@keystrokehq/cli 0.0.19 → 0.0.21

package/dist/{switch.handler-CCjMrRZN.mjs → switch.handler-BFGvj5c6.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 import { a as ui, j as throwReportedCliExit } from "./keystroke.mjs";
-import { n as credentials } from "./dist-CIInPRGh.mjs";
-import { i as requireClient } from "./context-BydAGTiB.mjs";
+import { n as credentials } from "./dist-DuJjDZIf.mjs";
+import { i as requireClient } from "./context-B2cQ-Nt3.mjs";
 import { select } from "@clack/prompts";
 //#region src/commands/org/switch.handler.ts
 async function handleOrgSwitch(_options, ctx) {

package/dist/{sync-BdTQDZjP.mjs → sync-CZ3iUPTA.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
 import { z } from "zod";
 //#region src/commands/sync/sync.command.ts
 /**
@@ -32,7 +32,7 @@ function createSyncCommand() {
 		description: "Sync local workflows with Keystroke",
 		schema: SyncOptionsSchema,
 		optionsConfig: SYNC_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./sync.handler-DjY8nqbB.mjs")).handleSync
+		loadHandler: async () => (await import("./sync.handler-B1L8I9lF.mjs")).handleSync
 	});
 }
 //#endregion

package/dist/{sync.handler-DjY8nqbB.mjs → sync.handler-B1L8I9lF.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
 import { P as logger, a as ui, j as throwReportedCliExit, l as isLocalMode, y as toErrorMessage } from "./keystroke.mjs";
-import { i as projects } from "./dist-CIInPRGh.mjs";
-import { a as validateApiKey, i as requireClient } from "./context-BydAGTiB.mjs";
-import { n as deployFromDir } from "./dist-Cx0RV8s7.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-CNQtOWE4.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-C8AiYxqp.mjs";
-import { t as createBuildProgress } from "./build-progress-AR8xow4_.mjs";
-import { t as createDeployProgress } from "./deploy-progress-DK87VKJ-.mjs";
+import { i as projects } from "./dist-DuJjDZIf.mjs";
+import { a as validateApiKey, i as requireClient } from "./context-B2cQ-Nt3.mjs";
+import { n as deployFromDir } from "./dist-Br4m3sFZ.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-Cj3MFnU0.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure, r as renderBuildHeader } from "./workflow-build-Bi1Aacc5.mjs";
+import { t as createBuildProgress } from "./build-progress-nYa14iBP.mjs";
+import { t as createDeployProgress } from "./deploy-progress-Dlp9aBDW.mjs";
 //#region src/commands/sync/sync.handler.ts
 async function handleSync(options, ctx) {
 	try {

package/dist/{task-BRmL2lmw.mjs → task-BWuIKWh4.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
-import { a as descriptionString, c as optionalDescriptionString, d as trimmedNonEmptyStringUnbounded, i as createStructuralSchema, n as credentialSetProxyConfigSchema, o as idNoSpacesString, s as jsonSchemaObject, t as CredentialSetManifestSchema, u as trimmedNonEmptyString } from "./schemas-BxFPUGWT.mjs";
-import { t as parseCronExpression } from "./cron-parser-Dw_cWzFu.mjs";
+import { a as descriptionString, c as optionalDescriptionString, d as trimmedNonEmptyStringUnbounded, f as parseCronExpression, i as createStructuralSchema, n as credentialSetProxyConfigSchema, o as idNoSpacesString, s as jsonSchemaObject, t as CredentialSetManifestSchema, u as trimmedNonEmptyString } from "./schemas-D2zfmyC-.mjs";
 import { z } from "zod";
+import "node:crypto";
 const SHA256HashSchema = z.string().length(64, "Must be 64 characters").regex(/^[a-f0-9]{64}$/i, "Must be hexadecimal").transform((value) => value);
 const JsonSchemaSchema = z.record(z.string(), z.unknown());
 z.object({
@@ -215,6 +215,11 @@ const ResolvedCredentialSetSchema = z.object({
 	proxy: credentialSetProxyConfigSchema.optional(),
 	/** When true, resolved values are passed raw (no ref-token proxy) for this set. */
 	needsRawSecret: z.boolean().optional(),
+	/** When true, this requirement uses a registered dynamic resolver phase. */
+	needsDynamicResolution: z.boolean().optional(),
+	/** Cache TTL in milliseconds for registered dynamic resolver output.
+	* `0` or absence means no cache hint. */
+	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
 	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
 	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
 	/** Persistence-layer schema fingerprint stamped at build time. The
@@ -242,6 +247,10 @@ z.object({
 	/** Optional subset of the stored-shape keys. */
 	optionalStoredCredentialKeys: z.array(CredentialRefTokenKeyNameSchema).optional(),
 	schemaFingerprint: z.string().optional(),
+	needsDynamicResolution: z.boolean().optional(),
+	/** Cache TTL in milliseconds for registered dynamic resolver output.
+	*  `0` or absence means no cache hint. */
+	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
 	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
 	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
 	proxy: credentialSetProxyConfigSchema.optional(),
@@ -264,6 +273,11 @@ const CredentialRequirementEntrySchema = z.object({
 	schemaFingerprint: z.string().optional(),
 	proxy: credentialSetProxyConfigSchema.optional(),
 	needsRawSecret: z.boolean().optional(),
+	/** When true, this requirement uses a registered dynamic resolver phase. */
+	needsDynamicResolution: z.boolean().optional(),
+	/** Cache TTL in milliseconds for registered dynamic resolver output.
+	*  `0` or absence means no cache hint. */
+	dynamicResolutionCacheMs: z.number().int().nonnegative().optional(),
 	/** Policy when a step throws `CredentialRevokedError` against this credential set. */
 	onCredentialRevoked: OnCredentialRevokedSchema.optional(),
 	requiredOAuthScopes: z.array(z.string()).optional()
@@ -278,16 +292,11 @@ z.object({
 	required: z.array(z.string()),
 	byStep: z.record(z.string(), z.array(CredentialRequirementEntrySchema))
 });
-const TriggerCallbackNameSchema = z.enum([
-	"filter",
-	"idempotencyKey",
-	"verify",
-	"callback"
-]);
+const TriggerPollExportNameSchema = z.enum(["poll"]);
 const TriggerCredentialRequirementEntrySchema = CredentialRequirementEntrySchema;
 const TriggerCredentialRequirementsSchema = z.object({
 	required: z.array(z.string()),
-	byCallback: z.partialRecord(TriggerCallbackNameSchema, z.array(TriggerCredentialRequirementEntrySchema))
+	byPollExport: z.partialRecord(TriggerPollExportNameSchema, z.array(TriggerCredentialRequirementEntrySchema))
 });
 const ExecutionIdentityPolicySchema = z.object({ subjectMode: z.enum(["never", "requiredWhenUserProvidedCredential"]) });
 z.object({
@@ -319,26 +328,45 @@ const TriggerTypeSchema = z.enum([
 * can index-filter app-source rows during provider-webhook fanout.
 */
 const TriggerSourceSchema = z.enum(["custom", "app"]);
-const WebhookMethodSchema = z.enum([
+z.enum([
 	"GET",
 	"POST",
 	"PUT",
 	"PATCH"
 ]);
-const TriggerCallbackBundleUploadSchema = z.object({
+const TriggerPollBundleUploadSchema = z.object({
 	code: z.string(),
 	hash: z.string(),
 	size: z.number()
 });
-const TriggerCallbackExportsSchema = z.object({
-	verify: z.string().min(1).optional(),
-	filter: z.string().min(1).optional(),
-	idempotencyKey: z.string().min(1).optional(),
-	callback: z.string().min(1).optional()
-});
-const TransformCallbackExportsSchema = z.object({ transform: z.string().min(1).optional() });
+/** Declarative idempotency-key spec resolved server-side (no VM). */
+const IdempotencyKeyConfigSchema = z.union([
+	z.object({
+		from: z.literal("payload"),
+		strategy: z.literal("hash")
+	}),
+	z.object({
+		from: z.literal("payload"),
+		path: z.string().trim().min(1)
+	}),
+	z.object({
+		from: z.literal("header"),
+		strategy: z.literal("hash")
+	}),
+	z.object({
+		from: z.literal("header"),
+		name: z.string().trim().min(1)
+	})
+]);
+const TriggerPollExportsSchema = z.object({ poll: z.string().min(1).optional() });
 z.object({
 	id: z.string(),
+	/**
+	* Authored trigger name from `xxxTrigger({ name: ... })`. Used by the workflow
+	* VM to look up the bound `transform`. Follows the `authoredWorkflowId` /
+	* `authoredAgentId` naming convention.
+	*/
+	authoredTriggerId: z.string().min(1),
 	type: TriggerTypeSchema,
 	/**
 	* Source-of-truth discriminator for webhook triggers. `'custom'` means
@@ -346,20 +374,56 @@ z.object({
 	* a Keystroke-managed provider app. Undefined for non-webhook triggers.
 	*/
 	triggerSource: TriggerSourceSchema.optional(),
+	/**
+	* Root-trigger name for `.narrow()` lineage so narrowed custom webhooks share
+	* the same `webhookSecretHash`/`webhookPublicId`. Equals `authoredTriggerId`
+	* for root triggers. Omitted for non-webhook triggers.
+	*/
+	webhookAuthGroupKey: z.string().min(1).optional(),
 	enabled: z.boolean(),
-	path: z.string().optional(),
-	method: WebhookMethodSchema.optional(),
 	schedule: z.string().optional(),
 	timezone: z.string().optional(),
 	config: z.record(z.string(), z.unknown()).optional(),
 	requiredCredentials: TriggerCredentialRequirementsSchema.optional(),
-	storagePath: z.string().min(1).optional(),
-	callbackBundle: TriggerCallbackBundleUploadSchema.optional(),
-	callbackExports: TriggerCallbackExportsSchema.optional(),
-	transformCallbackBundle: TriggerCallbackBundleUploadSchema.optional(),
-	transformCallbackExports: TransformCallbackExportsSchema.optional()
+	/** Hex-encoded sha-256 of the Keystroke-issued webhook secret. */
+	webhookSecretHash: z.string().min(1).optional(),
+	/** Public id surfaced in the webhook URL (header-mode auth). */
+	webhookPublicId: z.string().min(1).optional(),
+	/** JSON Schema applied at the server before any VM hop. Built from a
+	*  pure Zod schema declared on the trigger primitive. */
+	filterSchema: JsonSchemaSchema.optional(),
+	/** Declarative idempotency-key resolver. Webhook-only. */
+	idempotencyConfig: IdempotencyKeyConfigSchema.optional(),
+	pollStoragePath: z.string().min(1).optional(),
+	pollBundle: TriggerPollBundleUploadSchema.optional(),
+	pollExports: TriggerPollExportsSchema.optional()
 });
 //#endregion
+//#region ../../packages/core/src/trigger/shared/idempotency-config.ts
+const trimmedString = z.string().trim().min(1);
+const payloadHashSchema = z.object({
+	from: z.literal("payload"),
+	strategy: z.literal("hash")
+});
+const payloadPathSchema = z.object({
+	from: z.literal("payload"),
+	path: trimmedString
+});
+const headerHashSchema = z.object({
+	from: z.literal("header"),
+	strategy: z.literal("hash")
+});
+const headerNameSchema = z.object({
+	from: z.literal("header"),
+	name: trimmedString
+});
+const idempotencyKeyConfigSchema = z.union([
+	payloadHashSchema,
+	payloadPathSchema,
+	headerHashSchema,
+	headerNameSchema
+]);
+//#endregion
 //#region ../../packages/core/src/trigger/schemas.ts
 const credentialSetInstanceSchema = createStructuralSchema([
 	"id",
@@ -367,19 +431,24 @@ const credentialSetInstanceSchema = createStructuralSchema([
 	"connections"
 ], "a CredentialSet instance");
 const TriggerModeDefaultSchema = z.enum(["managed", "subscribable"]);
-const TriggerCallbackPresenceSchema = z.object({
-	filter: z.boolean(),
-	idempotencyKey: z.boolean(),
+const TriggerRuntimeDescriptorSchema = z.object({
+	/**
+	* True when this trigger bundles a `poll` export executed inside a
+	* microsandbox VM at trigger time. Polling-only — webhook/cron always
+	* leave this undefined. Replaces the legacy `callbacks: { poll, ... }`
+	* descriptor (the other callbacks are gone now that filter/idempotency/
+	* verify/transform are declarative or run in the workflow VM).
+	*/
 	poll: z.boolean().optional(),
-	transformAllowed: z.boolean(),
-	verify: z.boolean().optional()
+	filterSchema: jsonSchemaObject.optional(),
+	/** Webhook-only declarative idempotency-key resolver. */
+	idempotencyConfig: idempotencyKeyConfigSchema.optional()
 });
-const TriggerRuntimeDescriptorSchema = z.object({ callbacks: TriggerCallbackPresenceSchema });
 const TriggerManifestSchema = z.object({
 	manifestVersion: z.literal(1),
 	type: z.literal("trigger"),
 	triggerType: TriggerTypeSchema,
-	name: trimmedNonEmptyString("Trigger name"),
+	id: trimmedNonEmptyString("Trigger id"),
 	description: descriptionString("Trigger description"),
 	enabled: z.boolean(),
 	modeDefault: TriggerModeDefaultSchema,
@@ -393,7 +462,7 @@ z.object({
 	enabled: z.boolean().default(true),
 	executionIdentityPolicy: ExecutionIdentityPolicySchema.optional(),
 	modeDefault: TriggerModeDefaultSchema.default("managed"),
-	name: trimmedNonEmptyString("Trigger name")
+	id: trimmedNonEmptyString("Trigger id")
 });
 //#endregion
 //#region ../../packages/core/src/task/schemas.ts
@@ -408,7 +477,7 @@ const agentInstanceSchema = createStructuralSchema([
 ], "an Agent instance");
 const triggerInstanceSchema = createStructuralSchema([
 	"isTrigger",
-	"name",
+	"id",
 	"description",
 	"enabled"
 ], "a trigger instance (use cronTrigger(), pollingTrigger(), or webhookTrigger())");

package/dist/{task-target-build-DCV0UDaz.mjs → task-target-build-CTgl4L42.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 import { r as getKeystrokeProjectPath } from "./paths-JzzFkXQA-CEipIeVl.mjs";
-import "./dist-CIInPRGh.mjs";
-import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-B0eiobOd.mjs";
+import "./dist-DuJjDZIf.mjs";
+import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-aLuQvlIq.mjs";
 import path from "node:path";
 import { mkdir, writeFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
@@ -111,7 +111,7 @@ async function buildTaskTargetFile(options) {
 	return builtTasks;
 }
 async function bundleTaskTargetModule(options) {
-	const [{ rolldown }, { createEnvAccessPlugin, formatEnvAccessError }] = await Promise.all([import("rolldown"), import("./detect-env-access-CwkOYeYM-CNTyUzme.mjs").then((n) => n.n).then((n) => n.n)]);
+	const [{ rolldown }, { createEnvAccessPlugin, formatEnvAccessError }] = await Promise.all([import("rolldown"), import("./detect-env-access-CwkOYeYM-D4aTZv4R.mjs").then((n) => n.n).then((n) => n.n)]);
 	const entryId = "\0virtual:task-target-entry";
 	const trackedDependencies = /* @__PURE__ */ new Set();
 	const envViolations = [];
@@ -218,7 +218,7 @@ async function attachTaskTargetTriggers(options) {
 		options.artifact.triggers.push(...buildTaskTriggerArtifactsWithoutBundles(options.entry.taskMetadata.triggers, options.artifact.task.taskId, options.artifact.task.taskName));
 		return [];
 	}
-	const { buildTriggerArtifacts } = await import("./trigger-artifacts-RizI57RC-DjhOsdOm.mjs").then((n) => n.n);
+	const { buildTriggerArtifacts } = await import("./trigger-artifacts-BcRScRSp-C-JBJ6y8.mjs").then((n) => n.n);
 	const triggerResult = await buildTriggerArtifacts(options.entry.taskMetadata.triggers, options.artifact.task.taskId, options.artifact.task.taskName, options.projectRoot, {
 		workflowExportName: options.entry.source.localExportName,
 		workflowFilePath: options.entry.runtimeBundlePath
@@ -237,57 +237,56 @@ async function prepareTaskTargetOutput(options) {
 }
 function hasTriggerRuntimeCallbacks(triggers) {
 	return triggers.some((trigger) => {
-		const callbacks = trigger.triggerManifest.runtime.callbacks;
-		return trigger.hasTransform || Boolean(callbacks?.verify || callbacks?.filter || callbacks?.idempotencyKey || callbacks?.poll);
+		const runtime = trigger.triggerManifest.runtime;
+		return trigger.hasTransform || runtime.poll === true;
 	});
 }
 function buildTaskTriggerArtifactsWithoutBundles(loadedTriggers, workflowId, workflowName) {
 	return loadedTriggers.map((loaded) => {
