toolroll 0.9.62 → 0.9.65

package/dist/toolroll-update-ui.js

@@ -4,7 +4,7 @@
  * and a one-time "What's new" card afterwards. The work itself is the
  * `toolroll update` command (toolroll-update.ts), started as its own job.
  */
-import { html, postForm, replaceMarkup } from "./html.js";
+import { html, postForm, replaceMarkup, reauth } from "./html.js";
 import { STEP_WORDS, UPDATE_STEPS, runtimeUpdateTerminal } from "./toolroll-update.js";
 const clock = (iso) => { const d = new Date(iso); return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`; };
 export const UPDATES_CSS = `.updates{max-width:640px;min-width:0;overflow-wrap:anywhere}.updates .card{margin:0 0 16px}.updates h2{margin:0;font-size:1.0625rem}.updates .card>p{margin:4px 0 0}` +
@@ -69,7 +69,7 @@ export function updatesHtml(view, notice) {
                         : latest === null ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Couldn’t check for a newer release: ${"problem" in view.latest ? view.latest.problem : ""}</p>`
                             : html `<h2>Toolroll ${view.current} is up to date</h2>`;
     const form = newer && !["npx", "source", "desktop"].includes(view.method.kind)
-        ? postForm("/settings/updates", html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button><button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div>`, { hidden: { version: latest } })
+        ? postForm("/settings/updates", html `${reauth(html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button><button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div>`, { hidden: { version: latest } })
         : "";
     const rollback = view.rollbackTo !== null ? html `<p class="meta">To go back to ${view.rollbackTo}: <code>toolroll update --rollback</code></p>` : "";
     return html `<section class="updates">${note}${whatsNew}${j ? outcomeHtml(j) : ""}<div class="card" data-update-state="${newer ? "available" : "current"}">${state}${form}${rollback}</div></section>`;

package/dist/toolroll-update.js

@@ -32,10 +32,11 @@ import { createRequire } from "node:module";
 import { clearWords, durableJson, LINGERING_LIMIT_MS, lingeringRun, lingeringWords, settleLeftoverRecords, sqliteLock, desktopUpdateWaitingOf, stoppedWaitingWords, updateWaitingWords, verifiedDatabaseBackup } from "./desktop-update.js";
 import { activeUpdateWork, freezeUpdateGate, installUpdateGate, removeUpdateGate, updateAdmissionPaused, updateGateOwned } from "./desktop-update-gate.js";
 import { processMayBeAlive } from "./process-liveness.js";
+import { removeTerminalUpdateGate } from "./terminal-catalog.js";
 import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
-import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS } from "./store.js";
+import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -373,6 +374,8 @@ function addedColumns(...versions) {
     }
     return rules;
 }
+/** Rules on tables that later gained declared columns (addedColumns merges into these instead of replacing them). */
+const EARLIER_RULES = { flow_trigger: { fromRoutines: "trigger" } };
 const HISTORY_RULES = {
     ...Object.fromEntries(Object.entries(CHAT_MOVES).map(([table, moved]) => [table, { moved }])),
     action_ledger: { appendOnly: true }, ledger_seal: { appendOnly: true }, ledger_checkpoint: { appendOnly: true },
@@ -400,7 +403,12 @@ const HISTORY_RULES = {
     // saved before them reads none.
     // v121: live steering's columns and a run's attempt key read none, and no sends, the same way.
     // v122: a project's recorded remote reads none the same way.
-    ...addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS),
+    // v123: a plan authorization's basis reads the operating mode, and a trigger firing reads not on time and no script ran.
+    // v126: a receipt's state, acceptance time and held item, a trigger's credential generation and turned-away count,
+    // and who made a card read none, 0, or none. A table with an earlier rule (flow_trigger's v115 move) keeps it too.
+    // v128: a lead message's pending flag reads waiting exactly for a team queue's unadmitted operator message.
+    ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS))
+        .map(([table, rule]) => [table, { ...EARLIER_RULES[table], ...rule }])),
 };
 /** The tables a migration may remove whole (v115's removed features). */
 export const RETIRED_TABLES = Object.freeze(Object.keys(HISTORY_RULES).filter(name => HISTORY_RULES[name].retired));
@@ -907,8 +915,10 @@ function ungate(j) {
         db.exec("PRAGMA busy_timeout=5000");
         if (updateGateOwned(db, j.id))
             removeUpdateGate(db, j.id);
-        else
+        else {
             removeCodingUpdateGate(db, j.id);
+            removeTerminalUpdateGate(db, j.id);
+        }
     }
     finally {
         db.close();
@@ -919,6 +929,7 @@ function ungateCoding(j) {
     try {
         db.exec("PRAGMA busy_timeout=5000");
         removeCodingUpdateGate(db, j.id);
+        removeTerminalUpdateGate(db, j.id);
     }
     finally {
         db.close();

