@commercetools/cli-topic-integration-layer 0.0.0 → 0.2.1

package/dist/commands/integration-layer/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/commands/integration-layer/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEnD,oFAAoF;AACpF,sFAAsF;AACtF,8EAA8E;AAC9E,MAAM,cAAc,GAA2B;IAC7C,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCrB;IACC,cAAc,EAAE;;;;;;;;;;;;;;;;CAgBjB;IACC,eAAe,EAAE;;;;;;;;;;;CAWlB;IACC,cAAc,EAAE;;;;CAIjB;IACC,YAAY,EAAE;;;CAGf;IACC,WAAW,EAAE;;;;;;;;;;;CAWd;CACA,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,IAAK,SAAQ,OAAO;IACvC,MAAM,CAAU,WAAW,GAAG,iEAAiE,CAAC;IAEhG,MAAM,CAAU,QAAQ,GAAG;QACzB,uDAAuD;QACvD,wEAAwE;KACzE,CAAC;IAEF,MAAM,CAAU,IAAI,GAAG;QACrB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,4BAA4B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACtF,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,CAAC,OAAO,CAAC;YAClB,OAAO,EAAE,OAAO;SACjB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACnB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAE3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,0DAA0D,CAAC,CAAC;QAC1F,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,QAAQ,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IAChE,CAAC"}

package/dist/commands/integration-layer/schema/fetch.d.ts

@@ -0,0 +1,9 @@
+import { IntegrationLayerCommand } from "../../../lib/base.js";
+export default class SchemaFetch extends IntegrationLayerCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        out: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/integration-layer/schema/fetch.js

@@ -0,0 +1,27 @@
+import { writeFile } from "node:fs/promises";
+import { Flags } from "@oclif/core";
+import { fetchSubgraphSdl } from "../../../lib/ilClient.js";
+import { IntegrationLayerCommand } from "../../../lib/base.js";
+export default class SchemaFetch extends IntegrationLayerCommand {
+    static description = "Print (or write) the project's core-subgraph SDL — the input extensions compose against";
+    static examples = [
+        "<%= config.bin %> integration-layer schema fetch",
+        "<%= config.bin %> integration-layer schema fetch --out subgraph.graphql",
+    ];
+    static flags = {
+        out: Flags.string({ description: "write the SDL to this file instead of stdout" }),
+    };
+    async run() {
+        const { flags } = await this.parse(SchemaFetch);
+        const { baseUrl, projectKey, token } = await this.resolveIlContext(flags);
+        const sdl = await fetchSubgraphSdl(baseUrl, projectKey, token);
+        if (flags.out) {
+            await writeFile(flags.out, sdl, "utf8");
+            this.log(`✓ wrote ${projectKey} core-subgraph SDL → ${flags.out}`);
+        }
+        else {
+            this.log(sdl);
+        }
+    }
+}
+//# sourceMappingURL=fetch.js.map

package/dist/commands/integration-layer/schema/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../../src/commands/integration-layer/schema/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,uBAAuB;IAC9D,MAAM,CAAU,WAAW,GACzB,yFAAyF,CAAC;IAE5F,MAAM,CAAU,QAAQ,GAAG;QACzB,kDAAkD;QAClD,yEAAyE;KAC1E,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;KACnF,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,WAAW,UAAU,wBAAwB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { defineApiExtension, approve, block, update, type ApiExtensionAction, type ApiExtensionDefinition, type ApiExtensionError, type ApiExtensionInput, type ApiExtensionResult, type ExtensionContext, type ExtensionInput, } from "./lib/tooling/apiExtension.js";

package/dist/index.js

@@ -0,0 +1,5 @@
+// oclif discovers commands from the `oclif.commands` directory (see package.json).
+// The package `main` re-exports the extension authoring API so an author can import
+// the helpers/types when writing `src/extension.ts`.
+export { defineApiExtension, approve, block, update, } from "./lib/tooling/apiExtension.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,oFAAoF;AACpF,qDAAqD;AACrD,OAAO,EACL,kBAAkB,EAClB,OAAO,EACP,KAAK,EACL,MAAM,GAQP,MAAM,+BAA+B,CAAC"}

