Publish anywhere. Report everywhere.

{
  "id": "5f0c2a1e-8d3b-4c7a-9e21-6b0f4d2c9a71",
  "type": "run.completed",
  "created": "2026-11-06T09:15:00.000Z",
  "data": {
    "project_id": "c1a7…",
    "run_id": "9e44…",
    "trigger": "schedule",
    "status": "completed",
    "results": 200,
    "visibility_score": 58.4,
    "score_margin": 5.1,
    "mention_rate": 0.66
  }
}

import crypto from "node:crypto";

// Mentioned-Signature: t=<unix seconds>,v1=<hex HMAC>
// HMAC-SHA256(secret, t + "." + rawBody)
export function verify(secret, rawBody, header) {
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=", 2)),
  );
  const t = Number(parts.t);
  if (!Number.isFinite(t) || !parts.v1) return false;
  // Replay protection: reject anything older than 5 minutes.
  if (Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(t + "." + rawBody)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}