@01.software/sdk 0.49.0 → 0.56.1

package/dist/embedded-admin.js

@@ -0,0 +1,377 @@
+// src/core/errors.ts
+var SDK_ERROR_BRAND = /* @__PURE__ */ Symbol.for("@01.software/sdk/SDKError");
+var SDK_ERROR_TYPE_BRAND = /* @__PURE__ */ Symbol.for("@01.software/sdk/SDKError.type");
+function defineSDKErrorBrand(error) {
+  Object.defineProperty(error, SDK_ERROR_BRAND, {
+    value: true,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+}
+function defineSDKErrorType(error, type) {
+  Object.defineProperty(error, SDK_ERROR_TYPE_BRAND, {
+    value: type,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+}
+var SDKError = class extends Error {
+  constructor(code, message, status, details, userMessage, suggestion, requestId) {
+    super(message);
+    this.name = "SDKError";
+    this.code = code;
+    this.status = status;
+    this.details = details;
+    this.userMessage = userMessage;
+    this.suggestion = suggestion;
+    this.requestId = requestId;
+    defineSDKErrorBrand(this);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, new.target);
+    }
+  }
+  getUserMessage() {
+    return this.userMessage || this.message;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      status: this.status,
+      details: this.details,
+      userMessage: this.userMessage,
+      suggestion: this.suggestion,
+      ...this.requestId !== void 0 && { requestId: this.requestId },
+      ...this.kind !== void 0 && { kind: this.kind },
+      ...this.reason !== void 0 && { reason: this.reason },
+      ...this.rawReason !== void 0 && { rawReason: this.rawReason },
+      ...this.apiReason !== void 0 && { apiReason: this.apiReason },
+      ...this.retryable !== void 0 && { retryable: this.retryable },
+      ...this.retryAfter !== void 0 && { retryAfter: this.retryAfter }
+    };
+  }
+};
+var COMMERCE_ERROR_CODES = [
+  "validation_failed",
+  "bad_request",
+  "unauthorized",
+  "forbidden",
+  "account_suspended",
+  "key_invalid",
+  "pat_tenant_header_forbidden",
+  "tenant_mismatch",
+  "test_tenant_expired",
+  "token_invalid",
+  "token_expired",
+  "origin_not_allowed",
+  "server_credentials_required",
+  "role_denied",
+  "scope_denied",
+  "feature_disabled",
+  "not_found",
+  "conflict",
+  "locked",
+  "cart_revision_conflict",
+  "rate_limit_exceeded",
+  "usage_limit_exceeded",
+  "service_unavailable",
+  "idempotency_conflict",
+  "idempotency_in_progress",
+  "idempotency_key_required",
+  "invalid_idempotency_key",
+  "cart_not_active",
+  "cart_locked",
+  "cart_empty",
+  "cart_market_unavailable",
+  "cart_market_mismatch",
+  "checkout_not_open",
+  "checkout_already_open",
+  "payment_slot_held",
+  "reservation_expired",
+  "payment_session_not_cancelable",
+  "payment_session_conflict",
+  "provider_identity_mismatch",
+  "managed_refund_attestation_forbidden",
+  "payment_method_unavailable",
+  "provider_unavailable",
+  "lock_timeout",
+  "price_changed",
+  "pricing_fact_in_use",
+  "insufficient_stock",
+  "reservation_conflict",
+  "stock_lock_unavailable",
+  "variant_not_found",
+  "variant_stock_write_failed",
+  "stock_invariant_violation",
+  "payment_confirmation_in_flight",
+  "checkout_reservation_release_requires_transaction",
+  "admission_metadata_invalid",
+  "admission_metadata_required",
+  "capacity_exceeded",
+  "occurrence_lock_unavailable",
+  "occurrence_not_open",
+  "admission_type_capacity_exceeded",
+  "admission_type_occurrence_mismatch",
+  "admission_hold_expired",
+  "admission_hold_checkout_item_conflict",
+  "admission_hold_checkout_conflict",
+  "admission_hold_quantity_mismatch",
+  "admission_hold_unbound",
+  "admission_hold_missing",
+  "admission_hold_checkout_item_missing",
+  "admission_hold_expiry_failed",
+  "admission_hold_expiry_requires_transaction",
+  "admission_hold_line_item_mismatch",
+  "admission_materialization_failed",
+  "variant_inactive",
+  "variant_product_mismatch",
+  "product_not_public",
+  "market_not_found",
