create-safest-tools 0.5.1 → 0.5.2

package/README.md

@@ -18,7 +18,7 @@ npx create-safest-tools safest-resolve \
   --email-from reports@example.com
 ```
 
-The `--email-from` address is a real, receivable mailbox used for reporter receipts, follow-ups, outcomes, and replies. Use a short base address such as `reports@example.com` on a domain onboarded under Cloudflare Email Service → Email Sending, then enable Email Routing for that domain. Setup creates an exact Worker route for this address, enables plus-addressing for signed case replies, and does not enable catch-all mail. Account verification, invitations, and password recovery use a distinct `accounts@` address on the same domain by default; pass `--auth-email-from` to choose another address.
+The `--email-from` address is a real, receivable mailbox used for receipts, follow-ups, outcomes, and replies from reporters or affected users. Use a short base address such as `reports@example.com` on a domain onboarded under Cloudflare Email Service → Email Sending, then enable Email Routing for that domain. Setup creates an exact Worker route for this address, enables plus-addressing for signed case replies, and does not enable catch-all mail. Account verification, invitations, and password recovery use a distinct `accounts@` address on the same domain by default; pass `--auth-email-from` to choose another address. Every customer-facing email automatically uses the organization name, logo, colors, type, and spacing saved under Configuration → Branding.
 
 The command creates a local project and prints a read-only infrastructure plan. It does not change Cloudflare unless `--deploy` is supplied or the generated project’s `npm run setup` command is run and explicitly confirmed.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-safest-tools",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Create customer-owned abuse-reporting infrastructure on Cloudflare",
   "type": "module",
   "license": "Apache-2.0",

package/src/config.mjs

@@ -158,7 +158,7 @@ export function buildWranglerConfiguration(config) {
       OPERATOR_NOTIFICATION_WEBHOOK_URL: "",
       AUTH_EMAIL_FROM: email.auth,
       REPORTER_EMAIL_FROM: email.reporter,
-      REPORTER_EMAIL_SUBJECT_PREFIX: "Safest report update",
+      REPORTER_EMAIL_SUBJECT_PREFIX: "",
     },
     triggers: { crons: ["*/5 * * * *"] },
   };

package/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safest-resolve-installation",
-  "version": "0.5.1",
-  "safestToolsVersion": "0.5.1-resolve",
+  "version": "0.5.2",
+  "safestToolsVersion": "0.5.2-resolve",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/src/report-better-auth.ts

@@ -3,6 +3,9 @@ import { getMigrations } from "better-auth/db/migration";
 import { genericOAuth } from "better-auth/plugins";
 import type { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
 import { authenticationEmailBinding } from "./report-email";
+import { renderAuthenticationEmail } from "./report-email-template";
+import type { AuthenticationEmailKind } from "./report-email-template";
+import { loadWorkspaceBrand } from "./workspace-branding";
 
 const INVITATION_COOKIE = "safest_invitation";
 const INVITATION_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
@@ -255,36 +258,41 @@ async function identityMaySignIn(
   return { error: "account_unavailable", errorDescription: "This Safest Resolve account is unavailable." };
 }
 
-function escapeHtml(value: string): string {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
+type AuthenticationEmailMessage = {
+  to: string;
+  kind: AuthenticationEmailKind;
+  url: string;
+  role?: string;
+  expiresAt?: string;
+};
 
 async function sendAuthEmail(
   env: BetterAuthEnv,
-  message: { to: string; subject: string; heading: string; body: string; action: string; url: string },
+  message: AuthenticationEmailMessage,
 ): Promise<void> {
+  const brand = await loadWorkspaceBrand(env.DB);
+  const rendered = renderAuthenticationEmail({
+    brand,
+    kind: message.kind,
+    url: message.url,
+    ...(message.role ? { role: message.role } : {}),
+    ...(message.expiresAt ? { expiresAt: message.expiresAt } : {}),
+  });
   const email = authenticationEmailBinding(env);
   if (localDevelopment(env) && (!email || !env.AUTH_EMAIL_FROM)) {
-    console.info(`Local authentication email (${message.subject}) for ${message.to}: ${message.url}`);
+    console.info(`Local authentication email (${rendered.subject}) for ${message.to}: ${message.url}`);
     return;
   }
   if (!email || !env.AUTH_EMAIL_FROM) {
     throw new Error("Cloudflare Email Service and AUTH_EMAIL_FROM are required for authentication email.");
   }
-  const footer = "If you did not request this message, you can safely ignore it.";
-  const html = `<!doctype html><html><body style="font-family:system-ui,sans-serif;color:#171717">` +
