Destinations

Each destination implements the same Destination interface — config validation at save, idempotent delivery, periodic health probe. Adding the 8th destination is one class + one config-array entry.

• Email

  to (array of addresses), subject_template, body_template (optional)

  Always sends from noreply@inkwell.philiprehberger.com. Submitter email goes in body + Reply-To only — never as From. All header values pass through CRLF strip.

• Webhook

  url (https), secret (≥ 16 chars)

  HMAC-SHA256 in Stripe-style X-Inkwell-Signature: t=…,v1=… header. 48-hour rotation grace — old + new signatures both sent. SSRF guard refuses private / loopback / link-local IPs.

• Slack

  webhook_url (hooks.slack.com)

  Block Kit message. Length-limit-aware truncation.

• Discord

  webhook_url (discord.com/api/webhooks)

  Embed format with field mapping. Length-limit-aware truncation.

• Google Sheets

  spreadsheet_id, sheet_name, access_token, field_mapping (optional)

  Append-row per submission. OAuth access token managed via your Google Cloud console.

• HubSpot

  access_token, property_mapping (optional)

  Upsert contact by email; default mapping handles name → firstname/lastname split, phone, notes.

• Mailchimp

  api_key (with -dcN suffix), audience_id, tags, double_opt_in

  Datacenter parsed from api_key suffix. Single or double opt-in; tags + merge fields supported.