@forumone/throughline 0.0.0 → 1.0.0-next.0

package/dist/integrations/integrations/webhook/config-fields.d.ts

@@ -0,0 +1,33 @@
+import type { Field } from 'payload';
+/**
+ * The event names the webhook integration can subscribe to. Kept in sync
+ * with the core `FrameworkEvents` taxonomy plus the approval/decided event
+ * augmented by the approvals package.
+ */
+export declare const WEBHOOK_EVENT_OPTIONS: readonly [{
+    readonly label: "Page published";
+    readonly value: "content/page.published";
+}, {
+    readonly label: "Page unpublished";
+    readonly value: "content/page.unpublished";
+}, {
+    readonly label: "Page rolled back";
+    readonly value: "content/page.rolled_back";
+}, {
+    readonly label: "Form submission received";
+    readonly value: "form/submission.received";
+}, {
+    readonly label: "Approval decided";
+    readonly value: "approval/decided";
+}];
+export declare const WEBHOOK_DEFAULT_TIMEOUT_SECONDS = 10;
+export declare const MIN_SIGNING_SECRET_LENGTH = 32;
+export declare const configFields: Field[];
+export interface WebhookConfig {
+    targetUrl: string;
+    signingSecret: string;
+    eventFilter?: string[];
+    includeFullPayload?: boolean;
+    timeoutSeconds?: number;
+}
+//# sourceMappingURL=config-fields.d.ts.map

package/dist/integrations/integrations/webhook/config-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-fields.d.ts","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/config-fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAEpC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;EAMxB,CAAA;AAEV,eAAO,MAAM,+BAA+B,KAAK,CAAA;AACjD,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAE3C,eAAO,MAAM,YAAY,EAAE,KAAK,EAwC/B,CAAA;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB"}

package/dist/integrations/integrations/webhook/config-fields.js

@@ -0,0 +1,54 @@
+/**
+ * The event names the webhook integration can subscribe to. Kept in sync
+ * with the core `FrameworkEvents` taxonomy plus the approval/decided event
+ * augmented by the approvals package.
+ */
+export const WEBHOOK_EVENT_OPTIONS = [
+    { label: 'Page published', value: 'content/page.published' },
+    { label: 'Page unpublished', value: 'content/page.unpublished' },
+    { label: 'Page rolled back', value: 'content/page.rolled_back' },
+    { label: 'Form submission received', value: 'form/submission.received' },
+    { label: 'Approval decided', value: 'approval/decided' },
+];
+export const WEBHOOK_DEFAULT_TIMEOUT_SECONDS = 10;
+export const MIN_SIGNING_SECRET_LENGTH = 32;
+export const configFields = [
+    {
+        name: 'targetUrl',
+        type: 'text',
+        required: true,
+        admin: { description: 'HTTPS URL the integration POSTs events to.' },
+    },
+    {
+        name: 'signingSecret',
+        type: 'text',
+        required: true,
+        admin: {
+            description: `Shared secret for HMAC-SHA256 signatures, at least ${MIN_SIGNING_SECRET_LENGTH} characters. The receiver checks the x-throughline-signature header.`,
+        },
+    },
+    {
+        name: 'eventFilter',
+        type: 'select',
+        hasMany: true,
+        options: WEBHOOK_EVENT_OPTIONS.map((o) => ({ label: o.label, value: o.value })),
+        admin: {
+            description: 'Only deliver these event types. Leave empty to deliver every subscribed event.',
+        },
+    },
+    {
+        name: 'includeFullPayload',
+        type: 'checkbox',
+        defaultValue: false,
+        admin: {
+            description: 'If true, send the entire event data block. If false, send only IDs and slugs to keep payloads small.',
+        },
+    },
+    {
+        name: 'timeoutSeconds',
+        type: 'number',
+        defaultValue: WEBHOOK_DEFAULT_TIMEOUT_SECONDS,
+        admin: { description: `Per-request timeout in seconds. Default ${WEBHOOK_DEFAULT_TIMEOUT_SECONDS}.` },
+    },
+];
+//# sourceMappingURL=config-fields.js.map

