wh_catalog_sync

import crypto from "node:crypto"; export function verify(rawBody, header, secret) {  // one t, one or more v1 — a rotating secret sends both signatures.  const pairs = header.split(",").map((p) => p.trim().split("="));  const t = pairs.find(([k]) => k === "t")?.[1];  const signatures = pairs.filter(([k]) => k === "v1").map(([, v]) => v);  if (!t || signatures.length === 0) return false;  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;   const expected = Buffer.from(    crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex"),  );  return signatures.some((sig) => {    const given = Buffer.from(sig);    return given.length === expected.length && crypto.timingSafeEqual(expected, given);  });}