deepline 0.2.48 → 0.2.49

package/dist/bundling-sources/sdk/src/client.ts

@@ -818,10 +818,14 @@ export type MonitorsNamespace = {
   list: (options?: MonitorsListOptions) => Promise<MonitorsListResult>;
   /** Fetch one deployed monitor by public key (without dependents). */
   get: (key: string) => Promise<MonitorDetail>;
-  /** Send an explicit payload through the deployed monitor's normal webhook path. */
+  /**
+   * Test a deployed monitor. `validationOnly` safely verifies the callback
+   * envelope; omitted options preserve the historic full-ingestion behavior.
+   */
   test: (
     key: string,
     payload: Record<string, unknown>,
+    options?: { validationOnly?: boolean },
   ) => Promise<MonitorTestResult>;
   validate: (key: string) => Promise<MonitorValidateResult>;
   /** List the published plays depending on one monitor's output streams. */
@@ -1634,7 +1638,8 @@ export class DeeplineClient {
       deploy: (definition, options) => this.deployMonitor(definition, options),
       list: (options) => this.listMonitors(options),
       get: (key) => this.getMonitor(key),
-      test: (key, payload) => this.testMonitorWebhook(key, payload),
+      test: (key, payload, options) =>
+        this.testMonitorWebhook(key, payload, options),
       validate: (key) => this.validateMonitor(key),
       dependents: (key) => this.getMonitorDependents(key),
       update: (key, patch) => this.updateMonitor(key, patch),
@@ -4547,10 +4552,17 @@ export class DeeplineClient {
   async testMonitorWebhook(
     key: string,
     payload: Record<string, unknown>,
+    options?: { validationOnly?: boolean },
   ): Promise<MonitorTestResult> {
     return this.http.request<MonitorTestResult>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
-      { method: 'POST', body: { payload } },
+      {
+        method: 'POST',
+        body: {
+          payload,
+          ...(options?.validationOnly ? { mode: 'validation_only' } : {}),
+        },
+      },
     );
   }
 

package/dist/bundling-sources/sdk/src/play.ts

@@ -176,7 +176,8 @@ export type PlayFetchResponse = PlayAuthoringFetchResponse;
  *
  * A play can be triggered three ways, declared as the third argument to
  * {@link definePlay}:
- * - `webhook` — an inbound HTTP call (with optional HMAC signature verification);
+ * - `webhook` — an inbound HTTP call (with optional legacy HMAC or Standard
+ *   Webhooks signature verification);
  * - `cron` — a schedule; or
  * - `sqlListeners` — a **monitor**: the play runs whenever a monitor writes a new
  *   row to its output stream. This is how you build a play "on top of" a monitor
@@ -198,6 +199,19 @@ export type PlayFetchResponse = PlayAuthoringFetchResponse;
  * });
  * ```
  *
+ * @example Svix / Standard Webhooks verification with Deepline Secrets
+ * ```typescript
+ * definePlay('visitor-webhook', handler, {
+ *   webhook: {
+ *     auth: {
+ *       type: 'standard-webhooks',
+ *       headerFamily: 'svix',
+ *       signingSecrets: ['VECTOR_WEBHOOK_SECRET'],
+ *     },
+ *   },
+ * });
+ * ```
+ *
  * @example Cron schedule
  * ```typescript
  * definePlay('nightly-sync', handler, {

package/dist/bundling-sources/sdk/src/release.ts

@@ -160,7 +160,7 @@ export const SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: '0.2.48',
+  version: '0.2.49',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -56,6 +56,7 @@ export const PLAY_AUTHORING_CONTRACT_ISSUE_CODES = [
   'play_authoring_billing_limit_invalid',
   'play_authoring_billing_limit_unresolved',
   'play_authoring_webhook_hmac_invalid',
+  'play_authoring_standard_webhooks_invalid',
   'play_authoring_secret_invalid',
   'play_authoring_cron_timezone_invalid',
   'play_authoring_tool_request_invalid',
@@ -83,6 +84,16 @@ export type PlayAuthoringContractIssue = {
 };
 
