@commercetools/cli-topic-integration-layer 0.5.1 → 0.7.0

package/dist/commands/integration-layer/schema/fetch.js

@@ -13,8 +13,8 @@ export default class SchemaFetch extends IntegrationLayerCommand {
     };
     async run() {
         const { flags } = await this.parse(SchemaFetch);
-        const { baseUrl, projectKey, token } = await this.resolveIlContext(flags);
-        const sdl = await fetchSubgraphSdl(baseUrl, projectKey, token);
+        const { baseUrl, projectKey, authFetch } = await this.resolveIlContext(flags);
+        const sdl = await fetchSubgraphSdl(baseUrl, projectKey, authFetch);
         if (flags.out) {
             await writeFile(flags.out, sdl, "utf8");
             this.log(`✓ wrote ${projectKey} core-subgraph SDL → ${flags.out}`);

package/dist/commands/integration-layer/schema/fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../../src/commands/integration-layer/schema/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,uBAAuB;IAC9D,MAAM,CAAU,WAAW,GACzB,yFAAyF,CAAC;IAE5F,MAAM,CAAU,QAAQ,GAAG;QACzB,kDAAkD;QAClD,yEAAyE;KAC1E,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;KACnF,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,WAAW,UAAU,wBAAwB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC"}
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../../src/commands/integration-layer/schema/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,uBAAuB;IAC9D,MAAM,CAAU,WAAW,GACzB,yFAAyF,CAAC;IAE5F,MAAM,CAAU,QAAQ,GAAG;QACzB,kDAAkD;QAClD,yEAAyE;KAC1E,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;KACnF,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,WAAW,UAAU,wBAAwB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC"}

package/dist/hooks/authentication.d.ts

@@ -0,0 +1,3 @@
+import type { Hook } from "@oclif/core";
+declare const authentication: Hook.Prerun;
+export default authentication;

package/dist/hooks/authentication.js

@@ -0,0 +1,33 @@
+// THE ONE HACK — and it is deliberately the only one.
+//
+// Every other topic gets its auth wiring for free: the host CLI's own `init` hook calls
+// `configureAuth(...)` and the auth plugin's `prerun` hook fills the in-memory
+// `SecurityContextHolder`, after which `AuthCommand` hands commands the logged-in
+// principal + a self-refreshing fetch. But that machinery all lives on the HOST's copy of
+// `@commercetools/cli-plugin-auth`. When this topic is installed via `oclif plugins
+// install` it lands in the oclif data dir with its OWN second copy of that module, whose
+// statics the host never touches — so `getAuthentication()` from our commands would read
+// an empty context and reject every logged-in caller ("not logged in").
+//
+// We close that gap here, and ONLY here: this prerun hook configures + fills THIS copy
+// from the same on-disk credentials file, resolved through the same bare specifier our
+// commands import, so the copy it fills is exactly the copy they read. When the topic is
+// instead bundled into the host (a single shared copy) this just re-does the host's work
+// idempotently. With this in place `base.ts` is an ordinary `AuthCommand` topic — do NOT
+// "simplify" it back to reading credentials off disk by hand.
+import { AuthCommand, SecurityContextHolder, configureAuth } from "@commercetools/cli-plugin-auth";
+import { provideAuthenticationManager, provideAuthenticationRepository, } from "../lib/auth.js";
+const authentication = async (params) => {
+    // Only our own commands need this; leave every other command's context untouched.
+    if (!(params.Command.prototype instanceof AuthCommand))
+        return;
+    const authenticationRepository = provideAuthenticationRepository();
+    configureAuth({
+        authenticationManager: provideAuthenticationManager(),
+        authenticationRepository,
+    });
+    const authentication = await authenticationRepository.loadAuthentication();
+    SecurityContextHolder.getContext().setAuthentication(authentication);
+};
+export default authentication;
+//# sourceMappingURL=authentication.js.map

package/dist/hooks/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/hooks/authentication.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,wFAAwF;AACxF,+EAA+E;AAC/E,kFAAkF;AAClF,0FAA0F;AAC1F,oFAAoF;AACpF,yFAAyF;AACzF,yFAAyF;AACzF,wEAAwE;AACxE,EAAE;AACF,uFAAuF;AACvF,uFAAuF;AACvF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,8DAA8D;AAE9D,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAGnG,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,gBAAgB,CAAC;AAExB,MAAM,cAAc,GAAgB,KAAK,EAAE,MAAM,EAAE,EAAE;IACnD,kFAAkF;IAClF,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,YAAY,WAAW,CAAC;QAAE,OAAO;IAE/D,MAAM,wBAAwB,GAAG,+BAA+B,EAAE,CAAC;IACnE,aAAa,CAAC;QACZ,qBAAqB,EAAE,4BAA4B,EAAE;QACrD,wBAAwB;KACzB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;IAC3E,qBAAqB,CAAC,UAAU,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,eAAe,cAAc,CAAC"}

