@10x-media/webhooks 0.1.0-beta.0 → 0.1.0-beta.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @10x-media/webhooks
 
+## 0.1.0-beta.1
+
+### Minor Changes
+
+- Add a typed `translations` option to every plugin factory and make translation keys a stable public API. Each plugin's `./i18n` subpath now exports the `keys` object, the `TranslationKey` union, and the `TranslationsOption` shape. Overrides are flat and per-locale: values win over the built-in locales key-by-key, locales a plugin does not ship are added whole, and app-level `i18n.translations` still wins over everything.
+
+  ```ts
+  import { analytics } from "@10x-media/analytics";
+  import { keys } from "@10x-media/analytics/i18n";
+
+  analytics({
+    adapters: [nativeAdapter()],
+    translations: {
+      de: { [keys.pluginName]: "Analytik" },
+    },
+  });
+  ```
+
+  A typo'd key inside `translations` is a compile error.
+
+### Patch Changes
+
+- Restructure README: features, quick start, and links into the documentation site at https://docs.10xmedia.de. Long-form documentation moved out of the package README.
+
+- Update README documentation links: the docs site now serves from the domain root, so `docs.10xmedia.de/docs/<plugin>` links became `docs.10xmedia.de/<plugin>`.
+
+- Ship per-file dist output instead of bundled chunks. Bundling merged client components into shared chunks and dropped their 'use client' directives, so Next.js lost the RSC boundary and the admin panel crashed with "useRef only works in Client Components" when rendering components imported through such a chunk (for analytics: every chart-based dashboard widget). Dist now mirrors src one file at a time, directives stay exactly where they were authored, and file names are stable across releases. A repo-level `check:dist` verification (directive parity, no inlined dependencies, exports resolution, publint) now runs in CI so this class of regression cannot ship again.
+
 ## 0.1.0-beta.0
 
 ### Minor Changes

package/README.md

@@ -1,26 +1,29 @@
 # @10x-media/webhooks
 
-Outbound webhook subscriptions for Payload v3. Opt any collection in, let subscribers register URLs in the admin panel, and deliver signed HTTP POSTs on every create/update/delete -- inline or via Payload's built-in jobs queue.
+Outbound webhook subscriptions for Payload v3. Opt collections in, let subscribers register URLs in the admin panel (or in code), and deliver signed HTTP POSTs on every create, update, and delete, inline or through Payload's jobs queue, with retries and an append-only delivery log.
 
 [![npm](https://img.shields.io/npm/v/@10x-media/webhooks?style=flat-square)](https://www.npmjs.com/package/@10x-media/webhooks)
 
 Part of the [@10x-media Payload plugins](https://github.com/10x-media/payload-plugins) collection. In beta: published under the `beta` dist-tag until a stable 1.0.
 
-## Requirements
+## Features
 
-- Payload v3 (peer: `payload@^3.82.0`)
-- React 19 (peer)
-- Node 22.18+
+- **Opt-in collections** with per-collection operations, `previousData` on updates, and a `transform` to reshape or redact payloads.
+- **Two subscription sources**: admin-managed records and hard-coded code subscriptions, merged at delivery time.
+- **Delivery modes**: queued through Payload jobs (retries, timeouts) or inline; `auto` detects whether a runner exists.
+- **HMAC-SHA256 signing** with reveal-once secrets and id/event/timestamp headers on every request.
+- **Delivery log** with status, response code, duration, the exact body sent, and one-click redelivery.
+- **Jobs family interop**: installing `@10x-media/jobs` switches delivery to the queue automatically.
+- **Typed translations** with per-key overrides via `@10x-media/webhooks/i18n`.
 
-## Installation
+## Quick start
 
 ```bash
 pnpm add @10x-media/webhooks
 ```
 
-## Usage
-
 ```ts
+// payload.config.ts
 import { buildConfig } from 'payload'
 import { webhooks } from '@10x-media/webhooks'
 
@@ -36,150 +39,19 @@ export default buildConfig({
 })
 ```
 
