deepline 0.3.155 → 0.3.157

package/dist/bundling-sources/sdk/src/play.ts

@@ -207,7 +207,9 @@ export type PlayFetchResponse = PlayAuthoringFetchResponse;
  *   webhook: {
  *     hmac: {
  *       algorithm: 'sha256',
- *       header: 'X-Hub-Signature-256',
+ *       header: 'Attio-Signature',
+ *       // Attio sends a bare lowercase hexadecimal digest.
+ *       signaturePrefix: '',
  *       secretEnv: 'WEBHOOK_SECRET',
  *     },
  *   },

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.155',
+  version: '0.3.157',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/monitors/http-error-response.ts

@@ -129,6 +129,9 @@ export function monitorErrorNextAction(payload: MonitorErrorPayload): string {
   if (code === 'monitor_tool_not_found' || code === 'unknown_monitor_tool') {
     return 'Run `deepline monitors available --json`, choose a returned tool id, then retry with that exact id.';
   }
+  if (code === 'monitor_provider_not_offered') {
+    return 'This provider monitor is retired for new deployments. Run `deepline monitors available --json` to choose a supported Deepline Native radar. Existing retired-provider monitors can still be inspected and deleted.';
+  }
   if (code === 'deployed_monitor_not_found' || code === 'monitor_not_found') {
     return 'Run `deepline monitors list --status all --json`, choose a returned public monitor key, then retry with that key.';
   }

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd-play-deploy-task.ts

@@ -149,6 +149,8 @@ export type PlayDeployTaskParams = {
   playProjectId: string;
   deployToken: string;
   appBaseUrl: string;
+  /** Pinned by the first enqueue. Missing means the original Fly executor. */
+  buildBackend?: 'fly' | 'vercel';
 };
 
 const deployQueueReadyPromises = new Map<string, Promise<void>>();

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -1875,6 +1875,10 @@ export async function ensurePostgresSchedulerOnlineAdditiveExpansion(
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<void> {
   const schema = schemaName(options);
+  // Historical main v36 predates runtime-owned cron cursors. This is an
+  // additive deployment concern, like the receipt-reference expansion below;
+  // requiring it as a baseline would strand a retained Preview namespace.
+  await ensurePostgresSchedulerCronScheduleSchema(client, options);
   await client.query(`
     ALTER TABLE ${tableName('receipts', options)}
       ADD COLUMN IF NOT EXISTS output_ref jsonb
@@ -13291,14 +13295,26 @@ export async function countPostgresSchedulerReceipts(
   client: PostgresSchedulerQueryClient,
   input: {
     runId: string;
+    orgId?: string;
     status: WorkReceiptStatus;
     keyContains?: string | null;
     outputContains?: string | null;
+    receiptKeySha256?: string;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<number> {
   const params: unknown[] = [input.runId, input.status];
   const predicates = ['run_id = $1', 'status = $2'];
+  if (input.orgId) {
+    params.push(input.orgId);
+    predicates.push(`org_id = $${params.length}`);
+  }
+  if (input.receiptKeySha256) {
+    params.push(input.receiptKeySha256);
+    predicates.push(
+      `encode(sha256(convert_to(k, 'UTF8')), 'hex') = $${params.length}`,
+    );
+  }
   const keyContains = input.keyContains?.trim();
   if (keyContains) {
     params.push(keyContains);

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -706,6 +706,7 @@ export type PlayAuthoringAstBindings = {
     hmac?: {
       algorithm?: 'sha256';
       header?: string;
+      signaturePrefix?: string;
       secretEnv: string;
     };
     auth?: PlayStandardWebhookAuth;
@@ -803,6 +804,7 @@ export type PlayAuthoringBindings<TInput = Record<string, unknown>> = {
     hmac?: {
       algorithm?: 'sha256';
       header?: string;
+      signaturePrefix?: string;
       secretEnv: string;
     };
     auth?: PlayStandardWebhookAuth;
@@ -1762,6 +1764,24 @@ export const PLAY_AUTHORING_FIELD_REGISTRY = {
     errorMessage:
       'bindings.webhook.hmac.header must be a non-empty static string.',
   },
+  'bindings.webhook.hmac.signaturePrefix': {
+    schema: Type.String(),
+    fixtures: {
+      valid: '',
+      invalid: { expression: 'signaturePrefix' },
+      absent: undefined,
+      unresolved: { expression: 'signaturePrefix' },
+      edition1: undefined,
+    },
+    referenceType: 'string',
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_webhook_hmac_invalid',
+    description:
+      'Optional literal before the lowercase hexadecimal HMAC. Set to an empty string for providers that send a bare digest; defaults to sha256= when a signature header is configured.',
+    errorMessage:
+      'bindings.webhook.hmac.signaturePrefix must be a static string literal.',
+  },
   'bindings.webhook.auth.type': {
     schema: Type.Literal('standard-webhooks'),
     fixtures: {
@@ -3164,7 +3184,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType('inline')};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType('billing.maxCreditsPerRun')} };`,
   `  runtime?: { timeout?: ${cloudReferenceType('runtime.timeout')}; size?: ${cloudReferenceType('runtime.size')} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType('bindings.webhook.hmac.algorithm')}; header?: ${cloudReferenceType('bindings.webhook.hmac.header')}; secretEnv: ${cloudReferenceType('bindings.webhook.hmac.secretEnv')} }; auth?: { type: ${cloudReferenceType('bindings.webhook.auth.type')}; headerFamily: ${cloudReferenceType('bindings.webhook.auth.headerFamily')}; signingSecrets: readonly ${cloudReferenceType('bindings.webhook.auth.signingSecrets[]')}[]; toleranceSeconds?: ${cloudReferenceType('bindings.webhook.auth.toleranceSeconds')} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType('bindings.webhook.hmac.algorithm')}; header?: ${cloudReferenceType('bindings.webhook.hmac.header')}; signaturePrefix?: ${cloudReferenceType('bindings.webhook.hmac.signaturePrefix')}; secretEnv: ${cloudReferenceType('bindings.webhook.hmac.secretEnv')} }; auth?: { type: ${cloudReferenceType('bindings.webhook.auth.type')}; headerFamily: ${cloudReferenceType('bindings.webhook.auth.headerFamily')}; signingSecrets: readonly ${cloudReferenceType('bindings.webhook.auth.signingSecrets[]')}[]; toleranceSeconds?: ${cloudReferenceType('bindings.webhook.auth.toleranceSeconds')} } };`,
   `  cron?: { schedule: ${cloudReferenceType('bindings.cron.schedule')}; timezone?: ${cloudReferenceType('bindings.cron.timezone')}; input?: PlayCronInput<TInput> };`,
   '  sqlListeners?: readonly SqlListenerDeclaration[];',
   `  secrets?: readonly ${cloudReferenceType('bindings.secrets[]')}[];`,