package/dist/lib/auth.d.ts

@@ -0,0 +1,5 @@
+import { type AuthenticationManager, type AuthenticationRepository } from "@commercetools/cli-plugin-auth";
+/** The `client_credentials` manager that re-mints an access token from the stored secret. */
+export declare function provideAuthenticationManager(): AuthenticationManager;
+/** The repository over the shared credentials file, wired to (de)serialize the login. */
+export declare function provideAuthenticationRepository(): AuthenticationRepository;

package/dist/lib/auth.js

@@ -0,0 +1,41 @@
+// The auth-plugin wiring this topic hands to `configureAuth`, mirroring the host CLI's
+// `providers.ts` (`@commercetools/cli`) verbatim: a `client_credentials` authentication
+// manager (which re-mints an access token from the stored client id/secret when the old
+// one lapses) and a `FileBasedAuthenticationRepository` over the shared
+// `~/.commercetools/credentials` file `commercetools auth login` writes. The prerun hook
+// (`hooks/authentication.ts`) is what actually calls these; see its header for why the
+// topic has to do this itself instead of inheriting the host's copy.
+//
+// We reproduce those ~15 lines rather than import the host's, because they are NOT
+// available as a supported API. `@commercetools/cli` re-exports only `run` from its entry
+// (`src/index.ts`) — its `providers.ts` is private application wiring. The functions are
+// reachable solely by deep-importing compiled internals
+// (`@commercetools/cli/dist/providers.js`), which resolves only because that package
+// happens to declare no `exports` map — an unversioned path that can vanish on any patch.
+// Doing so would also invert the dependency graph: a topic pulling in the host CLI
+// *application* (a `bin` package) to reuse two factories. The classes composed below —
+// `CtpAuthenticationManager`, `CtpHttpAuthClient`, `FileBasedAuthenticationRepository`,
+// `CtpClientAuthenticationToken` — ARE the public exports of `@commercetools/cli-plugin-auth`
+// (the dependency we already declare), so composing them here is the supported path, not a
+// workaround: it is exactly what the host's `providers.ts` does, against the same public API.
+import os from "node:os";
+import path from "node:path";
+import { CtpAuthenticationManager, CtpClientAuthenticationToken, CtpHttpAuthClient, FileBasedAuthenticationRepository, } from "@commercetools/cli-plugin-auth";
+/**
+ * Where `commercetools auth login` persists the serialized principal, and the auth id it
+ * files the client-credentials token under. These mirror the host CLI's `providers.ts`
+ * (`@commercetools/cli`) — the on-disk credentials contract — verbatim.
+ */
+const CREDENTIALS_FILE = path.join(os.homedir(), ".commercetools", "credentials");
+const CLIENT_CREDENTIALS_AUTH_ID = "client-credentials";
+/** The `client_credentials` manager that re-mints an access token from the stored secret. */
+export function provideAuthenticationManager() {
+    return new CtpAuthenticationManager(new CtpHttpAuthClient());
+}
+/** The repository over the shared credentials file, wired to (de)serialize the login. */
+export function provideAuthenticationRepository() {
+    const repository = new FileBasedAuthenticationRepository(CREDENTIALS_FILE);
+    repository.addSerializable(CLIENT_CREDENTIALS_AUTH_ID, CtpClientAuthenticationToken, CtpClientAuthenticationToken.Serializable);
+    return repository;
+}
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,wEAAwE;AACxE,yFAAyF;AACzF,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,mFAAmF;AACnF,0FAA0F;AAC1F,yFAAyF;AACzF,wDAAwD;AACxD,qFAAqF;AACrF,0FAA0F;AAC1F,mFAAmF;AACnF,uFAAuF;AACvF,wFAAwF;AACxF,8FAA8F;AAC9F,2FAA2F;AAC3F,8FAA8F;AAE9F,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,iCAAiC,GAGlC,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAClF,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAExD,6FAA6F;AAC7F,MAAM,UAAU,4BAA4B;IAC1C,OAAO,IAAI,wBAAwB,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,+BAA+B;IAC7C,MAAM,UAAU,GAAG,IAAI,iCAAiC,CAAC,gBAAgB,CAAC,CAAC;IAC3E,UAAU,CAAC,eAAe,CACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,4BAA4B,CAAC,YAAY,CAC1C,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/lib/awaitBundleState.d.ts

