@10x-media/webhooks 0.1.0-beta.0

package/dist/index.js

@@ -0,0 +1,849 @@
+import { t as keys } from "./keys-BdNiD3rC.js";
+import { t as translations } from "./translations-CnkwrCJ3.js";
+import { definePlugin } from "payload";
+import { deepMergeSimple } from "payload/shared";
+import { createHmac, randomBytes } from "node:crypto";
+//#region src/plugin/registerTranslations.ts
+/**
+* Merge this plugin's translations into the host config. A host value wins on
+* conflict (`deepMergeSimple` lets the second argument override), so projects can
+* override any string.
+*/
+const registerTranslations = (config) => {
+	config.i18n ??= {};
+	config.i18n.translations = deepMergeSimple(translations, config.i18n.translations ?? {});
+};
+const ADMIN_GROUP = "Webhooks";
+const WEBHOOK_DELIVER_TASK = "webhooksDeliver";
+/** Placeholder returned for the signing secret on every read after its single create reveal. */
+const SECRET_MASK = "__redacted__";
+/**
+* `req.context` flags that opt a subscription read into seeing the raw signing secret.
+* The field `afterRead` mask runs even under `overrideAccess`, so internal signing reads
+* must set `revealSecretForSigning` to recover the raw value; `revealSecretOnce` is set by
+* the create `beforeChange` so the create response shows the secret exactly once.
+*/
+const SECRET_REVEAL_CONTEXT = {
+	forSigning: "webhooksRevealSecretForSigning",
+	once: "webhooksRevealSecretOnce"
+};
+const RESERVED_SLUGS = [
+	"payload-jobs",
+	"payload-locks",
+	"payload-preferences",
+	"payload-migrations"
+];
+//#endregion
+//#region src/translations/server.ts
+/**
+* Adapt a Payload request `t` (typed to core keys only) so it also accepts this
+* plugin's keys. They are registered at config time and resolve at runtime; the
+* cast only widens the compile-time key domain.
+*/
+const asTranslate = (t) => t;
+/** A field `label`/`description` backed by a typed key, resolved per request. */
+const labelForKey = (key) => ({ t }) => asTranslate(t)(key);
+//#endregion
+//#region src/collections/deliveries.ts
+const STATUS_CELL = "@10x-media/webhooks/client#DeliveryStatusCell";
+const loggedIn$1 = ({ req }) => Boolean(req.user);
+/** Runner-written delivery audit log; read-only in admin, server writes use overrideAccess. */
+const buildDeliveriesCollection = (args) => ({
+	slug: args.slug,
+	labels: {
+		singular: labelForKey(keys.deliverySingular),
+		plural: labelForKey(keys.deliveryPlural)
+	},
+	admin: {
+		group: ADMIN_GROUP,
+		useAsTitle: "event",
+		defaultColumns: [
+			"event",
+			"endpoint",
+			"status",
+			"responseStatus",
+			"attempt",
+			"createdAt"
+		],
+		hidden: args.hidden
+	},
+	access: {
+		read: loggedIn$1,
+		create: () => false,
+		update: () => false,
+		delete: loggedIn$1
+	},
+	fields: [
+		{
+			name: "subscriptionId",
+			type: "text",
+			index: true
+		},
+		{
+			name: "endpoint",
+			type: "text"
+		},
+		{
+			name: "event",
+			type: "text",
+			index: true
+		},
+		{
+			name: "status",
+			type: "select",
+			defaultValue: "pending",
+			options: [
+				"pending",
+				"success",
+				"failed",
+				"dead"
+			],
+			admin: { components: { Cell: STATUS_CELL } }
+		},
+		{
+			name: "attempt",
+			type: "number",
+			defaultValue: 0
+		},
+		{
+			name: "responseStatus",
+			type: "number"
+		},
+		{
+			name: "responseBody",
+			type: "textarea"
+		},
+		{
+			name: "error",
+			type: "textarea"
+		},
+		{
+			name: "durationMs",
+			type: "number"
+		},
+		{
+			name: "jobId",
+			type: "text"
+		},
+		{
+			name: "payload",
+			type: "json"
+		},
+		{
+			name: "redeliver",
+			type: "ui",
+			admin: { components: { Field: "@10x-media/webhooks/client#RedeliverButton" } }
+		}
+	]
+});
+//#endregion
+//#region src/collections/subscriptions.ts
+const generateSecret = ({ data, operation, req }) => {
+	if (operation === "create" && !data.secret) {
+		req.context[SECRET_REVEAL_CONTEXT.once] = true;
+		return {
+			...data,
+			secret: randomBytes(24).toString("hex")
+		};
+	}
+	return data;
+};
+/**
+* The DB always stores the raw secret; this mask only shapes read output. It runs even under
+* `overrideAccess` (field hooks are not gated by access), so the raw value reaches a reader only
+* when a reveal flag is set: `once` on the create response, `forSigning` on internal delivery reads.