package/dist/tools-ui.d.ts

@@ -2,7 +2,7 @@
  * entered here and nowhere else, and never shown again. */
 import { type Html } from "./html.js";
 import { type FoundTool, type ProjectTool, type ToolSpec } from "./project-tools.js";
-export declare const TOOLS_CSS = ".tools{max-width:780px;min-width:0;overflow-wrap:anywhere}.tools .card{padding:16px 18px;margin:12px 0;min-width:0}.tools .card h2{font-size:1.05rem;margin:0;color:var(--so-ink);font-weight:600}.tools .tool-heading{display:flex;align-items:center;gap:10px}.tools .tool-heading h2{flex:1;min-width:0}.tools .tool-state{font-size:.85rem;flex-shrink:0;color:var(--so-muted)}.tools .tool-state[data-ready=\"false\"]{color:var(--so-warning)}.tools .card>p{margin:6px 0 0}.tools .tool-note{color:var(--so-warning)}.tools code{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word;font-size:.85rem}.tools form{display:grid;gap:10px;margin:0}.tools label{display:grid;gap:6px}.tools input,.tools select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.tools button{justify-self:start;white-space:nowrap;min-height:44px;max-width:100%;overflow:hidden;text-overflow:ellipsis}.tools details:not(.card){margin:6px 0 0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.tools details:not(.card)>summary{min-height:36px;display:flex;align-items:center;font-size:.9rem;color:var(--so-muted);cursor:pointer}.tools details:not(.card)[open]>summary{color:var(--so-ink)}.tools details.card>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.tools summary{list-style:none;gap:10px}.tools summary::-webkit-details-marker{display:none}.tools summary::before{content:\"\";flex-shrink:0;width:6px;height:6px;margin:0 2px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform .15s}.tools details[open]>summary::before{transform:rotate(45deg)}.tools details:not(.card) form{padding:4px 0 10px}.tools .tool-facts{margin:0 0 8px;display:grid;gap:4px;font-size:.9rem}.tools .tool-facts p{margin:0}.tools .tool-controls{display:flex;gap:12px;flex-wrap:wrap;margin-top:12px}.tools .tool-found{display:flex;gap:10px;align-items:flex-start}.tools .tool-found input{flex:0 0 auto;width:18px;height:18px;margin-top:3px}.tools .tool-found span{min-width:0}.tools .problem{padding:10px 12px;margin:8px 0 0}.tools .tool-connect{scroll-margin-top:72px}.tools .connect-wanted{background:var(--so-accent);color:var(--so-on-accent);border-color:var(--so-accent)}.tools .connect-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:8px}.tools .connect-tile{display:grid;grid-template-columns:auto 1fr;column-gap:10px;align-items:center;justify-self:stretch;text-align:left;white-space:normal;padding:10px 12px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);color:var(--so-ink);min-height:60px;font:inherit;cursor:pointer;scroll-margin-top:96px}.tools .connect-tile:hover{border-color:var(--so-input-line);background:var(--so-raised)}.tools .connect-tile:target,.tools .connect-tile:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile .brand-mark{grid-row:span 2}.tools .connect-tile strong{font-weight:600;line-height:1.3}.tools .connect-tile>span:not(.brand-mark){font-size:.8rem;color:var(--so-muted);line-height:1.35;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}.tools .connect-tile[data-state=\"connected\"]>span:not(.brand-mark){color:var(--so-success)}.tools .connect-local{grid-column:1/-1}.tools .connect-local>span:not(.brand-mark){-webkit-line-clamp:unset}.tools .connect-problem{margin:0}.tools .connect-problem:focus{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile:disabled{cursor:default;opacity:.6}@media(max-width:600px){.tools .connect-grid{grid-template-columns:1fr 1fr}.tools .connect-tile:not(.connect-local)>span:not(.brand-mark){display:none}.tools .connect-local>span:not(.brand-mark){grid-column:2}.tools .connect-tile{min-height:52px;padding:8px 10px}.tools .connect-tile .brand-mark{grid-row:auto}.tools input,.tools select{font-size:16px}.tools .card{padding:14px}}";
+export declare const TOOLS_CSS = ".tools{max-width:780px;min-width:0;overflow-wrap:anywhere}.tools .card{padding:16px 18px;margin:12px 0;min-width:0}.tools .card h2{font-size:1.05rem;margin:0;color:var(--so-ink);font-weight:600}.tools .tool-heading{display:flex;align-items:center;gap:10px}.tools .tool-heading h2{flex:1;min-width:0}.tools .tool-state{font-size:.85rem;flex-shrink:0;color:var(--so-muted)}.tools .tool-state[data-ready=\"false\"]{color:var(--so-warning)}.tools .card>p{margin:6px 0 0}.tools .card>p.tool-credential{margin-top:4px;font-size:.875rem;color:var(--so-muted)}.tools .tool-note{color:var(--so-warning)}.tools code{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word;font-size:.85rem}.tools form{display:grid;gap:10px;margin:0}.tools label{display:grid;gap:6px}.tools input,.tools select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.tools button{justify-self:start;white-space:nowrap;min-height:44px;max-width:100%;overflow:hidden;text-overflow:ellipsis}.tools details:not(.card){margin:6px 0 0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.tools details:not(.card)>summary{min-height:36px;display:flex;align-items:center;font-size:.9rem;color:var(--so-muted);cursor:pointer}.tools details:not(.card)[open]>summary{color:var(--so-ink)}.tools details.card>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.tools summary{list-style:none;gap:10px}.tools summary::-webkit-details-marker{display:none}.tools summary::before{content:\"\";flex-shrink:0;width:6px;height:6px;margin:0 2px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform .15s}.tools details[open]>summary::before{transform:rotate(45deg)}.tools details:not(.card) form{padding:4px 0 10px}.tools .tool-facts{margin:0 0 8px;display:grid;gap:4px;font-size:.9rem}.tools .tool-facts p{margin:0}.tools .tool-controls{display:flex;gap:12px;flex-wrap:wrap;margin-top:12px}.tools .tool-found{display:flex;gap:10px;align-items:flex-start}.tools .tool-found input{flex:0 0 auto;width:18px;height:18px;margin-top:3px}.tools .tool-found span{min-width:0}.tools .problem{padding:10px 12px;margin:8px 0 0}.tools .tool-connect{scroll-margin-top:72px}.tools .connect-wanted{background:var(--so-accent);color:var(--so-on-accent);border-color:var(--so-accent)}.tools .connect-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:8px}.tools .connect-tile{display:grid;grid-template-columns:auto 1fr;column-gap:10px;align-items:center;justify-self:stretch;text-align:left;white-space:normal;padding:10px 12px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);color:var(--so-ink);min-height:60px;font:inherit;cursor:pointer;scroll-margin-top:96px}.tools .connect-tile:hover{border-color:var(--so-input-line);background:var(--so-raised)}.tools .connect-tile:target,.tools .connect-tile:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile .brand-mark{grid-row:span 2}.tools .connect-tile strong{font-weight:600;line-height:1.3}.tools .connect-tile>span:not(.brand-mark){font-size:.8rem;color:var(--so-muted);line-height:1.35;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}.tools .connect-tile[data-state=\"connected\"]>span:not(.brand-mark){color:var(--so-success)}.tools .connect-local{grid-column:1/-1}.tools .connect-local>span:not(.brand-mark){-webkit-line-clamp:unset}.tools .connect-problem{margin:0}.tools .connect-problem:focus{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile:disabled{cursor:default;opacity:.6}@media(max-width:600px){.tools .connect-grid{grid-template-columns:1fr 1fr}.tools .connect-tile:not(.connect-local)>span:not(.brand-mark){display:none}.tools .connect-local>span:not(.brand-mark){grid-column:2}.tools .connect-tile{min-height:52px;padding:8px 10px}.tools .connect-tile .brand-mark{grid-row:auto}.tools input,.tools select{font-size:16px}.tools .card{padding:14px}}";
 export type ToolsView = {
     repo: string;
     project: string;
@@ -26,6 +26,12 @@ export type ToolsView = {
         label: string;
     })[];
     found: FoundTool[];
+    /** Where this computer keeps tool secrets (project-tools.ts toolSecretStorage): said plainly when it's files only. */
+    storage?: {
+        words: string;
+        filesOnly: boolean;
+        problem?: string;
+    };
     /** The person's other projects and the one-click services still open there: where a connection here can also go. */
     others?: {
         repo: string;

