Verifies ComplyCube signatures and parses webhook events.

Configure the webhook endpoint's secret as the inbound declaration's secret. ComplyCube-Signature carries a lowercase hexadecimal HMAC-SHA256 of the raw request body. Verification compares the exact bytes and is case-sensitive. Re-encoding JSON, even with only whitespace changes, changes the signature. An empty secret returns {:error, :no_webhook_secret}.

The signature has no authenticated timestamp. A ComplyCube declaration cannot use replay_window_seconds; that combination is rejected at compile time. Durable event identity and idempotent business actions remain necessary for repeated deliveries.

parse_event_type/1 maps known type strings to pre-existing atoms. Unknown types return {:error, :unknown_event_type} and ingress records a permanent failure with error_class: "unknown_event_type". A new type requires an updated provider type map or your own AshHooks.Provider implementation.

handle_event/2 returns an AshHooks.Provider.ComplyCube.Event. To execute application actions during ingress, delegate signature verification and type parsing to this module and implement an idempotent handler in your provider.