@commercetools/cli-topic-integration-layer 0.8.0 → 0.10.0

package/dist/lib/apiExtensionServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiExtensionServer.js","sourceRoot":"","sources":["../../src/lib/apiExtensionServer.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,iFAAiF;AACjF,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,uFAAuF;AACvF,kFAAkF;AAClF,mDAAmD;AAGnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGzE,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,8CAA8C;AAEvF,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,QAAQ,GAAG,cAAc;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAmC;IAEnC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE3D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC7D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,IAAI,KAA4D,CAAC;QACjE,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;aAChG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;aAC1F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,QAAQ,EAAE,EACV,OAAO,EAAE;YACT,mEAAmE;YACnE,KAA8D,CAC/D,CAAC;YACF,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,GAAG;gBACnB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC,IAAI;oBACvC,CAAC,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG;oBAC1C,CAAC,CAAC,SAAS,CAAC;YAClB,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YACrF,IAAI,MAAM,CAAC,IAAI;gBAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;iBACtD,CAAC;gBACJ,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/B,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iFAAiF;YACjF,OAAO,EAAE,CAAC,GAAY,CAAC,CAAC;YACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/ctExtensions.d.ts

@@ -0,0 +1,102 @@
+import type { ApiExtensionDefinition } from "./tooling/apiExtension.js";
+/**
+ * The authenticated fetch supplied by the command layer — the `CtpAuthFetchFactory`
+ * fetch, which injects the `manage_project` bearer and refreshes/retries it.
+ * Structurally a `fetch`, so callers can pass a plain stub in tests.
+ */
+export type AuthFetch = typeof fetch;
+/** The commercetools platform API base for a login region (e.g. `eu-central-1.aws`). */
+export declare function ctApiBaseUrl(region: string): string;
+/** Every Extension `serve-api-extension` creates is keyed under this prefix, so it can
+ * find and remove exactly (and only) its own, and never touch a real one. */
+export declare const MANAGED_KEY_PREFIX = "il-localdev-";
+/** The commercetools Extension key for one of the bundle's declarations. */
+export declare function managedKey(authorKey: string): string;
+/** Whether an Extension key was created by this command (safe to delete on cleanup). */
+export declare function isManagedKey(key: string | undefined): boolean;
+export interface ExtensionTrigger {
+    resourceTypeId: string;
+    actions: string[];
+    condition?: string;
+}
+/** The commercetools ExtensionDraft body — an HTTP destination plus the triggers
+ * derived from one bundle declaration. */
+export interface ExtensionDraft {
+    key: string;
+    destination: {
+        type: "HTTP";
+        url: string;
+    };
+    triggers: ExtensionTrigger[];
+}
+/** One Extension as returned by commercetools (trimmed to what we reference). */
+export interface ExtensionSummary {
+    id: string;
+    key?: string;
+    version: number;
+    /** The resource/action triggers, used to detect collisions with what we'd register. */
+    triggers?: ExtensionTrigger[];
+}
+/** A resource/action overlap between an existing Extension and a declaration we'd register. */
+export interface TriggerCollision {
+    /** The existing Extension's key (undefined if it has none). */
+    key?: string;
+    /** The existing Extension's id. */
+    id: string;
+    /** The resource type both trigger on. */
+    resourceTypeId: string;
+    /** The action(s) they share. */
+    actions: string[];
+}
+/**
+ * Find where the project's EXISTING Extensions would collide with what we're about to
+ * register — an existing trigger on the SAME `resourceTypeId` that shares at least one
+ * `action` with one of our declarations. commercetools allows only one Extension per
+ * resource+action, so `serve-api-extension` registers only when there is no overlap; an
+ * unrelated Extension (a different resource, or non-overlapping actions) is left
+ * untouched. Pure, so it's unit-tested directly.
+ */
+export declare function findTriggerCollisions(existing: readonly ExtensionSummary[], desired: readonly ApiExtensionDefinition[]): TriggerCollision[];
+/**
+ * Build the commercetools ExtensionDraft for one declaration: destination = the local
+ * server's public `/api-extensions` URL. No destination authentication — this is a
+ * throwaway local debug callback behind an ephemeral tunnel, kept deliberately simple.
+ */
+export declare function draftFor(decl: ApiExtensionDefinition, callbackUrl: string): ExtensionDraft;
+/**
+ * A stable fingerprint of a declaration's TRIGGER shape (resource + actions +
+ * condition). The reconcile step recreates an Extension only when this changes; a
+ * handler-body edit leaves it identical, so no commercetools round trip is needed.
+ */
+export declare function triggerSignature(decl: ApiExtensionDefinition): string;
+/** An Extension this command created and is tracking, so it can update/delete it. */
+export interface RegisteredExtension {
+    /** The author's declaration key (unprefixed). */
+    authorKey: string;
+    /** The commercetools resource id (needed to delete). */
+    id: string;
+    /** The current commercetools version (needed to delete). */
+    version: number;
+    /** {@link triggerSignature} at the time it was created. */
+    signature: string;
+}
+export interface ReconcilePlan {
+    /** Declarations to (re)create — new, or whose trigger shape changed. */
+    toCreate: ApiExtensionDefinition[];
+    /** Registered Extensions to delete — gone, or superseded by a changed one. */
+    toDelete: RegisteredExtension[];
+}
+/**
+ * Diff what we've registered against the bundle's current declarations. Pure so it's
+ * unit-tested directly. An Extension whose trigger signature changed appears in BOTH
+ * lists (delete the stale one, create the new one); a handler-only edit appears in
+ * neither.
+ */
+export declare function planReconcile(registered: readonly RegisteredExtension[], desired: readonly ApiExtensionDefinition[]): ReconcilePlan;
+/** List the project's Extensions (one page; enough for the "refuse if any present"
+ * guard and for sweeping our own leftovers). */
+export declare function listExtensions(apiBaseUrl: string, projectKey: string, authFetch: AuthFetch, limit?: number): Promise<ExtensionSummary[]>;
+/** Create one Extension; returns its id + version (needed to delete it later). */
+export declare function createExtension(apiBaseUrl: string, projectKey: string, authFetch: AuthFetch, draft: ExtensionDraft): Promise<ExtensionSummary>;
+/** Delete one Extension by id + version (idempotent: a 404 is treated as done). */
+export declare function deleteExtension(apiBaseUrl: string, projectKey: string, authFetch: AuthFetch, id: string, version: number): Promise<void>;