package/dist/integrations/integrations/webhook/config-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-fields.js","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/config-fields.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAC5D,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAChE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAChE,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACxE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;CAChD,CAAA;AAEV,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAA;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAA;AAE3C,MAAM,CAAC,MAAM,YAAY,GAAY;IACnC;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE;KACrE;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE;YACL,WAAW,EACT,sDAAsD,yBAAyB,sEAAsE;SACxJ;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,KAAK,EAAE;YACL,WAAW,EAAE,gFAAgF;SAC9F;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE;YACL,WAAW,EACT,sGAAsG;SACzG;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,+BAA+B;QAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,2CAA2C,+BAA+B,GAAG,EAAE;KACtG;CACF,CAAA"}

package/dist/integrations/integrations/webhook/functions.d.ts

@@ -0,0 +1,24 @@
+import type { InngestFunction } from 'inngest';
+import { type Job, type JobContext } from '../../../jobs/types.js';
+import type { IntegrationContext } from '../../types.js';
+export declare const WEBHOOK_INTEGRATION_ID = "webhook";
+/**
+ * Builds the two Inngest functions the webhook integration contributes:
+ *
+ * - `webhook-deliver` subscribes to the system events configured at the
+ *   admin layer. For every enabled instance whose `eventFilter` matches,
+ *   it POSTs an HMAC-signed body to the target URL, retries up to five
+ *   times on failure, and records audit + status updates.
+ * - `webhook-manual-trigger` listens for `integration/manual-sync` events
+ *   (fired by the `trigger_sync` MCP tool). It delivers a minimal test
+ *   payload to a single instance so admins can verify connectivity from
+ *   the conversation surface.
+ *
+ * Failures are isolated: each delivery is its own `step.run`, so a broken
+ * instance retries on its own without affecting the others or the
+ * publishing pipeline that fired the originating event.
+ */
+export declare function createWebhookJobs(getContext: (job: JobContext) => IntegrationContext): Job[];
+/** The same two jobs, registered with Inngest exactly as they always were. */
+export declare function createWebhookFunctions(ctx: IntegrationContext): InngestFunction.Any[];
+//# sourceMappingURL=functions.d.ts.map

package/dist/integrations/integrations/webhook/functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAElE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAKxD,eAAO,MAAM,sBAAsB,YAAY,CAAA;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,kBAAkB,GAAG,GAAG,EAAE,CAiE5F;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,CAIrF"}

