create-safest-tools 0.5.0 → 0.5.2

package/README.md

@@ -18,7 +18,7 @@ npx create-safest-tools safest-resolve \
   --email-from reports@example.com
 ```
 
-The `--email-from` address is a real, receivable mailbox used for reporter receipts, follow-ups, outcomes, and replies. Use a short base address such as `reports@example.com` on a domain onboarded under Cloudflare Email Service → Email Sending, then enable Email Routing for that domain. Setup creates an exact Worker route for this address, enables plus-addressing for signed case replies, and does not enable catch-all mail. Account verification, invitations, and password recovery use a distinct `accounts@` address on the same domain by default; pass `--auth-email-from` to choose another address.
+The `--email-from` address is a real, receivable mailbox used for receipts, follow-ups, outcomes, and replies from reporters or affected users. Use a short base address such as `reports@example.com` on a domain onboarded under Cloudflare Email Service → Email Sending, then enable Email Routing for that domain. Setup creates an exact Worker route for this address, enables plus-addressing for signed case replies, and does not enable catch-all mail. Account verification, invitations, and password recovery use a distinct `accounts@` address on the same domain by default; pass `--auth-email-from` to choose another address. Every customer-facing email automatically uses the organization name, logo, colors, type, and spacing saved under Configuration → Branding.
 
 The command creates a local project and prints a read-only infrastructure plan. It does not change Cloudflare unless `--deploy` is supplied or the generated project’s `npm run setup` command is run and explicitly confirmed.
 
@@ -44,7 +44,7 @@ npm run setup:plan
 npm run setup
 ```
 
-`setup:plan` lists exact resource names and the reporter email route, then exits without modifying Cloudflare. `setup` opens Wrangler's Cloudflare login when needed, lets you choose the owning account, and verifies Workers Paid from the account's Workers usage model. Standard accounts need no separate billing token; only legacy or ambiguous account models use the temporary Billing Read fallback. It then guides Google, GitHub, and Cloudflare OAuth configuration with exact callback URLs and masked secret input. Nothing is provisioned until the exact `DEPLOY <installation-id>` confirmation. After confirmation it verifies Email Routing, enables subaddressing, and deploys only the exact reporter-address route.
+`setup:plan` lists exact resource names and the reporter email route, then exits without modifying Cloudflare. `setup` opens Wrangler's Cloudflare login when needed, lets you choose the owning account, and verifies Workers Paid from the account's Workers usage model. Standard accounts need no separate billing token; only legacy or ambiguous account models use the temporary Billing Read fallback. It then guides Google, GitHub, and Cloudflare OAuth configuration with exact callback URLs and masked secret input. Nothing is provisioned until the exact `DEPLOY <installation-id>` confirmation. After confirmation it verifies Email Routing, enables subaddressing, and deploys only the exact reporter-address route. If Cloudflare interrupts the deployment, run `npm run setup` again; it detects the unfinished installation, reuses the saved authentication choices and exact resources, suppresses expected already-exists errors, and continues through the owner-link step.
 
 A new installation applies one current D1 schema baseline. Later releases add only forward-compatible upgrade migrations.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-safest-tools",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Create customer-owned abuse-reporting infrastructure on Cloudflare",
   "type": "module",
   "license": "Apache-2.0",

package/src/config.mjs

@@ -158,7 +158,7 @@ export function buildWranglerConfiguration(config) {
       OPERATOR_NOTIFICATION_WEBHOOK_URL: "",
       AUTH_EMAIL_FROM: email.auth,
       REPORTER_EMAIL_FROM: email.reporter,
-      REPORTER_EMAIL_SUBJECT_PREFIX: "Safest report update",
+      REPORTER_EMAIL_SUBJECT_PREFIX: "",
     },
     triggers: { crons: ["*/5 * * * *"] },
   };

package/template/README.md

@@ -10,7 +10,7 @@ Before deployment:
 
 1. Review `reports.config.json` and `npm run setup:plan`.
 2. Under Cloudflare Email Service → Email Sending, onboard the configured sender domain. Enable Email Routing for that domain and use a real reporter mailbox such as `reports@example.com`; setup creates only that exact Worker route, enables plus-addressing for signed case replies, and never enables catch-all routing. Reporter updates and account mail use separate sender addresses and sender-restricted bindings.
-3. Run `npm run setup`. The guided setup signs in through Wrangler and verifies Workers Paid from the account's Workers usage model before provisioning. Standard accounts need no separate billing token; only legacy or ambiguous models use the temporary Billing Read fallback. Setup then creates owner-only local secrets and walks through optional Google, GitHub, and Cloudflare OAuth credentials with exact callback URLs.
+3. Run `npm run setup`. The guided setup signs in through Wrangler and verifies Workers Paid from the account's Workers usage model before provisioning. Standard accounts need no separate billing token; only legacy or ambiguous models use the temporary Billing Read fallback. Setup then creates owner-only local secrets and walks through optional Google, GitHub, and Cloudflare OAuth credentials with exact callback URLs. If Cloudflare interrupts deployment, run the same command again: setup detects the unfinished installation, reuses the saved choices and exact resources, skips the repeated OAuth questions, and continues to the owner link.
 4. Type the exact installation confirmation when setup requests it. After deployment, setup prints a 256-bit, single-use owner link that expires after 15 minutes and is never written to disk.
 5. Open the owner link, create the Safest owner account, then invite administrators and analysts from People. Nobody needs a Cloudflare account to sign in. Names and workspace roles are always displayed separately.
 

package/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safest-resolve-installation",
-  "version": "0.5.0",
-  "safestToolsVersion": "0.5.0-resolve",
+  "version": "0.5.2",
+  "safestToolsVersion": "0.5.2-resolve",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
@@ -46,5 +46,9 @@
   },
   "engines": {
     "node": ">=20.12.0"
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "workerd": true
   }
 }

package/template/scripts/reports-deploy.mjs

@@ -37,36 +37,83 @@ function parseArguments(argv) {
   return result;
 }
 
-function runWrangler(args, label) {
+function runWrangler(args, label, { stdin = "inherit" } = {}) {
   return new Promise((resolvePromise, reject) => {
     console.log(`\n${label}`);
-    const child = spawn(process.execPath, [wrangler, ...args], { cwd: projectRoot, env: process.env, stdio: "inherit" });
+    const child = spawn(process.execPath, [wrangler, ...args], {
+      cwd: projectRoot,
+      env: process.env,
+      stdio: [stdin, "inherit", "inherit"],
+    });
     child.once("error", reject);
     child.once("exit", (code, signal) => code === 0 ? resolvePromise() : reject(new Error(`${label} failed${signal ? ` with signal ${signal}` : ` with exit code ${code}`}`)));
   });
 }
 