-    `<h1 style="font-size:20px">${escapeHtml(message.heading)}</h1>` +
-    `<p>${escapeHtml(message.body)}</p>` +
-    `<p><a href="${escapeHtml(message.url)}" style="display:inline-block;padding:10px 16px;` +
-    `background:#171717;color:#fff;text-decoration:none;border-radius:6px">${escapeHtml(message.action)}</a></p>` +
-    `<p style="font-size:12px;color:#666">${escapeHtml(footer)}</p></body></html>`;
   await email.send({
-    from: { name: "Safest Resolve", email: env.AUTH_EMAIL_FROM },
+    from: { name: brand.organization_name, email: env.AUTH_EMAIL_FROM },
     to: message.to,
-    subject: message.subject,
-    text: `${message.heading}\n\n${message.body}\n\n${message.action}: ${message.url}\n\n${footer}`,
-    html,
+    subject: rendered.subject,
+    text: rendered.text,
+    html: rendered.html,
+    headers: { "X-Safest-Email-Type": message.kind },
   });
 }
 
@@ -369,25 +377,24 @@ export async function sendOperatorInvitationEmail(
   env: BetterAuthEnv,
   invitation: { email: string; inviteUrl: string; role: string; expiresAt: string },
 ): Promise<void> {
-  const role = invitation.role.replaceAll("_", " ");
   await sendAuthEmail(env, {
     to: invitation.email,
-    subject: "You are invited to Safest Resolve",
-    heading: "Join Safest Resolve",
-    body: `You were invited as ${role}. This single-use invitation expires ${new Date(invitation.expiresAt).toUTCString()}.`,
-    action: "Accept invitation",
+    kind: "invitation",
     url: invitation.inviteUrl,
+    role: invitation.role,
+    expiresAt: invitation.expiresAt,
   });
 }
 
-function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
+async function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
   const secret = authSecret(env);
   const baseURL = new URL(env.PUBLIC_BASE_URL).origin;
   const development = localDevelopment(env);
   const cloudflare = cloudflareProvider(env);
   const plugins = [genericOAuth({ config: cloudflare ? [cloudflare] : [] })];
+  const brand = await loadWorkspaceBrand(env.DB);
   return betterAuth({
-    appName: "Safest Resolve",
+    appName: brand.organization_name,
     baseURL,
     basePath: "/api/auth",
     trustedOrigins: development ? [baseURL, "http://localhost:*", "http://127.0.0.1:*"] : [baseURL],
@@ -430,10 +437,7 @@ function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
         const resetUrl = `${baseURL}/#reset=${encodeURIComponent(token)}`;
         await deliverAuthEmail(env, ctx, {
           to: user.email,
-          subject: "Reset your Safest Resolve password",
-          heading: "Reset your password",
-          body: "Use this one-time link within 30 minutes. Resetting your password signs out your other sessions.",
-          action: "Reset password",
+          kind: "password_reset",
           url: resetUrl,
         });
       },
@@ -447,10 +451,7 @@ function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
         if (await ownerSetupAllowsEmail(request, env, user.email)) return;
         await deliverAuthEmail(env, ctx, {
           to: user.email,
-          subject: "Verify your Safest Resolve email",
-          heading: "Verify your email",
-          body: "Confirm this address before signing in. This link expires in 24 hours and can be used once.",
-          action: "Verify email",
+          kind: "email_verification",
           url,
         });
       },
@@ -491,7 +492,7 @@ function createBetterAuth(env: BetterAuthEnv, ctx?: ExecutionContext) {
 const migrationPromises = new WeakMap<object, Promise<void>>();
 
 function ensureBetterAuthMigrations(
-  auth: ReturnType<typeof createBetterAuth>,
+  auth: Awaited<ReturnType<typeof createBetterAuth>>,
   database: D1Database,
 ): Promise<void> {
   const key = database as unknown as object;
@@ -512,7 +513,7 @@ export async function handleBetterAuthRequest(
   env: BetterAuthEnv,
   ctx: ExecutionContext,
 ): Promise<Response> {
-  const auth = createBetterAuth(env, ctx);
+  const auth = await createBetterAuth(env, ctx);
   await ensureBetterAuthMigrations(auth, env.DB);
   return auth.handler(request);
 }
@@ -542,7 +543,7 @@ export async function resolveBetterAuthSession(
   request: Request,
   env: BetterAuthEnv,
 ): Promise<BetterAuthSession | null> {
-  const auth = createBetterAuth(env);
+  const auth = await createBetterAuth(env);
   await ensureBetterAuthMigrations(auth, env.DB);
   const session = await auth.api.getSession({ headers: request.headers });
   return session as BetterAuthSession | null;
@@ -552,7 +553,7 @@ export async function revokeBetterAuthSessionsForOperator(
   env: BetterAuthEnv,
   operatorUserId: string,
 ): Promise<number> {
-  const auth = createBetterAuth(env);
+  const auth = await createBetterAuth(env);
   await ensureBetterAuthMigrations(auth, env.DB);
