Flags
/<drawer-name>.
Any secret-bearing value accepts $ENV{VAR_NAME} so committed drawer.json does not carry raw secrets.
Auth example
Local testing
Dry-run a webhook drawer without the listener:Planned unified surface
The unifiedbuttons trigger webhook ... surface should compile down to the same drawer trigger model.