+  "market_shipping_currency_unsupported",
+  "missing_market_rate",
+  "missing_shipping_amount",
+  "no_enabled_payment_provider",
+  "product_market_unavailable",
+  "unsupported_currency",
+  "missing_price_row",
+  "payment_provider_currency_unsupported",
+  "discount_code_not_found",
+  "discount_not_started",
+  "discount_expired",
+  "discount_usage_limit",
+  "discount_per_customer_limit",
+  "discount_customer_required",
+  "discount_first_order_only",
+  "discount_customer_not_eligible",
+  "discount_customer_excluded",
+  "discount_items_required",
+  "discount_product_not_eligible",
+  "discount_product_excluded",
+  "discount_min_order_amount",
+  "discount_currency_scope_required",
+  "discount_allocation_method_unsupported",
+  "currency_mismatch",
+  "customer_token_required",
+  "market_required",
+  "server_derived",
+  "internal_error"
+];
+var COMMERCE_ERROR_CODE_SET = new Set(
+  COMMERCE_ERROR_CODES
+);
+var ValidationError = class extends SDKError {
+  constructor(message, details, userMessage, suggestion, status = 400) {
+    super("VALIDATION_ERROR", message, status, details, userMessage, suggestion);
+    this.name = "ValidationError";
+    defineSDKErrorType(this, "ValidationError");
+  }
+};
+var createValidationError = (message, details, userMessage, suggestion, status) => new ValidationError(message, details, userMessage, suggestion, status);
+
+// src/embedded-admin/index.ts
+var EMBEDDED_ADMIN_PROTOCOL_VERSION = 1;
+var EMBEDDED_ADMIN_CHALLENGE_MESSAGE = "01.embedded-admin.challenge";
+var EMBEDDED_ADMIN_READY_MESSAGE = "01.embedded-admin.ready";
+var EMBEDDED_ADMIN_SESSION_MESSAGE = "01.embedded-admin.session";
+var EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60;
+var EMBEDDED_ADMIN_APP_KEY = "primary";
+var DEFAULT_RECEIVER_TIMEOUT_MS = 35e3;
+var MAX_RECEIVER_TIMEOUT_MS = 12e4;
+var MAX_LABEL_LENGTH = 80;
+var MAX_PATH_LENGTH = 512;
+function isLoopbackHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function normalizeEmbeddedAdminExactOrigin(value, options = {}) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 2048) return null;
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  const allowedProtocol = parsed.protocol === "https:" || options.allowLoopbackHttp === true && parsed.protocol === "http:" && isLoopbackHostname(parsed.hostname);
+  if (!allowedProtocol || parsed.hostname.includes("*")) return null;
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    return null;
+  }
+  if (parsed.pathname !== "/" || trimmed.endsWith("/")) return null;
+  return parsed.origin;
+}
+function normalizeEmbeddedAdminRelativePath(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.length > MAX_PATH_LENGTH) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed, "https://embedded.invalid");
+  } catch {
+    return null;
+  }
+  if (parsed.origin !== "https://embedded.invalid" || parsed.pathname.startsWith("//") || parsed.search || parsed.hash || parsed.username || parsed.password) {
+    return null;
+  }
+  return parsed.pathname;
+}
+function normalizeEmbeddedAdminBindingConfiguration(value, options = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw createValidationError("Embedded admin binding must be an object.");
+  }
+  const input = value;
+  const label = typeof input.label === "string" ? input.label.trim() : "";
+  const origin = normalizeEmbeddedAdminExactOrigin(input.origin);
+  const path = normalizeEmbeddedAdminRelativePath(input.path);
+  const consoleOrigin = options.consoleOrigin ? normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {
+    allowLoopbackHttp: options.allowLoopbackConsoleHttp === true
+  }) : null;
+  if (!label || label.length > MAX_LABEL_LENGTH) {
+    throw createValidationError(
+      `Embedded admin label must be between 1 and ${MAX_LABEL_LENGTH} characters.`
+    );
+  }
+  if (!origin) {
+    throw createValidationError(
+      "Embedded admin origin must be an exact HTTPS origin without a path, query, fragment, wildcard, or credentials."
