toolroll 0.9.67 → 0.9.69

package/dist/discord-settings.js

@@ -1,41 +1,13 @@
-import { loadPrimary } from "./webhooks.js";
-import { html, postForm } from "./html.js";
+import { html } from "./html.js";
 import { loadDiscordCredentials } from "./discord-api.js";
-import { ChatState } from "./chat-delivery-state.js";
+import { chatSettingsHtml } from "./chat-settings-page.js";
 export function discordSettingsHtml(store, dir, options = {}) {
-    const credentials = loadDiscordCredentials(dir), state = new ChatState(store, "discord"), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
-    const runtime = credentials ? state.runtime(credentials.installation) : null;
-    const now = options.now ?? new Date(), live = runtime &&
-        runtime.leaseUntil !== null &&
-        runtime.leaseUntil > now.toISOString() &&
-        runtime.connected;
-    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
-    const post = (action, content) => postForm(`/settings/discord/${action}`, content, { attrs: { class: "card" } });
-    const parts = [];
-    if (!credentials) {
-        parts.push(html `<p>Manage projects and review results in a private Discord conversation.</p>`, html `<details open><summary>Create your Discord app</summary><ol><li><a href="https://discord.com/developers/applications" target="_blank" rel="noopener noreferrer">Create an application</a>, then copy its token from the Bot page.</li><li>Keep the Interactions Endpoint URL empty and privileged intents off.</li><li>Under Installation, enable Guild Install with the bot scope and no server permissions. Use its install link to add it to your server, then open a direct message to the bot.</li></ol></details>`, post("connect", html `<label>Bot token<input style="min-height:44px" type="password" name="bot-token" autocomplete="off" required></label>${password}<p class="meta">The token stays on this installation. Next, pair your own Discord account.</p><button type="submit">Connect Discord</button>`));
-    }
-    else {
-        parts.push(html `<p><strong>${credentials.workspace}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`);
-        if (runtime?.problem)
-            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
-        if (!live && !runtime?.problem)
-            parts.push(html `<p>Keep the Toolroll worker running to receive Discord messages.</p>`);
-        if (options.code) {
-            parts.push(html `<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll Discord app. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/discord">Check connection</a>`);
-        }
-        else if (binding && state.live(binding)) {
-            const { pending, dropped: failed } = state.partCounts(binding.id);
-            parts.push(html `<p>Your Discord account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>`, html `<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === "discord"
-                ? html `<p>Task updates are sent here.</p>`
-                : post("alerts", html `<button type="submit">Send task updates here</button>`));
-        }
-        else {
-            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired Discord account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
-        }
-        if (binding && state.live(binding) && !options.code)
-            parts.push(post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
-        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect Discord</button>`)}</details>`);
-    }
-    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Discord</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}<details><summary>Access and setup</summary><p>Private messages and replies use your Toolroll permissions. Shared channels are not supported. Secure review links use this installation’s configured HTTPS console address.</p><p>The worker connects out to Discord. It does not need a public webhook or a Tailscale account.</p></details></section>`;
+    return chatSettingsHtml(store, dir, options, {
+        provider: "discord",
+        label: "Discord",
+        credentials: loadDiscordCredentials(dir),
+        setup: html `<details open><summary>Create your Discord app</summary><ol><li><a href="https://discord.com/developers/applications" target="_blank" rel="noopener noreferrer">Create an application</a>, then copy its token from the Bot page.</li><li>Keep the Interactions Endpoint URL empty and privileged intents off.</li><li>Under Installation, enable Guild Install with the bot scope and no server permissions. Use its install link to add it to your server, then open a direct message to the bot.</li></ol></details>`,
+        connect: password => html `<label>Bot token<input style="min-height:44px" type="password" name="bot-token" autocomplete="off" required></label>${password}<p class="meta">The token stays on this installation. Next, pair your own Discord account.</p><button type="submit">Connect Discord</button>`,
+        access: html `<p>Private messages and replies use your Toolroll permissions. Shared channels are not supported. Secure review links use this installation’s configured HTTPS console address.</p><p>The worker connects out to Discord. It does not need a public webhook or a Tailscale account.</p>`,
+    });
 }

