bade5289b6
## Summary - Restructures the `CloudflareSecretMatchGuard` to properly validate the `cf-webhook-auth` header before performing the comparison — checks for missing, empty, or mismatched-length values first - Removes `@ts-expect-error` workarounds with explicit typed header access - Expands test coverage with additional edge cases (missing header, wrong value, empty string, length mismatch) ## Test plan - [x] Unit tests pass (6 tests covering matching, missing config, missing header, wrong value, empty string, length mismatch) Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>