Chokepoint disruption alert (outbound, signed)

WorldMonitor POSTs this event to the callbackUrl you register via RegisterWebhook when a subscribed chokepoint's disruption score is at or above your alertThreshold (and its live signals above minLiveSignal when set), once per crossing, including one already in progress at first evaluation. It re-arms below the threshold unless a score input missing since the last delivery could explain the drop. Failures retry every 5 minutes with the same X-WM-Delivery-Id while the score holds; 5 failed ticks deactivate the webhook. Full rules at https://www.worldmonitor.app/docs/api-shipping-v2#delivery-worker.

Verify X-WM-Signature-V2 in constant time against sha256= + hex(HMAC-SHA256(key=secret, message=timestamp.deliveryId.event.rawRequestBody)). Use the exact header strings and raw body bytes. Use secret verbatim; do not hex-decode it or re-serialize JSON. Reject missing or malformed headers and timestamps more than 300 seconds in the past or future. Require V2; never fall back to the legacy body-only signature. Atomically dedupe verified delivery ids for the subscription lifetime. Retries keep the id but refresh the timestamp and signature. Respond with any 2xx to acknowledge receipt.