package/dist/integrations/integrations/webhook/functions.js

@@ -0,0 +1,139 @@
+import { defineJob } from '../../../jobs/define.js';
+import { inngestJobs } from '../../../jobs/inngest/adapter.js';
+import { hmacSha256Hex } from './hmac.js';
+import { extractIds } from './payload.js';
+export const WEBHOOK_INTEGRATION_ID = 'webhook';
+/**
+ * Builds the two Inngest functions the webhook integration contributes:
+ *
+ * - `webhook-deliver` subscribes to the system events configured at the
+ *   admin layer. For every enabled instance whose `eventFilter` matches,
+ *   it POSTs an HMAC-signed body to the target URL, retries up to five
+ *   times on failure, and records audit + status updates.
+ * - `webhook-manual-trigger` listens for `integration/manual-sync` events
+ *   (fired by the `trigger_sync` MCP tool). It delivers a minimal test
+ *   payload to a single instance so admins can verify connectivity from
+ *   the conversation surface.
+ *
+ * Failures are isolated: each delivery is its own `step.run`, so a broken
+ * instance retries on its own without affecting the others or the
+ * publishing pipeline that fired the originating event.
+ */
+export function createWebhookJobs(getContext) {
+    const deliver = defineJob({
+        id: 'webhook-deliver',
+        retries: 5,
+        on: {
+            event: [
+                'content/page.published',
+                'content/page.unpublished',
+                'content/page.rolled_back',
+                'form/submission.received',
+                'approval/decided',
+            ],
+        },
+    }, async (job) => {
+        const { event, step } = job;
+        const ctx = getContext(job);
+        const instances = await step.run('load-webhook-instances', () => ctx.loadInstances(WEBHOOK_INTEGRATION_ID));
+        for (const instance of instances) {
+            const filter = instance.config.eventFilter;
+            if (filter && filter.length > 0 && !filter.includes(event.name))
+                continue;
+            await step.run(`deliver-${instance.id}`, async () => {
+                await deliverEvent({ ctx, instance, eventName: event.name, eventData: event.data });
+            });
+        }
+    });
+    const manualTrigger = defineJob({
+        id: 'webhook-manual-trigger',
+        on: { event: 'integration/manual-sync' },
+    }, async (job) => {
+        const { event, step } = job;
+        const ctx = getContext(job);
+        const data = (event.data ?? {});
+        const targetInstanceId = data.instanceId;
+        if (!targetInstanceId)
+            return;
+        const instances = await step.run('load-target', async () => {
+            const all = await ctx.loadInstances(WEBHOOK_INTEGRATION_ID);
+            return all.filter((i) => i.id === targetInstanceId);
+        });
+        for (const instance of instances) {
+            await step.run(`deliver-test-${instance.id}`, async () => {
+                await deliverEvent({
+                    ctx,
+                    instance,
+                    eventName: 'integration/manual-sync',
+                    eventData: { instanceId: instance.id, message: 'Manual sync triggered' },
+                    includeFullPayloadOverride: true,
+                });
+            });
+        }
+    });
+    return [deliver, manualTrigger];
+}
+/** The same two jobs, registered with Inngest exactly as they always were. */
+export function createWebhookFunctions(ctx) {
+    return inngestJobs(ctx.inngest, ctx.onFailure ? { onFailure: ctx.onFailure } : {}).functions(createWebhookJobs(() => ctx));
+}
+async function deliverEvent({ ctx, instance, eventName, eventData, includeFullPayloadOverride, }) {
+    const includeFull = includeFullPayloadOverride ?? instance.config.includeFullPayload ?? false;
+    const body = JSON.stringify({
+        event: eventName,
+        data: includeFull ? eventData : extractIds(eventData),
+        timestamp: Date.now(),
+        instanceId: instance.id,
+    });
+    const signature = await hmacSha256Hex(body, instance.config.signingSecret);
+    const timeoutMs = (instance.config.timeoutSeconds ?? 10) * 1000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+        response = await fetch(instance.config.targetUrl, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'x-throughline-event': eventName,
+                'x-throughline-signature': `sha256=${signature}`,
+                'x-throughline-timestamp': String(Date.now()),
+            },
+            body,
+            signal: controller.signal,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        await ctx.updateStatus(instance.id, 'failed', message);
+        await ctx.recordAudit({
+            integrationId: WEBHOOK_INTEGRATION_ID,
+            instanceName: instance.name,
+            action: 'integration.failed',
+            summary: `Failed to deliver ${eventName} to ${instance.name}: ${message}`,
+            errorMessage: message,
+        });
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    const success = response.ok;
+    if (success)
+        await ctx.updateStatus(instance.id, 'success');
+    else
+        await ctx.updateStatus(instance.id, 'failed', `HTTP ${response.status}`);
+    await ctx.recordAudit({
+        integrationId: WEBHOOK_INTEGRATION_ID,
+        instanceName: instance.name,
+        action: success ? 'integration.synced' : 'integration.failed',
+        summary: success
+            ? `Delivered ${eventName} to ${instance.name}`
+            : `Failed to deliver ${eventName} to ${instance.name} (HTTP ${response.status})`,
+        ...(success ? {} : { errorMessage: `HTTP ${response.status}` }),
+    });
+    if (!success) {
+        throw new Error(`Webhook delivery failed: HTTP ${response.status}`);
+    }
+}
+//# sourceMappingURL=functions.js.map

package/dist/integrations/integrations/webhook/functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions.js","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/functions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzC,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAA;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAmD;IACnF,MAAM,OAAO,GAAG,SAAS,CACvB;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,CAAC;QACV,EAAE,EAAE;YACF,KAAK,EAAE;gBACL,wBAAwB;gBACxB,0BAA0B;gBAC1B,0BAA0B;gBAC1B,0BAA0B;gBAC1B,kBAAkB;aACnB;SACF;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAA;QAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAC9D,GAAG,CAAC,aAAa,CAAgB,sBAAsB,CAAC,CACzD,CAAA;QAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAA;YAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAEzE,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;YACrF,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,aAAa,GAAG,SAAS,CAC7B;QACE,EAAE,EAAE,wBAAwB;QAC5B,EAAE,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE;KACzC,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAA;QAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAoD,CAAA;QAClF,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAA;QACxC,IAAI,CAAC,gBAAgB;YAAE,OAAM;QAE7B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,aAAa,CAAgB,sBAAsB,CAAC,CAAA;YAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QAEF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;gBACvD,MAAM,YAAY,CAAC;oBACjB,GAAG;oBACH,QAAQ;oBACR,SAAS,EAAE,yBAAyB;oBACpC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;oBACxE,0BAA0B,EAAE,IAAI;iBACjC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CACF,CAAA;IAED,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACjC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAC1F,iBAAiB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAC7B,CAAA;AACH,CAAC;AAUD,KAAK,UAAU,YAAY,CAAC,EAC1B,GAAG,EACH,QAAQ,EACR,SAAS,EACT,SAAS,EACT,0BAA0B,GACd;IACZ,MAAM,WAAW,GAAG,0BAA0B,IAAI,QAAQ,CAAC,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAA;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;IAE7D,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,qBAAqB,EAAE,SAAS;gBAChC,yBAAyB,EAAE,UAAU,SAAS,EAAE;gBAChD,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aAC9C;YACD,IAAI;YACJ,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,MAAM,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QACtD,MAAM,GAAG,CAAC,WAAW,CAAC;YACpB,aAAa,EAAE,sBAAsB;YACrC,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,qBAAqB,SAAS,OAAO,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE;YACzE,YAAY,EAAE,OAAO;SACtB,CAAC,CAAA;QACF,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAA;IAC3B,IAAI,OAAO;QAAE,MAAM,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;;QACtD,MAAM,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7E,MAAM,GAAG,CAAC,WAAW,CAAC;QACpB,aAAa,EAAE,sBAAsB;QACrC,YAAY,EAAE,QAAQ,CAAC,IAAI;QAC3B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB;QAC7D,OAAO,EAAE,OAAO;YACd,CAAC,CAAC,aAAa,SAAS,OAAO,QAAQ,CAAC,IAAI,EAAE;YAC9C,CAAC,CAAC,qBAAqB,SAAS,OAAO,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,MAAM,GAAG;QAClF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;KAChE,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACrE,CAAC;AACH,CAAC"}

package/dist/integrations/integrations/webhook/healthcheck.d.ts

@@ -0,0 +1,10 @@
+import type { IntegrationHealth } from '../../types.js';
+import type { WebhookConfig } from './config-fields.js';
+/**
+ * Light reachability check for the webhook target. Sends a HEAD request and
+ * accepts any 2xx, plus 405 (Method Not Allowed) since plenty of webhook
+ * receivers only allow POST and reject HEAD with 405. That's healthy enough
+ * for a "your endpoint is up" probe.
+ */
+export declare function healthcheck(config: WebhookConfig): Promise<IntegrationHealth>;
+//# sourceMappingURL=healthcheck.d.ts.map

package/dist/integrations/integrations/webhook/healthcheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthcheck.d.ts","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/healthcheck.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgBnF"}

package/dist/integrations/integrations/webhook/healthcheck.js

@@ -0,0 +1,26 @@
+const HEALTHCHECK_TIMEOUT_MS = 5000;
+/**
+ * Light reachability check for the webhook target. Sends a HEAD request and
+ * accepts any 2xx, plus 405 (Method Not Allowed) since plenty of webhook
+ * receivers only allow POST and reject HEAD with 405. That's healthy enough
+ * for a "your endpoint is up" probe.
+ */
+export async function healthcheck(config) {
+    try {
+        const response = await fetch(config.targetUrl, {
+            method: 'HEAD',
+            signal: AbortSignal.timeout(HEALTHCHECK_TIMEOUT_MS),
+        });
+        if (response.ok || response.status === 405) {
+            return { ok: true, details: `Reachable (HTTP ${response.status})` };
+        }
+        return { ok: false, details: `Endpoint returned HTTP ${response.status}` };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            details: error instanceof Error ? error.message : 'Unknown error',
+        };
+    }
+}
+//# sourceMappingURL=healthcheck.js.map

package/dist/integrations/integrations/webhook/healthcheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthcheck.js","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/healthcheck.ts"],"names":[],"mappings":"AAGA,MAAM,sBAAsB,GAAG,IAAI,CAAA;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAqB;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC;SACpD,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAA;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAClE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/integrations/integrations/webhook/hmac.d.ts

@@ -0,0 +1,11 @@
+/**
+ * HMAC-SHA256 utility used by the webhook integration to sign delivery
+ * payloads. The hex-encoded digest is sent in the `x-throughline-signature`
+ * header (prefixed with `sha256=`); receivers verify by recomputing with
+ * the shared secret.
+ *
+ * Uses Web Crypto so the same code runs in Node 20+, edge runtimes, and
+ * the browser (for tests). No Node-specific imports.
+ */
+export declare function hmacSha256Hex(payload: string, secret: string): Promise<string>;
+//# sourceMappingURL=hmac.d.ts.map

package/dist/integrations/integrations/webhook/hmac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWpF"}

package/dist/integrations/integrations/webhook/hmac.js

@@ -0,0 +1,25 @@
+/**
+ * HMAC-SHA256 utility used by the webhook integration to sign delivery
+ * payloads. The hex-encoded digest is sent in the `x-throughline-signature`
+ * header (prefixed with `sha256=`); receivers verify by recomputing with
+ * the shared secret.
+ *
+ * Uses Web Crypto so the same code runs in Node 20+, edge runtimes, and
+ * the browser (for tests). No Node-specific imports.
+ */
+const HEX_CHARS = '0123456789abcdef';
+export async function hmacSha256Hex(payload, secret) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(payload));
+    return bytesToHex(new Uint8Array(signature));
+}
+function bytesToHex(bytes) {
+    let out = '';
+    for (let i = 0; i < bytes.length; i += 1) {
+        const byte = bytes[i];
+        out += HEX_CHARS[byte >> 4] + HEX_CHARS[byte & 0xf];
+    }
+    return out;
+}
+//# sourceMappingURL=hmac.js.map

package/dist/integrations/integrations/webhook/hmac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.js","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,SAAS,GAAG,kBAAkB,CAAA;AAEpC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,MAAc;IACjE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAChF,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACtB,GAAG,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,CAAE,GAAG,SAAS,CAAC,IAAI,GAAG,GAAG,CAAE,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/integrations/integrations/webhook/index.d.ts

@@ -0,0 +1,6 @@
+import type { Integration } from '../../types.js';
+import { type WebhookConfig } from './config-fields.js';
+export declare const webhookIntegration: Integration<WebhookConfig>;
+export type { WebhookConfig } from './config-fields.js';
+export { WEBHOOK_INTEGRATION_ID } from './functions.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/integrations/integrations/webhook/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAA;AAI3B,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,aAAa,CA0CzD,CAAA;AAED,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/integrations/integrations/webhook/index.js

@@ -0,0 +1,47 @@
+import { configFields, MIN_SIGNING_SECRET_LENGTH, } from './config-fields.js';
+import { createWebhookFunctions, createWebhookJobs, WEBHOOK_INTEGRATION_ID } from './functions.js';
+import { healthcheck } from './healthcheck.js';
+export const webhookIntegration = {
+    id: WEBHOOK_INTEGRATION_ID,
+    name: 'Generic Webhook',
+    description: 'POST system events to an external HTTPS endpoint with HMAC-SHA256 signed payloads. Configurable event filter, retries, and timeout.',
+    category: 'webhook',
+    configFields,
+    async validateConfig(config) {
+        if (!config?.targetUrl)
+            return { ok: false, reason: 'targetUrl is required' };
+        let url;
+        try {
+            url = new URL(config.targetUrl);
+        }
+        catch {
+            return { ok: false, reason: 'targetUrl is not a valid URL' };
+        }
+        if (url.protocol !== 'https:') {
+            return { ok: false, reason: 'targetUrl must use https://' };
+        }
+        if (!config.signingSecret || config.signingSecret.length < MIN_SIGNING_SECRET_LENGTH) {
+            return {
+                ok: false,
+                reason: `signingSecret must be at least ${MIN_SIGNING_SECRET_LENGTH} characters`,
+            };
+        }
+        if (config.timeoutSeconds !== undefined &&
+            (typeof config.timeoutSeconds !== 'number' || config.timeoutSeconds <= 0)) {
+            return { ok: false, reason: 'timeoutSeconds must be a positive number' };
+        }
+        return { ok: true };
+    },
+    subscribes: [
+        { event: 'content/page.published', purpose: 'Notify external systems when content goes live' },
+        { event: 'content/page.unpublished', purpose: 'Notify when content is taken down' },
+        { event: 'content/page.rolled_back', purpose: 'Notify when content reverts to a prior version' },
+        { event: 'form/submission.received', purpose: 'Forward form submissions to downstream systems' },
+        { event: 'approval/decided', purpose: 'Notify external workflow tools of approval outcomes' },
+    ],
+    createFunctions: createWebhookFunctions,
+    createJobs: createWebhookJobs,
+    healthcheck,
+};
+export { WEBHOOK_INTEGRATION_ID } from './functions.js';
+//# sourceMappingURL=index.js.map

package/dist/integrations/integrations/webhook/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,YAAY,EACZ,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAClG,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAA+B;IAC5D,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,iBAAiB;IACvB,WAAW,EACT,qIAAqI;IACvI,QAAQ,EAAE,SAAS;IACnB,YAAY;IACZ,KAAK,CAAC,cAAc,CAAC,MAAM;QACzB,IAAI,CAAC,MAAM,EAAE,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;QAC7E,IAAI,GAAQ,CAAA;QACZ,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;QAC9D,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kCAAkC,yBAAyB,aAAa;aACjF,CAAA;QACH,CAAC;QACD,IACE,MAAM,CAAC,cAAc,KAAK,SAAS;YACnC,CAAC,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,EACzE,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrB,CAAC;IACD,UAAU,EAAE;QACV,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,gDAAgD,EAAE;QAC9F,EAAE,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,mCAAmC,EAAE;QACnF,EAAE,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,gDAAgD,EAAE;QAChG,EAAE,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,gDAAgD,EAAE;QAChG,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,qDAAqD,EAAE;KAC9F;IACD,eAAe,EAAE,sBAAsB;IACvC,UAAU,EAAE,iBAAiB;IAC7B,WAAW;CACZ,CAAA;AAGD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/integrations/integrations/webhook/payload.d.ts

@@ -0,0 +1,9 @@
+/**
+ * When a webhook instance is configured with `includeFullPayload=false`,
+ * we still want to include enough context to make the event useful: IDs,
+ * slugs, and any other field whose name ends in `Id`. Keeps payloads small
+ * without requiring the receiver to make a follow-up API call for the
+ * common case.
+ */
+export declare function extractIds(data: unknown): Record<string, unknown>;
+//# sourceMappingURL=payload.d.ts.map

package/dist/integrations/integrations/webhook/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/payload.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASjE"}

package/dist/integrations/integrations/webhook/payload.js

@@ -0,0 +1,19 @@
+/**
+ * When a webhook instance is configured with `includeFullPayload=false`,
+ * we still want to include enough context to make the event useful: IDs,
+ * slugs, and any other field whose name ends in `Id`. Keeps payloads small
+ * without requiring the receiver to make a follow-up API call for the
+ * common case.
+ */
+export function extractIds(data) {
+    if (!data || typeof data !== 'object')
+        return {};
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+        if (key === 'id' || key === 'slug' || key.endsWith('Id')) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=payload.js.map

package/dist/integrations/integrations/webhook/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/integrations/integrations/webhook/payload.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAChD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/integrations/jobs/healthcheck.d.ts

@@ -0,0 +1,24 @@
+import type { Job } from '../../jobs/types.js';
+import { type JobOptions } from '../../jobs/options.js';
+import type { HealthcheckDefinition, HealthcheckOptions } from '../../jobs/workflow-types.js';
+/**
+ * Cron healthcheck. Runs every check in its own `step.run` so one
+ * misbehaving probe can't take down the rest, collects failures, and
+ * routes them to `onFailure` (defaults to `console.error`). Always fires
+ * a `system/healthcheck` Inngest event so external dashboards can
+ * observe heartbeats independently of failure routing.
+ */
+export declare function healthcheckJob(options: JobOptions<HealthcheckOptions>): Job;
+/**
+ * Check that Payload is reachable and able to query a collection. Defaults
+ * to `users` because every Payload deployment has it; pass a different
+ * slug if `users` isn't always present (rare).
+ */
+export declare function createPayloadReachableCheck(collectionSlug?: string): HealthcheckDefinition;
+/**
+ * Check that a manifest URL is reachable. Aimed at the design-system
+ * manifest the components server consults, but works for any HTTPS
+ * endpoint that responds 2xx to a GET.
+ */
+export declare function createManifestReachableCheck(manifestUrl: string): HealthcheckDefinition;
+//# sourceMappingURL=healthcheck.d.ts.map

package/dist/integrations/jobs/healthcheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthcheck.d.ts","sourceRoot":"","sources":["../../../src/integrations/jobs/healthcheck.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAqB,MAAM,8BAA8B,CAAA;AAKhH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAyE3E;AAWD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,cAAc,GAAE,MAAgB,GAC/B,qBAAqB,CAevB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,CAkBvF"}

package/dist/integrations/jobs/healthcheck.js

@@ -0,0 +1,133 @@
+import { failureOptions } from '../../jobs/workflow-types.js';
+import { defineJob } from '../../jobs/define.js';
+import { jobPayload } from '../../jobs/options.js';
+const DEFAULT_SCHEDULE = '*/15 * * * *';
+const REACHABLE_TIMEOUT_MS = 5_000;
+/**
+ * Cron healthcheck. Runs every check in its own `step.run` so one
+ * misbehaving probe can't take down the rest, collects failures, and
+ * routes them to `onFailure` (defaults to `console.error`). Always fires
+ * a `system/healthcheck` Inngest event so external dashboards can
+ * observe heartbeats independently of failure routing.
+ */
+export function healthcheckJob(options) {
+    const schedule = options.schedule ?? DEFAULT_SCHEDULE;
+    const onFailure = options.onFailure ?? defaultOnFailure;
+    return defineJob({
+        id: options.id ?? 'healthcheck',
+        /*
+        One at a time by default. Two probes running together tell you nothing a
+        single one does not, and `onFailure` below fires per run — so overlapping
+        runs would report the same outage twice.
+  
+        `HealthcheckOptions.onFailure` is this package's own option and a
+        different thing from Inngest's: it is called once per run when a check
+        fails, so it reports the *first* bad run rather than waiting for retries
+        to exhaust. A probe has no retries. Both are available now, and they
+        answer different questions — see the note on `failureOptions`.
+        */
+        ...failureOptions(options, 1),
+        on: { cron: schedule },
+    }, async ({ step, logger, emit, payload: contextPayload }) => {
+        const payload = jobPayload(options.payload, contextPayload, options.id ?? 'healthcheck');
+        const results = [];
+        for (const check of options.checks) {
+            const outcome = await step.run(`check-${check.name}`, async () => {
+                try {
+                    const result = await check.run({ payload });
+                    return { name: check.name, ...result };
+                }
+                catch (error) {
+                    return {
+                        name: check.name,
+                        ok: false,
+                        details: error instanceof Error ? error.message : 'Unknown error',
+                    };
+                }
+            });
+            results.push(outcome);
+        }
+        const failures = results
+            .filter((r) => !r.ok)
+            .map((r) => {
+            const entry = { name: r.name };
+            if (r.details)
+                entry.details = r.details;
+            return entry;
+        });
+        if (failures.length > 0) {
+            await step.run('report-failures', async () => {
+                await onFailure(failures);
+            });
+        }
+        await step.run('emit-heartbeat', async () => {
+            await emit({
+                name: 'system/healthcheck',
+                data: {
+                    source: 'workflow',
+                    timestamp: new Date().toISOString(),
+                },
+            });
+        });
+        logger.info('Healthcheck complete', {
+            totalChecks: results.length,
+            failures: failures.length,
+        });
+        return { results, failureCount: failures.length };
+    });
+}
+async function defaultOnFailure(failures) {
+    // eslint-disable-next-line no-console
+    console.error(`[healthcheck] ${failures.length} check(s) failed: ${failures
+        .map((f) => `${f.name}: ${f.details ?? 'no details'}`)
+        .join('; ')}`);
+}
+/**
+ * Check that Payload is reachable and able to query a collection. Defaults
+ * to `users` because every Payload deployment has it; pass a different
+ * slug if `users` isn't always present (rare).
+ */
+export function createPayloadReachableCheck(collectionSlug = 'users') {
+    return {
+        name: 'payload-reachable',
+        run: async ({ payload }) => {
+            try {
+                await payload.find({ collection: collectionSlug, limit: 1 });
+                return { ok: true };
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    details: error instanceof Error ? error.message : 'Unknown error',
+                };
+            }
+        },
+    };
+}
+/**
+ * Check that a manifest URL is reachable. Aimed at the design-system
+ * manifest the components server consults, but works for any HTTPS
+ * endpoint that responds 2xx to a GET.
+ */
+export function createManifestReachableCheck(manifestUrl) {
+    return {
+        name: 'manifest-reachable',
+        run: async () => {
+            try {
+                const response = await fetch(manifestUrl, {
+                    signal: AbortSignal.timeout(REACHABLE_TIMEOUT_MS),
+                });
+                if (response.ok)
+                    return { ok: true };
+                return { ok: false, details: `HTTP ${response.status}` };
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    details: error instanceof Error ? error.message : 'Unknown error',
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=healthcheck.js.map