Crypto & Digest

Two small families that solve two unrelated problems: proving a payload was not tampered with, and turning a flood of events into one message a human will actually read.

Crypto — Hashing & HMAC

Two operators, computing digests and signatures — typically to verify an inbound webhook or sign an outbound one.

algorithm is required on both. encoding is hex (the default) or base64 on both.

- name: signPayload
  type: crypto
  operator: hmac
  props:
    input: '{{trigger.data.body}}'
    secret: $env.SIGNING_SECRET
    algorithm: sha256
    encoding: hex

Keep the key in the environment ($env.SIGNING_SECRET), never inline in the config — the config is code, and it ships to a git remote.

Digest — Batch & Release

Two operators that collect items across many runs into a named bucket, then drain them as one batch. The classic use is a notification roll-up: one automation collects each event as it happens, a second releases them on a schedule.

digestKey is required on both operators and is what pairs a producer with its consumer. sort.direction is asc by default.

# Producer automation (record trigger) collects
- name: queueDigest
  type: digest
  operator: collect
  props:
    digestKey: daily-summary
    item: '{{trigger.data.record}}'
    deduplicateBy: id

# Consumer automation (cron trigger) releases
- name: drain
  type: digest
  operator: release
  props:
    digestKey: daily-summary
    sort: { field: created_at, direction: desc }
    limit: 50

Two runs, not one: collect belongs in an automation triggered by the event (a record trigger), and release in one triggered by the clock (a cron trigger). Because release drains, a released bucket starts empty for the next window — a missed schedule accumulates rather than losing events.

Related Pages

• Data & State — the data, state and filter families.
• Webhook & Cron Triggers — the inbound signature hmac verifies, and the schedule that drives release.
• Email Actions — sending the batch a digest releases.
• HTTP & Webhooks — signing an outbound request.
• Automation Environment Variables — where $env.SIGNING_SECRET comes from.