package/dist/lib/ctExtensions.js

@@ -0,0 +1,162 @@
+// Minimal client for the commercetools Composable Commerce **API Extensions**
+// resource (`/{projectKey}/extensions`), used ONLY by `serve-api-extension` to point
+// a project at a locally-served bundle for end-to-end debugging.
+//
+// Unlike `ilClient.ts` (which talks to the Commerce Integration Layer edge), this
+// talks to the commercetools platform API directly — the same authenticated fetch
+// carries a real `manage_project` bearer, so nothing here sets an Authorization
+// header itself. The commercetools API host follows the same `<svc>.<region>` scheme
+// as the auth/connect hosts (`api.<region>.commercetools.com`); the region comes
+// from the logged-in principal.
+//
+// SAFETY MODEL: this registers callbacks that make commercetools call the developer's
+// machine, so it is intentionally conservative. `serve-api-extension` REFUSES to run
+// when an existing Extension collides with the resource/action it would register (see
+// `findTriggerCollisions`) so it can never disturb a real one; unrelated Extensions are
+// left untouched. It owns everything it creates under the `il-localdev-` key prefix and
+// deletes what it created on exit. This module supplies the pure, unit-tested pieces of
+// that contract (key/draft/reconcile/collision) plus the three REST calls.
+/** The commercetools platform API base for a login region (e.g. `eu-central-1.aws`). */
+export function ctApiBaseUrl(region) {
+    const trimmed = region.trim();
+    if (!trimmed) {
+        throw new Error("no commercetools region on the login — run `commercetools auth login --project-key <key>`");
+    }
+    return `https://api.${trimmed}.commercetools.com`;
+}
+/** Every Extension `serve-api-extension` creates is keyed under this prefix, so it can
+ * find and remove exactly (and only) its own, and never touch a real one. */
+export const MANAGED_KEY_PREFIX = "il-localdev-";
+/** The commercetools Extension key for one of the bundle's declarations. */
+export function managedKey(authorKey) {
+    return `${MANAGED_KEY_PREFIX}${authorKey}`;
+}
+/** Whether an Extension key was created by this command (safe to delete on cleanup). */
+export function isManagedKey(key) {
+    return typeof key === "string" && key.startsWith(MANAGED_KEY_PREFIX);
+}
+/**
+ * Find where the project's EXISTING Extensions would collide with what we're about to
+ * register — an existing trigger on the SAME `resourceTypeId` that shares at least one
+ * `action` with one of our declarations. commercetools allows only one Extension per
+ * resource+action, so `serve-api-extension` registers only when there is no overlap; an
+ * unrelated Extension (a different resource, or non-overlapping actions) is left
+ * untouched. Pure, so it's unit-tested directly.
+ */
+export function findTriggerCollisions(existing, desired) {
+    const wantedActionsByResource = new Map();
+    for (const d of desired) {
+        const set = wantedActionsByResource.get(d.resourceTypeId) ?? new Set();
+        for (const a of d.actions)
+            set.add(a);
+        wantedActionsByResource.set(d.resourceTypeId, set);
+    }
+    const collisions = [];
+    for (const ext of existing) {
+        for (const trigger of ext.triggers ?? []) {
+            const wanted = wantedActionsByResource.get(trigger.resourceTypeId);
+            if (!wanted)
+                continue;
+            const shared = trigger.actions.filter((a) => wanted.has(a));
+            if (shared.length > 0) {
+                collisions.push({
+                    key: ext.key,
+                    id: ext.id,
+                    resourceTypeId: trigger.resourceTypeId,
+                    actions: shared,
+                });
+            }
+        }
+    }
+    return collisions;
+}
+/**
