Overview

Review and plan General Availability (GA) for:

• WPGraphQL Webhooks (currently 0.0.8)
• WPGraphQL Debug Extensions (currently 0.0.5)

WPGraphQL Webhooks

Already in place: registration API and admin UI, event dispatcher, manage_options checks on create/update/delete, per-webhook custom headers, and extensibility hooks (graphql_webhooks_payload, _timeout, _sslverify, _allowed_events, _allowed_methods, _validate_data, _before_trigger, _after_trigger, _sent, _init).

Security (from #167)

• Sign outgoing payloads (e.g. HMAC signature header with a per-webhook secret) so receivers can verify them
• Discourage or drop GET for payload delivery: it puts the full payload in the URL query string, which ends up in server logs
• Add a filter for custom authentication on delivery (remaining part of feat: Add extensibility filters for modifying payloads and custom authentication hooks #171)

Payload structure (from #170)

• Define a consistent payload shape across events: event metadata, timestamp, site URL, and a data object with event-specific details. Today _webhook_meta has sent_at, webhook_id, webhook_name and event_type, but no site URL, and the event data varies by event
• Document the payload shape

WPGraphQL Debug Extensions

• Add a test suite (there's no tests/ directory yet; Webhooks has unit, functional and acceptance suites to follow)

Both

• Release on the WP Engine Updater (same steps as chore: Release WPGraphQL Logging Plugin on WP Engine Updater #446 / chore: Release HWP Previews Plugin on WP Engine Updater #492)
• Final QA pass and 1.0.0 release