Webhook verification

See the included examples/webhook/verify.mjs. Pass the raw bytes—not reserialized JSON—to HMAC-SHA256, compare a fixed-length digest in constant time, enforce the timestamp window, then atomically mark eventId consumed before applying business effects.

During rotation, try only the current and explicitly retained previous key. A match does not authorize a different installation, environment, event type, or tenant. Store no raw secret, signature, token, full response body, or unnecessary PII in delivery logs.