+    );
+  }
+  if (!path) {
+    throw createValidationError(
+      "Embedded admin path must begin with / and must not include a query or fragment."
+    );
+  }
+  if (consoleOrigin && origin === consoleOrigin) {
+    throw createValidationError(
+      "Embedded admin origin must be different from the Console origin."
+    );
+  }
+  return {
+    enabled: input.enabled !== false,
+    label,
+    origin,
+    path
+  };
+}
+function isEmbeddedAdminChallengeMessage(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const message = value;
+  return message.type === EMBEDDED_ADMIN_CHALLENGE_MESSAGE && message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION && typeof message.requestId === "string" && message.requestId.length >= 16 && message.requestId.length <= 128;
+}
+function isEmbeddedAdminReadyMessage(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const message = value;
+  return message.type === EMBEDDED_ADMIN_READY_MESSAGE && message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION && typeof message.requestId === "string" && message.requestId.length >= 16 && message.requestId.length <= 128;
+}
+function isEmbeddedAdminSessionMessage(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const message = value;
+  return message.type === EMBEDDED_ADMIN_SESSION_MESSAGE && message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION && typeof message.requestId === "string" && message.requestId.length >= 16 && message.requestId.length <= 128 && typeof message.token === "string" && message.token.length > 0;
+}
+function receiveEmbeddedAdminSession(options) {
+  if (typeof window === "undefined" || window.parent === window) {
+    return Promise.reject(
+      createValidationError(
+        "receiveEmbeddedAdminSession must run inside an embedded browser frame."
+      )
+    );
+  }
+  const consoleOrigin = normalizeEmbeddedAdminExactOrigin(
+    options.consoleOrigin,
+    { allowLoopbackHttp: options.allowLoopbackHttp === true }
+  );
+  if (!consoleOrigin) {
+    return Promise.reject(
+      createValidationError("consoleOrigin must be one exact HTTPS origin.")
+    );
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_RECEIVER_TIMEOUT_MS;
+  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_RECEIVER_TIMEOUT_MS) {
+    return Promise.reject(
+      createValidationError(
+        `timeoutMs must be an integer between 1 and ${MAX_RECEIVER_TIMEOUT_MS}.`
+      )
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const ports = /* @__PURE__ */ new Set();
+    let settled = false;
+    const closePorts = () => {
+      for (const port of ports) port.close();
+      ports.clear();
+    };
+    const cleanup = () => {
+      window.removeEventListener("message", acceptChallenge);
+      options.signal?.removeEventListener("abort", abort);
+      clearTimeout(timer);
+      closePorts();
+    };
+    const finish = (receipt) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(receipt);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    };
+    const abort = () => fail(new Error("Embedded admin session receipt aborted."));
+    const acceptSession = (event, expectedRequestId) => {
+      if (!isEmbeddedAdminSessionMessage(event.data) || event.data.requestId !== expectedRequestId) {
+        return;
+      }
+      finish({ requestId: event.data.requestId, token: event.data.token });
+    };
+    const acceptChallenge = (event) => {
+      if (event.source !== window.parent || event.origin !== consoleOrigin || !isEmbeddedAdminChallengeMessage(event.data) || event.ports.length !== 1) {
+        for (const port2 of event.ports) port2.close();
+        return;
+      }
+      const port = event.ports[0];
+      const requestId = event.data.requestId;
+      ports.add(port);
+      port.addEventListener("message", (message) => {
+        acceptSession(message, requestId);
+      });
+      port.start();
+      port.postMessage({
+        type: EMBEDDED_ADMIN_READY_MESSAGE,
+        version: EMBEDDED_ADMIN_PROTOCOL_VERSION,
+        requestId
+      });
+    };
+    const timer = setTimeout(() => {
+      fail(new Error("Timed out waiting for an embedded admin session."));