@@ -1,4 +1,4 @@
-import { type ExtensionMeta } from "./ilClient.js";
+import { type AuthFetch, type ExtensionMeta } from "./ilClient.js";
 /** How the wait ended. Only `failed` means "the push produced a broken bundle". */
 export type BundleOutcome = {
     kind: "running";
@@ -30,4 +30,4 @@ export interface AwaitOptions {
  * The first read happens immediately — an extension that was already mid-poll can
  * settle the version before we ever sleep.
  */
-export declare function awaitBundleState(baseUrl: string, projectKey: string, token: string, version: number, options: AwaitOptions): Promise<BundleOutcome>;
+export declare function awaitBundleState(baseUrl: string, projectKey: string, authFetch: AuthFetch, version: number, options: AwaitOptions): Promise<BundleOutcome>;

package/dist/lib/awaitBundleState.js

@@ -28,14 +28,14 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
  * The first read happens immediately — an extension that was already mid-poll can
  * settle the version before we ever sleep.
  */
-export async function awaitBundleState(baseUrl, projectKey, token, version, options) {
+export async function awaitBundleState(baseUrl, projectKey, authFetch, version, options) {
     const sleep = options.sleep ?? defaultSleep;
     const now = options.now ?? Date.now;
     const deadline = now() + options.timeoutMs;
     for (;;) {
         let meta;
         try {
-            meta = await fetchExtensionMeta(baseUrl, projectKey, token);
+            meta = await fetchExtensionMeta(baseUrl, projectKey, authFetch);
         }
         catch (err) {
             return {

package/dist/lib/awaitBundleState.js.map

@@ -1 +1 @@
-{"version":3,"file":"awaitBundleState.js","sourceRoot":"","sources":["../../src/lib/awaitBundleState.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,mFAAmF;AACnF,+EAA+E;AAC/E,gFAAgF;AAChF,mFAAmF;AACnF,oFAAoF;AACpF,EAAE;AACF,iFAAiF;AACjF,kEAAkE;AAClE,EAAE;AACF,4CAA4C;AAC5C,EAAE;AACF,4FAA4F;AAC5F,qFAAqF;AACrF,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,qFAAqF;AACrF,2CAA2C;AAC3C,kFAAkF;AAClF,iEAAiE;AAEjE,OAAO,EAAE,kBAAkB,EAAsB,MAAM,eAAe,CAAC;AAoBvE,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CACjD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,OAAe,EACf,OAAqB;IAErB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAE3C,SAAS,CAAC;QACR,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,8CAA+C,GAAa,CAAC,OAAO,EAAE;aAC/E,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,4DAA4D;YAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,+DAA+D;gBACvE,IAAI;aACL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7B,4EAA4E;YAC5E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAE7D,iBAAiB;QACjB,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,2CAA2C,OAAO,WAAW,IAAI,CAAC,KAAK,CAC7E,OAAO,CAAC,SAAS,GAAG,IAAI,CACzB,GAAG;gBACJ,IAAI;aACL,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}
+{"version":3,"file":"awaitBundleState.js","sourceRoot":"","sources":["../../src/lib/awaitBundleState.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,mFAAmF;AACnF,+EAA+E;AAC/E,gFAAgF;AAChF,mFAAmF;AACnF,oFAAoF;AACpF,EAAE;AACF,iFAAiF;AACjF,kEAAkE;AAClE,EAAE;AACF,4CAA4C;AAC5C,EAAE;AACF,4FAA4F;AAC5F,qFAAqF;AACrF,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,qFAAqF;AACrF,2CAA2C;AAC3C,kFAAkF;AAClF,iEAAiE;AAEjE,OAAO,EAAE,kBAAkB,EAAsC,MAAM,eAAe,CAAC;AAoBvF,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CACjD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,OAAe,EACf,OAAqB;IAErB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAE3C,SAAS,CAAC;QACR,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,8CAA+C,GAAa,CAAC,OAAO,EAAE;aAC/E,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,4DAA4D;YAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,+DAA+D;gBACvE,IAAI;aACL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7B,4EAA4E;YAC5E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAE7D,iBAAiB;QACjB,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,2CAA2C,OAAO,WAAW,IAAI,CAAC,KAAK,CAC7E,OAAO,CAAC,SAAS,GAAG,IAAI,CACzB,GAAG;gBACJ,IAAI;aACL,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/lib/base.d.ts

@@ -1,18 +1,15 @@
 import { AuthCommand, CtpAuthorizedClient } from "@commercetools/cli-plugin-auth";
-/**
- * Reconstruct the logged-in principal from the persisted credentials file. Returns
- * undefined when no valid client-credentials login is on disk (absent file, or a
- * different auth kind), so unauthorized commands still run. No network. Exported for
- * tests; commands go through {@link IntegrationLayerCommand.requirePrincipal}.
- */
-export declare function loadPersistedPrincipal(credentialsFile?: string): Promise<CtpAuthorizedClient | undefined>;
 /** The resolved, ready-to-use integration-layer context: where to call and as whom. */
 export interface IlContext {
     /** The integration-layer edge base URL, trailing slashes trimmed. */
     baseUrl: string;
     projectKey: string;
-    /** The logged-in principal's commercetools access token (the `manage_project` bearer). */
-    token: string;
+    /**
+     * Authenticated fetch bound to the logged-in `manage_project` principal — it injects
+     * the bearer and transparently refreshes/retries it (`CtpAuthFetchFactory`). Hand it
+     * straight to the `ilClient` calls in place of a raw token.
+     */
+    authFetch: typeof fetch;
 }
 /** The subset of parsed flags {@link IntegrationLayerCommand.resolveIlContext} reads. */
 export interface IlFlagValues {
@@ -57,28 +54,22 @@ export declare abstract class IntegrationLayerCommand extends AuthCommand {
      */
     protected authorized: boolean;
     /**
-     * The principal loaded from `~/.commercetools/credentials` in {@link init}, or
-     * undefined when no valid login is persisted. Resolved once per command run so the
-     * synchronous {@link requirePrincipal} call sites (here and in `explore`) are unchanged.
+     * Authenticated fetch for the `manage_project` boundary — injects the bearer and
+     * refreshes/retries it. Built once in {@link init} (after the prerun hook has
+     * configured the auth plugin + filled the security context).
      */
-    private persistedPrincipal?;
+    protected authFetch: typeof fetch;
     static baseFlags: {
+        "env-file": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         "integration-layer-url": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         "project-key": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     protected init(): Promise<void>;
-    /**
-     * Read the persisted login from `~/.commercetools/credentials`. Returns undefined when
-     * no login is on disk (so unauthorized commands like standalone `serve` still run) and
-     * only fails loudly when the file is present but malformed. No network — the token was
-     * already minted by `auth login` and serialized whole.
-     */
-    private loadPersistedPrincipal;
     /** The logged-in commercetools principal, or an `AuthorizationError` pointing at `auth login`. */
     protected requirePrincipal(): CtpAuthorizedClient;
     /**
      * Resolve the integration-layer base URL + project key from the login context and
-     * take the principal's access token as the bearer. Fails loudly (no defensive
+     * hand back the authenticated fetch as the bearer. Fails loudly (no defensive
      * defaults) when a required value is absent.
      */
     protected resolveIlContext(flags: IlFlagValues): Promise<IlContext>;