 export type PlaySqlListenerOperation = 'INSERT' | 'UPDATE' | 'DELETE';
+export type PlayStandardWebhookHeaderFamily = 'standard' | 'svix';
+export type PlayStandardWebhookAuth = {
+  type: 'standard-webhooks';
+  /** `webhook-*` for Standard Webhooks, `svix-*` for Svix senders. */
+  headerFamily: PlayStandardWebhookHeaderFamily;
+  /** Deepline Secret names used for ordinary operation and rotation overlap. */
+  signingSecrets: string[];
+  /** Replay-protection window. Omitted means the Standard Webhooks 5-minute default. */
+  toleranceSeconds?: number;
+};
 export const PLAY_SQL_LISTENER_WHERE_OPERATORS = [
   'eq',
   'neq',
@@ -259,6 +270,7 @@ export type PlayAuthoringAstBindings = {
       header?: string;
       secretEnv: string;
     };
+    auth?: PlayStandardWebhookAuth;
   };
   cron?: { schedule: string; timezone?: string };
   sqlListeners?: PlayAuthoringAstSqlListenerDeclaration[];
@@ -287,6 +299,7 @@ export type PlayAuthoringBindings = {
       header?: string;
       secretEnv: string;
     };
+    auth?: PlayStandardWebhookAuth;
   };
   cron?: {
     schedule: string;
@@ -973,6 +986,81 @@ export const PLAY_AUTHORING_FIELD_REGISTRY = {
     errorMessage:
       'bindings.webhook.hmac.header must be a non-empty static string.',
   },
+  'bindings.webhook.auth.type': {
+    schema: Type.Literal('standard-webhooks'),
+    fixtures: {
+      valid: 'standard-webhooks',
+      invalid: 'svix',
+      absent: undefined,
+      unresolved: { expression: 'type' },
+      edition1: undefined,
+    },
+    referenceType: "'standard-webhooks'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with headerFamily and signingSecrets.
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_standard_webhooks_invalid',
+    description: 'Uses the Standard Webhooks v1 symmetric signing scheme.',
+    errorMessage:
+      'bindings.webhook.auth.type must be the static literal "standard-webhooks".',
+  },
+  'bindings.webhook.auth.headerFamily': {
+    schema: Type.Union([Type.Literal('standard'), Type.Literal('svix')]),
+    fixtures: {
+      valid: 'svix',
+      invalid: 'webhook',
+      absent: undefined,
+      unresolved: { expression: 'headerFamily' },
+      edition1: undefined,
+    },
+    referenceType: "'standard' | 'svix'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and signingSecrets.
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_standard_webhooks_invalid',
+    description: 'Header namespace expected from the webhook provider.',
+    errorMessage:
+      'bindings.webhook.auth.headerFamily must be the static literal "standard" or "svix".',
+  },
+  'bindings.webhook.auth.signingSecrets[]': {
+    schema: SecretEnvironmentNameSchema,
+    fixtures: {
+      valid: 'VECTOR_WEBHOOK_SECRET',
+      invalid: 'vector_webhook_secret',
+      absent: undefined,
+      unresolved: { expression: 'secret' },
+      edition1: undefined,
+    },
+    referenceType: 'string',
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and headerFamily.
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_standard_webhooks_invalid',
+    description: 'Deepline Secret name used to verify Standard Webhooks.',
+    errorMessage:
+      'bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter.',
+  },
+  'bindings.webhook.auth.toleranceSeconds': {
+    schema: Type.Integer({ minimum: 1, maximum: 3600 }),
+    fixtures: {
+      valid: 300,
+      invalid: 0,
+      absent: undefined,
+      unresolved: { expression: 'toleranceSeconds' },
+      edition1: undefined,
+    },
+    referenceType: 'number',
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_standard_webhooks_invalid',
+    description:
+      'Accepted delivery timestamp skew in seconds, from 1 through 3600.',
+    errorMessage:
+      'bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600.',
+  },
   'bindings.cron.schedule': {
     schema: Type.String({ minLength: 1 }),
     fixtures: {
@@ -2157,7 +2245,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType('inline')};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType('billing.maxCreditsPerRun')} };`,
   `  runtime?: { timeout?: ${cloudReferenceType('runtime.timeout')}; size?: ${cloudReferenceType('runtime.size')} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType('bindings.webhook.hmac.algorithm')}; header?: ${cloudReferenceType('bindings.webhook.hmac.header')}; secretEnv: ${cloudReferenceType('bindings.webhook.hmac.secretEnv')} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType('bindings.webhook.hmac.algorithm')}; header?: ${cloudReferenceType('bindings.webhook.hmac.header')}; secretEnv: ${cloudReferenceType('bindings.webhook.hmac.secretEnv')} }; auth?: { type: ${cloudReferenceType('bindings.webhook.auth.type')}; headerFamily: ${cloudReferenceType('bindings.webhook.auth.headerFamily')}; signingSecrets: readonly ${cloudReferenceType('bindings.webhook.auth.signingSecrets[]')}[]; toleranceSeconds?: ${cloudReferenceType('bindings.webhook.auth.toleranceSeconds')} } };`,
   `  cron?: { schedule: ${cloudReferenceType('bindings.cron.schedule')}; timezone?: ${cloudReferenceType('bindings.cron.timezone')} };`,
   '  sqlListeners?: readonly SqlListenerDeclaration[];',
   `  secrets?: readonly ${cloudReferenceType('bindings.secrets[]')}[];`,

