export default async function handler(event, ctx) {
  // event: the same envelope as a webhook — { id, type, store_id, data: { object }, livemode, ... }
  //        or, for a sync hook, the hook input (cart / rate quote / order draft).
  // ctx:   { secrets, fetch, log, store_id, environment }
  const token = await ctx.secrets.get('threepl_key');       // resolves an alias to a vaulted secret
  const res = await ctx.fetch('https://my-3pl.example.com/rates', {
    method: 'POST',
    headers: { authorization: `Bearer ${token}` },
    body: JSON.stringify({ to: event.address_to, parcel: event.parcel }),
  });
  const quote = await res.json();
  ctx.log('3pl quote', quote.amount);                        // captured into your run log
  return {
    rates: [{
      rate_id: quote.id, provider: 'My3PL', service: quote.service,
      amount: quote.amount, currency: quote.currency, estimated_days: quote.eta,
    }],
  };
}

// Your endpoint — e.g. an Express route on your own infrastructure
import { createHmac, timingSafeEqual } from 'crypto';

app.post('/gc/tax', express.raw({ type: 'application/json' }), (req, res) => {
  const ts = req.headers['x-timestamp'];
  const sig = req.headers['x-signature'];
  const rawBody = req.body.toString();

  // No signature at all → reject. Never treat "absent" as "not required".
  if (!sig || !ts) return res.status(401).json({ error: 'unsigned request' });

  // Reject anything older than 5 minutes (replay protection). X-Timestamp is in MILLISECONDS.
  if (Math.abs(Date.now() - Number(ts)) > 5 * 60 * 1000) {
    return res.status(401).json({ error: 'stale timestamp' });
  }

  // Sign the RAW header string and the RAW body — not a re-serialised object.
  const expected = createHmac('sha256', process.env.GC_EXTENSION_SECRET)
    .update(`${ts}.${rawBody}`)
    .digest('base64');
  const sigBuf = Buffer.from(String(sig));
  const expBuf = Buffer.from(expected);
  if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) {
    return res.status(401).json({ error: 'bad signature' });
  }

  const input = JSON.parse(rawBody);
  // input.operation === 'resolve' for TaxProvider — return the contract shape:
  res.json({ tax_amount: 8.25, breakdown: [{ jurisdiction: 'CA', amount: 8.25 }] });
});

POST https://api.tybritelabs.com/v1/extensions/{extension_id}/callback/{callback_token}

// A remote SubscriptionBillingProvider — verify the signature first (see above), then:
switch (input.operation) {
  case 'createSubscription': {
    // amount_cents is server-resolved from the agency's price catalogue. Charge THAT — a different
    // amount is a tampering attempt and is revalidated.
    const sub = await myGateway.subscriptions.create({
      email: input.subscriber_email,
      amount: input.amount_cents,
      currency: input.currency,
      returnUrl: input.return_url,
    });
    return {
      subscription_id: sub.id,
      status: sub.status,          // your provider's state
      redirect_url: sub.approveUrl, // where the merchant approves the mandate
      provider: 'my_gateway',
    };
  }
  case 'getSubscription':
    // Report what your provider ACTUALLY says. Do not assume 'active'.
    return { subscription_id: input.subscription_id, status: (await myGateway.get(input.subscription_id)).status, provider: 'my_gateway' };
  case 'cancelSubscription':
    await myGateway.cancel(input.subscription_id);
    return { subscription_id: input.subscription_id, status: 'cancelled', provider: 'my_gateway' };
}