package/dist/tools-ui.js

@@ -1,10 +1,11 @@
 /** Settings → Tools: one project's MCP servers, in plain words. Secrets are
  * entered here and nowhere else, and never shown again. */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { brandMarkHtml, TILE_PHONE } from "./brand-mark.js";
-import { toolCommandLine, toolStanding } from "./project-tools.js";
+import { signedIn } from "./oauth-run-token.js";
+import { credentialModeOf, toolCommandLine, toolStanding } from "./project-tools.js";
 const hidden = (data) => Object.entries(data).map(([k, v]) => html `<input type="hidden" name="${k}" value="${v}">`);
-export const TOOLS_CSS = `.tools{max-width:780px;min-width:0;overflow-wrap:anywhere}.tools .card{padding:16px 18px;margin:12px 0;min-width:0}.tools .card h2{font-size:1.05rem;margin:0;color:var(--so-ink);font-weight:600}.tools .tool-heading{display:flex;align-items:center;gap:10px}.tools .tool-heading h2{flex:1;min-width:0}.tools .tool-state{font-size:.85rem;flex-shrink:0;color:var(--so-muted)}.tools .tool-state[data-ready="false"]{color:var(--so-warning)}.tools .card>p{margin:6px 0 0}.tools .tool-note{color:var(--so-warning)}.tools code{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word;font-size:.85rem}.tools form{display:grid;gap:10px;margin:0}.tools label{display:grid;gap:6px}.tools input,.tools select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.tools button{justify-self:start;white-space:nowrap;min-height:44px;max-width:100%;overflow:hidden;text-overflow:ellipsis}.tools details:not(.card){margin:6px 0 0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.tools details:not(.card)>summary{min-height:36px;display:flex;align-items:center;font-size:.9rem;color:var(--so-muted);cursor:pointer}.tools details:not(.card)[open]>summary{color:var(--so-ink)}.tools details.card>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.tools summary{list-style:none;gap:10px}.tools summary::-webkit-details-marker{display:none}.tools summary::before{content:"";flex-shrink:0;width:6px;height:6px;margin:0 2px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform .15s}.tools details[open]>summary::before{transform:rotate(45deg)}.tools details:not(.card) form{padding:4px 0 10px}.tools .tool-facts{margin:0 0 8px;display:grid;gap:4px;font-size:.9rem}.tools .tool-facts p{margin:0}.tools .tool-controls{display:flex;gap:12px;flex-wrap:wrap;margin-top:12px}.tools .tool-found{display:flex;gap:10px;align-items:flex-start}.tools .tool-found input{flex:0 0 auto;width:18px;height:18px;margin-top:3px}.tools .tool-found span{min-width:0}.tools .problem{padding:10px 12px;margin:8px 0 0}.tools .tool-connect{scroll-margin-top:72px}.tools .connect-wanted{background:var(--so-accent);color:var(--so-on-accent);border-color:var(--so-accent)}.tools .connect-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:8px}.tools .connect-tile{display:grid;grid-template-columns:auto 1fr;column-gap:10px;align-items:center;justify-self:stretch;text-align:left;white-space:normal;padding:10px 12px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);color:var(--so-ink);min-height:60px;font:inherit;cursor:pointer;scroll-margin-top:96px}.tools .connect-tile:hover{border-color:var(--so-input-line);background:var(--so-raised)}.tools .connect-tile:target,.tools .connect-tile:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile .brand-mark{grid-row:span 2}.tools .connect-tile strong{font-weight:600;line-height:1.3}.tools .connect-tile>span:not(.brand-mark){font-size:.8rem;color:var(--so-muted);line-height:1.35;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}.tools .connect-tile[data-state="connected"]>span:not(.brand-mark){color:var(--so-success)}.tools .connect-local{grid-column:1/-1}.tools .connect-local>span:not(.brand-mark){-webkit-line-clamp:unset}.tools .connect-problem{margin:0}.tools .connect-problem:focus{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile:disabled{cursor:default;opacity:.6}${TILE_PHONE}{.tools .connect-grid{grid-template-columns:1fr 1fr}.tools .connect-tile:not(.connect-local)>span:not(.brand-mark){display:none}.tools .connect-local>span:not(.brand-mark){grid-column:2}.tools .connect-tile{min-height:52px;padding:8px 10px}.tools .connect-tile .brand-mark{grid-row:auto}.tools input,.tools select{font-size:16px}.tools .card{padding:14px}}`;
+export const TOOLS_CSS = `.tools{max-width:780px;min-width:0;overflow-wrap:anywhere}.tools .card{padding:16px 18px;margin:12px 0;min-width:0}.tools .card h2{font-size:1.05rem;margin:0;color:var(--so-ink);font-weight:600}.tools .tool-heading{display:flex;align-items:center;gap:10px}.tools .tool-heading h2{flex:1;min-width:0}.tools .tool-state{font-size:.85rem;flex-shrink:0;color:var(--so-muted)}.tools .tool-state[data-ready="false"]{color:var(--so-warning)}.tools .card>p{margin:6px 0 0}.tools .card>p.tool-credential{margin-top:4px;font-size:.875rem;color:var(--so-muted)}.tools .tool-note{color:var(--so-warning)}.tools code{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word;font-size:.85rem}.tools form{display:grid;gap:10px;margin:0}.tools label{display:grid;gap:6px}.tools input,.tools select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.tools button{justify-self:start;white-space:nowrap;min-height:44px;max-width:100%;overflow:hidden;text-overflow:ellipsis}.tools details:not(.card){margin:6px 0 0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.tools details:not(.card)>summary{min-height:36px;display:flex;align-items:center;font-size:.9rem;color:var(--so-muted);cursor:pointer}.tools details:not(.card)[open]>summary{color:var(--so-ink)}.tools details.card>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.tools summary{list-style:none;gap:10px}.tools summary::-webkit-details-marker{display:none}.tools summary::before{content:"";flex-shrink:0;width:6px;height:6px;margin:0 2px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform .15s}.tools details[open]>summary::before{transform:rotate(45deg)}.tools details:not(.card) form{padding:4px 0 10px}.tools .tool-facts{margin:0 0 8px;display:grid;gap:4px;font-size:.9rem}.tools .tool-facts p{margin:0}.tools .tool-controls{display:flex;gap:12px;flex-wrap:wrap;margin-top:12px}.tools .tool-found{display:flex;gap:10px;align-items:flex-start}.tools .tool-found input{flex:0 0 auto;width:18px;height:18px;margin-top:3px}.tools .tool-found span{min-width:0}.tools .problem{padding:10px 12px;margin:8px 0 0}.tools .tool-connect{scroll-margin-top:72px}.tools .connect-wanted{background:var(--so-accent);color:var(--so-on-accent);border-color:var(--so-accent)}.tools .connect-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:8px}.tools .connect-tile{display:grid;grid-template-columns:auto 1fr;column-gap:10px;align-items:center;justify-self:stretch;text-align:left;white-space:normal;padding:10px 12px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);color:var(--so-ink);min-height:60px;font:inherit;cursor:pointer;scroll-margin-top:96px}.tools .connect-tile:hover{border-color:var(--so-input-line);background:var(--so-raised)}.tools .connect-tile:target,.tools .connect-tile:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile .brand-mark{grid-row:span 2}.tools .connect-tile strong{font-weight:600;line-height:1.3}.tools .connect-tile>span:not(.brand-mark){font-size:.8rem;color:var(--so-muted);line-height:1.35;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}.tools .connect-tile[data-state="connected"]>span:not(.brand-mark){color:var(--so-success)}.tools .connect-local{grid-column:1/-1}.tools .connect-local>span:not(.brand-mark){-webkit-line-clamp:unset}.tools .connect-problem{margin:0}.tools .connect-problem:focus{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile:disabled{cursor:default;opacity:.6}${TILE_PHONE}{.tools .connect-grid{grid-template-columns:1fr 1fr}.tools .connect-tile:not(.connect-local)>span:not(.brand-mark){display:none}.tools .connect-local>span:not(.brand-mark){grid-column:2}.tools .connect-tile{min-height:52px;padding:8px 10px}.tools .connect-tile .brand-mark{grid-row:auto}.tools input,.tools select{font-size:16px}.tools .card{padding:14px}}`;
 /** The project chooser: it opens the chosen project at once; without scripts, its button does. */
 export function toolsProjectPicker(projects, chosen, keep = {}) {
     if (projects.length < 2)
@@ -14,23 +15,27 @@ export function toolsProjectPicker(projects, chosen, keep = {}) {
 }
 /** Choosing another project marks every form on the page as stale before it reloads, so a tap racing the reload is refused. */
 export const TOOLS_PROJECT_SCRIPT = `(function(){var s=document.querySelector('select[data-tools-project]');if(!s)return;s.addEventListener('change',function(){document.querySelectorAll('input[name=shown]').forEach(function(i){i.value=s.value;});});})();`;
-const password = html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`;
+const password = html `${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}`;