+*/
+const maskSecret = ({ value, req }) => {
+	if (req.context[SECRET_REVEAL_CONTEXT.forSigning] || req.context[SECRET_REVEAL_CONTEXT.once]) return value;
+	return value == null ? value : SECRET_MASK;
+};
+const clearRevealOnce = ({ doc, req }) => {
+	req.context[SECRET_REVEAL_CONTEXT.once] = false;
+	return doc;
+};
+const loggedIn = ({ req }) => Boolean(req.user);
+/** Admin-managed subscriptions collection; `events` options come from the catalog. */
+const buildSubscriptionsCollection = (args) => ({
+	slug: args.slug,
+	labels: {
+		singular: labelForKey(keys.subscriptionSingular),
+		plural: labelForKey(keys.subscriptionPlural)
+	},
+	admin: {
+		group: ADMIN_GROUP,
+		useAsTitle: "name",
+		defaultColumns: [
+			"name",
+			"url",
+			"enabled"
+		],
+		hidden: args.hidden
+	},
+	access: {
+		read: loggedIn,
+		create: loggedIn,
+		update: loggedIn,
+		delete: loggedIn
+	},
+	hooks: {
+		beforeChange: [generateSecret],
+		afterChange: [clearRevealOnce]
+	},
+	fields: [
+		{
+			name: "name",
+			type: "text",
+			required: true,
+			label: labelForKey(keys.fieldName)
+		},
+		{
+			name: "url",
+			type: "text",
+			required: true,
+			label: labelForKey(keys.fieldUrl)
+		},
+		{
+			name: "enabled",
+			type: "checkbox",
+			defaultValue: true,
+			label: labelForKey(keys.fieldEnabled)
+		},
+		{
+			name: "events",
+			type: "select",
+			hasMany: true,
+			label: labelForKey(keys.fieldEvents),
+			options: args.events.length ? args.events.map((e) => ({
+				label: e,
+				value: e
+			})) : [{
+				label: "(none)",
+				value: "__none__"
+			}]
+		},
+		{
+			name: "secret",
+			type: "text",
+			label: labelForKey(keys.fieldSecret),
+			admin: {
+				readOnly: true,
+				description: labelForKey(keys.fieldSecretHelp)
+			},
+			access: { update: () => false },
+			hooks: { afterRead: [maskSecret] }
+		},
+		{
+			name: "headers",
+			type: "array",
+			label: labelForKey(keys.fieldHeaders),
+			fields: [{
+				name: "key",
+				type: "text",
+				required: true
+			}, {
+				name: "value",
+				type: "text"
+			}]
+		},
+		{
+			name: "description",
+			type: "textarea",
+			label: labelForKey(keys.fieldDescription)
+		}
+	]
+});
+//#endregion
+//#region src/plugin/resolveSubscriptions.ts
+const rowHeaders = (headers) => {
+	if (!headers?.length) return;
+	const out = {};
+	for (const h of headers) if (h.key) out[h.key] = h.value ?? "";
+	return Object.keys(out).length ? out : void 0;
+};
+/** Normalize a subscriptions-collection document. */
+const fromCollectionRow = (row) => ({
+	id: String(row.id),
+	source: "collection",
+	url: row.url,
+	events: row.events ?? [],
+	secret: row.secret ?? void 0,
+	headers: rowHeaders(row.headers),
+	enabled: row.enabled !== false
+});
+/** Normalize a code-defined subscription. */
+const fromCodeSubscription = (sub) => ({
+	id: sub.id,
+	source: "code",
+	url: sub.url,
+	events: sub.events,
+	secret: sub.secret,
+	headers: sub.headers,
+	enabled: sub.enabled !== false
+});
+/** Enabled subscriptions listening for `event`. */
+const matchSubscriptions = (subs, event) => subs.filter((s) => s.enabled && s.events.includes(event));
+/** Look up one subscription by id (code first, then the collection). */
+const resolveSubscriptionById = async (args) => {
+	const code = args.codeSubscriptions.find((s) => s.id === args.id);
+	if (code) return fromCodeSubscription(code);