package/dist/lib/base.d.ts

@@ -0,0 +1,50 @@
+import { AuthCommand, CtpAuthorizedClient } from "@commercetools/cli-plugin-auth";
+/** The resolved, ready-to-use integration-layer context: where to call and as whom. */
+export interface IlContext {
+    /** The integration-layer edge base URL, trailing slashes trimmed. */
+    baseUrl: string;
+    projectKey: string;
+    /** The logged-in principal's commercetools access token (the `manage_project` bearer). */
+    token: string;
+}
+/** The subset of parsed flags {@link IntegrationLayerCommand.resolveIlContext} reads. */
+export interface IlFlagValues {
+    "integration-layer-url"?: string;
+    "project-key"?: string;
+}
+/**
+ * Derive the integration-layer EXTENSIONS edge base URL from the authenticated
+ * principal's commercetools region. The extensions edge — the connector-backend pod
+ * that serves the CLI's `/<project>/subgraph` + `/<project>/extension/*` routes —
+ * follows the same host convention as the commercetools API itself
+ * (`<svc>.<region>.commercetools.com`, cf. the auth client's
+ * `auth.<region>.commercetools.com`), so a login in region `eu-central-1.aws`
+ * resolves to `https://extensions.integration-layer.eu-central-1.aws.commercetools.com`
+ * (the production host). `--integration-layer-url` / `INTEGRATION_LAYER_URL` stays
+ * the explicit override — e.g. to point at a local edge or a staging edge on the
+ * escemo/stage zone, which don't follow the production convention. Returns undefined
+ * only when the region is absent, so resolveIlContext then fails loudly.
+ */
+export declare function edgeUrlForRegion(region: string): string | undefined;
+export declare abstract class IntegrationLayerCommand extends AuthCommand {
+    /**
+     * Whether the command needs a logged-in principal. True for every command that
+     * calls the integration layer; a command that only conditionally reaches it (e.g.
+     * `serve` in standalone mode) sets this false and relies on {@link resolveIlContext}
+     * to fail loudly if the network path is actually taken.
+     */
+    protected authorized: boolean;
+    static baseFlags: {
+        "integration-layer-url": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        "project-key": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    protected init(): Promise<void>;
+    /** The logged-in commercetools principal, or an `AuthorizationError` pointing at `auth login`. */
+    protected requirePrincipal(): CtpAuthorizedClient;
+    /**
+     * Resolve the integration-layer base URL + project key from the login context and
+     * take the principal's access token as the bearer. Fails loudly (no defensive
+     * defaults) when a required value is absent.
+     */
+    protected resolveIlContext(flags: IlFlagValues): Promise<IlContext>;
+}