-That is the minimum config. The plugin adds two collections to your admin panel:
-
-- **Webhook Subscriptions** -- admins create endpoint records (URL, events, optional secret).
-- **Webhook Deliveries** -- an append-only log with status, response code, and a redeliver button.
-
-## Options
-
-| Option | Type | Default | Description |
-|---|---|---|---|
-| `disabled` | `boolean` | `false` | When `true`, returns the config unchanged. |
-| `collections` | `Record<string, true \| CollectionWebhookConfig>` | `{}` | Collections that emit webhook events. |
-| `subscriptions` | `CodeSubscription[]` | `[]` | Hard-coded subscriptions (no admin record needed). |
-| `delivery` | `DeliveryMode \| DeliveryOptions` | `'auto'` | How deliveries are executed. |
-| `subscriptionsCollection` | `{ slug?: string; hidden?: boolean }` | -- | Override the subscriptions collection slug or hide it from the admin panel. |
-| `deliveriesLog` | `{ slug?: string; hidden?: boolean }` | -- | Override the deliveries collection slug or hide it from the admin panel. |
-
-### `CollectionWebhookConfig`
-
-```ts
-type CollectionWebhookConfig = {
-  operations?: ('create' | 'update' | 'delete')[]
-  includePreviousData?: boolean
-  transform?: (args: {
-    doc: Record<string, unknown>
-    previousDoc?: Record<string, unknown>
-    operation: 'create' | 'update' | 'delete'
-    req: PayloadRequest
-  }) => unknown
-}
-```
-
-`true` is shorthand for all three operations with no transform.
-
-`transform` lets you redact fields or reshape the payload before it is sent. Return `undefined` to suppress delivery for that document.
-
-`includePreviousData` adds a `previousData` key to the body on `update` events.
-
-### Delivery modes
-
-| Mode | Behavior |
-|---|---|
-| `'auto'` (default) | Queued when `config.jobs.autoRun` is set or `@10x-media/jobs` is installed; inline otherwise. |
-| `'queue'` | Always enqueued as a Payload job. A worker must run `payload.jobs.run()`. |
-| `'inline'` | Awaited in the `afterChange`/`afterDelete` hook. Simple but adds latency to every write. |
-
-Pass a full `DeliveryOptions` object to tune the queue and timeout:
-
-```ts
-webhooks({
-  collections: { posts: true },
-  delivery: {
-    mode: 'queue',
-    timeoutMs: 5_000,
-    retries: 3,
-    queue: 'webhooks',
-  },
-})
-```
-
-Defaults: `timeoutMs: 10000`, `retries: 4`, `queue: 'default'`.
-
-### Code subscriptions
-
-Register subscriptions in code when you do not want them managed through the admin panel:
-
-```ts
-webhooks({
-  collections: { orders: true },
-  subscriptions: [
-    {
-      id: 'my-crm',
-      url: 'https://crm.example.com/hooks/orders',
-      events: ['orders.created', 'orders.updated'],
-      secret: process.env.WEBHOOK_SECRET,
-    },
-  ],
-})
-```
-
-Code subscriptions are merged with admin-managed ones at delivery time.
-
-## Webhook payload
-
-Every delivery POSTs a JSON body:
-
-```json
-{
-  "id": "<delivery-id>",
-  "event": "posts.created",
-  "collection": "posts",
-  "operation": "create",
-  "occurredAt": "2025-01-01T00:00:00.000Z",
-  "data": { ... }
-}
-```
-
-`previousData` is included on `update` events when `includePreviousData: true`.
-
-## Signature verification
-
-When a subscription has a `secret`, each request carries an `X-Webhook-Signature` header:
-
-```
-X-Webhook-Signature: v1=<hex>
-```
-
-The signature is HMAC-SHA256 over `${timestamp}.${rawBody}`, where `timestamp` is the Unix second from the `X-Webhook-Timestamp` header.
-
-Verify in your receiver:
-
-```ts
-import { createHmac } from 'node:crypto'
-
-function verify(secret: string, timestamp: string, rawBody: string, signature: string): boolean {
-  const expected = createHmac('sha256', secret)
-    .update(`${timestamp}.${rawBody}`)
-    .digest('hex')
-  return signature === `v1=${expected}`
-}
-```
-
-Additional headers sent on every request: `X-Webhook-Id`, `X-Webhook-Event`, `X-Webhook-Timestamp`, `User-Agent: 10x-media-webhooks`. Subscriptions can inject extra headers via the admin panel's **Headers** array field.
-
-## Admin panel
-
-The plugin adds a **Webhooks** group with two collections.
-
-**Webhook Subscriptions**: create and manage endpoint records. A random 48-character hex secret is auto-generated on create and shown in full **exactly once** on that create response -- copy it to your receiver then. On every later read it is masked (`__redacted__`); the raw value is still used internally to sign deliveries but is never returned through the API or admin again. Rotate by deleting and recreating the record.
-
-**Webhook Deliveries**: an append-only delivery log. Each row shows the event, subscription, status, HTTP response code, and a **Redeliver** button that replays the original payload to the original URL. Access requires a logged-in admin.
-
-## Composing with `@10x-media/jobs`
-
-When `@10x-media/jobs` is installed, `delivery` mode auto-resolves to `'queue'` and the delivery task runs under the jobs worker. No extra config is needed -- the plugin detects the sibling plugin automatically.
-
-## Composing with `@10x-media/automations`
+Then create a subscription in the admin (**Webhooks** group), copy its reveal-once secret to your receiver, and write to an opted-in collection.
 
-When `@10x-media/automations` is installed, the plugin contributes a `webhook` trigger slug to the automations catalog, reserving it for future inbound-webhook support. This plugin is outbound-only today and does not yet fire that trigger -- the contribution simply registers the slug so a later inbound phase can use it. No extra config is needed.
+## Documentation
 
-## Security
+Full documentation at [docs.10xmedia.de](https://docs.10xmedia.de/webhooks):
 
-- **Signing secrets are reveal-once.** A subscription's secret is shown in full only on the create response and masked (`__redacted__`) on every read thereafter; the raw value is used internally to sign deliveries and is never returned via REST, GraphQL, or the admin again. It is currently stored unencrypted at rest -- encryption-at-rest is planned.
-- **Outbound requests target operator-supplied URLs (SSRF).** Deliveries POST to whatever URL a subscription specifies, including private or internal hosts. Subscriptions are created by authenticated admins, so treat that as a trusted operation; if your admins are not fully trusted, restrict outbound egress at the network layer or front your receivers with an allowlist.
-- **Admin access is the trust boundary.** Both collections require a logged-in user, and the redeliver endpoint authorizes by login only (any authenticated user may redeliver any delivery). Tighten the collections with your own access control if you need finer-grained permissions.
+- [Overview](https://docs.10xmedia.de/webhooks)
+- [Quick start](https://docs.10xmedia.de/webhooks/quick-start)
+- [Subscriptions](https://docs.10xmedia.de/webhooks/subscriptions)
+- [Deliveries](https://docs.10xmedia.de/webhooks/deliveries)
+- [Signing and secrets](https://docs.10xmedia.de/webhooks/signing)
+- [Security model](https://docs.10xmedia.de/webhooks/security)
+- [i18n](https://docs.10xmedia.de/webhooks/i18n)
 