 function toolCard(one, base, manage, project, research = null) {
     const { tool, secretsSet } = one;
     const standing = toolStanding(tool, secretsSet);
-    // One line per secret: the disclosure is both where it stands and where it is set.
-    const secrets = manage ? tool.spec.secrets.map(secret => {
+    // How its runs get credentials, in one line; what that means is in Details.
+    const mode = credentialModeOf(tool.spec, secretsSet);
+    const credential = mode === null ? "" : html `<p class="tool-credential" data-credential="${mode.mode}">${mode.words}</p>`;
+    // One line per secret: the disclosure is both where it stands and where it is set. A service connected by signing
+    // in gets its tokens only by signing in again (its Connect tile): no token of it is ever pasted here.
+    const secrets = manage && !signedIn(tool.spec) ? tool.spec.secrets.map(secret => {
         const set = secretsSet.includes(secret.name);
         return html `<details><summary>${set ? `Replace ${secret.name}` : `Set ${secret.name}${secret.optional ? " (optional)" : ""}`}</summary>${postForm("/settings/tools/change", html `<label>${secret.name}<input type="password" name="value" autocomplete="off" required></label>${password}<button>Save</button>`, { hidden: { ...base, action: "secret", name: tool.name, secret: secret.name } })}</details>`;
     }) : "";
     const tested = tool.lastTest?.ok ? html `<p>Tested ${tool.lastTest.at.slice(0, 16).replace("T", " ")} UTC: ${tool.lastTest.tools.join(", ") || "it lists no tools"}</p>` : "";
-    const details = html `<details><summary>Details</summary><div class="tool-facts"><p>Starts: <code>${toolCommandLine(tool.spec)}</code></p><p>From ${tool.source} · added by ${tool.createdBy}</p>${tested}</div></details>`;
+    const details = html `<details><summary>Details</summary><div class="tool-facts">${mode?.detail == null ? "" : html `<p>${mode.detail}</p>`}<p>Starts: <code>${toolCommandLine(tool.spec)}</code></p><p>From ${tool.source} · added by ${tool.createdBy}</p>${tested}</div></details>`;
     const failed = tool.lastTest !== null && !tool.lastTest.ok ? html `<p class="problem" role="status">${tool.lastTest.problem ?? "The last test failed."}</p>` : "";
     // Connected, but research can't use it (its grant writes): said once, with the one way to fix it.
     const reconnect = research === null || !manage ? "" : html `<details><summary>Reconnect read-only</summary>${postForm("/settings/tools/connect", html `${password}<button>Reconnect read-only</button>`, { hidden: { ...base, service: tool.name, access: "read" } })}</details>`;
     const limited = research === null ? "" : html `<p class="tool-note" role="status">${research}</p>${reconnect}`;
     const controls = manage ? html `<div class="tool-controls">${postForm("/settings/tools/change", html `<button aria-label="Test ${tool.name} in ${project}">Test</button>`, { hidden: { ...base, action: "test", name: tool.name } })}${postForm("/settings/tools/change", html `<button class="secondary">Remove from ${project}</button>`, { hidden: { ...base, action: "remove", name: tool.name } })}</div>` : "";
-    return html `<article class="card" id="tool-${tool.name}"><div class="tool-heading">${brandMarkHtml(tool.source === "custom" ? null : tool.name, tool.name, standing.ready)}<h2>${tool.name}</h2><span class="tool-state" data-ready="${String(standing.ready)}">${standing.words}</span></div><p>${tool.spec.about}</p>${failed}${limited}${secrets}${details}${controls}</article>`;
+    return html `<article class="card" id="tool-${tool.name}"><div class="tool-heading">${brandMarkHtml(tool.source === "custom" ? null : tool.name, tool.name, standing.ready)}<h2>${tool.name}</h2><span class="tool-state" data-ready="${String(standing.ready)}">${standing.words}</span></div><p>${tool.spec.about}</p>${credential}${failed}${limited}${secrets}${details}${controls}</article>`;
 }
 /** A service connected here, offered to the person's other projects: each button signs in again for that project (tokens are never copied). */
 function elsewhere(view, base) {
@@ -44,7 +49,11 @@ export function toolsHtml(view, csrf, canManage, message = {}) {
     // `shown` is the project this page shows; the server refuses a post whose repo differs from it.
     const base = { repo: view.repo, shown: view.repo };
     const to = ` to ${view.project}`;
-    const intro = html `<p>Builds in ${view.project} use exactly these tools. MCP servers set up elsewhere on this computer aren't used.</p><details><summary>How tools work</summary><ul><li>A tool you add reaches work you approve from now on. Approve a task again to give it a new tool.</li><li>Removing a tool takes it away from every build right away.</li><li>Secrets stay on this computer, are never shown again, and go only to the tool that needs them.</li><li>Reviewers and the lead chat never get tools. Gemini builds don't use tools yet.</li></ul></details>`;
+    const keptIn = view.storage === undefined || view.storage.filesOnly ? "Secrets stay on this computer" : view.storage.words.replace(/\.$/, "");
+    // No keychain here: said once, plainly, where it can't be missed.
+    const storage = view.storage?.problem !== undefined ? html `<p class="problem tool-storage" role="alert">${view.storage.problem}</p>`
+        : view.storage?.filesOnly === true ? html `<p class="tool-storage" role="note">${view.storage.words}</p>` : "";
+    const intro = html `<p>Builds in ${view.project} use exactly these tools. MCP servers set up elsewhere on this computer aren't used.</p><details><summary>How tools work</summary><ul><li>A tool you add reaches work you approve from now on. Approve a task again to give it a new tool.</li><li>Removing a tool takes it away from every build right away.</li><li>${keptIn}, are never shown again, and go only to the tool that needs them.</li><li>Reviewers and the lead chat never get tools. Gemini builds don't use tools yet.</li></ul></details>`;
     const cards = view.tools.length === 0 ? html `<p class="meta">No tools yet. Builds in this project get none.</p>` : view.tools.map(one => toolCard(one, base, manage, view.project, view.connections.find(c => c.id === one.tool.name && c.state === "connected")?.research ?? null));
     const fromList = view.catalog.length === 0 ? "" : postForm("/settings/tools/change", html `<label>Common tools<select name="catalog">${view.catalog.map(one => html `<option value="${one.name}">${one.label}: ${one.about}</option>`)}</select></label>${password}<button>Add${to}</button>`, { hidden: { ...base, action: "add-catalog" } });
     const custom = html `<details><summary>Add your own</summary>${postForm("/settings/tools/change", html `<label>Name<input name="name" pattern="[a-z0-9][a-z0-9_\\-]{0,39}" maxlength="40" required placeholder="for example: postgres"></label><label>It runs as<select name="transport"><option value="stdio">A program on this computer</option><option value="http">A web address</option></select></label><label>Command or address<input name="target" required placeholder="npx -y some-mcp-server@1.2.3, or https://…"></label><label>Secrets it needs (names, comma separated)<input name="secrets" placeholder="for example: DATABASE_URL"></label><p class="meta">For a web address, the first secret is sent as its sign-in token. Set each secret's value after adding.</p>${password}<button>Add${to}</button>`, { hidden: { ...base, action: "add-custom" } })}</details>`;
@@ -62,5 +71,5 @@ export function toolsHtml(view, csrf, canManage, message = {}) {
     const add = manage ? html `<details class="card"${view.tools.length === 0 ? html ` open` : ""}><summary>Add a tool</summary>${fromList}${custom}</details>` : "";
     const found = manage && view.found.length > 0 ? html `<details class="card"><summary>Found on this computer (${view.found.length})</summary><p class="meta">MCP servers your other apps use. Adding one copies its settings, and any secrets it has, into this project.</p>${postForm("/settings/tools/change", html `${view.found.map(one => html `<label class="tool-found"><input type="checkbox" name="import" value="${one.spec.name}"><span><strong>${one.spec.name}</strong> · ${one.source}<br><code>${toolCommandLine(one.spec)}</code>${one.spec.secrets.length === 0 ? "" : html `<br><span class="meta">Brings ${one.spec.secrets.map(s => s.name).join(", ")}</span>`}</span></label>`)}${password}<button>Add selected${to}</button>`, { hidden: { ...base, action: "import" } })}</details>` : "";
     const note = atButton ? "" : message.problem ? html `<p class="problem" role="alert">${message.problem}</p>` : message.said ? html `<p role="status">${message.said}</p>` : "";
-    return html `<section class="tools">${note}${intro}${cards}${connect}${add}${found}</section>`;
+    return html `<section class="tools">${note}${intro}${storage}${cards}${connect}${add}${found}</section>`;
 }