package/dist/lib/base.js

@@ -0,0 +1,85 @@
+// Base class for the topic's commands that reach the integration layer's
+// `manage_project` boundary. It extends the host CLI's `AuthCommand`
+// (`@commercetools/cli-plugin-auth`), so the bearer is the token
+// `commercetools auth login` already persisted to `~/.commercetools/credentials`
+// (loaded into the security context by the auth plugin's prerun hook) — no separate
+// credential handling, exactly as the `connect` topic does.
+//
+// `@commercetools/cli-plugin-auth` is a PEER dependency: at runtime the plugin uses
+// the HOST CLI's copy, so the static auth manager/repository the host wires up are
+// the same singletons this class reads (a bundled second copy would see an empty
+// security context and reject every logged-in caller).
+import { Flags } from "@oclif/core";
+import { AuthCommand, AuthorizationError, CtpAuthorizedClient, } from "@commercetools/cli-plugin-auth";
+/**
+ * Derive the integration-layer EXTENSIONS edge base URL from the authenticated
+ * principal's commercetools region. The extensions edge — the connector-backend pod
+ * that serves the CLI's `/<project>/subgraph` + `/<project>/extension/*` routes —
+ * follows the same host convention as the commercetools API itself
+ * (`<svc>.<region>.commercetools.com`, cf. the auth client's
+ * `auth.<region>.commercetools.com`), so a login in region `eu-central-1.aws`
+ * resolves to `https://extensions.integration-layer.eu-central-1.aws.commercetools.com`
+ * (the production host). `--integration-layer-url` / `INTEGRATION_LAYER_URL` stays
+ * the explicit override — e.g. to point at a local edge or a staging edge on the
+ * escemo/stage zone, which don't follow the production convention. Returns undefined
+ * only when the region is absent, so resolveIlContext then fails loudly.
+ */
+export function edgeUrlForRegion(region) {
+    const trimmed = region.trim();
+    if (!trimmed)
+        return undefined;
+    return `https://extensions.integration-layer.${trimmed}.commercetools.com`;
+}
+export class IntegrationLayerCommand extends AuthCommand {
+    /**
+     * Whether the command needs a logged-in principal. True for every command that
+     * calls the integration layer; a command that only conditionally reaches it (e.g.
+     * `serve` in standalone mode) sets this false and relies on {@link resolveIlContext}
+     * to fail loudly if the network path is actually taken.
+     */
+    authorized = true;
+    static baseFlags = {
+        "integration-layer-url": Flags.string({
+            description: "integration-layer extensions edge base URL (also settable via INTEGRATION_LAYER_URL); overrides the URL derived from your login region",
+            env: "INTEGRATION_LAYER_URL",
+            helpGroup: "INTEGRATION LAYER",
+        }),
+        "project-key": Flags.string({
+            description: "override the logged-in project key",
+            helpGroup: "INTEGRATION LAYER",
+        }),
+    };
+    async init() {
+        await super.init();
+        if (this.authorized)
+            this.requirePrincipal();
+    }
+    /** The logged-in commercetools principal, or an `AuthorizationError` pointing at `auth login`. */
+    requirePrincipal() {
+        const principal = this.getAuthentication()?.getPrincipal();
+        if (principal instanceof CtpAuthorizedClient)
+            return principal;
+        throw new AuthorizationError("not logged in — run `commercetools auth login` first");
+    }
+    /**
+     * Resolve the integration-layer base URL + project key from the login context and
+     * take the principal's access token as the bearer. Fails loudly (no defensive
+     * defaults) when a required value is absent.
+     */
+    async resolveIlContext(flags) {
+        const principal = this.requirePrincipal();
+        const token = principal.getAccessToken().getTokenValue();
+        const projectKey = flags["project-key"] ?? principal.getProjectKey();
+        if (!projectKey) {
+            throw new Error("no project key — log in with `commercetools auth login --project-key <key>` or pass --project-key");
+        }
+        const baseUrl = flags["integration-layer-url"] ?? edgeUrlForRegion(principal.getRegion());
+        if (!baseUrl) {
+            throw new Error("could not resolve the integration layer URL: pass --integration-layer-url or set " +
+                "INTEGRATION_LAYER_URL (the extensions edge base, e.g. " +
+                "https://extensions.integration-layer.eu-central-1.aws.commercetools.com)");
+        }
+        return { baseUrl: baseUrl.replace(/\/+$/, ""), projectKey, token };
+    }
+}
+//# sourceMappingURL=base.js.map

package/dist/lib/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/lib/base.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,qEAAqE;AACrE,iEAAiE;AACjE,iFAAiF;AACjF,oFAAoF;AACpF,4DAA4D;AAC5D,EAAE;AACF,oFAAoF;AACpF,mFAAmF;AACnF,iFAAiF;AACjF,uDAAuD;AAEvD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAiBxC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,wCAAwC,OAAO,oBAAoB,CAAC;AAC7E,CAAC;AAED,MAAM,OAAgB,uBAAwB,SAAQ,WAAW;IAC/D;;;;;OAKG;IACO,UAAU,GAAG,IAAI,CAAC;IAE5B,MAAM,CAAU,SAAS,GAAG;QAC1B,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC;YACpC,WAAW,EACT,wIAAwI;YAC1I,GAAG,EAAE,uBAAuB;YAC5B,SAAS,EAAE,mBAAmB;SAC/B,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC;YAC1B,WAAW,EAAE,oCAAoC;YACjD,SAAS,EAAE,mBAAmB;SAC/B,CAAC;KACH,CAAC;IAEiB,KAAK,CAAC,IAAI;QAC3B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC;IAED,kGAAkG;IACxF,gBAAgB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC;QAC3D,IAAI,SAAS,YAAY,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAC/D,MAAM,IAAI,kBAAkB,CAAC,sDAAsD,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC;QAEzD,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;QACrE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,uBAAuB,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACjF,wDAAwD;gBACxD,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC"}

package/dist/lib/ilClient.d.ts

@@ -0,0 +1,49 @@
+/** A single {key,value,secret} entry of a project's extension config (secret values redacted on read). */
+export interface ConfigEntry {
+    key: string;
+    value: string | null;
+    secret: boolean;
+}
+/** The stored bundle's metadata (integration layer `ExtensionMeta`). */
+export interface ExtensionMeta {
+    projectKey: string;
+    length: number;
+    uploadedAt: number;
+    version: number;
+    updatedBy?: string;
+    filename?: string;
+}
+export interface BreakingChange {
+    type: string;
+    description: string;
+}
+export interface RemoteValidationResult {
+    valid: boolean;
+    composes: boolean;
+    compositionErrors: string[];
+    breakingChanges: BreakingChange[];
+    /** False when no published baseline was available, so the breaking check was skipped. */
+    comparedToPublished: boolean;
+}
+/** GET the project's raw core-subgraph SDL — the compose input (`GET …/subgraph`). */
+export declare function fetchSubgraphSdl(baseUrl: string, projectKey: string, token: string): Promise<string>;
+/** POST a candidate SDL to the composition + breaking-change gate (`POST …/extension/validate`). */
+export declare function remoteValidate(baseUrl: string, projectKey: string, token: string, typeDefs: string): Promise<RemoteValidationResult>;
+/** Upload the built bundle, replacing the project's stored one (`PUT …/extension/bundle`). */
+export declare function pushBundle(baseUrl: string, projectKey: string, token: string, bundle: string, filename: string): Promise<ExtensionMeta>;
+/** The stored bundle's metadata, or null if none is stored (`GET …/extension/bundle/meta`). */
+export declare function fetchExtensionMeta(baseUrl: string, projectKey: string, token: string): Promise<ExtensionMeta | null>;
+/** Remove the project's extension subgraph from Hive (`DELETE …/extension/subgraph`). */
+export declare function deleteExtensionSubgraph(baseUrl: string, projectKey: string, token: string): Promise<void>;
+/** List the project's extension config entries, secret values redacted (`GET …/extension/config`). */
+export declare function listConfig(baseUrl: string, projectKey: string, token: string): Promise<ConfigEntry[]>;
+/**
+ * Upsert/delete config entries and return the resulting (redacted) list
+ * (`PATCH …/extension/config`). An entry with `value: null` deletes that key. PATCH
+ * (not PUT) so a single set/unset touches one key without clobbering the rest.
+ */
+export declare function patchConfig(baseUrl: string, projectKey: string, token: string, entries: Array<{
+    key: string;
+    value: string | null;
+    secret?: boolean;
+}>): Promise<ConfigEntry[]>;

package/dist/lib/ilClient.js

@@ -0,0 +1,108 @@
+// Low-level HTTP client for the integration layer's per-project manage-surface
+// routes. Every call is parameterised by (baseUrl, projectKey, token) — the command
+// layer resolves those (`IntegrationLayerCommand.resolveIlContext`, whose token is the
+// `commercetools auth login` principal's) and this module just speaks the wire
+// protocol. The route bodies these mirror live in the integration
+// layer's `routes/manage.ts`; the request/response shapes here are extracted from the
+// `ee-ext` tooling's `remoteValidate.ts` / `push.ts` (which read them from env) and
+// the remaining manage routes (config, status, delete, subgraph).
+function apiRoot(baseUrl, projectKey) {
+    return `${baseUrl.replace(/\/+$/, "")}/${encodeURIComponent(projectKey)}`;
+}
+function bearer(token) {
+    return { Authorization: `Bearer ${token}` };
+}
+/** GET the project's raw core-subgraph SDL — the compose input (`GET …/subgraph`). */
+export async function fetchSubgraphSdl(baseUrl, projectKey, token) {
+    const url = `${apiRoot(baseUrl, projectKey)}/subgraph`;
+    const res = await fetch(url, { headers: { accept: "text/plain", ...bearer(token) } });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`could not fetch core-subgraph SDL (${res.status}) from ${url}: ${text}`);
+    }
+    return text;
+}
+/** POST a candidate SDL to the composition + breaking-change gate (`POST …/extension/validate`). */
+export async function remoteValidate(baseUrl, projectKey, token, typeDefs) {
+    const url = `${apiRoot(baseUrl, projectKey)}/extension/validate`;
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...bearer(token) },
+        body: JSON.stringify({ typeDefs }),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`schema validation request failed (${res.status}): ${text}`);
+    }
+    return JSON.parse(text);
+}
+/** Upload the built bundle, replacing the project's stored one (`PUT …/extension/bundle`). */
+export async function pushBundle(baseUrl, projectKey, token, bundle, filename) {
+    const url = `${apiRoot(baseUrl, projectKey)}/extension/bundle`;
+    const res = await fetch(url, {
+        method: "PUT",
+        headers: {
+            "Content-Type": "text/javascript",
+            // The route requires the original filename (percent-encoded; it carries the
+            // module's type). The bundle is plain CommonJS, so name it `.cjs`.
+            "x-extension-filename": encodeURIComponent(filename),
+            ...bearer(token),
+        },
+        body: bundle,
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`PUT extension/bundle failed (${res.status}): ${text}`);
+    }
+    return JSON.parse(text);
+}
+/** The stored bundle's metadata, or null if none is stored (`GET …/extension/bundle/meta`). */
+export async function fetchExtensionMeta(baseUrl, projectKey, token) {
+    const url = `${apiRoot(baseUrl, projectKey)}/extension/bundle/meta`;
+    const res = await fetch(url, { headers: { accept: "application/json", ...bearer(token) } });
+    if (res.status === 404)
+        return null;
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`GET extension/bundle/meta failed (${res.status}): ${text}`);
+    }
+    return JSON.parse(text);
+}
+/** Remove the project's extension subgraph from Hive (`DELETE …/extension/subgraph`). */
+export async function deleteExtensionSubgraph(baseUrl, projectKey, token) {
+    const url = `${apiRoot(baseUrl, projectKey)}/extension/subgraph`;
+    const res = await fetch(url, { method: "DELETE", headers: { ...bearer(token) } });
+    if (!res.ok && res.status !== 204) {
+        const text = await res.text();
+        throw new Error(`DELETE extension/subgraph failed (${res.status}): ${text}`);
+    }
+}
+/** List the project's extension config entries, secret values redacted (`GET …/extension/config`). */
+export async function listConfig(baseUrl, projectKey, token) {
+    const url = `${apiRoot(baseUrl, projectKey)}/extension/config`;
+    const res = await fetch(url, { headers: { accept: "application/json", ...bearer(token) } });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`GET extension/config failed (${res.status}): ${text}`);
+    }
+    return JSON.parse(text);
+}
+/**
+ * Upsert/delete config entries and return the resulting (redacted) list
+ * (`PATCH …/extension/config`). An entry with `value: null` deletes that key. PATCH
+ * (not PUT) so a single set/unset touches one key without clobbering the rest.
+ */
+export async function patchConfig(baseUrl, projectKey, token, entries) {
+    const url = `${apiRoot(baseUrl, projectKey)}/extension/config`;
+    const res = await fetch(url, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json", ...bearer(token) },
+        body: JSON.stringify(entries),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`PATCH extension/config failed (${res.status}): ${text}`);
+    }
+    return JSON.parse(text);
+}
+//# sourceMappingURL=ilClient.js.map

package/dist/lib/ilClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ilClient.js","sourceRoot":"","sources":["../../src/lib/ilClient.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,oFAAoF;AACpF,uFAAuF;AACvF,+EAA+E;AAC/E,kEAAkE;AAClE,sFAAsF;AACtF,oFAAoF;AACpF,kEAAkE;AAiClE,SAAS,OAAO,CAAC,OAAe,EAAE,UAAkB;IAClD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,UAAkB,EAClB,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE;QACjE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;AACpD,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,MAAc,EACd,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,iBAAiB;YACjC,4EAA4E;YAC5E,mEAAmE;YACnE,sBAAsB,EAAE,kBAAkB,CAAC,QAAQ,CAAC;YACpD,GAAG,MAAM,CAAC,KAAK,CAAC;SACjB;QACD,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,UAAkB,EAClB,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,wBAAwB,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,UAAkB,EAClB,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,UAAkB,EAClB,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,OAAuE;IAEvE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE;QACjE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC"}