package/dist/discord.js

@@ -1,6 +1,6 @@
 /** A single leased Discord Gateway connection, hosted by the ordinary worker. */
 import { randomBytes } from "node:crypto";
-import { setTimeout as sleep } from "node:timers/promises";
+import { abortablePause, workChatQueue } from "./chat-follow.js";
 import { loadDiscordCredentials, discordApi, object, discordId, } from "./discord-api.js";
 import { ChatState, chatHash } from "./chat-delivery-state.js";
 import { receiveDiscord, processDiscordEvent, deliverDiscordPart, planDiscordNotifications, planDiscordRooms, } from "./discord-chat.js";
@@ -12,14 +12,7 @@ export function discordReadyMatches(raw, identity) {
 }
 export async function followDiscord(options) {
     const owner = randomBytes(16).toString("hex"), state = new ChatState(options.store, "discord");
-    const pause = async (ms) => {
-        try {
-            await sleep(ms, undefined, { signal: options.signal });
-        }
-        catch {
-            /* shutdown */
-        }
-    };
+    const pause = abortablePause(options.signal);
     while (!options.signal.aborted) {
         const credentials = loadDiscordCredentials(options.dir);
         if (!credentials ||
@@ -129,20 +122,16 @@ export async function followDiscord(options) {
         };
         try {
             await client.login(credentials.botToken);
-            while (same()) {
-                if (!connected || state.retryAt(credentials.installation) > new Date().toISOString()) {
-                    await pause(1000);
-                    continue;
-                }
-                await processDiscordEvent(chat);
-                if (same())
-                    await planDiscordRooms(chat);
-                if (same())
-                    await deliverDiscordPart(chat);
-                if (same() && options.notifications())
-                    await planDiscordNotifications(chat);
-                await pause(1000);
-            }
+            await workChatQueue({
+                same,
+                ready: () => connected && !(state.retryAt(credentials.installation) > new Date().toISOString()),
+                pause,
+                notifications: () => options.notifications(),
+                process: () => processDiscordEvent(chat),
+                rooms: () => planDiscordRooms(chat),
+                deliver: () => deliverDiscordPart(chat),
+                notify: () => planDiscordNotifications(chat),
+            });
         }
         catch {
             if (alive)

package/dist/evidence.d.ts

@@ -80,7 +80,6 @@ export declare function evidenceRoot(home: string): string;
  * name. The agent learns the name from its brief and nowhere else.
  */
 export declare function mailboxName(): string;
-export declare function looksLikeMailbox(name: string): boolean;
 /** Every protocol file the sweep must never let an old attempt leave behind.
  * The pre-rename NIGHTORDERS- prefix stays recognized here — a worktree cut
  * down before 2026-08-13 may still hold one, and cleanup has no vintage. */

package/dist/evidence.js

@@ -128,9 +128,6 @@ export function evidenceRoot(home) {
 export function mailboxName() {
     return `${MAILBOX_PREFIX}${randomBytes(8).toString("hex")}${MAILBOX_SUFFIX}`;
 }
-export function looksLikeMailbox(name) {
-    return name.startsWith(MAILBOX_PREFIX) && name.endsWith(MAILBOX_SUFFIX);
-}
 /** Every protocol file the sweep must never let an old attempt leave behind.
  * The pre-rename NIGHTORDERS- prefix stays recognized here — a worktree cut
  * down before 2026-08-13 may still hold one, and cleanup has no vintage. */

package/dist/exec.d.ts

@@ -246,15 +246,6 @@ export declare function run(file: string, args: readonly string[], options?: Run
  * worst useful case while remaining a hard, per-event memory boundary.
  */
 export declare const JSONL_EVENT_HARD_CAP: number;
-/**
- * The accounting an oversized Claude result still carries, read by a bounded scan of its kept prefix and tail: the
- * session's running `total_cost_usd`, its `usage` and `num_turns`, and whether it is a main result at all (an
- * `origin` naming anything but a person makes it a background task's). Anything unreadable or seen twice is absent.
- */
-export declare function scanOversizedClaudeResult(prefix: Buffer, tail: Buffer | undefined): {
-    primary: boolean;
-    account: Record<string, unknown>;
-};
 /** Marks a Claude result whose session cost could not be read: the gateway charges the run's dollar cap instead. */
 export declare const CLAUDE_COST_UNKNOWN = "standing_orders_cost_unknown";
 export declare function runStreamJsonl(file: string, args: readonly string[], options?: RunOptions): Promise<ExecResult>;