package/dist/cli/index.js

@@ -1044,7 +1044,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.48",
+  version: "0.2.49",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -3879,7 +3879,7 @@ var DeeplineClient = class {
       deploy: (definition, options2) => this.deployMonitor(definition, options2),
       list: (options2) => this.listMonitors(options2),
       get: (key) => this.getMonitor(key),
-      test: (key, payload) => this.testMonitorWebhook(key, payload),
+      test: (key, payload, options2) => this.testMonitorWebhook(key, payload, options2),
       validate: (key) => this.validateMonitor(key),
       dependents: (key) => this.getMonitorDependents(key),
       update: (key, patch) => this.updateMonitor(key, patch),
@@ -6048,10 +6048,16 @@ var DeeplineClient = class {
       { method: "GET" }
     );
   }
-  async testMonitorWebhook(key, payload) {
+  async testMonitorWebhook(key, payload, options) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
-      { method: "POST", body: { payload } }
+      {
+        method: "POST",
+        body: {
+          payload,
+          ...options?.validationOnly ? { mode: "validation_only" } : {}
+        }
+      }
     );
   }
   async setupMonitor(tool, payload) {
@@ -15021,6 +15027,76 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.auth.type": {
+    schema: Type.Literal("standard-webhooks"),
+    fixtures: {
+      valid: "standard-webhooks",
+      invalid: "svix",
+      absent: void 0,
+      unresolved: { expression: "type" },
+      edition1: void 0
+    },
+    referenceType: "'standard-webhooks'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with headerFamily and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Uses the Standard Webhooks v1 symmetric signing scheme.",
+    errorMessage: 'bindings.webhook.auth.type must be the static literal "standard-webhooks".'
+  },
+  "bindings.webhook.auth.headerFamily": {
+    schema: Type.Union([Type.Literal("standard"), Type.Literal("svix")]),
+    fixtures: {
+      valid: "svix",
+      invalid: "webhook",
+      absent: void 0,
+      unresolved: { expression: "headerFamily" },
+      edition1: void 0
+    },
+    referenceType: "'standard' | 'svix'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Header namespace expected from the webhook provider.",
+    errorMessage: 'bindings.webhook.auth.headerFamily must be the static literal "standard" or "svix".'
+  },
+  "bindings.webhook.auth.signingSecrets[]": {
+    schema: SecretEnvironmentNameSchema,
+    fixtures: {
+      valid: "VECTOR_WEBHOOK_SECRET",
+      invalid: "vector_webhook_secret",
+      absent: void 0,
+      unresolved: { expression: "secret" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and headerFamily.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Deepline Secret name used to verify Standard Webhooks.",
+    errorMessage: "bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter."
+  },
+  "bindings.webhook.auth.toleranceSeconds": {
+    schema: Type.Integer({ minimum: 1, maximum: 3600 }),
+    fixtures: {
+      valid: 300,
+      invalid: 0,
+      absent: void 0,
+      unresolved: { expression: "toleranceSeconds" },
+      edition1: void 0
+    },
+    referenceType: "number",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Accepted delivery timestamp skew in seconds, from 1 through 3600.",
+    errorMessage: "bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600."
+  },
   "bindings.cron.schedule": {
     schema: Type.String({ minLength: 1 }),
     fixtures: {
@@ -16045,7 +16121,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")} };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
@@ -30757,6 +30833,31 @@ function readDeployOutputContract(payload) {
   });
   return { tool: asString(contract.tool), streams };
 }
+function renderDeployReplacementWarning(input2) {
+  const summary = asRecord2(input2.payload.change_summary);
+  const upstream = summary ? asRecord2(summary.upstream) : void 0;
+  if (!summary || !upstream || upstream.resource_replaced !== true) return [];
+  const definition = asRecord2(summary.definition);
+  const changed = definition && Array.isArray(definition.changed) ? definition.changed : [];
+  const lines = [
+    input2.completed ? "WARNING: this deploy replaced the existing upstream monitor." : "WARNING: this deploy replaces the existing upstream monitor.",
+    "Existing Customer DB rows are preserved. Provider backfill is not implied."
+  ];
+  for (const raw of changed) {
+    const item = asRecord2(raw);
+    const path = item ? asString(item.path) : void 0;
+    if (!item || !path) continue;
+    lines.push(
+      `  ${path}: ${JSON.stringify(item.before ?? null)} \u2192 ${JSON.stringify(
+        item.after ?? null
+      )}`
+    );
+  }
+  lines.push(
+    input2.monitorKey ? `Use \`deepline monitors update ${input2.monitorKey} <patch>\` for a patch-style change.` : "Use `deepline monitors update <key> <patch>` for a patch-style change."
+  );
+  return lines;
+}
 function renderMonitorDeployCompletion(payload) {
   const monitor = asRecord2(payload.monitor);
   const key = monitor ? asString(monitor.key) : void 0;
@@ -30784,6 +30885,12 @@ function renderMonitorDeployCompletion(payload) {
   if (pricingLine) {
     lines.push("", `Pricing: ${pricingLine}`);
   }
+  const replacementWarning = renderDeployReplacementWarning({
+    payload,
+    completed: true,
+    monitorKey: key
+  });
+  if (replacementWarning.length) lines.push("", ...replacementWarning);
   const guidance = asRecord2(payload.setup_guidance);
   if (guidance) {
     const callbackUrl = asString(guidance.callback_url);
@@ -30835,6 +30942,11 @@ function renderMonitorDeployPlan(payload) {
       if (message) lines.push(`  - ${path ? `${path}: ` : ""}${message}`);
     }
   }
+  const replacementWarning = renderDeployReplacementWarning({
+    payload,
+    completed: false
+  });
+  if (replacementWarning.length) lines.push("", ...replacementWarning);
   const estimate = asRecord2(payload.deploy_cost_estimate);
   const credits = estimate ? asFiniteNumber(estimate.credits) : void 0;
   if (credits !== void 0) {
@@ -31201,10 +31313,17 @@ async function handleMonitorsGet(key, options) {
 }
 async function handleMonitorsTest(key, payload, options) {
   const explicitPayload = parseJsonObjectArg(payload, "<payload>");
-  const result = await new DeeplineClient().monitors.test(key, explicitPayload);
-  const text = `Webhook test for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
-  persisted rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
-  bound Plays dispatched: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
+  const result = await new DeeplineClient().monitors.test(
+    key,
+    explicitPayload,
+    {
+      validationOnly: options.dispatch !== true
+    }
+  );
+  const dispatch = options.dispatch === true;
+  const text = `Monitor diagnostic for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
+` + (dispatch ? "  mode: dispatch (writes rows and may dispatch bound Plays)\n" : "  mode: validation_only (no rows written, credits spent, or Plays dispatched)\n") + `${dispatch ? "persisted" : "would persist"} rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
+${dispatch ? "dispatched" : "would dispatch"} bound Plays: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
 `;
   printCommandEnvelope(result, { json: options.json, text });
 }
@@ -31416,12 +31535,18 @@ Examples:
   withJsonOption(
     monitors.command("test <key> <payload>").description(
       "Send an explicit payload through a monitor\u2019s webhook ingestion path."
+    ).option(
+      "--dispatch",
+      "Inject the test event through normal ingestion (writes rows and may dispatch bound Plays)"
     ).addHelpText(
       "after",
       `
 Notes:
   <payload> must be an explicit JSON object. The command uses the deployed
-  monitor\u2019s real validation, persistence, and inline Play dispatch path; it does
+  monitor\u2019s real binding and payload validation, but is a side-effect-free
+  diagnostic: it does not persist rows, spend credits, dispatch Plays, or alter
+  monitor state. Pass --dispatch only when you deliberately need the historic
+  full-ingestion test event; it can write rows and trigger bound Plays. It does
   not synthesize a provider event or accept an omitted payload.
 
 Examples:
@@ -31442,7 +31567,9 @@ Notes:
   via --file <path>, or
   from stdin with --file -. Does not deploy or spend credits.
   For Deepline Native Company Radar monitors, check validates persona-filter enums and the
-  job_titles Boolean-expression grammar locally. Inspect the exact schema with
+  job_titles Boolean-expression grammar locally (parentheses are unsupported;
+  NOT > AND > OR).
+  Inspect the exact schema with
   \`deepline monitors available deepline_native.company_radar --json\`.
 
 Examples:
@@ -31466,6 +31593,9 @@ Notes:
   --dry-run validates the definition and shows the plan (deploy cost in Deepline
   credits when the server reports it, plus any existing monitors that may
   already cover this scope) WITHOUT deploying. Exits 0 when valid, 7 when not.
+  Deploy is a full desired definition for its key: omitting a previously stored
+  field removes it and can replace the upstream resource. Use \`monitors update\`
+  for a patch-style change.
 
 Examples:
   deepline monitors deploy '{"key":"job-openings","tool":"deepline_native.company_radar","payload":{"domain":"stripe.com","radar_type":"company_job_openings"}}'