+    }, timeoutMs);
+    if (options.signal?.aborted) {
+      abort();
+      return;
+    }
+    options.signal?.addEventListener("abort", abort, { once: true });
+    window.addEventListener("message", acceptChallenge);
+  });
+}
+export {
+  EMBEDDED_ADMIN_APP_KEY,
+  EMBEDDED_ADMIN_CHALLENGE_MESSAGE,
+  EMBEDDED_ADMIN_PROTOCOL_VERSION,
+  EMBEDDED_ADMIN_READY_MESSAGE,
+  EMBEDDED_ADMIN_SESSION_MESSAGE,
+  EMBEDDED_ADMIN_SESSION_TTL_SECONDS,
+  isEmbeddedAdminChallengeMessage,
+  isEmbeddedAdminReadyMessage,
+  isEmbeddedAdminSessionMessage,
+  normalizeEmbeddedAdminBindingConfiguration,
+  normalizeEmbeddedAdminExactOrigin,
+  normalizeEmbeddedAdminRelativePath,
+  receiveEmbeddedAdminSession
+};
+//# sourceMappingURL=embedded-admin.js.map

package/dist/embedded-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/errors.ts","../src/embedded-admin/index.ts"],"sourcesContent":["const SDK_ERROR_BRAND = Symbol.for('@01.software/sdk/SDKError')\nconst SDK_ERROR_TYPE_BRAND = Symbol.for('@01.software/sdk/SDKError.type')\n\ntype SDKErrorType =\n  | 'NetworkError'\n  | 'ValidationError'\n  | 'ApiError'\n  | 'ConfigError'\n  | 'TimeoutError'\n  | 'GoneError'\n  | 'ServiceUnavailableError'\n  | 'UsageLimitError'\n  | 'AuthError'\n  | 'PermissionError'\n  | 'NotFoundError'\n  | 'ConflictError'\n  | 'RateLimitError'\n\nfunction defineSDKErrorBrand(error: SDKError): void {\n  Object.defineProperty(error, SDK_ERROR_BRAND, {\n    value: true,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nfunction defineSDKErrorType(error: SDKError, type: SDKErrorType): void {\n  Object.defineProperty(error, SDK_ERROR_TYPE_BRAND, {\n    value: type,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nexport class SDKError extends Error {\n  readonly code: string\n  readonly status?: number\n  readonly details?: unknown\n  readonly userMessage?: string\n  readonly suggestion?: string\n  readonly requestId?: string\n  readonly kind?: 'commerce'\n  readonly reason?: CommerceErrorCode | 'unknown_commerce_error'\n  readonly rawReason?: string\n  /** Machine-readable reason from a non-commerce API response. */\n  readonly apiReason?: string\n  readonly retryable?: boolean\n  readonly retryAfter?: number\n\n  constructor(\n    code: string,\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(message)\n    this.name = 'SDKError'\n    this.code = code\n    this.status = status\n    this.details = details\n    this.userMessage = userMessage\n    this.suggestion = suggestion\n    this.requestId = requestId\n    defineSDKErrorBrand(this)\n\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, new.target)\n    }\n  }\n\n  getUserMessage(): string {\n    return this.userMessage || this.message\n  }\n\n  toJSON() {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      details: this.details,\n      userMessage: this.userMessage,\n      suggestion: this.suggestion,\n      ...(this.requestId !== undefined && { requestId: this.requestId }),\n      ...(this.kind !== undefined && { kind: this.kind }),\n      ...(this.reason !== undefined && { reason: this.reason }),\n      ...(this.rawReason !== undefined && { rawReason: this.rawReason }),\n      ...(this.apiReason !== undefined && { apiReason: this.apiReason }),\n      ...(this.retryable !== undefined && { retryable: this.retryable }),\n      ...(this.retryAfter !== undefined && { retryAfter: this.retryAfter }),\n    }\n  }\n}\n\n/**\n * Canonical Cart/Checkout/PaymentSession error reasons. This public SDK mirror\n * intentionally does not import the private contracts package; parity is\n * enforced by a type test.