+	args.req.context[SECRET_REVEAL_CONTEXT.forSigning] = true;
+	try {
+		const row = (await args.payload.find({
+			collection: args.subscriptionsSlug,
+			where: { id: { equals: args.id } },
+			limit: 1,
+			depth: 0,
+			overrideAccess: true,
+			req: args.req
+		})).docs[0];
+		return row ? fromCollectionRow(row) : null;
+	} finally {
+		args.req.context[SECRET_REVEAL_CONTEXT.forSigning] = false;
+	}
+};
+//#endregion
+//#region src/delivery/deriveDeliveryStatus.ts
+/** Delivery status from the attempt outcome. `attempt` is 1-based; total tries = maxRetries + 1. */
+const deriveDeliveryStatus = (args) => {
+	if (args.ok) return "success";
+	return args.attempt > args.maxRetries ? "dead" : "failed";
+};
+//#endregion
+//#region src/delivery/deliver.ts
+/** Max response-body characters retained for the delivery log. */
+const MAX_RESPONSE_BODY = 2e3;
+/** POST `body` to `url` with a hard timeout; never throws. */
+const deliver = async (args) => {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), args.timeoutMs);
+	const start = Date.now();
+	try {
+		const res = await fetch(args.url, {
+			method: "POST",
+			headers: args.headers,
+			body: args.body,
+			signal: controller.signal
+		});
+		const text = await res.text();
+		return {
+			ok: res.ok,
+			responseStatus: res.status,
+			responseBody: text.slice(0, MAX_RESPONSE_BODY),
+			durationMs: Date.now() - start
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: err instanceof Error ? err.message : String(err),
+			durationMs: Date.now() - start
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+};
+//#endregion
+//#region src/delivery/sign.ts
+/** HMAC-SHA256 over `${timestamp}.${body}`, hex-encoded. */
+const signPayload = (args) => createHmac("sha256", args.secret).update(`${args.timestamp}.${args.body}`).digest("hex");
+/** Wrap a signature hex in the versioned header value. */
+const signatureHeader = (hex) => `v1=${hex}`;
+//#endregion
+//#region src/delivery/sendDelivery.ts
+const USER_AGENT = "10x-media-webhooks";
+/** Assemble headers (+ signature) and POST the body to the subscription's URL. */
+const sendDelivery = (args) => {
+	const { subscription, deliveryId, event, body, timeoutMs, now } = args;
+	const timestamp = Math.floor(now / 1e3);
+	const headers = {
+		"Content-Type": "application/json",
+		"User-Agent": USER_AGENT,
+		"X-Webhook-Id": deliveryId,
+		"X-Webhook-Event": event,
+		"X-Webhook-Timestamp": String(timestamp),
+		...subscription.headers
+	};
+	if (subscription.secret) headers["X-Webhook-Signature"] = signatureHeader(signPayload({
+		secret: subscription.secret,
+		timestamp,
+		body
+	}));
+	return deliver({
+		url: subscription.url,
+		body,
+		headers,
+		timeoutMs
+	});
+};
+//#endregion
+//#region src/delivery/deliverTask.ts
+/** Native Payload jobs task that performs one queued delivery attempt. */
+const buildDeliverTask = (deps) => ({
+	slug: WEBHOOK_DELIVER_TASK,
+	retries: deps.retries,
+	inputSchema: [{
+		name: "deliveryId",
+		type: "text",
+		required: true
+	}],
+	handler: async ({ input, job, req }) => {
+		const { payload } = req;
+		const deliveryId = input.deliveryId;
+		const delivery = await payload.findByID({
+			collection: deps.deliveriesSlug,
+			id: deliveryId,
+			overrideAccess: true,
+			req
+		});
+		const subscription = await resolveSubscriptionById({