package/dist/cli/index.mjs

@@ -1030,7 +1030,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.48",
+  version: "0.2.49",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -3865,7 +3865,7 @@ var DeeplineClient = class {
       deploy: (definition, options2) => this.deployMonitor(definition, options2),
       list: (options2) => this.listMonitors(options2),
       get: (key) => this.getMonitor(key),
-      test: (key, payload) => this.testMonitorWebhook(key, payload),
+      test: (key, payload, options2) => this.testMonitorWebhook(key, payload, options2),
       validate: (key) => this.validateMonitor(key),
       dependents: (key) => this.getMonitorDependents(key),
       update: (key, patch) => this.updateMonitor(key, patch),
@@ -6034,10 +6034,16 @@ var DeeplineClient = class {
       { method: "GET" }
     );
   }
-  async testMonitorWebhook(key, payload) {
+  async testMonitorWebhook(key, payload, options) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
-      { method: "POST", body: { payload } }
+      {
+        method: "POST",
+        body: {
+          payload,
+          ...options?.validationOnly ? { mode: "validation_only" } : {}
+        }
+      }
     );
   }
   async setupMonitor(tool, payload) {
@@ -15058,6 +15064,76 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.auth.type": {
+    schema: Type.Literal("standard-webhooks"),
+    fixtures: {
+      valid: "standard-webhooks",
+      invalid: "svix",
+      absent: void 0,
+      unresolved: { expression: "type" },
+      edition1: void 0
+    },
+    referenceType: "'standard-webhooks'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with headerFamily and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Uses the Standard Webhooks v1 symmetric signing scheme.",
+    errorMessage: 'bindings.webhook.auth.type must be the static literal "standard-webhooks".'
+  },
+  "bindings.webhook.auth.headerFamily": {
+    schema: Type.Union([Type.Literal("standard"), Type.Literal("svix")]),
+    fixtures: {
+      valid: "svix",
+      invalid: "webhook",
+      absent: void 0,
+      unresolved: { expression: "headerFamily" },
+      edition1: void 0
+    },
+    referenceType: "'standard' | 'svix'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Header namespace expected from the webhook provider.",
+    errorMessage: 'bindings.webhook.auth.headerFamily must be the static literal "standard" or "svix".'
+  },
+  "bindings.webhook.auth.signingSecrets[]": {
+    schema: SecretEnvironmentNameSchema,
+    fixtures: {
+      valid: "VECTOR_WEBHOOK_SECRET",
+      invalid: "vector_webhook_secret",
+      absent: void 0,
+      unresolved: { expression: "secret" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and headerFamily.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Deepline Secret name used to verify Standard Webhooks.",
+    errorMessage: "bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter."
+  },
+  "bindings.webhook.auth.toleranceSeconds": {
+    schema: Type.Integer({ minimum: 1, maximum: 3600 }),
+    fixtures: {
+      valid: 300,
+      invalid: 0,
+      absent: void 0,
+      unresolved: { expression: "toleranceSeconds" },
+      edition1: void 0
+    },
+    referenceType: "number",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Accepted delivery timestamp skew in seconds, from 1 through 3600.",
+    errorMessage: "bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600."
+  },
   "bindings.cron.schedule": {
     schema: Type.String({ minLength: 1 }),
     fixtures: {
@@ -16082,7 +16158,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")} };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
@@ -30808,6 +30884,31 @@ function readDeployOutputContract(payload) {
   });
   return { tool: asString(contract.tool), streams };
 }
+function renderDeployReplacementWarning(input2) {
+  const summary = asRecord2(input2.payload.change_summary);
+  const upstream = summary ? asRecord2(summary.upstream) : void 0;
+  if (!summary || !upstream || upstream.resource_replaced !== true) return [];
+  const definition = asRecord2(summary.definition);
+  const changed = definition && Array.isArray(definition.changed) ? definition.changed : [];
+  const lines = [
+    input2.completed ? "WARNING: this deploy replaced the existing upstream monitor." : "WARNING: this deploy replaces the existing upstream monitor.",
+    "Existing Customer DB rows are preserved. Provider backfill is not implied."
+  ];
+  for (const raw of changed) {
+    const item = asRecord2(raw);
+    const path = item ? asString(item.path) : void 0;
+    if (!item || !path) continue;
+    lines.push(
+      `  ${path}: ${JSON.stringify(item.before ?? null)} \u2192 ${JSON.stringify(
+        item.after ?? null
+      )}`
+    );
+  }
+  lines.push(
+    input2.monitorKey ? `Use \`deepline monitors update ${input2.monitorKey} <patch>\` for a patch-style change.` : "Use `deepline monitors update <key> <patch>` for a patch-style change."
+  );
+  return lines;
+}
 function renderMonitorDeployCompletion(payload) {
   const monitor = asRecord2(payload.monitor);
   const key = monitor ? asString(monitor.key) : void 0;
@@ -30835,6 +30936,12 @@ function renderMonitorDeployCompletion(payload) {
   if (pricingLine) {
     lines.push("", `Pricing: ${pricingLine}`);
   }
+  const replacementWarning = renderDeployReplacementWarning({
+    payload,
+    completed: true,
+    monitorKey: key
+  });
+  if (replacementWarning.length) lines.push("", ...replacementWarning);
   const guidance = asRecord2(payload.setup_guidance);
   if (guidance) {
     const callbackUrl = asString(guidance.callback_url);
@@ -30886,6 +30993,11 @@ function renderMonitorDeployPlan(payload) {
       if (message) lines.push(`  - ${path ? `${path}: ` : ""}${message}`);
     }
   }
+  const replacementWarning = renderDeployReplacementWarning({
+    payload,
+    completed: false
+  });
+  if (replacementWarning.length) lines.push("", ...replacementWarning);
   const estimate = asRecord2(payload.deploy_cost_estimate);
   const credits = estimate ? asFiniteNumber(estimate.credits) : void 0;
   if (credits !== void 0) {
@@ -31252,10 +31364,17 @@ async function handleMonitorsGet(key, options) {
 }
 async function handleMonitorsTest(key, payload, options) {
   const explicitPayload = parseJsonObjectArg(payload, "<payload>");
-  const result = await new DeeplineClient().monitors.test(key, explicitPayload);
-  const text = `Webhook test for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
-  persisted rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
-  bound Plays dispatched: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
+  const result = await new DeeplineClient().monitors.test(
+    key,
+    explicitPayload,
+    {
+      validationOnly: options.dispatch !== true
+    }
+  );
+  const dispatch = options.dispatch === true;
+  const text = `Monitor diagnostic for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
+` + (dispatch ? "  mode: dispatch (writes rows and may dispatch bound Plays)\n" : "  mode: validation_only (no rows written, credits spent, or Plays dispatched)\n") + `${dispatch ? "persisted" : "would persist"} rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
+${dispatch ? "dispatched" : "would dispatch"} bound Plays: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
 `;
   printCommandEnvelope(result, { json: options.json, text });
 }
@@ -31467,12 +31586,18 @@ Examples:
   withJsonOption(
     monitors.command("test <key> <payload>").description(
       "Send an explicit payload through a monitor\u2019s webhook ingestion path."
+    ).option(
+      "--dispatch",
+      "Inject the test event through normal ingestion (writes rows and may dispatch bound Plays)"
     ).addHelpText(
       "after",
       `
 Notes:
   <payload> must be an explicit JSON object. The command uses the deployed
-  monitor\u2019s real validation, persistence, and inline Play dispatch path; it does
+  monitor\u2019s real binding and payload validation, but is a side-effect-free
+  diagnostic: it does not persist rows, spend credits, dispatch Plays, or alter
+  monitor state. Pass --dispatch only when you deliberately need the historic
+  full-ingestion test event; it can write rows and trigger bound Plays. It does
   not synthesize a provider event or accept an omitted payload.
 