\n */\nexport const COMMERCE_ERROR_CODES = [\n  'validation_failed',\n  'bad_request',\n  'unauthorized',\n  'forbidden',\n  'account_suspended',\n  'key_invalid',\n  'pat_tenant_header_forbidden',\n  'tenant_mismatch',\n  'test_tenant_expired',\n  'token_invalid',\n  'token_expired',\n  'origin_not_allowed',\n  'server_credentials_required',\n  'role_denied',\n  'scope_denied',\n  'feature_disabled',\n  'not_found',\n  'conflict',\n  'locked',\n  'cart_revision_conflict',\n  'rate_limit_exceeded',\n  'usage_limit_exceeded',\n  'service_unavailable',\n  'idempotency_conflict',\n  'idempotency_in_progress',\n  'idempotency_key_required',\n  'invalid_idempotency_key',\n  'cart_not_active',\n  'cart_locked',\n  'cart_empty',\n  'cart_market_unavailable',\n  'cart_market_mismatch',\n  'checkout_not_open',\n  'checkout_already_open',\n  'payment_slot_held',\n  'reservation_expired',\n  'payment_session_not_cancelable',\n  'payment_session_conflict',\n  'provider_identity_mismatch',\n  'managed_refund_attestation_forbidden',\n  'payment_method_unavailable',\n  'provider_unavailable',\n  'lock_timeout',\n  'price_changed',\n  'pricing_fact_in_use',\n  'insufficient_stock',\n  'reservation_conflict',\n  'stock_lock_unavailable',\n  'variant_not_found',\n  'variant_stock_write_failed',\n  'stock_invariant_violation',\n  'payment_confirmation_in_flight',\n  'checkout_reservation_release_requires_transaction',\n  'admission_metadata_invalid',\n  'admission_metadata_required',\n  'capacity_exceeded',\n  'occurrence_lock_unavailable',\n  'occurrence_not_open',\n  'admission_type_capacity_exceeded',\n  'admission_type_occurrence_mismatch',\n  'admission_hold_expired',\n  'admission_hold_checkout_item_conflict',\n  'admission_hold_checkout_conflict',\n  'admission_hold_quantity_mismatch',\n  'admission_hold_unbound',\n  'admission_hold_missing',\n  'admission_hold_checkout_item_missing',\n  'admission_hold_expiry_failed',\n  'admission_hold_expiry_requires_transaction',\n  'admission_hold_line_item_mismatch',\n  'admission_materialization_failed',\n  'variant_inactive',\n  'variant_product_mismatch',\n  'product_not_public',\n  'market_not_found',\n  'market_shipping_currency_unsupported',\n  'missing_market_rate',\n  'missing_shipping_amount',\n  'no_enabled_payment_provider',\n  'product_market_unavailable',\n  'unsupported_currency',\n  'missing_price_row',\n  'payment_provider_currency_unsupported',\n  'discount_code_not_found',\n  'discount_not_started',\n  'discount_expired',\n  'discount_usage_limit',\n  'discount_per_customer_limit',\n  'discount_customer_required',\n  'discount_first_order_only',\n  'discount_customer_not_eligible',\n  'discount_customer_excluded',\n  'discount_items_required',\n  'discount_product_not_eligible',\n  'discount_product_excluded',\n  'discount_min_order_amount',\n  'discount_currency_scope_required',\n  'discount_allocation_method_unsupported',\n  'currency_mismatch',\n  'customer_token_required',\n  'market_required',\n  'server_derived',\n  'internal_error',\n] as const\n\nexport type CommerceErrorCode = (typeof COMMERCE_ERROR_CODES)[number]\n\ntype CommerceSDKErrorBase = SDKError & {\n  readonly kind: 'commerce'\n  readonly requestId: string\n  readonly retryable: boolean\n  readonly retryAfter?: number\n  readonly details?: Record<string, unknown>\n}\n\nexport type CommerceSDKError = CommerceSDKErrorBase &\n  (\n    | { readonly reason: CommerceErrorCode; readonly rawReason?: never }\n    | {\n        readonly reason: 'unknown_commerce_error'\n        readonly rawReason: string\n      }\n  )\n\nconst COMMERCE_ERROR_CODE_SET: ReadonlySet<string> = new Set(\n  COMMERCE_ERROR_CODES,\n)\nconst COMMERCE_ERROR_ENVELOPE_KEYS = new Set([\n  'error',\n  'reason',\n  'requestId',\n  'retryable',\n  'details',\n])\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nexport type CommerceErrorEnvelope = {\n  error: string\n  reason: string\n  requestId: string\n  retryable: boolean\n  details?: Record<string, unknown>\n}\n\nfunction commerceProtocolError(\n  issue: string,\n  trustedRequestId?: string,\n): SDKError {\n  return createApiError(\n    'Invalid canonical commerce error response.',\n    502,\n    { protocol: 'commerce-error-envelope', issue },\n    'The server returned an incompatible commerce error response.',\n    'Verify that the Console commerce contract is deployed before using this SDK version.',\n    trustedRequestId,\n  )\n}\n\n/** @internal Strictly parse a canonical commerce error without retaining its raw body. */\nexport function parseCommerceErrorEnvelope(\n  body: unknown,\n  headerRequestId?: string,\n): CommerceErrorEnvelope {\n  if (headerRequestId === undefined) {\n    throw commerceProtocolError('missing_request_id_header')\n  }\n  if (headerRequestId.length === 0) {\n    throw commerceProtocolError('empty_request_id_header')\n  }\n  if (!isPlainRecord(body)) {\n    throw commerceProtocolError('expected_object', headerRequestId)\n  }\n  if (Object.keys(body).some((key) => !COMMERCE_ERROR_ENVELOPE_KEYS.has(key))) {\n    throw commerceProtocolError('unexpected_field', headerRequestId)\n  }\n  if (\n    typeof body.error !