feat: Webhooks

[isTravis]

Adds outbound webhooks that fire when a new version is created, so downstream consumers can react to changes instead of polling.

What's included

• DB — collection_webhooks (bumpFilter text[], secret, enabled) and webhook_deliveries (status/attempts/response/timing) with indexes for the retry sweep and 30-day purge. Migration 0006.
• Fire hook — deliveries are enqueued at the version-ready point in negotiate.ts and the metadata-patch path in versions.ts; filtered by bump type (major/minor/patch). Never blocks the 201.
• Delivery (src/lib/webhooks.server.ts) — HMAC-SHA256 signing (X-Underlay-Signature), SSRF guard (blocks localhost/private/link-local incl. cloud-metadata IP, DNS-resolved at delivery), 10s timeout, retry with backoff.
• Purge — 30-day cleanup via in-process interval + tools/pruneWebhookLogs.ts cron.
• API — CRUD under /api/collections/:owner/:slug/webhooks + /deliveries, /test, and retry; gated requireAuth('write') + owner/admin + API-key scope. Secret returned once on create.
• UI — a Webhooks section in collection settings (create form, one-time secret reveal, per-webhook delivery log).

[Copilot]

Pull request overview

Adds first-class outbound webhooks for “new version created” events, including persistence for deliveries, background retry/purge jobs, management API endpoints, and a collection settings UI to configure endpoints and inspect delivery logs.

Changes:

• Introduces collection_webhooks + webhook_deliveries tables (migration 0006) and background jobs for retry + 30‑day retention purging (in-process + cron tool).
• Adds webhook delivery pipeline with HMAC signing, SSRF checks, retries with exponential backoff, and manual retry/test endpoints.
• Adds collection settings UI section and loader wiring to create/manage webhooks and view delivery logs.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tools/pruneWebhookLogs.ts	Adds cron-invoked tool to purge old webhook delivery logs.
tools/cron.ts	Schedules daily webhook log pruning in production cron container.
src/routes/[owner]/[collection]/settings.tsx	Renders new Webhooks settings section in collection settings UI.
src/routes/[owner]/[collection]/settings.data.ts	Loads initial webhooks list for settings page.
src/lib/webhooks.server.ts	Implements webhook enqueueing, delivery, retry sweep, and purge jobs + SSRF/signing utilities.
src/lib/webhooks.server.test.ts	Adds unit tests for signing, IP blocking, and URL validation helpers.
src/db/schema.ts	Defines collection_webhooks and webhook_deliveries tables and indexes in Drizzle schema.
src/db/migrations/0006_moaning_mauler.sql	Creates webhook tables + indexes and foreign keys.
src/db/migrations/meta/0006_snapshot.json	Drizzle migration snapshot update for schema version 7.
src/db/migrations/meta/_journal.json	Registers migration 0006.
src/components/WebhooksSettings.tsx	Adds UI for CRUD, test sends, delivery logs, and retries.
src/api/webhooks.ts	Adds authenticated/authorized webhook CRUD + deliveries/test/retry API.
src/api/versions.ts	Fires webhooks when metadata patch creates a new version.
src/api/negotiate.ts	Fires webhooks when a negotiated version is committed.
server.ts	Mounts webhooks API routes and starts in-process webhook background jobs.
package.json	Adds tool:pruneWebhookLogs script for cron/tooling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.