+ * Build the commercetools ExtensionDraft for one declaration: destination = the local
+ * server's public `/api-extensions` URL. No destination authentication — this is a
+ * throwaway local debug callback behind an ephemeral tunnel, kept deliberately simple.
+ */
+export function draftFor(decl, callbackUrl) {
+    return {
+        key: managedKey(decl.key),
+        destination: {
+            type: "HTTP",
+            url: callbackUrl,
+        },
+        triggers: [
+            {
+                resourceTypeId: decl.resourceTypeId,
+                actions: [...decl.actions],
+                ...(decl.condition !== undefined ? { condition: decl.condition } : {}),
+            },
+        ],
+    };
+}
+/**
+ * A stable fingerprint of a declaration's TRIGGER shape (resource + actions +
+ * condition). The reconcile step recreates an Extension only when this changes; a
+ * handler-body edit leaves it identical, so no commercetools round trip is needed.
+ */
+export function triggerSignature(decl) {
+    return JSON.stringify({
+        resourceTypeId: decl.resourceTypeId,
+        actions: [...decl.actions].sort(),
+        condition: decl.condition ?? null,
+    });
+}
+/**
+ * Diff what we've registered against the bundle's current declarations. Pure so it's
+ * unit-tested directly. An Extension whose trigger signature changed appears in BOTH
+ * lists (delete the stale one, create the new one); a handler-only edit appears in
+ * neither.
+ */
+export function planReconcile(registered, desired) {
+    const registeredByKey = new Map(registered.map((r) => [r.authorKey, r]));
+    const desiredByKey = new Map(desired.map((d) => [d.key, d]));
+    const toCreate = desired.filter((d) => {
+        const existing = registeredByKey.get(d.key);
+        return !existing || existing.signature !== triggerSignature(d);
+    });
+    const toDelete = registered.filter((r) => {
+        const want = desiredByKey.get(r.authorKey);
+        return !want || triggerSignature(want) !== r.signature;
+    });
+    return { toCreate, toDelete };
+}
+function extensionsUrl(base, projectKey) {
+    return `${base}/${encodeURIComponent(projectKey)}/extensions`;
+}
+/** List the project's Extensions (one page; enough for the "refuse if any present"
+ * guard and for sweeping our own leftovers). */
+export async function listExtensions(apiBaseUrl, projectKey, authFetch, limit = 100) {
+    const url = `${extensionsUrl(apiBaseUrl, projectKey)}?limit=${limit}`;
+    const res = await authFetch(url, { headers: { accept: "application/json" } });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`GET /extensions failed (${res.status}) for '${projectKey}': ${text}`);
+    }
+    const body = JSON.parse(text);
+    return body.results ?? [];
+}
+/** Create one Extension; returns its id + version (needed to delete it later). */
+export async function createExtension(apiBaseUrl, projectKey, authFetch, draft) {
+    const res = await authFetch(extensionsUrl(apiBaseUrl, projectKey), {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(draft),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`POST /extensions '${draft.key}' failed (${res.status}): ${text}`);
+    }
+    return JSON.parse(text);
+}
+/** Delete one Extension by id + version (idempotent: a 404 is treated as done). */
+export async function deleteExtension(apiBaseUrl, projectKey, authFetch, id, version) {
+    const url = `${extensionsUrl(apiBaseUrl, projectKey)}/${encodeURIComponent(id)}?version=${version}`;
+    const res = await authFetch(url, { method: "DELETE", headers: { accept: "application/json" } });
+    if (res.ok || res.status === 404)
+        return;
+    const text = await res.text();
+    throw new Error(`DELETE /extensions/${id} failed (${res.status}): ${text}`);
+}
+//# sourceMappingURL=ctExtensions.js.map

