HTTP Bot HMAC Signer (sources/http_bot_signing.py)

Dependency-free HMAC-SHA256 signing/verification utility for authenticating inbound/outbound requests in the HTTP Bot adapter, including replay-window checks via timestamp.

# Source: https://github.com/langbot-app/LangBot | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
# Provided via justclaw.it.com; keep this notice with the code.
"""HMAC signing utilities for the HTTP Bot adapter.

A dependency-free, symmetric HMAC-SHA256 scheme used in *both* directions:

    signing_string = "{timestamp}." + raw_body_bytes
    signature      = "sha256=" + hex(HMAC_SHA256(secret, signing_string))

Inbound requests are signed by the caller and verified here; outbound
callbacks are signed here and verified by the caller. The scheme is trivial to
reproduce in any language (see docs/platforms/http-bot.md for JS/curl).
"""

from __future__ import annotations

import hashlib
import hmac
import time

# Header names (kept here so adapt

... (truncated -- full source via MCP)