 Examples:
@@ -31493,7 +31618,9 @@ Notes:
   via --file <path>, or
   from stdin with --file -. Does not deploy or spend credits.
   For Deepline Native Company Radar monitors, check validates persona-filter enums and the
-  job_titles Boolean-expression grammar locally. Inspect the exact schema with
+  job_titles Boolean-expression grammar locally (parentheses are unsupported;
+  NOT > AND > OR).
+  Inspect the exact schema with
   \`deepline monitors available deepline_native.company_radar --json\`.
 
 Examples:
@@ -31517,6 +31644,9 @@ Notes:
   --dry-run validates the definition and shows the plan (deploy cost in Deepline
   credits when the server reports it, plus any existing monitors that may
   already cover this scope) WITHOUT deploying. Exits 0 when valid, 7 when not.
+  Deploy is a full desired definition for its key: omitting a previously stored
+  field removes it and can replace the upstream resource. Use \`monitors update\`
+  for a patch-style change.
 
 Examples:
   deepline monitors deploy '{"key":"job-openings","tool":"deepline_native.company_radar","payload":{"domain":"stripe.com","radar_type":"company_job_openings"}}'

package/dist/{compiler-manifest-CGZadg-v.d.mts → compiler-manifest-BPA3r-VG.d.mts}

@@ -876,6 +876,16 @@ declare class ProviderTransientError extends ToolExecutionError {
 declare const SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS: readonly [1, 2, 3];
 type PlayAuthoringContractEdition = (typeof SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS)[number];
 type PlaySqlListenerOperation = 'INSERT' | 'UPDATE' | 'DELETE';
+type PlayStandardWebhookHeaderFamily = 'standard' | 'svix';
+type PlayStandardWebhookAuth = {
+    type: 'standard-webhooks';
+    /** `webhook-*` for Standard Webhooks, `svix-*` for Svix senders. */
+    headerFamily: PlayStandardWebhookHeaderFamily;
+    /** Deepline Secret names used for ordinary operation and rotation overlap. */
+    signingSecrets: string[];
+    /** Replay-protection window. Omitted means the Standard Webhooks 5-minute default. */
+    toleranceSeconds?: number;
+};
 type PlaySqlListenerFilterScalar = string | number | boolean | null;
 type PlaySqlListenerFilterOperator = {
     eq?: PlaySqlListenerFilterScalar;
@@ -928,6 +938,7 @@ type PlayAuthoringAstBindings = {
             header?: string;
             secretEnv: string;
         };
+        auth?: PlayStandardWebhookAuth;
     };
     cron?: {
         schedule: string;
@@ -958,6 +969,7 @@ type PlayAuthoringBindings = {
             header?: string;
             secretEnv: string;
         };
+        auth?: PlayStandardWebhookAuth;
     };
     cron?: {
         schedule: string;
@@ -1362,6 +1374,78 @@ declare const PLAY_AUTHORING_FIELD_REGISTRY: {
         readonly description: "HTTP header containing the webhook signature.";
         readonly errorMessage: "bindings.webhook.hmac.header must be a non-empty static string.";
     };
+    readonly 'bindings.webhook.auth.type': {
+        readonly schema: _sinclair_typebox.TLiteral<"standard-webhooks">;
+        readonly fixtures: {
+            readonly valid: "standard-webhooks";
+            readonly invalid: "svix";
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "type";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "'standard-webhooks'";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_standard_webhooks_invalid";
+        readonly description: "Uses the Standard Webhooks v1 symmetric signing scheme.";
+        readonly errorMessage: "bindings.webhook.auth.type must be the static literal \"standard-webhooks\".";
+    };
+    readonly 'bindings.webhook.auth.headerFamily': {
+        readonly schema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"standard">, _sinclair_typebox.TLiteral<"svix">]>;
+        readonly fixtures: {
+            readonly valid: "svix";
+            readonly invalid: "webhook";
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "headerFamily";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "'standard' | 'svix'";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_standard_webhooks_invalid";
+        readonly description: "Header namespace expected from the webhook provider.";
+        readonly errorMessage: "bindings.webhook.auth.headerFamily must be the static literal \"standard\" or \"svix\".";
+    };
+    readonly 'bindings.webhook.auth.signingSecrets[]': {
+        readonly schema: _sinclair_typebox.TString;
+        readonly fixtures: {
+            readonly valid: "VECTOR_WEBHOOK_SECRET";
+            readonly invalid: "vector_webhook_secret";
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "secret";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "string";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_standard_webhooks_invalid";
+        readonly description: "Deepline Secret name used to verify Standard Webhooks.";
+        readonly errorMessage: "bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter.";
+    };
+    readonly 'bindings.webhook.auth.toleranceSeconds': {
+        readonly schema: _sinclair_typebox.TInteger;
+        readonly fixtures: {
+            readonly valid: 300;
+            readonly invalid: 0;
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "toleranceSeconds";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "number";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_standard_webhooks_invalid";
+        readonly description: "Accepted delivery timestamp skew in seconds, from 1 through 3600.";
+        readonly errorMessage: "bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600.";
+    };
     readonly 'bindings.cron.schedule': {
         readonly schema: _sinclair_typebox.TString;
         readonly fixtures: {