package/dist/bundling-sources/shared_libs/plays/bundling/index.ts

@@ -130,7 +130,8 @@ export type PlayBundlingAdapter = {
    */
   sourceIdentityRoot?: string;
   nodeModulesDir: string;
-  cacheDir?: string;
+  /** null disables disk caching (for ephemeral serverless build invocations). */
+  cacheDir?: string | null;
   sdkSourceRoot: string;
   sdkPackageJson: string;
   sdkEntryFile: string;
@@ -2159,6 +2160,7 @@ async function readArtifactCache(
   artifactKind: PlayArtifactKind,
   adapter: PlayBundlingAdapter,
 ): Promise<PlayBundleArtifact | null> {
+  if (adapter.cacheDir === null) return null;
   try {
     const serialized = await readFile(
       /* turbopackIgnore: true */ artifactCachePath(
@@ -2178,6 +2180,7 @@ async function writeArtifactCache(
   artifact: PlayBundleArtifact,
   adapter: PlayBundlingAdapter,
 ): Promise<void> {
+  if (adapter.cacheDir === null) return;
   const cacheDir = adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR;
   await mkdir(/* turbopackIgnore: true */ cacheDir, { recursive: true });
   await writeFile(

package/dist/bundling-sources/shared_libs/plays/deploy/api-client.ts

@@ -1,6 +1,7 @@
 import type { PlayBundleArtifact } from '../artifact-types';
 import type { PlayCompilerManifest } from '../compiler-manifest';
 import type { PlayDeploymentStatus } from '../deployment-status';
+import { TERMINAL_PLAY_DEPLOYMENT_STATUSES } from '../deployment-status';
 import type {
   SerializedPlayDeployment,
   SerializedPlayProject,
@@ -63,6 +64,13 @@ export type RegisteredArtifact = {
   [key: string]: unknown;
 };
 
+/** The queue result never includes source, artifacts, or per-play diagnostics. */
+export type DeploymentBuildResult = {
+  deploymentId: string;
+  finalStatus: PlayDeploymentStatus;
+  plays: number;
+};
+
 export type DeploymentPlayState = {
   name: string;
   exists: boolean;
@@ -97,12 +105,15 @@ export class DeployApiClient {
     method: 'GET' | 'POST';
     path: string;
     body?: unknown;
+    signal?: AbortSignal;
   }): Promise<T> {
     const doFetch = this.config.fetchImpl ?? fetch;
     const response = await doFetch(
       `${this.config.appBaseUrl.replace(/\/$/, '')}${input.path}`,
       {
         method: input.method,
+        signal: input.signal,
+        redirect: 'error',
         headers: {
           Authorization: `Bearer ${this.config.deployToken}`,
           ...(input.body !== undefined
@@ -139,6 +150,26 @@ export class DeployApiClient {
     return `/api/v2/deployments/${this.config.deploymentId}${suffix}`;
   }
 
+  async build(signal: AbortSignal): Promise<DeploymentBuildResult> {
+    const result = await this.request<DeploymentBuildResult>({
+      method: 'POST',
+      path: this.deploymentPath('/build'),
+      signal,
+    });
+    if (
+      !result ||
+      result.deploymentId !== this.config.deploymentId ||
+      !TERMINAL_PLAY_DEPLOYMENT_STATUSES.has(result.finalStatus) ||
+      !Number.isSafeInteger(result.plays) ||
+      result.plays < 0
+    ) {
+      throw new Error(
+        'Deployment build returned an invalid completion result.',
+      );
+    }
+    return result;
+  }
+
   getDeployment(): Promise<{
     deployment: SerializedPlayDeployment;
     project: SerializedPlayProject;

package/dist/bundling-sources/shared_libs/plays/deploy/run-deployment.ts

@@ -1,5 +1,5 @@
 import { join } from 'node:path';
-import { rm } from 'node:fs/promises';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
 import type { PlayCompilerManifest } from '../compiler-manifest';
 import {
   DeployApiClient,
@@ -473,7 +473,10 @@ export async function runDeployment(
     };
   };
 
-  const workDir = join(hooks.workRoot, `deploy-${params.deploymentId}`);
+  // Fluid compute can serve overlapping attempts in the same process. A retry
+  // must never remove another attempt's checkout during tarball extraction.
+  await mkdir(hooks.workRoot, { recursive: true });
+  const workDir = await mkdtemp(join(hooks.workRoot, 'deploy-'));
   // Check writes are customer-visible; give transient host failures bounded
   // retries before any caller decides to swallow or fail.
   const postCheck = async (

package/dist/cli/index.js

@@ -3051,7 +3051,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.155",
+  version: "0.3.157",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -17521,6 +17521,22 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.hmac.signaturePrefix": {
+    schema: import_typebox.Type.String(),
+    fixtures: {
+      valid: "",
+      invalid: { expression: "signaturePrefix" },
+      absent: void 0,
+      unresolved: { expression: "signaturePrefix" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_webhook_hmac_invalid",
+    description: "Optional literal before the lowercase hexadecimal HMAC. Set to an empty string for providers that send a bare digest; defaults to sha256= when a signature header is configured.",
+    errorMessage: "bindings.webhook.hmac.signaturePrefix must be a static string literal."
+  },
   "bindings.webhook.auth.type": {
     schema: import_typebox.Type.Literal("standard-webhooks"),
     fixtures: {
@@ -18725,7 +18741,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; signaturePrefix?: ${cloudReferenceType("bindings.webhook.hmac.signaturePrefix")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")}; input?: PlayCronInput<TInput> };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
@@ -20637,6 +20653,16 @@ var import_node_path16 = require("path");
 var import_node_path15 = require("path");
 var import_promises7 = require("fs/promises");
 
+// ../plays/deployment-status.ts
+var TERMINAL_PLAY_DEPLOYMENT_STATUSES = /* @__PURE__ */ new Set([
+  "succeeded",
+  "succeeded_with_warnings",
+  "failed",
+  "reconcile_failed",
+  "cancelled",
+  "superseded"
+]);
+
 // ../plays/deploy/api-client.ts
 var REGISTER_MAX_BATCH_COUNT = 3;
 var REGISTER_MAX_BATCH_BYTES = 25e5;
@@ -20662,6 +20688,8 @@ var DeployApiClient = class {
       `${this.config.appBaseUrl.replace(/\/$/, "")}${input2.path}`,
       {
         method: input2.method,
+        signal: input2.signal,
+        redirect: "error",
         headers: {
           Authorization: `Bearer ${this.config.deployToken}`,
           ...input2.body !== void 0 ? { "Content-Type": "application/json" } : {}
@@ -20691,6 +20719,19 @@ var DeployApiClient = class {
   deploymentPath(suffix = "") {
     return `/api/v2/deployments/${this.config.deploymentId}${suffix}`;
   }
+  async build(signal) {
+    const result = await this.request({
+      method: "POST",
+      path: this.deploymentPath("/build"),
+      signal
+    });
+    if (!result || result.deploymentId !== this.config.deploymentId || !TERMINAL_PLAY_DEPLOYMENT_STATUSES.has(result.finalStatus) || !Number.isSafeInteger(result.plays) || result.plays < 0) {
+      throw new Error(
+        "Deployment build returned an invalid completion result."
+      );
+    }
+    return result;
+  }
   getDeployment() {
     return this.request({
       method: "GET",
@@ -21143,7 +21184,8 @@ async function runDeployment(params, hooks) {
       checkRunId: checkRun?.checkRunId
     };
   };
-  const workDir = (0, import_node_path15.join)(hooks.workRoot, `deploy-${params.deploymentId}`);
+  await (0, import_promises7.mkdir)(hooks.workRoot, { recursive: true });
+  const workDir = await (0, import_promises7.mkdtemp)((0, import_node_path15.join)(hooks.workRoot, "deploy-"));
   const postCheck = async (postCheckOnce, input2) => {
     let lastError;
     for (let attempt = 0; ; attempt += 1) {

package/dist/cli/index.mjs

@@ -1950,7 +1950,7 @@ function configureProxyFromEnv() {
 configureProxyFromEnv();
 
 // src/cli/index.ts
-import { mkdtemp as mkdtemp3, rm as rm4, writeFile as writeFile6 } from "fs/promises";
+import { mkdtemp as mkdtemp4, rm as rm4, writeFile as writeFile6 } from "fs/promises";
 import { join as join27 } from "path";
 import { tmpdir as tmpdir7 } from "os";
 import { Command as Command5 } from "commander";
@@ -3046,7 +3046,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.155",
+  version: "0.3.157",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -15539,8 +15539,8 @@ Examples:
 import {
   copyFile,
   lstat as lstat2,
-  mkdir as mkdir4,
-  mkdtemp as mkdtemp2,
+  mkdir as mkdir5,
+  mkdtemp as mkdtemp3,
   readFile as readFile4,
   realpath as realpath4,
   rename,
@@ -17586,6 +17586,22 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.hmac.signaturePrefix": {
+    schema: Type.String(),
+    fixtures: {
+      valid: "",
+      invalid: { expression: "signaturePrefix" },
+      absent: void 0,
+      unresolved: { expression: "signaturePrefix" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_webhook_hmac_invalid",
+    description: "Optional literal before the lowercase hexadecimal HMAC. Set to an empty string for providers that send a bare digest; defaults to sha256= when a signature header is configured.",
+    errorMessage: "bindings.webhook.hmac.signaturePrefix must be a static string literal."
+  },
   "bindings.webhook.auth.type": {
     schema: Type.Literal("standard-webhooks"),
     fixtures: {
@@ -18790,7 +18806,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; signaturePrefix?: ${cloudReferenceType("bindings.webhook.hmac.signaturePrefix")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")}; input?: PlayCronInput<TInput> };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
@@ -20701,13 +20717,23 @@ function normalizeFixtureScopeValue(value, maxLength) {
 
 // src/cli/commands/plays-deploy.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { mkdtemp, realpath as realpath3, rm as rm2 } from "fs/promises";
+import { mkdtemp as mkdtemp2, realpath as realpath3, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join12, resolve as resolve11 } from "path";
 
 // ../plays/deploy/run-deployment.ts
 import { join as join11 } from "path";
-import { rm } from "fs/promises";
+import { mkdir as mkdir4, mkdtemp, rm } from "fs/promises";
+
+// ../plays/deployment-status.ts
+var TERMINAL_PLAY_DEPLOYMENT_STATUSES = /* @__PURE__ */ new Set([
+  "succeeded",
+  "succeeded_with_warnings",
+  "failed",
+  "reconcile_failed",
+  "cancelled",
+  "superseded"
+]);
 