 ## License
 

package/dist/collections/deliveries.js

@@ -0,0 +1,99 @@
+import { keys } from "../translations/keys.js";
+import { ADMIN_GROUP } from "../constants.js";
+import { labelForKey } from "../translations/server.js";
+//#region src/collections/deliveries.ts
+const STATUS_CELL = "@10x-media/webhooks/client#DeliveryStatusCell";
+const loggedIn = ({ req }) => Boolean(req.user);
+/** Runner-written delivery audit log; read-only in admin, server writes use overrideAccess. */
+const buildDeliveriesCollection = (args) => ({
+	slug: args.slug,
+	labels: {
+		singular: labelForKey(keys.deliverySingular),
+		plural: labelForKey(keys.deliveryPlural)
+	},
+	admin: {
+		group: ADMIN_GROUP,
+		useAsTitle: "event",
+		defaultColumns: [
+			"event",
+			"endpoint",
+			"status",
+			"responseStatus",
+			"attempt",
+			"createdAt"
+		],
+		hidden: args.hidden
+	},
+	access: {
+		read: loggedIn,
+		create: () => false,
+		update: () => false,
+		delete: loggedIn
+	},
+	fields: [
+		{
+			name: "subscriptionId",
+			type: "text",
+			index: true
+		},
+		{
+			name: "endpoint",
+			type: "text"
+		},
+		{
+			name: "event",
+			type: "text",
+			index: true
+		},
+		{
+			name: "status",
+			type: "select",
+			defaultValue: "pending",
+			options: [
+				"pending",
+				"success",
+				"failed",
+				"dead"
+			],
+			admin: { components: { Cell: STATUS_CELL } }
+		},
+		{
+			name: "attempt",
+			type: "number",
+			defaultValue: 0
+		},
+		{
+			name: "responseStatus",
+			type: "number"
+		},
+		{
+			name: "responseBody",
+			type: "textarea"
+		},
+		{
+			name: "error",
+			type: "textarea"
+		},
+		{
+			name: "durationMs",
+			type: "number"
+		},
+		{
+			name: "jobId",
+			type: "text"
+		},
+		{
+			name: "payload",
+			type: "json"
+		},
+		{
+			name: "redeliver",
+			type: "ui",
+			admin: { components: { Field: "@10x-media/webhooks/client#RedeliverButton" } }
+		}
+	]
+});
+//#endregion
+export { buildDeliveriesCollection };
+
+//# sourceMappingURL=deliveries.js.map

package/dist/collections/deliveries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveries.js","names":[],"sources":["../../src/collections/deliveries.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload'\n\nimport { ADMIN_GROUP } from '../constants'\nimport { keys } from '../translations/keys'\nimport { labelForKey } from '../translations/server'\n\nconst STATUS_CELL = '@10x-media/webhooks/client#DeliveryStatusCell'\n\nconst loggedIn = ({ req }: { req: { user?: unknown } }) => Boolean(req.user)\n\n/** Runner-written delivery audit log; read-only in admin, server writes use overrideAccess. */\nexport const buildDeliveriesCollection = (args: {\n\tslug: string\n\thidden: boolean\n}): CollectionConfig => ({\n\tslug: args.slug,\n\tlabels: {\n\t\tsingular: labelForKey(keys.deliverySingular),\n\t\tplural: labelForKey(keys.deliveryPlural),\n\t},\n\tadmin: {\n\t\tgroup: ADMIN_GROUP,\n\t\tuseAsTitle: 'event',\n\t\tdefaultColumns: ['event', 'endpoint', 'status', 'responseStatus', 'attempt', 'createdAt'],\n\t\thidden: args.hidden,\n\t},\n\taccess: { read: loggedIn, create: () => false, update: () => false, delete: loggedIn },\n\tfields: [\n\t\t{ name: 'subscriptionId', type: 'text', index: true },\n\t\t{ name: 'endpoint', type: 'text' },\n\t\t{ name: 'event', type: 'text', index: true },\n\t\t{\n\t\t\tname: 'status',\n\t\t\ttype: 'select',\n\t\t\tdefaultValue: 'pending',\n\t\t\toptions: ['pending', 'success', 'failed', 'dead'],\n\t\t\tadmin: { components: { Cell: STATUS_CELL } },\n\t\t},\n\t\t{ name: 'attempt', type: 'number', defaultValue: 0 },\n\t\t{ name: 'responseStatus', type: 'number' },\n\t\t{ name: 'responseBody', type: 'textarea' },\n\t\t{ name: 'error', type: 'textarea' },\n\t\t{ name: 'durationMs', type: 'number' },\n\t\t{ name: 'jobId', type: 'text' },\n\t\t{ name: 'payload', type: 'json' },\n\t\t{\n\t\t\tname: 'redeliver',\n\t\t\ttype: 'ui',\n\t\t\tadmin: { components: { Field: '@10x-media/webhooks/client#RedeliverButton' } },\n\t\t},\n\t],\n})\n"],"mappings":";;;;AAMA,MAAM,cAAc;AAEpB,MAAM,YAAY,EAAE,UAAuC,QAAQ,IAAI,IAAI;;AAG3E,MAAa,6BAA6B,UAGjB;CACxB,MAAM,KAAK;CACX,QAAQ;EACP,UAAU,YAAY,KAAK,gBAAgB;EAC3C,QAAQ,YAAY,KAAK,cAAc;CACxC;CACA,OAAO;EACN,OAAO;EACP,YAAY;EACZ,gBAAgB;GAAC;GAAS;GAAY;GAAU;GAAkB;GAAW;EAAW;EACxF,QAAQ,KAAK;CACd;CACA,QAAQ;EAAE,MAAM;EAAU,cAAc;EAAO,cAAc;EAAO,QAAQ;CAAS;CACrF,QAAQ;EACP;GAAE,MAAM;GAAkB,MAAM;GAAQ,OAAO;EAAK;EACpD;GAAE,MAAM;GAAY,MAAM;EAAO;EACjC;GAAE,MAAM;GAAS,MAAM;GAAQ,OAAO;EAAK;EAC3C;GACC,MAAM;GACN,MAAM;GACN,cAAc;GACd,SAAS;IAAC;IAAW;IAAW;IAAU;GAAM;GAChD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,EAAE;EAC5C;EACA;GAAE,MAAM;GAAW,MAAM;GAAU,cAAc;EAAE;EACnD;GAAE,MAAM;GAAkB,MAAM;EAAS;EACzC;GAAE,MAAM;GAAgB,MAAM;EAAW;EACzC;GAAE,MAAM;GAAS,MAAM;EAAW;EAClC;GAAE,MAAM;GAAc,MAAM;EAAS;EACrC;GAAE,MAAM;GAAS,MAAM;EAAO;EAC9B;GAAE,MAAM;GAAW,MAAM;EAAO;EAChC;GACC,MAAM;GACN,MAAM;GACN,OAAO,EAAE,YAAY,EAAE,OAAO,6CAA6C,EAAE;EAC9E;CACD;AACD"}

package/dist/collections/subscriptions.js

@@ -0,0 +1,123 @@
+import { keys } from "../translations/keys.js";
+import { ADMIN_GROUP, SECRET_MASK, SECRET_REVEAL_CONTEXT } from "../constants.js";
+import { labelForKey } from "../translations/server.js";
+import { randomBytes } from "node:crypto";
+//#region src/collections/subscriptions.ts
+const generateSecret = ({ data, operation, req }) => {
+	if (operation === "create" && !data.secret) {
+		req.context[SECRET_REVEAL_CONTEXT.once] = true;
+		return {
+			...data,
+			secret: randomBytes(24).toString("hex")
+		};
+	}
+	return data;
+};
+/**
+* The DB always stores the raw secret; this mask only shapes read output. It runs even under
+* `overrideAccess` (field hooks are not gated by access), so the raw value reaches a reader only
+* when a reveal flag is set: `once` on the create response, `forSigning` on internal delivery reads.
+*/
+const maskSecret = ({ value, req }) => {
+	if (req.context[SECRET_REVEAL_CONTEXT.forSigning] || req.context[SECRET_REVEAL_CONTEXT.once]) return value;
+	return value == null ? value : SECRET_MASK;
+};
+const clearRevealOnce = ({ doc, req }) => {
+	req.context[SECRET_REVEAL_CONTEXT.once] = false;
+	return doc;
+};
+const loggedIn = ({ req }) => Boolean(req.user);
+/** Admin-managed subscriptions collection; `events` options come from the catalog. */
+const buildSubscriptionsCollection = (args) => ({
+	slug: args.slug,
+	labels: {
+		singular: labelForKey(keys.subscriptionSingular),
+		plural: labelForKey(keys.subscriptionPlural)
+	},
+	admin: {
+		group: ADMIN_GROUP,
+		useAsTitle: "name",
+		defaultColumns: [
+			"name",
+			"url",
+			"enabled"
+		],
+		hidden: args.hidden
+	},
+	access: {
+		read: loggedIn,
+		create: loggedIn,
+		update: loggedIn,
+		delete: loggedIn
+	},
+	hooks: {
+		beforeChange: [generateSecret],
+		afterChange: [clearRevealOnce]
+	},
+	fields: [
+		{
+			name: "name",
+			type: "text",
+			required: true,
+			label: labelForKey(keys.fieldName)
+		},
+		{
+			name: "url",
+			type: "text",
+			required: true,
+			label: labelForKey(keys.fieldUrl)
+		},
+		{
+			name: "enabled",
+			type: "checkbox",
+			defaultValue: true,
+			label: labelForKey(keys.fieldEnabled)
+		},
+		{
+			name: "events",
+			type: "select",
+			hasMany: true,
+			label: labelForKey(keys.fieldEvents),
+			options: args.events.length ? args.events.map((e) => ({
+				label: e,
+				value: e
+			})) : [{
+				label: "(none)",
+				value: "__none__"
+			}]
+		},
+		{
+			name: "secret",
+			type: "text",
+			label: labelForKey(keys.fieldSecret),
+			admin: {
+				readOnly: true,
+				description: labelForKey(keys.fieldSecretHelp)
+			},
+			access: { update: () => false },
+			hooks: { afterRead: [maskSecret] }
+		},
+		{
+			name: "headers",
+			type: "array",
+			label: labelForKey(keys.fieldHeaders),
+			fields: [{
+				name: "key",
+				type: "text",
+				required: true
+			}, {
+				name: "value",
+				type: "text"
+			}]
+		},
+		{
+			name: "description",
+			type: "textarea",
+			label: labelForKey(keys.fieldDescription)
+		}
+	]
+});
+//#endregion
+export { buildSubscriptionsCollection };
+
+//# sourceMappingURL=subscriptions.js.map