package/dist/{compiler-manifest-CGZadg-v.d.ts → compiler-manifest-BPA3r-VG.d.ts}

@@ -876,6 +876,16 @@ declare class ProviderTransientError extends ToolExecutionError {
 declare const SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS: readonly [1, 2, 3];
 type PlayAuthoringContractEdition = (typeof SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS)[number];
 type PlaySqlListenerOperation = 'INSERT' | 'UPDATE' | 'DELETE';
+type PlayStandardWebhookHeaderFamily = 'standard' | 'svix';
+type PlayStandardWebhookAuth = {
+    type: 'standard-webhooks';
+    /** `webhook-*` for Standard Webhooks, `svix-*` for Svix senders. */
+    headerFamily: PlayStandardWebhookHeaderFamily;
+    /** Deepline Secret names used for ordinary operation and rotation overlap. */
+    signingSecrets: string[];
+    /** Replay-protection window. Omitted means the Standard Webhooks 5-minute default. */
+    toleranceSeconds?: number;
+};
 type PlaySqlListenerFilterScalar = string | number | boolean | null;
 type PlaySqlListenerFilterOperator = {
     eq?: PlaySqlListenerFilterScalar;
@@ -928,6 +938,7 @@ type PlayAuthoringAstBindings = {
             header?: string;
             secretEnv: string;
         };
+        auth?: PlayStandardWebhookAuth;
     };
     cron?: {
         schedule: string;
@@ -958,6 +969,7 @@ type PlayAuthoringBindings = {
             header?: string;
             secretEnv: string;
         };
+        auth?: PlayStandardWebhookAuth;
     };
     cron?: {
         schedule: string;
@@ -1362,6 +1374,78 @@ declare const PLAY_AUTHORING_FIELD_REGISTRY: {
         readonly description: "HTTP header containing the webhook signature.";
         readonly errorMessage: "bindings.webhook.hmac.header must be a non-empty static string.";
     };
+    readonly 'bindings.webhook.auth.type': {
+        readonly schema: _sinclair_typebox.TLiteral<"standard-webhooks">;
+        readonly fixtures: {
+            readonly valid: "standard-webhooks";
+            readonly invalid: "svix";
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "type";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "'standard-webhooks'";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_standard_webhooks_invalid";
+        readonly description: "Uses the Standard Webhooks v1 symmetric signing scheme.";
+        readonly errorMessage: "bindings.webhook.auth.type must be the static literal \"standard-webhooks\".";
+    };
+    readonly 'bindings.webhook.auth.headerFamily': {
+        readonly schema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"standard">, _sinclair_typebox.TLiteral<"svix">]>;
+        readonly fixtures: {
+            readonly valid: "svix";
+            readonly invalid: "webhook";
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "headerFamily";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "'standard' | 'svix'";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_standard_webhooks_invalid";
+        readonly description: "Header namespace expected from the webhook provider.";
+        readonly errorMessage: "bindings.webhook.auth.headerFamily must be the static literal \"standard\" or \"svix\".";
+    };
+    readonly 'bindings.webhook.auth.signingSecrets[]': {
+        readonly schema: _sinclair_typebox.TString;
+        readonly fixtures: {
+            readonly valid: "VECTOR_WEBHOOK_SECRET";
+            readonly invalid: "vector_webhook_secret";
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "secret";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "string";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_standard_webhooks_invalid";
+        readonly description: "Deepline Secret name used to verify Standard Webhooks.";
+        readonly errorMessage: "bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter.";
+    };
+    readonly 'bindings.webhook.auth.toleranceSeconds': {
+        readonly schema: _sinclair_typebox.TInteger;
+        readonly fixtures: {
+            readonly valid: 300;
+            readonly invalid: 0;
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "toleranceSeconds";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "number";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_standard_webhooks_invalid";
+        readonly description: "Accepted delivery timestamp skew in seconds, from 1 through 3600.";
+        readonly errorMessage: "bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600.";
+    };
     readonly 'bindings.cron.schedule': {
         readonly schema: _sinclair_typebox.TString;
         readonly fixtures: {

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest } from './compiler-manifest-CGZadg-v.mjs';
-export { O as DEEPLINE_EXTRACTOR_TARGETS, Q as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, R as DeeplineEmailStatusGetterValue, S as DeeplineExtractorTarget, U as DeeplineGetterValue, V as DeeplineGetterValueMap, W as JOB_CHANGE_STATUS_VALUES, X as JobChangeStatus, Y as PHONE_STATUS_VALUES, Z as PhoneStatus, _ as PlayDataset, $ as PlayDatasetInput, a0 as PreviousCell, a1 as ProviderTransientError, a2 as ProviderTransientErrorCategory, a3 as ToolExecutionErrorCategory, a4 as ToolExecutionErrorOrigin, a5 as ToolExecutionFailureV1, a6 as ToolExecutionNetworkKind, a7 as ToolExecutionNetworkScope, a8 as isDeeplineExtractorTarget } from './compiler-manifest-CGZadg-v.mjs';
+import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest } from './compiler-manifest-BPA3r-VG.mjs';
+export { O as DEEPLINE_EXTRACTOR_TARGETS, Q as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, R as DeeplineEmailStatusGetterValue, S as DeeplineExtractorTarget, U as DeeplineGetterValue, V as DeeplineGetterValueMap, W as JOB_CHANGE_STATUS_VALUES, X as JobChangeStatus, Y as PHONE_STATUS_VALUES, Z as PhoneStatus, _ as PlayDataset, $ as PlayDatasetInput, a0 as PreviousCell, a1 as ProviderTransientError, a2 as ProviderTransientErrorCategory, a3 as ToolExecutionErrorCategory, a4 as ToolExecutionErrorOrigin, a5 as ToolExecutionFailureV1, a6 as ToolExecutionNetworkKind, a7 as ToolExecutionNetworkScope, a8 as isDeeplineExtractorTarget } from './compiler-manifest-BPA3r-VG.mjs';
 import '@sinclair/typebox';
 
