Webhooks Laravel Package

Product Decisions This Supports

• Build vs. buy for a commodity layer. This package covers the undifferentiated plumbing of outbound webhooks: endpoint registration, payload signing, event filtering, delivery evidence, exponential backoff, secret rotation, replay, and delivery logs. Adopting it converts a multi-sprint platform project into an integration task, freeing roadmap capacity for the product surface customers actually pay for (event catalog, subscription UX, self-serve debugging).
• Whether "integrations/automation" becomes a roadmap pillar. Reliable outbound delivery is the gating capability for customer-facing integrations, Zapier-style connectors, and partner APIs. This package is a credible enabler for scoping that pillar without committing headcount to a delivery subsystem.
• Service-level commitments and support tiers. Delivery evidence, logs, and replay are exactly the primitives needed to promise something: at-least-once delivery, retry window length, replay retention, and dispute resolution ("your endpoint was down; here is the attempt history"). That directly informs SLA language, support-tier packaging, and whether replay is a paid or included feature.
• Security and enterprise-readiness decisions. Signing plus secret rotation is the answer to the "how do you secure webhooks?" line in security questionnaires. Adopting it lets you claim HMAC signing and rotation cadence now rather than scheduling custom work before an enterprise deal.
• Subscription granularity and pricing model. The filtering capability forces a product decision: do customers subscribe per event type, per topic, or all-or-nothing? That choice drives the settings UI, event-volume pricing, and whether you meter deliveries.
• Architecture direction for the Laravel platform. Because it ships as a Liberu module (HMVC-style), evaluating it is also a decision about how much you standardize on that module ecosystem versus plain Laravel packages — a decision with long-tail consequences for hiring, upgrades, and vendor independence.

When to Consider This Package

Consider it when:

• You are on Laravel and need outbound webhooks as a product feature on a weeks-not-quarters timeline.
• You specifically need the unglamorous parts — retries with backoff, replay, secret rotation, delivery evidence — that hand-rolled implementations reliably get wrong.
• You can verify, before committing: Laravel/PHP version compatibility, queue driver assumptions, test coverage, migration footprint, and whether it requires Liberu's module loader/scaffolding to function.
• You are willing to wrap it behind an internal interface (e.g., a WebhookDispatcher contract) so the vendor package is an implementation detail, not an architectural dependency.

Look elsewhere when:

• You need external validation. Zero stars, zero dependents, and no visible third-party production users means no community signal, no battle-testing, and a probable bus factor of one. That is a real risk, not a formality — verify the release history and maintainer activity directly rather than trusting the listed release date.
• You only need inbound webhook ingestion (receiving from Stripe/GitHub); this package is oriented around delivery.
• You need cross-language or non-HTTP event distribution (Kafka, SNS/EventBridge, message bus semantics) rather than HTTP callbacks to customer endpoints.
• You require a support contract, uptime SLA, or SOC 2 report from the webhook layer itself — a managed provider (Svix, Hookdeck, or a cloud queue with DLQ) is the safer buy.
• Your codebase is plain Laravel and you do not want Liberu module conventions leaking into your structure.
• Webhook volume is high enough that delivery infrastructure becomes a first-class scaling concern — at that point you want an owned service, not a package.

Recommended adoption posture: timeboxed spike against a real endpoint, read the delivery/backoff/replay source directly, then either fork-and-own or integrate behind your own contract with a documented exit plan.

How to Pitch It (Stakeholders)

To executives: Outbound webhooks are a standard expectation in every B2B integration conversation, and building them properly — retries, signing, replay, audit logs — is four to eight weeks of platform work that produces nothing a customer sees. This MIT-licensed package supplies that layer for free, which lets us pursue integrations and automation as a revenue surface this quarter instead of next. The trade-off is maturity: it has no external user base, so we treat it as an accelerator rather than a foundation — we isolate it behind our own interface, budget a named owner, and can swap it out. Low license cost, contained risk, meaningful schedule gain.

To engineering: It gives us signing, exponential backoff, secret rotation, filtering, replay, and delivery evidence out of the box, so we spend our time on domain events and the customer-facing subscription/debugging experience instead of retry state machines. We will not import it directly into business logic — everything goes through our own dispatcher contract, we fork if the upstream stalls, and we validate Laravel version, queue behavior, and migration footprint during a short spike before anything ships.

The honest caveat to state up front: adoption rests on code review and a spike, not on community proof. If the spike surfaces coupling to Liberu's module system or thin test coverage, the fallback is to mine it as a reference design and build the thin layer ourselves — the architectural lessons still pay for the evaluation.