== 'string' ||\n    body.error.length === 0 ||\n    typeof body.reason !== 'string' ||\n    body.reason.length === 0 ||\n    typeof body.requestId !== 'string' ||\n    body.requestId.length === 0 ||\n    (body.retryable !== undefined && typeof body.retryable !== 'boolean') ||\n    (body.details !== undefined && !isPlainRecord(body.details))\n  ) {\n    throw commerceProtocolError('invalid_field', headerRequestId)\n  }\n\n  if (headerRequestId !== undefined && headerRequestId !== body.requestId) {\n    throw commerceProtocolError('request_id_mismatch', headerRequestId)\n  }\n\n  return {\n    error: body.error,\n    reason: body.reason,\n    requestId: body.requestId,\n    retryable: body.retryable === true,\n    ...(body.details === undefined ? {} : { details: body.details }),\n  }\n}\n\n/** @internal Validate and apply the canonical commerce error envelope. */\nexport function enhanceCommerceError(\n  error: SDKError,\n  body: unknown,\n  headerRequestId?: string,\n): SDKError {\n  const envelope = parseCommerceErrorEnvelope(body, headerRequestId)\n\n  const known = COMMERCE_ERROR_CODE_SET.has(envelope.reason)\n  Object.assign(error, {\n    code: envelope.reason,\n    kind: 'commerce' as const,\n    reason: known\n      ? (envelope.reason as CommerceErrorCode)\n      : 'unknown_commerce_error',\n    ...(known ? {} : { rawReason: envelope.reason }),\n    requestId: envelope.requestId,\n    retryable: envelope.retryable,\n    details: envelope.details,\n  })\n  return error\n}\n\n/** @internal Apply a non-commerce reason without canonical-commerce validation. */\nexport function enhanceNonCommerceError(\n  error: SDKError,\n  reason: unknown,\n): SDKError {\n  if (typeof reason === 'string') Object.assign(error, { apiReason: reason })\n  return error\n}\n\n/**\n * Read the server-provided machine reason across strict commerce and\n * non-commerce SDK errors. Unknown commerce reasons are returned verbatim.\n */\nexport function getSDKErrorReason(error: SDKError): string | undefined {\n  if (error.kind !== 'commerce') return error.apiReason\n  return error.reason === 'unknown_commerce_error'\n    ? error.rawReason\n    : error.reason\n}\n\nexport function isCommerceSDKError(error: unknown): error is CommerceSDKError {\n  if (!isSDKError(error) || error.kind !== 'commerce') return false\n  if (\n    typeof error.requestId !== 'string' ||\n    typeof error.retryable !== 'boolean' ||\n    (error.retryAfter !== undefined &&\n      (!Number.isSafeInteger(error.retryAfter) || error.retryAfter < 0)) ||\n    typeof error.reason !== 'string'\n  ) {\n    return false\n  }\n  return error.reason === 'unknown_commerce_error'\n    ? typeof error.rawReason === 'string'\n    : COMMERCE_ERROR_CODE_SET.has(error.reason) && error.rawReason === undefined\n}\n\nexport class NetworkError extends SDKError {\n  constructor(\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('NETWORK_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'NetworkError'\n    defineSDKErrorType(this, 'NetworkError')\n  }\n}\n\nexport class ValidationError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    status = 400,\n  ) {\n    super('VALIDATION_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'ValidationError'\n    defineSDKErrorType(this, 'ValidationError')\n  }\n}\n\nexport class ApiError extends SDKError {\n  constructor(\n    message: string,\n    status: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'API_ERROR',\n      message,\n      status,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'ApiError'\n    defineSDKErrorType(this, 'ApiError')\n  }\n}\n\nexport class ConfigError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('CONFIG_ERROR', message, undefined, details, userMessage, suggestion)\n    this.name = 'ConfigError'\n    defineSDKErrorType(this, 'ConfigError')\n  }\n}\n\nexport class TimeoutError extends SDKError {\n  constructor(\n    message = 'Request timed out.