 declare const FIXTURE_BEHAVIOR_VERSION: 1;
@@ -2187,8 +2187,13 @@ type MonitorsNamespace = {
     list: (options?: MonitorsListOptions) => Promise<MonitorsListResult>;
     /** Fetch one deployed monitor by public key (without dependents). */
     get: (key: string) => Promise<MonitorDetail>;
-    /** Send an explicit payload through the deployed monitor's normal webhook path. */
-    test: (key: string, payload: Record<string, unknown>) => Promise<MonitorTestResult>;
+    /**
+     * Test a deployed monitor. `validationOnly` safely verifies the callback
+     * envelope; omitted options preserve the historic full-ingestion behavior.
+     */
+    test: (key: string, payload: Record<string, unknown>, options?: {
+        validationOnly?: boolean;
+    }) => Promise<MonitorTestResult>;
     validate: (key: string) => Promise<MonitorValidateResult>;
     /** List the published plays depending on one monitor's output streams. */
     dependents: (key: string) => Promise<MonitorDependents>;
@@ -3520,7 +3525,9 @@ declare class DeeplineClient {
     listMonitors(options?: MonitorsListOptions): Promise<MonitorsListResult>;
     /** Fetch one deployed monitor by public key. Prefer `client.monitors.get(...)`. */
     getMonitor(key: string): Promise<MonitorDetail>;
-    testMonitorWebhook(key: string, payload: Record<string, unknown>): Promise<MonitorTestResult>;
+    testMonitorWebhook(key: string, payload: Record<string, unknown>, options?: {
+        validationOnly?: boolean;
+    }): Promise<MonitorTestResult>;
     setupMonitor(tool: string, payload: Record<string, unknown>): Promise<Record<string, unknown>>;
     validateMonitor(key: string): Promise<MonitorValidateResult>;
     /** Published plays depending on one monitor. Prefer `client.monitors.dependents(...)`. */
@@ -3720,7 +3727,8 @@ type PlayFetchResponse = PlayAuthoringFetchResponse;
  *
  * A play can be triggered three ways, declared as the third argument to
  * {@link definePlay}:
- * - `webhook` — an inbound HTTP call (with optional HMAC signature verification);
+ * - `webhook` — an inbound HTTP call (with optional legacy HMAC or Standard
+ *   Webhooks signature verification);
  * - `cron` — a schedule; or
  * - `sqlListeners` — a **monitor**: the play runs whenever a monitor writes a new
  *   row to its output stream. This is how you build a play "on top of" a monitor
@@ -3742,6 +3750,19 @@ type PlayFetchResponse = PlayAuthoringFetchResponse;
  * });
  * ```
  *
+ * @example Svix / Standard Webhooks verification with Deepline Secrets
+ * ```typescript
+ * definePlay('visitor-webhook', handler, {
+ *   webhook: {
+ *     auth: {
+ *       type: 'standard-webhooks',
+ *       headerFamily: 'svix',
+ *       signingSecrets: ['VECTOR_WEBHOOK_SECRET'],
+ *     },
+ *   },
+ * });
+ * ```
+ *
  * @example Cron schedule
  * ```typescript
  * definePlay('nightly-sync', handler, {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest } from './compiler-manifest-CGZadg-v.js';
-export { O as DEEPLINE_EXTRACTOR_TARGETS, Q as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, R as DeeplineEmailStatusGetterValue, S as DeeplineExtractorTarget, U as DeeplineGetterValue, V as DeeplineGetterValueMap, W as JOB_CHANGE_STATUS_VALUES, X as JobChangeStatus, Y as PHONE_STATUS_VALUES, Z as PhoneStatus, _ as PlayDataset, $ as PlayDatasetInput, a0 as PreviousCell, a1 as ProviderTransientError, a2 as ProviderTransientErrorCategory, a3 as ToolExecutionErrorCategory, a4 as ToolExecutionErrorOrigin, a5 as ToolExecutionFailureV1, a6 as ToolExecutionNetworkKind, a7 as ToolExecutionNetworkScope, a8 as isDeeplineExtractorTarget } from './compiler-manifest-CGZadg-v.js';
+import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest } from './compiler-manifest-BPA3r-VG.js';
+export { O as DEEPLINE_EXTRACTOR_TARGETS, Q as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, R as DeeplineEmailStatusGetterValue, S as DeeplineExtractorTarget, U as DeeplineGetterValue, V as DeeplineGetterValueMap, W as JOB_CHANGE_STATUS_VALUES, X as JobChangeStatus, Y as PHONE_STATUS_VALUES, Z as PhoneStatus, _ as PlayDataset, $ as PlayDatasetInput, a0 as PreviousCell, a1 as ProviderTransientError, a2 as ProviderTransientErrorCategory, a3 as ToolExecutionErrorCategory, a4 as ToolExecutionErrorOrigin, a5 as ToolExecutionFailureV1, a6 as ToolExecutionNetworkKind, a7 as ToolExecutionNetworkScope, a8 as isDeeplineExtractorTarget } from './compiler-manifest-BPA3r-VG.js';
 import '@sinclair/typebox';
 
 declare const FIXTURE_BEHAVIOR_VERSION: 1;
@@ -2187,8 +2187,13 @@ type MonitorsNamespace = {
     list: (options?: MonitorsListOptions) => Promise<MonitorsListResult>;
     /** Fetch one deployed monitor by public key (without dependents). */
     get: (key: string) => Promise<MonitorDetail>;
-    /** Send an explicit payload through the deployed monitor's normal webhook path. */
-    test: (key: string, payload: Record<string, unknown>) => Promise<MonitorTestResult>;
+    /**
+     * Test a deployed monitor. `validationOnly` safely verifies the callback
+     * envelope; omitted options preserve the historic full-ingestion behavior.
+     */
+    test: (key: string, payload: Record<string, unknown>, options?: {
+        validationOnly?: boolean;
+    }) => Promise<MonitorTestResult>;
     validate: (key: string) => Promise<MonitorValidateResult>;
     /** List the published plays depending on one monitor's output streams. */
     dependents: (key: string) => Promise<MonitorDependents>;
@@ -3520,7 +3525,9 @@ declare class DeeplineClient {
     listMonitors(options?: MonitorsListOptions): Promise<MonitorsListResult>;
     /** Fetch one deployed monitor by public key. Prefer `client.monitors.get(...)`. */
     getMonitor(key: string): Promise<MonitorDetail>;
-    testMonitorWebhook(key: string, payload: Record<string, unknown>): Promise<MonitorTestResult>;
+    testMonitorWebhook(key: string, payload: Record<string, unknown>, options?: {
+        validationOnly?: boolean;
+    }): Promise<MonitorTestResult>;
     setupMonitor(tool: string, payload: Record<string, unknown>): Promise<Record<string, unknown>>;
     validateMonitor(key: string): Promise<MonitorValidateResult>;
     /** Published plays depending on one monitor. Prefer `client.monitors.dependents(...)`. */
@@ -3720,7 +3727,8 @@ type PlayFetchResponse = PlayAuthoringFetchResponse;
  *
  * A play can be triggered three ways, declared as the third argument to
  * {@link definePlay}:
- * - `webhook` — an inbound HTTP call (with optional HMAC signature verification);
+ * - `webhook` — an inbound HTTP call (with optional legacy HMAC or Standard
+ *   Webhooks signature verification);
  * - `cron` — a schedule; or
  * - `sqlListeners` — a **monitor**: the play runs whenever a monitor writes a new
  *   row to its output stream. This is how you build a play "on top of" a monitor
@@ -3742,6 +3750,19 @@ type PlayFetchResponse = PlayAuthoringFetchResponse;
  * });
  * ```
  *
+ * @example Svix / Standard Webhooks verification with Deepline Secrets
+ * ```typescript
+ * definePlay('visitor-webhook', handler, {
+ *   webhook: {
+ *     auth: {
+ *       type: 'standard-webhooks',
+ *       headerFamily: 'svix',
+ *       signingSecrets: ['VECTOR_WEBHOOK_SECRET'],
+ *     },
+ *   },
+ * });
+ * ```
+ *
  * @example Cron schedule
  * ```typescript
  * definePlay('nightly-sync', handler, {

