@keystrokehq/snowflake 0.0.1 → 0.0.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Buster
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/_official/index.d.mts

@@ -1,2 +1,2 @@
-import { c as snowflakeOfficialIntegration, i as snowflake, s as snowflakeBundle } from "../integration-CCWMSTlO.mjs";
+import { c as snowflakeOfficialIntegration, i as snowflake, s as snowflakeBundle } from "../integration-CQNVr6NY.mjs";
 export { snowflake, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/_official/index.mjs

@@ -1,3 +1,3 @@
-import { a as snowflakeBundle, n as snowflake, o as snowflakeOfficialIntegration } from "../integration-Dptv8L0L.mjs";
+import { a as snowflakeBundle, n as snowflake, o as snowflakeOfficialIntegration } from "../integration-BVS1DWxb.mjs";
 
 export { snowflake, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { n as SnowflakeCredentials } from "./integration-CCWMSTlO.mjs";
+import { n as SnowflakeCredentials } from "./integration-CQNVr6NY.mjs";
 import { t as RetryPolicy } from "./retry-w7cTp1QL.mjs";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as parseSnowflakeCredentials } from "./integration-Dptv8L0L.mjs";
+import { t as parseSnowflakeCredentials } from "./integration-BVS1DWxb.mjs";
 import { a as extractSnowflakeMessage, c as parseRetryAfterHeader, i as extractSnowflakeCode, n as SnowflakeSqlError, o as extractSnowflakeSqlState, r as classifySnowflakeHttpStatus, s as extractSnowflakeStatementHandle, t as SnowflakeApiError } from "./errors-DKnc9o_a.mjs";
 import { a as createSnowflakeJwt, i as shouldRetry, n as computeBackoffMs, r as defaultSleep, t as DEFAULT_RETRY_POLICY } from "./retry-0hMfb8cC.mjs";
 
@@ -20,7 +20,7 @@ import { a as createSnowflakeJwt, i as shouldRetry, n as computeBackoffMs, r as
 */
 const DEFAULT_TIMEOUT_MS = 3e4;
 const JWT_REFRESH_SKEW_SECONDS = 60;
-const USER_AGENT = "keystroke-integration-snowflake/0.0.0";
+const USER_AGENT = "keystroke-snowflake/0.0.0";
 function createSnowflakeClient(rawCredentials, options = {}) {
 	const credentials = isSnowflakeCredentials(rawCredentials) ? rawCredentials : parseSnowflakeCredentials(rawCredentials);
 	const fetchImpl = options.fetchImpl ?? fetch;

package/dist/connection.d.mts

@@ -1,2 +1,2 @@
-import { a as snowflakeAuthModeSchema, c as snowflakeOfficialIntegration, i as snowflake, n as SnowflakeCredentials, o as snowflakeAuthSchema, r as parseSnowflakeCredentials, s as snowflakeBundle, t as SnowflakeAuthMode } from "./integration-CCWMSTlO.mjs";
+import { a as snowflakeAuthModeSchema, c as snowflakeOfficialIntegration, i as snowflake, n as SnowflakeCredentials, o as snowflakeAuthSchema, r as parseSnowflakeCredentials, s as snowflakeBundle, t as SnowflakeAuthMode } from "./integration-CQNVr6NY.mjs";
 export { type SnowflakeAuthMode, type SnowflakeCredentials, parseSnowflakeCredentials, snowflake, snowflakeAuthModeSchema, snowflakeAuthSchema, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/connection.mjs

@@ -1,3 +1,3 @@
-import { a as snowflakeBundle, i as snowflakeAuthSchema, n as snowflake, o as snowflakeOfficialIntegration, r as snowflakeAuthModeSchema, t as parseSnowflakeCredentials } from "./integration-Dptv8L0L.mjs";
+import { a as snowflakeBundle, i as snowflakeAuthSchema, n as snowflake, o as snowflakeOfficialIntegration, r as snowflakeAuthModeSchema, t as parseSnowflakeCredentials } from "./integration-BVS1DWxb.mjs";
 
 export { parseSnowflakeCredentials, snowflake, snowflakeAuthModeSchema, snowflakeAuthSchema, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/{integration-Dptv8L0L.mjs → integration-BVS1DWxb.mjs}

@@ -1,4 +1,4 @@
-import { defineOfficialIntegration } from "@keystrokehq/integration-authoring/official";
+import { defineOfficialIntegration, officialCredentialSetId } from "@keystrokehq/integration-authoring/official";
 import { z } from "zod";
 import { CredentialSet } from "@keystrokehq/core";
 
@@ -28,7 +28,7 @@ import { CredentialSet } from "@keystrokehq/core";
 * certificate compromise) from posting events from an unrelated topic.
 */
 const snowflakeS3SnsWebhookCredentialSet = new CredentialSet({
-	id: "snowflake-s3-sns-webhook",
+	id: officialCredentialSetId("snowflake-s3-sns-webhook"),
 	exposure: "platform-only",
 	name: "Snowflake Auto-Ingest — AWS SNS",
 	auth: z.object({
@@ -51,7 +51,7 @@ const snowflakeS3SnsWebhookCredentialSet = new CredentialSet({
 * with any valid Google OIDC token from impersonating the subscription.
 */
 const snowflakeGcsPubSubWebhookCredentialSet = new CredentialSet({
-	id: "snowflake-gcs-pubsub-webhook",
+	id: officialCredentialSetId("snowflake-gcs-pubsub-webhook"),
 	exposure: "platform-only",
 	name: "Snowflake Auto-Ingest — GCS Pub/Sub",
 	auth: z.object({
@@ -74,7 +74,7 @@ const snowflakeGcsPubSubWebhookCredentialSet = new CredentialSet({
 * Cloud-Events schema. See `IMPLEMENTATION_NOTES.md` § trigger webhooks.
 */
 const snowflakeAzureEventGridWebhookCredentialSet = new CredentialSet({
-	id: "snowflake-azure-eventgrid-webhook",
+	id: officialCredentialSetId("snowflake-azure-eventgrid-webhook"),
 	exposure: "platform-only",
 	name: "Snowflake Auto-Ingest — Azure Event Grid",
 	auth: z.object({
@@ -204,4 +204,4 @@ function parseSnowflakeCredentials(input) {
 }
 
 //#endregion
-export { snowflakeBundle as a, snowflakeGcsPubSubWebhookCredentialSet as c, snowflakeAuthSchema as i, snowflakeS3SnsWebhookCredentialSet as l, snowflake as n, snowflakeOfficialIntegration as o, snowflakeAuthModeSchema as r, snowflakeAzureEventGridWebhookCredentialSet as s, parseSnowflakeCredentials as t };
+export { snowflakeBundle as a, snowflakeAuthSchema as i, snowflake as n, snowflakeOfficialIntegration as o, snowflakeAuthModeSchema as r, parseSnowflakeCredentials as t };

package/dist/{integration-CCWMSTlO.d.mts → integration-CQNVr6NY.d.mts}

@@ -106,7 +106,7 @@ declare const snowflakeBundle: _keystrokehq_integration_authoring_official0.Offi
   SNOWFLAKE_REGION: z.ZodOptional<z.ZodString>;
   SNOWFLAKE_PUBLIC_KEY_FP: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>>;
-declare const snowflake: _keystrokehq_core0.CredentialSet<"snowflake", z.ZodObject<{
+declare const snowflake: _keystrokehq_core0.CredentialSet<"keystroke:snowflake", z.ZodObject<{
   mode: z.ZodEnum<{
     keypair: "keypair";
     oauth: "oauth";