   const result = await env.DB.prepare(`
     DELETE FROM auth_session

package/template/src/report-delivery.ts

@@ -495,6 +495,7 @@ async function processEmail(db: D1Database, deliveryId: string, env: Env): Promi
         fromAddress: from,
         publicReference: row.reportReference,
         signingSecret: env.CONTEXT_SIGNING_SECRET,
+        audience: row.audience,
         expiresAt: Math.floor(Date.now() / 1_000) + Math.max(
           Number.parseInt(env.REPORT_RETENTION_DAYS, 10) || 365,
           Number.parseInt(env.APPEAL_WINDOW_DAYS, 10) || 30,
@@ -503,7 +504,7 @@ async function processEmail(db: D1Database, deliveryId: string, env: Env): Promi
     ]);
     const rendered = renderReporterEmail({
       brand, body: row.body, reportReference: row.reportReference,
-      templateVersionId: row.templateVersionId, subjectPrefix: prefix,
+      templateVersionId: row.templateVersionId, subjectPrefix: prefix, audience: row.audience,
     });
     const result = await binding.send({
       to: email,

package/template/src/report-email-inbound.ts

@@ -12,6 +12,7 @@ interface ReplyReportRow {
   state: ReportState;
   participantId: string;
   contactCiphertext: string | null;
+  audience: "reporter" | "affected_user";
 }
 
 function now(): string {
@@ -102,16 +103,16 @@ export async function receiveReporterEmail(
   const report = await env.DB.prepare(`
     SELECT r.id, r.state, p.id AS participantId, p.contact_ciphertext AS contactCiphertext
     FROM reports r
-    JOIN report_participants p ON p.report_id = r.id AND p.audience = 'reporter'
+    JOIN report_participants p ON p.report_id = r.id AND p.audience = ?2
     WHERE r.public_reference = ?1
     LIMIT 1
-  `).bind(claim.publicReference).first<ReplyReportRow>();
+  `).bind(claim.publicReference, claim.audience).first<ReplyReportRow>();
   if (!report?.contactCiphertext) {
     await recordUnmatchedEmail(env.DB, message, "report_or_reporter_contact_missing");
     return { reportId: null, stored: false };
   }
   const expectedSender = (await decryptReportContact(
-    env.CREDENTIAL_ENCRYPTION_KEY, report.contactCiphertext, report.id, "reporter",
+    env.CREDENTIAL_ENCRYPTION_KEY, report.contactCiphertext, report.id, report.audience,
   )).trim().toLowerCase();
   if (!await secretsEqual(message.from.trim().toLowerCase(), expectedSender)) {
     await recordUnmatchedEmail(env.DB, message, "sender_mismatch");
@@ -145,8 +146,8 @@ export async function receiveReporterEmail(
       INSERT OR IGNORE INTO case_messages (
         id, report_id, audience, direction, sender_type, sender_id, body,
         automated, delivery_state, created_at, idempotency_key, audience_checked_at
-      ) VALUES (?1, ?2, 'reporter', 'inbound', 'reporter', ?3, ?4, 0, 'not_required', ?5, ?6, ?5)
-    `).bind(messageId, report.id, report.participantId, body, receivedAt, idempotencyKey),
+      ) VALUES (?1, ?2, ?3, 'inbound', ?3, ?4, ?5, 0, 'not_required', ?6, ?7, ?6)
+    `).bind(messageId, report.id, report.audience, report.participantId, body, receivedAt, idempotencyKey),
     env.DB.prepare(`UPDATE reports SET state = ?2, updated_at = ?3 WHERE id = ?1`).bind(report.id, targetState, receivedAt),
     env.DB.prepare(`
       INSERT OR IGNORE INTO audit_events (

package/template/src/report-email-template.ts

@@ -1,53 +1,279 @@
 import type { WorkspaceBrand } from "./workspace-branding";
 
+export type CaseEmailAudience = "reporter" | "affected_user";
+export type AuthenticationEmailKind = "invitation" | "password_reset" | "email_verification";
+
+export type RenderedEmail = {
+  subject: string;
+  text: string;
+  html: string;
+};
+
+type Detail = { label: string; value: string };
+
 function escapeHtml(value: string): string {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
     .replaceAll('"', "&quot;").replaceAll("'", "&#039;");
 }
 
-function kind(templateVersionId: string | null): "receipt" | "followup" | "outcome" {
+function messageHtml(value: string): string {
+  return escapeHtml(value).replaceAll("\n", "<br />");
+}
+
+function channelHost(url: string): string {
+  try { return new URL(url).hostname; } catch { return "the workspace address"; }
+}
+
+function readableUtc(value: string): string {
+  const date = new Date(value);
+  if (Number.isNaN(date.valueOf())) return value;
+  const weekdays = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+  const months = [
+    "January", "February", "March", "April", "May", "June",
+    "July", "August", "September", "October", "November", "December",
+  ];
+  return `${weekdays[date.getUTCDay()]}, ${date.getUTCDate()} ${months[date.getUTCMonth()]} ${date.getUTCFullYear()} `
+    + `at ${String(date.getUTCHours()).padStart(2, "0")}:${String(date.getUTCMinutes()).padStart(2, "0")} UTC`;
+}
+
+function roleDetails(role: string): { name: string; description: string } {
+  const roles: Record<string, { name: string; description: string }> = {
+    owner: { name: "Infrastructure owner", description: "Manage the deployment, workspace settings, and team access." },
+    administrator: { name: "Administrator", description: "Configure the workspace and manage team access." },
+    workflow_author: { name: "Workflow author", description: "Build, test, and publish safety workflows." },
+    reviewer: { name: "Analyst", description: "Review reports, contact reporters, and record decisions." },
+    appeal_reviewer: { name: "Appeal analyst", description: "Review appeals independently and communicate their outcomes." },
+    quality_reviewer: { name: "Quality reviewer", description: "Review decision quality and AI quality samples." },
+    operations: { name: "Operations", description: "Monitor and recover delivery and workflow operations." },
+    auditor: { name: "Auditor", description: "Review reports, outcomes, and audit history without changing them." },
+  };
+  return roles[role] ?? {
+    name: role.replaceAll("_", " ").replace(/^./u, (character) => character.toUpperCase()),
+    description: "Work with the safety team in this workspace.",
+  };
+}
+
+function relativeLuminance(hex: string): number {
+  const channels = [1, 3, 5].map((offset) => Number.parseInt(hex.slice(offset, offset + 2), 16) / 255)
+    .map((value) => value <= 0.04045 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4);
+  return 0.2126 * channels[0]! + 0.7152 * channels[1]! + 0.0722 * channels[2]!;
+}
+
+function contrast(left: string, right: string): number {
+  const [lighter, darker] = [relativeLuminance(left), relativeLuminance(right)].sort((a, b) => b - a);
+  return (lighter! + 0.05) / (darker! + 0.05);
+}
+
+function actionColors(brand: WorkspaceBrand): { background: string; foreground: string } {
+  if (contrast(brand.primary_color, brand.primary_contrast_color) >= 4.5) {
+    return { background: brand.primary_color, foreground: brand.primary_contrast_color };
+  }
+  const foreground = contrast(brand.primary_color, "#ffffff") >= contrast(brand.primary_color, "#111111")
+    ? "#ffffff" : "#111111";
+  return { background: brand.primary_color, foreground };
+}
+
+function logoHtml(brand: WorkspaceBrand): string {
+  if (brand.logo_url) {
+    return `<img src="${escapeHtml(brand.logo_url)}" width="44" alt="${escapeHtml(brand.logo_alt || brand.organization_name)}" `
+      + `style="display:block;width:auto;max-width:132px;height:auto;max-height:44px;border:0;outline:none;text-decoration:none" />`;
+  }
+  return `<span style="display:inline-block;width:42px;height:42px;line-height:42px;border-radius:${Math.min(brand.border_radius, 12)}px;`
+    + `background-color:${brand.primary_color};color:${actionColors(brand).foreground};font-size:18px;font-weight:700;text-align:center">`
+    + `${escapeHtml(brand.organization_name.slice(0, 1).toUpperCase())}</span>`;
+}
+
+function detailsHtml(brand: WorkspaceBrand, details: Detail[]): string {
+  if (!details.length) return "";
+  return `<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" `
+    + `style="margin:24px 0 0;border:1px solid ${brand.border_color};border-radius:${Math.min(brand.border_radius, 14)}px;background-color:${brand.background_color}">`
+    + details.map((detail, index) => `<tr><td class="detail-row detail-label" width="132" style="width:132px;padding:${index ? "12px 18px" : "16px 18px 12px"};`
+      + `${index ? `border-top:1px solid ${brand.border_color};` : ""}color:${brand.muted_color};font-size:13px;line-height:1.45;vertical-align:top;white-space:nowrap">`
+      + `${escapeHtml(detail.label)}</td><td class="detail-row detail-value" align="left" style="padding:${index ? "12px 18px 12px 0" : "16px 18px 12px 0"};`
+      + `${index ? `border-top:1px solid ${brand.border_color};` : ""}color:${brand.text_color};font-size:13px;line-height:1.45;font-weight:700;vertical-align:top">`
+      + `${escapeHtml(detail.value)}</td></tr>`).join("")
+    + "</table>";
+}
+
+function frame(input: {
+  brand: WorkspaceBrand;
+  subject: string;
+  preview: string;
+  category: string;
+  heading: string;
+  intro: string;
+  contentHtml: string;
+  details?: Detail[];
+  action?: { label: string; url: string };
+  afterActionHtml?: string;
+  footerHtml: string;
+}): string {
+  const { brand } = input;
+  const radius = Math.min(brand.border_radius, 16);
+  const button = actionColors(brand);
+  const action = input.action ? `<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="margin:28px 0 0"><tr>`
+    + `<td bgcolor="${button.background}" style="border-radius:${Math.min(radius, 10)}px;background-color:${button.background}">`
+    + `<a href="${escapeHtml(input.action.url)}" role="button" style="display:inline-block;min-width:148px;padding:14px 22px;border:1px solid ${button.background};`