 		const triggerManifest = loaded.triggerManifest;
-		const triggerName = triggerManifest.name;
+		const authoredTriggerId = triggerManifest.id;
 		const triggerType = triggerManifest.triggerType;
 		const runtime = triggerManifest.runtime;
-		const callbacks = runtime.callbacks;
+		const hasPollBundle = "poll" in runtime && runtime.poll === true;
 		const webhookSource = "source" in runtime && runtime.source && typeof runtime.source === "object" ? runtime.source : null;
 		const projectedConfig = webhookSource ? webhookSource.type === "app" ? { source: {
 			type: "app",
 			appRef: webhookSource.appRef
-		} } : { source: {
-			type: "custom",
-			method: webhookSource.method,
-			path: webhookSource.path,
-			...webhookSource.response ? { response: webhookSource.response } : {}
-		} } : void 0;
+		} } : { source: { type: "custom" } } : void 0;
+		const filterSchema = "filterSchema" in runtime && runtime.filterSchema && typeof runtime.filterSchema === "object" ? runtime.filterSchema : void 0;
+		const idempotencyConfig = "idempotencyConfig" in runtime && runtime.idempotencyConfig ? runtime.idempotencyConfig : void 0;
+		const lineage = triggerManifest.lineage;
+		const webhookAuthGroupKey = triggerType === "webhook" ? (lineage && lineage.length > 0 ? lineage[0] : void 0) ?? authoredTriggerId : void 0;
 		return {
-			triggerId: generateTaskTriggerId(workflowId, triggerName),
+			triggerId: generateTaskTriggerId(workflowId, authoredTriggerId),
 			triggerType,
-			triggerName,
+			authoredTriggerId,
 			workflowId,
 			workflowName,
 			sourceFilePath: loaded.sourceFilePath,
 			hasTransform: loaded.hasTransform,
-			hasFilter: loaded.hasFilter,
 			enabled: triggerManifest.enabled,
+			...filterSchema ? { filterSchema } : {},
+			...idempotencyConfig ? { idempotencyConfig } : {},
 			..."schedule" in runtime && typeof runtime.schedule === "string" ? { schedule: runtime.schedule } : {},
 			..."timezone" in runtime && typeof runtime.timezone === "string" ? { timezone: runtime.timezone } : {},
 			...webhookSource ? { triggerSource: webhookSource.type } : {},
-			...webhookSource?.type === "custom" && webhookSource.path ? { path: webhookSource.path } : {},
-			...webhookSource?.type === "custom" && webhookSource.method ? { method: webhookSource.method } : {},
+			...webhookAuthGroupKey ? { webhookAuthGroupKey } : {},
 			...projectedConfig ? { config: projectedConfig } : {},
 			...triggerManifest.modeDefault ? { modeDefault: triggerManifest.modeDefault } : {},
-			...triggerManifest.credentialSets ? { requiredCredentials: buildTaskTriggerCredentialRequirements(triggerManifest.credentialSets, callbacks) } : {},
+			...triggerManifest.credentialSets ? { requiredCredentials: buildTaskTriggerCredentialRequirements(triggerManifest.credentialSets, hasPollBundle) } : {},
 			...loaded.staticPayload !== void 0 ? { staticPayload: loaded.staticPayload } : {},
 			trigger: loaded.triggerManifest
 		};
 	});
 }
-function generateTaskTriggerId(workflowId, triggerName) {
-	return createHash("sha256").update(`${workflowId}::${triggerName}`).digest("hex").slice(0, 16);
+function generateTaskTriggerId(workflowId, authoredTriggerId) {
+	return createHash("sha256").update(`${workflowId}::${authoredTriggerId}`).digest("hex").slice(0, 16);
 }
-function buildTaskTriggerCredentialRequirements(credentialSets, callbacks) {
+function buildTaskTriggerCredentialRequirements(credentialSets, hasPollBundle) {
 	if (!credentialSets || credentialSets.length === 0) return {
 		required: [],
-		byCallback: {}
+		byPollExport: {}
 	};
 	const entries = credentialSets.map((credentialSet) => {
 		const optionalCredentialKeys = readOptionalJsonSchemaKeysFromSchemaObject(credentialSet.auth);
@@ -302,12 +301,11 @@ function buildTaskTriggerCredentialRequirements(credentialSets, callbacks) {
 		};
 	});
 	const requiredIds = credentialSets.map((credentialSet) => credentialSet.id);
-	const byCallback = {};
-	if (callbacks?.poll) byCallback.callback = entries;
-	if (callbacks?.verify) byCallback.verify = entries;
+	const byPollExport = {};
+	if (hasPollBundle) byPollExport.poll = entries;
 	return {
 		required: requiredIds,
-		byCallback
+		byPollExport
 	};
 }
 function createPreparedTaskTarget(artifact, triggers) {
@@ -321,7 +319,7 @@ function createPreparedTaskTarget(artifact, triggers) {
 	};
 }
 async function tryParseTaskBuildManifest(manifest) {
-	const { TaskBuildManifestSchema } = await import("./task-BRmL2lmw.mjs").then((n) => n.t);
+	const { TaskBuildManifestSchema } = await import("./task-BWuIKWh4.mjs").then((n) => n.t);
 	const result = TaskBuildManifestSchema.safeParse(manifest);
 	return result.success ? result.data : null;
 }
@@ -353,7 +351,6 @@ function discoverTaskTriggers(task, importedModule, sourceFilePath) {
 			triggerExportName: findTriggerExportName(entry, trigger, importedModule),
 			sourceFilePath,
 			hasTransform: isBound && typeof entry.transform === "function",
-			hasFilter: isBound ? typeof entry.filter === "function" : typeof trigger.filter === "function",
 			staticPayload,
 			triggerIndex
 		});
@@ -367,7 +364,7 @@ function isTaskLike(value) {
 	return isRecord(value) && typeof value.toManifest === "function";
 }
 function isTriggerLike(value) {
-	return isRecord(value) && typeof value.name === "string" && typeof value.toManifest === "function";
+	return isRecord(value) && typeof value.id === "string" && typeof value.toManifest === "function";
 }
 function isBoundTriggerLike(value) {
 	return isRecord(value) && value.isBoundTrigger === true && isTriggerLike(value.trigger);
@@ -379,47 +376,36 @@ function findTriggerExportName(entry, trigger, importedModule) {
 	for (const [name, value] of Object.entries(importedModule)) {
 		if (value === entry || value === trigger) return name;
 		if (isBoundTriggerLike(value) && (value === entry || value.trigger === trigger)) return name;
-		if (isTriggerLike(value) && value.name === trigger.name) return name;
+		if (isTriggerLike(value) && value.id === trigger.id) return name;
 	}
 }
 function toTriggerUploadData(trigger) {
-	const callbackExports = trigger.callbackExports;
-	const transformCallbackExports = trigger.transformCallbackExports;
+	const pollExports = trigger.pollExports;
 	return {
 		id: trigger.triggerId,
+		authoredTriggerId: trigger.authoredTriggerId,
 		type: trigger.triggerType,
 		...trigger.triggerSource ? { triggerSource: trigger.triggerSource } : {},
+		...trigger.webhookAuthGroupKey ? { webhookAuthGroupKey: trigger.webhookAuthGroupKey } : {},
 		enabled: trigger.enabled,
-		...trigger.path ? { path: trigger.path } : {},
-		...trigger.method ? { method: trigger.method } : {},
 		...trigger.schedule ? { schedule: trigger.schedule } : {},
 		...trigger.timezone ? { timezone: trigger.timezone } : {},
 		...trigger.config ? { config: trigger.config } : {},
 		...trigger.requiredCredentials ? { requiredCredentials: trigger.requiredCredentials } : {},
-		...callbackExports ? { callbackExports } : {},
-		...trigger.callbackBundle ? { callbackBundle: {
-			code: trigger.callbackBundle.code,
-			hash: trigger.callbackBundle.hash ?? createHash("sha256").update(trigger.callbackBundle.code).digest("hex"),
-			size: trigger.callbackBundle.size
-		} } : {},
-		...transformCallbackExports ? { transformCallbackExports } : {},
-		...trigger.transformCallbackBundle ? { transformCallbackBundle: {
-			code: trigger.transformCallbackBundle.code,
-			hash: trigger.transformCallbackBundle.hash ?? createHash("sha256").update(trigger.transformCallbackBundle.code).digest("hex"),
-			size: trigger.transformCallbackBundle.size
+		...trigger.filterSchema ? { filterSchema: trigger.filterSchema } : {},
+		...trigger.idempotencyConfig ? { idempotencyConfig: trigger.idempotencyConfig } : {},
+		...pollExports ? { pollExports } : {},
+		...trigger.pollBundle ? { pollBundle: {
+			code: trigger.pollBundle.code,
+			hash: trigger.pollBundle.hash ?? createHash("sha256").update(trigger.pollBundle.code).digest("hex"),
+			size: trigger.pollBundle.size
 		} } : {}
 	};
 }
 function releaseTriggerBundleCode(triggers) {
-	for (const trigger of triggers) {
-		if (trigger.callbackBundle) {
-			trigger.callbackBundle.code = "";
-			trigger.callbackBundle.released = true;
-		}
-		if (trigger.transformCallbackBundle) {
-			trigger.transformCallbackBundle.code = "";
-			trigger.transformCallbackBundle.released = true;
-		}
+	for (const trigger of triggers) if (trigger.pollBundle) {
+		trigger.pollBundle.code = "";
+		trigger.pollBundle.released = true;
 	}
 }
 function releaseBuiltTaskTargets(builtTasks) {

package/dist/task-target-deploy-DeUyfi9H.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+
+import { n as deployTaskTargets } from "./task-target-deploy-dQYnMO8n-d2vdeqXH.mjs";
+export { deployTaskTargets };

package/dist/{task-target-deploy-CZBGNC0H-I-tvkGCC.mjs → task-target-deploy-dQYnMO8n-d2vdeqXH.mjs}

@@ -50,18 +50,18 @@ function normalizeWorkflowManifest(manifest) {
 function normalizeTrigger(trigger) {
 	return sortObjectKeysDeep({
 		id: trigger.id,
+		authoredTriggerId: trigger.authoredTriggerId,
 		type: trigger.type,
 		enabled: trigger.enabled,
-		...trigger.path !== void 0 ? { path: trigger.path } : {},
-		...trigger.method !== void 0 ? { method: trigger.method } : {},
+		...trigger.webhookAuthGroupKey !== void 0 ? { webhookAuthGroupKey: trigger.webhookAuthGroupKey } : {},
 		...trigger.schedule !== void 0 ? { schedule: trigger.schedule } : {},
 		...trigger.timezone !== void 0 ? { timezone: trigger.timezone } : {},
 		...trigger.config !== void 0 ? { config: trigger.config } : {},
 		...trigger.requiredCredentials !== void 0 ? { requiredCredentials: trigger.requiredCredentials } : {},
-		...trigger.callbackBundle ? { callbackBundleHash: trigger.callbackBundle.hash } : {},
-		...trigger.callbackExports !== void 0 ? { callbackExports: trigger.callbackExports } : {},
-		...trigger.transformCallbackBundle ? { transformCallbackBundleHash: trigger.transformCallbackBundle.hash } : {},
-		...trigger.transformCallbackExports !== void 0 ? { transformCallbackExports: trigger.transformCallbackExports } : {}
+		...trigger.filterSchema !== void 0 ? { filterSchema: trigger.filterSchema } : {},
+		...trigger.idempotencyConfig !== void 0 ? { idempotencyConfig: trigger.idempotencyConfig } : {},
+		...trigger.pollBundle ? { pollBundleHash: trigger.pollBundle.hash } : {},
+		...trigger.pollExports !== void 0 ? { pollExports: trigger.pollExports } : {}
 	});
 }
 function normalizeAgentManifest(manifest) {
@@ -100,7 +100,7 @@ function buildCanonicalProjectSnapshotPayload(params) {
 	};
 }
 //#endregion
-//#region ../../packages/workflow-deploy/dist/task-target-deploy-CZBGNC0H.mjs
+//#region ../../packages/workflow-deploy/dist/task-target-deploy-dQYnMO8n.mjs
 function computeProjectSnapshotHash(params) {
 	const hex = createHash("sha256").update(JSON.stringify(buildCanonicalProjectSnapshotPayload({
 		workflows: params.workflows,
@@ -149,7 +149,7 @@ async function deployTaskTargets(options) {
 			tasksToDeploy
 		}) });
 	} finally {
-		releasePreparedTaskCallbackBundleCode(tasksToDeploy);
+		releasePreparedTaskPollBundleCode(tasksToDeploy);
 	}
 	const taskResults = deployResult.tasks ?? [];
 	onDeployProgressEvent?.({
@@ -159,7 +159,7 @@ async function deployTaskTargets(options) {
 		failed: taskResults.filter((item) => item.status === "failed").length,
 		elapsedMs: Date.now() - registerStartedAt
 	});
-	return finalizeTaskTargetResult([...skippedTasks, ...taskResults.map(mapTaskResultStatus)], startedAt);
+	return finalizeTaskTargetResult([...skippedTasks, ...taskResults.map(mapTaskResultStatus)], startedAt, deployResult.newWebhookCredentials);
 }
 function buildTaskTargetDeployRequest(params) {
 	return {
@@ -251,19 +251,17 @@ function mapTaskResultStatus(result) {
 		taskId: result.taskId
 	};
 }
-function releasePreparedTaskCallbackBundleCode(preparedTasks) {
-	for (const task of preparedTasks) for (const trigger of task.triggers) {