package/dist/lib/base.js

@@ -1,62 +1,13 @@
 // Base class for the topic's commands that reach the Commerce Integration Layer's
-// `manage_project` boundary. The bearer is the token `commercetools auth login`
-// already persisted to `~/.commercetools/credentials`; we read it back from disk
-// here rather than from the auth plugin's in-memory security context — see below.
-//
-// `@commercetools/cli-plugin-auth` holds the security context in a MODULE-LEVEL
-// STATIC (`SecurityContextHolder.globalContext`), so there is one context per loaded
-// copy of that module. When this topic is bundled into the host CLI it resolves up
-// into the host's single copy and the static the host fills is the one we read. But
-// when the topic is installed via `oclif plugins install`, it lands in the oclif data
-// dir's own node_modules tree, npm auto-installs the declared `cli-plugin-auth` there,
-// and Node loads that as a SECOND, distinct module instance. `auth login`'s prerun
-// hook (running in the host) fills the HOST copy's static; a read via the inherited
-// `getAuthentication()` would hit the DATA-DIR copy's empty static and reject every
-// logged-in caller ("not logged in"). This is not hypothetical — it is the exact
-// failure mode that a CI symlink-dedupe workaround previously papered over.
-//
-// The cure is to stop depending on cross-copy static identity. `auth login` serializes
-// the full principal (token, region, project key, scope, expiry) to
-// `~/.commercetools/credentials` via the host CLI's `FileBasedAuthenticationRepository`.
-// We reconstruct it from that same file, from THIS module's own copy of the repository
-// — no network, no auth manager, no shared static — so it no longer matters whether one
-// or two copies of `cli-plugin-auth` are loaded. Accordingly `cli-plugin-auth` is a
-// regular `dependency`, not a peer: a second copy is now harmless. The path, auth id
-// (`"client-credentials"`), and serialized shape mirror the host CLI's
-// `providers.ts`/`init.ts` wiring exactly.
-import os from "node:os";
-import path from "node:path";
+// `manage_project` boundary. An ordinary `AuthCommand` topic: the logged-in principal
+// comes from the inherited `getAuthentication()` (the security context our prerun hook
+// fills — see `hooks/authentication.ts`), and outbound calls go through a
+// `CtpAuthFetchFactory` fetch that injects the bearer and transparently refreshes/retries
+// it, exactly like the `connect` topic. There is no bespoke credential reading here; the
+// one topic-specific concession is the prerun hook.
 import { Flags } from "@oclif/core";
-import { AuthCommand, AuthorizationError, CtpAuthorizedClient, CtpClientAuthenticationToken, FileBasedAuthenticationRepository, } from "@commercetools/cli-plugin-auth";
-/**
- * Where `commercetools auth login` persists the serialized principal, and the auth id
- * it files the client-credentials token under. These mirror the host CLI's
- * `providers.ts` (`@commercetools/cli`) — the on-disk credentials contract — verbatim.
- */
-const CREDENTIALS_FILE = path.join(os.homedir(), ".commercetools", "credentials");
-const CLIENT_CREDENTIALS_AUTH_ID = "client-credentials";
-/**
- * A `FileBasedAuthenticationRepository` over the shared credentials file, wired to
- * deserialize the client-credentials principal. Constructed from THIS module's copy of
- * `cli-plugin-auth`, so `loadAuthentication()` reconstructs the principal regardless of
- * how many copies of the auth plugin are loaded (see the header note).
- */
-function persistedAuthenticationRepository(credentialsFile) {
-    const repository = new FileBasedAuthenticationRepository(credentialsFile);
-    repository.addSerializable(CLIENT_CREDENTIALS_AUTH_ID, CtpClientAuthenticationToken, CtpClientAuthenticationToken.Serializable);
-    return repository;
-}
-/**
- * Reconstruct the logged-in principal from the persisted credentials file. Returns
- * undefined when no valid client-credentials login is on disk (absent file, or a
- * different auth kind), so unauthorized commands still run. No network. Exported for
- * tests; commands go through {@link IntegrationLayerCommand.requirePrincipal}.
- */
-export async function loadPersistedPrincipal(credentialsFile = CREDENTIALS_FILE) {
-    const authentication = await persistedAuthenticationRepository(credentialsFile).loadAuthentication();
-    const principal = authentication?.getPrincipal();
-    return principal instanceof CtpAuthorizedClient ? principal : undefined;
-}
+import { AuthCommand, AuthorizationError, CtpAuthFetchFactory, CtpAuthorizedClient, } from "@commercetools/cli-plugin-auth";
+import { loadLocalEnv } from "./loadLocalEnv.js";
 /**
  * Derive the integration-layer EXTENSIONS edge base URL from the authenticated
  * principal's commercetools region. The extensions edge serves the CLI's
@@ -110,12 +61,16 @@ export class IntegrationLayerCommand extends AuthCommand {
      */
     authorized = true;
     /**
-     * The principal loaded from `~/.commercetools/credentials` in {@link init}, or
-     * undefined when no valid login is persisted. Resolved once per command run so the
-     * synchronous {@link requirePrincipal} call sites (here and in `explore`) are unchanged.
+     * Authenticated fetch for the `manage_project` boundary — injects the bearer and
+     * refreshes/retries it. Built once in {@link init} (after the prerun hook has
+     * configured the auth plugin + filled the security context).
      */
-    persistedPrincipal;
+    authFetch;
     static baseFlags = {
+        "env-file": Flags.string({
+            description: "dotenv file to load before the command runs (default: .env in the cwd, if present); does not override variables already set in the environment",
+            helpGroup: "GLOBAL",
+        }),
         "integration-layer-url": Flags.string({
             description: "integration-layer extensions edge base URL (also settable via INTEGRATION_LAYER_URL); overrides the URL derived from your login region",
             env: "INTEGRATION_LAYER_URL",
@@ -127,34 +82,30 @@ export class IntegrationLayerCommand extends AuthCommand {
         }),
     };
     async init() {
+        // Before oclif resolves flag `env:` bindings (and before `serve` reads
+        // EXTENSION_CONFIG_*), so a project `.env` / `--env-file` actually takes effect.
+        loadLocalEnv();
         await super.init();
-        this.persistedPrincipal = await this.loadPersistedPrincipal();
+        // The prerun hook has configured the auth plugin + filled this copy's security
+        // context by now, so the inherited accessors resolve as in any other topic.
+        this.authFetch = new CtpAuthFetchFactory(this.getAuthenticationManager(), this.getAuthenticationRepository()).create();
         if (this.authorized)
             this.requirePrincipal();
     }
-    /**
-     * Read the persisted login from `~/.commercetools/credentials`. Returns undefined when
-     * no login is on disk (so unauthorized commands like standalone `serve` still run) and
-     * only fails loudly when the file is present but malformed. No network — the token was
-     * already minted by `auth login` and serialized whole.
-     */
-    async loadPersistedPrincipal() {
-        return loadPersistedPrincipal();
-    }
     /** The logged-in commercetools principal, or an `AuthorizationError` pointing at `auth login`. */
     requirePrincipal() {
-        if (this.persistedPrincipal)
-            return this.persistedPrincipal;
+        const principal = this.getAuthentication()?.getPrincipal();
+        if (principal instanceof CtpAuthorizedClient)
+            return principal;
         throw new AuthorizationError("not logged in — run `commercetools auth login` first");
     }
     /**
      * Resolve the integration-layer base URL + project key from the login context and
-     * take the principal's access token as the bearer. Fails loudly (no defensive
+     * hand back the authenticated fetch as the bearer. Fails loudly (no defensive
      * defaults) when a required value is absent.
      */
     async resolveIlContext(flags) {
         const principal = this.requirePrincipal();
-        const token = principal.getAccessToken().getTokenValue();
         const projectKey = flags["project-key"] ?? principal.getProjectKey();
         if (!projectKey) {
             throw new Error("no project key — log in with `commercetools auth login --project-key <key>` or pass --project-key");
@@ -165,7 +116,7 @@ export class IntegrationLayerCommand extends AuthCommand {
                 "INTEGRATION_LAYER_URL (the extensions edge base, e.g. " +
                 "https://extensions.integration-layer.eu-central-1.aws.commercetools.com)");
         }
-        return { baseUrl: baseUrl.replace(/\/+$/, ""), projectKey, token };
+        return { baseUrl: baseUrl.replace(/\/+$/, ""), projectKey, authFetch: this.authFetch };
     }
 }
 //# sourceMappingURL=base.js.map

package/dist/lib/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/lib/base.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,qFAAqF;AACrF,mFAAmF;AACnF,oFAAoF;AACpF,sFAAsF;AACtF,uFAAuF;AACvF,mFAAmF;AACnF,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,4EAA4E;AAC5E,EAAE;AACF,uFAAuF;AACvF,oEAAoE;AACpE,yFAAyF;AACzF,uFAAuF;AACvF,wFAAwF;AACxF,oFAAoF;AACpF,qFAAqF;AACrF,uEAAuE;AACvE,2CAA2C;AAE3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAClF,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAExD;;;;;GAKG;AACH,SAAS,iCAAiC,CACxC,eAAuB;IAEvB,MAAM,UAAU,GAAG,IAAI,iCAAiC,CAAC,eAAe,CAAC,CAAC;IAC1E,UAAU,CAAC,eAAe,CACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,4BAA4B,CAAC,YAAY,CAC1C,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,kBAA0B,gBAAgB;IAE1C,MAAM,cAAc,GAAG,MAAM,iCAAiC,CAAC,eAAe,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACrG,MAAM,SAAS,GAAG,cAAc,EAAE,YAAY,EAAE,CAAC;IACjD,OAAO,SAAS,YAAY,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAiBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,wCAAwC,OAAO,oBAAoB,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,qCAAqC,OAAO,oBAAoB,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,kCAAkC,OAAO,oBAAoB,CAAC;AACvE,CAAC;AAED,MAAM,OAAgB,uBAAwB,SAAQ,WAAW;IAC/D;;;;;OAKG;IACO,UAAU,GAAG,IAAI,CAAC;IAE5B;;;;OAIG;IACK,kBAAkB,CAAuB;IAEjD,MAAM,CAAU,SAAS,GAAG;QAC1B,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC;YACpC,WAAW,EACT,wIAAwI;YAC1I,GAAG,EAAE,uBAAuB;YAC5B,SAAS,EAAE,4BAA4B;SACxC,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC;YAC1B,WAAW,EAAE,oCAAoC;YACjD,SAAS,EAAE,4BAA4B;SACxC,CAAC;KACH,CAAC;IAEiB,KAAK,CAAC,IAAI;QAC3B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,sBAAsB;QAClC,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,kGAAkG;IACxF,gBAAgB;QACxB,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QAC5D,MAAM,IAAI,kBAAkB,CAAC,sDAAsD,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC;QAEzD,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;QACrE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,uBAAuB,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4FAA4F;gBAC1F,wDAAwD;gBACxD,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/lib/base.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,sFAAsF;AACtF,uFAAuF;AACvF,0EAA0E;AAC1E,0FAA0F;AAC1F,yFAAyF;AACzF,oDAAoD;AAEpD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAqBjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,wCAAwC,OAAO,oBAAoB,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,qCAAqC,OAAO,oBAAoB,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,kCAAkC,OAAO,oBAAoB,CAAC;AACvE,CAAC;AAED,MAAM,OAAgB,uBAAwB,SAAQ,WAAW;IAC/D;;;;;OAKG;IACO,UAAU,GAAG,IAAI,CAAC;IAE5B;;;;OAIG;IACO,SAAS,CAAgB;IAEnC,MAAM,CAAU,SAAS,GAAG;QAC1B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC;YACvB,WAAW,EACT,gJAAgJ;YAClJ,SAAS,EAAE,QAAQ;SACpB,CAAC;QACF,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC;YACpC,WAAW,EACT,wIAAwI;YAC1I,GAAG,EAAE,uBAAuB;YAC5B,SAAS,EAAE,4BAA4B;SACxC,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC;YAC1B,WAAW,EAAE,oCAAoC;YACjD,SAAS,EAAE,4BAA4B;SACxC,CAAC;KACH,CAAC;IAEiB,KAAK,CAAC,IAAI;QAC3B,uEAAuE;QACvE,iFAAiF;QACjF,YAAY,EAAE,CAAC;QACf,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,+EAA+E;QAC/E,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,IAAI,mBAAmB,CACtC,IAAI,CAAC,wBAAwB,EAAE,EAC/B,IAAI,CAAC,2BAA2B,EAAE,CACnC,CAAC,MAAM,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC;IAED,kGAAkG;IACxF,gBAAgB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC;QAC3D,IAAI,SAAS,YAAY,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAC/D,MAAM,IAAI,kBAAkB,CAAC,sDAAsD,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE1C,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;QACrE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,uBAAuB,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4FAA4F;gBAC1F,wDAAwD;gBACxD,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACzF,CAAC"}

package/dist/lib/extensionConfig.d.ts

@@ -0,0 +1,17 @@
+/** Prefix for local-dev env vars that feed `ctx.config` (see `loadLocalEnv` / `.env`). */
+export declare const EXTENSION_CONFIG_PREFIX = "EXTENSION_CONFIG_";
+/**
+ * Project the `EXTENSION_CONFIG_<KEY>` entries of an env-shaped record into the
+ * `ctx.config` map the runtime injects — `EXTENSION_CONFIG_ALGOLIA_API_KEY=…` becomes
+ * `ALGOLIA_API_KEY`. Locally there is no Commerce Integration Layer to read the
+ * project's stored config from, so `serve` sources it from the environment and any
+ * `.env` / `--env-file`. Keys with an empty remainder (bare `EXTENSION_CONFIG_`) are
+ * dropped.
+ */
+export declare function extensionConfigFromEnv(env?: Record<string, string | undefined>): Record<string, string>;
+/**
+ * Parse `--config KEY=VALUE` pairs into a `ctx.config` map; a later pair wins on the
+ * same key. A pair without a `=` (or with an empty key) is skipped. Used by
+ * `invoke-api-extension` to overlay explicit flags on top of the environment / `.env`.
+ */
+export declare function extensionConfigFromPairs(pairs: readonly string[]): Record<string, string>;

package/dist/lib/extensionConfig.js

@@ -0,0 +1,36 @@
+/** Prefix for local-dev env vars that feed `ctx.config` (see `loadLocalEnv` / `.env`). */
+export const EXTENSION_CONFIG_PREFIX = "EXTENSION_CONFIG_";
+/**
+ * Project the `EXTENSION_CONFIG_<KEY>` entries of an env-shaped record into the
+ * `ctx.config` map the runtime injects — `EXTENSION_CONFIG_ALGOLIA_API_KEY=…` becomes
+ * `ALGOLIA_API_KEY`. Locally there is no Commerce Integration Layer to read the
+ * project's stored config from, so `serve` sources it from the environment and any
+ * `.env` / `--env-file`. Keys with an empty remainder (bare `EXTENSION_CONFIG_`) are
+ * dropped.
+ */
+export function extensionConfigFromEnv(env = process.env) {
+    const config = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (!key.startsWith(EXTENSION_CONFIG_PREFIX) || typeof value !== "string")
+            continue;
+        const name = key.slice(EXTENSION_CONFIG_PREFIX.length);
+        if (name)
+            config[name] = value;
+    }
+    return config;
+}
+/**
+ * Parse `--config KEY=VALUE` pairs into a `ctx.config` map; a later pair wins on the
+ * same key. A pair without a `=` (or with an empty key) is skipped. Used by
+ * `invoke-api-extension` to overlay explicit flags on top of the environment / `.env`.
+ */
+export function extensionConfigFromPairs(pairs) {
+    const config = {};
+    for (const pair of pairs) {
+        const eq = pair.indexOf("=");
+        if (eq > 0)
+            config[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+    return config;
+}
+//# sourceMappingURL=extensionConfig.js.map

package/dist/lib/extensionConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensionConfig.js","sourceRoot":"","sources":["../../src/lib/extensionConfig.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,uBAAuB,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACpF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAwB;IAC/D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/ilClient.d.ts

@@ -63,8 +63,14 @@ export interface RemoteValidationResult {
     /** False when no published baseline was available, so the breaking check was skipped. */
     comparedToPublished: boolean;
 }
+/**
+ * The authenticated fetch supplied by the command layer — the `CtpAuthFetchFactory` fetch,
+ * which injects the `manage_project` bearer and refreshes/retries it. Structurally a
+ * `fetch`, so callers can pass a plain stub in tests.
+ */
+export type AuthFetch = typeof fetch;
 /** GET the project's raw core-subgraph SDL — the compose input (`GET …/subgraph`). */
-export declare function fetchSubgraphSdl(baseUrl: string, projectKey: string, token: string): Promise<string>;
+export declare function fetchSubgraphSdl(baseUrl: string, projectKey: string, authFetch: AuthFetch): Promise<string>;
 /**
  * GET the project's DEPLOYED composed graph as a PUBLIC API SCHEMA — what the router
  * actually plans and serves (core subgraph + the project's published extension),
@@ -80,9 +86,9 @@ export declare function fetchSubgraphSdl(baseUrl: string, projectKey: string, to
  * same `manage_project` boundary as `/subgraph`. 404 means the project has never
  * published a composable version.
  */
-export declare function fetchDeployedApiSchemaSdl(baseUrl: string, projectKey: string, token: string): Promise<string>;
+export declare function fetchDeployedApiSchemaSdl(baseUrl: string, projectKey: string, authFetch: AuthFetch): Promise<string>;
 /** POST a candidate SDL to the composition + breaking-change gate (`POST …/extension/validate`). */
-export declare function remoteValidate(baseUrl: string, projectKey: string, token: string, typeDefs: string): Promise<RemoteValidationResult>;
+export declare function remoteValidate(baseUrl: string, projectKey: string, authFetch: AuthFetch, typeDefs: string): Promise<RemoteValidationResult>;
 /**
  * Upload the built bundle, replacing the project's stored one (`PUT …/extension/bundle`).
  *
@@ -90,11 +96,11 @@ export declare function remoteValidate(baseUrl: string, projectKey: string, toke
  * came from; the Commerce Integration Layer stores it against the revision, shows it in the
  * Merchant Center, and hands it to the connector.
  */
-export declare function pushBundle(baseUrl: string, projectKey: string, token: string, bundle: string, filename: string, sourceRevision?: string): Promise<ExtensionMeta>;
+export declare function pushBundle(baseUrl: string, projectKey: string, authFetch: AuthFetch, bundle: string, filename: string, sourceRevision?: string): Promise<ExtensionMeta>;
 /** The stored bundle's metadata, or null if none is stored (`GET …/extension/bundle/meta`). */
-export declare function fetchExtensionMeta(baseUrl: string, projectKey: string, token: string): Promise<ExtensionMeta | null>;
+export declare function fetchExtensionMeta(baseUrl: string, projectKey: string, authFetch: AuthFetch): Promise<ExtensionMeta | null>;
 /** Remove the project's extension subgraph from Hive (`DELETE …/extension/subgraph`). */
-export declare function deleteExtensionSubgraph(baseUrl: string, projectKey: string, token: string): Promise<void>;
+export declare function deleteExtensionSubgraph(baseUrl: string, projectKey: string, authFetch: AuthFetch): Promise<void>;
 /**
  * The project's extension HTTP allowlist: the merchant-tunable `allow` host patterns
  * the extension sandbox's `fetch` may reach, plus the operator `deny` ceiling. A host
@@ -109,7 +115,7 @@ export interface AllowlistView {
     deny: string[];
 }
 /** GET the project's extension HTTP allowlist (`GET …/extension/allowlist`). */
-export declare function getAllowlist(baseUrl: string, projectKey: string, token: string): Promise<AllowlistView>;
+export declare function getAllowlist(baseUrl: string, projectKey: string, authFetch: AuthFetch): Promise<AllowlistView>;
 /**
  * Replace the merchant `allow` patterns with `patterns` (`PUT …/extension/allowlist`).
  * The route takes a bare JSON array and REPLACES the whole allow list — the add/remove
@@ -118,18 +124,18 @@ export declare function getAllowlist(baseUrl: string, projectKey: string, token:
  * returns the stored list plus the config's new monotonic version. The `deny` ceiling
  * is untouched (it has no write route).
  */
-export declare function putAllowlist(baseUrl: string, projectKey: string, token: string, patterns: string[]): Promise<{
+export declare function putAllowlist(baseUrl: string, projectKey: string, authFetch: AuthFetch, patterns: string[]): Promise<{
     allow: string[];
     version: number;
 }>;
 /** List the project's extension config entries, secret values redacted (`GET …/extension/config`). */
-export declare function listConfig(baseUrl: string, projectKey: string, token: string): Promise<ConfigEntry[]>;
+export declare function listConfig(baseUrl: string, projectKey: string, authFetch: AuthFetch): Promise<ConfigEntry[]>;
 /**
  * Upsert/delete config entries and return the resulting (redacted) list
  * (`PATCH …/extension/config`). An entry with `value: null` deletes that key. PATCH
  * (not PUT) so a single set/unset touches one key without clobbering the rest.
  */
-export declare function patchConfig(baseUrl: string, projectKey: string, token: string, entries: Array<{
+export declare function patchConfig(baseUrl: string, projectKey: string, authFetch: AuthFetch, entries: Array<{
     key: string;
     value: string | null;
     secret?: boolean;