package/dist/triggers.d.mts

@@ -1,92 +1,16 @@
-import { i as snowflake } from "./integration-CCWMSTlO.mjs";
-import { scheduledDeltaEventSchema, scheduledSqlEventSchema, snowpipeObjectBatchSchema, streamAppendOnlyEventSchema, streamHasDataEventSchema } from "./events.mjs";
+import { i as snowflake } from "./integration-CQNVr6NY.mjs";
+import { scheduledDeltaEventSchema, scheduledSqlEventSchema, streamAppendOnlyEventSchema, streamHasDataEventSchema } from "./events.mjs";
 import { RowValue } from "./rows.mjs";
 import { StatusPageOptions } from "./status-page.mjs";
-import { VerifyEventGridRequestOptions, VerifyPubSubPushOptions, VerifySnsMessageOptions } from "./verification.mjs";
 import { z } from "zod";
-import * as _keystrokehq_core0 from "@keystrokehq/core";
-import { BoundTrigger, CredentialSet } from "@keystrokehq/core";
+import { BoundTrigger } from "@keystrokehq/core";
 import { IntegrationTriggerBindingOptions, createPollingTriggerBindingFactory } from "@keystrokehq/integration-authoring";
-import * as _keystrokehq_core_credential_set0 from "@keystrokehq/core/credential-set";
-import { AnyCredentialSet, InferCredentialSetAuth } from "@keystrokehq/core/credential-set";
-import { PollingTriggerManifest, WebhookRequest, WebhookTriggerManifest } from "@keystrokehq/core/trigger";
+import { PollingTriggerManifest } from "@keystrokehq/core/trigger";
 
-//#region src/webhook-credentials.d.ts
-/**
- * AWS SNS webhook credentials.
- *
- * SNS verifies message authenticity via an X.509 signature whose public
- * cert is published at an SNS-hosted URL. The only real secret is the
- * optional {@link expectedTopicArn}: tight-scoping to a single topic
- * prevents an attacker that fooled SNS signing (not possible absent a
- * certificate compromise) from posting events from an unrelated topic.
- */
-declare const snowflakeS3SnsWebhookCredentialSet: CredentialSet<"snowflake-s3-sns-webhook", z.ZodObject<{
-  expectedTopicArn: z.ZodOptional<z.ZodString>;
-  allowedSigningCertHostPattern: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-  autoConfirmSubscriptions: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-    true: "true";
-    false: "false";
-  }>>>;
-}, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
-  expectedTopicArn: z.ZodOptional<z.ZodString>;
-  allowedSigningCertHostPattern: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-  autoConfirmSubscriptions: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-    true: "true";
-    false: "false";
-  }>>>;
-}, z.core.$strip>>[] | undefined>;
-/**
- * GCP Pub/Sub push subscriptions sign each request with a Google-minted
- * OIDC JWT (RS256) in the `Authorization` header. Verification requires
- * knowing:
- *
- *  - `expectedAudience`: the OIDC audience configured on the push
- *    subscription (commonly the webhook URL itself).
- *  - `expectedServiceAccount`: the push subscription's service-account
- *    email, which appears as the JWT `email` claim.
- *
- * Both are public identifiers, but pinning them prevents an attacker
- * with any valid Google OIDC token from impersonating the subscription.
- */
-declare const snowflakeGcsPubSubWebhookCredentialSet: CredentialSet<"snowflake-gcs-pubsub-webhook", z.ZodObject<{
-  expectedAudience: z.ZodString;
-  expectedServiceAccount: z.ZodString;
-  jwksUri: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-  issuer: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-}, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
-  expectedAudience: z.ZodString;
-  expectedServiceAccount: z.ZodString;
-  jwksUri: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-  issuer: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-}, z.core.$strip>>[] | undefined>;
-/**
- * Azure Event Grid authenticates webhook endpoints via one-time
- * handshake validation (validation code or URL) rather than per-request
- * signatures. If the operator wires a **shared secret** into the
- * Event Grid subscription as a custom header, that secret can be
- * checked here as a defence-in-depth measure.
- *
- * Event Grid's synchronous handshake (`SubscriptionValidationEvent`) is
- * not fulfillable through the Keystroke static-response webhook
- * primitive; Snowflake operators should use **manual handshake** or
- * Cloud-Events schema. See `IMPLEMENTATION_NOTES.md` § trigger webhooks.
- */
-declare const snowflakeAzureEventGridWebhookCredentialSet: CredentialSet<"snowflake-azure-eventgrid-webhook", z.ZodObject<{
-  sharedSecret: z.ZodOptional<z.ZodString>;
-  sharedSecretHeader: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-  expectedTopicArn: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
-  sharedSecret: z.ZodOptional<z.ZodString>;
-  sharedSecretHeader: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-  expectedTopicArn: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>>[] | undefined>;
-//#endregion
 //#region src/triggers.d.ts
 type Schedule = Parameters<typeof createPollingTriggerBindingFactory>[0]['schedule'];
 type SnowflakeCredentialSets = readonly [typeof snowflake];
 type SnowflakePollingBoundTrigger<TResponse extends z.ZodTypeAny, TOutput = z.output<TResponse>> = BoundTrigger<z.output<TResponse>, SnowflakeCredentialSets, PollingTriggerManifest, TOutput>;
-type SnowflakeWebhookBoundTrigger<TPayloadSchema extends z.ZodTypeAny, TCredentialSets extends readonly [typeof snowflake, ...AnyCredentialSet[]], TOutput = SnowpipeObjectBatchOutput> = BoundTrigger<z.output<TPayloadSchema>, TCredentialSets, WebhookTriggerManifest, TOutput, WebhookRequest>;
 interface SnowflakePollingBindingOptions<TResponse extends z.ZodTypeAny, TOutput = z.output<TResponse>> extends IntegrationTriggerBindingOptions<z.output<TResponse>, TOutput> {
   readonly schedule?: Schedule;
 }
@@ -423,116 +347,10 @@ declare const statusPageComponentChangeBatchSchema: z.ZodObject<{
  * Status-page pollers don't need Snowflake credentials, but they still
  * flow through the Snowflake binding factory so they show up in the
  * polling manifest alongside the rest. Credentials are declared but
- * unused — the poll callback ignores `ctx.credentials.snowflake`.
+ * unused — the poll callback ignores `ctx.credentials['keystroke:snowflake']`.
  */
 declare function statusPageIncident<TOutput = z.output<typeof statusPageIncidentBatchSchema>>(input?: StatusPagePollingParams & SnowflakePollingBindingOptions<typeof statusPageIncidentBatchSchema, TOutput>): SnowflakePollingBoundTrigger<typeof statusPageIncidentBatchSchema, TOutput>;
 declare function statusPageComponentChanged<TOutput = z.output<typeof statusPageComponentChangeBatchSchema>>(input?: StatusPagePollingParams & SnowflakePollingBindingOptions<typeof statusPageComponentChangeBatchSchema, TOutput>): SnowflakePollingBoundTrigger<typeof statusPageComponentChangeBatchSchema, TOutput>;
-/**
- * Shape of the event emitted by an auto-ingest webhook trigger. Same
- * envelope across the 3 clouds so downstream pipelines can branch on
- * `provider` without re-modelling.
- */
-type SnowpipeObjectBatchOutput = z.output<typeof snowpipeObjectBatchSchema>;
-type SnowpipeWebhookRequest = _keystrokehq_core0.WebhookRequest;
-interface WebhookBindingOptions<TOutput = SnowpipeObjectBatchOutput> extends IntegrationTriggerBindingOptions<SnowpipeObjectBatchOutput, TOutput, SnowpipeWebhookRequest> {
-  /**
-   * Override the default `/snowflake/...` path suffix. The router serves
-   * webhooks at `/api/v1/webhooks/{orgId}{path}` so authors only supply the
-   * suffix that follows the organization id.
-   */
-  readonly path?: string;
-}
-/**
- * The public SNS payload schema accepted by this trigger. SNS delivers
- * an application/json body; we validate it before signature-checking.
- */
-declare const snsWebhookPayloadSchema: z.ZodObject<{
-  Type: z.ZodEnum<{
-    Notification: "Notification";
-    SubscriptionConfirmation: "SubscriptionConfirmation";
-    UnsubscribeConfirmation: "UnsubscribeConfirmation";
-  }>;
-  MessageId: z.ZodString;
-  TopicArn: z.ZodString;
-  Message: z.ZodString;
-  Timestamp: z.ZodString;
-  SignatureVersion: z.ZodString;
-  Signature: z.ZodString;
-  SigningCertURL: z.ZodString;
-  Subject: z.ZodOptional<z.ZodString>;
-  Token: z.ZodOptional<z.ZodString>;
-  SubscribeURL: z.ZodOptional<z.ZodString>;
-  UnsubscribeURL: z.ZodOptional<z.ZodString>;
-}, z.core.$catchall<z.ZodUnknown>>;
-/**
- * `triggers.autoIngestS3Sns` — receives AWS SNS HTTPS deliveries,
- * verifies the SNS signature against the signing certificate, and
- * emits normalized S3 object events. Subscription-confirmation
- * messages are surfaced via a sentinel event of type
- * `SubscriptionConfirmation` so operators can auto-confirm in
- * downstream logic.
- */
-declare function autoIngestS3Sns<TOutput = SnowpipeObjectBatchOutput>(input?: WebhookBindingOptions<TOutput> & {
-  /** Test seam — injected verifier overrides. Not persisted. */readonly verifierOptions?: VerifySnsMessageOptions;
-}): SnowflakeWebhookBoundTrigger<typeof snsWebhookPayloadSchema, readonly [typeof snowflake, typeof snowflakeS3SnsWebhookCredentialSet], TOutput>;
-declare const gcsWebhookPayloadSchema: z.ZodObject<{
-  message: z.ZodObject<{
-    messageId: z.ZodOptional<z.ZodString>;
-    publishTime: z.ZodOptional<z.ZodString>;
-    data: z.ZodOptional<z.ZodString>;
-    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  }, z.core.$catchall<z.ZodUnknown>>;
-  subscription: z.ZodOptional<z.ZodString>;
-}, z.core.$catchall<z.ZodUnknown>>;
-/**
- * `triggers.autoIngestGcsPubSub` — receives GCP Pub/Sub push deliveries,
- * verifies the Google-signed OIDC JWT against Google's JWKS, and
- * emits normalized GCS object events extracted from the Pub/Sub
- * message body.
- */
-declare function autoIngestGcsPubSub<TOutput = SnowpipeObjectBatchOutput>(input?: WebhookBindingOptions<TOutput> & {
-  readonly verifierOptions?: Partial<VerifyPubSubPushOptions>;
-}): SnowflakeWebhookBoundTrigger<typeof gcsWebhookPayloadSchema, readonly [typeof snowflake, typeof snowflakeGcsPubSubWebhookCredentialSet], TOutput>;
-/**
- * Event Grid wire format is `AzureEventGridEvent[]`. Keystroke's
- * webhook primitive validates a single payload schema — so we accept
- * either a single event or a wrapper object. The runtime reparses the
- * raw body to preserve the array shape.
- */
-declare const azureWebhookPayloadSchema: z.ZodUnion<readonly [z.ZodArray<z.ZodObject<{
-  id: z.ZodString;
-  eventType: z.ZodString;
-  subject: z.ZodString;
-  eventTime: z.ZodString;
-  dataVersion: z.ZodOptional<z.ZodString>;
-  metadataVersion: z.ZodOptional<z.ZodString>;
-  topic: z.ZodOptional<z.ZodString>;
-  data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-}, z.core.$catchall<z.ZodUnknown>>>, z.ZodObject<{
-  id: z.ZodString;
-  eventType: z.ZodString;
-  subject: z.ZodString;
-  eventTime: z.ZodString;
-  dataVersion: z.ZodOptional<z.ZodString>;
-  metadataVersion: z.ZodOptional<z.ZodString>;
-  topic: z.ZodOptional<z.ZodString>;
-  data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-}, z.core.$catchall<z.ZodUnknown>>]>;
-/**
- * `triggers.autoIngestAzureEventGrid` — receives Azure Event Grid
- * deliveries. Validates shared-secret header (if configured), parses
- * the batch, and emits normalized Azure Blob object events. The
- * synchronous subscription-validation handshake is NOT supported
- * through the Keystroke static-response primitive; operators must
- * use manual validation URLs (see IMPLEMENTATION_NOTES.md).
- */
-declare function autoIngestAzureEventGrid<TOutput = SnowpipeObjectBatchOutput>(input?: WebhookBindingOptions<TOutput> & {
-  readonly verifierOptions?: VerifyEventGridRequestOptions;
-}): SnowflakeWebhookBoundTrigger<typeof azureWebhookPayloadSchema, readonly [typeof snowflake, typeof snowflakeAzureEventGridWebhookCredentialSet], TOutput>;
-/**
- * Convenience namespace grouping every polling trigger in this package.
- * Equivalent to calling the individual factory functions directly.
- */
 declare const polling: Readonly<{
   streamHasNewRows: typeof streamHasNewRows;
   streamAppendOnly: typeof streamAppendOnly;
@@ -557,22 +375,5 @@ declare const polling: Readonly<{
   statusPageIncident: typeof statusPageIncident;
   statusPageComponentChanged: typeof statusPageComponentChanged;
 }>;
-/**
- * Convenience namespace grouping every auto-ingest webhook trigger.
- */
-declare const webhooks: Readonly<{
-  autoIngestS3Sns: typeof autoIngestS3Sns;
-  autoIngestGcsPubSub: typeof autoIngestGcsPubSub;
-  autoIngestAzureEventGrid: typeof autoIngestAzureEventGrid;
-}>;
-/**
- * Nested `autoIngest` namespace per the spec (§7 PLAN.md) so callers
- * can reach the three webhook triggers via `triggers.autoIngest.<cloud>`.
- */
-declare const autoIngest: Readonly<{
-  s3Sns: typeof autoIngestS3Sns;
-  gcsPubSub: typeof autoIngestGcsPubSub;
-  azureEventGrid: typeof autoIngestAzureEventGrid;
-}>;
 //#endregion
-export { autoIngest, autoIngestAzureEventGrid, autoIngestGcsPubSub, autoIngestS3Sns, databaseCreated, databaseDropped, grantsChanged, pipeLoadCompleted, pipeLoadFailed, polling, roleCreated, roleDropped, scheduledDelta, scheduledSql, shareChanged, statementCompleted, statusPageComponentChanged, statusPageIncident, streamAppendOnly, streamHasNewRows, tableCreated, tableDropped, taskRunCompleted, userCreated, userDropped, warehouseCreditsUsage, warehouseQueueDepth, webhooks };
+export { databaseCreated, databaseDropped, grantsChanged, pipeLoadCompleted, pipeLoadFailed, polling, roleCreated, roleDropped, scheduledDelta, scheduledSql, shareChanged, statementCompleted, statusPageComponentChanged, statusPageIncident, streamAppendOnly, streamHasNewRows, tableCreated, tableDropped, taskRunCompleted, userCreated, userDropped, warehouseCreditsUsage, warehouseQueueDepth };

package/dist/triggers.mjs

@@ -1,13 +1,12 @@
-import { c as snowflakeGcsPubSubWebhookCredentialSet, l as snowflakeS3SnsWebhookCredentialSet, n as snowflake, s as snowflakeAzureEventGridWebhookCredentialSet } from "./integration-Dptv8L0L.mjs";
+import { n as snowflake } from "./integration-BVS1DWxb.mjs";
 import { createSnowflakeClient } from "./client.mjs";
-import { azureEventGridEventSchema, gcsPubSubPushSchema, grantChangedEventSchema, pipeLoadEventSchema, scheduledDeltaEventSchema, scheduledSqlEventSchema, shareChangedEventSchema, snowflakeDiffSnapshotEntrySchema, snowflakeObjectLifecycleEventSchema, snsNotificationSchema, statementCompletedEventSchema, statusPageComponentChangeEventSchema, statusPageIncidentEventSchema, streamAppendOnlyEventSchema, streamHasDataEventSchema, taskRunEventSchema, warehouseCreditsEventSchema, warehouseQueueEventSchema } from "./events.mjs";
+import { grantChangedEventSchema, pipeLoadEventSchema, scheduledDeltaEventSchema, scheduledSqlEventSchema, shareChangedEventSchema, snowflakeDiffSnapshotEntrySchema, snowflakeObjectLifecycleEventSchema, statementCompletedEventSchema, statusPageComponentChangeEventSchema, statusPageIncidentEventSchema, streamAppendOnlyEventSchema, streamHasDataEventSchema, taskRunEventSchema, warehouseCreditsEventSchema, warehouseQueueEventSchema } from "./events.mjs";
 import { executeSql } from "./sql.mjs";
 import { a as quoteLiteral, i as quoteIdentifier, t as buildFqn } from "./sql-safety-CywdR3EP.mjs";
 import { BindingBuilder } from "./rows.mjs";
 import { getStatusSummary, getUnresolvedIncidents } from "./status-page.mjs";
-import { EVENT_GRID_VALIDATION_EVENT_TYPE, SnowflakeWebhookVerificationError, extractGcsObjectPayload, extractS3Records, parseAzureBlobLocation, parsePubSubPush, verifyEventGridRequest, verifyPubSubPushAuthorization, verifySnsMessage } from "./verification.mjs";
 import { z } from "zod";
-import { createPollingTriggerBindingFactory, createWebhookTriggerBindingFactory } from "@keystrokehq/integration-authoring";
+import { createPollingTriggerBindingFactory } from "@keystrokehq/integration-authoring";
 
 //#region src/triggers.ts
 function defineSnowflakePollingTrigger(definition) {
@@ -17,9 +16,8 @@ function splitBindingOptions(input) {
 	return {
 		schedule: input?.schedule,
 		bindOptions: {
-			...input?.name ? { name: input.name } : {},
+			...input?.id ? { id: input.id } : {},
 			...input?.description ? { description: input.description } : {},
-			...input?.filter ? { filter: input.filter } : {},
 			...input?.transform ? { transform: input.transform } : {}
 		}
 	};
@@ -30,17 +28,15 @@ function resolveSchedule(override, fallback) {
 }
 function createSnowflakePollingBindingFactory(definition, params, schedule) {
 	return createPollingTriggerBindingFactory({
-		defaultName: definition.defaultName,
+		defaultId: definition.defaultId,
 		defaultDescription: definition.defaultDescription,
 		schedule: resolveSchedule(schedule, definition.defaultSchedule),
 		credentialSets: [snowflake],
 		response: definition.responseSchema,
 		poll: (ctx) => {
 			const snowflakeCtx = ctx;
-			return definition.poll(params, snowflakeCtx.credentials.snowflake, snowflakeCtx);
-		},
-		idempotencyKey: (response) => definition.idempotencyKey(response),
-		definitionFilter: (response) => definition.hasPayload(response)
+			return definition.poll(params, snowflakeCtx.credentials["keystroke:snowflake"], snowflakeCtx);
+		}
 	});
 }
 function bindSnowflakePollingTrigger(definition, params, input) {
@@ -73,7 +69,7 @@ function hashStatement(statement) {
 }
 const streamHasNewRowsDefinition = defineSnowflakePollingTrigger({
 	responseSchema: streamHasDataEventSchema,
-	defaultName: "Snowflake Stream Has New Rows",
+	defaultId: "snowflake.stream_has_new_rows",
 	defaultDescription: "Fires when SYSTEM$STREAM_HAS_DATA returns TRUE for a Snowflake stream (fires at most once per schedule tick).",
 	defaultSchedule: "1m",
 	poll: async (params, credentials) => {
@@ -94,16 +90,14 @@ const streamHasNewRowsDefinition = defineSnowflakePollingTrigger({
 			hasData,
 			checkedAt: isoNow()
 		};
-	},
-	idempotencyKey: (response) => `${response.streamName}:${response.checkedAt}`,
-	hasPayload: (response) => response.hasData
+	}
 });
 function streamHasNewRows(input) {
 	return bindSnowflakePollingTrigger(streamHasNewRowsDefinition, input, input);
 }
 const streamAppendOnlyDefinition = defineSnowflakePollingTrigger({
 	responseSchema: streamAppendOnlyEventSchema,
-	defaultName: "Snowflake Stream Append-Only",
+	defaultId: "snowflake.stream_append_only",
 	defaultDescription: "Emits new inserted rows from a Snowflake stream on each poll. Consumers must progress the stream via downstream DML in a transaction.",
 	defaultSchedule: "1m",
 	poll: async (params, credentials) => {
@@ -123,16 +117,14 @@ const streamAppendOnlyDefinition = defineSnowflakePollingTrigger({
 			rowCount: rows.length,
 			fetchedAt: isoNow()
 		};
-	},
-	idempotencyKey: (response) => `${response.streamName}:${response.fetchedAt}:${response.rowCount}`,
-	hasPayload: (response) => response.rowCount > 0
+	}
 });
 function streamAppendOnly(input) {
 	return bindSnowflakePollingTrigger(streamAppendOnlyDefinition, input, input);
 }
 const scheduledSqlDefinition = defineSnowflakePollingTrigger({
 	responseSchema: scheduledSqlEventSchema,
-	defaultName: "Snowflake Scheduled SQL",
+	defaultId: "snowflake.scheduled_sql",
 	defaultDescription: "Runs a caller-supplied SQL statement on each schedule tick and emits the full result set.",
 	defaultSchedule: "5m",
 	poll: async (params, credentials) => {
@@ -159,15 +151,10 @@ const scheduledSqlDefinition = defineSnowflakePollingTrigger({
 			rowCount: rows.length,
 			fetchedAt: isoNow()
 		};
-	},
-	idempotencyKey: (response) => `${response.statementDigest}:${response.fetchedAt}`,
-	hasPayload: (response) => response.rowCount > 0
+	}
 });
 function scheduledSql(input) {
-	return bindSnowflakePollingTrigger(input.emitOnEmpty ? {
-		...scheduledSqlDefinition,
-		hasPayload: () => true
-	} : scheduledSqlDefinition, input, input);
+	return bindSnowflakePollingTrigger(scheduledSqlDefinition, input, input);
 }
 function stringifyCursor(value) {
 	if (value === null || value === void 0) return null;
@@ -177,7 +164,7 @@ function stringifyCursor(value) {
 }
 const scheduledDeltaDefinition = defineSnowflakePollingTrigger({
 	responseSchema: scheduledDeltaEventSchema,
-	defaultName: "Snowflake Scheduled Delta",
+	defaultId: "snowflake.scheduled_delta",
 	defaultDescription: "Emits new rows from a Snowflake table where a cursor column exceeds the last observed high-water mark.",
 	defaultSchedule: "1m",
 	poll: async (params, credentials, ctx) => {
@@ -215,9 +202,7 @@ const scheduledDeltaDefinition = defineSnowflakePollingTrigger({
 			rowCount: rows.length,
 			fetchedAt: isoNow()
 		};
-	},
-	idempotencyKey: (response) => `${response.table}:${response.cursorColumn}:${response.highWaterValue ?? "initial"}`,
-	hasPayload: (response) => response.rowCount > 0
+	}
 });
 function scheduledDelta(input) {
 	return bindSnowflakePollingTrigger(scheduledDeltaDefinition, input, input);
@@ -234,7 +219,7 @@ const taskRunCompletedDefinition = defineSnowflakePollingTrigger({
 		highWaterValue: z.string().nullable(),
 		fetchedAt: z.string()
 	}).catchall(z.unknown()),
-	defaultName: "Snowflake Task Run Completed",
+	defaultId: "snowflake.task_run_completed",
 	defaultDescription: "Emits terminal task runs polled from INFORMATION_SCHEMA.TASK_HISTORY (SUCCEEDED / FAILED / CANCELLED).",
 	defaultSchedule: "1m",
 	poll: async (params, credentials, ctx) => {
@@ -272,9 +257,7 @@ const taskRunCompletedDefinition = defineSnowflakePollingTrigger({
 			highWaterValue: readStringField(last ?? {}, "COMPLETED_TIME", "completed_time") ?? readStringField(last ?? {}, "SCHEDULED_TIME", "scheduled_time") ?? priorHighWater,
 			fetchedAt: isoNow()
 		};
-	},
-	idempotencyKey: (response) => `task-run:${response.highWaterValue ?? "initial"}:${response.events.length}`,
-	hasPayload: (response) => response.events.length > 0
+	}
 });
 function taskRunCompleted(input) {
 	return bindSnowflakePollingTrigger(taskRunCompletedDefinition, {
@@ -301,7 +284,7 @@ const statementCompletedDefinition = defineSnowflakePollingTrigger({
 		highWaterValue: z.string().nullable(),
 		fetchedAt: z.string()
 	}).catchall(z.unknown()),
-	defaultName: "Snowflake Statement Completed",
+	defaultId: "snowflake.statement_completed",
 	defaultDescription: "Emits terminal statements from INFORMATION_SCHEMA.QUERY_HISTORY, optionally filtered by user / text / warehouse.",
 	defaultSchedule: "1m",
 	poll: async (params, credentials, ctx) => {
@@ -349,9 +332,7 @@ const statementCompletedDefinition = defineSnowflakePollingTrigger({
 			highWaterValue: readStringField(last ?? {}, "END_TIME", "end_time") ?? readStringField(last ?? {}, "START_TIME", "start_time") ?? priorHighWater,
 			fetchedAt: isoNow()
 		};
-	},
-	idempotencyKey: (response) => `stmt:${response.highWaterValue ?? "initial"}:${response.events.length}`,
-	hasPayload: (response) => response.events.length > 0
+	}
 });
 function statementCompleted(input) {
 	return bindSnowflakePollingTrigger(statementCompletedDefinition, {
@@ -372,10 +353,10 @@ const pipeLoadBatchSchema = z.object({
 	highWaterValue: z.string().nullable(),
 	fetchedAt: z.string()
 }).catchall(z.unknown());
-function buildPipeLoadDefinition(defaultName, defaultDescription, statusPredicate) {
+function buildPipeLoadDefinition(defaultId, defaultDescription, statusPredicate) {
 	return defineSnowflakePollingTrigger({
 		responseSchema: pipeLoadBatchSchema,
-		defaultName,
+		defaultId,
 		defaultDescription,
 		defaultSchedule: "1m",
 		poll: async (params, credentials, ctx) => {
@@ -418,13 +399,11 @@ function buildPipeLoadDefinition(defaultName, defaultDescription, statusPredicat
 				highWaterValue: readStringField(last ?? {}, "LAST_LOAD_TIME", "last_load_time") ?? priorHighWater,
 				fetchedAt: isoNow()
 			};
-		},
-		idempotencyKey: (response) => `pipe-load:${response.highWaterValue ?? "initial"}:${response.events.length}`,
-		hasPayload: (response) => response.events.length > 0
+		}
 	});
 }
-const pipeLoadCompletedDefinition = buildPipeLoadDefinition("Snowflake Pipe Load Completed", "Emits successful Snowpipe loads polled from INFORMATION_SCHEMA.COPY_HISTORY.", `STATUS = 'LOADED'`);
-const pipeLoadFailedDefinition = buildPipeLoadDefinition("Snowflake Pipe Load Failed", "Emits failed Snowpipe loads polled from INFORMATION_SCHEMA.COPY_HISTORY.", `STATUS IN ('LOAD_FAILED', 'PARTIALLY_LOADED')`);
+const pipeLoadCompletedDefinition = buildPipeLoadDefinition("snowflake.pipe_load_completed", "Emits successful Snowpipe loads polled from INFORMATION_SCHEMA.COPY_HISTORY.", `STATUS = 'LOADED'`);
+const pipeLoadFailedDefinition = buildPipeLoadDefinition("snowflake.pipe_load_failed", "Emits failed Snowpipe loads polled from INFORMATION_SCHEMA.COPY_HISTORY.", `STATUS IN ('LOAD_FAILED', 'PARTIALLY_LOADED')`);
 function pipeLoadCompleted(input) {
 	return bindSnowflakePollingTrigger(pipeLoadCompletedDefinition, {
 		pipeName: input?.pipeName,
@@ -493,9 +472,6 @@ function toSnapshotEntries(entries) {
 		...e.signature !== void 0 ? { signature: e.signature } : {}
 	}));
 }
-function sortedIdempotencyKey(prefix, events, getIdentity = (e) => e.identity ?? "") {
-	return `${prefix}:${events.map(getIdentity).slice().sort().join(",") || "empty"}`;
-}
 const lifecycleBatchSchema = buildDiffBatchSchema(snowflakeObjectLifecycleEventSchema);
 function rowToLifecycleEntry(kind, row) {
 	const name = readStringField(row, "name", "NAME") ?? "";
@@ -527,7 +503,7 @@ function lifecycleEventFromEntry(kind, change, entry, detectedAt) {
 function buildLifecycleDefinition(config) {
 	return defineSnowflakePollingTrigger({
 		responseSchema: lifecycleBatchSchema,
-		defaultName: config.defaultName,
+		defaultId: config.defaultId,
 		defaultDescription: config.defaultDescription,
 		defaultSchedule: "5m",
 		poll: async (params, credentials, ctx) => {
@@ -548,9 +524,7 @@ function buildLifecycleDefinition(config) {
