export default async function handler(event, ctx) {
  // event: the same envelope as a webhook — { id, type, store_id, data: { object }, livemode, ... }
  //        or, for a sync hook, the hook input (cart / rate quote / order draft).
  // ctx:   { secrets, fetch, log, store_id, environment }
  const token = await ctx.secrets.get('threepl_key');       // resolves an alias to a vaulted secret
  const res = await ctx.fetch('https://my-3pl.example.com/rates', {
    method: 'POST',
    headers: { authorization: `Bearer ${token}` },
    body: JSON.stringify({ to: event.address_to, parcel: event.parcel }),
  });
  const quote = await res.json();
  ctx.log('3pl quote', quote.amount);                        // captured into your run log
  return {
    rates: [{
      rate_id: quote.id, provider: 'My3PL', service: quote.service,
      amount: quote.amount, currency: quote.currency, estimated_days: quote.eta,
    }],
  };
}

// Your endpoint — e.g. an Express route on your own infrastructure
import { createHmac, timingSafeEqual } from 'crypto';

app.post('/gc/tax', express.raw({ type: 'application/json' }), (req, res) => {
  const ts = req.headers['x-timestamp'];
  const sig = req.headers['x-signature'];
  const rawBody = req.body.toString();

  // No signature at all → reject. Never treat "absent" as "not required".
  if (!sig || !ts) return res.status(401).json({ error: 'unsigned request' });

  // Reject anything older than 5 minutes (replay protection). X-Timestamp is in MILLISECONDS.
  if (Math.abs(Date.now() - Number(ts)) > 5 * 60 * 1000) {
    return res.status(401).json({ error: 'stale timestamp' });
  }

  // Sign the RAW header string and the RAW body — not a re-serialised object.
  const expected = createHmac('sha256', process.env.GC_EXTENSION_SECRET)
    .update(`${ts}.${rawBody}`)
    .digest('base64');
  const sigBuf = Buffer.from(String(sig));
  const expBuf = Buffer.from(expected);
  if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) {
    return res.status(401).json({ error: 'bad signature' });
  }

  const input = JSON.parse(rawBody);
  // input.operation === 'resolve' for TaxProvider — return the contract shape:
  res.json({ tax_amount: 8.25, breakdown: [{ jurisdiction: 'CA', amount: 8.25 }] });
});

POST https://api.tybritelabs.com/v1/extensions/{extension_id}/callback/{callback_token}

app.post('/gc/social', express.raw({ type: 'application/json' }), async (req, res) => {
  // Verify X-Signature exactly as in the example above, then:
  const input = JSON.parse(req.body.toString());
  const RULES = { max_images: 4, max_videos: 0, carousel: true, caption_max: 2000,
                  link_supported: true, text_only: true, media_only: false };

  switch (input.operation) {
    case 'listDestinations':
      return res.json({ destinations: [{ external_id: 'announcements', display_name: 'Announcements',
                                         meta: { rules: RULES } }] });
    case 'rules':
      return res.json({ rules: RULES });
    case 'publish': {
      const content = [input.caption, input.link].filter(Boolean).join('\n\n');
      const r = await fetch(`${process.env.DISCORD_WEBHOOK_URL}?wait=true`, {
        method: 'POST', headers: { 'content-type': 'application/json' },
        body: JSON.stringify({ content, allowed_mentions: { parse: [] },
          embeds: input.media.filter((m) => m.kind === 'image').map((m) => ({ image: { url: m.url } })) }),
      });
      if (r.status === 401 || r.status === 404) return res.json({ ok: false, reconnect: true });
      if (!r.ok) return res.json({ ok: false, permanent: r.status < 500 && r.status !== 429 });
      const msg = await r.json();
      return res.json({ ok: true, provider_post_id: msg.id });
    }
    case 'insights':
      return res.json({ metrics: [] });
  }
});

// A remote SubscriptionBillingProvider — verify the signature first (see above), then:
switch (input.operation) {
  case 'createSubscription': {
    // amount_cents is server-resolved from the agency's price catalogue. Charge THAT — a different
    // amount is a tampering attempt and is revalidated.
    const sub = await myGateway.subscriptions.create({
      email: input.subscriber_email,
      amount: input.amount_cents,
      currency: input.currency,
      returnUrl: input.return_url,
    });
    return {
      subscription_id: sub.id,
      status: sub.status,          // your provider's state
      redirect_url: sub.approveUrl, // where the merchant approves the mandate
      provider: 'my_gateway',
    };
  }
  case 'getSubscription':
    // Report what your provider ACTUALLY says. Do not assume 'active'.
    return { subscription_id: input.subscription_id, status: (await myGateway.get(input.subscription_id)).status, provider: 'my_gateway' };
  case 'cancelSubscription':
    await myGateway.cancel(input.subscription_id);
    return { subscription_id: input.subscription_id, status: 'cancelled', provider: 'my_gateway' };
}