package/dist/webhook-limits.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Webhook floods (docs/plans/webhook-tasks.md §4): how many deliveries a trigger's address may fail in a minute. Held
+ * in memory per store (a restart forgets it, which is harmless: it protects the process and the database's write rate,
+ * not anything durable). It counts only what doesn't prove itself — a bad, missing or stale signature, an address that
+ * isn't set up, an unknown address, and every delivery to an unsigned webhook (nothing proves those) — so a stranger
+ * holding a leaked address can't crowd out the deliveries that are signed.
+ */
+import type { Store } from "./store.js";
+/** At most this many unproven deliveries per address a minute; over it, further ones are answered 429 and do nothing. */
+export declare const UNPROVEN_PER_MINUTE = 60;
+/** Addresses that match no trigger share one count. */
+export declare const UNKNOWN_ADDRESS = "unknown";
+/** Count one unproven delivery to `address` at `now`. Whether it is over the minute's limit, and when to try again. */
+export declare function countUnproven(store: Store, address: string, now: Date): {
+    over: false;
+} | {
+    over: true;
+    retryAfterSeconds: number;
+};
+/** At most this many cards a trigger makes in a rolling hour (counted when each card is made). */
+export declare const CARDS_PER_HOUR = 30;
+/** At most this many signed deliveries a trigger holds while it waits for room; beyond it, deliveries are turned away. */
+export declare const HELD_AT_MOST = 200;

package/dist/webhook-limits.js

@@ -0,0 +1,30 @@
+/** At most this many unproven deliveries per address a minute; over it, further ones are answered 429 and do nothing. */
+export const UNPROVEN_PER_MINUTE = 60;
+const WINDOW_MS = 60_000;
+/** Addresses that match no trigger share one count. */
+export const UNKNOWN_ADDRESS = "unknown";
+const counters = new WeakMap();
+/** Count one unproven delivery to `address` at `now`. Whether it is over the minute's limit, and when to try again. */
+export function countUnproven(store, address, now) {
+    let counter = counters.get(store);
+    if (counter === undefined) {
+        counter = new Map();
+        counters.set(store, counter);
+    }
+    const at = now.getTime();
+    const recent = (counter.get(address) ?? []).filter(one => one > at - WINDOW_MS);
+    recent.push(at);
+    // Keep at most one over the limit: the count only needs to know it is over, and memory stays bounded per address.
+    counter.set(address, recent.slice(-(UNPROVEN_PER_MINUTE + 1)));
+    // Bounded across addresses too: the oldest addresses are forgotten first.
+    if (counter.size > 10_000)
+        counter.delete(counter.keys().next().value);
+    if (recent.length <= UNPROVEN_PER_MINUTE)
+        return { over: false };
+    const oldest = recent[recent.length - UNPROVEN_PER_MINUTE - 1];
+    return { over: true, retryAfterSeconds: Math.max(1, Math.ceil((oldest + WINDOW_MS - at) / 1000)) };
+}
+/** At most this many cards a trigger makes in a rolling hour (counted when each card is made). */
+export const CARDS_PER_HOUR = 30;
+/** At most this many signed deliveries a trigger holds while it waits for room; beyond it, deliveries are turned away. */
+export const HELD_AT_MOST = 200;

package/dist/webhook-readers.d.ts

@@ -0,0 +1,56 @@
+import type { WebhookSender } from "./webhook-signing.js";
+/** A webhook trigger's reading settings (its saved config, defaults filled). */
+export type ReaderSettings = {
+    sender: WebhookSender;
+    title: string;
+    titleField: string | null;
+    bodyField: string | null;
+    idField: string | null;
+    urlField: string | null;
+    project: string | null;
+    team: string | null;
+};
+/** What one delivery is, once read: an item (with the outside thing's identity and link, when it has them), a delivery
+ * whose configured identity couldn't be used (made into nothing, with why), or one that isn't for this flow. */
+export type ReadDelivery = {
+    kind: "item";
+    identity: string | null;
+    url: string | null;
+    title: string;
+    description: string;
+    label: string;
+} | {
+    kind: "skip";
+    why: string;
+} | {
+    kind: "ignored";
+    why: string;
+};
+/** Whether outside words could hold a key or password (the same check cards' words get). */
+export declare const looksSecret: (value: string) => boolean;
+/** Where a sender's links may point: its own host, and (for Sentry) the organisation subdomains under it. */
+export type LinkHosts = readonly {
+    host: string;
+    subdomains: boolean;
+}[];
+export declare const SENTRY_HOSTS: LinkHosts;
+export declare const VERCEL_HOSTS: LinkHosts;
+/**
+ * A link kept from a delivery: absolute https, at most 2,000 characters, no user information, and with its query and
+ * fragment dropped (where tokens travel). `hosts` narrows it to a sender's own site (and its subdomains). Null when it
+ * isn't one, or when what is left could still hold a secret.
+ */
+export declare function safeLink(value: unknown, hosts: LinkHosts | null): string | null;
+/** The identity words a key may carry: at most 120 characters, nothing hidden, and nothing that looks like a secret. */
+export declare function identityOf(value: unknown): {
+    ok: true;
+    id: string;
+} | {
+    ok: false;
+    why: string;
+};
+/** Whether each provider's reader has read a real, captured delivery (test/fixtures/webhooks/*.captured.json), or only
+ * its sender's documented examples so far: the panel says which until a captured one is in the suite. */
+export declare const READER_CAPTURED: Record<"sentry" | "vercel", boolean>;
+/** What a proven delivery says, by its sender's reader. */
+export declare function readDelivery(body: unknown, settings: ReaderSettings): ReadDelivery;

package/dist/webhook-readers.js

@@ -0,0 +1,138 @@
+/**
+ * What a proven webhook delivery says, read by its sender's reader (docs/plans/webhook-tasks.md §2). A signature proves
+ * who sent a delivery, not that it belongs in this flow: Sentry's and Vercel's readers check its shape, its action and
+ * the configured scope first, and only then give it an identity. Anything else is ignored, with why, and claims no
+ * identity. The generic senders pick their fields by dot-paths. Every outside value is screened for secrets before it
+ * is used anywhere (a key, a held item, a card, a task), and every link is made safe before it is kept.
+ */
+import { scanForSecrets } from "./evidence.js";
+const HIDDEN = /[\u0000-\u001f\u007f​-‏‪-‮⁦-⁩]/;
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+const pick = (body, path) => path.split(".").reduce((node, part) => record(node)[part], body);
+const text = (value) => typeof value === "string" && value.trim() !== "" ? value.trim() : null;
+/** A string or a safe integer, as an identity's words exactly as sent; anything else isn't one. */
+const idWords = (value) => typeof value === "string" ? value : typeof value === "number" && Number.isSafeInteger(value) ? String(value) : null;
+/** Whether outside words could hold a key or password (the same check cards' words get). */
+export const looksSecret = (value) => scanForSecrets(value).length > 0;
+export const SENTRY_HOSTS = [{ host: "sentry.io", subdomains: true }];
+export const VERCEL_HOSTS = [{ host: "vercel.com", subdomains: false }];
+/**
+ * A link kept from a delivery: absolute https, at most 2,000 characters, no user information, and with its query and
+ * fragment dropped (where tokens travel). `hosts` narrows it to a sender's own site (and its subdomains). Null when it
+ * isn't one, or when what is left could still hold a secret.
+ */
+export function safeLink(value, hosts) {
+    if (typeof value !== "string" || value.length > 2000 || HIDDEN.test(value))
+        return null;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "")
+        return null;
+    const host = url.hostname.toLowerCase();
+    if (hosts !== null && !hosts.some(one => host === one.host || (one.subdomains && host.endsWith(`.${one.host}`))))
+        return null;
+    const kept = `${url.origin}${url.pathname}`;
+    // Judged as it will be kept: an address that only normalises past 2,000 characters (escaped non-ASCII) isn't kept.
+    if (kept.length > 2000)
+        return null;
+    // Screened as kept and as read: a token spelled with percent-escapes is the same token. A path that won't decode isn't kept.
+    let decoded;
+    try {
+        decoded = decodeURIComponent(url.pathname);
+    }
+    catch {
+        return null;
+    }
+    return looksSecret(kept) || looksSecret(decoded) || HIDDEN.test(decoded) ? null : kept;
+}
+/** The identity words a key may carry: at most 120 characters, nothing hidden, and nothing that looks like a secret. */
+export function identityOf(value) {
+    const sent = idWords(value);
+    if (sent === null || sent.trim() === "")
+        return { ok: false, why: "its identity is missing" };
+    // Judged as sent, before anything is trimmed: padding, hidden characters or length make it unusable, never another id.
+    if (sent.length > 120 || HIDDEN.test(sent) || sent !== sent.trim())
+        return { ok: false, why: "its identity isn't usable" };
+    if (looksSecret(sent))
+        return { ok: false, why: "it looked like it held a key or password" };
+    return { ok: true, id: sent };
+}
+/** Sentry's API address for an event names its project's slug (…/api/0/projects/<org>/<project>/events/<id>/): read
+ * only from that exact shape on Sentry's own host. */
+function sentrySlugOf(value) {
+    const link = typeof value === "string" ? value : "";
+    const match = /^https:\/\/(?:[a-z0-9-]+\.)?sentry\.io\/api\/0\/projects\/[a-z0-9_-]+\/([a-z0-9_-]+)\/events\/[A-Za-z0-9-]+\/?$/.exec(link);
+    return match?.[1] ?? null;
+}
+/** Sentry: an issue alert (action "triggered", with the event) or a new issue (action "created", with the issue). */
+function readSentry(body, settings) {
+    const action = text(record(body)["action"]);
+    const data = record(record(body)["data"]);
+    const alert = action === "triggered" && Object.keys(record(data["event"])).length > 0;
+    const created = action === "created" && Object.keys(record(data["issue"])).length > 0;
+    // A fixed reason: nothing the sender wrote is kept for an event Toolroll doesn't take.
+    if (!alert && !created)
+        return { kind: "ignored", why: "not an issue alert or a new issue" };
+    const thing = record(alert ? data["event"] : data["issue"]);
+    // Scope from the body alone (the resource header isn't signed): the project's id or slug, as Sentry sends it.
+    if (settings.project !== null) {
+        const project = record(thing["project"]);
+        // An alert's event names its project by number, and by slug only in its API address; a new issue names both.
+        const names = [idWords(thing["project"]), idWords(project["id"]), text(project["slug"]), sentrySlugOf(thing["url"])].filter((one) => one !== null);
+        if (!names.some(one => one.toLowerCase() === settings.project.toLowerCase()))
+            return { kind: "ignored", why: "from another Sentry project" };
+    }
+    const identity = identityOf(alert ? thing["issue_id"] : thing["id"]);
+    if (!identity.ok)
+        return { kind: "skip", why: identity.why };
+    const title = text(thing["title"]) ?? settings.title;
+    const culprit = text(thing["culprit"]);
+    return { kind: "item", identity: identity.id, url: safeLink(thing["web_url"], SENTRY_HOSTS), title, description: culprit === null ? "From a Sentry issue." : `From a Sentry issue, in ${culprit}.`, label: "Sentry issue" };
+}
+/** Vercel: a failed deployment only, from the configured project and team. */
+function readVercel(body, settings) {
+    const type = text(record(body)["type"]);
+    if (type !== "deployment.error")
+        return { kind: "ignored", why: "not a failed deployment" };
+    const payload = record(record(body)["payload"]);
+    if (settings.project !== null && idWords(record(payload["project"])["id"]) !== settings.project)
+        return { kind: "ignored", why: "from another Vercel project" };
+    if (settings.team !== null && idWords(record(payload["team"])["id"]) !== settings.team)
+        return { kind: "ignored", why: "from another Vercel team" };
+    const deployment = record(payload["deployment"]);
+    const identity = identityOf(deployment["id"]);
+    if (!identity.ok)
+        return { kind: "skip", why: identity.why };
+    const name = text(deployment["name"]);
+    return { kind: "item", identity: identity.id, url: safeLink(record(payload["links"])["deployment"], VERCEL_HOSTS), title: name === null ? settings.title : `${name} failed to deploy`,
+        description: "From a failed Vercel deployment.", label: "Vercel deployment" };
+}
+/** Any JSON: the trigger's own paths, then the usual names; shown whole when they find no text. */
+function readGeneric(body, settings) {
+    const at = (path) => path === null ? undefined : pick(body, path);
+    let identity = null;
+    if (settings.idField !== null) {
+        const read = identityOf(at(settings.idField));
+        // A configured identity that can't be used makes nothing: it never falls back to some other identity.
+        if (!read.ok)
+            return { kind: "skip", why: read.why };
+        identity = read.id;
+    }
+    const title = at(settings.titleField ?? "title") ?? at("summary") ?? at("message");
+    const details = at(settings.bodyField ?? "description") ?? at("body") ?? at("text");
+    return { kind: "item", identity, url: settings.urlField === null ? null : safeLink(at(settings.urlField), null),
+        title: typeof title === "string" && title.trim() !== "" ? title : settings.title,
+        description: `From a webhook:\n\n${typeof details === "string" ? details : JSON.stringify(body, null, 2)}`.slice(0, 4000), label: "Webhook" };
+}
+/** Whether each provider's reader has read a real, captured delivery (test/fixtures/webhooks/*.captured.json), or only
+ * its sender's documented examples so far: the panel says which until a captured one is in the suite. */
+export const READER_CAPTURED = { sentry: false, vercel: false };
+/** What a proven delivery says, by its sender's reader. */
+export function readDelivery(body, settings) {
+    return settings.sender === "sentry" ? readSentry(body, settings) : settings.sender === "vercel" ? readVercel(body, settings) : readGeneric(body, settings);
+}

package/dist/webhook-signing.d.ts

@@ -0,0 +1,27 @@
+import { WEBHOOK_SENDERS } from "./contracts/flow.js";
+export { WEBHOOK_SENDERS };
+export type WebhookSender = (typeof WEBHOOK_SENDERS)[number];
+/** The senders whose deliveries carry a signature (everything but `none`). */
+export type SigningSender = Exclude<WebhookSender, "none">;
+export declare const SENDER_WORDS: Record<WebhookSender, string>;
+/** Node's `headersDistinct`: every header's values, one per line it arrived on. */
+export type DistinctHeaders = Record<string, string[] | undefined>;
+export type Proof = {
+    ok: true;
+    signedId: string | null;
+} | {
+    ok: false;
+    said: string;
+};
+/** A Standard Webhooks timestamp may be this far from now, either way. */
+export declare const STANDARD_TOLERANCE_MS: number;
+/** A `whsec_` secret's key bytes, or null when it isn't one. */
+export declare function standardKey(secret: string): Buffer | null;
+/** Whether a delivery was signed with this secret by this sender. `none` proves nothing and is never passed here. */
+export declare function proveDelivery(sender: SigningSender, secret: string, headers: DistinctHeaders, body: Buffer, now: Date): Proof;
+/** Whether a pasted secret has its sender's shape (Sentry's and Vercel's come from them; the others can be made here). */
+export declare function secretShapeOk(sender: SigningSender, secret: string): boolean;
+/** A new secret for a sender Toolroll can make one for; Sentry's and Vercel's are pasted from them. */
+export declare function makeSecret(sender: "standard" | "github-style"): string;
+/** Whether Toolroll makes this sender's secret (and shows it once), rather than asking for the sender's own. */
+export declare const makesSecret: (sender: SigningSender) => sender is "standard" | "github-style";

package/dist/webhook-signing.js

@@ -0,0 +1,119 @@
+/**
+ * How a webhook proves who sent it (docs/plans/webhook-tasks.md §1). Each sender's check runs over the raw bytes,
+ * before anything is parsed; a security header sent more than once, or not at all, is refused. Nothing here reads or
+ * writes the store: the caller passes the current generation's secret, and a refusal writes nothing.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { WEBHOOK_SENDERS } from "./contracts/flow.js";
+export { WEBHOOK_SENDERS };
+export const SENDER_WORDS = {
+    none: "Unsigned", standard: "Standard Webhooks", "github-style": "GitHub-style signature", sentry: "Sentry", vercel: "Vercel",
+};
+/** A Standard Webhooks timestamp may be this far from now, either way. */
+export const STANDARD_TOLERANCE_MS = 5 * 60_000;
+const HEX = (bytes) => new RegExp(`^[0-9a-f]{${bytes * 2}}$`);
+const BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+const HIDDEN = /[\u0000-\u001f\u007f]/;
+/** Exactly one value for a security header, or why not. */
+function single(headers, name) {
+    const values = headers[name] ?? [];
+    if (values.length === 0)
+        return { ok: false, said: `The ${name} header is missing.` };
+    if (values.length > 1)
+        return { ok: false, said: `The ${name} header was sent more than once.` };
+    return { ok: true, value: values[0] };
+}
+function same(expected, given) {
+    return expected.length === given.length && timingSafeEqual(expected, given);
+}
+/** A `whsec_` secret's key bytes, or null when it isn't one. */
+export function standardKey(secret) {
+    if (!secret.startsWith("whsec_"))
+        return null;
+    const encoded = secret.slice("whsec_".length);
+    if (!BASE64.test(encoded) || encoded.length % 4 !== 0)
+        return null;
+    const key = Buffer.from(encoded, "base64");
+    return key.length >= 24 && key.length <= 64 ? key : null;
+}
+/** Whether a delivery was signed with this secret by this sender. `none` proves nothing and is never passed here. */
+export function proveDelivery(sender, secret, headers, body, now) {
+    switch (sender) {
+        case "github-style": {
+            const header = single(headers, "x-hub-signature-256");
+            if (!header.ok)
+                return header;
+            const given = header.value.trim().toLowerCase();
+            if (!given.startsWith("sha256=") || !HEX(32).test(given.slice(7)))
+                return { ok: false, said: "The signature isn't sha256=<hex>." };
+            return same(createHmac("sha256", secret).update(body).digest(), Buffer.from(given.slice(7), "hex")) ? { ok: true, signedId: null } : { ok: false, said: "Signature doesn't match." };
+        }
+        case "sentry": {
+            const header = single(headers, "sentry-hook-signature");
+            if (!header.ok)
+                return { ok: false, said: header.said.includes("missing") ? "Sentry didn't sign this: use an Internal Integration's webhook." : header.said };
+            const given = header.value.trim().toLowerCase();
+            if (!HEX(32).test(given))
+                return { ok: false, said: "The signature isn't a SHA-256 hex digest." };
+            return same(createHmac("sha256", secret).update(body).digest(), Buffer.from(given, "hex")) ? { ok: true, signedId: null } : { ok: false, said: "Signature doesn't match." };
+        }
+        case "vercel": {
+            const header = single(headers, "x-vercel-signature");
+            if (!header.ok)
+                return header;
+            const given = header.value.trim().toLowerCase();
+            if (!HEX(20).test(given))
+                return { ok: false, said: "The signature isn't a SHA-1 hex digest." };
+            return same(createHmac("sha1", secret).update(body).digest(), Buffer.from(given, "hex")) ? { ok: true, signedId: null } : { ok: false, said: "Signature doesn't match." };
+        }
+        case "standard": {
+            const key = standardKey(secret);
+            if (key === null)
+                return { ok: false, said: "The saved secret isn't a whsec_ secret." };
+            const id = single(headers, "webhook-id"), stamp = single(headers, "webhook-timestamp"), signature = single(headers, "webhook-signature");
+            for (const header of [id, stamp, signature])
+                if (!header.ok)
+                    return header;
+            const idText = id.value, stampText = stamp.value, signatureText = signature.value;
+            if (idText === "" || idText.length > 200 || HIDDEN.test(idText))
+                return { ok: false, said: "The webhook-id header isn't usable." };
+            // Unix seconds, as an integer: milliseconds, decimals and signs are refused, not guessed at.
+            if (!/^\d{1,11}$/.test(stampText))
+                return { ok: false, said: "The webhook-timestamp isn't Unix seconds." };
+            if (Math.abs(now.getTime() - Number(stampText) * 1000) > STANDARD_TOLERANCE_MS)
+                return { ok: false, said: "Too old, or from the future." };
+            const expected = createHmac("sha256", key).update(Buffer.concat([Buffer.from(`${idText}.${stampText}.`, "utf8"), body])).digest();
+            // Any well-formed v1 entry may match; a malformed entry is passed over, and none well-formed is a refusal.
+            let wellFormed = 0;
+            for (const entry of signatureText.split(" ")) {
+                if (!entry.startsWith("v1,"))
+                    continue;
+                const encoded = entry.slice(3);
+                if (!BASE64.test(encoded) || encoded.length % 4 !== 0)
+                    continue;
+                const given = Buffer.from(encoded, "base64");
+                if (given.length !== 32)
+                    continue;
+                wellFormed++;
+                if (same(expected, given))
+                    return { ok: true, signedId: idText };
+            }
+            return { ok: false, said: wellFormed === 0 ? "The webhook-signature has no v1 signature." : "Signature doesn't match." };
+        }
+    }
+}
+/** Whether a pasted secret has its sender's shape (Sentry's and Vercel's come from them; the others can be made here). */
+export function secretShapeOk(sender, secret) {
+    switch (sender) {
+        case "sentry": return /^[0-9a-fA-F]{32,128}$/.test(secret);
+        case "vercel": return /^[A-Za-z0-9]{16,200}$/.test(secret);
+        case "standard": return standardKey(secret) !== null;
+        case "github-style": return /^[\x21-\x7e]{16,200}$/.test(secret);
+    }
+}
+/** A new secret for a sender Toolroll can make one for; Sentry's and Vercel's are pasted from them. */
+export function makeSecret(sender) {
+    return sender === "standard" ? `whsec_${randomBytes(32).toString("base64")}` : randomBytes(32).toString("hex");
+}
+/** Whether Toolroll makes this sender's secret (and shows it once), rather than asking for the sender's own. */
+export const makesSecret = (sender) => sender === "standard" || sender === "github-style";