Fix webhook verification

[LarsenCundric]

Summary by cubic

Fix webhook signature verification by signing the full webhook body (event.data), not just the payload. This matches the sender’s scheme and prevents false “invalid signature” errors.

• Bug Fixes

  • Compute HMAC over the entire body; createWebhookSignature now accepts body instead of payload. If you call this directly, update your argument key.

• Dependencies

  • Move zod to runtime dependencies in package.json and .fern/metadata.json.

^{Written for commit 9e50659. Summary will update automatically on new commits.}

[cubic-dev-ai]

No issues found across 3 files