 				snapshot: toSnapshotEntries(current),
 				fetchedAt: detectedAt
 			};
-		},
-		idempotencyKey: (response) => sortedIdempotencyKey(`${config.kind}:${config.change}`, response.events),
-		hasPayload: (response) => response.events.length > 0
+		}
 	});
 }
 function likeClause(like) {
@@ -566,14 +540,14 @@ function inScope(params) {
 const userCreatedDefinition = buildLifecycleDefinition({
 	kind: "USER",
 	change: "created",
-	defaultName: "Snowflake User Created",
+	defaultId: "snowflake.user_created",
 	defaultDescription: "Emits every new user observed via SHOW USERS since the prior poll.",
 	buildStatement: (params) => `SHOW USERS${likeClause(params.like)}`
 });
 const userDroppedDefinition = buildLifecycleDefinition({
 	kind: "USER",
 	change: "dropped",
-	defaultName: "Snowflake User Dropped",
+	defaultId: "snowflake.user_dropped",
 	defaultDescription: "Emits every user that has disappeared from SHOW USERS since the prior poll.",
 	buildStatement: (params) => `SHOW USERS${likeClause(params.like)}`
 });
@@ -599,14 +573,14 @@ function userDropped(input) {
 const roleCreatedDefinition = buildLifecycleDefinition({
 	kind: "ROLE",
 	change: "created",
-	defaultName: "Snowflake Role Created",
+	defaultId: "snowflake.role_created",
 	defaultDescription: "Emits every new role observed via SHOW ROLES since the prior poll.",
 	buildStatement: (params) => `SHOW ROLES${likeClause(params.like)}`
 });
 const roleDroppedDefinition = buildLifecycleDefinition({
 	kind: "ROLE",
 	change: "dropped",
-	defaultName: "Snowflake Role Dropped",
+	defaultId: "snowflake.role_dropped",
 	defaultDescription: "Emits every role that has disappeared from SHOW ROLES since the prior poll.",
 	buildStatement: (params) => `SHOW ROLES${likeClause(params.like)}`
 });
@@ -628,14 +602,14 @@ function roleDropped(input) {
 const databaseCreatedDefinition = buildLifecycleDefinition({
 	kind: "DATABASE",
 	change: "created",
-	defaultName: "Snowflake Database Created",
+	defaultId: "snowflake.database_created",
 	defaultDescription: "Emits every new database observed via SHOW DATABASES since the prior poll.",
 	buildStatement: (params) => `SHOW DATABASES${likeClause(params.like)}`
 });
 const databaseDroppedDefinition = buildLifecycleDefinition({
 	kind: "DATABASE",
 	change: "dropped",
-	defaultName: "Snowflake Database Dropped",
+	defaultId: "snowflake.database_dropped",
 	defaultDescription: "Emits every database that disappeared from SHOW DATABASES since the prior poll.",
 	buildStatement: (params) => `SHOW DATABASES${likeClause(params.like)}`
 });
@@ -657,14 +631,14 @@ function databaseDropped(input) {
 const tableCreatedDefinition = buildLifecycleDefinition({
 	kind: "TABLE",
 	change: "created",
-	defaultName: "Snowflake Table Created",
+	defaultId: "snowflake.table_created",
 	defaultDescription: "Emits every new table observed via SHOW TABLES since the prior poll.",
 	buildStatement: (params) => `SHOW TABLES${likeClause(params.like)}${inScope(params)}`
 });
 const tableDroppedDefinition = buildLifecycleDefinition({
 	kind: "TABLE",
 	change: "dropped",
-	defaultName: "Snowflake Table Dropped",
+	defaultId: "snowflake.table_dropped",
 	defaultDescription: "Emits every table that disappeared from SHOW TABLES since the prior poll.",
 	buildStatement: (params) => `SHOW TABLES${likeClause(params.like)}${inScope(params)}`
 });
@@ -707,7 +681,7 @@ function signatureOf(row, fields) {
 }
 const shareChangedDefinition = defineSnowflakePollingTrigger({
 	responseSchema: shareChangedBatchSchema,
-	defaultName: "Snowflake Share Changed",
+	defaultId: "snowflake.share_changed",
 	defaultDescription: "Emits share create / drop / modify events observed via SHOW SHARES. Modifications diff against a signature of kind / owner / comment / accounts / listing.",
 	defaultSchedule: "5m",
 	poll: async (params, credentials, ctx) => {
@@ -764,9 +738,7 @@ const shareChangedDefinition = defineSnowflakePollingTrigger({
 			snapshot: toSnapshotEntries(current),
 			fetchedAt: detectedAt
 		};
-	},
-	idempotencyKey: (response) => sortedIdempotencyKey("share-changed", response.events),
-	hasPayload: (response) => response.events.length > 0
+	}
 });
 function shareChanged(input) {
 	return bindSnowflakePollingTrigger(shareChangedDefinition, {
@@ -787,7 +759,7 @@ function grantStatement(params) {
 }
 const grantsChangedDefinition = defineSnowflakePollingTrigger({
 	responseSchema: grantsChangedBatchSchema,
-	defaultName: "Snowflake Grants Changed",
+	defaultId: "snowflake.grants_changed",
 	defaultDescription: "Emits grant / revoke events observed via SHOW GRANTS TO <ROLE|USER|SHARE>. Diffs against the prior poll by (privilege, granted_on, name, grantee).",
 	defaultSchedule: "5m",
 	poll: async (params, credentials, ctx) => {
@@ -826,9 +798,7 @@ const grantsChangedDefinition = defineSnowflakePollingTrigger({
 			snapshot: toSnapshotEntries(current),
 			fetchedAt: detectedAt
 		};
-	},
-	idempotencyKey: (response) => sortedIdempotencyKey("grants-changed", response.events),
-	hasPayload: (response) => response.events.length > 0
+	}
 });
 function buildGrantEvent(row, change, identity, detectedAt) {
 	return {
@@ -858,7 +828,7 @@ const warehouseQueueBatchSchema = z.object({
 }).catchall(z.unknown());
 const warehouseCreditsUsageDefinition = defineSnowflakePollingTrigger({
 	responseSchema: warehouseCreditsBatchSchema,
-	defaultName: "Snowflake Warehouse Credits Usage",
+	defaultId: "snowflake.warehouse_credits_usage",
 	defaultDescription: "Tails INFORMATION_SCHEMA.WAREHOUSE_METERING_HISTORY and emits per-warehouse credit buckets above an optional minimum.",
 	defaultSchedule: "5m",
 	poll: async (params, credentials, ctx) => {
@@ -893,13 +863,11 @@ const warehouseCreditsUsageDefinition = defineSnowflakePollingTrigger({
 			highWaterValue: readStringField(last ?? {}, "END_TIME", "end_time") ?? priorHighWater,
 			fetchedAt: isoNow()
 		};
-	},
-	idempotencyKey: (response) => `wh-credits:${response.highWaterValue ?? "initial"}:${response.events.length}`,
-	hasPayload: (response) => response.events.length > 0
+	}
 });
 const warehouseQueueDepthDefinition = defineSnowflakePollingTrigger({
 	responseSchema: warehouseQueueBatchSchema,
-	defaultName: "Snowflake Warehouse Queue Depth",
+	defaultId: "snowflake.warehouse_queue_depth",
 	defaultDescription: "Tails INFORMATION_SCHEMA.WAREHOUSE_LOAD_HISTORY and emits per-interval queue depth above an optional minimum.",
 	defaultSchedule: "5m",
 	poll: async (params, credentials, ctx) => {
@@ -935,9 +903,7 @@ const warehouseQueueDepthDefinition = defineSnowflakePollingTrigger({
 			highWaterValue: readStringField(last ?? {}, "END_TIME", "end_time") ?? priorHighWater,
 			fetchedAt: isoNow()
 		};
-	},
-	idempotencyKey: (response) => `wh-queue:${response.highWaterValue ?? "initial"}:${response.events.length}`,
-	hasPayload: (response) => response.events.length > 0
+	}
 });
 function warehouseCreditsUsage(input) {
 	return bindSnowflakePollingTrigger(warehouseCreditsUsageDefinition, input ?? {}, input);
@@ -974,7 +940,7 @@ function extractStatusPageOptions(params) {
 }
 const statusPageIncidentDefinition = {
 	responseSchema: statusPageIncidentBatchSchema,
-	defaultName: "Snowflake Status Page Incident",
+	defaultId: "snowflake.status_page_incident",
 	defaultDescription: "Polls https://status.snowflake.com/api/v2/incidents/unresolved.json and emits newly-appearing or status-changed incidents.",
 	defaultSchedule: "5m",
 	poll: async (params, _credentials, ctx) => {
@@ -1007,13 +973,11 @@ const statusPageIncidentDefinition = {
 			snapshot: toSnapshotEntries(current),
 			fetchedAt: detectedAt
 		};
-	},
-	idempotencyKey: (response) => sortedIdempotencyKey("status-incident", response.events, (e) => `${e.id}:${e.updatedAt ?? ""}`),
-	hasPayload: (response) => response.events.length > 0
+	}
 };
 const statusPageComponentChangeDefinition = {
 	responseSchema: statusPageComponentChangeBatchSchema,
-	defaultName: "Snowflake Status Page Component Changed",
+	defaultId: "snowflake.status_page_component_changed",
 	defaultDescription: "Polls https://status.snowflake.com/api/v2/summary.json and emits a change event when any component transitions status.",
 	defaultSchedule: "2m",
 	poll: async (params, _credentials, ctx) => {
@@ -1045,15 +1009,13 @@ const statusPageComponentChangeDefinition = {
 			snapshot: toSnapshotEntries(current),
 			fetchedAt: detectedAt
 		};
-	},
-	idempotencyKey: (response) => sortedIdempotencyKey("status-component", response.events, (e) => `${e.id}:${e.currentStatus}`),
-	hasPayload: (response) => response.events.length > 0
+	}
 };
 /**
 * Status-page pollers don't need Snowflake credentials, but they still
 * flow through the Snowflake binding factory so they show up in the
 * polling manifest alongside the rest. Credentials are declared but
-* unused — the poll callback ignores `ctx.credentials.snowflake`.
+* unused — the poll callback ignores `ctx.credentials['keystroke:snowflake']`.
 */
 function statusPageIncident(input) {
 	return bindSnowflakePollingTrigger(statusPageIncidentDefinition, input ?? {}, input);
@@ -1061,262 +1023,6 @@ function statusPageIncident(input) {
 function statusPageComponentChanged(input) {
 	return bindSnowflakePollingTrigger(statusPageComponentChangeDefinition, input ?? {}, input);
 }
-function resolveWebhookPath(override, fallback) {
-	return override ?? fallback;
-}
-function isoNowUtc() {
-	return (/* @__PURE__ */ new Date()).toISOString();
-}
-/**
-* The public SNS payload schema accepted by this trigger. SNS delivers
-* an application/json body; we validate it before signature-checking.
-*/
-const snsWebhookPayloadSchema = snsNotificationSchema;
-function s3RecordsToBatch(snsMessage, rawBody) {
-	const receivedAt = isoNowUtc();
-	return {
-		events: extractS3Records(snsMessage).map((record) => {
-			const bucket = record.s3?.bucket?.name ?? "";
-			const key = record.s3?.object?.key ?? "";
-			return {
-				provider: "aws-s3",
-				eventType: record.eventName ?? "",
-				eventTime: record.eventTime ?? receivedAt,
-				bucket,
-				key,
-				size: typeof record.s3?.object?.size === "number" ? record.s3.object.size : null,
-				etag: record.s3?.object?.eTag ?? null,
-				region: record.awsRegion ?? null,
-				sourceIp: record.requestParameters?.sourceIPAddress ?? null,
-				messageId: snsMessage.MessageId,
-				receivedAt,
-				raw: record
-			};
-		}),
-		provider: "aws-s3",
-		receivedAt,
-		messageId: snsMessage.MessageId,
-		topic: snsMessage.TopicArn,
-		raw: JSON.parse(rawBody)
-	};
-}
-/**
-* `triggers.autoIngestS3Sns` — receives AWS SNS HTTPS deliveries,
-* verifies the SNS signature against the signing certificate, and
-* emits normalized S3 object events. Subscription-confirmation
-* messages are surfaced via a sentinel event of type
-* `SubscriptionConfirmation` so operators can auto-confirm in
-* downstream logic.
-*/
-function autoIngestS3Sns(input) {
-	const { verifierOptions, path, ...rest } = input ?? {};
-	return createWebhookTriggerBindingFactory({
-		defaultName: "Snowflake Auto-Ingest — AWS SNS",
-		defaultDescription: "Receives Snowpipe auto-ingest notifications via AWS SNS HTTPS delivery. Verifies SNS signature against the SigningCertURL, pins TopicArn, and normalizes S3 object events.",
-		path: resolveWebhookPath(path, "/snowflake/auto-ingest/s3-sns"),
-		method: "POST",
-		payload: snsWebhookPayloadSchema,
-		credentialSets: [snowflake, snowflakeS3SnsWebhookCredentialSet],
-		response: { successStatus: 200 },
-		verify: async (request, ctx) => {
-			const creds = ctx.credentials["snowflake-s3-sns-webhook"];
-			try {
-				await verifySnsMessage(request.rawBody, {
-					...creds.expectedTopicArn ? { expectedTopicArn: creds.expectedTopicArn } : {},
-					...creds.allowedSigningCertHostPattern ? { allowedSigningCertHostPattern: creds.allowedSigningCertHostPattern } : {},
-					...verifierOptions ?? {}
-				});
-			} catch (err) {
-				if (err instanceof SnowflakeWebhookVerificationError) throw err;
-				throw new SnowflakeWebhookVerificationError({
-					message: "Unexpected error verifying SNS signature.",
-					reason: "unknown",
-					provider: "aws-s3",
-					cause: err
-				});
-			}
-		},
-		mapPayload: (payload) => {
-			if (payload.Type !== "Notification") return null;
-			const batch = s3RecordsToBatch(payload, JSON.stringify(payload));
-			return batch.events.length > 0 ? batch : null;
-		},
-		idempotencyKey: (_payload, mapped) => mapped ? `sns:${mapped.messageId ?? "no-id"}` : void 0
-	})(rest);
-}
-const gcsWebhookPayloadSchema = gcsPubSubPushSchema;
-function gcsPushToBatch(push) {
-	const receivedAt = isoNowUtc();
-	const payload = extractGcsObjectPayload(push);
-	const attributes = push.message.attributes ?? {};
-	if (!payload || !payload.bucket || !payload.name) return {
-		events: [],
-		provider: "gcp-gcs",
-		receivedAt,
-		messageId: push.message.messageId ?? null,
-		topic: push.subscription ?? null,
-		raw: push
-	};
-	const eventType = attributes.eventType ?? "OBJECT_FINALIZE";
-	const sizeNumber = typeof payload.size === "number" ? payload.size : typeof payload.size === "string" ? Number(payload.size) : null;
-	return {
-		events: [{
-			provider: "gcp-gcs",
-			eventType,
-			eventTime: payload.updated ?? payload.timeCreated ?? receivedAt,
-			bucket: payload.bucket,
-			key: payload.name,
-			size: sizeNumber !== null && Number.isFinite(sizeNumber) ? sizeNumber : null,
-			etag: payload.etag ?? null,
-			region: null,
-			sourceIp: null,
-			messageId: push.message.messageId ?? null,
-			receivedAt,
-			raw: payload
-		}],
-		provider: "gcp-gcs",
-		receivedAt,
-		messageId: push.message.messageId ?? null,
-		topic: push.subscription ?? null,
-		raw: push
-	};
-}
-/**
-* `triggers.autoIngestGcsPubSub` — receives GCP Pub/Sub push deliveries,
-* verifies the Google-signed OIDC JWT against Google's JWKS, and
-* emits normalized GCS object events extracted from the Pub/Sub
-* message body.
-*/
-function autoIngestGcsPubSub(input) {
-	const { verifierOptions, path, ...rest } = input ?? {};
-	return createWebhookTriggerBindingFactory({
-		defaultName: "Snowflake Auto-Ingest — GCS Pub/Sub",
-		defaultDescription: "Receives Snowpipe auto-ingest notifications via GCP Pub/Sub push. Verifies the Google-signed OIDC JWT in the Authorization header and normalizes GCS object events.",
-		path: resolveWebhookPath(path, "/snowflake/auto-ingest/gcs-pubsub"),
-		method: "POST",
-		payload: gcsWebhookPayloadSchema,
-		credentialSets: [snowflake, snowflakeGcsPubSubWebhookCredentialSet],
-		response: { successStatus: 204 },
-		verify: async (request, ctx) => {
-			const creds = ctx.credentials["snowflake-gcs-pubsub-webhook"];
-			try {
-				parsePubSubPush(request.rawBody);
-				await verifyPubSubPushAuthorization(request.headers.authorization, {
-					expectedAudience: creds.expectedAudience,
-					expectedServiceAccount: creds.expectedServiceAccount,
-					...creds.issuer ? { issuer: creds.issuer } : {},
-					...creds.jwksUri ? { jwksUri: creds.jwksUri } : {},
-					...verifierOptions ?? {}
-				});
-			} catch (err) {
-				if (err instanceof SnowflakeWebhookVerificationError) throw err;
-				throw new SnowflakeWebhookVerificationError({
-					message: "Unexpected error verifying Pub/Sub push.",
-					reason: "unknown",
-					provider: "gcp-gcs",
-					cause: err
-				});
-			}
-		},
-		mapPayload: (payload) => {
-			const batch = gcsPushToBatch(payload);
-			return batch.events.length > 0 ? batch : null;
-		},
-		idempotencyKey: (_payload, mapped) => mapped ? `pubsub:${mapped.messageId ?? "no-id"}` : void 0
-	})(rest);
-}
-/**
-* Event Grid wire format is `AzureEventGridEvent[]`. Keystroke's
-* webhook primitive validates a single payload schema — so we accept
-* either a single event or a wrapper object. The runtime reparses the
-* raw body to preserve the array shape.
-*/
-const azureWebhookPayloadSchema = z.union([z.array(azureEventGridEventSchema), azureEventGridEventSchema]);
-function azureBatchToBatch(events, rawBody) {
-	const receivedAt = isoNowUtc();
-	const mapped = [];
-	let topic = null;
-	for (const event of events) {
-		if (event.eventType === EVENT_GRID_VALIDATION_EVENT_TYPE) continue;
-		topic = event.topic ?? topic;
-		const loc = parseAzureBlobLocation(event);
-		const data = event.data;
-		mapped.push({
-			provider: "azure-blob",
-			eventType: event.eventType,
-			eventTime: event.eventTime,
-			bucket: loc.bucket,
-			key: loc.key,
-			size: typeof data.contentLength === "number" ? data.contentLength : null,
-			etag: typeof data.eTag === "string" ? data.eTag : null,
-			region: null,
-			sourceIp: null,
-			messageId: event.id,
-			receivedAt,
-			raw: event
-		});
-	}
-	return {
-		events: mapped,
-		provider: "azure-blob",
-		receivedAt,
-		messageId: events[0]?.id ?? null,
-		topic,
-		raw: JSON.parse(rawBody)
-	};
-}
-/**
-* `triggers.autoIngestAzureEventGrid` — receives Azure Event Grid
-* deliveries. Validates shared-secret header (if configured), parses
-* the batch, and emits normalized Azure Blob object events. The
-* synchronous subscription-validation handshake is NOT supported
-* through the Keystroke static-response primitive; operators must
-* use manual validation URLs (see IMPLEMENTATION_NOTES.md).
-*/
-function autoIngestAzureEventGrid(input) {
-	const { verifierOptions, path, ...rest } = input ?? {};
-	return createWebhookTriggerBindingFactory({
-		defaultName: "Snowflake Auto-Ingest — Azure Event Grid",
-		defaultDescription: "Receives Snowpipe auto-ingest notifications via Azure Event Grid. Validates shared-secret header, drops subscription-validation events (manual handshake required), and normalizes Azure Blob object events.",
-		path: resolveWebhookPath(path, "/snowflake/auto-ingest/azure-eventgrid"),
-		method: "POST",
-		payload: azureWebhookPayloadSchema,
-		credentialSets: [snowflake, snowflakeAzureEventGridWebhookCredentialSet],
-		response: { successStatus: 200 },
-		verify: async (request, ctx) => {
-			const creds = ctx.credentials["snowflake-azure-eventgrid-webhook"];
-			try {
-				verifyEventGridRequest({
-					rawBody: request.rawBody,
-					headers: request.headers
-				}, {
-					...creds.sharedSecret ? { sharedSecret: creds.sharedSecret } : {},
-					...creds.sharedSecretHeader ? { sharedSecretHeader: creds.sharedSecretHeader } : {},
-					...creds.expectedTopicArn ? { expectedTopic: creds.expectedTopicArn } : {},
-					...verifierOptions ?? {}
-				});
-			} catch (err) {
-				if (err instanceof SnowflakeWebhookVerificationError) throw err;
-				throw new SnowflakeWebhookVerificationError({
-					message: "Unexpected error verifying Event Grid request.",
-					reason: "unknown",
-					provider: "azure-blob",
-					cause: err
-				});
-			}
-		},
-		mapPayload: (payload) => {
-			const events = Array.isArray(payload) ? payload : [payload];
-			const batch = azureBatchToBatch(events, JSON.stringify(events));
-			return batch.events.length > 0 ? batch : null;
-		},
-		idempotencyKey: (_payload, mapped) => mapped ? `eventgrid:${mapped.messageId ?? "no-id"}` : void 0
-	})(rest);
-}
-/**
-* Convenience namespace grouping every polling trigger in this package.
-* Equivalent to calling the individual factory functions directly.
-*/
 const polling = Object.freeze({
 	streamHasNewRows,
 	streamAppendOnly,
@@ -1341,23 +1047,6 @@ const polling = Object.freeze({
 	statusPageIncident,
 	statusPageComponentChanged
 });
-/**
-* Convenience namespace grouping every auto-ingest webhook trigger.
-*/
-const webhooks = Object.freeze({
-	autoIngestS3Sns,
-	autoIngestGcsPubSub,
-	autoIngestAzureEventGrid
-});
-/**
-* Nested `autoIngest` namespace per the spec (§7 PLAN.md) so callers
-* can reach the three webhook triggers via `triggers.autoIngest.<cloud>`.
-*/
-const autoIngest = Object.freeze({
-	s3Sns: autoIngestS3Sns,
-	gcsPubSub: autoIngestGcsPubSub,
-	azureEventGrid: autoIngestAzureEventGrid
-});
 