package/dist/index.js

@@ -763,7 +763,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.48",
+  version: "0.2.49",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -3598,7 +3598,7 @@ var DeeplineClient = class {
       deploy: (definition, options2) => this.deployMonitor(definition, options2),
       list: (options2) => this.listMonitors(options2),
       get: (key) => this.getMonitor(key),
-      test: (key, payload) => this.testMonitorWebhook(key, payload),
+      test: (key, payload, options2) => this.testMonitorWebhook(key, payload, options2),
       validate: (key) => this.validateMonitor(key),
       dependents: (key) => this.getMonitorDependents(key),
       update: (key, patch) => this.updateMonitor(key, patch),
@@ -5767,10 +5767,16 @@ var DeeplineClient = class {
       { method: "GET" }
     );
   }
-  async testMonitorWebhook(key, payload) {
+  async testMonitorWebhook(key, payload, options) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
-      { method: "POST", body: { payload } }
+      {
+        method: "POST",
+        body: {
+          payload,
+          ...options?.validationOnly ? { mode: "validation_only" } : {}
+        }
+      }
     );
   }
   async setupMonitor(tool, payload) {

package/dist/index.mjs

@@ -689,7 +689,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.48",
+  version: "0.2.49",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -3524,7 +3524,7 @@ var DeeplineClient = class {
       deploy: (definition, options2) => this.deployMonitor(definition, options2),
       list: (options2) => this.listMonitors(options2),
       get: (key) => this.getMonitor(key),
-      test: (key, payload) => this.testMonitorWebhook(key, payload),
+      test: (key, payload, options2) => this.testMonitorWebhook(key, payload, options2),
       validate: (key) => this.validateMonitor(key),
       dependents: (key) => this.getMonitorDependents(key),
       update: (key, patch) => this.updateMonitor(key, patch),
@@ -5693,10 +5693,16 @@ var DeeplineClient = class {
       { method: "GET" }
     );
   }
-  async testMonitorWebhook(key, payload) {
+  async testMonitorWebhook(key, payload, options) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
-      { method: "POST", body: { payload } }
+      {
+        method: "POST",
+        body: {
+          payload,
+          ...options?.validationOnly ? { mode: "validation_only" } : {}
+        }
+      }
     );
   }
   async setupMonitor(tool, payload) {

package/dist/install-integrity.json

@@ -212,8 +212,8 @@
     "dist/cli/index.d.ts",
     "dist/cli/index.js",
     "dist/cli/index.mjs",
-    "dist/compiler-manifest-CGZadg-v.d.mts",
-    "dist/compiler-manifest-CGZadg-v.d.ts",
+    "dist/compiler-manifest-BPA3r-VG.d.mts",
+    "dist/compiler-manifest-BPA3r-VG.d.ts",
     "dist/helpers.d.mts",
     "dist/helpers.d.ts",
     "dist/helpers.js",

package/dist/plays/bundle-play-file.d.mts

@@ -1,5 +1,5 @@
-import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-CGZadg-v.mjs';
-export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-CGZadg-v.mjs';
+import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-BPA3r-VG.mjs';
+export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-BPA3r-VG.mjs';
 import '@sinclair/typebox';
 
 type PlayPackageImport = {

package/dist/plays/bundle-play-file.d.ts

@@ -1,5 +1,5 @@
-import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-CGZadg-v.js';
-export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-CGZadg-v.js';
+import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-BPA3r-VG.js';
+export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-BPA3r-VG.js';
 import '@sinclair/typebox';
 
 type PlayPackageImport = {

package/dist/plays/bundle-play-file.mjs

@@ -2806,6 +2806,76 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.auth.type": {
+    schema: Type.Literal("standard-webhooks"),
+    fixtures: {
+      valid: "standard-webhooks",
+      invalid: "svix",
+      absent: void 0,
+      unresolved: { expression: "type" },
+      edition1: void 0
+    },
+    referenceType: "'standard-webhooks'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with headerFamily and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Uses the Standard Webhooks v1 symmetric signing scheme.",
+    errorMessage: 'bindings.webhook.auth.type must be the static literal "standard-webhooks".'
+  },
+  "bindings.webhook.auth.headerFamily": {
+    schema: Type.Union([Type.Literal("standard"), Type.Literal("svix")]),
+    fixtures: {
+      valid: "svix",
+      invalid: "webhook",
+      absent: void 0,
+      unresolved: { expression: "headerFamily" },
+      edition1: void 0
+    },
+    referenceType: "'standard' | 'svix'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Header namespace expected from the webhook provider.",
+    errorMessage: 'bindings.webhook.auth.headerFamily must be the static literal "standard" or "svix".'
+  },
+  "bindings.webhook.auth.signingSecrets[]": {
+    schema: SecretEnvironmentNameSchema,
+    fixtures: {
+      valid: "VECTOR_WEBHOOK_SECRET",
+      invalid: "vector_webhook_secret",
+      absent: void 0,
+      unresolved: { expression: "secret" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and headerFamily.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Deepline Secret name used to verify Standard Webhooks.",
+    errorMessage: "bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter."
+  },
+  "bindings.webhook.auth.toleranceSeconds": {
+    schema: Type.Integer({ minimum: 1, maximum: 3600 }),
+    fixtures: {
+      valid: 300,
+      invalid: 0,
+      absent: void 0,
+      unresolved: { expression: "toleranceSeconds" },
+      edition1: void 0
+    },
+    referenceType: "number",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Accepted delivery timestamp skew in seconds, from 1 through 3600.",
+    errorMessage: "bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600."
+  },
   "bindings.cron.schedule": {
     schema: Type.String({ minLength: 1 }),
     fixtures: {
@@ -3830,7 +3900,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")} };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {