@commercetools/cli-topic-integration-layer 0.0.0 → 0.2.2

package/dist/lib/tooling/build.js

@@ -0,0 +1,54 @@
+// Bundle an extension source into a single self-contained CommonJS artifact.
+//
+// Copied from commercetools/integration-layer-extension-examples
+// (packages/tooling/src/build.ts) — a LOW-LEVEL function reused verbatim; the
+// argv/env-driven `buildCommand` wrapper is NOT copied (this plugin's oclif command
+// is the wrapper). esbuild bundles local helper modules inline. The output is
+// CommonJS so the runtime can evaluate it as a script and read `module.exports`.
+// `platform: "neutral"` keeps Node built-ins out (an import of one fails the build,
+// not at load time), and `conditions: ["worker"]` steers a bundled SDK to its
+// fetch-based build (the runtime provides a global `fetch`, not Node `http`/`https`).
+// `graphql` stays EXTERNAL — the runtime supplies its single instance; a second
+// inlined copy would break its `instanceof` checks.
+import { build } from "esbuild";
+import { join, resolve } from "node:path";
+import process from "node:process";
+/** Peer modules the runtime owns — bundled never, resolved at load time. */
+export const HOST_PROVIDED_EXTERNALS = ["graphql"];
+/** The extension source of the example the tool is invoked inside (cwd-relative). */
+export function defaultEntry() {
+    return join(process.cwd(), "src", "extension.ts");
+}
+/** The bundle output for the example the tool is invoked inside (cwd-relative). */
+export function defaultOutfile() {
+    return join(process.cwd(), "dist", "extension.js");
+}
+/** Bundle `entry` into a single self-contained CJS file at `outfile`. */
+export async function buildBundle(entry = defaultEntry(), outfile = defaultOutfile()) {
+    const result = await build({
+        entryPoints: [entry],
+        outfile,
+        bundle: true,
+        format: "cjs",
+        platform: "neutral",
+        target: "node22",
+        conditions: ["worker"],
+        // `platform: "neutral"` leaves `mainFields` empty, so a package that ships only
+        // classic `main`/`module` fields (no `exports`) — e.g. `@commercetools/ts-client`
+        // / `@commercetools/platform-sdk`, which an extension reaches for to read CT from
+        // a resolver — is otherwise unresolvable ("Could not resolve"). Preferring
+        // `module` (the fetch-based ESM build, no Node built-ins) then `main` fixes that;
+        // packages that DO declare `exports` (e.g. algoliasearch) resolve through it and
+        // ignore this. (ILEE's build.ts lacks this line — its examples don't hit the case;
+        // keep the two in sync when it's added there.)
+        mainFields: ["module", "main"],
+        external: HOST_PROVIDED_EXTERNALS,
+        metafile: true,
+        logLevel: "silent",
+    });
+    const sourceFiles = Object.keys(result.metafile.inputs)
+        .filter((input) => !input.includes("node_modules"))
+        .map((input) => resolve(process.cwd(), input));
+    return { outfile, sourceFiles };
+}
+//# sourceMappingURL=build.js.map

package/dist/lib/tooling/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/lib/tooling/build.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,iEAAiE;AACjE,8EAA8E;AAC9E,oFAAoF;AACpF,8EAA8E;AAC9E,iFAAiF;AACjF,oFAAoF;AACpF,8EAA8E;AAC9E,sFAAsF;AACtF,gFAAgF;AAChF,oDAAoD;AAEpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,SAAS,CAAC,CAAC;AAEnD,qFAAqF;AACrF,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;AACpD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACrD,CAAC;AAaD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,YAAY,EAAE,EAC9B,UAAkB,cAAc,EAAE;IAElC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,WAAW,EAAE,CAAC,KAAK,CAAC;QACpB,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,gFAAgF;QAChF,kFAAkF;QAClF,kFAAkF;QAClF,2EAA2E;QAC3E,kFAAkF;QAClF,iFAAiF;QACjF,mFAAmF;QACnF,+CAA+C;QAC/C,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;SACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/tooling/compose.d.ts

@@ -0,0 +1,28 @@
+import { type GraphQLSchema } from "graphql";
+/** The subgraph names the integration layer composes under — matched here so the
+ *  local composition mirrors the deployed one. `integration-layer` is the name an
+ *  extension's `@override(from: …)` references. */
+export declare const INTEGRATION_LAYER_SERVICE = "integration-layer";
+export declare const EXTENSION_SERVICE = "extensions";
+export type ComposeResult = {
+    ok: true;
+    /** The client-facing API schema (federation directives stripped), browsable. */
+    apiSchema: GraphQLSchema;
+    /** Printed API-schema SDL — "what the full schema looks like" to a consumer. */
+    apiSdl: string;
+    /** The raw composed supergraph SDL the router plans against. */
+    supergraphSdl: string;
+} | {
+    ok: false;
+    errors: string[];
+};
+/**
+ * Compose the integration layer + the extension into a supergraph and derive the
+ * client-facing API schema. Never throws — a composition failure comes back in
+ * `errors` so the dev server can surface it and keep serving. The URLs are baked into
+ * the supergraph so `--gateway` routes correctly; for `--compose` they're cosmetic.
+ */
+export declare function composeWithIntegrationLayer(integrationLayerSdl: string, extensionSdl: string, urls: {
+    integrationLayerUrl: string;
+    extensionUrl: string;
+}): ComposeResult;

package/dist/lib/tooling/compose.js

@@ -0,0 +1,48 @@
+// Compose the local extension subgraph with the project's live integration-layer
+// subgraph — the same two-subgraph composition the integration layer runs on publish.
+//
+// The LOW-LEVEL `composeWithIntegrationLayer` is copied verbatim from
+// commercetools/integration-layer-extension-examples (packages/tooling/src/compose.ts).
+// The env/token-minting `fetchIntegrationLayerSubgraphSdl` wrapper is NOT copied —
+// fetching the project's subgraph SDL is a plain authenticated HTTP call, so it lives
+// in `../ilClient.ts` parameterised by (baseUrl, projectKey, token), and the command
+// layer supplies the token.
+import { parse, printSchema } from "graphql";
+import { composeServices } from "@apollo/composition";
+/** The subgraph names the integration layer composes under — matched here so the
+ *  local composition mirrors the deployed one. `integration-layer` is the name an
+ *  extension's `@override(from: …)` references. */
+export const INTEGRATION_LAYER_SERVICE = "integration-layer";
+export const EXTENSION_SERVICE = "extensions";
+/**
+ * Compose the integration layer + the extension into a supergraph and derive the
+ * client-facing API schema. Never throws — a composition failure comes back in
+ * `errors` so the dev server can surface it and keep serving. The URLs are baked into
+ * the supergraph so `--gateway` routes correctly; for `--compose` they're cosmetic.
+ */
+export function composeWithIntegrationLayer(integrationLayerSdl, extensionSdl, urls) {
+    let services;
+    try {
+        services = [
+            { name: INTEGRATION_LAYER_SERVICE, typeDefs: parse(integrationLayerSdl), url: urls.integrationLayerUrl },
+            { name: EXTENSION_SERVICE, typeDefs: parse(extensionSdl), url: urls.extensionUrl },
+        ];
+    }
+    catch (err) {
+        return { ok: false, errors: [`SDL is not valid GraphQL: ${err.message}`] };
+    }
+    const result = composeServices(services);
+    // `errors` is the discriminant of the composition-failure variant; its presence
+    // narrows `result` to the success variant (with `schema` + `supergraphSdl`).
+    if (result.errors) {
+        return { ok: false, errors: result.errors.map((e) => e.message) };
+    }
+    const apiSchema = result.schema.toAPISchema().toGraphQLJSSchema();
+    return {
+        ok: true,
+        apiSchema,
+        apiSdl: printSchema(apiSchema),
+        supergraphSdl: result.supergraphSdl,
+    };
+}
+//# sourceMappingURL=compose.js.map

package/dist/lib/tooling/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../../src/lib/tooling/compose.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,sFAAsF;AACtF,EAAE;AACF,sEAAsE;AACtE,wFAAwF;AACxF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,4BAA4B;AAE5B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAsB,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;mDAEmD;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAc9C;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,mBAA2B,EAC3B,YAAoB,EACpB,IAA2D;IAE3D,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG;YACT,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,mBAAmB,EAAE;YACxG,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;SACnF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,gFAAgF;IAChF,6EAA6E;IAC7E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC"}

package/dist/lib/tooling/extensions.d.ts

@@ -0,0 +1,77 @@
+import { type GraphQLSchema } from "graphql";
+/** An extension package discovered under the workspace's extensions/ directory. */
+export interface DiscoveredExtension {
+    /** The package/directory name (used only for messages — the combined subgraph has one name). */
+    name: string;
+    /** The extension source entry (`<dir>/src/extension.ts`). */
+    entry: string;
+    /** The esbuild bundle output for a standalone build (`<dir>/dist/extension.js`). */
+    outfile: string;
+}
+/**
+ * Discover every extension package under `<root>/<dirName>` that has a
+ * `src/extension.ts`. Sorted by name for stable, deterministic merge output.
+ */
+export declare function discoverExtensions(root: string, dirName: string): Promise<DiscoveredExtension[]>;
+/** One extension's contribution to the combined subgraph. */
+export interface ExtensionModule {
+    name: string;
+    typeDefs: string;
+    resolvers: object;
+}
+/** The single subgraph all extensions merge into. */
+export interface MergedSubgraph {
+    /** Executable subgraph schema (typeDefs + wired resolvers) — for serving. */
+    schema: GraphQLSchema;
+    /** Federation SDL of the merged subgraph — for composing with the core / publishing. */
+    sdl: string;
+}
+/**
+ * Merge several extension modules into ONE federation subgraph — the single bundle a
+ * project deploys. Each extension's SDL is a self-contained subgraph (its own
+ * `type Query`, its own `@link` header), so we can't just concatenate them
+ * (`buildSubgraphSchema` would see two `type Query`). `mergeTypeDefs` folds same-named
+ * types into one — so two extensions can each contribute fields to `Query` — and dedupes
+ * the repeated `@link`.
+ *
+ * First we reject two extensions declaring the SAME field (even identically): merged into
+ * one bundle their resolvers would silently shadow each other, so it's an authoring error
+ * we name loudly rather than paper over. The merged SDL is printed with
+ * `printSubgraphSchema`, so it round-trips as the exact federation SDL the IL validates /
+ * publishes for the deployed bundle.
+ */
+export declare function mergeExtensionSubgraph(modules: ExtensionModule[]): MergedSubgraph;
+/** Result of a combined build — the same shape {@link buildBundle} returns. */
+export interface CombinedBuildResult {
+    /** Absolute path to the single combined bundle. */
+    outfile: string;
+    /** The authors' source files that went into it (for static analysis; excludes the generated entry). */
+    sourceFiles: string[];
+}
+/**
+ * Build ONE combined bundle from every discovered extension — the artifact `push`
+ * uploads. Each extension is bundled + loaded to read its `typeDefs` (merged into one
+ * SDL, so a clash fails here on the author's machine) and to be re-imported by a
+ * generated entry that, at load time, merges the resolvers (per type, then per field),
+ * concatenates `apiExtensions`, and merges `hooks`. That entry is then bundled into the
+ * final self-contained artifact — a faithful stand-in for the single deployed bundle.
+ */
+export declare function buildCombinedBundle(extensions: DiscoveredExtension[], outfile: string): Promise<CombinedBuildResult>;
+/** What {@link bundleForFlags} produced, plus a label for the command's log line. */
+export interface BundleForFlags extends CombinedBuildResult {
+    /** Human description of what was bundled (the entry, or "N extension(s) (…)"). */
+    describe: string;
+}
+/**
+ * The single build step shared by `build`/`validate`/`push`: bundle either the one
+ * extension in the cwd (default) or — with `--all` — every extension under
+ * `<extensionsDir>/*` merged into the one combined bundle a project deploys. Throws a
+ * clean message when `--all` finds nothing to build.
+ */
+export declare function bundleForFlags(opts: {
+    all: boolean;
+    extensionsDir: string;
+    entry: string;
+    out: string;
+    cwd?: string;
+}): Promise<BundleForFlags>;

package/dist/lib/tooling/extensions.js

@@ -0,0 +1,209 @@
+// Monorepo helpers for the "one bundle per project" model. In production a project
+// has a SINGLE extension bundle = one federation subgraph (all of a repo's extensions
+// merged), which the router then composes with the integration-layer core subgraph.
+// So a monorepo of `extensions/*` packages must:
+//   - MERGE into one subgraph for local `serve --all` (mergeExtensionSubgraph), and
+//   - BUILD into one bundle for `build/validate/push --all` (buildCombinedBundle),
+// never one-subgraph-per-extension (that's not the deployed shape).
+import { readdir, readFile, stat, writeFile, mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import process from "node:process";
+import { buildSubgraphSchema, printSubgraphSchema } from "@apollo/subgraph";
+import { mergeTypeDefs } from "@graphql-tools/merge";
+import { Kind, parse } from "graphql";
+import { buildBundle } from "./build.js";
+import { loadBundleSource } from "./loadBundle.js";
+/**
+ * Discover every extension package under `<root>/<dirName>` that has a
+ * `src/extension.ts`. Sorted by name for stable, deterministic merge output.
+ */
+export async function discoverExtensions(root, dirName) {
+    const base = join(root, dirName);
+    const dirents = await readdir(base, { withFileTypes: true }).catch(() => []);
+    const found = [];
+    for (const dirent of dirents) {
+        if (!dirent.isDirectory())
+            continue;
+        const entry = join(base, dirent.name, "src", "extension.ts");
+        const hasEntry = await stat(entry)
+            .then((s) => s.isFile())
+            .catch(() => false);
+        if (!hasEntry)
+            continue;
+        found.push({
+            name: dirent.name,
+            entry,
+            outfile: join(base, dirent.name, "dist", "extension.js"),
+        });
+    }
+    return found.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Collect `Type.field` keys an SDL declares on object/interface types (incl. extensions). */
+function declaredFields(sdl) {
+    const out = [];
+    for (const def of parse(sdl).definitions) {
+        if (def.kind === Kind.OBJECT_TYPE_DEFINITION ||
+            def.kind === Kind.OBJECT_TYPE_EXTENSION ||
+            def.kind === Kind.INTERFACE_TYPE_DEFINITION ||
+            def.kind === Kind.INTERFACE_TYPE_EXTENSION) {
+            for (const f of def.fields ?? [])
+                out.push({ type: def.name.value, field: f.name.value });
+        }
+    }
+    return out;
+}
+/**
+ * Merge several extension modules into ONE federation subgraph — the single bundle a
+ * project deploys. Each extension's SDL is a self-contained subgraph (its own
+ * `type Query`, its own `@link` header), so we can't just concatenate them
+ * (`buildSubgraphSchema` would see two `type Query`). `mergeTypeDefs` folds same-named
+ * types into one — so two extensions can each contribute fields to `Query` — and dedupes
+ * the repeated `@link`.
+ *
+ * First we reject two extensions declaring the SAME field (even identically): merged into
+ * one bundle their resolvers would silently shadow each other, so it's an authoring error
+ * we name loudly rather than paper over. The merged SDL is printed with
+ * `printSubgraphSchema`, so it round-trips as the exact federation SDL the IL validates /
+ * publishes for the deployed bundle.
+ */
+export function mergeExtensionSubgraph(modules) {
+    if (modules.length === 0) {
+        throw new Error("no extension exports a GraphQL subgraph (typeDefs) to merge");
+    }
+    const resolvers = {};
+    const sdls = [];
+    const owner = new Map(); // "Type.field" -> first extension that declared it
+    for (const m of modules) {
+        if (typeof m.typeDefs !== "string" || m.typeDefs.trim() === "") {
+            throw new Error(`extension '${m.name}' must export a non-empty \`typeDefs\` string`);
+        }
+        if (m.resolvers === null || typeof m.resolvers !== "object") {
+            throw new Error(`extension '${m.name}' with \`typeDefs\` must also export a \`resolvers\` object`);
+        }
+        let fields;
+        try {
+            fields = declaredFields(m.typeDefs);
+        }
+        catch (err) {
+            throw new Error(`extension '${m.name}' has invalid \`typeDefs\`: ${err.message}`);
+        }
+        for (const { type, field } of fields) {
+            const key = `${type}.${field}`;
+            const prev = owner.get(key);
+            if (prev !== undefined && prev !== m.name) {
+                throw new Error(`extensions '${prev}' and '${m.name}' both declare \`${key}\` — a project ships one bundle, so each field must be owned by a single extension`);
+            }
+            owner.set(key, m.name);
+        }
+        sdls.push(m.typeDefs);
+        // Merge resolvers per type then per field — the same shape the combined bundle uses.
+        for (const [type, fieldResolvers] of Object.entries(m.resolvers)) {
+            resolvers[type] = Object.assign(resolvers[type] ?? {}, fieldResolvers);
+        }
+    }
+    let schema;
+    try {
+        // `mergeTypeDefs` folds the per-extension subgraphs into one document. `@apollo/subgraph`
+        // types `resolvers` as its internal `GraphQLResolverMap`; cast through the param type.
+        const typeDefs = mergeTypeDefs(sdls);
+        schema = buildSubgraphSchema({ typeDefs, resolvers });
+    }
+    catch (err) {
+        throw new Error(`extensions do not merge into a single subgraph: ${err.message}`);
+    }
+    return { schema, sdl: printSubgraphSchema(schema) };
+}
+/**
+ * Build ONE combined bundle from every discovered extension — the artifact `push`
+ * uploads. Each extension is bundled + loaded to read its `typeDefs` (merged into one
+ * SDL, so a clash fails here on the author's machine) and to be re-imported by a
+ * generated entry that, at load time, merges the resolvers (per type, then per field),
+ * concatenates `apiExtensions`, and merges `hooks`. That entry is then bundled into the
+ * final self-contained artifact — a faithful stand-in for the single deployed bundle.
+ */
+export async function buildCombinedBundle(extensions, outfile) {
+    if (extensions.length === 0) {
+        throw new Error("no extensions to build");
+    }
+    // 1. Bundle + load each extension to read its exported subgraph (typeDefs/resolvers).
+    const tmp = await mkdtemp(join(tmpdir(), "il-combine-"));
+    const loaded = [];
+    for (const ext of extensions) {
+        const out = join(tmp, `${ext.name}.js`);
+        await buildBundle(ext.entry, out);
+        loaded.push({ name: ext.name, module: loadBundleSource(await readFile(out, "utf8")) });
+    }
+    // 2. Merge the subgraph-bearing extensions into one SDL (conflict detection). An
+    //    extension may be API-extensions-only (no typeDefs) — those contribute no SDL.
+    const withSubgraph = loaded.filter((l) => typeof l.module.typeDefs === "string" && l.module.typeDefs.trim() !== "");
+    const mergedSdl = withSubgraph.length > 0
+        ? mergeExtensionSubgraph(withSubgraph.map((l) => ({
+            name: l.name,
+            typeDefs: l.module.typeDefs,
+            resolvers: l.module.resolvers ?? {},
+        }))).sdl
+        : undefined;
+    // 3. Generate the combining entry: re-import each extension, merge at load time.
+    const imports = extensions
+        .map((e, i) => `import * as e${i} from ${JSON.stringify(e.entry)};`)
+        .join("\n");
+    const modulesArray = `[${extensions.map((_, i) => `e${i}`).join(", ")}]`;
+    const entrySource = `${imports}
+
+const __modules = ${modulesArray};
+
+${mergedSdl !== undefined ? `export const typeDefs = ${JSON.stringify(mergedSdl)};` : ""}
+
+const __mergeResolvers = (mods) => {
+  const out = {};
+  for (const m of mods) {
+    const r = m && m.resolvers;
+    if (!r || typeof r !== "object") continue;
+    for (const type of Object.keys(r)) {
+      out[type] = Object.assign(out[type] ?? {}, r[type]);
+    }
+  }
+  return out;
+};
+
+export const resolvers = __mergeResolvers(__modules);
+export const apiExtensions = __modules.flatMap((m) =>
+  m && Array.isArray(m.apiExtensions) ? m.apiExtensions : [],
+);
+export const hooks = Object.assign(
+  {},
+  ...__modules.map((m) => (m && m.hooks && typeof m.hooks === "object" ? m.hooks : {})),
+);
+`;
+    const entryPath = join(tmp, "combined-entry.ts");
+    await writeFile(entryPath, entrySource, "utf8");
+    // 4. Bundle the generated entry into the single artifact. Its imported author sources
+    //    feed static analysis; the generated entry itself is trusted, so drop it.
+    const { sourceFiles } = await buildBundle(entryPath, outfile);
+    const generated = resolve(entryPath);
+    return { outfile, sourceFiles: sourceFiles.filter((f) => resolve(f) !== generated) };
+}
+/**
+ * The single build step shared by `build`/`validate`/`push`: bundle either the one
+ * extension in the cwd (default) or — with `--all` — every extension under
+ * `<extensionsDir>/*` merged into the one combined bundle a project deploys. Throws a
+ * clean message when `--all` finds nothing to build.
+ */
+export async function bundleForFlags(opts) {
+    if (!opts.all) {
+        const { outfile, sourceFiles } = await buildBundle(opts.entry, opts.out);
+        return { outfile, sourceFiles, describe: opts.entry };
+    }
+    const extensions = await discoverExtensions(opts.cwd ?? process.cwd(), opts.extensionsDir);
+    if (extensions.length === 0) {
+        throw new Error(`no extensions found under ./${opts.extensionsDir}/*/src/extension.ts — run --all from the monorepo root`);
+    }
+    const { outfile, sourceFiles } = await buildCombinedBundle(extensions, opts.out);
+    return {
+        outfile,
+        sourceFiles,
+        describe: `${extensions.length} extension(s) (${extensions.map((e) => e.name).join(", ")})`,
+    };
+}
+//# sourceMappingURL=extensions.js.map

package/dist/lib/tooling/extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../src/lib/tooling/extensions.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,sFAAsF;AACtF,oFAAoF;AACpF,iDAAiD;AACjD,oFAAoF;AACpF,mFAAmF;AACnF,oEAAoE;AAEpE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAsB,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAwB,MAAM,iBAAiB,CAAC;AAYzE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,OAAe;IAEf,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;aAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACvB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAiBD,8FAA8F;AAC9F,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,IACE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,sBAAsB;YACxC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,qBAAqB;YACvC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,yBAAyB;YAC3C,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,wBAAwB,EAC1C,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,SAAS,GAA4C,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,mDAAmD;IAC5F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,+CAA+C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,6DAA6D,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,UAAU,CAAC,CAAC,IAAI,oBAAoB,GAAG,oFAAoF,CAC/I,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtB,qFAAqF;QACrF,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAoC,CAAC,EAAE,CAAC;YAC5F,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAyC,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,0FAA0F;QAC1F,uFAAuF;QACvF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAE9C,CAAC,CAAC;IACR,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mDAAoD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;AACtD,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAiC,EACjC,OAAe;IAEf,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,sFAAsF;IACtF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAgD,EAAE,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;QACxC,MAAM,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAK,CAAC,CAAC,MAAM,CAAC,QAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,CAC5F,CAAC;IACF,MAAM,SAAS,GACb,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,sBAAsB,CACpB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAkB;YACrC,SAAS,EAAG,CAAC,CAAC,MAAM,CAAC,SAAgC,IAAI,EAAE;SAC5D,CAAC,CAAC,CACJ,CAAC,GAAG;QACP,CAAC,CAAC,SAAS,CAAC;IAEhB,iFAAiF;IACjF,MAAM,OAAO,GAAG,UAAU;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SACnE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACzE,MAAM,WAAW,GAAG,GAAG,OAAO;;oBAEZ,YAAY;;EAE9B,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBvF,CAAC;IACA,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACjD,MAAM,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAEhD,sFAAsF;IACtF,8EAA8E;IAC9E,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;AACvF,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAMpC;IACC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,aAAa,wDAAwD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,OAAO;QACL,OAAO;QACP,WAAW;QACX,QAAQ,EAAE,GAAG,UAAU,CAAC,MAAM,kBAAkB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KAC5F,CAAC;AACJ,CAAC"}

package/dist/lib/tooling/gateway.d.ts

@@ -0,0 +1,21 @@
+import { ApolloGateway } from "@apollo/gateway";
+/**
+ * Mint an anonymous session and return its bearer token. The gateway attaches it to
+ * every integration-layer subgraph request; the integration layer 403s a bearer
+ * whose project doesn't match the URL, so an anonymous session is the minimum needed
+ * to route real queries through. (A 30-day sliding TTL easily outlasts a dev session.)
+ */
+export declare function mintAnonymousSession(integrationLayerUrl: string, projectKey: string): Promise<string>;
+export interface GatewayOptions {
+    /** The composed supergraph the planner routes against (from `composeWithIntegrationLayer`). */
+    supergraphSdl: string;
+    /** Anonymous session bearer, attached to the integration-layer data source's requests. */
+    integrationLayerBearer: string;
+}
+/**
+ * Build and load an Apollo Gateway over the composed supergraph. Each subgraph is an
+ * HTTP data source addressed by its baked URL; the integration-layer one carries the
+ * session bearer. Resolves once the gateway has loaded its query planner. Call
+ * `.stop()` on the returned gateway when replacing it (on a schema change).
+ */
+export declare function makeGateway(opts: GatewayOptions): Promise<ApolloGateway>;

package/dist/lib/tooling/gateway.js

@@ -0,0 +1,65 @@
+// The `--gateway` half of the local dev server: an executable merged schema that
+// routes each field to its owner — the local extension and the project's deployed
+// integration layer — so a query like `{ product(id:…) { name loyaltyPoints(price:…) }}`
+// resolves `name` from the integration layer and `loyaltyPoints` from the local
+// extension in one request, the production topology in miniature.
+//
+// Copied verbatim from commercetools/integration-layer-extension-examples
+// (packages/tooling/src/gateway.ts). We use Apollo Gateway (the reference Federation
+// implementation) because the extension model leans on `@interfaceObject` and only
+// the reference gateway resolves that correctly. Both subgraphs are reached over
+// HTTP, so the extension runs as a genuine subgraph; the integration-layer data
+// source carries an anonymous session bearer (the integration layer re-validates the
+// bearer's project against the URL).
+import { ApolloGateway, RemoteGraphQLDataSource } from "@apollo/gateway";
+import { INTEGRATION_LAYER_SERVICE } from "./compose.js";
+/**
+ * Mint an anonymous session and return its bearer token. The gateway attaches it to
+ * every integration-layer subgraph request; the integration layer 403s a bearer
+ * whose project doesn't match the URL, so an anonymous session is the minimum needed
+ * to route real queries through. (A 30-day sliding TTL easily outlasts a dev session.)
+ */
+export async function mintAnonymousSession(integrationLayerUrl, projectKey) {
+    const base = integrationLayerUrl.replace(/\/+$/, "");
+    const url = `${base}/${encodeURIComponent(projectKey)}/session`;
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ grant_type: "anonymous" }),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`could not mint an anonymous session (${res.status}) at ${url}: ${text}`);
+    }
+    const token = JSON.parse(text).token;
+    if (!token)
+        throw new Error("token response had no `token`");
+    return token;
+}
+/**
+ * Build and load an Apollo Gateway over the composed supergraph. Each subgraph is an
+ * HTTP data source addressed by its baked URL; the integration-layer one carries the
+ * session bearer. Resolves once the gateway has loaded its query planner. Call
+ * `.stop()` on the returned gateway when replacing it (on a schema change).
+ */
+export async function makeGateway(opts) {
+    const gateway = new ApolloGateway({
+        supergraphSdl: opts.supergraphSdl,
+        buildService: ({ name, url }) => new RemoteGraphQLDataSource({
+            url,
+            // Use Node's global `fetch` (undici) for every data source; Apollo Gateway's
+            // default fetcher breaks its agent selection in some environments.
+            fetcher: globalThis.fetch,
+            willSendRequest: ({ request }) => {
+                // Authenticate only the integration-layer subgraph; the extension subgraph
+                // is the dev server's own internal endpoint and needs no bearer.
+                if (name === INTEGRATION_LAYER_SERVICE) {
+                    request.http?.headers.set("authorization", `Bearer ${opts.integrationLayerBearer}`);
+                }
+            },
+        }),
+    });
+    await gateway.load();
+    return gateway;
+}
+//# sourceMappingURL=gateway.js.map

package/dist/lib/tooling/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../../src/lib/tooling/gateway.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,kFAAkF;AAClF,yFAAyF;AACzF,gFAAgF;AAChF,kEAAkE;AAClE,EAAE;AACF,0EAA0E;AAC1E,qFAAqF;AACrF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAChF,qFAAqF;AACrF,qCAAqC;AAErC,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,mBAA2B,EAC3B,UAAkB;IAElB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC,KAAK,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAoB;IACpD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;QAChC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAC9B,IAAI,uBAAuB,CAAC;YAC1B,GAAG;YACH,6EAA6E;YAC7E,mEAAmE;YACnE,OAAO,EAAE,UAAU,CAAC,KAAsD;YAC1E,eAAe,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC/B,2EAA2E;gBAC3E,iEAAiE;gBACjE,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;oBACvC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;SACF,CAAC;KACL,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/tooling/loadBundle.d.ts

@@ -0,0 +1,10 @@
+export interface EvaluatedBundle {
+    typeDefs?: unknown;
+    resolvers?: unknown;
+    apiExtensions?: unknown;
+}
+/**
+ * Evaluate an esbuild-CJS extension bundle and return its `module.exports`.
+ * `require` resolves only `graphql`; any other module id throws.
+ */
+export declare function loadBundleSource(source: string): EvaluatedBundle;

package/dist/lib/tooling/loadBundle.js

@@ -0,0 +1,27 @@
+// Load a built extension bundle and return its exported `typeDefs` + `resolvers`,
+// used by the resolver-coherence check and the local dev server.
+//
+// Copied verbatim from commercetools/integration-layer-extension-examples
+// (packages/tooling/src/loadBundle.ts). The bundle is esbuild's single-file
+// CommonJS artifact, so we evaluate it with the CommonJS calling convention and a
+// `require` that resolves only `graphql` (a second copy would break `instanceof`).
+// It runs as an ordinary module — not a security boundary; the runtime enforces
+// that, and `staticAnalysis.ts` screens the source first.
+import { GraphQLError } from "graphql";
+/**
+ * Evaluate an esbuild-CJS extension bundle and return its `module.exports`.
+ * `require` resolves only `graphql`; any other module id throws.
+ */
+export function loadBundleSource(source) {
+    const moduleObject = { exports: {} };
+    const requireShim = (id) => {
+        if (id === "graphql")
+            return { GraphQLError };
+        throw new Error(`extension bundle may not require "${id}"`);
+    };
+    // The CommonJS wrapper: bind `module`/`exports`/`require` and run the source.
+    const evaluate = new Function("module", "exports", "require", source);
+    evaluate(moduleObject, moduleObject.exports, requireShim);
+    return moduleObject.exports;
+}
+//# sourceMappingURL=loadBundle.js.map

package/dist/lib/tooling/loadBundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadBundle.js","sourceRoot":"","sources":["../../../src/lib/tooling/loadBundle.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,iEAAiE;AACjE,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,kFAAkF;AAClF,mFAAmF;AACnF,gFAAgF;AAChF,0DAA0D;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAUvC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,YAAY,GAAiC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnE,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE;QAC1C,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACtE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,OAAO,YAAY,CAAC,OAAO,CAAC;AAC9B,CAAC"}

package/dist/lib/tooling/staticAnalysis.d.ts

@@ -0,0 +1,11 @@
+export interface AnalysisIssue {
+    file: string;
+    line: number;
+    message: string;
+}
+/**
+ * Analyse the given source files (the author's entry + its local imports) and
+ * return every runtime-incompatibility issue found. An empty array means the source
+ * is clean of the patterns this checks.
+ */
+export declare function analyzeSources(files: string[]): Promise<AnalysisIssue[]>;