package/dist/collections/subscriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptions.js","names":[],"sources":["../../src/collections/subscriptions.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto'\nimport type {\n\tCollectionAfterChangeHook,\n\tCollectionBeforeChangeHook,\n\tCollectionConfig,\n\tFieldHook,\n} from 'payload'\n\nimport { ADMIN_GROUP, SECRET_MASK, SECRET_REVEAL_CONTEXT } from '../constants'\nimport { keys } from '../translations/keys'\nimport { labelForKey } from '../translations/server'\n\nconst generateSecret: CollectionBeforeChangeHook = ({ data, operation, req }) => {\n\tif (operation === 'create' && !data.secret) {\n\t\treq.context[SECRET_REVEAL_CONTEXT.once] = true\n\t\treturn { ...data, secret: randomBytes(24).toString('hex') }\n\t}\n\treturn data\n}\n\n/**\n * The DB always stores the raw secret; this mask only shapes read output. It runs even under\n * `overrideAccess` (field hooks are not gated by access), so the raw value reaches a reader only\n * when a reveal flag is set: `once` on the create response, `forSigning` on internal delivery reads.\n */\nconst maskSecret: FieldHook = ({ value, req }) => {\n\tif (req.context[SECRET_REVEAL_CONTEXT.forSigning] || req.context[SECRET_REVEAL_CONTEXT.once]) {\n\t\treturn value\n\t}\n\treturn value == null ? value : SECRET_MASK\n}\n\nconst clearRevealOnce: CollectionAfterChangeHook = ({ doc, req }) => {\n\treq.context[SECRET_REVEAL_CONTEXT.once] = false\n\treturn doc\n}\n\nconst loggedIn = ({ req }: { req: { user?: unknown } }) => Boolean(req.user)\n\n/** Admin-managed subscriptions collection; `events` options come from the catalog. */\nexport const buildSubscriptionsCollection = (args: {\n\tslug: string\n\tevents: string[]\n\thidden: boolean\n}): CollectionConfig => ({\n\tslug: args.slug,\n\tlabels: {\n\t\tsingular: labelForKey(keys.subscriptionSingular),\n\t\tplural: labelForKey(keys.subscriptionPlural),\n\t},\n\tadmin: {\n\t\tgroup: ADMIN_GROUP,\n\t\tuseAsTitle: 'name',\n\t\tdefaultColumns: ['name', 'url', 'enabled'],\n\t\thidden: args.hidden,\n\t},\n\taccess: { read: loggedIn, create: loggedIn, update: loggedIn, delete: loggedIn },\n\thooks: { beforeChange: [generateSecret], afterChange: [clearRevealOnce] },\n\tfields: [\n\t\t{ name: 'name', type: 'text', required: true, label: labelForKey(keys.fieldName) },\n\t\t{ name: 'url', type: 'text', required: true, label: labelForKey(keys.fieldUrl) },\n\t\t{\n\t\t\tname: 'enabled',\n\t\t\ttype: 'checkbox',\n\t\t\tdefaultValue: true,\n\t\t\tlabel: labelForKey(keys.fieldEnabled),\n\t\t},\n\t\t{\n\t\t\tname: 'events',\n\t\t\ttype: 'select',\n\t\t\thasMany: true,\n\t\t\tlabel: labelForKey(keys.fieldEvents),\n\t\t\toptions: args.events.length\n\t\t\t\t? args.events.map((e) => ({ label: e, value: e }))\n\t\t\t\t: [{ label: '(none)', value: '__none__' }],\n\t\t},\n\t\t{\n\t\t\tname: 'secret',\n\t\t\ttype: 'text',\n\t\t\tlabel: labelForKey(keys.fieldSecret),\n\t\t\tadmin: { readOnly: true, description: labelForKey(keys.fieldSecretHelp) },\n\t\t\taccess: { update: () => false },\n\t\t\thooks: { afterRead: [maskSecret] },\n\t\t},\n\t\t{\n\t\t\tname: 'headers',\n\t\t\ttype: 'array',\n\t\t\tlabel: labelForKey(keys.fieldHeaders),\n\t\t\tfields: [\n\t\t\t\t{ name: 'key', type: 'text', required: true },\n\t\t\t\t{ name: 'value', type: 'text' },\n\t\t\t],\n\t\t},\n\t\t{ name: 'description', type: 'textarea', label: labelForKey(keys.fieldDescription) },\n\t],\n})\n"],"mappings":";;;;;AAYA,MAAM,kBAA8C,EAAE,MAAM,WAAW,UAAU;CAChF,IAAI,cAAc,YAAY,CAAC,KAAK,QAAQ;EAC3C,IAAI,QAAQ,sBAAsB,QAAQ;EAC1C,OAAO;GAAE,GAAG;GAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK;EAAE;CAC3D;CACA,OAAO;AACR;;;;;;AAOA,MAAM,cAAyB,EAAE,OAAO,UAAU;CACjD,IAAI,IAAI,QAAQ,sBAAsB,eAAe,IAAI,QAAQ,sBAAsB,OACtF,OAAO;CAER,OAAO,SAAS,OAAO,QAAQ;AAChC;AAEA,MAAM,mBAA8C,EAAE,KAAK,UAAU;CACpE,IAAI,QAAQ,sBAAsB,QAAQ;CAC1C,OAAO;AACR;AAEA,MAAM,YAAY,EAAE,UAAuC,QAAQ,IAAI,IAAI;;AAG3E,MAAa,gCAAgC,UAIpB;CACxB,MAAM,KAAK;CACX,QAAQ;EACP,UAAU,YAAY,KAAK,oBAAoB;EAC/C,QAAQ,YAAY,KAAK,kBAAkB;CAC5C;CACA,OAAO;EACN,OAAO;EACP,YAAY;EACZ,gBAAgB;GAAC;GAAQ;GAAO;EAAS;EACzC,QAAQ,KAAK;CACd;CACA,QAAQ;EAAE,MAAM;EAAU,QAAQ;EAAU,QAAQ;EAAU,QAAQ;CAAS;CAC/E,OAAO;EAAE,cAAc,CAAC,cAAc;EAAG,aAAa,CAAC,eAAe;CAAE;CACxE,QAAQ;EACP;GAAE,MAAM;GAAQ,MAAM;GAAQ,UAAU;GAAM,OAAO,YAAY,KAAK,SAAS;EAAE;EACjF;GAAE,MAAM;GAAO,MAAM;GAAQ,UAAU;GAAM,OAAO,YAAY,KAAK,QAAQ;EAAE;EAC/E;GACC,MAAM;GACN,MAAM;GACN,cAAc;GACd,OAAO,YAAY,KAAK,YAAY;EACrC;EACA;GACC,MAAM;GACN,MAAM;GACN,SAAS;GACT,OAAO,YAAY,KAAK,WAAW;GACnC,SAAS,KAAK,OAAO,SAClB,KAAK,OAAO,KAAK,OAAO;IAAE,OAAO;IAAG,OAAO;GAAE,EAAE,IAC/C,CAAC;IAAE,OAAO;IAAU,OAAO;GAAW,CAAC;EAC3C;EACA;GACC,MAAM;GACN,MAAM;GACN,OAAO,YAAY,KAAK,WAAW;GACnC,OAAO;IAAE,UAAU;IAAM,aAAa,YAAY,KAAK,eAAe;GAAE;GACxE,QAAQ,EAAE,cAAc,MAAM;GAC9B,OAAO,EAAE,WAAW,CAAC,UAAU,EAAE;EAClC;EACA;GACC,MAAM;GACN,MAAM;GACN,OAAO,YAAY,KAAK,YAAY;GACpC,QAAQ,CACP;IAAE,MAAM;IAAO,MAAM;IAAQ,UAAU;GAAK,GAC5C;IAAE,MAAM;IAAS,MAAM;GAAO,CAC/B;EACD;EACA;GAAE,MAAM;GAAe,MAAM;GAAY,OAAO,YAAY,KAAK,gBAAgB;EAAE;CACpF;AACD"}

package/dist/constants.js

@@ -0,0 +1,29 @@
+//#region src/constants.ts
+const DEFAULT_SUBSCRIPTIONS_SLUG = "webhook-subscriptions";
+const DEFAULT_DELIVERIES_SLUG = "webhook-deliveries";
+const ADMIN_GROUP = "Webhooks";
+const WEBHOOK_DELIVER_TASK = "webhooksDeliver";
+const DEFAULT_DELIVERY_QUEUE = "default";
+const DEFAULT_TIMEOUT_MS = 1e4;
+/** Placeholder returned for the signing secret on every read after its single create reveal. */
+const SECRET_MASK = "__redacted__";
+/**
+* `req.context` flags that opt a subscription read into seeing the raw signing secret.
+* The field `afterRead` mask runs even under `overrideAccess`, so internal signing reads
+* must set `revealSecretForSigning` to recover the raw value; `revealSecretOnce` is set by
+* the create `beforeChange` so the create response shows the secret exactly once.
+*/
+const SECRET_REVEAL_CONTEXT = {
+	forSigning: "webhooksRevealSecretForSigning",
+	once: "webhooksRevealSecretOnce"
+};
+const RESERVED_SLUGS = [
+	"payload-jobs",
+	"payload-locks",
+	"payload-preferences",
+	"payload-migrations"
+];
+//#endregion
+export { ADMIN_GROUP, DEFAULT_DELIVERIES_SLUG, DEFAULT_DELIVERY_QUEUE, DEFAULT_SUBSCRIPTIONS_SLUG, DEFAULT_TIMEOUT_MS, RESERVED_SLUGS, SECRET_MASK, SECRET_REVEAL_CONTEXT, WEBHOOK_DELIVER_TASK };
+
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","names":[],"sources":["../src/constants.ts"],"sourcesContent":["export const DEFAULT_SUBSCRIPTIONS_SLUG = 'webhook-subscriptions'\nexport const DEFAULT_DELIVERIES_SLUG = 'webhook-deliveries'\nexport const ADMIN_GROUP = 'Webhooks'\nexport const WEBHOOK_DELIVER_TASK = 'webhooksDeliver'\nexport const DEFAULT_DELIVERY_QUEUE = 'default'\nexport const DEFAULT_TIMEOUT_MS = 10_000\nexport const DEFAULT_RETRIES = 4\n\n/** Placeholder returned for the signing secret on every read after its single create reveal. */\nexport const SECRET_MASK = '__redacted__'\n\n/**\n * `req.context` flags that opt a subscription read into seeing the raw signing secret.\n * The field `afterRead` mask runs even under `overrideAccess`, so internal signing reads\n * must set `revealSecretForSigning` to recover the raw value; `revealSecretOnce` is set by\n * the create `beforeChange` so the create response shows the secret exactly once.\n */\nexport const SECRET_REVEAL_CONTEXT = {\n\tforSigning: 'webhooksRevealSecretForSigning',\n\tonce: 'webhooksRevealSecretOnce',\n} as const\nexport const RESERVED_SLUGS = [\n\t'payload-jobs',\n\t'payload-locks',\n\t'payload-preferences',\n\t'payload-migrations',\n] as const\n"],"mappings":";AAAA,MAAa,6BAA6B;AAC1C,MAAa,0BAA0B;AACvC,MAAa,cAAc;AAC3B,MAAa,uBAAuB;AACpC,MAAa,yBAAyB;AACtC,MAAa,qBAAqB;;AAIlC,MAAa,cAAc;;;;;;;AAQ3B,MAAa,wBAAwB;CACpC,YAAY;CACZ,MAAM;AACP;AACA,MAAa,iBAAiB;CAC7B;CACA;CACA;CACA;AACD"}

package/dist/delivery/DeliveryStatusCell.d.ts

@@ -0,0 +1,10 @@
+import { DefaultCellComponentProps } from "payload";
+
+//#region src/delivery/DeliveryStatusCell.d.ts
+/** List cell rendering a delivery's status as a native Payload Pill. */
+declare const DeliveryStatusCell: ({
+  cellData
+}: DefaultCellComponentProps) => import("react/jsx-runtime").JSX.Element;
+//#endregion
+export { DeliveryStatusCell };
+//# sourceMappingURL=DeliveryStatusCell.d.ts.map

package/dist/delivery/DeliveryStatusCell.js

@@ -0,0 +1,42 @@
+"use client";
+import { keys } from "../translations/keys.js";
+import { useTranslation as useTranslation$1 } from "../translations/useTranslation.js";
+import { Pill } from "@payloadcms/ui";
+import { jsx } from "react/jsx-runtime";
+//#region src/delivery/DeliveryStatusCell.tsx
+const META = {
+	pending: {
+		labelKey: keys.statusPending,
+		pillStyle: "light"
+	},
+	success: {
+		labelKey: keys.statusSuccess,
+		pillStyle: "success"
+	},
+	failed: {
+		labelKey: keys.statusFailed,
+		pillStyle: "warning"
+	},
+	dead: {
+		labelKey: keys.statusDead,
+		pillStyle: "error"
+	}
+};
+const FALLBACK = {
+	labelKey: keys.statusPending,
+	pillStyle: "light"
+};
+/** List cell rendering a delivery's status as a native Payload Pill. */
+const DeliveryStatusCell = ({ cellData }) => {
+	const { t } = useTranslation$1();
+	const meta = META[String(cellData)] ?? FALLBACK;
+	return /* @__PURE__ */ jsx(Pill, {
+		pillStyle: meta.pillStyle,
+		size: "small",
+		children: t(meta.labelKey)
+	});
+};
+//#endregion
+export { DeliveryStatusCell };
+
+//# sourceMappingURL=DeliveryStatusCell.js.map