+			id: String(delivery.subscriptionId),
+			codeSubscriptions: deps.codeSubscriptions,
+			subscriptionsSlug: deps.subscriptionsSlug,
+			payload,
+			req
+		});
+		if (!subscription) {
+			await payload.update({
+				collection: deps.deliveriesSlug,
+				id: deliveryId,
+				data: {
+					status: "dead",
+					error: "subscription not found"
+				},
+				overrideAccess: true,
+				req
+			});
+			return { output: {} };
+		}
+		const attempt = Number(job.totalTried ?? 0) + 1;
+		const result = await sendDelivery({
+			subscription,
+			deliveryId,
+			event: String(delivery.event),
+			body: JSON.stringify(delivery.payload),
+			timeoutMs: deps.timeoutMs,
+			now: Date.now()
+		});
+		const status = deriveDeliveryStatus({
+			ok: result.ok,
+			attempt,
+			maxRetries: deps.retries
+		});
+		await payload.update({
+			collection: deps.deliveriesSlug,
+			id: deliveryId,
+			data: {
+				status,
+				attempt,
+				responseStatus: result.responseStatus,
+				responseBody: result.responseBody,
+				error: result.error,
+				durationMs: result.durationMs,
+				jobId: String(job.id)
+			},
+			overrideAccess: true,
+			req
+		});
+		if (!result.ok) throw new Error(`Webhook delivery failed: ${result.error ?? result.responseStatus}`);
+		return { output: {} };
+	}
+});
+//#endregion
+//#region src/delivery/redeliver.ts
+/** Re-dispatch a past delivery from its stored payload, creating a new linked row. */
+const redeliverDelivery = async (args) => {
+	const { deps, deliveryId, payload, req } = args;
+	const original = await payload.findByID({
+		collection: deps.deliveriesSlug,
+		id: deliveryId,
+		overrideAccess: true,
+		req
+	});
+	const created = await payload.create({
+		collection: deps.deliveriesSlug,
+		data: {
+			subscriptionId: original.subscriptionId,
+			endpoint: original.endpoint,
+			event: original.event,
+			payload: original.payload,
+			status: "pending",
+			attempt: 0
+		},
+		overrideAccess: true,
+		req
+	});
+	const newId = String(created.id);
+	if (deps.mode === "queue") {
+		await payload.jobs.queue({
+			task: WEBHOOK_DELIVER_TASK,
+			input: { deliveryId: newId },
+			queue: deps.queue
+		});
+		return { id: newId };
+	}
+	const subscription = await resolveSubscriptionById({
+		id: String(original.subscriptionId),
+		codeSubscriptions: deps.codeSubscriptions,
+		subscriptionsSlug: deps.subscriptionsSlug,
+		payload,
+		req
+	});
+	if (!subscription) {
+		await payload.update({
+			collection: deps.deliveriesSlug,
+			id: newId,
+			data: {
+				status: "dead",
+				error: "subscription not found"
+			},
+			overrideAccess: true,
+			req
+		});
+		return { id: newId };
+	}
+	const result = await sendDelivery({
+		subscription,
+		deliveryId: newId,
+		event: String(original.event),
+		body: JSON.stringify(original.payload),
+		timeoutMs: deps.timeoutMs,
+		now: Date.now()
+	});
+	await payload.update({
+		collection: deps.deliveriesSlug,
+		id: newId,
+		data: {
+			status: result.ok ? "success" : "dead",
+			attempt: 1,
+			responseStatus: result.responseStatus,
+			responseBody: result.responseBody,
+			error: result.error,
+			durationMs: result.durationMs
+		},
+		overrideAccess: true,
+		req
+	});
+	return { id: newId };
+};
+//#endregion
+//#region src/events/eventTypes.ts
+const OP_TO_EVENT = {
+	create: "created",
+	update: "updated",
+	delete: "deleted"
+};
+/** Past-tense public event suffix for a Payload operation. */