package/dist/lib/ctExtensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctExtensions.js","sourceRoot":"","sources":["../../src/lib/ctExtensions.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,qFAAqF;AACrF,iEAAiE;AACjE,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,qFAAqF;AACrF,iFAAiF;AACjF,gCAAgC;AAChC,EAAE;AACF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,wFAAwF;AACxF,wFAAwF;AACxF,wFAAwF;AACxF,2EAA2E;AAW3E,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,OAAO,oBAAoB,CAAC;AACpD,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,GAAG,kBAAkB,GAAG,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACvE,CAAC;AAwCD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqC,EACrC,OAA0C;IAE1C,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,UAAU,CAAC,IAAI,CAAC;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,IAA4B,EAAE,WAAmB;IACxE,OAAO;QACL,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,WAAW,EAAE;YACX,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,WAAW;SACjB;QACD,QAAQ,EAAE;YACR;gBACE,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA4B;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;AACL,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,UAA0C,EAC1C,OAA0C;IAE1C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,UAAkB;IACrD,OAAO,GAAG,IAAI,IAAI,kBAAkB,CAAC,UAAU,CAAC,aAAa,CAAC;AAChE,CAAC;AAED;gDACgD;AAChD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,UAAkB,EAClB,SAAoB,EACpB,KAAK,GAAG,GAAG;IAEX,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,KAAK,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,UAAU,UAAU,MAAM,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;IAClE,OAAO,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,UAAkB,EAClB,SAAoB,EACpB,KAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,GAAG,aAAa,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,UAAkB,EAClB,SAAoB,EACpB,EAAU,EACV,OAAe;IAEf,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,YAAY,OAAO,EAAE,CAAC;IACpG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/lib/ilClient.d.ts

@@ -140,3 +140,31 @@ export declare function patchConfig(baseUrl: string, projectKey: string, authFet
     value: string | null;
     secret?: boolean;
 }>): Promise<ConfigEntry[]>;
+/** The deployed connector's verdict, as the Commerce Integration Layer's invoke proxy returns it. */
+export interface DeployedInvokeResponse {
+    /** The connector's own HTTP status: 200 (approve/modify), 400 (block), 401/5xx (fault). */
+    status: number;
+    /** The connector's response body ({}, { actions }, { errors }, …) — the API-Extension result. */
+    result: unknown;
+}
+/**
+ * Fire ONE commercetools API-Extension callback at the project's DEPLOYED extension
+ * and return the connector's verdict (`POST …/extension/api-extensions/invoke`).
+ *
+ * The Commerce Integration Layer is the signing proxy: only it can mint the shared-secret
+ * bearer the connector's `/api-extensions` endpoint requires (derived from the
+ * project's stored client secret), so the CLI hands it the payload and the integration
+ * layer resolves the deployed connector URL, signs, forwards, and returns the result.
+ * Nothing is persisted to commercetools — it is the callback in isolation.
+ *
+ * A connector that ANSWERS — including a 400 block — comes back inside the
+ * `{ status, result }` envelope (a block is a verdict, not a failure). This throws
+ * only when the deployed extension could not be REACHED (no deployment, no service
+ * URL yet, timeout) or the request was rejected (not enrolled, unauthorized).
+ */
+export declare function invokeDeployedApiExtension(baseUrl: string, projectKey: string, authFetch: AuthFetch, input: {
+    action: string;
+    resource: {
+        typeId: string;
+    };
+}): Promise<DeployedInvokeResponse>;