package/dist/delivery/DeliveryStatusCell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeliveryStatusCell.js","names":["useTranslation"],"sources":["../../src/delivery/DeliveryStatusCell.tsx"],"sourcesContent":["'use client'\n\nimport { Pill } from '@payloadcms/ui'\nimport type { DefaultCellComponentProps } from 'payload'\n\nimport { keys, type TranslationKey } from '../translations/keys'\nimport { useTranslation } from '../translations/useTranslation'\n\ntype MetaEntry = { labelKey: TranslationKey; pillStyle: 'error' | 'light' | 'success' | 'warning' }\n\nconst META: Record<string, MetaEntry> = {\n\tpending: { labelKey: keys.statusPending, pillStyle: 'light' },\n\tsuccess: { labelKey: keys.statusSuccess, pillStyle: 'success' },\n\tfailed: { labelKey: keys.statusFailed, pillStyle: 'warning' },\n\tdead: { labelKey: keys.statusDead, pillStyle: 'error' },\n}\n\nconst FALLBACK: MetaEntry = { labelKey: keys.statusPending, pillStyle: 'light' }\n\n/** List cell rendering a delivery's status as a native Payload Pill. */\nexport const DeliveryStatusCell = ({ cellData }: DefaultCellComponentProps) => {\n\tconst { t } = useTranslation()\n\tconst meta = META[String(cellData)] ?? FALLBACK\n\treturn (\n\t\t<Pill pillStyle={meta.pillStyle} size=\"small\">\n\t\t\t{t(meta.labelKey)}\n\t\t</Pill>\n\t)\n}\n"],"mappings":";;;;;;AAUA,MAAM,OAAkC;CACvC,SAAS;EAAE,UAAU,KAAK;EAAe,WAAW;CAAQ;CAC5D,SAAS;EAAE,UAAU,KAAK;EAAe,WAAW;CAAU;CAC9D,QAAQ;EAAE,UAAU,KAAK;EAAc,WAAW;CAAU;CAC5D,MAAM;EAAE,UAAU,KAAK;EAAY,WAAW;CAAQ;AACvD;AAEA,MAAM,WAAsB;CAAE,UAAU,KAAK;CAAe,WAAW;AAAQ;;AAG/E,MAAa,sBAAsB,EAAE,eAA0C;CAC9E,MAAM,EAAE,MAAMA,iBAAe;CAC7B,MAAM,OAAO,KAAK,OAAO,QAAQ,MAAM;CACvC,OACC,oBAAC,MAAD;EAAM,WAAW,KAAK;EAAW,MAAK;YACpC,EAAE,KAAK,QAAQ;CACX,CAAA;AAER"}

package/dist/delivery/RedeliverButton.d.ts

@@ -0,0 +1,6 @@
+//#region src/delivery/RedeliverButton.d.ts
+/** Doc-view action that POSTs to the deliveries redeliver endpoint. */
+declare const RedeliverButton: () => import("react/jsx-runtime").JSX.Element | null;
+//#endregion
+export { RedeliverButton };
+//# sourceMappingURL=RedeliverButton.d.ts.map

package/dist/delivery/RedeliverButton.js

@@ -0,0 +1,43 @@
+"use client";
+import { keys } from "../translations/keys.js";
+import { useTranslation as useTranslation$1 } from "../translations/useTranslation.js";
+import { Button, toast, useConfig, useDocumentInfo } from "@payloadcms/ui";
+import { jsx } from "react/jsx-runtime";
+import { useState } from "react";
+//#region src/delivery/RedeliverButton.tsx
+/** Doc-view action that POSTs to the deliveries redeliver endpoint. */
+const RedeliverButton = () => {
+	const { id, collectionSlug } = useDocumentInfo();
+	const { config } = useConfig();
+	const { t } = useTranslation$1();
+	const [busy, setBusy] = useState(false);
+	if (!id || !collectionSlug) return null;
+	const apiRoute = config.routes?.api ?? "/api";
+	const serverURL = config.serverURL ?? "";
+	const onClick = async () => {
+		setBusy(true);
+		try {
+			const res = await fetch(`${serverURL}${apiRoute}/${collectionSlug}/${encodeURIComponent(String(id))}/redeliver`, {
+				method: "POST",
+				credentials: "include"
+			});
+			if (!res.ok) throw new Error(String(res.status));
+			toast.success(t(keys.redeliverDone));
+		} catch {
+			toast.error(t(keys.redeliver));
+		} finally {
+			setBusy(false);
+		}
+	};
+	return /* @__PURE__ */ jsx(Button, {
+		buttonStyle: "secondary",
+		disabled: busy,
+		onClick,
+		size: "small",
+		children: t(keys.redeliver)
+	});
+};
+//#endregion
+export { RedeliverButton };
+
+//# sourceMappingURL=RedeliverButton.js.map

