"""Verify the AMLOK v1.4.2 signature against exact raw request bytes."""
import hashlib
import hmac
import json
import math
import re
import time


def verify_webhook(raw_body, header, secret, now_seconds=None):
    """Return a verified envelope. Caller must persist/deduplicate before 2xx."""
    if not isinstance(raw_body, bytes) or not isinstance(header, str) or not isinstance(secret, str) or not secret:
        raise ValueError("Invalid webhook verification inputs")
    timestamps, signatures = [], []
    for entry in header.split(","):
        pair = entry.strip().split("=")
        if len(pair) != 2:
            raise ValueError("Malformed signature header")
        key, value = pair
        if key == "t":
            timestamps.append(value)
        elif key == "v1":
            signatures.append(value)
    if (len(timestamps) != 1 or not re.fullmatch(r"[0-9]+", timestamps[0]) or
            not signatures or any(not re.fullmatch(r"[a-fA-F0-9]{64}", value) for value in signatures)):
        raise ValueError("Malformed signature header")
    timestamp = int(timestamps[0])
    now = time.time() if now_seconds is None else now_seconds
    if not math.isfinite(now) or abs(now - timestamp) > 300:
        raise ValueError("Webhook timestamp outside the five-minute tolerance")
    signed = timestamps[0].encode("ascii") + b"." + raw_body
    expected = hmac.new(secret.encode("utf-8"), signed, hashlib.sha256).digest()
    if not any(hmac.compare_digest(expected, bytes.fromhex(value)) for value in signatures):
        raise ValueError("Invalid webhook signature")
    event = json.loads(raw_body)
    if (not isinstance(event, dict) or not isinstance(event.get("id"), str) or not event["id"] or
            not isinstance(event.get("type"), str) or not isinstance(event.get("resource_id"), str) or
            type(event.get("resource_version")) is not int):
        raise ValueError("Invalid webhook envelope")
    return event