package/dist/lib/ilClient.js

@@ -173,4 +173,41 @@ export async function patchConfig(baseUrl, projectKey, authFetch, entries) {
     }
     return JSON.parse(text);
 }
+/**
+ * Fire ONE commercetools API-Extension callback at the project's DEPLOYED extension
+ * and return the connector's verdict (`POST …/extension/api-extensions/invoke`).
+ *
+ * The Commerce Integration Layer is the signing proxy: only it can mint the shared-secret
+ * bearer the connector's `/api-extensions` endpoint requires (derived from the
+ * project's stored client secret), so the CLI hands it the payload and the integration
+ * layer resolves the deployed connector URL, signs, forwards, and returns the result.
+ * Nothing is persisted to commercetools — it is the callback in isolation.
+ *
+ * A connector that ANSWERS — including a 400 block — comes back inside the
+ * `{ status, result }` envelope (a block is a verdict, not a failure). This throws
+ * only when the deployed extension could not be REACHED (no deployment, no service
+ * URL yet, timeout) or the request was rejected (not enrolled, unauthorized).
+ */
+export async function invokeDeployedApiExtension(baseUrl, projectKey, authFetch, input) {
+    const url = `${apiRoot(baseUrl, projectKey)}/extension/api-extensions/invoke`;
+    const res = await authFetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(input),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        let detail = text;
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed.error)
+                detail = parsed.error;
+        }
+        catch {
+            // Non-JSON body — surface it raw.
+        }
+        throw new Error(`could not invoke the deployed extension (${res.status}): ${detail}`);
+    }
+    return JSON.parse(text);
+}
 //# sourceMappingURL=ilClient.js.map

package/dist/lib/ilClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"ilClient.js","sourceRoot":"","sources":["../../src/lib/ilClient.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,wFAAwF;AACxF,0FAA0F;AAC1F,2FAA2F;AAC3F,0FAA0F;AAC1F,qFAAqF;AACrF,sFAAsF;AACtF,oFAAoF;AACpF,kEAAkE;AAwElE,SAAS,OAAO,CAAC,OAAe,EAAE,UAAkB;IAClD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AAC5E,CAAC;AASD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,gEAAgE;YACpF,0FAA0F,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,CAAC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,cAAuB;IAEvB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,iBAAiB;YACjC,4EAA4E;YAC5E,mEAAmE;YACnE,sBAAsB,EAAE,kBAAkB,CAAC,QAAQ,CAAC;YACpD,+EAA+E;YAC/E,+EAA+E;YAC/E,0DAA0D;YAC1D,GAAG,CAAC,cAAc;gBAChB,CAAC,CAAC,EAAE,6BAA6B,EAAE,kBAAkB,CAAC,cAAc,CAAC,EAAE;gBACvE,CAAC,CAAC,EAAE,CAAC;SACR;QACD,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,wBAAwB,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAgBD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,QAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,CAAC;AAClE,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,OAAuE;IAEvE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"ilClient.js","sourceRoot":"","sources":["../../src/lib/ilClient.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,wFAAwF;AACxF,0FAA0F;AAC1F,2FAA2F;AAC3F,0FAA0F;AAC1F,qFAAqF;AACrF,sFAAsF;AACtF,oFAAoF;AACpF,kEAAkE;AAwElE,SAAS,OAAO,CAAC,OAAe,EAAE,UAAkB;IAClD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AAC5E,CAAC;AASD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,gEAAgE;YACpF,0FAA0F,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,CAAC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,cAAuB;IAEvB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,iBAAiB;YACjC,4EAA4E;YAC5E,mEAAmE;YACnE,sBAAsB,EAAE,kBAAkB,CAAC,QAAQ,CAAC;YACpD,+EAA+E;YAC/E,+EAA+E;YAC/E,0DAA0D;YAC1D,GAAG,CAAC,cAAc;gBAChB,CAAC,CAAC,EAAE,6BAA6B,EAAE,kBAAkB,CAAC,cAAc,CAAC,EAAE;gBACvE,CAAC,CAAC,EAAE,CAAC;SACR;QACD,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,wBAAwB,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAgBD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,QAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,CAAC;AAClE,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,UAAkB,EAClB,SAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,OAAuE;IAEvE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;AAC3C,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAe,EACf,UAAkB,EAClB,SAAoB,EACpB,KAAuD;IAEvD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,kCAAkC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YACtD,IAAI,MAAM,CAAC,KAAK;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,CAAC,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;AACpD,CAAC"}