+    + `border-radius:${Math.min(radius, 10)}px;background-color:${button.background};color:${button.foreground};font-size:15px;line-height:20px;font-weight:700;text-align:center;text-decoration:none">`
+    + `${escapeHtml(input.action.label)}</a></td></tr></table>` : "";
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="color-scheme" content="light"><meta name="supported-color-schemes" content="light"><title>${escapeHtml(input.subject)}</title>
+<style>@media only screen and (max-width:620px){.outer-pad{padding:0!important}.email-card{border-radius:0!important;border-left:0!important;border-right:0!important}.email-pad{padding-left:22px!important;padding-right:22px!important}.detail-row{display:block!important;width:auto!important;padding:10px 16px!important;text-align:left!important;white-space:normal!important}.detail-label{padding-bottom:3px!important}.detail-value{padding-top:0!important;border-top:0!important}}</style></head>
+<body bgcolor="${brand.background_color}" style="margin:0;padding:0;background-color:${brand.background_color};color:${brand.text_color};font-family:${escapeHtml(brand.body_font_family)};-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%">
+<div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(input.preview)}&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;</div>
+<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" bgcolor="${brand.background_color}" style="width:100%;background-color:${brand.background_color}"><tr><td class="outer-pad" align="center" style="padding:36px 16px">
+<table role="article" aria-roledescription="email" aria-label="${escapeHtml(input.subject)}" class="email-card" width="100%" cellspacing="0" cellpadding="0" border="0" bgcolor="${brand.surface_color}" style="width:100%;max-width:600px;background-color:${brand.surface_color};border:1px solid ${brand.border_color};border-radius:${radius}px;overflow:hidden">
+<tr><td height="6" bgcolor="${brand.primary_color}" style="height:6px;background-color:${brand.primary_color};font-size:0;line-height:0">&nbsp;</td></tr>
+<tr><td class="email-pad" style="padding:28px 34px 18px"><table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0"><tr><td width="56" valign="middle" style="width:56px">${logoHtml(brand)}</td><td valign="middle" style="padding-left:12px"><div style="color:${brand.text_color};font-size:16px;line-height:1.25;font-weight:700">${escapeHtml(brand.organization_name)}</div><div style="margin-top:3px;color:${brand.muted_color};font-size:12px;line-height:1.3;font-weight:700;letter-spacing:.06em;text-transform:uppercase">${escapeHtml(input.category)}</div></td></tr></table></td></tr>
+<tr><td class="email-pad" style="padding:14px 34px 32px"><h1 style="margin:0;color:${brand.text_color};font-family:${escapeHtml(brand.heading_font_family)};font-size:30px;line-height:1.18;font-weight:700;letter-spacing:-.01em">${escapeHtml(input.heading)}</h1>
+<p style="margin:16px 0 0;color:${brand.text_color};font-size:16px;line-height:1.65">${escapeHtml(input.intro)}</p>
+${input.contentHtml}${detailsHtml(brand, input.details ?? [])}${action}${input.afterActionHtml ?? ""}</td></tr>
+<tr><td class="email-pad" style="padding:22px 34px;border-top:1px solid ${brand.border_color};color:${brand.muted_color};font-size:12px;line-height:1.65">${input.footerHtml}</td></tr>
+</table></td></tr></table></body></html>`;
+}
+
+function caseKind(templateVersionId: string | null): "receipt" | "followup" | "outcome" | "appeal_outcome" {
   if (templateVersionId?.includes("received")) return "receipt";
+  if (templateVersionId?.startsWith("appeal-outcome")) return "appeal_outcome";
   if (templateVersionId?.includes("outcome")) return "outcome";
   return "followup";
 }
 
+function subjectIdentity(prefix: string, brand: WorkspaceBrand): string {
+  const value = prefix.trim();
+  return !value || ["safest report update", "report update"].includes(value.toLowerCase())
+    ? brand.organization_name : value;
+}
+
 export function renderReporterEmail(input: {
   brand: WorkspaceBrand;
   body: string;
   reportReference: string;
   templateVersionId: string | null;
   subjectPrefix: string;
-}): { subject: string; text: string; html: string } {
-  const messageKind = kind(input.templateVersionId);
-  const heading = messageKind === "receipt"
-    ? "We received your report"
-    : messageKind === "outcome" ? "An outcome is ready" : "A message from the safety team";
-  const preview = messageKind === "receipt"
-    ? `Your report ${input.reportReference} is now with the safety team.`
-    : `There is an update for report ${input.reportReference}.`;
-  const subject = messageKind === "receipt"
-    ? `${input.brand.organization_name} received your report — ${input.reportReference}`