package/dist/exec.js

@@ -9,12 +9,12 @@
 import { ACP_LINE_CAP, createAcpConversation } from "./acp-client.js";
 import { linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced } from "./agent-fence.js";
 import { execFile, execFileSync, spawn } from "node:child_process";
-import { readFileSync, realpathSync } from "node:fs";
-import { join } from "node:path";
+import { realpathSync } from "node:fs";
 import { observeProcessTree, stopProcessTree } from "./process-tree.js";
 import { jsonlDiscriminants } from "./jsonl-discriminants.js";
 import { createContainer, currentContainment } from "./containment.js";
 import { claudeLimitsOf, noteLimits } from "./provider-limits.js";
+import { sleep as defaultSleep } from "./sleep.js";
 /** Shell convention for "could not be executed": the refusal before any target ran. */
 export const CONTAINMENT_REFUSED_CODE = 126;
 /** Live provider children, for the deterministic stop. Registered only when `processGroup` was set. */
@@ -508,7 +508,7 @@ export function isTransientSpawnFailure(error) {
  * A non-transient answer — success, a real exit code, not found, timeout —
  * is returned at once: only the never-started case is retried.
  */
-export async function retryTransientSpawn(attempt, delays = SPAWN_RETRY_DELAYS_MS, sleep = ms => new Promise(resolve => setTimeout(resolve, ms))) {
+export async function retryTransientSpawn(attempt, delays = SPAWN_RETRY_DELAYS_MS, sleep = defaultSleep) {
     let last = await attempt();
     for (const delay of delays) {
         if (!last.transient)
@@ -942,81 +942,6 @@ function leadingClaudeSystemSubtype(prefix) {
 }
 /** How much of an oversized Claude result's end is kept to read its cost and usage (they follow the words). */
 const CLAUDE_RESULT_TAIL_CAP = 64 * 1024;
-/**
- * Where a key's value starts in a fragment of JSON text, once and only once. `"key":` never occurs inside a JSON
- * string (every quote there is escaped, so `y":` cannot appear), so each match is a real key, though possibly of a
- * nested object. A key seen more than once is ambiguous and reads as absent.
- */
-function soleKeyValueAt(texts, key) {
-    const pattern = new RegExp(`"${key}"\\s*:\\s*`, "g");
-    let found = null;
-    for (const text of texts) {
-        for (const match of text.matchAll(pattern)) {
-            if (found !== null)
-                return null;
-            found = { text, at: match.index + match[0].length };
-        }
-    }
-    return found;
-}
-/** The JSON object starting at `at`, read to its matching brace (strings and escapes respected), or null. */
-function jsonObjectAt(text, at) {
-    if (text[at] !== "{")
-        return null;
-    let depth = 0, inString = false;
-    for (let i = at; i < text.length && i - at < CLAUDE_RESULT_TAIL_CAP; i += 1) {
-        const c = text[i];
-        if (inString) {
-            if (c === "\\")
-                i += 1;
-            else if (c === '"')
-                inString = false;
-        }
-        else if (c === '"')
-            inString = true;
-        else if (c === "{")
-            depth += 1;
-        else if (c === "}" && --depth === 0) {
-            try {
-                const value = JSON.parse(text.slice(at, i + 1));
-                return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-            }
-            catch {
-                return null;
-            }
-        }
-    }
-    return null;
-}
-/**
- * The accounting an oversized Claude result still carries, read by a bounded scan of its kept prefix and tail: the
- * session's running `total_cost_usd`, its `usage` and `num_turns`, and whether it is a main result at all (an
- * `origin` naming anything but a person makes it a background task's). Anything unreadable or seen twice is absent.
- */
-export function scanOversizedClaudeResult(prefix, tail) {
-    const texts = [prefix.toString("utf8"), ...(tail === undefined ? [] : [tail.toString("utf8")])];
-    const origin = soleKeyValueAt(texts, "origin");
-    const originObject = origin === null ? null : jsonObjectAt(origin.text, origin.at);
-    const primary = originObject === null || String(originObject["kind"] ?? "") === "human";
-    const account = {};
-    const number = (key) => {
-        const at = soleKeyValueAt(texts, key);
-        const match = at === null ? null : /^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(at.text.slice(at.at, at.at + 64));
-        const value = match === null ? NaN : Number(match[0]);
-        return Number.isFinite(value) && value >= 0 ? value : null;
-    };
-    const cost = number("total_cost_usd");
-    if (cost !== null)
-        account["total_cost_usd"] = cost;
-    const turns = number("num_turns");
-    if (turns !== null)
-        account["num_turns"] = turns;
-    const usageAt = soleKeyValueAt(texts, "usage");
-    const usage = usageAt === null ? null : jsonObjectAt(usageAt.text, usageAt.at);
-    if (usage !== null)
-        account["usage"] = usage;
-    return { primary, account };
-}
 /** Marks a Claude result whose session cost could not be read: the gateway charges the run's dollar cap instead. */
 export const CLAUDE_COST_UNKNOWN = "standing_orders_cost_unknown";
 function malformedCodexEventIsLoadBearing(prefix) {
@@ -1036,7 +961,6 @@ function malformedGeminiEventIsLoadBearing(prefix) {
     return type === "init" || type === "result";
 }
 export function runStreamJsonl(file, args, options = {}) {
-    const { cwd } = options;
     const childEnv = resolveChildEnv(options);
     return new Promise(resolve => {
         let child;
@@ -1249,7 +1173,6 @@ export function runStreamJsonl(file, args, options = {}) {
  * semantics match `runStreamJsonl`.
  */
 export function runGeminiStreamJsonl(file, args, options = {}) {
-    const { cwd } = options;
     const childEnv = resolveChildEnv(options);
     return new Promise(resolve => {
         let child;
@@ -1843,7 +1766,6 @@ export const STREAM_INPUT = Symbol.for("toolroll.streamInput");
 /** Whether a runner declares it keeps stdin open for a live session; an injected runner opts in by carrying the mark. */
 export const streamsInput = (runner) => typeof runner === "function" && runner[STREAM_INPUT] === true;
 export function runClaudeStreamJsonl(file, args, options = {}) {
-    const { cwd } = options;
     const childEnv = resolveChildEnv(options);
     const live = options.liveInput ?? null;
     return new Promise(resolve => {

package/dist/flow-actions.js

@@ -18,9 +18,6 @@
  * answer: the card takes its failure path. Trouble reaching a service is
  * tried again, like every step.
  */
-import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { redactSecretAssignments } from "./builder.js";
 import { redactSecretLines, scanForSecrets } from "./evidence.js";
 import { fillFlowText } from "./flows.js";

package/dist/flow-draft.d.ts

@@ -1,4 +1,4 @@
-import { run, type ExecResult } from "./exec.js";
+import { type CommandRunner } from "./claude-print.js";
 import { type FlowDefinition, type FlowStage } from "./flows.js";
 export declare const DRAFT_CHARS: 12000;
 export type DraftCard = {
@@ -37,8 +37,6 @@ export declare function draftPrompt(stage: FlowStage, card: DraftCard, definitio
 export declare function wholeDraft(text: string): string;
 /** A draft a person edited, as kept: trimmed, whole (one over DRAFT_CHARS is refused where it is written, never cut), and never holding a key-shaped line. */
 export declare function keptDraft(text: string): string;
-type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
 /** The production runner: Claude through the sign-in on this computer, with no tools, no MCP servers and no repository. */
 export declare function claudeDraftRunner(runner?: CommandRunner): DraftRunner;
 export declare const DRAFT_TIMEOUT = 180000;
-export {};

package/dist/flow-draft.js

@@ -7,13 +7,9 @@
  * nothing is sent: a later zone shows it to a person, and a later step posts
  * it ({{stage.<id>}}).
  */
-import { Buffer } from "node:buffer";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { strictJsonParse } from "./converse.js";
 import { redactSecretLines, scanForSecrets } from "./evidence.js";
 import { run } from "./exec.js";
+import { CLAUDE_NO_TOOLS_ARGS, CLAUDE_SIGNED_OUT, claudeJsonBody, claudeModelArgs, inScratchDir } from "./claude-print.js";
 import { fillFlowText } from "./flows.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 import { LIMITS } from "./decision.js";
@@ -62,30 +58,21 @@ export function keptDraft(text) {
 }
 /** The production runner: Claude through the sign-in on this computer, with no tools, no MCP servers and no repository. */
 export function claudeDraftRunner(runner = run) {
-    return async (request) => {
-        const dir = mkdtempSync(join(tmpdir(), "standing-orders-draft-"));
+    return request => inScratchDir("standing-orders-draft-", async (dir) => {
         const started = Date.now();
-        try {
-            const result = await runner("claude", [
-                "-p", "--output-format", "json", "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
-                "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
-                ...(request.model === "default" ? [] : ["--model", request.model]),
-            ], { cwd: dir, stdin: request.prompt, timeoutMs: request.timeoutMs, maxBuffer: 256 * 1024, omitEnv: ALL_CREDENTIAL_ENV, processGroup: true });
-            if (result.notFound)
-                return { ok: false, said: "Claude isn't installed on this computer." };
-            if (result.timedOut)
-                return { ok: false, said: "Claude took too long to write the draft." };
-            const parsed = strictJsonParse(Buffer.from(result.stdout, "utf8"), 256 * 1024, 12);
-            const body = parsed.ok && typeof parsed.value === "object" && parsed.value !== null && !Array.isArray(parsed.value) ? parsed.value : null;
-            if (result.code !== 0 || body === null || body["is_error"] === true || body["subtype"] !== "success" || typeof body["result"] !== "string") {
-                return { ok: false, said: /not logged in|login|authenticat/i.test(`${result.stdout}${result.stderr}`) ? "Claude isn't signed in on this computer." : "Claude couldn't write the draft." };
-            }
-            const cost = body["total_cost_usd"];
-            return { ok: true, text: body["result"], ms: Date.now() - started, ...(typeof cost === "number" && Number.isFinite(cost) && cost >= 0 ? { costUsd: cost } : {}) };
+        const result = await runner("claude", [
+            "-p", "--output-format", "json", ...CLAUDE_NO_TOOLS_ARGS, ...claudeModelArgs(request.model),
+        ], { cwd: dir, stdin: request.prompt, timeoutMs: request.timeoutMs, maxBuffer: 256 * 1024, omitEnv: ALL_CREDENTIAL_ENV, processGroup: true });
+        if (result.notFound)
+            return { ok: false, said: "Claude isn't installed on this computer." };
+        if (result.timedOut)
+            return { ok: false, said: "Claude took too long to write the draft." };
+        const body = claudeJsonBody(result.stdout, 256 * 1024);
+        if (result.code !== 0 || body === null || body["is_error"] === true || body["subtype"] !== "success" || typeof body["result"] !== "string") {
+            return { ok: false, said: CLAUDE_SIGNED_OUT.test(`${result.stdout}${result.stderr}`) ? "Claude isn't signed in on this computer." : "Claude couldn't write the draft." };
         }
-        finally {
-            rmSync(dir, { recursive: true, force: true });
-        }
-    };
+        const cost = body["total_cost_usd"];
+        return { ok: true, text: body["result"], ms: Date.now() - started, ...(typeof cost === "number" && Number.isFinite(cost) && cost >= 0 ? { costUsd: cost } : {}) };
+    });
 }
 export const DRAFT_TIMEOUT = DRAFT_TIMEOUT_MS;

package/dist/flow-scripts.d.ts

@@ -1,5 +1,5 @@
 import { type ScriptLanguage } from "./flows.js";
-import type { FlowScriptRow, Store } from "./store.js";
+import type { Store } from "./store.js";
 export type ScriptDraft = {
     name: string;
     about: string;
@@ -29,10 +29,3 @@ export type ScriptSaved = {
 };
 /** Save a script (a new version when it exists). */
 export declare function saveScript(store: Store, repo: string, input: Parameters<typeof validateScript>[0], actor: string, now: Date): ScriptSaved;
-/** The flows and zones in a project that run each script. */
-export declare function scriptUses(store: Store, repo: string): Map<string, {
-    flow: number;
-    flowName: string;
-    zone: string;
-}[]>;
-export declare function scriptWords(script: FlowScriptRow): string;