package/dist/lib/tooling/apiExtensionDispatch.d.ts

@@ -0,0 +1,32 @@
+import type { EvaluatedBundle } from "./loadBundle.js";
+import type { ApiExtensionAction, ApiExtensionDefinition, ApiExtensionError, ApiExtensionInput, ApiExtensionResult, ExtensionContext } from "./apiExtension.js";
+/** The wire result: the HTTP status commercetools expects, plus the optional body. */
+export interface DispatchResult {
+    status: number;
+    /** Omitted for a bare approve (empty 200 body). */
+    body?: {
+        actions: unknown[];
+    } | {
+        errors: ApiExtensionError[];
+    };
+}
+/** Pull the `apiExtensions` array off a loaded bundle (empty when it exports none). */
+export declare function extractApiExtensions(mod: EvaluatedBundle): ApiExtensionDefinition[];
+/** Whether a handler is triggered by a given commercetools resource + action. */
+export declare function handlerMatches(handler: ApiExtensionDefinition, resourceTypeId: string, action: ApiExtensionAction): boolean;
+/** Summarise a single handler's result for a human-readable log line. */
+export declare function describeResult(result: ApiExtensionResult): string;
+/**
+ * Dispatch one commercetools API-Extension callback across the matching handlers and
+ * return the response commercetools expects:
+ *
+ * - No matching handler → approve (200, no body): no handler expresses an opinion, so
+ *   the write proceeds (the defined behaviour, not a fallback).
+ * - Any handler returns `errors` → BLOCK (400 with the merged errors).
+ * - Otherwise merge any `actions` → 200 with the actions (or an empty 200).
+ *
+ * FAIL FAST: a handler that throws is NOT swallowed into an approve — the error
+ * propagates to the caller, which returns 500 so commercetools fails the write loudly
+ * (the same contract as the deployed sandbox).
+ */
+export declare function dispatchApiExtension(handlers: ApiExtensionDefinition[], ctx: ExtensionContext, input: ApiExtensionInput): Promise<DispatchResult>;

package/dist/lib/tooling/apiExtensionDispatch.js

@@ -0,0 +1,71 @@
+// Run a bundle's commercetools API-Extension handlers for one callback and map the
+// merged result to the commercetools response contract. Kept PURE (no HTTP, no
+// module state) so it's unit-tested directly and shared by two callers:
+//   - `invoke-api-extension` fires a SYNTHETIC payload at the handlers offline;
+//   - `serve-api-extension` serves the handlers over HTTP so REAL commercetools
+//     callbacks reach them for local end-to-end debugging.
+//
+// This mirrors the sandbox runtime's dispatch contract
+// (octolog-extensions-sandbox `service/src/apiExtensions/dispatch.ts`) so a handler
+// behaves identically locally and once deployed. The one deliberate difference is
+// that handlers run here in plain Node (no SES compartment, no `harden`) — that is
+// what makes breakpoints and stack traces work; `validate`/`push` remain the
+// correctness gate for the real sandbox endowments.
+/** Pull the `apiExtensions` array off a loaded bundle (empty when it exports none). */
+export function extractApiExtensions(mod) {
+    return Array.isArray(mod.apiExtensions) ? mod.apiExtensions : [];
+}
+/** Whether a handler is triggered by a given commercetools resource + action. */
+export function handlerMatches(handler, resourceTypeId, action) {
+    return handler.resourceTypeId === resourceTypeId && handler.actions.includes(action);
+}
+/** Summarise a single handler's result for a human-readable log line. */
+export function describeResult(result) {
+    if (result && typeof result === "object") {
+        if (Array.isArray(result.errors) && result.errors.length > 0) {
+            return `BLOCK — ${result.errors.map((e) => `${e.code}: ${e.message}`).join("; ")}`;
+        }
+        if (Array.isArray(result.actions) && result.actions.length > 0) {
+            return `MODIFY — ${JSON.stringify(result.actions)}`;
+        }
+    }
+    return "APPROVE";
+}
+/**
+ * Dispatch one commercetools API-Extension callback across the matching handlers and
+ * return the response commercetools expects:
+ *
+ * - No matching handler → approve (200, no body): no handler expresses an opinion, so
+ *   the write proceeds (the defined behaviour, not a fallback).
+ * - Any handler returns `errors` → BLOCK (400 with the merged errors).
+ * - Otherwise merge any `actions` → 200 with the actions (or an empty 200).
+ *
+ * FAIL FAST: a handler that throws is NOT swallowed into an approve — the error
+ * propagates to the caller, which returns 500 so commercetools fails the write loudly
+ * (the same contract as the deployed sandbox).
+ */
+export async function dispatchApiExtension(handlers, ctx, input) {
+    const matching = handlers.filter((h) => 
+    // input.action is the SDK's (open) ExtensionAction; our handlers only declare
+    // Create/Update, so a non-matching action simply finds no handler.
+    handlerMatches(h, input.resource.typeId, input.action));
+    if (matching.length === 0)
+        return { status: 200 };
+    const errors = [];
+    const actions = [];
+    for (const h of matching) {
+        const result = await h.handler(input, ctx);
+        if (result && typeof result === "object") {
+            if (Array.isArray(result.errors))
+                errors.push(...result.errors);
+            if (Array.isArray(result.actions))
+                actions.push(...result.actions);
+        }
+    }
+    if (errors.length > 0)
+        return { status: 400, body: { errors } };
+    if (actions.length > 0)
+        return { status: 200, body: { actions } };
+    return { status: 200 };
+}
+//# sourceMappingURL=apiExtensionDispatch.js.map