-    : `${input.subjectPrefix} — ${input.reportReference}`;
-  const messageHtml = escapeHtml(input.body).replaceAll("\n", "<br />");
-  const logo = input.brand.logo_url
-    ? `<img src="${escapeHtml(input.brand.logo_url)}" width="40" alt="${escapeHtml(input.brand.logo_alt || input.brand.organization_name)}" style="display:block;max-width:120px;max-height:40px;border:0" />`
-    : `<span style="display:inline-block;width:36px;height:36px;line-height:36px;border-radius:10px;background:${input.brand.primary_color};color:${input.brand.primary_contrast_color};font-size:18px;font-weight:700;text-align:center">${escapeHtml(input.brand.organization_name.slice(0, 1).toUpperCase())}</span>`;
-  const html = `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(subject)}</title></head>
-<body style="margin:0;padding:0;background:${input.brand.background_color};color:${input.brand.text_color};font-family:Arial,Helvetica,sans-serif">
-<div style="display:none;max-height:0;overflow:hidden;opacity:0">${escapeHtml(preview)}</div>
-<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" style="background:${input.brand.background_color}"><tr><td align="center" style="padding:32px 16px">
-<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" style="max-width:600px;background:${input.brand.surface_color};border:1px solid ${input.brand.border_color};border-radius:${Math.min(input.brand.border_radius, 16)}px;overflow:hidden">
-<tr><td style="height:6px;background:${input.brand.primary_color};font-size:0">&nbsp;</td></tr>
-<tr><td style="padding:28px 32px 12px"><table role="presentation" width="100%" cellspacing="0" cellpadding="0"><tr><td>${logo}</td><td align="right" style="color:${input.brand.muted_color};font-size:13px;font-weight:700">${escapeHtml(input.brand.organization_name)}</td></tr></table></td></tr>
-<tr><td style="padding:12px 32px 8px"><h1 style="margin:0;font-size:26px;line-height:1.25;color:${input.brand.text_color};font-family:Georgia,'Times New Roman',serif">${escapeHtml(heading)}</h1></td></tr>
-<tr><td style="padding:12px 32px"><div style="padding:20px;border:1px solid ${input.brand.border_color};border-radius:${Math.min(input.brand.border_radius, 14)}px;background:${input.brand.background_color};font-size:16px;line-height:1.6;color:${input.brand.text_color}">${messageHtml}</div></td></tr>
-<tr><td style="padding:10px 32px 24px"><table role="presentation" width="100%" cellspacing="0" cellpadding="0"><tr><td style="color:${input.brand.muted_color};font-size:13px">Report reference</td><td align="right" style="color:${input.brand.text_color};font-size:13px;font-weight:700">${escapeHtml(input.reportReference)}</td></tr></table></td></tr>
-<tr><td style="padding:20px 32px;border-top:1px solid ${input.brand.border_color};color:${input.brand.muted_color};font-size:12px;line-height:1.55">Reply directly to this email to contact the safety team. Keep the reply address unchanged so your message reaches the correct case. This message contains only the information needed for your report update.</td></tr>
-</table></td></tr></table></body></html>`;
+  audience?: CaseEmailAudience;
+}): RenderedEmail {
+  const emailKind = caseKind(input.templateVersionId);
+  const audience = input.audience ?? "reporter";
+  const identity = subjectIdentity(input.subjectPrefix, input.brand);
+  const copy = emailKind === "receipt" ? {
+    category: "Report received",
+    heading: "We received your report",
+    intro: "Thank you for taking the time to report this. Our safety team has received the information you shared.",
+    subject: `${input.brand.organization_name} received your report — ${input.reportReference}`,
+    preview: `Your report ${input.reportReference} is now with the safety team.`,
+    status: "Received",
+  } : emailKind === "appeal_outcome" ? {
+    category: "Appeal outcome",
+    heading: "Your appeal has been reviewed",
+    intro: "The safety team has completed its review of the appeal and shared the decision below.",
+    subject: `${identity}: appeal outcome — ${input.reportReference}`,
+    preview: `An appeal outcome is available for ${input.reportReference}.`,
+    status: "Appeal reviewed",
+  } : emailKind === "outcome" ? {
+    category: "Report outcome",
+    heading: audience === "affected_user" ? "There’s an update on a report involving you" : "There’s an update on your report",
+    intro: "The safety team has completed a review and shared an update below.",
+    subject: `${identity}: report outcome — ${input.reportReference}`,
+    preview: `A report outcome is available for ${input.reportReference}.`,
+    status: "Reviewed",
+  } : {
+    category: "Safety team message",
+    heading: "A message from our safety team",
+    intro: audience === "affected_user"
+      ? "The safety team has sent you a message about a report involving you."
+      : "The safety team has sent you a message about your report.",
+    subject: `${identity}: safety team message — ${input.reportReference}`,
+    preview: `The safety team sent a message about ${input.reportReference}.`,
+    status: "Update available",
+  };
+  const replyCopy = "Reply directly to this email if you have a question or more information to share. Your reply will be added to the case for the safety team to review. Keep the reply address unchanged.";
+  const html = frame({
+    brand: input.brand,
+    subject: copy.subject,
+    preview: copy.preview,
+    category: copy.category,
+    heading: copy.heading,
+    intro: copy.intro,
+    contentHtml: `<div style="margin:24px 0 0;padding:20px;border-left:4px solid ${input.brand.accent_color};border-radius:${Math.min(input.brand.border_radius, 12)}px;background-color:${input.brand.background_color};color:${input.brand.text_color};font-size:16px;line-height:1.65">${messageHtml(input.body)}</div>`,
+    details: [
+      { label: "Report reference", value: input.reportReference },
+      { label: "Status", value: copy.status },
+    ],
+    footerHtml: `${escapeHtml(replyCopy)}<br><span style="display:inline-block;margin-top:8px">For privacy, this email includes only the information needed for this update.</span>`,
+  });
   return {
-    subject,
+    subject: copy.subject,
     html,
-    text: `${heading}\n\n${input.body}\n\nReport reference: ${input.reportReference}\n\nReply directly to this email to contact the safety team. Keep the reply address unchanged so your message reaches the correct case.`,
+    text: `${copy.heading}\n\n${copy.intro}\n\n${input.body}\n\nReport reference: ${input.reportReference}\nStatus: ${copy.status}\n\n${replyCopy}\n\nFor privacy, this email includes only the information needed for this update.`,
+  };
+}
+
+export function renderAuthenticationEmail(input: {
+  brand: WorkspaceBrand;
+  kind: AuthenticationEmailKind;
+  url: string;
+  role?: string;
+  expiresAt?: string;
+}): RenderedEmail {
+  const host = channelHost(input.url);
+  const role = roleDetails(input.role ?? "reviewer");
+  const expiration = input.expiresAt ? readableUtc(input.expiresAt) : "";
+  const copy = input.kind === "invitation" ? {
+    subject: `You’re invited to join ${input.brand.organization_name}`,
+    preview: `Accept your invitation to join ${input.brand.organization_name} as ${role.name}.`,
+    category: "Team invitation",
+    heading: `Join ${input.brand.organization_name}`,
+    intro: `You’ve been invited to join the ${input.brand.organization_name} safety workspace as ${role.name}.`,
+    details: [
+      { label: "Role", value: role.name },
+      { label: "Access", value: role.description },
+      ...(expiration ? [{ label: "Invitation expires", value: expiration }] : []),
+    ],
+    action: "Accept invitation",
+    security: "This secure invitation can be used once. If you were not expecting it, you can safely ignore this email.",
+  } : input.kind === "password_reset" ? {
+    subject: `Reset your ${input.brand.organization_name} password`,
+    preview: `Use this secure link to reset your ${input.brand.organization_name} password.`,
+    category: "Account security",
+    heading: "Reset your password",
+    intro: `We received a request to reset the password for your ${input.brand.organization_name} safety workspace account.`,
+    details: [{ label: "Link expires", value: "30 minutes" }],
+    action: "Reset password",
+    security: "This secure link can be used once. Resetting your password signs out your other sessions. If you did not request a password reset, ignore this email; your password will not change.",
+  } : {
+    subject: `Verify your email for ${input.brand.organization_name}`,
+    preview: `Confirm your email address to finish setting up your ${input.brand.organization_name} account.`,
+    category: "Account verification",
+    heading: "Verify your email address",
+    intro: `Confirm that this email address belongs to you to finish setting up your ${input.brand.organization_name} safety workspace account.`,
+    details: [{ label: "Link expires", value: "24 hours" }],
+    action: "Verify email address",
+    security: "This secure link can be used once. If you did not create this account, you can safely ignore this email.",
+  };
+  const afterAction = `<p style="margin:20px 0 0;color:${input.brand.muted_color};font-size:12px;line-height:1.6">`
+    + `If the button does not work, copy and paste this address into your browser:<br>`
+    + `<a href="${escapeHtml(input.url)}" style="color:${input.brand.primary_color};text-decoration:underline;word-break:break-all">${escapeHtml(input.url)}</a></p>`;
+  const footer = `${escapeHtml(copy.security)}<br><span style="display:inline-block;margin-top:8px">`
+    + `This account email was sent by ${escapeHtml(input.brand.organization_name)}. The secure link opens ${escapeHtml(host)}.</span>`
+    + `<br><span style="display:inline-block;margin-top:8px">This automated account email cannot accept replies. If you need help, contact your workspace administrator through your usual support channel.</span>`;
+  const detailText = copy.details.map((detail) => `${detail.label}: ${detail.value}`).join("\n");
+  return {
+    subject: copy.subject,
+    html: frame({
+      brand: input.brand,
+      subject: copy.subject,
+      preview: copy.preview,
+      category: copy.category,
+      heading: copy.heading,
+      intro: copy.intro,
+      contentHtml: "",