-		if (trigger.callbackBundle) trigger.callbackBundle.code = "";
-		if (trigger.transformCallbackBundle) trigger.transformCallbackBundle.code = "";
-	}
+function releasePreparedTaskPollBundleCode(preparedTasks) {
+	for (const task of preparedTasks) for (const trigger of task.triggers) if (trigger.pollBundle) trigger.pollBundle.code = "";
 }
-function finalizeTaskTargetResult(tasks, startedAt) {
+function finalizeTaskTargetResult(tasks, startedAt, newWebhookCredentials) {
 	return {
 		success: tasks.every((task) => task.status !== "failed"),
 		workflows: [],
 		agents: [],
 		tasks,
-		totalTime: Date.now() - startedAt
+		totalTime: Date.now() - startedAt,
+		...newWebhookCredentials ? { newWebhookCredentials } : {}
 	};
 }
 //#endregion

package/dist/task-target-deploy-runner.mjs

@@ -2,9 +2,9 @@
 
 import { r as getKeystrokeProjectPath } from "./paths-JzzFkXQA-CEipIeVl.mjs";
 import "./default-urls-BoSm4s9C.mjs";
-import "./dist-CIInPRGh.mjs";
+import "./dist-DuJjDZIf.mjs";
 import { n as findProjectRoot, t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
-import { t as resolveCliCredentials } from "./resolve-cli-credentials-DytxgMwn.mjs";
+import { t as resolveCliCredentials } from "./resolve-cli-credentials-DaMDaamj.mjs";
 import path from "node:path";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
@@ -119,7 +119,7 @@ function restartStage(options, projectRoot, stage) {
 }
 async function runBuildPhase(options, projectRoot) {
 	const projectConfig = await assertWorkflowProjectRoot(projectRoot);
-	const { buildTaskTargetEntries } = await import("./task-target-build-DCV0UDaz.mjs");
+	const { buildTaskTargetEntries } = await import("./task-target-build-CTgl4L42.mjs");
 	await writeBuildDescriptor(projectRoot, {
 		projectRoot,
 		projectConfig,
@@ -132,7 +132,7 @@ async function runBuildPhase(options, projectRoot) {
 }
 async function runPreparePhase(projectRoot) {
 	const buildDescriptor = await readBuildDescriptor(projectRoot);
-	const { prepareTaskTargetBuiltTasks } = await import("./task-target-build-DCV0UDaz.mjs");
+	const { prepareTaskTargetBuiltTasks } = await import("./task-target-build-CTgl4L42.mjs");
 	const prepareResult = await prepareTaskTargetBuiltTasks({
 		builtTasks: buildDescriptor.builtTasks,
 		projectRoot
@@ -163,11 +163,11 @@ async function resolveDeployAuthOptions(options) {
 }
 async function runDeployPhase(options, projectRoot) {
 	const descriptor = await readDescriptor(projectRoot);
-	const { createDeployClient } = await import("./deploy-BPDUTKZD.mjs");
+	const { createDeployClient } = await import("./deploy-BURTx92e.mjs");
 	const client = createDeployClient(await resolveDeployAuthOptions(options));
 	const auth = await client.public.auth.validate();
 	if (auth.organizationId !== descriptor.projectConfig.organizationId) throw new Error(`Project organization mismatch: config=${descriptor.projectConfig.organizationId} auth=${auth.organizationId}`);
-	const { deployTaskTargets } = await import("./task-target-deploy-DmpCWE3u.mjs");
+	const { deployTaskTargets } = await import("./task-target-deploy-DeUyfi9H.mjs");
 	const result = await deployTaskTargets({
 		preparedTasks: descriptor.preparedTasks,
 		client,

package/dist/{test-TTQXrhHm.mjs → test-Byq4hG3C.mjs}

@@ -2,7 +2,7 @@
 
 import { a as ui } from "./keystroke.mjs";
 import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-C5qcOo8m.mjs";
+import { t as createTypedCommand } from "./commander-9Kro0Dl3.mjs";
 import { z } from "zod";
 //#region src/commands/test/test.command.ts
 const TestOptionsSchema = JsonOptionSchema;
@@ -63,7 +63,7 @@ function createTestCommand() {
 				description: "Agent tool name from the built manifest",
 				key: "toolName"
 			},
-			loadHandler: async () => (await import("./tool.handler-DMfFZCRg.mjs")).handleTestTool
+			loadHandler: async () => (await import("./tool.handler-BHS5Z4J_.mjs")).handleTestTool
 		})]
 	});
 	cmd.enablePositionalOptions();