 //#endregion
-export { autoIngest, autoIngestAzureEventGrid, autoIngestGcsPubSub, autoIngestS3Sns, databaseCreated, databaseDropped, grantsChanged, pipeLoadCompleted, pipeLoadFailed, polling, roleCreated, roleDropped, scheduledDelta, scheduledSql, shareChanged, statementCompleted, statusPageComponentChanged, statusPageIncident, streamAppendOnly, streamHasNewRows, tableCreated, tableDropped, taskRunCompleted, userCreated, userDropped, warehouseCreditsUsage, warehouseQueueDepth, webhooks };
+export { databaseCreated, databaseDropped, grantsChanged, pipeLoadCompleted, pipeLoadFailed, polling, roleCreated, roleDropped, scheduledDelta, scheduledSql, shareChanged, statementCompleted, statusPageComponentChanged, statusPageIncident, streamAppendOnly, streamHasNewRows, tableCreated, tableDropped, taskRunCompleted, userCreated, userDropped, warehouseCreditsUsage, warehouseQueueDepth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keystrokehq/snowflake",
-  "version": "0.0.1",
+  "version": "0.0.5",
   "private": false,
   "sideEffects": false,
   "type": "module",
@@ -147,27 +147,21 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "typecheck": "tsgo --build",
-    "build": "tsdown",
-    "lint": "biome check .",
-    "test:unit": "vitest run --passWithNoTests --project unit",
-    "test:int": "vitest run --passWithNoTests --project int",
-    "prepublishOnly": "pnpm build && pnpm test:unit",
-    "lint:fix": "biome check --write ."
-  },
   "dependencies": {
-    "@keystrokehq/integration-authoring": "^0.0.1",
-    "@keystrokehq/core": "^0.0.5",
+    "@keystrokehq/integration-authoring": "^0.0.5",
     "zod": "^4.3.6"
   },
+  "peerDependencies": {
+    "@keystrokehq/core": ">=0.0.7 <0.1.0"
+  },
   "devDependencies": {
-    "@types/node": "catalog:",
-    "@keystrokehq/test-utils": "workspace:*",
-    "@keystrokehq/typescript-config": "workspace:*",
-    "tsdown": "catalog:",
-    "typescript": "catalog:",
-    "vitest": "catalog:"
+    "@types/node": "^22.19.11",
+    "tsdown": "^0.20.3",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18",
+    "@keystrokehq/core": "^0.0.7",
+    "@keystrokehq/test-utils": "0.0.0",
+    "@keystrokehq/typescript-config": "0.0.0"
   },
   "keywords": [
     "snowflake",
@@ -186,5 +180,13 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "typecheck": "tsgo --build",
+    "build": "tsdown",
+    "lint": "biome check .",
+    "test:unit": "vitest run --passWithNoTests --project unit",
+    "test:int": "vitest run --passWithNoTests --project int",
+    "lint:fix": "biome check --write ."
   }
-}
+}