+function captureWrangler(args, { stdin = "ignore" } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [wrangler, ...args], {
+      cwd: projectRoot,
+      env: process.env,
+      stdio: [stdin, "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolvePromise({ code, signal, stdout, stderr, output: `${stdout}\n${stderr}` }));
+  });
+}
+
+function printWranglerOutput({ stdout, stderr }) {
+  if (stdout) process.stdout.write(stdout);
+  if (stderr) process.stderr.write(stderr);
+}
+
 export function isExistingResourceError(output) {
   return /already exists|already (?:been )?taken|duplicate resource/iu.test(output);
 }
 
-function ensureWranglerResource(args, label) {
-  return new Promise((resolvePromise, reject) => {
-    console.log(`\n${label}`);
-    const child = spawn(process.execPath, [wrangler, ...args], { cwd: projectRoot, env: process.env, stdio: ["inherit", "pipe", "pipe"] });
-    let output = "";
-    child.stdout.on("data", (chunk) => { output += chunk; process.stdout.write(chunk); });
-    child.stderr.on("data", (chunk) => { output += chunk; process.stderr.write(chunk); });
-    child.once("error", reject);
-    child.once("exit", (code, signal) => {
-      if (code === 0) return resolvePromise();
-      if (isExistingResourceError(output)) {
-        console.log("Resource already exists; reusing the exact configured name.");
-        return resolvePromise();
-      }
-      reject(new Error(`${label} failed${signal ? ` with signal ${signal}` : ` with exit code ${code}`}`));
-    });
-  });
+export function isTransientWranglerAuthenticationError(output) {
+  return /authentication error[\s\S]{0,200}(?:code\s*:\s*10000|\[code:\s*10000\])/iu.test(output);
+}
+
+async function ensureWranglerResource(args, label) {
+  console.log(`\n${label}`);
+  const result = await captureWrangler(args);
+  if (result.code === 0) {
+    console.log("Created the exact configured resource.");
+    return;
+  }
+  if (isExistingResourceError(result.output)) {
+    console.log("Already exists; reusing the exact configured resource.");
+    return;
+  }
+  printWranglerOutput(result);
+  throw new Error(`${label} failed${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+}
+
+async function deployWithAuthenticationRetry(args, label) {
+  console.log(`\n${label}`);
+  let result = await captureWrangler(args, { stdin: "inherit" });
+  if (result.code === 0) {
+    printWranglerOutput(result);
+    return;
+  }
+  if (!isTransientWranglerAuthenticationError(result.output)) {
+    printWranglerOutput(result);
+    throw new Error(`${label} failed${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+  }
+
+  console.log("Cloudflare rejected the upload token. Refreshing Wrangler authentication and retrying once.");
+  await runWrangler(["whoami"], "Refresh Cloudflare authentication");
+  console.log(`\n${label} (automatic retry 1 of 1)`);
+  result = await captureWrangler(args, { stdin: "inherit" });
+  printWranglerOutput(result);
+  if (result.code !== 0) {
+    throw new Error(`${label} failed after one automatic authentication retry${result.signal ? ` with signal ${result.signal}` : ` with exit code ${result.code}`}`);
+  }
 }
 
 async function validateSecrets(path, config) {
@@ -88,6 +135,23 @@ async function hasDatabaseId() {
   return typeof config?.d1_databases?.[0]?.database_id === "string" && config.d1_databases[0].database_id.length > 0;
 }
 
+async function fileExists(path) {
+  try {
+    await readFile(path);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+export function setupInstallationState({ databaseConfigured, installationRecorded }) {
+  if (installationRecorded && !databaseConfigured) return "inconsistent";
+  if (installationRecorded) return "installed";
+  if (databaseConfigured) return "resume";
+  return "fresh";
+}
+
 async function confirmation(installationId, yes) {
   if (yes) return;
   if (!process.stdin.isTTY) throw new Error("interactive confirmation is required; use --yes only after reviewing setup:plan");
@@ -105,6 +169,20 @@ export async function deployReports(argv = process.argv.slice(2)) {
   console.log(JSON.stringify({ action: options.upgrade ? "upgrade" : "install", ...plan }, null, 2));
   if (options.planOnly) return { status: "planned", plan };
   if (!plan.ready) throw new Error(plan.blockers.join(" "));
+  const installationPath = resolve(projectRoot, ".safest/installation.json");
+  const databaseConfigured = await hasDatabaseId();
+  const installationRecorded = await fileExists(installationPath);
+  const setupState = setupInstallationState({ databaseConfigured, installationRecorded });
+  if (options.upgrade && !databaseConfigured) throw new Error("upgrade requires an existing D1 database_id in wrangler.jsonc");
+  if (!options.upgrade && setupState === "installed") {
+    throw new Error("setup is already complete; use npm run owner:setup for a new owner link or npm run upgrade for an existing installation");
+  }
+  if (!options.upgrade && setupState === "inconsistent") {
+    throw new Error("the installation receipt exists but wrangler.jsonc has no D1 database_id; restore the database configuration before continuing");
+  }
+  if (!options.upgrade && setupState === "resume") {
+    console.log("\nInterrupted installation detected. Reusing the saved authentication choices and exact Cloudflare resources, then continuing setup.");
+  }
   const interactive = process.stdin.isTTY && !options.yes;
   const authentication = await ensureWranglerAuthentication({ wrangler, projectRoot, interactive });
   const accountSelection = await chooseCloudflareAccount({
@@ -127,7 +205,7 @@ export async function deployReports(argv = process.argv.slice(2)) {
     await initializeSecrets(secretsPath);
     console.log(`Created ${secretsPath} with generated owner-only secrets.`);
   }
-  if (!options.upgrade) {
+  if (!options.upgrade && setupState === "fresh") {
     const configured = await configureAuthentication({
       configPath: resolve(projectRoot, options.config),
       secretsPath,
@@ -144,10 +222,7 @@ export async function deployReports(argv = process.argv.slice(2)) {
     wranglerToken: authentication.token,
   });
   console.log(`\nReporter replies will route through ${reporterRouting.address}; plus-addressing is enabled and no catch-all is created.`);
-  const databaseConfigured = await hasDatabaseId();
-  if (options.upgrade && !databaseConfigured) throw new Error("upgrade requires an existing D1 database_id in wrangler.jsonc");
-  if (!options.upgrade && databaseConfigured) throw new Error("this project already has a D1 database_id; use npm run upgrade instead of setup");
-  if (!options.upgrade) {
+  if (!options.upgrade && setupState === "fresh") {
     await runWrangler(["d1", "create", config.resources.databaseName, "--binding", "DB", "--update-config"], "Create the customer-owned D1 database");
   }
   await ensureWranglerResource(["r2", "bucket", "create", config.resources.profileMediaBucketName], "Ensure the private profile-media R2 bucket exists");
@@ -157,9 +232,13 @@ export async function deployReports(argv = process.argv.slice(2)) {
   await ensureWranglerResource(["queues", "create", config.resources.reportQueueName], "Ensure the report jobs Queue exists");
   await ensureWranglerResource(["queues", "create", config.resources.deliveryQueueName], "Ensure the delivery jobs Queue exists");
   await ensureWranglerResource(["queues", "create", config.resources.operationsDlqName], "Ensure the operations dead-letter Queue exists");
-  await runWrangler(["d1", "migrations", "apply", "DB", "--remote"], "Apply forward-only report migrations");
-  await runWrangler(["deploy", "--secrets-file", secretsPath, "--strict"], "Deploy the reports Worker and bindings");
-  const installationPath = resolve(projectRoot, ".safest/installation.json");
+  await runWrangler(
+    ["d1", "migrations", "apply", "DB", "--remote"],
+    "Apply forward-only report migrations",
+    { stdin: "ignore" },
+  );
+  await deployWithAuthenticationRetry(["deploy", "--secrets-file", secretsPath, "--strict"], "Deploy the reports Worker and bindings");
+  const ownerSetup = options.upgrade ? null : await issueOwnerSetup({ config });
   await mkdir(dirname(installationPath), { recursive: true, mode: 0o700 });
   await writeFile(installationPath, `${JSON.stringify({
     schemaVersion: 2,
@@ -168,9 +247,9 @@ export async function deployReports(argv = process.argv.slice(2)) {
     resources: config.resources,
     ownerEmail: config.owner.email,
   }, null, 2)}\n`, { mode: 0o600 });
-  if (!options.upgrade) printOwnerSetup(await issueOwnerSetup({ config }));
+  if (ownerSetup) printOwnerSetup(ownerSetup);
   console.log("\nDeployment finished. Open the one-time owner setup link, run the authenticated setup feature checks until /ready succeeds, invite an administrator and analyst, then verify one server report and Queue consumption before production traffic.");
-  return { status: "deployed", plan };
+  return { status: "deployed", plan, resumed: !options.upgrade && setupState === "resume" };
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/template/src/report-better-auth.ts

@@ -3,6 +3,9 @@ import { getMigrations } from "better-auth/db/migration";
 import { genericOAuth } from "better-auth/plugins";
 import type { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
 import { authenticationEmailBinding } from "./report-email";
+import { renderAuthenticationEmail } from "./report-email-template";
+import type { AuthenticationEmailKind } from "./report-email-template";
+import { loadWorkspaceBrand } from "./workspace-branding";
 
 const INVITATION_COOKIE = "safest_invitation";
 const INVITATION_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
@@ -255,36 +258,41 @@ async function identityMaySignIn(
   return { error: "account_unavailable", errorDescription: "This Safest Resolve account is unavailable." };
 }
 
-function escapeHtml(value: string): string {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
+type AuthenticationEmailMessage = {
+  to: string;
+  kind: AuthenticationEmailKind;
+  url: string;
+  role?: string;
+  expiresAt?: string;
+};
 
 async function sendAuthEmail(
   env: BetterAuthEnv,
-  message: { to: string; subject: string; heading: string; body: string; action: string; url: string },
+  message: AuthenticationEmailMessage,
 ): Promise<void> {
+  const brand = await loadWorkspaceBrand(env.DB);
+  const rendered = renderAuthenticationEmail({
+    brand,
+    kind: message.kind,
+    url: message.url,
+    ...(message.role ? { role: message.role } : {}),
+    ...(message.expiresAt ? { expiresAt: message.expiresAt } : {}),
+  });
   const email = authenticationEmailBinding(env);
   if (localDevelopment(env) && (!email || !env.AUTH_EMAIL_FROM)) {
-    console.info(`Local authentication email (${message.subject}) for ${message.to}: ${message.url}`);
+    console.info(`Local authentication email (${rendered.subject}) for ${message.to}: ${message.url}`);
     return;
   }
   if (!email || !env.AUTH_EMAIL_FROM) {
     throw new Error("Cloudflare Email Service and AUTH_EMAIL_FROM are required for authentication email.");
   }
-  const footer = "If you did not request this message, you can safely ignore it.";
-  const html = `<!doctype html><html><body style="font-family:system-ui,sans-serif;color:#171717">` +
-    `<h1 style="font-size:20px">${escapeHtml(message.heading)}</h1>` +
-    `<p>${escapeHtml(message.body)}</p>` +
-    `<p><a href="${escapeHtml(message.url)}" style="display:inline-block;padding:10px 16px;` +
-    `background:#171717;color:#fff;text-decoration:none;border-radius:6px">${escapeHtml(message.action)}</a></p>` +
-    `<p style="font-size:12px;color:#666">${escapeHtml(footer)}</p></body></html>`;
   await email.send({
-    from: { name: "Safest Resolve", email: env.AUTH_EMAIL_FROM },
+    from: { name: brand.organization_name, email: env.AUTH_EMAIL_FROM },
     to: message.to,
-    subject: message.subject,
-    text: `${message.heading}\n\n${message.body}\n\n${message.action}: ${message.url}\n\n${footer}`,
-    html,
+    subject: rendered.subject,
+    text: rendered.text,
+    html: rendered.html,
+    headers: { "X-Safest-Email-Type": message.kind },
   });
 }
 
@@ -369,25 +377,24 @@ export async function sendOperatorInvitationEmail(
   env: BetterAuthEnv,
   invitation: { email: string; inviteUrl: string; role: string; expiresAt: string },
 ): Promise<void> {
-  const role = invitation.role.replaceAll("_", " ");
   await sendAuthEmail(env, {
     to: invitation.email,
-    subject: "You are invited to Safest Resolve",
-    heading: "Join Safest Resolve",
-    body: `You were invited as ${role}. This single-use invitation expires ${new Date(invitation.expiresAt).toUTCString()}.`,
-    action: "Accept invitation",
+    kind: "invitation",
     url: invitation.inviteUrl,
+    role: invitation.role,
+    expiresAt: invitation.expiresAt,
   });
 }
 
-function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
+async function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
   const secret = authSecret(env);
   const baseURL = new URL(env.PUBLIC_BASE_URL).origin;
   const development = localDevelopment(env);
   const cloudflare = cloudflareProvider(env);
   const plugins = [genericOAuth({ config: cloudflare ? [cloudflare] : [] })];
+  const brand = await loadWorkspaceBrand(env.DB);
   return betterAuth({
-    appName: "Safest Resolve",
+    appName: brand.organization_name,
     baseURL,
     basePath: "/api/auth",
     trustedOrigins: development ? [baseURL, "http://localhost:*", "http://127.0.0.1:*"] : [baseURL],
@@ -430,10 +437,7 @@ function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
         const resetUrl = `${baseURL}/#reset=${encodeURIComponent(token)}`;
         await deliverAuthEmail(env, ctx, {
           to: user.email,
-          subject: "Reset your Safest Resolve password",
-          heading: "Reset your password",
-          body: "Use this one-time link within 30 minutes. Resetting your password signs out your other sessions.",
-          action: "Reset password",
+          kind: "password_reset",
           url: resetUrl,
         });
       },
@@ -447,10 +451,7 @@ function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
         if (await ownerSetupAllowsEmail(request, env, user.email)) return;
         await deliverAuthEmail(env, ctx, {
           to: user.email,
-          subject: "Verify your Safest Resolve email",
-          heading: "Verify your email",
-          body: "Confirm this address before signing in. This link expires in 24 hours and can be used once.",
-          action: "Verify email",
+          kind: "email_verification",
           url,
         });
       },
@@ -491,7 +492,7 @@ function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
 const migrationPromises = new WeakMap<object, Promise<void>>();
 
 function ensureBetterAuthMigrations(
-  auth: ReturnType<typeof createBetterAuth>,
+  auth: Awaited<ReturnType<typeof createBetterAuth>>,
   database: D1Database,
 ): Promise<void> {
   const key = database as unknown as object;
@@ -512,7 +513,7 @@ export async function handleBetterAuthRequest(
   env: BetterAuthEnv,
   ctx: ExecutionContext,
 ): Promise<Response> {
-  const auth = createBetterAuth(env, ctx);
+  const auth = await createBetterAuth(env, ctx);
   await ensureBetterAuthMigrations(auth, env.DB);
   return auth.handler(request);
 }
@@ -542,7 +543,7 @@ export async function resolveBetterAuthSession(
   request: Request,
   env: BetterAuthEnv,
 ): Promise<BetterAuthSession | null> {
-  const auth = createBetterAuth(env);
+  const auth = await createBetterAuth(env);
   await ensureBetterAuthMigrations(auth, env.DB);
   const session = await auth.api.getSession({ headers: request.headers });
   return session as BetterAuthSession | null;
@@ -552,7 +553,7 @@ export async function revokeBetterAuthSessionsForOperator(
   env: BetterAuthEnv,
   operatorUserId: string,
 ): Promise<number> {
-  const auth = createBetterAuth(env);
+  const auth = await createBetterAuth(env);
   await ensureBetterAuthMigrations(auth, env.DB);
   const result = await env.DB.prepare(`
     DELETE FROM auth_session

package/template/src/report-delivery.ts

@@ -495,6 +495,7 @@ async function processEmail(db: D1Database, deliveryId: string, env: Env): Promi
         fromAddress: from,
         publicReference: row.reportReference,
         signingSecret: env.CONTEXT_SIGNING_SECRET,
+        audience: row.audience,
         expiresAt: Math.floor(Date.now() / 1_000) + Math.max(
           Number.parseInt(env.REPORT_RETENTION_DAYS, 10) || 365,
           Number.parseInt(env.APPEAL_WINDOW_DAYS, 10) || 30,
@@ -503,7 +504,7 @@ async function processEmail(db: D1Database, deliveryId: string, env: Env): Promi
     ]);
     const rendered = renderReporterEmail({
       brand, body: row.body, reportReference: row.reportReference,
-      templateVersionId: row.templateVersionId, subjectPrefix: prefix,
+      templateVersionId: row.templateVersionId, subjectPrefix: prefix, audience: row.audience,
     });
     const result = await binding.send({
       to: email,

package/template/src/report-email-inbound.ts

@@ -12,6 +12,7 @@ interface ReplyReportRow {
   state: ReportState;
   participantId: string;
   contactCiphertext: string | null;
+  audience: "reporter" | "affected_user";
 }
 
 function now(): string {
@@ -102,16 +103,16 @@ export async function receiveReporterEmail(
   const report = await env.DB.prepare(`
     SELECT r.id, r.state, p.id AS participantId, p.contact_ciphertext AS contactCiphertext
     FROM reports r
-    JOIN report_participants p ON p.report_id = r.id AND p.audience = 'reporter'
+    JOIN report_participants p ON p.report_id = r.id AND p.audience = ?2
     WHERE r.public_reference = ?1
     LIMIT 1
-  `).bind(claim.publicReference).first<ReplyReportRow>();
+  `).bind(claim.publicReference, claim.audience).first<ReplyReportRow>();
   if (!report?.contactCiphertext) {
     await recordUnmatchedEmail(env.DB, message, "report_or_reporter_contact_missing");
     return { reportId: null, stored: false };
   }
   const expectedSender = (await decryptReportContact(
-    env.CREDENTIAL_ENCRYPTION_KEY, report.contactCiphertext, report.id, "reporter",
+    env.CREDENTIAL_ENCRYPTION_KEY, report.contactCiphertext, report.id, report.audience,
   )).trim().toLowerCase();
   if (!await secretsEqual(message.from.trim().toLowerCase(), expectedSender)) {
     await recordUnmatchedEmail(env.DB, message, "sender_mismatch");
@@ -145,8 +146,8 @@ export async function receiveReporterEmail(
       INSERT OR IGNORE INTO case_messages (
         id, report_id, audience, direction, sender_type, sender_id, body,
         automated, delivery_state, created_at, idempotency_key, audience_checked_at
-      ) VALUES (?1, ?2, 'reporter', 'inbound', 'reporter', ?3, ?4, 0, 'not_required', ?5, ?6, ?5)
-    `).bind(messageId, report.id, report.participantId, body, receivedAt, idempotencyKey),
+      ) VALUES (?1, ?2, ?3, 'inbound', ?3, ?4, ?5, 0, 'not_required', ?6, ?7, ?6)
+    `).bind(messageId, report.id, report.audience, report.participantId, body, receivedAt, idempotencyKey),
     env.DB.prepare(`UPDATE reports SET state = ?2, updated_at = ?3 WHERE id = ?1`).bind(report.id, targetState, receivedAt),
     env.DB.prepare(`
       INSERT OR IGNORE INTO audit_events (

package/template/src/report-email-template.ts

@@ -1,53 +1,279 @@
 import type { WorkspaceBrand } from "./workspace-branding";
 
+export type CaseEmailAudience = "reporter" | "affected_user";
+export type AuthenticationEmailKind = "invitation" | "password_reset" | "email_verification";
+
+export type RenderedEmail = {
+  subject: string;
+  text: string;
+  html: string;
+};
+
+type Detail = { label: string; value: string };
+
 function escapeHtml(value: string): string {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
     .replaceAll('"', "&quot;").replaceAll("'", "&#039;");
 }
 
-function kind(templateVersionId: string | null): "receipt" | "followup" | "outcome" {
+function messageHtml(value: string): string {
+  return escapeHtml(value).replaceAll("\n", "<br />");
+}
+
+function channelHost(url: string): string {
+  try { return new URL(url).hostname; } catch { return "the workspace address"; }
+}
+
+function readableUtc(value: string): string {
+  const date = new Date(value);
+  if (Number.isNaN(date.valueOf())) return value;
+  const weekdays = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+  const months = [
+    "January", "February", "March", "April", "May", "June",
+    "July", "August", "September", "October", "November", "December",
+  ];
+  return `${weekdays[date.getUTCDay()]}, ${date.getUTCDate()} ${months[date.getUTCMonth()]} ${date.getUTCFullYear()} `
+    + `at ${String(date.getUTCHours()).padStart(2, "0")}:${String(date.getUTCMinutes()).padStart(2, "0")} UTC`;
+}
+
+function roleDetails(role: string): { name: string; description: string } {
+  const roles: Record<string, { name: string; description: string }> = {
+    owner: { name: "Infrastructure owner", description: "Manage the deployment, workspace settings, and team access." },
+    administrator: { name: "Administrator", description: "Configure the workspace and manage team access." },
+    workflow_author: { name: "Workflow author", description: "Build, test, and publish safety workflows." },
+    reviewer: { name: "Analyst", description: "Review reports, contact reporters, and record decisions." },
+    appeal_reviewer: { name: "Appeal analyst", description: "Review appeals independently and communicate their outcomes." },
+    quality_reviewer: { name: "Quality reviewer", description: "Review decision quality and AI quality samples." },
+    operations: { name: "Operations", description: "Monitor and recover delivery and workflow operations." },
+    auditor: { name: "Auditor", description: "Review reports, outcomes, and audit history without changing them." },
+  };
+  return roles[role] ?? {
+    name: role.replaceAll("_", " ").replace(/^./u, (character) => character.toUpperCase()),
+    description: "Work with the safety team in this workspace.",
+  };
+}
+
+function relativeLuminance(hex: string): number {
+  const channels = [1, 3, 5].map((offset) => Number.parseInt(hex.slice(offset, offset + 2), 16) / 255)
+    .map((value) => value <= 0.04045 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4);
+  return 0.2126 * channels[0]! + 0.7152 * channels[1]! + 0.0722 * channels[2]!;
+}
+
+function contrast(left: string, right: string): number {
+  const [lighter, darker] = [relativeLuminance(left), relativeLuminance(right)].sort((a, b) => b - a);
+  return (lighter! + 0.05) / (darker! + 0.05);
+}
+
+function actionColors(brand: WorkspaceBrand): { background: string; foreground: string } {
+  if (contrast(brand.primary_color, brand.primary_contrast_color) >= 4.5) {
+    return { background: brand.primary_color, foreground: brand.primary_contrast_color };
+  }
+  const foreground = contrast(brand.primary_color, "#ffffff") >= contrast(brand.primary_color, "#111111")
+    ? "#ffffff" : "#111111";
+  return { background: brand.primary_color, foreground };
+}
+
+function logoHtml(brand: WorkspaceBrand): string {
+  if (brand.logo_url) {
+    return `<img src="${escapeHtml(brand.logo_url)}" width="44" alt="${escapeHtml(brand.logo_alt || brand.organization_name)}" `
+      + `style="display:block;width:auto;max-width:132px;height:auto;max-height:44px;border:0;outline:none;text-decoration:none" />`;
+  }
+  return `<span style="display:inline-block;width:42px;height:42px;line-height:42px;border-radius:${Math.min(brand.border_radius, 12)}px;`
+    + `background-color:${brand.primary_color};color:${actionColors(brand).foreground};font-size:18px;font-weight:700;text-align:center">`
+    + `${escapeHtml(brand.organization_name.slice(0, 1).toUpperCase())}</span>`;
+}
+
+function detailsHtml(brand: WorkspaceBrand, details: Detail[]): string {
+  if (!details.length) return "";
+  return `<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" `
+    + `style="margin:24px 0 0;border:1px solid ${brand.border_color};border-radius:${Math.min(brand.border_radius, 14)}px;background-color:${brand.background_color}">`
+    + details.map((detail, index) => `<tr><td class="detail-row detail-label" width="132" style="width:132px;padding:${index ? "12px 18px" : "16px 18px 12px"};`
+      + `${index ? `border-top:1px solid ${brand.border_color};` : ""}color:${brand.muted_color};font-size:13px;line-height:1.45;vertical-align:top;white-space:nowrap">`
+      + `${escapeHtml(detail.label)}</td><td class="detail-row detail-value" align="left" style="padding:${index ? "12px 18px 12px 0" : "16px 18px 12px 0"};`
+      + `${index ? `border-top:1px solid ${brand.border_color};` : ""}color:${brand.text_color};font-size:13px;line-height:1.45;font-weight:700;vertical-align:top">`
+      + `${escapeHtml(detail.value)}</td></tr>`).join("")
+    + "</table>";
+}
+
+function frame(input: {
+  brand: WorkspaceBrand;
+  subject: string;
+  preview: string;
+  category: string;
+  heading: string;
+  intro: string;
+  contentHtml: string;
+  details?: Detail[];
+  action?: { label: string; url: string };
+  afterActionHtml?: string;
+  footerHtml: string;
+}): string {
+  const { brand } = input;
+  const radius = Math.min(brand.border_radius, 16);
+  const button = actionColors(brand);
+  const action = input.action ? `<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="margin:28px 0 0"><tr>`
+    + `<td bgcolor="${button.background}" style="border-radius:${Math.min(radius, 10)}px;background-color:${button.background}">`
+    + `<a href="${escapeHtml(input.action.url)}" role="button" style="display:inline-block;min-width:148px;padding:14px 22px;border:1px solid ${button.background};`
+    + `border-radius:${Math.min(radius, 10)}px;background-color:${button.background};color:${button.foreground};font-size:15px;line-height:20px;font-weight:700;text-align:center;text-decoration:none">`
+    + `${escapeHtml(input.action.label)}</a></td></tr></table>` : "";
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="color-scheme" content="light"><meta name="supported-color-schemes" content="light"><title>${escapeHtml(input.subject)}</title>
+<style>@media only screen and (max-width:620px){.outer-pad{padding:0!important}.email-card{border-radius:0!important;border-left:0!important;border-right:0!important}.email-pad{padding-left:22px!important;padding-right:22px!important}.detail-row{display:block!important;width:auto!important;padding:10px 16px!important;text-align:left!important;white-space:normal!important}.detail-label{padding-bottom:3px!important}.detail-value{padding-top:0!important;border-top:0!important}}</style></head>
+<body bgcolor="${brand.background_color}" style="margin:0;padding:0;background-color:${brand.background_color};color:${brand.text_color};font-family:${escapeHtml(brand.body_font_family)};-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%">
+<div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(input.preview)}&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;</div>
+<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" bgcolor="${brand.background_color}" style="width:100%;background-color:${brand.background_color}"><tr><td class="outer-pad" align="center" style="padding:36px 16px">
+<table role="article" aria-roledescription="email" aria-label="${escapeHtml(input.subject)}" class="email-card" width="100%" cellspacing="0" cellpadding="0" border="0" bgcolor="${brand.surface_color}" style="width:100%;max-width:600px;background-color:${brand.surface_color};border:1px solid ${brand.border_color};border-radius:${radius}px;overflow:hidden">
+<tr><td height="6" bgcolor="${brand.primary_color}" style="height:6px;background-color:${brand.primary_color};font-size:0;line-height:0">&nbsp;</td></tr>
+<tr><td class="email-pad" style="padding:28px 34px 18px"><table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0"><tr><td width="56" valign="middle" style="width:56px">${logoHtml(brand)}</td><td valign="middle" style="padding-left:12px"><div style="color:${brand.text_color};font-size:16px;line-height:1.25;font-weight:700">${escapeHtml(brand.organization_name)}</div><div style="margin-top:3px;color:${brand.muted_color};font-size:12px;line-height:1.3;font-weight:700;letter-spacing:.06em;text-transform:uppercase">${escapeHtml(input.category)}</div></td></tr></table></td></tr>
+<tr><td class="email-pad" style="padding:14px 34px 32px"><h1 style="margin:0;color:${brand.text_color};font-family:${escapeHtml(brand.heading_font_family)};font-size:30px;line-height:1.18;font-weight:700;letter-spacing:-.01em">${escapeHtml(input.heading)}</h1>
+<p style="margin:16px 0 0;color:${brand.text_color};font-size:16px;line-height:1.65">${escapeHtml(input.intro)}</p>
+${input.contentHtml}${detailsHtml(brand, input.details ?? [])}${action}${input.afterActionHtml ?? ""}</td></tr>
+<tr><td class="email-pad" style="padding:22px 34px;border-top:1px solid ${brand.border_color};color:${brand.muted_color};font-size:12px;line-height:1.65">${input.footerHtml}</td></tr>
+</table></td></tr></table></body></html>`;
+}
+
+function caseKind(templateVersionId: string | null): "receipt" | "followup" | "outcome" | "appeal_outcome" {
   if (templateVersionId?.includes("received")) return "receipt";
+  if (templateVersionId?.startsWith("appeal-outcome")) return "appeal_outcome";
   if (templateVersionId?.includes("outcome")) return "outcome";
   return "followup";
 }
 
+function subjectIdentity(prefix: string, brand: WorkspaceBrand): string {
+  const value = prefix.trim();
+  return !value || ["safest report update", "report update"].includes(value.toLowerCase())
+    ? brand.organization_name : value;
+}
+
 export function renderReporterEmail(input: {
   brand: WorkspaceBrand;
   body: string;
   reportReference: string;
   templateVersionId: string | null;
   subjectPrefix: string;
-}): { subject: string; text: string; html: string } {
-  const messageKind = kind(input.templateVersionId);
-  const heading = messageKind === "receipt"
-    ? "We received your report"
-    : messageKind === "outcome" ? "An outcome is ready" : "A message from the safety team";
-  const preview = messageKind === "receipt"
-    ? `Your report ${input.reportReference} is now with the safety team.`
-    : `There is an update for report ${input.reportReference}.`;
-  const subject = messageKind === "receipt"
-    ? `${input.brand.organization_name} received your report — ${input.reportReference}`
-    : `${input.subjectPrefix} — ${input.reportReference}`;
-  const messageHtml = escapeHtml(input.body).replaceAll("\n", "<br />");
-  const logo = input.brand.logo_url
-    ? `<img src="${escapeHtml(input.brand.logo_url)}" width="40" alt="${escapeHtml(input.brand.logo_alt || input.brand.organization_name)}" style="display:block;max-width:120px;max-height:40px;border:0" />`
-    : `<span style="display:inline-block;width:36px;height:36px;line-height:36px;border-radius:10px;background:${input.brand.primary_color};color:${input.brand.primary_contrast_color};font-size:18px;font-weight:700;text-align:center">${escapeHtml(input.brand.organization_name.slice(0, 1).toUpperCase())}</span>`;
-  const html = `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(subject)}</title></head>
-<body style="margin:0;padding:0;background:${input.brand.background_color};color:${input.brand.text_color};font-family:Arial,Helvetica,sans-serif">
-<div style="display:none;max-height:0;overflow:hidden;opacity:0">${escapeHtml(preview)}</div>
-<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" style="background:${input.brand.background_color}"><tr><td align="center" style="padding:32px 16px">
-<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" style="max-width:600px;background:${input.brand.surface_color};border:1px solid ${input.brand.border_color};border-radius:${Math.min(input.brand.border_radius, 16)}px;overflow:hidden">
-<tr><td style="height:6px;background:${input.brand.primary_color};font-size:0">&nbsp;</td></tr>
-<tr><td style="padding:28px 32px 12px"><table role="presentation" width="100%" cellspacing="0" cellpadding="0"><tr><td>${logo}</td><td align="right" style="color:${input.brand.muted_color};font-size:13px;font-weight:700">${escapeHtml(input.brand.organization_name)}</td></tr></table></td></tr>
-<tr><td style="padding:12px 32px 8px"><h1 style="margin:0;font-size:26px;line-height:1.25;color:${input.brand.text_color};font-family:Georgia,'Times New Roman',serif">${escapeHtml(heading)}</h1></td></tr>
-<tr><td style="padding:12px 32px"><div style="padding:20px;border:1px solid ${input.brand.border_color};border-radius:${Math.min(input.brand.border_radius, 14)}px;background:${input.brand.background_color};font-size:16px;line-height:1.6;color:${input.brand.text_color}">${messageHtml}</div></td></tr>
-<tr><td style="padding:10px 32px 24px"><table role="presentation" width="100%" cellspacing="0" cellpadding="0"><tr><td style="color:${input.brand.muted_color};font-size:13px">Report reference</td><td align="right" style="color:${input.brand.text_color};font-size:13px;font-weight:700">${escapeHtml(input.reportReference)}</td></tr></table></td></tr>
-<tr><td style="padding:20px 32px;border-top:1px solid ${input.brand.border_color};color:${input.brand.muted_color};font-size:12px;line-height:1.55">Reply directly to this email to contact the safety team. Keep the reply address unchanged so your message reaches the correct case. This message contains only the information needed for your report update.</td></tr>
-</table></td></tr></table></body></html>`;
+  audience?: CaseEmailAudience;
+}): RenderedEmail {
+  const emailKind = caseKind(input.templateVersionId);
+  const audience = input.audience ?? "reporter";
+  const identity = subjectIdentity(input.subjectPrefix, input.brand);
+  const copy = emailKind === "receipt" ? {
+    category: "Report received",
+    heading: "We received your report",
+    intro: "Thank you for taking the time to report this. Our safety team has received the information you shared.",
+    subject: `${input.brand.organization_name} received your report — ${input.reportReference}`,
+    preview: `Your report ${input.reportReference} is now with the safety team.`,
+    status: "Received",
+  } : emailKind === "appeal_outcome" ? {
+    category: "Appeal outcome",
+    heading: "Your appeal has been reviewed",
+    intro: "The safety team has completed its review of the appeal and shared the decision below.",
+    subject: `${identity}: appeal outcome — ${input.reportReference}`,
+    preview: `An appeal outcome is available for ${input.reportReference}.`,
+    status: "Appeal reviewed",
+  } : emailKind === "outcome" ? {
+    category: "Report outcome",
+    heading: audience === "affected_user" ? "There’s an update on a report involving you" : "There’s an update on your report",
+    intro: "The safety team has completed a review and shared an update below.",
+    subject: `${identity}: report outcome — ${input.reportReference}`,
+    preview: `A report outcome is available for ${input.reportReference}.`,
+    status: "Reviewed",
+  } : {
+    category: "Safety team message",
+    heading: "A message from our safety team",
+    intro: audience === "affected_user"
+      ? "The safety team has sent you a message about a report involving you."
+      : "The safety team has sent you a message about your report.",
