@whooshbang/contracts 1.0.0-rc.13

package/fixtures/whooshbang-events-v1/signing/vectors.json

@@ -0,0 +1,852 @@
+{
+  "schema": "whooshbang.webhook-signing-vectors.v1",
+  "synthetic_verification_keys": {
+    "current": "whsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
+    "previous": "whsec_ICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8=",
+    "wrong": "whsec_QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl8=",
+    "short_invalid": "whsec_AA=="
+  },
+  "raw_bodies": {
+    "original": "{\"schema\":\"whooshbang.event.v1\",\"id\":\"evt_interaction_received_synthetic\",\"type\":\"interaction.received\",\"created_at\":\"2026-07-25T18:11:00Z\",\"account_id\":\"acct_synthetic_customer_events\",\"project_id\":\"proj_synthetic_customer_events\",\"environment\":\"test\",\"data\":{\"interaction_id\":\"interaction_synthetic_confirm\",\"message_id\":\"message_synthetic_interaction\",\"binding_id\":\"binding_synthetic_telegram\",\"channel\":\"telegram\",\"correlation_id\":\"correlation_synthetic_interaction\",\"interaction_type\":\"confirm\",\"response\":{\"type\":\"confirm\",\"value\":true},\"occurred_at\":\"2026-07-25T18:10:30Z\",\"expires_at\":\"2026-07-25T18:30:00Z\"}}",
+    "body_mutation": "{ \"schema\":\"whooshbang.event.v1\",\"id\":\"evt_interaction_received_synthetic\",\"type\":\"interaction.received\",\"created_at\":\"2026-07-25T18:11:00Z\",\"account_id\":\"acct_synthetic_customer_events\",\"project_id\":\"proj_synthetic_customer_events\",\"environment\":\"test\",\"data\":{\"interaction_id\":\"interaction_synthetic_confirm\",\"message_id\":\"message_synthetic_interaction\",\"binding_id\":\"binding_synthetic_telegram\",\"channel\":\"telegram\",\"correlation_id\":\"correlation_synthetic_interaction\",\"interaction_type\":\"confirm\",\"response\":{\"type\":\"confirm\",\"value\":true},\"occurred_at\":\"2026-07-25T18:10:30Z\",\"expires_at\":\"2026-07-25T18:30:00Z\"}}"
+  },
+  "cases": [
+    {
+      "id": "valid-current",
+      "description": "One current V1 signature verifies over the exact raw bytes.",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": true,
+        "event_id": "evt_interaction_received_synthetic",
+        "timestamp": 1785000000,
+        "attempt": 1
+      }
+    },
+    {
+      "id": "valid-rotation-overlap",
+      "description": "Current and previous V1 signatures share the standard space-delimited header.",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc= v1,0lrBBZXvwC5Odcq5hOqVUq9cNJ1mnGSLuuVw5arw87s="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current", "previous"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": true,
+        "event_id": "evt_interaction_received_synthetic",
+        "timestamp": 1785000000,
+        "attempt": 1
+      }
+    },
+    {
+      "id": "valid-rotation-previous",
+      "description": "The immediately previous key remains trusted during bounded rotation overlap.",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,0lrBBZXvwC5Odcq5hOqVUq9cNJ1mnGSLuuVw5arw87s="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current", "previous"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": true,
+        "event_id": "evt_interaction_received_synthetic",
+        "timestamp": 1785000000,
+        "attempt": 1
+      }
+    },
+    {
+      "id": "valid-rotation-current-only",
+      "description": "A receiver that has only the current key accepts the current member of an overlap header.",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc= v1,0lrBBZXvwC5Odcq5hOqVUq9cNJ1mnGSLuuVw5arw87s="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": true,
+        "event_id": "evt_interaction_received_synthetic",
+        "timestamp": 1785000000,
+        "attempt": 1
+      }
+    },
+    {
+      "id": "wrong-secret",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["wrong"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "signature_mismatch"
+      }
+    },
+    {
+      "id": "body-mutation",
+      "description": "JSON that parses identically but has different raw bytes does not verify.",
+      "raw_body": "body_mutation",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "signature_mismatch"
+      }
+    },
+    {
+      "id": "id-mutation",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_mutated"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "signature_mismatch"
+      }
+    },
+    {
+      "id": "timestamp-mutation",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000001"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000001,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "signature_mismatch"
+      }
+    },
+    {
+      "id": "timestamp-outside-tolerance",
+      "description": "A cryptographically valid old attempt is rejected by the replay window.",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1784999600"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,xGLKp4XxdmxIk3OE8P0/n95rAyyyKkvcQnZooclcE5c="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "timestamp_outside_tolerance"
+      }
+    },
+    {
+      "id": "missing-signature-header",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "missing_header"
+      }
+    },
+    {
