Webhooks: Know the moment it happens.

import { createHmac, timingSafeEqual } from 'node:crypto';function verify(secret: string, timestamp: string, body: string, signature: string) {  const expected = createHmac('sha256', secret).update(`${timestamp}.${body}`).digest('hex');  const provided = signature.replace(/^v1=/, '');  return timingSafeEqual(Buffer.from(expected), Buffer.from(provided));}export async function POST(request: Request) {  const body = await request.text();  const timestamp = request.headers.get('enlist-timestamp')!;  const signature = request.headers.get('enlist-signature')!;  if (!verify(process.env.ENLIST_WEBHOOK_SECRET!, timestamp, body, signature)) {    return new Response('Invalid signature', { status: 401 });  }  const event = JSON.parse(body);  // event.type: 'signup.created' | 'signup.email_delivered' | …  // event.data: { id, waitlist_id, email, position, … }  return new Response('ok');}