const endpoint = await synapse.webhooks.create(
  organizationId,
  appId,
  environmentId,
  {
    url: "https://app.example/webhooks/synapse",
    eventTypes: ["evaluation.completed", "alignment.drifted"],
  },
  { idempotencyKey: persistedRequestId },
);

// Store endpoint.secret now. It is shown only once.
await secretStore.put("synapse-webhook-current", endpoint.secret);

import { verifyWebhookSignature } from "@apart-ai/synapse/webhooks";

export async function handleSynapseWebhook(request: Request) {
  const signature = request.headers.get("X-Synapse-Signature") ?? "";
  const eventId = request.headers.get("X-Synapse-Event-Id") ?? "";
  if (!signature || !eventId) {
    return new Response("Missing required webhook headers", { status: 400 });
  }
  const rawBody = await request.text();

  await verifyWebhookSignature(
    rawBody,
    signature,
    [
      process.env.SYNAPSE_WEBHOOK_SECRET!,
      process.env.SYNAPSE_PREVIOUS_SECRET!,
    ],
    { toleranceSeconds: 300 },
  );

  if (await wasAlreadyProcessed(eventId)) {
    return new Response(null, { status: 204 });
  }

  const event = JSON.parse(rawBody);
  await processEventAndRememberId(event, eventId);
  return new Response(null, { status: 204 });
}