.resources.profileMediaBucketName], "Ensure the private profile-media R2 bucket exists");
@@ -157,9 +232,13 @@ export async function deployReports(argv = process.argv.slice(2)) {
   await ensureWranglerResource(["queues", "create", config.resources.reportQueueName], "Ensure the report jobs Queue exists");
   await ensureWranglerResource(["queues", "create", config.resources.deliveryQueueName], "Ensure the delivery jobs Queue exists");
   await ensureWranglerResource(["queues", "create", config.resources.operationsDlqName], "Ensure the operations dead-letter Queue exists");
-  await runWrangler(["d1", "migrations", "apply", "DB", "--remote"], "Apply forward-only report migrations");
-  await runWrangler(["deploy", "--secrets-file", secretsPath, "--strict"], "Deploy the reports Worker and bindings");
-  const installationPath = resolve(projectRoot, ".safest/installation.json");
+  await runWrangler(
+    ["d1", "migrations", "apply", "DB", "--remote"],
+    "Apply forward-only report migrations",
+    { stdin: "ignore" },
+  );
+  await deployWithAuthenticationRetry(["deploy", "--secrets-file", secretsPath, "--strict"], "Deploy the reports Worker and bindings");
+  const ownerSetup = options.upgrade ? null : await issueOwnerSetup({ config });
   await mkdir(dirname(installationPath), { recursive: true, mode: 0o700 });
   await writeFile(installationPath, `${JSON.stringify({
     schemaVersion: 2,
@@ -168,9 +247,9 @@ export async function deployReports(argv = process.argv.slice(2)) {
     resources: config.resources,
     ownerEmail: config.owner.email,
   }, null, 2)}\n`, { mode: 0o600 });
-  if (!options.upgrade) printOwnerSetup(await issueOwnerSetup({ config }));
+  if (ownerSetup) printOwnerSetup(ownerSetup);
   console.log("\nDeployment finished. Open the one-time owner setup link, run the authenticated setup feature checks until /ready succeeds, invite an administrator and analyst, then verify one server report and Queue consumption before production traffic.");
-  return { status: "deployed", plan };
+  return { status: "deployed", plan, resumed: !options.upgrade && setupState === "resume" };
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {