toolroll 0.9.62 → 0.9.65

package/dist/flow-engine.js

@@ -6,12 +6,14 @@
  * waits for people. See flows.ts for what each zone does.
  */
 import { assignmentOf } from "./assignment.js";
-import { filerFor } from "./approval-policy.js";
 import { diagnoseTaskDispatch } from "./dispatch.js";
 import { passOn, TEXT_LIMITS } from "./text-limits.js";
 import { deciderOf, durationWords, fillFlowText, flowGoal, flowValueLabel, flowWorkTemplate, validateFlowDefinition, withinHours } from "./flows.js";
+import { readSnapshot, referenceWords, snapshotOf } from "./task-source.js";
 import { reportFillIns, reportSummaryFor } from "./report-summary.js";
 import { fileTaskProposal } from "./proposal.js";
+import { FLOW_ACCEPTANCE, unattendedCoverageFor } from "./flow-unattended.js";
+import { sealFlowFilingUnderGrant } from "./plan-auto.js";
 import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
 import { readVerifiedReport, scanForSecrets } from "./evidence.js";
@@ -33,10 +35,7 @@ export function flowDefinitionOf(flow) {
 export const flowCardHref = (flow, card) => `/flows/${flow}?card=${card}`;
 /** Where a confirmed flow action may point: a flow's canvas, maybe with one card open. */
 export const FLOW_HREF = /^\/flows\/[1-9][0-9]{0,9}(\?card=[1-9][0-9]{0,9})?$/;
-const ACCEPTANCE = {
-    report: [{ id: "c1", statement: "The report answers the request, citing where in the repository each point comes from", how: null, evidence: ["manual-review"] }],
-    task: [{ id: "c1", statement: "The requested change is made and the project's existing checks still pass", how: null, evidence: ["manual-review"] }],
-};
+const ACCEPTANCE = FLOW_ACCEPTANCE;
 function fill(template, card) {
     return fillFlowText(template, { title: card.title, description: card.description, note: card.note, outputs: card.outputs });
 }
@@ -266,18 +265,31 @@ function workStage(store, flow, definition, stage, card, now, options, outcome,
             const fresh = store.getFlowCard(card.id);
             if (fresh === null || fresh.state !== "active" || fresh.entry !== card.entry || fresh.stage !== stage.id || fresh.task !== null)
                 return null;
+            // A card this flow's own schedule added, while the flow runs on its own (flow-unattended.ts): the grant's frozen
+            // criteria and budget, sealed here, in the same transaction. Any other card files as it always did and waits.
+            const grant = unattendedCoverageFor(store, flow, fresh, repo, now);
+            const kind = report ? "report" : "task";
             const made = fileTaskProposal(store, {
                 title: (report ? `${stage.title}: ${card.title}` : card.title).slice(0, 200),
                 repo,
                 goal,
-                filedVia: `flow:${flow.id}`, filedBy: filerFor(card.createdBy), // who made the card asked for the work (an owner can be reassigned by anyone)
+                filedVia: `flow:${flow.id}`,
+                // Who made the card asked for the work (an owner can be reassigned by anyone). v126: an automation's card (a
+                // delivery, a poll, a schedule, a form) files as automation, by the kind kept on the card, never by its name.
+                filedBy: { name: card.createdBy, kind: card.createdKind },
                 deliverable: report ? "report" : "branch",
                 planning: report ? "skip" : stage.planning ?? "auto",
-                acceptance: report ? ACCEPTANCE.report : ACCEPTANCE.task,
+                acceptance: grant === null ? ACCEPTANCE[kind] : grant.terms.acceptance[kind],
+                ...(grant?.terms.perAttemptBudgetMicrousd == null ? {} : { budgetMicrousd: grant.terms.perAttemptBudgetMicrousd }),
                 admittedRepos: [repo],
             }, now);
+            // v126: a card an outside event's delivery made gives its task a snapshot of where it came from, in this transaction.
+            const snapshot = made.ok ? snapshotOf(fresh.source) : null;
+            if (made.ok && snapshot !== null)
+                store.recordTaskSource(made.id, { flow: flow.id, card: fresh.id, entry: fresh.entry }, JSON.stringify(snapshot), now);
+            const ranOnItsOwn = made.ok && grant !== null && sealFlowFilingUnderGrant(store, made.id, grant, fresh, now);
             if (made.ok)
-                store.updateFlowCard(card.id, { task: made.id, ...(report || fresh.primaryTask !== null ? {} : { primaryTask: made.id }), waiting: "Filed as a task" }, now);
+                store.updateFlowCard(card.id, { task: made.id, ...(report || fresh.primaryTask !== null ? {} : { primaryTask: made.id }), waiting: ranOnItsOwn ? "Filed as a task, approved: this flow runs on its own" : "Filed as a task" }, now);
             return made;
         });
         if (filed === null)
@@ -354,12 +366,24 @@ function workStage(store, flow, definition, stage, card, now, options, outcome,
  * 64 KiB), so in practice an attachment is never shortened. */
 const FLOW_ATTACHED_LIMIT = 128_000;
 export function flowGoalCuts(store, taskId, goal) {
+    let cuts = [];
     try {
-        return goalCuts(store, taskId, goal);
+        cuts = goalCuts(store, taskId, goal);
     }
     catch {
-        return [];
+        cuts = [];
     } // context, never a reason a build can't start
+    // v126: where the work came from, from the task's own kept source (or the task it revises) — never from the card's
+    // current task link or zone, which move on. Given whole whenever the goal itself couldn't carry it.
+    try {
+        const kept = store.taskSourceOf(taskId);
+        const snapshot = kept === null ? null : readSnapshot(kept.sourceJson);
+        const words = snapshot === null ? "" : referenceWords(snapshot);
+        if (words !== "" && !goal.includes(words) && !cuts.some(one => one.text === words))
+            cuts.push({ label: flowValueLabel("card.source"), text: words });
+    }
+    catch { /* context, never a reason a build can't start */ }
+    return cuts;
 }
 function goalCuts(store, taskId, goal) {
     const root = store.taskFamilyOf(taskId, null, true)?.root.id ?? taskId;
@@ -413,7 +437,7 @@ export function addCardToFlow(store, flow, input, actor, now) {
     if ("problem" in text)
         return { ok: false, message: text.problem };
     const stage = definition.stages.find(one => one.id === input.stage) ?? definition.stages.find(one => one.id === definition.start);
-    const card = store.addFlowCard({ flow: flow.id, title: text.title, description: text.description, stage: stage.id, by: actor }, now);
+    const card = store.addFlowCard({ flow: flow.id, title: text.title, description: text.description, stage: stage.id, by: actor, byKind: "person" }, now);
     // Whoever adds a card follows it; owning it is a separate, deliberate step.
     store.setFlowCardWatcher(card, actor, true, now);
     return { ok: true, said: `Card added to ${zoneWords(stage.title)}`, card };

package/dist/flow-gallery-ui.js

@@ -7,7 +7,7 @@
 import { brandMarkHtml } from "./brand-mark.js";
 import { BLANK, GALLERY, GALLERY_GROUPS, galleryDiagram, galleryToolsOf, OUTDATED_COMMANDS, SEND_RESULT, sendsAlready } from "./flow-gallery.js";
 import { choiceTargets } from "./flows.js";
-import { html, joinHtml, postForm } from "./html.js";
+import { html, joinHtml, postForm, reauth } from "./html.js";
 export const GALLERY_CSS = `.gallery{max-width:1120px;min-width:0}.gallery h2{margin:28px 0 10px;font-size:.9375rem}.gallery h2:first-of-type{margin-top:8px}` +
     `.gallery-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(250px,1fr));gap:12px}` +
     `.gallery-card{display:flex;flex-direction:column;gap:8px;padding:16px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);min-width:0}` +
@@ -89,7 +89,7 @@ export function galleryUseHtml(input) {
         if (tool.state === "connected" || tool.state === "taken" || input.csrf === "")
             return html `<div class="gallery-connect" data-tool="${tool.id}" data-state="${String(tool.state)}">${head}</div>`;
         const how = tool.id === "figma-desktop" ? "Open the Figma desktop app and turn on its Dev Mode MCP server in Preferences." : `You sign in on ${tool.label}, then come back here.`;
-        return html `<div class="gallery-connect" data-tool="${tool.id}" data-state="open">${head}${postForm("/settings/tools/connect", html `<p class="meta">${how}</p><label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button name="service" value="${tool.id}">Connect ${tool.label}</button>`, { hidden: { repo: input.repo, shown: input.repo, template: template.id } })}</div>`;
+        return html `<div class="gallery-connect" data-tool="${tool.id}" data-state="open">${head}${postForm("/settings/tools/connect", html `<p class="meta">${how}</p>${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button name="service" value="${tool.id}">Connect ${tool.label}</button>`, { hidden: { repo: input.repo, shown: input.repo, template: template.id } })}</div>`;
     };
     const toolsBlock = tools.length === 0 ? "" : html `<section class="gallery-tools-use" aria-label="Tools">${tools.map(connect)}</section>`;
     // Made without a tool, the preview names the zone that needs it.

package/dist/flow-gallery.js

@@ -266,10 +266,26 @@ export const GALLERY = [
         does: ["Checks for outdated {{ask.outdated}} packages {{ask.schedule-words}}, with no AI.", "When some are out of date, updates them as a task, under your usual approvals.", "What you approve opens a pull request."],
         never: NEVER_MERGES,
     },
+    {
+        // v126: the direct road from a signed outside request to a build that waits for your approval.
+        id: "webhook-to-build", name: "Webhook to build", group: "health",
+        promise: "A signed request from any tool becomes a build, under your usual approvals.",
+        needs: ["A tool that can send signed webhooks", "GitHub"], asks: [],
+        steps: [
+            { id: "build", title: "Build it", kind: "task", instructions: work("{{card.title}}\n\n{{card.description}}") },
+            owner("review", "Review the build"),
+            { ...pr, next: "Done" },
+            { id: "done", title: "Done", kind: "done" },
+        ],
+        triggers: [{ kind: "webhook", sender: "standard", title: "Request" }],
+        does: ["Adds a webhook signed the Standard Webhooks way. Once the flow is made, open its Triggers and choose Set up under Signing: it shows the address and the secret together, once; give both to the sender.",
+            "Each signed request becomes a card and is built as a task. The task waits for your approval, like any other.", "You review the build; what you approve opens a pull request."],
+        never: NEVER_MERGES,
+    },
     {
         id: "error-to-fix", name: "Error to fix", group: "health", tools: ["sentry"],
-        promise: "New errors from Sentry or any error tracker are sorted, researched and fixed.",
-        needs: ["A webhook from Sentry or another tracker", SORTS], asks: [],
+        promise: "New Sentry errors are sorted, researched and fixed.",
+        needs: ["A Sentry Internal Integration", SORTS], asks: [],
         steps: [
             { id: "worth-fixing", title: "Worth fixing?", kind: "sort", question: "Is this error in our own code, and new or frequent enough to fix now?",
                 answers: [
@@ -284,8 +300,9 @@ export const GALLERY = [
             { id: "done", title: "Done", kind: "done" },
             { id: "ignored", title: "Ignored", kind: "done" },
         ],
-        triggers: [{ kind: "webhook", title: "Error", titleField: "data.issue.title", bodyField: "data.issue.culprit" }],
-        does: ["Adds a webhook. Once the flow is made, open its Triggers and choose New address, then paste that into Sentry or another error tracker.", "Jev keeps errors in your code that are new or frequent, and drops noise; ones it isn't sure about wait for you.",
+        // v126: signed by Sentry and read by Toolroll's Sentry reader: one card per issue, linked to it.
+        triggers: [{ kind: "webhook", sender: "sentry", title: "Error" }],
+        does: ["Adds a Sentry webhook. Once the flow is made, open its Triggers and choose New address; in Sentry create an Internal Integration (Settings → Developer Settings), paste that address as its Webhook URL, turn on Alert Rule Action and Issue events, then paste its Client Secret under Signing on the flow's Triggers.", "One card per Sentry issue, however often it alerts, linked to the issue.", "Jev keeps errors in your code that are new or frequent, and drops noise; ones it isn't sure about wait for you.",
             "Each kept error is researched, then fixed as a task, under your usual approvals.", "What you approve opens a pull request."],
         never: NEVER_MERGES,
     },
@@ -300,7 +317,7 @@ export const GALLERY = [
             pr,
         ],
         triggers: [{ kind: "webhook", title: "Incident", titleField: "data.attributes.name" }],
-        does: ["Adds a webhook. Once the flow is made, open its Triggers and choose New address, then paste that into Better Stack.", "Reads the incident, its monitor's history and your recent commits and deploys, and sends you the likely cause.", "You choose Fix or Ignore; a fix is built as a task, under your usual approvals, and opens a pull request."],
+        does: ["Adds a webhook. Once the flow is made, open its Triggers and choose New address, then paste that into Better Stack. Better Stack doesn't sign its webhooks, so anyone with the address could add cards: keep it private.", "Reads the incident, its monitor's history and your recent commits and deploys, and sends you the likely cause.", "You choose Fix or Ignore; a fix is built as a task, under your usual approvals, and opens a pull request."],
         never: NEVER_MERGES,
     },
     {
@@ -335,8 +352,9 @@ export const GALLERY = [
             pr,
             send("Send the fix"),
         ],
-        triggers: [{ kind: "webhook", title: "Failed deployment", titleField: "payload.deployment.name" }],
-        does: ["Adds a webhook. Once the flow is made, open its Triggers and choose New address, then paste that into Vercel for failed deployments.", "Reads the build log and finds the cause.", "Builds a fix as a task, under your usual approvals, opens a pull request and sends it to you."],
+        // v126: signed by Vercel and read by Toolroll's Vercel reader: failed deployments only, one card each.
+        triggers: [{ kind: "webhook", sender: "vercel", title: "Failed deployment" }],
+        does: ["Adds a Vercel webhook. Once the flow is made, open its Triggers and choose New address; in Vercel (Settings → Webhooks) paste that address and choose Deployment Error, then paste the secret Vercel shows under Signing on the flow's Triggers. Put your Vercel project ID in Signing too, so only its deployments add cards.", "Reads the build log and finds the cause.", "Builds a fix as a task, under your usual approvals, opens a pull request and sends it to you."],
         never: NEVER_MERGES,
     },
     // ---------------------------------------------------------- Hear from users
@@ -637,7 +655,8 @@ export function useGalleryTemplate(store, template, repo, given, input) {
             const id = store.createFlow({ repo, name, definitionJson: JSON.stringify(built.definition), by: input.by }, input.now);
             const made = store.getFlow(id);
             for (const trigger of built.triggers) {
-                const added = addFlowTriggerTo(store, made, { ...trigger, zone: trigger["zone"] ?? flowDefinitionOf(made).start }, input.by, input.now, input.dir);
+                // No one is shown the gallery's addresses: a webhook is made with none until its panel makes one (v126).
+                const added = addFlowTriggerTo(store, made, { ...trigger, zone: trigger["zone"] ?? flowDefinitionOf(made).start }, input.by, input.now, input.dir, { shown: false });
                 if (!added.ok)
                     throw new Error(added.message);
                 if (added.reveal !== null)

package/dist/flow-share.js

@@ -24,7 +24,7 @@ import { addFlowTriggerTo, describeTrigger, HOOK_PATH, readHooksBase, triggerCon
 import { durationMinutes, durationWords, FlowContractError, flowTerms, inStepWords, LANGUAGE_WORDS, validateFlowDefinition } from "./flows.js";
 import { stageReferenceProblems } from "./contracts/stage-output.js";
 import { readVersioned } from "./contracts/contract.js";
-import { FLOW_ALIASES, FLOW_FILE_FORMAT, legacyFlowNeed, legacySubagentStep, FLOW_FILE_VERSION, flowFileSchema, PARAMETER_ID } from "./contracts/flow.js";
+import { FLOW_ALIASES, WEBHOOK_SENDERS, FLOW_FILE_FORMAT, legacyFlowNeed, legacySubagentStep, FLOW_FILE_VERSION, flowFileSchema, PARAMETER_ID } from "./contracts/flow.js";
 import { parseSchedule } from "./flow-schedule.js";
 export { FLOW_FILE_FORMAT, FLOW_FILE_VERSION };
 /** The largest flow file Toolroll reads or fetches. */
@@ -111,7 +111,13 @@ function triggerOf(config, ask) {
             ...(config.state === null ? {} : { state: config.state }),
             ...(config.label === null ? {} : { label: ask({ id: "linear-label", about: "The Linear label issues need", default: config.label }) }),
             delivery: config.delivery, ...zone };
-        case "webhook": return { kind: "webhook", title: config.title, ...(config.titleField === null ? {} : { titleField: config.titleField }), ...(config.bodyField === null ? {} : { bodyField: config.bodyField }), ...zone };
+        // v126: who signs it travels (never its secret or address: an imported signed webhook isn't set up until its
+        // secret is made or pasted there); the project and team it is scoped to are asked again, as another install's own.
+        case "webhook": return { kind: "webhook", title: config.title, ...(config.titleField == null ? {} : { titleField: config.titleField }), ...(config.bodyField == null ? {} : { bodyField: config.bodyField }),
+            ...((config.sender ?? "none") === "none" ? {} : { sender: config.sender }),
+            ...(config.project == null ? {} : { project: ask({ id: "webhook-project", about: "The project the signed webhook's deliveries must come from", default: config.project }) }),
+            ...(config.team == null ? {} : { team: ask({ id: "webhook-team", about: "The Vercel team the deliveries must come from", default: config.team }) }),
+            ...(config.idField == null ? {} : { idField: config.idField }), ...(config.urlField == null ? {} : { urlField: config.urlField }), ...zone };
         case "email": return { kind: "email", folder: config.folder,
             ...(config.sender === null ? {} : { sender: ask({ id: "email-sender", about: "Whose mail starts cards: addresses or domains, comma-separated (left empty: anyone's)", optional: true }) }),
             ...(config.subject === null ? {} : { subject: config.subject }), ...zone };
@@ -192,8 +198,13 @@ function scrubDeep(value, scrub, key, inScripts) {
         return key !== null && (STRUCTURAL.has(key) || (inScripts && key === "name")) ? value : scrub(value);
     if (Array.isArray(value))
         return value.map(one => scrubDeep(one, scrub, key, inScripts));
-    if (value !== null && typeof value === "object")
-        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, scrubDeep(v, scrub, k, inScripts || k === "scripts")]));
+    if (value !== null && typeof value === "object") {
+        // v126: a webhook's sender is one of a fixed few words (who signs it), never prose: kept as it is, even when an
+        // account happens to share its name. An email trigger's sender is people's addresses, and is still scrubbed.
+        const record = value;
+        const webhookSender = record["kind"] === "webhook" && typeof record["sender"] === "string" && WEBHOOK_SENDERS.includes(record["sender"]);
+        return Object.fromEntries(Object.entries(record).map(([k, v]) => [k, webhookSender && k === "sender" ? v : scrubDeep(v, scrub, k, inScripts || k === "scripts")]));
+    }
     return value;
 }
 /** A flow as a file: its zones and paths, its triggers' settings and the scripts it runs, nothing of this installation's. */
@@ -530,7 +541,7 @@ export function importFlow(store, plan, actor, now, dir) {
         }
         const id = store.createFlow({ repo: plan.repo, name: plan.name, definitionJson: JSON.stringify(plan.definition), by: actor }, now);
         for (const trigger of plan.triggers) {
-            const made = addFlowTriggerTo(store, store.getFlow(id), trigger, actor, now, dir);
+            const made = addFlowTriggerTo(store, store.getFlow(id), trigger, actor, now, dir, { shown: false });
             if (!made.ok)
                 throw new FlowFileError(`A ${String(trigger["kind"])} trigger: ${made.message}`);
             store.updateFlowTrigger(made.id, { state: "paused" }, now);

package/dist/flow-triggers.d.ts

@@ -1,6 +1,7 @@
 import type { Runner } from "./backend.js";
 import { type FlowAct } from "./flow-engine.js";
 import { type FlowDefinition } from "./flows.js";
+import { type DistinctHeaders, type WebhookSender } from "./webhook-signing.js";
 import { type ContractResult } from "./contracts/contract.js";
 import { FLOW_TRIGGER_KINDS, type ChatApp, type FlowTriggerKind, type TriggerConfig, type TriggerInput } from "./contracts/flow.js";
 import { type MailReader } from "./mailbox.js";
@@ -49,13 +50,20 @@ export declare function triggerHeadline(config: TriggerConfig, store: Store): {
 export declare function triggerConfigOf(trigger: FlowTriggerRow): TriggerConfig | null;
 /** A saved trigger's config (`configJson`, which carries no version) read by its one schema, what it leaves out filled. */
 export declare function readTriggerConfig(raw: unknown): ContractResult<TriggerConfig>;
+/** v126: who signs a webhook trigger's deliveries; one saved before senders were chosen is unsigned. */
+export declare const senderOf: (config: Extract<TriggerConfig, {
+    kind: "webhook";
+}>) => WebhookSender;
 /** Whether this trigger takes deliveries at a secret address rather than being checked. */
+/** Whether a raw trigger the caller is about to add would take deliveries (an address): read leniently, before validation. */
+export declare function rawTakesDeliveries(raw: unknown): boolean;
 export declare function takesDeliveries(config: TriggerConfig): boolean;
-/** A webhook's signing secret (GitHub: made here; Linear: pasted from Linear). 0600, beside the database, never a column. */
-export declare function saveHookSecret(dir: string, trigger: number, secret: string): void;
-export declare function readHookSecret(dir: string, trigger: number): string | null;
+/** A webhook's signing secret (made here, or pasted from its sender). In the keychain (or an owner-only file where there's none), never a column. */
+export declare function saveHookSecret(dir: string, trigger: number, secret: string, credential?: string): void;
+/** Exactly this credential's secret, or null: never another's. */
+export declare function readHookSecret(dir: string, trigger: number, credential?: string): string | null;
 export declare const LINEAR_ENV = "TOOLROLL_LINEAR_KEY";
-/** The Linear API key the worker checks Linear with: the environment, or a 0600 file beside the database. */
+/** The Linear API key the worker checks Linear with: the environment, or kept by Toolroll (the keychain, or an owner-only file beside the database). */
 export declare function readLinearKey(dir: string | null): string | null;
 export declare function saveLinearKey(dir: string, key: string): {
     ok: true;
@@ -89,20 +97,32 @@ export type TriggerMade = {
     message: string;
 };
 /** Add a trigger to a flow. A webhook trigger's address (and GitHub's signing secret) is returned once and never stored readable. */
-export declare function addFlowTriggerTo(store: Store, flow: FlowRow, raw: unknown, actor: string, now: Date, dir: string | null): TriggerMade;
+/**
+ * `ingress: "proved"`: the caller proved a password typed now (a credential act, docs/plans/passwordless.md) — only then
+ * may a trigger that takes deliveries be made with an address. Without it a webhook is made with none (its panel's
+ * set-up, which asks for the password, makes one), and GitHub/Linear webhook delivery is refused.
+ */
+export declare function addFlowTriggerTo(store: Store, flow: FlowRow, raw: unknown, actor: string, now: Date, dir: string | null, options?: {
+    shown?: boolean;
+    ingress?: "proved";
+}): TriggerMade;
 /** A new secret address for a webhook trigger (the old one stops working at once). */
 export declare function renewFlowHook(store: Store, trigger: FlowTriggerRow, now: Date, dir: string): TriggerMade;
 /**
  * Pause a trigger, or turn it on again. A schedule that never had a time (a routine moved to a flow while it waited
  * for approval, v115) starts counting from now, as a new schedule does; one that was due while it was off fires once.
  */
-export declare function setFlowTriggerOn(store: Store, trigger: FlowTriggerRow, on: boolean, now: Date): void;
-export declare function removeFlowTrigger(store: Store, trigger: FlowTriggerRow, now: Date, dir: string | null): void;
+export declare function setFlowTriggerOn(store: Store, trigger: FlowTriggerRow, on: boolean, now: Date, by?: string): void;
+export declare function removeFlowTrigger(store: Store, trigger: FlowTriggerRow, now: Date, dir: string | null, by?: string): void;
+/** `onTime`: the clock's own firing of a schedule (never Run now or Check now); only those can run on their own.
+ * `ranScript`: for a script's, what code it ran (scriptRanDigestOf), which must be the code a grant signed. */
 export type Incoming = {
     key: string;
     title: string;
     description: string | null;
     source: FlowCardSource;
+    onTime?: boolean;
+    ranScript?: string | null;
 };
 type Made = "added" | "seen" | "skipped";
 /** One outside thing into one card through a trigger (a chat channel's message, v89): at most once per key. */
@@ -185,24 +205,77 @@ export declare const LINEAR_QUERY = "query FlowTrigger($filter: IssueFilter) { i
 export declare function linearItem(config: Extract<TriggerConfig, {
     kind: "linear";
 }>, raw: unknown): Found | null;
+/** v126: headers as Node's `headersDistinct` gives them, one value per line they arrived on, so a security header sent
+ * twice is seen twice (Node's `headers` joins repeated custom headers with commas). */
 export type HookDelivery = {
-    headers: Record<string, string | string[] | undefined>;
+    headers: DistinctHeaders;
     body: Buffer;
 };
+/** `retryAfter` (seconds): a 429's Retry-After. */
 export type HookAnswer = {
     status: number;
     said: string;
+    retryAfter?: number;
 };
 /** A webhook delivery at a trigger's secret address: prove it, read it, make at most the cards it names. Nothing runs here. */
 export declare function receiveFlowHook(store: Store, token: string, delivery: HookDelivery, dir: string, now: Date): HookAnswer;
-/** Save Linear's signing secret for a Linear webhook trigger (pasted on the secure panel, never in chat). */
-export declare function saveLinearSigningSecret(trigger: FlowTriggerRow, secret: string, dir: string): {
+/**
+ * v126: make a trigger's held deliveries into their cards while the last hour has room, oldest first. Each card in its
+ * own write transaction, which reads everything it acts on under the write lock: the trigger (still active, still
+ * taking deliveries), the hour's room, the oldest held receipt, the flow; then the same guards intake has (a failing
+ * run already owned by another card in the project is left out). The card and the receipt's move to accepted land
+ * together, or neither does.
+ */
+export declare function drainHeldDeliveries(store: Store, trigger: FlowTriggerRow, now: Date): number;
+/**
+ * v126: a delivery refused before it could be read (too large, a body that wouldn't read): it proves nothing, so it
+ * counts toward its address's minute like any unproven delivery. The answer to give instead when that count is over.
+ */
+export declare function hookRefusedUnread(store: Store, token: string, now: Date): HookAnswer | null;
+/** A signing secret pasted on the secure panel behind the password, never in chat: Linear's, or a signed webhook's
+ * sender's (Sentry's or Vercel's own, or a Standard or GitHub-style one made elsewhere). */
+export declare function saveSigningSecret(store: Store, trigger: FlowTriggerRow, secret: string, now: Date, dir: string): {
     ok: true;
+    said: string;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * v126: a new secret for a webhook whose sender Toolroll makes secrets for (Standard Webhooks, GitHub-style), shown once.
+ * Its address stays as it is (New address is its own action). Sentry's and Vercel's secrets are theirs, pasted instead.
+ * The only place such a secret is made: creating a trigger (from the panel, the gallery or an import) never does.
+ */
+export declare function setUpFlowHook(store: Store, trigger: FlowTriggerRow, now: Date, dir: string): TriggerMade;
+/**
+ * v126: change who signs a webhook's deliveries, in place: the trigger keeps its id, address and what it has received
+ * (keys carry the sender, so nothing received unsigned stands for anything signed). Its credentials move to the next
+ * generation with no secret: it isn't ready until it is set up again. Settings the new sender doesn't read are left out.
+ */
+export declare function changeFlowHookSender(store: Store, trigger: FlowTriggerRow, sender: unknown, actor: string, now: Date, dir: string): {
+    ok: true;
+    said: string;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * v126: which project (and, for Vercel, team) a Sentry or Vercel webhook takes deliveries from, set in place: the
+ * trigger keeps its id, address, secret and history; blank takes any project the secret covers. Only from the settings
+ * read here, so a change racing it doesn't land on top of it.
+ */
+export declare function setFlowHookScope(store: Store, trigger: FlowTriggerRow, scope: {
+    project: unknown;
+    team: unknown;
+}, actor: string, now: Date): {
+    ok: true;
+    said: string;
 } | {
     ok: false;
     message: string;
 };
-/** Whether a webhook trigger can prove its deliveries: GitHub always (its secret is made here), Linear once its secret is pasted. */
+/** Whether a webhook trigger can prove its deliveries: an unsigned webhook always (its address is all it has), the others
+ * once the current generation's secret is saved. */
 export declare function hookReady(trigger: FlowTriggerRow, dir: string | null): boolean;
 export declare const FORM_PATH = "/hooks/form/";
 /** Share a button as a secret link anyone can fill in, without signing in. The link is shown once; only its hash is kept. */