package/dist/delivery/RedeliverButton.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedeliverButton.js","names":["useTranslation"],"sources":["../../src/delivery/RedeliverButton.tsx"],"sourcesContent":["'use client'\n\nimport { Button, toast, useConfig, useDocumentInfo } from '@payloadcms/ui'\nimport { useState } from 'react'\n\nimport { keys } from '../translations/keys'\nimport { useTranslation } from '../translations/useTranslation'\n\n/** Doc-view action that POSTs to the deliveries redeliver endpoint. */\nexport const RedeliverButton = () => {\n\tconst { id, collectionSlug } = useDocumentInfo()\n\tconst { config } = useConfig()\n\tconst { t } = useTranslation()\n\tconst [busy, setBusy] = useState(false)\n\n\tif (!id || !collectionSlug) {\n\t\treturn null\n\t}\n\n\tconst apiRoute = config.routes?.api ?? '/api'\n\tconst serverURL = config.serverURL ?? ''\n\n\tconst onClick = async () => {\n\t\tsetBusy(true)\n\t\ttry {\n\t\t\tconst res = await fetch(\n\t\t\t\t`${serverURL}${apiRoute}/${collectionSlug}/${encodeURIComponent(String(id))}/redeliver`,\n\t\t\t\t{ method: 'POST', credentials: 'include' }\n\t\t\t)\n\t\t\tif (!res.ok) {\n\t\t\t\tthrow new Error(String(res.status))\n\t\t\t}\n\t\t\ttoast.success(t(keys.redeliverDone))\n\t\t} catch {\n\t\t\ttoast.error(t(keys.redeliver))\n\t\t} finally {\n\t\t\tsetBusy(false)\n\t\t}\n\t}\n\n\treturn (\n\t\t<Button buttonStyle=\"secondary\" disabled={busy} onClick={onClick} size=\"small\">\n\t\t\t{t(keys.redeliver)}\n\t\t</Button>\n\t)\n}\n"],"mappings":";;;;;;;;AASA,MAAa,wBAAwB;CACpC,MAAM,EAAE,IAAI,mBAAmB,gBAAgB;CAC/C,MAAM,EAAE,WAAW,UAAU;CAC7B,MAAM,EAAE,MAAMA,iBAAe;CAC7B,MAAM,CAAC,MAAM,WAAW,SAAS,KAAK;CAEtC,IAAI,CAAC,MAAM,CAAC,gBACX,OAAO;CAGR,MAAM,WAAW,OAAO,QAAQ,OAAO;CACvC,MAAM,YAAY,OAAO,aAAa;CAEtC,MAAM,UAAU,YAAY;EAC3B,QAAQ,IAAI;EACZ,IAAI;GACH,MAAM,MAAM,MAAM,MACjB,GAAG,YAAY,SAAS,GAAG,eAAe,GAAG,mBAAmB,OAAO,EAAE,CAAC,EAAE,aAC5E;IAAE,QAAQ;IAAQ,aAAa;GAAU,CAC1C;GACA,IAAI,CAAC,IAAI,IACR,MAAM,IAAI,MAAM,OAAO,IAAI,MAAM,CAAC;GAEnC,MAAM,QAAQ,EAAE,KAAK,aAAa,CAAC;EACpC,QAAQ;GACP,MAAM,MAAM,EAAE,KAAK,SAAS,CAAC;EAC9B,UAAU;GACT,QAAQ,KAAK;EACd;CACD;CAEA,OACC,oBAAC,QAAD;EAAQ,aAAY;EAAY,UAAU;EAAe;EAAS,MAAK;YACrE,EAAE,KAAK,SAAS;CACV,CAAA;AAEV"}

package/dist/delivery/buildPayload.js

@@ -0,0 +1,26 @@
+import { eventId } from "../events/eventTypes.js";
+//#region src/delivery/buildPayload.ts
+/** Build the outbound body, applying any per-collection transform/redaction. */
+const buildPayload = (args) => {
+	const { deliveryId, collection, operation, doc, previousDoc, occurredAt, config, req } = args;
+	const data = config?.transform ? config.transform({
+		doc,
+		previousDoc,
+		operation,
+		req
+	}) : doc;
+	const body = {
+		id: deliveryId,
+		event: eventId(collection, operation),
+		collection,
+		operation,
+		occurredAt,
+		data
+	};
+	if (operation === "update" && config?.includePreviousData && previousDoc) body.previousData = previousDoc;
+	return body;
+};
+//#endregion
+export { buildPayload };
+
+//# sourceMappingURL=buildPayload.js.map

package/dist/delivery/buildPayload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildPayload.js","names":[],"sources":["../../src/delivery/buildPayload.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { eventId } from '../events/eventTypes'\nimport type { CollectionWebhookConfig, WebhookOperation } from '../options'\n\n/** The JSON body POSTed to a subscriber. */\nexport type WebhookBody = {\n\tid: string\n\tevent: string\n\tcollection: string\n\toperation: WebhookOperation\n\toccurredAt: string\n\tdata: unknown\n\tpreviousData?: unknown\n}\n\n/** Build the outbound body, applying any per-collection transform/redaction. */\nexport const buildPayload = (args: {\n\tdeliveryId: string\n\tcollection: string\n\toperation: WebhookOperation\n\tdoc: Record<string, unknown>\n\tpreviousDoc?: Record<string, unknown>\n\toccurredAt: string\n\tconfig?: CollectionWebhookConfig\n\treq: PayloadRequest\n}): WebhookBody => {\n\tconst { deliveryId, collection, operation, doc, previousDoc, occurredAt, config, req } = args\n\tconst data = config?.transform ? config.transform({ doc, previousDoc, operation, req }) : doc\n\tconst body: WebhookBody = {\n\t\tid: deliveryId,\n\t\tevent: eventId(collection, operation),\n\t\tcollection,\n\t\toperation,\n\t\toccurredAt,\n\t\tdata,\n\t}\n\tif (operation === 'update' && config?.includePreviousData && previousDoc) {\n\t\tbody.previousData = previousDoc\n\t}\n\treturn body\n}\n"],"mappings":";;;AAiBA,MAAa,gBAAgB,SASV;CAClB,MAAM,EAAE,YAAY,YAAY,WAAW,KAAK,aAAa,YAAY,QAAQ,QAAQ;CACzF,MAAM,OAAO,QAAQ,YAAY,OAAO,UAAU;EAAE;EAAK;EAAa;EAAW;CAAI,CAAC,IAAI;CAC1F,MAAM,OAAoB;EACzB,IAAI;EACJ,OAAO,QAAQ,YAAY,SAAS;EACpC;EACA;EACA;EACA;CACD;CACA,IAAI,cAAc,YAAY,QAAQ,uBAAuB,aAC5D,KAAK,eAAe;CAErB,OAAO;AACR"}