+const operationToEvent = (op) => OP_TO_EVENT[op];
+/** Public event id, e.g. `posts.created`. */
+const eventId = (collectionSlug, op) => `${collectionSlug}.${operationToEvent(op)}`;
+/** Every event id the given opt-in collections can emit, in declaration order. */
+const eventCatalog = (collections) => {
+	const out = [];
+	for (const [slug, cfg] of Object.entries(collections)) {
+		const ops = (cfg === true ? void 0 : cfg.operations) ?? [
+			"create",
+			"update",
+			"delete"
+		];
+		for (const op of ops) out.push(eventId(slug, op));
+	}
+	return out;
+};
+//#endregion
+//#region src/delivery/buildPayload.ts
+/** Build the outbound body, applying any per-collection transform/redaction. */
+const buildPayload = (args) => {
+	const { deliveryId, collection, operation, doc, previousDoc, occurredAt, config, req } = args;
+	const data = config?.transform ? config.transform({
+		doc,
+		previousDoc,
+		operation,
+		req
+	}) : doc;
+	const body = {
+		id: deliveryId,
+		event: eventId(collection, operation),
+		collection,
+		operation,
+		occurredAt,
+		data
+	};
+	if (operation === "update" && config?.includePreviousData && previousDoc) body.previousData = previousDoc;
+	return body;
+};
+//#endregion
+//#region src/events/hooks.ts
+/** Max collection subscriptions scanned per event (pagination is a future enhancement). */
+const SUBSCRIPTION_SCAN_LIMIT = 1e3;
+const resolveListening = async (args) => {
+	const code = args.deps.codeSubscriptions.map(fromCodeSubscription);
+	args.req.context[SECRET_REVEAL_CONTEXT.forSigning] = true;
+	let res;
+	try {
+		res = await args.req.payload.find({
+			collection: args.deps.subscriptionsSlug,
+			where: { enabled: { not_equals: false } },
+			limit: SUBSCRIPTION_SCAN_LIMIT,
+			depth: 0,
+			overrideAccess: true,
+			req: args.req
+		});
+	} finally {
+		args.req.context[SECRET_REVEAL_CONTEXT.forSigning] = false;
+	}
+	if (res.docs.length >= SUBSCRIPTION_SCAN_LIMIT) args.req.payload.logger.warn(`@10x-media/webhooks: subscription scan hit the ${SUBSCRIPTION_SCAN_LIMIT} cap; some subscriptions may be skipped for ${args.event}.`);
+	const collection = res.docs.map((d) => fromCollectionRow(d));
+	return matchSubscriptions([...code, ...collection], args.event);
+};
+const dispatch = async (args) => {
+	const { deps, operation, doc, previousDoc, req } = args;
+	if (!deps.operations.includes(operation)) return;
+	const { payload } = req;
+	const event = eventId(deps.collectionSlug, operation);
+	const subscriptions = await resolveListening({
+		deps,
+		event,
+		req
+	});
+	if (!subscriptions.length) return;
+	const occurredAt = (/* @__PURE__ */ new Date()).toISOString();
+	for (const subscription of subscriptions) {
+		const created = await payload.create({
+			collection: deps.deliveriesSlug,
+			data: {
+				subscriptionId: subscription.id,
+				endpoint: subscription.url,
+				event,
+				status: "pending",
+				attempt: 0
+			},
+			overrideAccess: true,
+			req
+		});
+		const deliveryId = String(created.id);
+		const body = buildPayload({
+			deliveryId,
+			collection: deps.collectionSlug,
+			operation,
+			doc,
+			previousDoc,
+			occurredAt,
+			config: deps.config,
+			req
+		});
+		await payload.update({
+			collection: deps.deliveriesSlug,
+			id: deliveryId,
+			data: { payload: body },
+			overrideAccess: true,
+			req