+    subject: `${identity}: safety team message — ${input.reportReference}`,
+    preview: `The safety team sent a message about ${input.reportReference}.`,
+    status: "Update available",
+  };
+  const replyCopy = "Reply directly to this email if you have a question or more information to share. Your reply will be added to the case for the safety team to review. Keep the reply address unchanged.";
+  const html = frame({
+    brand: input.brand,
+    subject: copy.subject,
+    preview: copy.preview,
+    category: copy.category,
+    heading: copy.heading,
+    intro: copy.intro,
+    contentHtml: `<div style="margin:24px 0 0;padding:20px;border-left:4px solid ${input.brand.accent_color};border-radius:${Math.min(input.brand.border_radius, 12)}px;background-color:${input.brand.background_color};color:${input.brand.text_color};font-size:16px;line-height:1.65">${messageHtml(input.body)}</div>`,
+    details: [
+      { label: "Report reference", value: input.reportReference },
+      { label: "Status", value: copy.status },
+    ],
+    footerHtml: `${escapeHtml(replyCopy)}<br><span style="display:inline-block;margin-top:8px">For privacy, this email includes only the information needed for this update.</span>`,
+  });
   return {
-    subject,
+    subject: copy.subject,
     html,
-    text: `${heading}\n\n${input.body}\n\nReport reference: ${input.reportReference}\n\nReply directly to this email to contact the safety team. Keep the reply address unchanged so your message reaches the correct case.`,
+    text: `${copy.heading}\n\n${copy.intro}\n\n${input.body}\n\nReport reference: ${input.reportReference}\nStatus: ${copy.status}\n\n${replyCopy}\n\nFor privacy, this email includes only the information needed for this update.`,
+  };
+}
+
+export function renderAuthenticationEmail(input: {
+  brand: WorkspaceBrand;
+  kind: AuthenticationEmailKind;
+  url: string;
+  role?: string;
+  expiresAt?: string;
+}): RenderedEmail {
+  const host = channelHost(input.url);
+  const role = roleDetails(input.role ?? "reviewer");
+  const expiration = input.expiresAt ? readableUtc(input.expiresAt) : "";
+  const copy = input.kind === "invitation" ? {
+    subject: `You’re invited to join ${input.brand.organization_name}`,
+    preview: `Accept your invitation to join ${input.brand.organization_name} as ${role.name}.`,
+    category: "Team invitation",
+    heading: `Join ${input.brand.organization_name}`,
+    intro: `You’ve been invited to join the ${input.brand.organization_name} safety workspace as ${role.name}.`,
+    details: [
+      { label: "Role", value: role.name },
+      { label: "Access", value: role.description },
+      ...(expiration ? [{ label: "Invitation expires", value: expiration }] : []),
+    ],
+    action: "Accept invitation",
+    security: "This secure invitation can be used once. If you were not expecting it, you can safely ignore this email.",
+  } : input.kind === "password_reset" ? {
+    subject: `Reset your ${input.brand.organization_name} password`,
+    preview: `Use this secure link to reset your ${input.brand.organization_name} password.`,
+    category: "Account security",
+    heading: "Reset your password",
+    intro: `We received a request to reset the password for your ${input.brand.organization_name} safety workspace account.`,
+    details: [{ label: "Link expires", value: "30 minutes" }],
+    action: "Reset password",
+    security: "This secure link can be used once. Resetting your password signs out your other sessions. If you did not request a password reset, ignore this email; your password will not change.",
+  } : {
+    subject: `Verify your email for ${input.brand.organization_name}`,
+    preview: `Confirm your email address to finish setting up your ${input.brand.organization_name} account.`,
+    category: "Account verification",
+    heading: "Verify your email address",
+    intro: `Confirm that this email address belongs to you to finish setting up your ${input.brand.organization_name} safety workspace account.`,
+    details: [{ label: "Link expires", value: "24 hours" }],
+    action: "Verify email address",
+    security: "This secure link can be used once. If you did not create this account, you can safely ignore this email.",
+  };
+  const afterAction = `<p style="margin:20px 0 0;color:${input.brand.muted_color};font-size:12px;line-height:1.6">`
+    + `If the button does not work, copy and paste this address into your browser:<br>`
+    + `<a href="${escapeHtml(input.url)}" style="color:${input.brand.primary_color};text-decoration:underline;word-break:break-all">${escapeHtml(input.url)}</a></p>`;
+  const footer = `${escapeHtml(copy.security)}<br><span style="display:inline-block;margin-top:8px">`
+    + `This account email was sent by ${escapeHtml(input.brand.organization_name)}. The secure link opens ${escapeHtml(host)}.</span>`
+    + `<br><span style="display:inline-block;margin-top:8px">This automated account email cannot accept replies. If you need help, contact your workspace administrator through your usual support channel.</span>`;
+  const detailText = copy.details.map((detail) => `${detail.label}: ${detail.value}`).join("\n");
+  return {
+    subject: copy.subject,
+    html: frame({
+      brand: input.brand,
+      subject: copy.subject,
+      preview: copy.preview,
+      category: copy.category,
+      heading: copy.heading,
+      intro: copy.intro,
+      contentHtml: "",
+      details: copy.details,
+      action: { label: copy.action, url: input.url },
+      afterActionHtml: afterAction,
+      footerHtml: footer,
+    }),
+    text: `${copy.heading}\n\n${copy.intro}\n\n${detailText}\n\n${copy.action}: ${input.url}\n\n${copy.security}\n\nThis account email was sent by ${input.brand.organization_name}. The secure link opens ${host}.\n\nThis automated account email cannot accept replies. If you need help, contact your workspace administrator through your usual support channel.`,
   };
 }