package/dist/lib/tooling/apiExtension.d.ts

@@ -0,0 +1,31 @@
+import type { ExtensionAction, ExtensionInput } from '@commercetools/platform-sdk';
+export type { ExtensionInput };
+export type ApiExtensionAction = Extract<ExtensionAction, 'Create' | 'Update'>;
+export interface ExtensionContext {
+    now(): number;
+    config: Readonly<Record<string, string>>;
+}
+export type ApiExtensionInput = ExtensionInput;
+export interface ApiExtensionError {
+    code: string;
+    message: string;
+}
+export type ApiExtensionResult = void | {
+    actions?: unknown[];
+    errors?: ApiExtensionError[];
+};
+export interface ApiExtensionDefinition {
+    key: string;
+    resourceTypeId: string;
+    actions: ApiExtensionAction[];
+    condition?: string;
+    handler: (input: ApiExtensionInput, ctx: ExtensionContext) => ApiExtensionResult | Promise<ApiExtensionResult>;
+}
+/** Identity helper — declare an API-Extension handler, type-checked against the SDK payload. */
+export declare function defineApiExtension(definition: ApiExtensionDefinition): ApiExtensionDefinition;
+/** Approve the write unchanged. */
+export declare function approve(): ApiExtensionResult;
+/** Block the write with a validation error (commercetools returns it to the caller). */
+export declare function block(code: string, message: string): ApiExtensionResult;
+/** Apply commercetools update actions to the triggering resource. */
+export declare function update(actions: unknown[]): ApiExtensionResult;

package/dist/lib/tooling/apiExtension.js

@@ -0,0 +1,39 @@
+// Authoring API for commercetools API Extensions.
+//
+// Copied verbatim from commercetools/integration-layer-extension-examples
+// (packages/tooling/src/apiExtension.ts). An API Extension is the commercetools
+// platform feature: a synchronous HTTP callback commercetools makes before
+// persisting a cart/order/… create or update, which can approve, modify, or BLOCK
+// the write. This is a DIFFERENT thing from a GraphQL schema extension (typeDefs +
+// resolvers), which adds fields to the graph. A bundle may export `apiExtensions`,
+// `typeDefs`/`resolvers`, or both.
+//
+// A handler is a plain function `(input, ctx) => result`. Use `defineApiExtension`
+// for type checking and the `approve` / `block` / `update` helpers to return intent
+// instead of hand-rolling the wire shape. The runtime (the sandbox) maps the result
+// to commercetools' response contract.
+//
+// The RECEIVED payload is the commercetools SDK's own `ExtensionInput` — you don't
+// define the resource types. Its `resource` is the discriminated `Reference` union,
+// so narrowing on `input.resource.typeId === 'cart'` gives you `resource.obj` typed
+// as the real `Cart` (and so on). These are type-only imports (erased by the
+// bundler), so they add nothing to the pushed bundle. The SDK does NOT model the
+// RESPONSE envelope (approve/block/actions is an HTTP contract, not a resource), so
+// `ApiExtensionResult` / `ApiExtensionError` below stay local.
+/** Identity helper — declare an API-Extension handler, type-checked against the SDK payload. */
+export function defineApiExtension(definition) {
+    return definition;
+}
+/** Approve the write unchanged. */
+export function approve() {
+    return {};
+}
+/** Block the write with a validation error (commercetools returns it to the caller). */
+export function block(code, message) {
+    return { errors: [{ code, message }] };
+}
+/** Apply commercetools update actions to the triggering resource. */
+export function update(actions) {
+    return { actions };
+}
+//# sourceMappingURL=apiExtension.js.map

package/dist/lib/tooling/apiExtension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiExtension.js","sourceRoot":"","sources":["../../../src/lib/tooling/apiExtension.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,2EAA2E;AAC3E,kFAAkF;AAClF,mFAAmF;AACnF,mFAAmF;AACnF,mCAAmC;AACnC,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,oFAAoF;AACpF,uCAAuC;AACvC,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,oFAAoF;AACpF,6EAA6E;AAC7E,iFAAiF;AACjF,oFAAoF;AACpF,+DAA+D;AA+C/D,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAAC,UAAkC;IACnE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,OAAO;IACrB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,OAAe;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,MAAM,CAAC,OAAkB;IACvC,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/dist/lib/tooling/build.d.ts

@@ -0,0 +1,18 @@
+/** Peer modules the runtime owns — bundled never, resolved at load time. */
+export declare const HOST_PROVIDED_EXTERNALS: string[];
+/** The extension source of the example the tool is invoked inside (cwd-relative). */
+export declare function defaultEntry(): string;
+/** The bundle output for the example the tool is invoked inside (cwd-relative). */
+export declare function defaultOutfile(): string;
+export interface BuildResult {
+    /** Absolute path to the bundled artifact. */
+    outfile: string;
+    /**
+     * The author's own source files that went into the bundle (entry + local
+     * imports), absolute paths. npm packages are excluded — these feed the static
+     * analyzer, which only checks code the author wrote.
+     */
+    sourceFiles: string[];
+}
+/** Bundle `entry` into a single self-contained CJS file at `outfile`. */
+export declare function buildBundle(entry?: string, outfile?: string): Promise<BuildResult>;

package/dist/lib/tooling/build.js

@@ -0,0 +1,54 @@
+// Bundle an extension source into a single self-contained CommonJS artifact.
+//
+// Copied from commercetools/integration-layer-extension-examples
+// (packages/tooling/src/build.ts) — a LOW-LEVEL function reused verbatim; the
+// argv/env-driven `buildCommand` wrapper is NOT copied (this plugin's oclif command
+// is the wrapper). esbuild bundles local helper modules inline. The output is
+// CommonJS so the runtime can evaluate it as a script and read `module.exports`.
+// `platform: "neutral"` keeps Node built-ins out (an import of one fails the build,
+// not at load time), and `conditions: ["worker"]` steers a bundled SDK to its
+// fetch-based build (the runtime provides a global `fetch`, not Node `http`/`https`).
+// `graphql` stays EXTERNAL — the runtime supplies its single instance; a second
+// inlined copy would break its `instanceof` checks.
+import { build } from "esbuild";
+import { join, resolve } from "node:path";
+import process from "node:process";
+/** Peer modules the runtime owns — bundled never, resolved at load time. */
+export const HOST_PROVIDED_EXTERNALS = ["graphql"];
+/** The extension source of the example the tool is invoked inside (cwd-relative). */
+export function defaultEntry() {
+    return join(process.cwd(), "src", "extension.ts");
+}
+/** The bundle output for the example the tool is invoked inside (cwd-relative). */
+export function defaultOutfile() {
+    return join(process.cwd(), "dist", "extension.js");
+}
+/** Bundle `entry` into a single self-contained CJS file at `outfile`. */
+export async function buildBundle(entry = defaultEntry(), outfile = defaultOutfile()) {
+    const result = await build({
+        entryPoints: [entry],
+        outfile,
+        bundle: true,
+        format: "cjs",
+        platform: "neutral",
+        target: "node22",
+        conditions: ["worker"],
+        // `platform: "neutral"` leaves `mainFields` empty, so a package that ships only
+        // classic `main`/`module` fields (no `exports`) — e.g. `@commercetools/ts-client`
+        // / `@commercetools/platform-sdk`, which an extension reaches for to read CT from
+        // a resolver — is otherwise unresolvable ("Could not resolve"). Preferring
+        // `module` (the fetch-based ESM build, no Node built-ins) then `main` fixes that;
+        // packages that DO declare `exports` (e.g. algoliasearch) resolve through it and
+        // ignore this. (ILEE's build.ts lacks this line — its examples don't hit the case;
+        // keep the two in sync when it's added there.)
+        mainFields: ["module", "main"],
+        external: HOST_PROVIDED_EXTERNALS,
+        metafile: true,
+        logLevel: "silent",
+    });
+    const sourceFiles = Object.keys(result.metafile.inputs)
+        .filter((input) => !input.includes("node_modules"))
+        .map((input) => resolve(process.cwd(), input));
+    return { outfile, sourceFiles };
+}
+//# sourceMappingURL=build.js.map

package/dist/lib/tooling/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/lib/tooling/build.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,iEAAiE;AACjE,8EAA8E;AAC9E,oFAAoF;AACpF,8EAA8E;AAC9E,iFAAiF;AACjF,oFAAoF;AACpF,8EAA8E;AAC9E,sFAAsF;AACtF,gFAAgF;AAChF,oDAAoD;AAEpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,SAAS,CAAC,CAAC;AAEnD,qFAAqF;AACrF,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;AACpD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACrD,CAAC;AAaD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,YAAY,EAAE,EAC9B,UAAkB,cAAc,EAAE;IAElC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,WAAW,EAAE,CAAC,KAAK,CAAC;QACpB,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,gFAAgF;QAChF,kFAAkF;QAClF,kFAAkF;QAClF,2EAA2E;QAC3E,kFAAkF;QAClF,iFAAiF;QACjF,mFAAmF;QACnF,+CAA+C;QAC/C,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;SACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/tooling/compose.d.ts

