docs(webhooks): list 12 new named webhook sources

Lists the new named webhook sources on the sources page: `loops()` and
`granola()` (Standard Webhooks), `autumn()` (Svix), `metronome()`,
`mux()`, `tailscale()`, `langfuse()`, `infisical()`, `planetscale()`,
`plain()` and `firecrawl()` (provider-specific HMAC), and `supabase()`.
Supabase database webhooks aren't signed, so the page explains adding an
`Authorization: Bearer <secret>` header to the webhook.

The filters page also shows how to match any event of a batched array
payload: `event any ( type == 'nodeCreated' )`.
Mono-RevId: d7e19f30f093b9bb81bc40ca05a91601d2da2091

Author: ericallam

docs/webhooks/filters.mdx

@@ -116,6 +116,12 @@ event.billing.country == event.shipping.country
 event.items any ( quantity > 0 )
 ```
 
+When the payload itself is an array, as with providers that batch several events into one request (Tailscale, for example), quantify over `event`:
+
+```text Filter expression
+event any ( type == 'nodeCreated' )
+```
+
 ### Spacing
 
 Separate paths, operators, and values with one space. Parentheses may touch what they enclose, as in `(event.amount > 0)` and `any (quantity > 0)`. Lists and quoted strings may contain spaces (`['opened', 'closed']`, `'Fix the build'`). These forms work with both the TypeScript validator and the deployment parser.

docs/webhooks/sources.mdx

@@ -96,14 +96,17 @@ Each function below returns a source with its provider's verification configurat
 
 | Verification | Source functions |
 | --- | --- |
-| Svix | `clerk()`, `resend()`, `brex()` |
-| Standard Webhooks | `openai()`, `replicate()`, `recallai()`, `composio()` |
+| Svix | `clerk()`, `resend()`, `brex()`, `autumn()` |
+| Standard Webhooks | `openai()`, `replicate()`, `recallai()`, `composio()`, `loops()`, `granola()` |
 | HMAC-SHA256 with `X-Hub-Signature-256` | `whatsapp()` |
 | Shared secret in `X-Gitlab-Token` | `gitlab()` |
-| Provider-specific HMAC | `calendly()`, `calCom()`, `sentry()`, `pagerduty()`, `vercel()`, `linear()`, `notion()`, `typeform()`, `docusign()`, `jira()`, `intercom()`, `zendesk()`, `attio()`, `workos()`, `elevenlabs()`, `vapi()`, `retell()`, `shopify()` |
+| Shared secret as `Authorization: Bearer` | `supabase()` |
+| Provider-specific HMAC | `calendly()`, `calCom()`, `sentry()`, `pagerduty()`, `vercel()`, `linear()`, `notion()`, `typeform()`, `docusign()`, `jira()`, `intercom()`, `zendesk()`, `attio()`, `workos()`, `elevenlabs()`, `vapi()`, `retell()`, `shopify()`, `metronome()`, `mux()`, `tailscale()`, `langfuse()`, `infisical()`, `planetscale()`, `plain()`, `firecrawl()` |
 
 Provider IDs containing a hyphen use a camel case function name: the `cal-com` provider is `webhooks.calCom()`.
 
+Supabase database webhooks aren't signed, so `supabase()` checks a shared secret instead. Generate the endpoint's secret on Trigger.dev, then add an `Authorization` header with the value `Bearer <secret>` under the webhook's HTTP Headers in Supabase.
+
 Slack also ships as a chat channel in `@trigger.dev/slack`.
 
 ## Endpoint validation