+		});
+		if (deps.mode === "queue") {
+			await payload.jobs.queue({
+				task: WEBHOOK_DELIVER_TASK,
+				input: { deliveryId },
+				queue: deps.queue
+			});
+			continue;
+		}
+		try {
+			const result = await sendDelivery({
+				subscription,
+				deliveryId,
+				event,
+				body: JSON.stringify(body),
+				timeoutMs: deps.timeoutMs,
+				now: Date.now()
+			});
+			await payload.update({
+				collection: deps.deliveriesSlug,
+				id: deliveryId,
+				data: {
+					status: result.ok ? "success" : "dead",
+					attempt: 1,
+					responseStatus: result.responseStatus,
+					responseBody: result.responseBody,
+					error: result.error,
+					durationMs: result.durationMs
+				},
+				overrideAccess: true,
+				req
+			});
+		} catch (err) {
+			payload.logger.error(`@10x-media/webhooks: inline delivery ${deliveryId} threw: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
+};
+/** afterChange hook factory for an opt-in source collection. */
+const makeAfterChange = (deps) => async ({ doc, previousDoc, operation, req }) => {
+	await dispatch({
+		deps,
+		operation: operation === "create" ? "create" : "update",
+		doc,
+		previousDoc,
+		req
+	});
+	return doc;
+};
+/** afterDelete hook factory for an opt-in source collection. */
+const makeAfterDelete = (deps) => async ({ doc, req }) => {
+	await dispatch({
+		deps,
+		operation: "delete",
+		doc,
+		req
+	});
+	return doc;
+};
+//#endregion
+//#region src/options.ts
+const resolveDeliveryOptions = (delivery) => {
+	const opts = delivery === void 0 ? {} : typeof delivery === "string" ? { mode: delivery } : delivery;
+	return {
+		mode: opts.mode ?? "auto",
+		timeoutMs: opts.timeoutMs ?? 1e4,
+		retries: opts.retries ?? 4,
+		queue: opts.queue ?? "default"
+	};
+};
+//#endregion
+//#region src/plugin/resolveMode.ts
+/** Resolve the effective execution mode, warning when `queue` is forced with no runner. */
+const resolveMode = (args) => {
+	const runnerLikely = args.hasAutoRun || args.hasJobsPlugin;
+	if (args.configured === "queue") {
+		if (!runnerLikely) args.warn("@10x-media/webhooks: delivery.mode=\"queue\" but no job runner detected (config.jobs.autoRun unset and @10x-media/jobs not installed); queued deliveries stay pending until a worker runs.");
+		return "queue";
+	}
+	if (args.configured === "inline") return "inline";
+	return runnerLikely ? "queue" : "inline";
+};
+//#endregion
+//#region src/plugin/registerWebhooks.ts
+/** Register collections, the delivery task, source hooks, and the redeliver endpoint. */
+const registerWebhooks = (args) => {
+	const { config, options } = args;
+	const sources = options.collections ?? {};
+	const subscriptionsSlug = options.subscriptionsCollection?.slug ?? "webhook-subscriptions";
+	const deliveriesSlug = options.deliveriesLog?.slug ?? "webhook-deliveries";
+	const reserved = new Set([
+		...RESERVED_SLUGS,
+		subscriptionsSlug,
+		deliveriesSlug
+	]);
+	const sourceSlugs = Object.keys(sources).filter((s) => !reserved.has(s));
+	const delivery = resolveDeliveryOptions(options.delivery);
+	const codeSubscriptions = options.subscriptions ?? [];
+	const catalog = eventCatalog(Object.fromEntries(sourceSlugs.map((s) => [s, sources[s] ?? true])));
+	const mode = resolveMode({
+		configured: delivery.mode,
+		hasAutoRun: Boolean(config.jobs?.autoRun),
+		hasJobsPlugin: args.hasJobsPlugin,
+		warn: (m) => console.warn(m)
