Inbound webhook configs can now link to workspace workflow definitions, making webhooks a trigger adapter rather than the automation itself.
Signed webhook deliveries linked to workflows create dry-run workflow runs and step logs without sending WhatsApp messages. Signature failures stop before workflow execution.
Existing unlinked webhook configs keep the legacy direct transactional-template dry-run/send behavior.
Safety
Workflow run logs store summarized payload/input/output metadata only. Raw webhook payloads and sensitive headers stay out of workflow logs.
Live webhook promotion remains locked; this release is dry-run execution infrastructure for the upcoming guided builder and run-history slices.
Verification
pnpm --filter @repo/database exec vitest run src/adapters/inbound-webhooks.test.ts src/adapters/workflows.test.ts --no-file-parallelism --maxWorkers=1
pnpm --filter app exec vitest run app/api/settings/inbound-webhooks/route.test.ts app/api/workflows/route.test.ts --no-file-parallelism --maxWorkers=1
pnpm --filter api exec vitest run __tests__/inbound-webhook-route.test.ts --no-file-parallelism --maxWorkers=1