package/dist/lib/tooling/apiExtensionDispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiExtensionDispatch.js","sourceRoot":"","sources":["../../../src/lib/tooling/apiExtensionDispatch.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,+EAA+E;AAC/E,wEAAwE;AACxE,gFAAgF;AAChF,gFAAgF;AAChF,2DAA2D;AAC3D,EAAE;AACF,uDAAuD;AACvD,oFAAoF;AACpF,kFAAkF;AAClF,mFAAmF;AACnF,6EAA6E;AAC7E,oDAAoD;AAmBpD,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,aAA0C,CAAC,CAAC,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAC5B,OAA+B,EAC/B,cAAsB,EACtB,MAA0B;IAE1B,OAAO,OAAO,CAAC,cAAc,KAAK,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,MAA0B;IACvD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,OAAO,WAAW,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAkC,EAClC,GAAqB,EACrB,KAAwB;IAExB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;IACrC,8EAA8E;IAC9E,mEAAmE;IACnE,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAA4B,CAAC,CAC7E,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAElD,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;IAClE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACzB,CAAC"}

package/dist/lib/tooling/build.d.ts

@@ -1,4 +1,9 @@
-/** Peer modules the runtime owns — bundled never, resolved at load time. */
+/**
+ * Peer modules the runtime owns — bundled never, resolved at load time. `graphql`
+ * (its single instance) plus the `http`/`https` modules the runtime maps to the
+ * gated fetch shim; the `node:`-prefixed aliases are included so either import
+ * spelling resolves.
+ */
 export declare const HOST_PROVIDED_EXTERNALS: string[];
 /** The extension source of the example the tool is invoked inside (cwd-relative). */
 export declare function defaultEntry(): string;

package/dist/lib/tooling/build.js

@@ -5,14 +5,31 @@
 // CommonJS so the runtime can evaluate it as a script and read `module.exports`.
 // `platform: "neutral"` keeps Node built-ins out (an import of one fails the build,
 // not at load time), and `conditions: ["worker"]` steers a bundled SDK to its
-// fetch-based build (the runtime provides a global `fetch`, not Node `http`/`https`).
-// `graphql` stays EXTERNAL — the runtime supplies its single instance; a second
-// inlined copy would break its `instanceof` checks.
+// fetch-based build. `graphql` stays EXTERNAL — the runtime supplies its single
+// instance; a second inlined copy would break its `instanceof` checks.
+//
+// `http`/`https` (and their `node:`-prefixed aliases) are the ONE class of Node
+// built-in left external: the runtime resolves them to a gated shim (nodeHttpShim.ts)
+// whose `request`/`get` route through the same allowlist-gated `fetch`, not a raw
+// socket. Marking them external makes esbuild emit `require("https")` for the runtime
+// to satisfy, rather than failing the build with "Could not resolve". Every OTHER
+// Node built-in stays unresolvable (and `staticAnalysis.ts` rejects it at validate).
 import { build } from "esbuild";
 import { join, resolve } from "node:path";
 import process from "node:process";
-/** Peer modules the runtime owns — bundled never, resolved at load time. */
-export const HOST_PROVIDED_EXTERNALS = ["graphql"];
+/**
+ * Peer modules the runtime owns — bundled never, resolved at load time. `graphql`
+ * (its single instance) plus the `http`/`https` modules the runtime maps to the
+ * gated fetch shim; the `node:`-prefixed aliases are included so either import
+ * spelling resolves.
+ */
+export const HOST_PROVIDED_EXTERNALS = [
+    "graphql",
+    "http",
+    "https",
+    "node:http",
+    "node:https",
+];
 /** The extension source of the example the tool is invoked inside (cwd-relative). */
 export function defaultEntry() {
     return join(process.cwd(), "src", "extension.ts");