+      "id": "duplicate-id-header",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "Webhook-Id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "duplicate_header"
+      }
+    },
+    {
+      "id": "duplicate-signature-header",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "duplicate_header"
+      }
+    },
+    {
+      "id": "malformed-signature",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,not*base64"
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "malformed_signature"
+      }
+    },
+    {
+      "id": "unknown-signature-version",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v2,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "unsupported_signature_version"
+      }
+    },
+    {
+      "id": "malformed-multi-signature-spacing",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc=  v1,0lrBBZXvwC5Odcq5hOqVUq9cNJ1mnGSLuuVw5arw87s="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current", "previous"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "malformed_signature"
+      }
+    },
+    {
+      "id": "too-many-signatures",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc= v1,0lrBBZXvwC5Odcq5hOqVUq9cNJ1mnGSLuuVw5arw87s= v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current", "previous"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "too_many_signatures"
+      }
+    },
+    {
+      "id": "duplicate-signature-token",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc= v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "duplicate_signature"
+      }
+    },
+    {
+      "id": "delimiter-injected-id",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt.interaction.injected"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,/qusIweevhAX5gR0nzLT4T41CwXLF3Qc+xGqaPTnY9k="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "malformed_webhook_id"
+      }
+    },
+    {
+      "id": "delimiter-injected-timestamp",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000.0"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,cQ3H2qUQEZSXQiz5Sei6XtdrLgQcYGMkHOXgKIzMZxs="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "malformed_timestamp"
+      }
+    },
+    {
+      "id": "noncanonical-timestamp",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "01785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "malformed_timestamp"
+      }
+    },
+    {
+      "id": "attempt-outside-contract",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "9"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "malformed_attempt"
+      }
+    },
+    {
+      "id": "attempt-is-not-signed",
+      "description": "The diagnostic attempt may change without changing an otherwise valid signature.",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "8"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": true,
+        "event_id": "evt_interaction_received_synthetic",
+        "timestamp": 1785000000,
+        "attempt": 8
+      }
+    },
+    {
+      "id": "valid-duplicate-event-retry",
+      "description": "A retry keeps the exact event ID and body while timestamp, signature, and attempt change.",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000060"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,wGTQbelJe/UNKysG3OBoDibjwIf4DoAVRps8DTIvh4s="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "2"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000060,
+      "tolerance_seconds": 300,
+      "duplicate_of": "valid-current",
+      "expected": {
+        "verified": true,
+        "event_id": "evt_interaction_received_synthetic",
+        "timestamp": 1785000060,
+        "attempt": 2
+      }
+    },
+    {
+      "id": "invalid-short-secret",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["short_invalid"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "invalid_secret"
+      }
+    },
+    {
+      "id": "too-many-trusted-secrets",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current", "previous", "wrong"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "too_many_secrets"
+      }
+    },
+    {
+      "id": "duplicate-trusted-secret",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current", "current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "duplicate_secret"
+      }
+    },
+    {
+      "id": "missing-attempt-header",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "missing_header"
+      }
+    },
+    {
+      "id": "duplicate-attempt-header",
+      "raw_body": "original",
+      "headers": [
+        {
+          "name": "webhook-id",
+          "value": "evt_interaction_received_synthetic"
+        },
+        {
+          "name": "webhook-timestamp",
+          "value": "1785000000"
+        },
+        {
+          "name": "webhook-signature",
+          "value": "v1,HNNY1ubZYyZMemV4NJVBoIbHqzklUZWyS6LqI5SlVrc="
+        },
+        {
+          "name": "webhook-attempt",
+          "value": "1"
+        },
+        {
+          "name": "Webhook-Attempt",
+          "value": "1"
+        }
+      ],
+      "trusted_keys": ["current"],
+      "now_seconds": 1785000000,
+      "tolerance_seconds": 300,
+      "expected": {
+        "verified": false,
+        "reason": "duplicate_header"
+      }
+    }
+  ]
+}