export function transform(req: WebhookRequest): TransformResult {
  // verify stripe signature
  const sig = req.headers["stripe-signature"];
  const expected = repost.crypto.hmac(
    "sha256",
    process.env.STRIPE_SECRET,
    req.body,
  );

  if (!repost.crypto.timingSafeEqual(sig, expected)) {
    return { discard: true };
  }

  // mint a downstream auth token
  const token = repost.jwt.sign(
    {
      sub: req.body.customer.id,
      evt: req.body.type,
    },
    process.env.INTERNAL_JWT_KEY,
    { algorithm: "HS256", expiresIn: "30s" },
  );

  return {
    path: "/v2/billing/events",
    headers: {
      ...req.headers,
      authorization: `Bearer ${token}`,
    },
    body: {
      ...req.body,
      processedAt: req.receivedAt,
    },
  };
}