+	});
+	config.collections ??= [];
+	config.collections.push(buildSubscriptionsCollection({
+		slug: subscriptionsSlug,
+		events: catalog,
+		hidden: options.subscriptionsCollection?.hidden ?? false
+	}));
+	const deliveries = buildDeliveriesCollection({
+		slug: deliveriesSlug,
+		hidden: options.deliveriesLog?.hidden ?? false
+	});
+	const redeliverEndpoint = {
+		path: "/:id/redeliver",
+		method: "post",
+		handler: async (req) => {
+			if (!req.user) return Response.json({ error: "unauthorized" }, { status: 401 });
+			const id = req.routeParams?.id;
+			if (typeof id !== "string") return Response.json({ error: "missing id" }, { status: 400 });
+			const result = await redeliverDelivery({
+				deps: {
+					deliveriesSlug,
+					subscriptionsSlug,
+					codeSubscriptions,
+					mode,
+					timeoutMs: delivery.timeoutMs,
+					queue: delivery.queue
+				},
+				deliveryId: id,
+				payload: req.payload,
+				req
+			});
+			return Response.json(result, { status: 202 });
+		}
+	};
+	deliveries.endpoints = [...deliveries.endpoints || [], redeliverEndpoint];
+	config.collections.push(deliveries);
+	config.jobs ??= {};
+	config.jobs.tasks ??= [];
+	config.jobs.tasks.push(buildDeliverTask({
+		deliveriesSlug,
+		subscriptionsSlug,
+		codeSubscriptions,
+		timeoutMs: delivery.timeoutMs,
+		retries: delivery.retries
+	}));
+	for (let i = 0; i < config.collections.length; i++) {
+		const collection = config.collections[i];
+		if (!collection || !sourceSlugs.includes(collection.slug)) continue;
+		const cfg = sources[collection.slug];
+		const collectionConfig = cfg === true || cfg === void 0 ? {} : cfg;
+		const deps = {
+			collectionSlug: collection.slug,
+			config: collectionConfig,
+			operations: collectionConfig.operations ?? [
+				"create",
+				"update",
+				"delete"
+			],
+			deliveriesSlug,
+			subscriptionsSlug,
+			codeSubscriptions,
+			mode,
+			timeoutMs: delivery.timeoutMs,
+			queue: delivery.queue
+		};
+		config.collections[i] = {
+			...collection,
+			hooks: {
+				...collection.hooks,
+				afterChange: [...collection.hooks?.afterChange ?? [], makeAfterChange(deps)],
+				afterDelete: [...collection.hooks?.afterDelete ?? [], makeAfterDelete(deps)]
+			}
+		};
+	}
+};
+//#endregion
+//#region src/index.ts
+/** The trigger slug webhooks contributes to the automations catalog. */
+const WEBHOOK_TRIGGER_SLUG = "webhook";
+/**
+* Webhooks plugin for Payload v3. Runs before automations (`order: 10`) so it can
+* push its `webhook` trigger into automations when present, and builds outbound
+* delivery: opt-in collections emit signed HTTP POSTs to subscribed endpoints,
+* delivered via native Payload jobs or bounded-await inline.
+*/
+const webhooks = definePlugin({
+	slug: "@10x-media/webhooks",
+	order: 10,
+	plugin: ({ config, plugins, ...options }) => {
+		if (options.disabled === true) return config;
+		registerTranslations(config);
+		const automationsPlugin = plugins["@10x-media/automations"];
+		if (automationsPlugin?.options) {
+			const opts = automationsPlugin.options;
+			opts.triggers = [...opts.triggers ?? [], WEBHOOK_TRIGGER_SLUG];
+		}
+		registerWebhooks({
+			config,
+			options,
+			hasJobsPlugin: Boolean(plugins["@10x-media/jobs"])
+		});
+		return config;
+	}
+});
+//#endregion
+export { WEBHOOK_TRIGGER_SLUG, webhooks };
+
+//# sourceMappingURL=index.js.map