package/template/src/report-email.ts

@@ -5,6 +5,8 @@ export type AuthenticationEmailBinding = {
     subject: string;
     text: string;
     html: string;
+    replyTo?: string | { email: string; name?: string };
+    headers?: Record<string, string>;
   }): Promise<unknown>;
 };
 
@@ -55,14 +57,17 @@ export function reporterEmailFrom(env: unknown): string {
 export function reporterEmailSubjectPrefix(env: unknown): string {
   const bindings = emailEnvironment(env);
   return (bindings.REPORTER_EMAIL_SUBJECT_PREFIX ?? bindings.EMAIL_SUBJECT_PREFIX ?? "").trim().slice(0, 120)
-    || "Safest report update";
+    || "Report update";
 }
 
 export function reporterEmailConfigured(env: unknown): boolean {
   return Boolean(reporterEmailBinding(env) && reporterEmailFrom(env));
 }
 
-const replyTokenPattern = /^r1\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
+export type CaseReplyAudience = "reporter" | "affected_user";
+
+const legacyReplyTokenPattern = /^r1\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
+const replyTokenPattern = /^r2([ra])\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
 const encoder = new TextEncoder();
 
 function hex(bytes: Uint8Array): string {
@@ -86,12 +91,14 @@ export async function reporterReplyToken(input: {
   publicReference: string;
   expiresAt: number;
   signingSecret: string;
+  audience?: CaseReplyAudience;
 }): Promise<string> {
   const reference = input.publicReference.replace(/^RPT-/u, "").toLowerCase();
   if (!/^[a-z0-9_-]{16}$/u.test(reference)) throw new Error("The report reference cannot be used for an email reply token.");
   const expiry = input.expiresAt.toString(16).padStart(8, "0");
   if (!/^[0-9a-f]{8}$/u.test(expiry)) throw new Error("The reporter reply expiry is outside the supported range.");
-  const payload = `r1.${reference}.${expiry}`;
+  const audience = input.audience === "affected_user" ? "a" : "r";
+  const payload = `r2${audience}.${reference}.${expiry}`;
   return `${payload}.${hex(await replySignature(input.signingSecret, payload))}`;
 }
 
@@ -99,16 +106,24 @@ export async function verifyReporterReplyToken(
   token: string,
   signingSecret: string,
   currentTime = Math.floor(Date.now() / 1_000),
-): Promise<{ publicReference: string; expiresAt: number } | null> {
-  const match = replyTokenPattern.exec(token);
-  if (!match) return null;
-  const expiry = Number.parseInt(match[2]!, 16);
-  const supplied = Uint8Array.from(match[3]!.match(/.{2}/gu) ?? [], (pair) => Number.parseInt(pair, 16));
+): Promise<{ publicReference: string; expiresAt: number; audience: CaseReplyAudience } | null> {
+  const current = replyTokenPattern.exec(token);
+  const legacy = current ? null : legacyReplyTokenPattern.exec(token);
+  if (!current && !legacy) return null;
+  const reference = current?.[2] ?? legacy?.[1] ?? "";
+  const expiryHex = current?.[3] ?? legacy?.[2] ?? "";
+  const signatureHex = current?.[4] ?? legacy?.[3] ?? "";
+  const expiry = Number.parseInt(expiryHex, 16);
+  const supplied = Uint8Array.from(signatureHex.match(/.{2}/gu) ?? [], (pair) => Number.parseInt(pair, 16));
   if (!expiry || expiry <= currentTime) return null;
-  const payload = `r1.${match[1]}.${match[2]}`;
+  const payload = current ? `r2${current[1]}.${reference}.${expiryHex}` : `r1.${reference}.${expiryHex}`;
   const expected = await replySignature(signingSecret, payload);
   if (!constantTimeEqual(supplied, expected)) return null;
-  return { publicReference: `RPT-${match[1]!.toUpperCase()}`, expiresAt: expiry };
+  return {
+    publicReference: `RPT-${reference.toUpperCase()}`,
+    expiresAt: expiry,
+    audience: current?.[1] === "a" ? "affected_user" : "reporter",
+  };
 }
 
 export async function reporterReplyAddress(input: {
@@ -116,6 +131,7 @@ export async function reporterReplyAddress(input: {
   publicReference: string;
   signingSecret: string;
   expiresAt: number;
+  audience?: CaseReplyAudience;
 }): Promise<string> {
   const separator = input.fromAddress.lastIndexOf("@");
   if (separator < 1) throw new Error("The reporter email address is invalid.");

package/template/src/report-repository.ts

@@ -281,7 +281,8 @@ export async function createReport(
   const receiptMessageId = crypto.randomUUID();
   const receiptNoticeId = crypto.randomUUID();
   const receiptDeliveryId = crypto.randomUUID();
-  const receiptBody = `We received your report ${publicReference}. It is now with the safety team. We will email you when there is an update, and you can reply directly to any report email.`;
+  const receiptBody = "Thank you for speaking up. Our safety team will review the information you shared. "
+    + "We’ll email you here if we need more information or when there is an update.";
   const directEmail = Boolean(submission.reporter.email && options.emailEnabled);
   const webhookNotification = Boolean(!directEmail && options.notificationEnabled
     && (submission.reporter.email || submission.reporter.reference));