import crypto from 'node:crypto';
/**
 * Verify Skimly webhook signature.
 * signature header format: "v1=<hex>"
 */
export function verifySkimlySignature(signature, rawBody, secret) {
    if (!signature?.startsWith('v1='))
        return false;
    const expected = 'v1=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
    // timing safe compare
    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}