@@ -0,0 +1,28 @@
+import { type GraphQLSchema } from "graphql";
+/** The subgraph names the integration layer composes under — matched here so the
+ *  local composition mirrors the deployed one. `integration-layer` is the name an
+ *  extension's `@override(from: …)` references. */
+export declare const INTEGRATION_LAYER_SERVICE = "integration-layer";
+export declare const EXTENSION_SERVICE = "extensions";
+export type ComposeResult = {
+    ok: true;
+    /** The client-facing API schema (federation directives stripped), browsable. */
+    apiSchema: GraphQLSchema;
+    /** Printed API-schema SDL — "what the full schema looks like" to a consumer. */
+    apiSdl: string;
+    /** The raw composed supergraph SDL the router plans against. */
+    supergraphSdl: string;
+} | {
+    ok: false;
+    errors: string[];
+};
+/**
+ * Compose the integration layer + the extension into a supergraph and derive the
+ * client-facing API schema. Never throws — a composition failure comes back in
+ * `errors` so the dev server can surface it and keep serving. The URLs are baked into
+ * the supergraph so `--gateway` routes correctly; for `--compose` they're cosmetic.
+ */
+export declare function composeWithIntegrationLayer(integrationLayerSdl: string, extensionSdl: string, urls: {
+    integrationLayerUrl: string;
+    extensionUrl: string;
+}): ComposeResult;

package/dist/lib/tooling/compose.js

@@ -0,0 +1,48 @@
+// Compose the local extension subgraph with the project's live integration-layer
+// subgraph — the same two-subgraph composition the integration layer runs on publish.
+//
+// The LOW-LEVEL `composeWithIntegrationLayer` is copied verbatim from
+// commercetools/integration-layer-extension-examples (packages/tooling/src/compose.ts).
+// The env/token-minting `fetchIntegrationLayerSubgraphSdl` wrapper is NOT copied —
+// fetching the project's subgraph SDL is a plain authenticated HTTP call, so it lives
+// in `../ilClient.ts` parameterised by (baseUrl, projectKey, token), and the command
+// layer supplies the token.
+import { parse, printSchema } from "graphql";
+import { composeServices } from "@apollo/composition";
+/** The subgraph names the integration layer composes under — matched here so the
+ *  local composition mirrors the deployed one. `integration-layer` is the name an
+ *  extension's `@override(from: …)` references. */
+export const INTEGRATION_LAYER_SERVICE = "integration-layer";
+export const EXTENSION_SERVICE = "extensions";
+/**
+ * Compose the integration layer + the extension into a supergraph and derive the
+ * client-facing API schema. Never throws — a composition failure comes back in
+ * `errors` so the dev server can surface it and keep serving. The URLs are baked into
+ * the supergraph so `--gateway` routes correctly; for `--compose` they're cosmetic.
+ */
+export function composeWithIntegrationLayer(integrationLayerSdl, extensionSdl, urls) {
+    let services;
+    try {
+        services = [
+            { name: INTEGRATION_LAYER_SERVICE, typeDefs: parse(integrationLayerSdl), url: urls.integrationLayerUrl },
+            { name: EXTENSION_SERVICE, typeDefs: parse(extensionSdl), url: urls.extensionUrl },
+        ];
+    }
+    catch (err) {
+        return { ok: false, errors: [`SDL is not valid GraphQL: ${err.message}`] };
+    }
+    const result = composeServices(services);
+    // `errors` is the discriminant of the composition-failure variant; its presence
+    // narrows `result` to the success variant (with `schema` + `supergraphSdl`).
+    if (result.errors) {
+        return { ok: false, errors: result.errors.map((e) => e.message) };
+    }
+    const apiSchema = result.schema.toAPISchema().toGraphQLJSSchema();
+    return {
+        ok: true,
+        apiSchema,
+        apiSdl: printSchema(apiSchema),
+        supergraphSdl: result.supergraphSdl,
+    };
+}
+//# sourceMappingURL=compose.js.map

package/dist/lib/tooling/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../../src/lib/tooling/compose.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,sFAAsF;AACtF,EAAE;AACF,sEAAsE;AACtE,wFAAwF;AACxF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,4BAA4B;AAE5B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAsB,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;mDAEmD;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAc9C;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,mBAA2B,EAC3B,YAAoB,EACpB,IAA2D;IAE3D,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG;YACT,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,mBAAmB,EAAE;YACxG,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;SACnF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,gFAAgF;IAChF,6EAA6E;IAC7E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC"}