import hashlib
import hmac


def verify_meta_signature(app_secret: str, raw_body: bytes, signature_header: str | None) -> bool:
    """Validate X-Hub-Signature-256 from Meta webhook POSTs."""
    if not app_secret or not signature_header:
        return False
    if not signature_header.startswith("sha256="):
        return False
    expected = signature_header.removeprefix("sha256=")
    computed = hmac.new(app_secret.encode("utf-8"), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(computed, expected)