package/dist/lib/tooling/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/lib/tooling/build.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,oEAAoE;AACpE,6DAA6D;AAC7D,iFAAiF;AACjF,oFAAoF;AACpF,8EAA8E;AAC9E,sFAAsF;AACtF,gFAAgF;AAChF,oDAAoD;AAEpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,SAAS,CAAC,CAAC;AAEnD,qFAAqF;AACrF,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;AACpD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACrD,CAAC;AAaD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,YAAY,EAAE,EAC9B,UAAkB,cAAc,EAAE;IAElC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,WAAW,EAAE,CAAC,KAAK,CAAC;QACpB,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,gFAAgF;QAChF,kFAAkF;QAClF,kFAAkF;QAClF,2EAA2E;QAC3E,kFAAkF;QAClF,iFAAiF;QACjF,eAAe;QACf,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;SACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/lib/tooling/build.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,oEAAoE;AACpE,6DAA6D;AAC7D,iFAAiF;AACjF,oFAAoF;AACpF,8EAA8E;AAC9E,gFAAgF;AAChF,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,sFAAsF;AACtF,kFAAkF;AAClF,sFAAsF;AACtF,kFAAkF;AAClF,qFAAqF;AAErF,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS;IACT,MAAM;IACN,OAAO;IACP,WAAW;IACX,YAAY;CACb,CAAC;AAEF,qFAAqF;AACrF,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;AACpD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACrD,CAAC;AAaD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,YAAY,EAAE,EAC9B,UAAkB,cAAc,EAAE;IAElC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,WAAW,EAAE,CAAC,KAAK,CAAC;QACpB,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,gFAAgF;QAChF,kFAAkF;QAClF,kFAAkF;QAClF,2EAA2E;QAC3E,kFAAkF;QAClF,iFAAiF;QACjF,eAAe;QACf,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;SACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/tooling/loadBundle.js

@@ -3,19 +3,29 @@
 //
 // The bundle is esbuild's single-file
 // CommonJS artifact, so we evaluate it with the CommonJS calling convention and a
-// `require` that resolves only `graphql` (a second copy would break `instanceof`).
-// It runs as an ordinary module — not a security boundary; the runtime enforces
-// that, and `staticAnalysis.ts` screens the source first.
+// `require` that resolves `graphql` (a second copy would break `instanceof`) plus
+// `http`/`https` — the latter to the gated shim (nodeHttpShim.ts), never Node's
+// real modules, so a bundle that imports `https` behaves the same locally as in the
+// deployed sandbox. It runs as an ordinary module — not a security boundary; the
+// runtime enforces that, and `staticAnalysis.ts` screens the source first.
 import { GraphQLError } from "graphql";
+import { createNodeHttpShims } from "./nodeHttpShim.js";
 /**
  * Evaluate an esbuild-CJS extension bundle and return its `module.exports`.
  * `require` resolves only `graphql`; any other module id throws.
  */
 export function loadBundleSource(source) {
     const moduleObject = { exports: {} };
+    // Late-bound fetch: when a resolver runs under the dev server it is the delegating
+    // gated fetch (sandboxFetch.ts); elsewhere (coherence check) resolvers don't run.
+    const httpShims = createNodeHttpShims((input, init) => globalThis.fetch(input, init));
     const requireShim = (id) => {
         if (id === "graphql")
             return { GraphQLError };
+        if (id === "https" || id === "node:https")
+            return httpShims.https;
+        if (id === "http" || id === "node:http")
+            return httpShims.http;
         throw new Error(`extension bundle may not require "${id}"`);
     };
     // The CommonJS wrapper: bind `module`/`exports`/`require` and run the source.

package/dist/lib/tooling/loadBundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadBundle.js","sourceRoot":"","sources":["../../../src/lib/tooling/loadBundle.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,iEAAiE;AACjE,EAAE;AACF,sCAAsC;AACtC,kFAAkF;AAClF,mFAAmF;AACnF,gFAAgF;AAChF,0DAA0D;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAUvC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,YAAY,GAAiC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnE,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE;QAC1C,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACtE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,OAAO,YAAY,CAAC,OAAO,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"loadBundle.js","sourceRoot":"","sources":["../../../src/lib/tooling/loadBundle.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,iEAAiE;AACjE,EAAE;AACF,sCAAsC;AACtC,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oFAAoF;AACpF,iFAAiF;AACjF,2EAA2E;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAUxD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,YAAY,GAAiC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnE,mFAAmF;IACnF,kFAAkF;IAClF,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE;QAC1C,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC9C,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC;QAClE,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACtE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,OAAO,YAAY,CAAC,OAAO,CAAC;AAC9B,CAAC"}