Integrate gVault webhooks

curl -X POST https://sandbox.groundtech.co/v2/gvaults/webhooks \
  -H "Authorization: Bearer $GROUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://ops.acme.com/webhooks/ground-gvaults",
    "events": [
      "gvault.allowlist.status_changed",
      "fee_wrapper.status_changed",
      "fee_wrapper.fees.status_changed",
      "fee_wrapper.allowlist.status_changed"
    ],
    "description": "Sandbox gVault lifecycle events"
  }'

const crypto = require('crypto');

function verifyGroundSignature(rawBody, header, secret, tolerance = 300) {
  const parts = Object.fromEntries(header.split(',').map((part) => part.split('=')));
  const timestamp = Number(parts.t);
  if (!Number.isFinite(timestamp)) throw new Error('Invalid signature timestamp');
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > tolerance) {
    throw new Error('Signature timestamp outside tolerance');
  }

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  const actual = parts.v1 || '';
  if (expected.length !== actual.length ||
      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(actual))) {
    throw new Error('Invalid signature');
  }
}

{
  "id": "73a8e0c9-c20d-4b10-b9a4-0f0ff6b5cb9c",
  "type": "fee_wrapper.status_changed",
  "createdAt": "2026-09-03T17:35:39.000Z",
  "data": {
    "feeWrapperId": "8f4c52d7-62ab-4db9-a964-92f481f6b851",
    "status": "ready",
    "contractAddress": "0x7C4A1cb5a3D5C3c4E019c3f6aB29A0f98C21B814"
  }
}