+      details: copy.details,
+      action: { label: copy.action, url: input.url },
+      afterActionHtml: afterAction,
+      footerHtml: footer,
+    }),
+    text: `${copy.heading}\n\n${copy.intro}\n\n${detailText}\n\n${copy.action}: ${input.url}\n\n${copy.security}\n\nThis account email was sent by ${input.brand.organization_name}. The secure link opens ${host}.\n\nThis automated account email cannot accept replies. If you need help, contact your workspace administrator through your usual support channel.`,
   };
 }

package/template/src/report-email.ts

@@ -5,6 +5,8 @@ export type AuthenticationEmailBinding = {
     subject: string;
     text: string;
     html: string;
+    replyTo?: string | { email: string; name?: string };
+    headers?: Record<string, string>;
   }): Promise<unknown>;
 };
 
@@ -55,14 +57,17 @@ export function reporterEmailFrom(env: unknown): string {
 export function reporterEmailSubjectPrefix(env: unknown): string {
   const bindings = emailEnvironment(env);
   return (bindings.REPORTER_EMAIL_SUBJECT_PREFIX ?? bindings.EMAIL_SUBJECT_PREFIX ?? "").trim().slice(0, 120)
-    || "Safest report update";
+    || "Report update";
 }
 
 export function reporterEmailConfigured(env: unknown): boolean {
   return Boolean(reporterEmailBinding(env) && reporterEmailFrom(env));
 }
 
-const replyTokenPattern = /^r1\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
+export type CaseReplyAudience = "reporter" | "affected_user";
+
+const legacyReplyTokenPattern = /^r1\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
+const replyTokenPattern = /^r2([ra])\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
 const encoder = new TextEncoder();
 
 function hex(bytes: Uint8Array): string {
@@ -86,12 +91,14 @@ export async function reporterReplyToken(input: {
   publicReference: string;
   expiresAt: number;
   signingSecret: string;
+  audience?: CaseReplyAudience;
 }): Promise<string> {
   const reference = input.publicReference.replace(/^RPT-/u, "").toLowerCase();
   if (!/^[a-z0-9_-]{16}$/u.test(reference)) throw new Error("The report reference cannot be used for an email reply token.");
   const expiry = input.expiresAt.toString(16).padStart(8, "0");
   if (!/^[0-9a-f]{8}$/u.test(expiry)) throw new Error("The reporter reply expiry is outside the supported range.");
-  const payload = `r1.${reference}.${expiry}`;
+  const audience = input.audience === "affected_user" ? "a" : "r";
+  const payload = `r2${audience}.${reference}.${expiry}`;
   return `${payload}.${hex(await replySignature(input.signingSecret, payload))}`;
 }
 
@@ -99,16 +106,24 @@ export async function verifyReporterReplyToken(
   token: string,
   signingSecret: string,
   currentTime = Math.floor(Date.now() / 1_000),
-): Promise<{ publicReference: string; expiresAt: number } | null> {
-  const match = replyTokenPattern.exec(token);
-  if (!match) return null;
-  const expiry = Number.parseInt(match[2]!, 16);
-  const supplied = Uint8Array.from(match[3]!.match(/.{2}/gu) ?? [], (pair) => Number.parseInt(pair, 16));
+): Promise<{ publicReference: string; expiresAt: number; audience: CaseReplyAudience } | null> {
+  const current = replyTokenPattern.exec(token);
+  const legacy = current ? null : legacyReplyTokenPattern.exec(token);
+  if (!current && !legacy) return null;
+  const reference = current?.[2] ?? legacy?.[1] ?? "";
+  const expiryHex = current?.[3] ?? legacy?.[2] ?? "";
+  const signatureHex = current?.[4] ?? legacy?.[3] ?? "";
+  const expiry = Number.parseInt(expiryHex, 16);
+  const supplied = Uint8Array.from(signatureHex.match(/.{2}/gu) ?? [], (pair) => Number.parseInt(pair, 16));
   if (!expiry || expiry <= currentTime) return null;
-  const payload = `r1.${match[1]}.${match[2]}`;
+  const payload = current ? `r2${current[1]}.${reference}.${expiryHex}` : `r1.${reference}.${expiryHex}`;
   const expected = await replySignature(signingSecret, payload);
   if (!constantTimeEqual(supplied, expected)) return null;
-  return { publicReference: `RPT-${match[1]!.toUpperCase()}`, expiresAt: expiry };
+  return {
+    publicReference: `RPT-${reference.toUpperCase()}`,
+    expiresAt: expiry,
+    audience: current?.[1] === "a" ? "affected_user" : "reporter",
+  };
 }
 
 export async function reporterReplyAddress(input: {
@@ -116,6 +131,7 @@ export async function reporterReplyAddress(input: {
   publicReference: string;
   signingSecret: string;
   expiresAt: number;
+  audience?: CaseReplyAudience;
 }): Promise<string> {
   const separator = input.fromAddress.lastIndexOf("@");
   if (separator < 1) throw new Error("The reporter email address is invalid.");

package/template/src/report-repository.ts

@@ -281,7 +281,8 @@ export async function createReport(
   const receiptMessageId = crypto.randomUUID();
   const receiptNoticeId = crypto.randomUUID();
   const receiptDeliveryId = crypto.randomUUID();
-  const receiptBody = `We received your report ${publicReference}. It is now with the safety team. We will email you when there is an update, and you can reply directly to any report email.`;
+  const receiptBody = "Thank you for speaking up. Our safety team will review the information you shared. "
+    + "We’ll email you here if we need more information or when there is an update.";
   const directEmail = Boolean(submission.reporter.email && options.emailEnabled);
   const webhookNotification = Boolean(!directEmail && options.notificationEnabled
     && (submission.reporter.email || submission.reporter.reference));