 // ../plays/deploy/api-client.ts
 var REGISTER_MAX_BATCH_COUNT = 3;
@@ -20734,6 +20760,8 @@ var DeployApiClient = class {
       `${this.config.appBaseUrl.replace(/\/$/, "")}${input2.path}`,
       {
         method: input2.method,
+        signal: input2.signal,
+        redirect: "error",
         headers: {
           Authorization: `Bearer ${this.config.deployToken}`,
           ...input2.body !== void 0 ? { "Content-Type": "application/json" } : {}
@@ -20763,6 +20791,19 @@ var DeployApiClient = class {
   deploymentPath(suffix = "") {
     return `/api/v2/deployments/${this.config.deploymentId}${suffix}`;
   }
+  async build(signal) {
+    const result = await this.request({
+      method: "POST",
+      path: this.deploymentPath("/build"),
+      signal
+    });
+    if (!result || result.deploymentId !== this.config.deploymentId || !TERMINAL_PLAY_DEPLOYMENT_STATUSES.has(result.finalStatus) || !Number.isSafeInteger(result.plays) || result.plays < 0) {
+      throw new Error(
+        "Deployment build returned an invalid completion result."
+      );
+    }
+    return result;
+  }
   getDeployment() {
     return this.request({
       method: "GET",
@@ -21215,7 +21256,8 @@ async function runDeployment(params, hooks) {
       checkRunId: checkRun?.checkRunId
     };
   };
-  const workDir = join11(hooks.workRoot, `deploy-${params.deploymentId}`);
+  await mkdir4(hooks.workRoot, { recursive: true });
+  const workDir = await mkdtemp(join11(hooks.workRoot, "deploy-"));
   const postCheck = async (postCheckOnce, input2) => {
     let lastError;
     for (let attempt = 0; ; attempt += 1) {
@@ -21840,7 +21882,7 @@ async function handlePlaysDeploy(directory, options) {
     ...options.commit ? { commit: options.commit } : {}
   });
   const { bundleDeployPlayFile } = await loadPlayBundler();
-  const workRoot = await mkdtemp(join12(tmpdir4(), "deepline-deploy-"));
+  const workRoot = await mkdtemp2(join12(tmpdir4(), "deepline-deploy-"));
   const consoleInfo = console.info;
   console.info = console.error;
   try {
@@ -35136,7 +35178,7 @@ async function persistEnrichFailureReport(input2) {
   }
   const stateDir = join14(homedir6(), ".local", "deepline", "runtime", "state");
   const reportPrefix = input2.jobs.length > 0 ? "run-block-failures" : "enrich-issues";
-  await mkdir4(stateDir, { recursive: true });
+  await mkdir5(stateDir, { recursive: true });
   const reportPath = join14(
     stateDir,
     `${reportPrefix}-${Math.floor(Date.now() / 1e3)}-${process.pid}.json`
@@ -36066,7 +36108,7 @@ function registerEnrichCommand(program) {
       sdkEnrichTelemetryCompleted = true;
       await completeSdkEnrichTelemetry(sdkEnrichTelemetry, input2);
     };
-    const tempDir = await mkdtemp2(join14(tmpdir5(), "deepline-enrich-play-"));
+    const tempDir = await mkdtemp3(join14(tmpdir5(), "deepline-enrich-play-"));
     await emitSdkEnrichTelemetry(sdkEnrichTelemetry, "enrich_started");
     const tempPlay = join14(tempDir, "deepline-enrich.play.ts");
     let inPlaceTempDir = null;
@@ -36095,7 +36137,7 @@ function registerEnrichCommand(program) {
       if (inPlaceTempDir) {
         await rm3(inPlaceTempDir, { recursive: true, force: true });
       }
-      inPlaceTempDir = await mkdtemp2(
+      inPlaceTempDir = await mkdtemp3(
         join14(
           dirname11(inPlaceCommitOutputPath ?? resolve13(inputCsv)),
           ".deepline-enrich-in-place-"
@@ -50382,7 +50424,7 @@ Examples:
 }
 
 // src/cli/commands/workflow.ts
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname21, join as join26, resolve as resolve21 } from "path";
 
 // src/cli/workflow-to-play.ts
@@ -50635,7 +50677,7 @@ async function transformOne(api, workflowId, outDir, publish) {
       { workflowName: workflow.name, version: revision.version }
     );
     const file = join26(resolve21(outDir), `${compiled.playName}.play.ts`);
-    await mkdir5(dirname21(file), { recursive: true });
+    await mkdir6(dirname21(file), { recursive: true });
     await writeFile5(file, compiled.sourceCode, "utf8");
     let published = false;
     if (publish) {
@@ -51175,7 +51217,7 @@ function topLevelCommandKnown(program, commandName) {
   );
 }
 async function runPlayRunnerHealthCheck() {
-  const dir = await mkdtemp3(join27(tmpdir7(), "deepline-health-play-"));
+  const dir = await mkdtemp4(join27(tmpdir7(), "deepline-health-play-"));
   const file = join27(dir, "health-check.play.ts");
   try {
     await writeFile6(

package/dist/{compiler-manifest-BJBNPTWt.d.mts → compiler-manifest-4bYusxBr.d.mts}

@@ -793,6 +793,7 @@ type PlayAuthoringAstBindings = {
         hmac?: {
             algorithm?: 'sha256';
             header?: string;
+            signaturePrefix?: string;
             secretEnv: string;
         };
         auth?: PlayStandardWebhookAuth;
@@ -843,6 +844,7 @@ type PlayAuthoringBindings<TInput = Record<string, unknown>> = {
         hmac?: {
             algorithm?: 'sha256';
             header?: string;
+            signaturePrefix?: string;
             secretEnv: string;
         };
         auth?: PlayStandardWebhookAuth;
@@ -1444,6 +1446,26 @@ declare const PLAY_AUTHORING_FIELD_REGISTRY: {
         readonly description: "HTTP header containing the webhook signature.";
         readonly errorMessage: "bindings.webhook.hmac.header must be a non-empty static string.";
     };
+    readonly 'bindings.webhook.hmac.signaturePrefix': {
+        readonly schema: _sinclair_typebox.TString;
+        readonly fixtures: {
+            readonly valid: "";
+            readonly invalid: {
+                readonly expression: "signaturePrefix";
+            };
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "signaturePrefix";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "string";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_webhook_hmac_invalid";
+        readonly description: "Optional literal before the lowercase hexadecimal HMAC. Set to an empty string for providers that send a bare digest; defaults to sha256= when a signature header is configured.";
+        readonly errorMessage: "bindings.webhook.hmac.signaturePrefix must be a static string literal.";
+    };
     readonly 'bindings.webhook.auth.type': {
         readonly schema: _sinclair_typebox.TLiteral<"standard-webhooks">;
         readonly fixtures: {

package/dist/{compiler-manifest-BJBNPTWt.d.ts → compiler-manifest-4bYusxBr.d.ts}

@@ -793,6 +793,7 @@ type PlayAuthoringAstBindings = {
         hmac?: {
             algorithm?: 'sha256';
             header?: string;
+            signaturePrefix?: string;
             secretEnv: string;
         };
         auth?: PlayStandardWebhookAuth;
@@ -843,6 +844,7 @@ type PlayAuthoringBindings<TInput = Record<string, unknown>> = {
         hmac?: {
             algorithm?: 'sha256';
             header?: string;
+            signaturePrefix?: string;
             secretEnv: string;
         };
         auth?: PlayStandardWebhookAuth;
@@ -1444,6 +1446,26 @@ declare const PLAY_AUTHORING_FIELD_REGISTRY: {
         readonly description: "HTTP header containing the webhook signature.";
         readonly errorMessage: "bindings.webhook.hmac.header must be a non-empty static string.";
     };
+    readonly 'bindings.webhook.hmac.signaturePrefix': {
+        readonly schema: _sinclair_typebox.TString;
+        readonly fixtures: {
+            readonly valid: "";
+            readonly invalid: {
+                readonly expression: "signaturePrefix";
+            };
+            readonly absent: undefined;
+            readonly unresolved: {
+                readonly expression: "signaturePrefix";
+            };
+            readonly edition1: undefined;
+        };
+        readonly referenceType: "string";
+        readonly required: false;
+        readonly resolution: "static-required";
+        readonly issueCode: "play_authoring_webhook_hmac_invalid";
+        readonly description: "Optional literal before the lowercase hexadecimal HMAC. Set to an empty string for providers that send a bare digest; defaults to sha256= when a signature header is configured.";
+        readonly errorMessage: "bindings.webhook.hmac.signaturePrefix must be a static string literal.";
+    };
     readonly 'bindings.webhook.auth.type': {
         readonly schema: _sinclair_typebox.TLiteral<"standard-webhooks">;
         readonly fixtures: {

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 /// <reference path="./text-imports.d.ts" />
-import { c as PlayCompilerManifest, T as ToolResultBilling, A as AsyncPlayRunRef$1, i as PlayAuthoringColumnMap, j as PlayAuthoringColumnResolver, k as PlayAuthoringRuntimeContext, l as PlayAuthoringConditionalStepResolver, m as PlayAuthoringCsvInput, n as PlayAuthoringCsvOptions, o as PlayAuthoringDatasetBuilder, p as PlayAuthoringDatasetColumnDefinition, q as PlayAuthoringDatasetColumnRunInput, r as ToolExecuteResult, s as PlayAuthoringReferenceLike, t as PlayReturnObject$1, u as PlayAuthoringDefineConfig, v as PlayAuthoringDefinedPlay, w as PlayAuthoringFetchOptions, x as PlayAuthoringFileInput, y as PlayAuthoringAsyncCallOptions, z as PlayAuthoringBindings, B as PlayAuthoringCallExecution, C as PlayAuthoringCallOptions, D as PlayAuthoringFetchResponse, E as PlayAuthoringInputContract, F as PlayRunId$1, G as PlayAuthoringStepProgramStep, H as PlayAuthoringRuntimeStepOptions, I as PlaySqlListenerDeclaration, J as PlaySqlListenerEvent, K as PlaySqlListenerOperation, L as PlaySqlQuery, M as PlayAuthoringStepOptions, N as PlayAuthoringStepProgram, O as PlayAuthoringStepProgramResolver, Q as PlayAuthoringStepResolver, R as PlayToolExecutionRequest, S as PlayAuthoringStepProgramOptions, U as DeeplineError, V as ToolExecutionError, W as ToolExecutionErrorOptions } from './compiler-manifest-BJBNPTWt.mjs';
-export { X as CtxFetchHttpError, Y as DEEPLINE_EXTRACTOR_TARGETS, Z as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, _ as DeeplineEmailStatusGetterValue, $ as DeeplineExtractorTarget, a0 as DeeplineGetterValue, a1 as DeeplineGetterValueMap, a2 as JOB_CHANGE_STATUS_VALUES, a3 as JobChangeStatus, a4 as PHONE_STATUS_VALUES, a5 as PhoneStatus, a6 as PlayDataset, a7 as PlayDatasetInput, a8 as PreviousCell, a9 as ProviderTransientError, aa as ProviderTransientErrorCategory, ab as ProviderUnavailableError, ac as ProviderUnavailableReason, ad as ToolExecutionErrorCategory, ae as ToolExecutionErrorOrigin, af as ToolExecutionFailureV1, ag as ToolExecutionNetworkKind, ah as ToolExecutionNetworkScope, ai as ToolExecutionPublicDetails, aj as getProviderUnavailableReason, ak as isDeeplineExtractorTarget, al as isProviderUnavailable, am as isProviderWaterfallUnavailableError } from './compiler-manifest-BJBNPTWt.mjs';
+import { c as PlayCompilerManifest, T as ToolResultBilling, A as AsyncPlayRunRef$1, i as PlayAuthoringColumnMap, j as PlayAuthoringColumnResolver, k as PlayAuthoringRuntimeContext, l as PlayAuthoringConditionalStepResolver, m as PlayAuthoringCsvInput, n as PlayAuthoringCsvOptions, o as PlayAuthoringDatasetBuilder, p as PlayAuthoringDatasetColumnDefinition, q as PlayAuthoringDatasetColumnRunInput, r as ToolExecuteResult, s as PlayAuthoringReferenceLike, t as PlayReturnObject$1, u as PlayAuthoringDefineConfig, v as PlayAuthoringDefinedPlay, w as PlayAuthoringFetchOptions, x as PlayAuthoringFileInput, y as PlayAuthoringAsyncCallOptions, z as PlayAuthoringBindings, B as PlayAuthoringCallExecution, C as PlayAuthoringCallOptions, D as PlayAuthoringFetchResponse, E as PlayAuthoringInputContract, F as PlayRunId$1, G as PlayAuthoringStepProgramStep, H as PlayAuthoringRuntimeStepOptions, I as PlaySqlListenerDeclaration, J as PlaySqlListenerEvent, K as PlaySqlListenerOperation, L as PlaySqlQuery, M as PlayAuthoringStepOptions, N as PlayAuthoringStepProgram, O as PlayAuthoringStepProgramResolver, Q as PlayAuthoringStepResolver, R as PlayToolExecutionRequest, S as PlayAuthoringStepProgramOptions, U as DeeplineError, V as ToolExecutionError, W as ToolExecutionErrorOptions } from './compiler-manifest-4bYusxBr.mjs';
+export { X as CtxFetchHttpError, Y as DEEPLINE_EXTRACTOR_TARGETS, Z as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, _ as DeeplineEmailStatusGetterValue, $ as DeeplineExtractorTarget, a0 as DeeplineGetterValue, a1 as DeeplineGetterValueMap, a2 as JOB_CHANGE_STATUS_VALUES, a3 as JobChangeStatus, a4 as PHONE_STATUS_VALUES, a5 as PhoneStatus, a6 as PlayDataset, a7 as PlayDatasetInput, a8 as PreviousCell, a9 as ProviderTransientError, aa as ProviderTransientErrorCategory, ab as ProviderUnavailableError, ac as ProviderUnavailableReason, ad as ToolExecutionErrorCategory, ae as ToolExecutionErrorOrigin, af as ToolExecutionFailureV1, ag as ToolExecutionNetworkKind, ah as ToolExecutionNetworkScope, ai as ToolExecutionPublicDetails, aj as getProviderUnavailableReason, ak as isDeeplineExtractorTarget, al as isProviderUnavailable, am as isProviderWaterfallUnavailableError } from './compiler-manifest-4bYusxBr.mjs';
 import { MonitorFleetDefinition } from './monitor-fleet-contract.mjs';
 export { AdmittedMonitorFleetAuthoringContract, MONITOR_FLEET_AUTHORING_CONTRACT_CHANGELOG, MONITOR_FLEET_AUTHORING_CONTRACT_EDITION, MONITOR_FLEET_DOCUMENTATION, MONITOR_FLEET_FRONTIER_MAX_ROWS, MONITOR_FLEET_MAX_MEMBERS, MonitorFleetAuthoringContractEdition, MonitorFleetAuthoringContractResult, MonitorFleetColumn, MonitorFleetContractIssue, MonitorFleetExpression, MonitorFleetTemplate, admitMonitorFleetAuthoringContract, defineMonitorFleet, fleetColumn, fleetKey, lintMonitorFleetInput, validateMonitorFleetDefinition } from './monitor-fleet-contract.mjs';
 export { BatchMonitorInput, MonitorInputIssue, MonitorSpec as MonitorInputSpec, lintMonitorBatchInput, lintMonitorSpecTemplate, renderMonitorSpecTemplate } from './monitor-input-contract.mjs';
@@ -5678,7 +5678,9 @@ type PlayFetchResponse = PlayAuthoringFetchResponse;
  *   webhook: {
  *     hmac: {
  *       algorithm: 'sha256',
- *       header: 'X-Hub-Signature-256',
+ *       header: 'Attio-Signature',
+ *       // Attio sends a bare lowercase hexadecimal digest.
+ *       signaturePrefix: '',
  *       secretEnv: 'WEBHOOK_SECRET',
  *     },
  *   },

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 /// <reference path="./text-imports.d.ts" />
-import { c as PlayCompilerManifest, T as ToolResultBilling, A as AsyncPlayRunRef$1, i as PlayAuthoringColumnMap, j as PlayAuthoringColumnResolver, k as PlayAuthoringRuntimeContext, l as PlayAuthoringConditionalStepResolver, m as PlayAuthoringCsvInput, n as PlayAuthoringCsvOptions, o as PlayAuthoringDatasetBuilder, p as PlayAuthoringDatasetColumnDefinition, q as PlayAuthoringDatasetColumnRunInput, r as ToolExecuteResult, s as PlayAuthoringReferenceLike, t as PlayReturnObject$1, u as PlayAuthoringDefineConfig, v as PlayAuthoringDefinedPlay, w as PlayAuthoringFetchOptions, x as PlayAuthoringFileInput, y as PlayAuthoringAsyncCallOptions, z as PlayAuthoringBindings, B as PlayAuthoringCallExecution, C as PlayAuthoringCallOptions, D as PlayAuthoringFetchResponse, E as PlayAuthoringInputContract, F as PlayRunId$1, G as PlayAuthoringStepProgramStep, H as PlayAuthoringRuntimeStepOptions, I as PlaySqlListenerDeclaration, J as PlaySqlListenerEvent, K as PlaySqlListenerOperation, L as PlaySqlQuery, M as PlayAuthoringStepOptions, N as PlayAuthoringStepProgram, O as PlayAuthoringStepProgramResolver, Q as PlayAuthoringStepResolver, R as PlayToolExecutionRequest, S as PlayAuthoringStepProgramOptions, U as DeeplineError, V as ToolExecutionError, W as ToolExecutionErrorOptions } from './compiler-manifest-BJBNPTWt.js';
-export { X as CtxFetchHttpError, Y as DEEPLINE_EXTRACTOR_TARGETS, Z as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, _ as DeeplineEmailStatusGetterValue, $ as DeeplineExtractorTarget, a0 as DeeplineGetterValue, a1 as DeeplineGetterValueMap, a2 as JOB_CHANGE_STATUS_VALUES, a3 as JobChangeStatus, a4 as PHONE_STATUS_VALUES, a5 as PhoneStatus, a6 as PlayDataset, a7 as PlayDatasetInput, a8 as PreviousCell, a9 as ProviderTransientError, aa as ProviderTransientErrorCategory, ab as ProviderUnavailableError, ac as ProviderUnavailableReason, ad as ToolExecutionErrorCategory, ae as ToolExecutionErrorOrigin, af as ToolExecutionFailureV1, ag as ToolExecutionNetworkKind, ah as ToolExecutionNetworkScope, ai as ToolExecutionPublicDetails, aj as getProviderUnavailableReason, ak as isDeeplineExtractorTarget, al as isProviderUnavailable, am as isProviderWaterfallUnavailableError } from './compiler-manifest-BJBNPTWt.js';
+import { c as PlayCompilerManifest, T as ToolResultBilling, A as AsyncPlayRunRef$1, i as PlayAuthoringColumnMap, j as PlayAuthoringColumnResolver, k as PlayAuthoringRuntimeContext, l as PlayAuthoringConditionalStepResolver, m as PlayAuthoringCsvInput, n as PlayAuthoringCsvOptions, o as PlayAuthoringDatasetBuilder, p as PlayAuthoringDatasetColumnDefinition, q as PlayAuthoringDatasetColumnRunInput, r as ToolExecuteResult, s as PlayAuthoringReferenceLike, t as PlayReturnObject$1, u as PlayAuthoringDefineConfig, v as PlayAuthoringDefinedPlay, w as PlayAuthoringFetchOptions, x as PlayAuthoringFileInput, y as PlayAuthoringAsyncCallOptions, z as PlayAuthoringBindings, B as PlayAuthoringCallExecution, C as PlayAuthoringCallOptions, D as PlayAuthoringFetchResponse, E as PlayAuthoringInputContract, F as PlayRunId$1, G as PlayAuthoringStepProgramStep, H as PlayAuthoringRuntimeStepOptions, I as PlaySqlListenerDeclaration, J as PlaySqlListenerEvent, K as PlaySqlListenerOperation, L as PlaySqlQuery, M as PlayAuthoringStepOptions, N as PlayAuthoringStepProgram, O as PlayAuthoringStepProgramResolver, Q as PlayAuthoringStepResolver, R as PlayToolExecutionRequest, S as PlayAuthoringStepProgramOptions, U as DeeplineError, V as ToolExecutionError, W as ToolExecutionErrorOptions } from './compiler-manifest-4bYusxBr.js';
+export { X as CtxFetchHttpError, Y as DEEPLINE_EXTRACTOR_TARGETS, Z as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, _ as DeeplineEmailStatusGetterValue, $ as DeeplineExtractorTarget, a0 as DeeplineGetterValue, a1 as DeeplineGetterValueMap, a2 as JOB_CHANGE_STATUS_VALUES, a3 as JobChangeStatus, a4 as PHONE_STATUS_VALUES, a5 as PhoneStatus, a6 as PlayDataset, a7 as PlayDatasetInput, a8 as PreviousCell, a9 as ProviderTransientError, aa as ProviderTransientErrorCategory, ab as ProviderUnavailableError, ac as ProviderUnavailableReason, ad as ToolExecutionErrorCategory, ae as ToolExecutionErrorOrigin, af as ToolExecutionFailureV1, ag as ToolExecutionNetworkKind, ah as ToolExecutionNetworkScope, ai as ToolExecutionPublicDetails, aj as getProviderUnavailableReason, ak as isDeeplineExtractorTarget, al as isProviderUnavailable, am as isProviderWaterfallUnavailableError } from './compiler-manifest-4bYusxBr.js';
 import { MonitorFleetDefinition } from './monitor-fleet-contract.js';
 export { AdmittedMonitorFleetAuthoringContract, MONITOR_FLEET_AUTHORING_CONTRACT_CHANGELOG, MONITOR_FLEET_AUTHORING_CONTRACT_EDITION, MONITOR_FLEET_DOCUMENTATION, MONITOR_FLEET_FRONTIER_MAX_ROWS, MONITOR_FLEET_MAX_MEMBERS, MonitorFleetAuthoringContractEdition, MonitorFleetAuthoringContractResult, MonitorFleetColumn, MonitorFleetContractIssue, MonitorFleetExpression, MonitorFleetTemplate, admitMonitorFleetAuthoringContract, defineMonitorFleet, fleetColumn, fleetKey, lintMonitorFleetInput, validateMonitorFleetDefinition } from './monitor-fleet-contract.js';
 export { BatchMonitorInput, MonitorInputIssue, MonitorSpec as MonitorInputSpec, lintMonitorBatchInput, lintMonitorSpecTemplate, renderMonitorSpecTemplate } from './monitor-input-contract.js';
@@ -5678,7 +5678,9 @@ type PlayFetchResponse = PlayAuthoringFetchResponse;
  *   webhook: {
  *     hmac: {
  *       algorithm: 'sha256',
- *       header: 'X-Hub-Signature-256',
+ *       header: 'Attio-Signature',
+ *       // Attio sends a bare lowercase hexadecimal digest.
+ *       signaturePrefix: '',
  *       secretEnv: 'WEBHOOK_SECRET',
  *     },
  *   },

package/dist/index.js

@@ -864,7 +864,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.155",
+  version: "0.3.157",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -9979,6 +9979,22 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.hmac.signaturePrefix": {
+    schema: import_typebox.Type.String(),
+    fixtures: {
+      valid: "",
+      invalid: { expression: "signaturePrefix" },
+      absent: void 0,
+      unresolved: { expression: "signaturePrefix" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_webhook_hmac_invalid",
+    description: "Optional literal before the lowercase hexadecimal HMAC. Set to an empty string for providers that send a bare digest; defaults to sha256= when a signature header is configured.",
+    errorMessage: "bindings.webhook.hmac.signaturePrefix must be a static string literal."
+  },
   "bindings.webhook.auth.type": {
     schema: import_typebox.Type.Literal("standard-webhooks"),
     fixtures: {
@@ -11183,7 +11199,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; signaturePrefix?: ${cloudReferenceType("bindings.webhook.hmac.signaturePrefix")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")}; input?: PlayCronInput<TInput> };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,

package/dist/index.mjs

@@ -768,7 +768,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.155",
+  version: "0.3.157",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -9883,6 +9883,22 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.hmac.signaturePrefix": {
+    schema: Type.String(),
+    fixtures: {
+      valid: "",
+      invalid: { expression: "signaturePrefix" },
+      absent: void 0,
+      unresolved: { expression: "signaturePrefix" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_webhook_hmac_invalid",
+    description: "Optional literal before the lowercase hexadecimal HMAC. Set to an empty string for providers that send a bare digest; defaults to sha256= when a signature header is configured.",
+    errorMessage: "bindings.webhook.hmac.signaturePrefix must be a static string literal."
+  },
   "bindings.webhook.auth.type": {
     schema: Type.Literal("standard-webhooks"),
     fixtures: {
@@ -11087,7 +11103,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; signaturePrefix?: ${cloudReferenceType("bindings.webhook.hmac.signaturePrefix")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")}; input?: PlayCronInput<TInput> };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,

package/dist/install-integrity.json

@@ -552,8 +552,8 @@
     "dist/cli/index.js",
     "dist/cli/index.mjs",
     "dist/cli/text-imports.d.ts",
-    "dist/compiler-manifest-BJBNPTWt.d.mts",
-    "dist/compiler-manifest-BJBNPTWt.d.ts",
+    "dist/compiler-manifest-4bYusxBr.d.mts",
+    "dist/compiler-manifest-4bYusxBr.d.ts",
     "dist/helpers.d.mts",
     "dist/helpers.d.ts",
     "dist/helpers.js",

package/dist/plays/bundle-play-file.d.mts

@@ -1,6 +1,6 @@
 /// <reference path="./text-imports.d.ts" />
-import { P as PlayArtifactKind, a as PlayBundleArtifact, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-BJBNPTWt.mjs';
-export { d as PLAY_ARTIFACT_KINDS, e as PlayArtifactCompatibility, f as PlayImportPolicy, g as PlayPackageImport, h as PlayRuntimeFeature } from '../compiler-manifest-BJBNPTWt.mjs';
+import { P as PlayArtifactKind, a as PlayBundleArtifact, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-4bYusxBr.mjs';
+export { d as PLAY_ARTIFACT_KINDS, e as PlayArtifactCompatibility, f as PlayImportPolicy, g as PlayPackageImport, h as PlayRuntimeFeature } from '../compiler-manifest-4bYusxBr.mjs';
 import '@sinclair/typebox';
 
 type ImportedPlayDependency = {
@@ -33,7 +33,8 @@ type PlayBundlingAdapter = {
      */
     sourceIdentityRoot?: string;
     nodeModulesDir: string;
-    cacheDir?: string;
+    /** null disables disk caching (for ephemeral serverless build invocations). */
+    cacheDir?: string | null;
     sdkSourceRoot: string;
     sdkPackageJson: string;
     sdkEntryFile: string;

package/dist/plays/bundle-play-file.d.ts

@@ -1,6 +1,6 @@
 /// <reference path="./text-imports.d.ts" />
-import { P as PlayArtifactKind, a as PlayBundleArtifact, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-BJBNPTWt.js';
-export { d as PLAY_ARTIFACT_KINDS, e as PlayArtifactCompatibility, f as PlayImportPolicy, g as PlayPackageImport, h as PlayRuntimeFeature } from '../compiler-manifest-BJBNPTWt.js';
+import { P as PlayArtifactKind, a as PlayBundleArtifact, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-4bYusxBr.js';
+export { d as PLAY_ARTIFACT_KINDS, e as PlayArtifactCompatibility, f as PlayImportPolicy, g as PlayPackageImport, h as PlayRuntimeFeature } from '../compiler-manifest-4bYusxBr.js';
 import '@sinclair/typebox';
 
 type ImportedPlayDependency = {
@@ -33,7 +33,8 @@ type PlayBundlingAdapter = {
      */
     sourceIdentityRoot?: string;
     nodeModulesDir: string;
-    cacheDir?: string;
+    /** null disables disk caching (for ephemeral serverless build invocations). */
+    cacheDir?: string | null;
     sdkSourceRoot: string;
     sdkPackageJson: string;
     sdkEntryFile: string;

package/dist/plays/bundle-play-file.mjs

@@ -319,6 +319,22 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.hmac.signaturePrefix": {
+    schema: Type.String(),
+    fixtures: {
+      valid: "",
+      invalid: { expression: "signaturePrefix" },
+      absent: void 0,
+      unresolved: { expression: "signaturePrefix" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_webhook_hmac_invalid",
+    description: "Optional literal before the lowercase hexadecimal HMAC. Set to an empty string for providers that send a bare digest; defaults to sha256= when a signature header is configured.",
+    errorMessage: "bindings.webhook.hmac.signaturePrefix must be a static string literal."
+  },
   "bindings.webhook.auth.type": {
     schema: Type.Literal("standard-webhooks"),
     fixtures: {
@@ -1523,7 +1539,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; signaturePrefix?: ${cloudReferenceType("bindings.webhook.hmac.signaturePrefix")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")}; input?: PlayCronInput<TInput> };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
@@ -4202,6 +4218,7 @@ function artifactCachePath(graphHash, artifactKind, adapter) {
   );
 }
 async function readArtifactCache(graphHash, artifactKind, adapter) {
+  if (adapter.cacheDir === null) return null;
   try {
     const serialized = await readFile(
       /* turbopackIgnore: true */
@@ -4218,6 +4235,7 @@ async function readArtifactCache(graphHash, artifactKind, adapter) {
   }
 }
 async function writeArtifactCache(artifact, adapter) {
+  if (adapter.cacheDir === null) return;
   const cacheDir = adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR;
   await mkdir(
     /* turbopackIgnore: true */

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.155";
+    readonly version: "0.3.157";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.155";
+    readonly version: "0.3.157";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.155",
+  version: "0.3.157",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.155",
+  version: "0.3.157",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.155",
+  "version": "0.3.157",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",