package/dist/flow-scripts.js

@@ -10,7 +10,6 @@
  */
 import { createHash } from "node:crypto";
 import { scanForSecrets } from "./evidence.js";
-import { flowDefinitionOf } from "./flow-engine.js";
 import { SCRIPT_LANGUAGES, SCRIPT_NAME } from "./flows.js";
 /** A script as it would be saved, checked in plain words. Throws. */
 export function validateScript(input) {
@@ -59,15 +58,3 @@ export function saveScript(store, repo, input, actor, now) {
     const version = store.saveFlowScript({ repo, ...draft, digest: scriptDigest(draft), by: actor }, now);
     return { ok: true, said: current === null ? `Saved the ${draft.name} script. Any flow in this project can run it.` : `Saved version ${version} of ${draft.name}. Every flow that runs it uses this version from now on.`, version };
 }
-/** The flows and zones in a project that run each script. */
-export function scriptUses(store, repo) {
-    const uses = new Map();
-    for (const flow of store.listFlows([repo]))
-        for (const stage of flowDefinitionOf(flow)?.stages ?? [])
-            if (stage.kind === "check" && stage.script !== null)
-                uses.set(stage.script, [...uses.get(stage.script) ?? [], { flow: flow.id, flowName: flow.name, zone: stage.title }]);
-    return uses;
-}
-export function scriptWords(script) {
-    return `${script.name} (version ${script.version}, up to ${script.timeoutMinutes} min): ${script.about}`;
-}

package/dist/flow-send.js

@@ -19,7 +19,7 @@ import { withActor } from "./actor.js";
 import { flowCardHref, flowDefinitionOf, revisionWithNote } from "./flow-engine.js";
 import { itemPlug, itemSource } from "./flow-items.js";
 import { withStageHandoff } from "./contracts/stage-output.js";
-import { flowSendForStore, readFlowChoiceAnswer, readFlowItems, readFlowSendPayload } from "./contracts/flow-send.js";
+import { flowSendForStore, readFlowChoiceAnswer, readFlowSendPayload } from "./contracts/flow-send.js";
 import { notifyPeople } from "./flow-people.js";
 import { readVerifiedReport } from "./evidence.js";
 import { FLOW_END, replyTarget } from "./flows.js";

package/dist/flow-share.d.ts

@@ -59,8 +59,6 @@ export declare function importFlow(store: Store, plan: FlowImportPlan, actor: st
     id: number;
     said: string;
 };
-/** What a flow's zones and paths are, without where they sit on the canvas: what a round trip keeps. */
-export declare function flowShape(definition: FlowDefinition): string;
 /** A gist or GitHub file page as the address of its raw text; null when it isn't one Toolroll fetches. */
 export declare function rawFlowUrl(address: string): string | null;
 export type FetchLike = (url: string, init: {

package/dist/flow-share.js

@@ -15,7 +15,6 @@
  * a person approves them, and its instructions are shown as the untrusted
  * text they are.
  */
-import { createHash } from "node:crypto";
 import { scanForSecrets } from "./evidence.js";
 import { flowDefinitionOf } from "./flow-engine.js";
 import { readFlowSecrets } from "./flow-secrets.js";
@@ -24,7 +23,7 @@ import { addFlowTriggerTo, describeTrigger, HOOK_PATH, readHooksBase, triggerCon
 import { durationMinutes, durationWords, FlowContractError, flowTerms, inStepWords, LANGUAGE_WORDS, validateFlowDefinition } from "./flows.js";
 import { stageReferenceProblems } from "./contracts/stage-output.js";
 import { readVersioned } from "./contracts/contract.js";
-import { FLOW_ALIASES, WEBHOOK_SENDERS, FLOW_FILE_FORMAT, legacyFlowNeed, legacySubagentStep, FLOW_FILE_VERSION, flowFileSchema, PARAMETER_ID } from "./contracts/flow.js";
+import { FLOW_ALIASES, WEBHOOK_SENDERS, FLOW_FILE_FORMAT, legacyFlowNeed, legacySubagentStep, FLOW_FILE_VERSION, flowFileSchema } from "./contracts/flow.js";
 import { parseSchedule } from "./flow-schedule.js";
 export { FLOW_FILE_FORMAT, FLOW_FILE_VERSION };
 /** The largest flow file Toolroll reads or fetches. */
@@ -550,10 +549,6 @@ export function importFlow(store, plan, actor, now, dir) {
         return { id, said: `Imported ${plan.name}.${off === 0 ? "" : ` Its ${off === 1 ? "trigger is" : `${off} triggers are`} off until you turn ${off === 1 ? "it" : "them"} on.`}${held === 0 ? "" : ` Approve its ${held === 1 ? "script" : `${held} scripts`} on the Scripts panel before ${held === 1 ? "it runs" : "they run"}.`}` };
     });
 }
-/** What a flow's zones and paths are, without where they sit on the canvas: what a round trip keeps. */
-export function flowShape(definition) {
-    return createHash("sha256").update(JSON.stringify({ start: definition.start, stages: definition.stages.map(one => ({ ...one, zone: null })) })).digest("hex");
-}
 // ------------------------------------------------------------------ fetching
 const FETCH_HOSTS = new Set(["github.com", "gist.github.com", "raw.githubusercontent.com", "gist.githubusercontent.com"]);
 /** A gist or GitHub file page as the address of its raw text; null when it isn't one Toolroll fetches. */

package/dist/flow-steps.js

@@ -22,7 +22,7 @@
  * twice. Trouble reaching a service is retried three times, 5 then 15
  * minutes apart; a check that fails is an answer, not trouble.
  */
-import { chmodSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { approvedCommandShell, redactSecretAssignments, SETUP_ENV_ALLOWLIST, SETUP_ENV_DENYLIST } from "./builder.js";
 import { assignmentOf } from "./assignment.js";

package/dist/flow-triggers.d.ts

@@ -62,7 +62,6 @@ export declare function takesDeliveries(config: TriggerConfig): boolean;
 export declare function saveHookSecret(dir: string, trigger: number, secret: string, credential?: string): void;
 /** Exactly this credential's secret, or null: never another's. */
 export declare function readHookSecret(dir: string, trigger: number, credential?: string): string | null;
-export declare const LINEAR_ENV = "TOOLROLL_LINEAR_KEY";
 /** The Linear API key the worker checks Linear with: the environment, or kept by Toolroll (the keychain, or an owner-only file beside the database). */
 export declare function readLinearKey(dir: string | null): string | null;
 export declare function saveLinearKey(dir: string, key: string): {

package/dist/flow-triggers.js

@@ -50,6 +50,7 @@ import { prepareUnattendedCandidates, grantSignsScriptOf, scriptProvenanceOf, sc
 import { tmpdir } from "node:os";
 import { envValue } from "./names.js";
 import { linearLabelNames, readFormSubmission, readGithubEvent, readGithubIssue, readGithubIssueEventList, readGithubIssueList, readGithubRun, readGithubRunList, readInboundMail, readLinearAnswer, readLinearEvent, readLinearIssue, readWebhookPayload } from "./contracts/trigger-payloads.js";
+import { isRecord } from "./is-record.js";
 export { FLOW_TRIGGER_KINDS };
 export const CHAT_APP_NAMES = { slack: "Slack", discord: "Discord", teams: "Teams", telegram: "Telegram" };
 /** What each kind is called on the canvas. */
@@ -66,7 +67,6 @@ const HOOK_BYTES = 1_000_000;
 const TEAM = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 // ------------------------------------------------------------ the terms
 const HIDDEN = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f\u200b-\u200f\u202a-\u202e\u2066-\u2069]/;
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
  * A trigger's settings read by their one schema (`label: required`, `unknown key 'flows'`). A setting given as null is
  * left out, and a button's blank question lines are dropped, as every release has read them. Then what the schema can't
@@ -414,7 +414,6 @@ function dropHookSecret(dir, trigger, credential) {
     catch { /* never read: nothing points at it */ }
 }
 const LINEAR = { name: "linear-key", file: ["linear-key"] };
-export const LINEAR_ENV = "TOOLROLL_LINEAR_KEY";
 /** The Linear API key the worker checks Linear with: the environment, or kept by Toolroll (the keychain, or an owner-only file beside the database). */
 export function readLinearKey(dir) {
     const env = envValue(process.env, "LINEAR_KEY")?.trim();

package/dist/flow-unattended.js

@@ -33,6 +33,7 @@ import { isProtectedWork } from "./approval-policy.js";
 import { dollarWords as dollars, scheduleWords, UNATTENDED_RULE_WORDS, unattendedCoverWords, unattendedEndWords, unattendedHeadWords, unattendedLimitWords, untilWords } from "./flow-unattended-words.js";
 import { MODE_MAX_DAYS } from "./modes.js";
 import { accountReachesSql } from "./project-access.js";
+import { canonicalJson } from "./canonical-json.js";
 /** Grant history, run reservations and the last prepared script snapshots shared by UI/worker processes. Additive only. */
 export const FLOW_UNATTENDED_SCHEMA = `
 CREATE TABLE IF NOT EXISTS flow_script_provenance (
@@ -72,18 +73,6 @@ export const FLOW_ACCEPTANCE = {
 export const UNATTENDED_MAX_RUNS = 50;
 /** The largest per-attempt budget a grant may name: $100. */
 export const UNATTENDED_MAX_BUDGET_MICROUSD = 100_000_000;
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value)
-            .filter(([, v]) => v !== undefined)
-            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
-        return `{${entries.join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
 export const unattendedTermsJson = (terms) => canonicalJson(terms);
 /** sha256 over a domain-separated canonical encoding, 32 hex like the mode digest. */
 export function unattendedDigestOf(terms) {

package/dist/flows.js

@@ -54,6 +54,7 @@ import { cardReference } from "./task-source.js";
 import { parseContract, readVersioned } from "./contracts/contract.js";
 import { stageReferenceProblems } from "./contracts/stage-output.js";
 import { CHOICES_MAX, CHOICES_MIN, FLOW_ALIASES, FLOW_COLORS, FLOW_DEFINITION_VERSION, FLOW_END, FLOW_MERGE_METHODS, FLOW_STAGE_KINDS, flowDefinitionSchema, flowStepsSchema, HEADERS_MAX, legacySubagentStep, LONGEST_WAIT_MINUTES, savedFlowDefinitionSchema, SCRIPT_LANGUAGES, SCRIPT_NAME, sortKeyOf, SURE_AT_MAX, SURE_AT_MIN, ZONE_ID, } from "./contracts/flow.js";
+import { isRecord } from "./is-record.js";
 export { CHOICES_MAX, CHOICES_MIN, FLOW_COLORS, FLOW_END, FLOW_MERGE_METHODS, FLOW_STAGE_KINDS, LONGEST_WAIT_MINUTES, SCRIPT_LANGUAGES, SCRIPT_NAME, sortKeyOf };
 /** What each kind is called and does, in the words the canvas uses. */
 export const FLOW_KIND_WORDS = {
@@ -137,7 +138,6 @@ export class FlowContractError extends Error {
     }
 }
 // ------------------------------------------------------------------ reading a drawing
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Text as every release has kept it: trimmed, and blank as none. Anything else is left for the schema to name. */
 const said = (value) => value === undefined || value === null ? null : typeof value === "string" ? value.trim() === "" ? null : value.trim() : value;
 const coordinate = (value, min, max, fallback) => typeof value === "number" && Number.isFinite(value) ? Math.round(Math.min(max, Math.max(min, value))) : fallback;

package/dist/health-cli.d.ts

@@ -1,3 +1,3 @@
-import { type TeamCliOptions } from './team-cli.js';
+import { type ConnectOptions } from './connect-cli.js';
 /** Read the running server, never a fresh CLI process's empty counters or the local database. */
-export declare function runHealthCommand(argv: readonly string[], write: (line: string) => void, options?: TeamCliOptions): Promise<number>;
+export declare function runHealthCommand(argv: readonly string[], write: (line: string) => void, options?: ConnectOptions): Promise<number>;

package/dist/health-cli.js

@@ -1,4 +1,4 @@
-import { bearerOf, centralProfile } from './team-cli.js';
+import { bearerOf, centralProfile } from './connect-cli.js';
 import { envelopeJson } from './envelope.js';
 import { healthSnapshotSchema } from './contracts/health.js';
 /** Read the running server, never a fresh CLI process's empty counters or the local database. */