feat: add baselinker-webhooks skill

[garethx]

Adds the baselinker-webhooks skill for BaseLinker (rebranded Base.com), a Polish multichannel e-commerce / warehouse / order-management platform. BASELINKER was added to the Hookdeck source-type enum ~2026-08-10.

Why this one is unusual

BaseLinker publishes no webhook documentation at all. Before authoring I confirmed:

• api.baselinker.com (= api.base.com) is 195 request/response methods over connector.php. No webhook registration/subscription method exists; change tracking is polling (getJournalList, getOrderReturnJournalList, getInventoryProductLogs).
• The developers.baselinker.com/shops_api "shops data exchange protocol" is BaseLinker calling merchant-hosted PHP scripts with a shared password — RPC polling, not signed event delivery.
• Neither the English nor Polish Help Centre documents an outbound webhook or a "send HTTP request" automatic action. Every webhook hit is an inbound marketplace/courier integration (Heureka, Fruugo, ClickPost, Blue Dart, Myntra).
• No developer portal exists (base.com/*/developers 404s).
• hookdeck.com/docs/sources lists BASELINKER with no documentation link.

So the skill is authored from primary evidence rather than provider prose.

The scheme

Two properties make this unlike any other skill in the repo, and both drive every example:

1. Deliveries are HTTP HEAD, never POST. A HEAD request has no body — handlers use app.head() / an exported HEAD / @app.head, and never read req.body. No JSON body parser is mounted on the route.
2. The entire payload is in the query string. Values are always strings, so order_id is coerced and validated and nothing is assumed present.

There is no signature verification — no HMAC, no secret, no timestamp/replay check, no handshake. Confirmed in Hookdeck's own API spec, where SourceConfigBaselinkerAuth is {properties: {}, additionalProperties: false} (accepts no secret), while every HMAC source there carries webhook_secret_key. BaseLinker sits in the zero-property-auth cohort with AWS SNS, Microsoft Graph, Microsoft SharePoint, Monday, Strava, Tikkie, Ethoca and Zift.

No verifier is fabricated. The only auth shown is an optional token the user appends to their own endpoint URL, labelled throughout as not provider authentication. X-BLToken is documented as the outbound request header for your own API calls and explicitly not a webhook signature.

Responses stay bodyless per RFC 9110 §9.3.2, including the 400/401 paths — hence Response(status_code=...) rather than HTTPException in FastAPI. Worth knowing: because a HEAD response can't carry a body, Hookdeck returns the request id in the x-hookdeck-request-id header instead.

Things a reviewer may otherwise re-flag

• hmac.compare_digest / crypto.timingSafeEqual appear in the examples. These are constant-time comparisons of the user's own URL token, not a provider signature check. Please don't read them as a fabricated verifier.
• order_id / state are hedged deliberately. They are presented as observed examples, never as a documented or exhaustive parameter list. state is treated as an opaque string, not an enum and not an event-type discriminator — there is no switch over state values anywhere, by design.
• Automatic Actions system-event names (order fetched, status set, shipment created, …) are referenced as background context only. They are panel UI labels, not wire values, and are not used as event-name constants.
• The exact panel path that registers the callback URL is unconfirmed and flagged as such in TODO.md.

Testing

• ./scripts/validate-provider.sh baselinker-webhooks — passes
• express: 23 tests pass
• nextjs: 19 tests pass
• fastapi: 22 tests pass (fresh venv from requirements.txt)

Open items are tracked honestly in skills/baselinker-webhooks/TODO.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VcD5gC7udDGBQD8Ko97q8i