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('TIMEOUT_ERROR', message, 408, details, userMessage, suggestion)\n    this.name = 'TimeoutError'\n    defineSDKErrorType(this, 'TimeoutError')\n  }\n}\n\nexport class GoneError extends SDKError {\n  constructor(\n    message = 'The requested resource is no longer available.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('GONE_ERROR', message, 410, details, userMessage, suggestion)\n    this.name = 'GoneError'\n    defineSDKErrorType(this, 'GoneError')\n  }\n}\n\nexport class ServiceUnavailableError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message = 'Service temporarily unavailable.',\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super(\n      'SERVICE_UNAVAILABLE_ERROR',\n      message,\n      503,\n      details,\n      userMessage,\n      suggestion,\n    )\n    this.name = 'ServiceUnavailableError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'ServiceUnavailableError')\n  }\n}\n\nexport class UsageLimitError extends SDKError {\n  readonly usage: { limit: number; current: number; remaining: number }\n\n  constructor(\n    message: string,\n    usage: { limit: number; current: number; remaining: number },\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('USAGE_LIMIT_ERROR', message, 429, details, userMessage, suggestion)\n    this.name = 'UsageLimitError'\n    this.usage = usage\n    defineSDKErrorType(this, 'UsageLimitError')\n  }\n\n  toJSON() {\n    return {\n      ...super.toJSON(),\n      usage: this.usage,\n    }\n  }\n}\n\nexport class AuthError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'auth_error',\n      message,\n      401,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'AuthError'\n    defineSDKErrorType(this, 'AuthError')\n  }\n}\n\nexport class PermissionError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'permission_error',\n      message,\n      403,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'PermissionError'\n    defineSDKErrorType(this, 'PermissionError')\n  }\n}\n\nexport class NotFoundError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'not_found',\n      message,\n      404,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'NotFoundError'\n    defineSDKErrorType(this, 'NotFoundError')\n  }\n}\n\nexport class ConflictError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super('conflict', message, 409, details, userMessage, suggestion, requestId)\n    this.name = 'ConflictError'\n    defineSDKErrorType(this, 'ConflictError')\n  }\n}\n\nexport class RateLimitError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message: string,\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'rate_limit_exceeded',\n      message,\n      429,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'RateLimitError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'RateLimitError')\n  }\n}\n\nfunction hasBrandedSDKErrorShape(error: unknown): error is SDKError {\n  if (error === null || typeof error !== 'object') return false\n\n  const candidate = error as Record<PropertyKey, unknown>\n  return (\n    candidate[SDK_ERROR_BRAND] === true &&\n    typeof candidate.name === 'string' &&\n    typeof candidate.code === 'string' &&\n    typeof candidate.message === 'string' &&\n    (candidate.status === undefined || typeof candidate.status === 'number') &&\n    (candidate.userMessage === undefined ||\n      typeof candidate.userMessage === 'string') &&\n    (candidate.suggestion === undefined ||\n      typeof candidate.suggestion === 'string') &&\n    (candidate.requestId === undefined ||\n      typeof candidate.requestId === 'string') &&\n    (candidate.kind === undefined || candidate.kind === 'commerce') &&\n    (candidate.reason === undefined || typeof candidate.reason === 'string') &&\n    (candidate.rawReason === undefined ||\n      typeof candidate.rawReason === 'string') &&\n    (candidate.apiReason === undefined ||\n      typeof candidate.apiReason === 'string') &&\n    (candidate.retryable === undefined ||\n      typeof candidate.retryable === 'boolean') &&\n    (candidate.retryAfter === undefined ||\n      typeof candidate.retryAfter === 'number') &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nfunction hasSDKErrorType(error: unknown, type: SDKErrorType): boolean {\n  return (\n    hasBrandedSDKErrorShape(error) &&\n    (error as unknown as Record<PropertyKey, unknown>)[SDK_ERROR_TYPE_BRAND] ===\n      type\n  )\n}\n\nexport function isSDKError(error: unknown): error is SDKError {\n  return error instanceof SDKError || hasBrandedSDKErrorShape(error)\n}\n\nexport function isNetworkError(error: unknown): error is NetworkError {\n  return error instanceof NetworkError || hasSDKErrorType(error, 'NetworkError')\n}\n\nexport function isValidationError(error: unknown): error is ValidationError {\n  if (\n    error instanceof ValidationError ||\n    hasSDKErrorType(error, 'ValidationError')\n  ) {\n    return true\n  }\n  if (error == null || typeof error !== 'object') return false\n\n  const candidate = error as {\n    code?: unknown\n    name?: unknown\n    message?: unknown\n    getUserMessage?: unknown\n    toJSON?: unknown\n  }\n  return (\n    candidate.name === 'ValidationError' &&\n    candidate.code === 'VALIDATION_ERROR' &&\n    typeof candidate.message === 'string' &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nexport function isApiError(error: unknown): error is ApiError {\n  return error instanceof ApiError || hasSDKErrorType(error, 'ApiError')\n}\n\nexport function isConfigError(error: unknown): error is ConfigError {\n  return error instanceof ConfigError || hasSDKErrorType(error, 'ConfigError')\n}\n\nexport function isTimeoutError(error: unknown): error is TimeoutError {\n  return error instanceof TimeoutError || hasSDKErrorType(error, 'TimeoutError')\n}\n\nexport function isGoneError(error: unknown): error is GoneError {\n  return error instanceof GoneError || hasSDKErrorType(error, 'GoneError')\n}\n\nexport function isServiceUnavailableError(\n  error: unknown,\n): error is ServiceUnavailableError {\n  return (\n    error instanceof ServiceUnavailableError ||\n    hasSDKErrorType(error, 'ServiceUnavailableError')\n  )\n}\n\nexport function isUsageLimitError(error: unknown): error is UsageLimitError {\n  return (\n    error instanceof UsageLimitError ||\n    hasSDKErrorType(error, 'UsageLimitError')\n  )\n}\n\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError || hasSDKErrorType(error, 'AuthError')\n}\n\nexport function isPermissionError(error: unknown): error is PermissionError {\n  return (\n    error instanceof PermissionError ||\n    hasSDKErrorType(error, 'PermissionError')\n  )\n}\n\nexport function isNotFoundError(error: unknown): error is NotFoundError {\n  return (\n    error instanceof NotFoundError || hasSDKErrorType(error, 'NotFoundError')\n  )\n}\n\nexport function isConflictError(error: unknown): error is ConflictError {\n  return (\n    error instanceof ConflictError || hasSDKErrorType(error, 'ConflictError')\n  )\n}\n\nexport function isRateLimitError(error: unknown): error is RateLimitError {\n  return (\n    error instanceof RateLimitError || hasSDKErrorType(error, 'RateLimitError')\n  )\n}\n\nexport const createNetworkError = (\n  message: string,\n  status?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new NetworkError(message, status, details, userMessage, suggestion)\n\nexport const createValidationError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  status?: number,\n) => new ValidationError(message, details, userMessage, suggestion, status)\n\nexport const createApiError = (\n  message: string,\n  status: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ApiError(message, status, details, userMessage, suggestion, requestId)\n\nexport const createConfigError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new ConfigError(message, details, userMessage, suggestion)\n\nexport const createTimeoutError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new TimeoutError(message, details, userMessage, suggestion)\n\nexport const createGoneError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new GoneError(message, details, userMessage, suggestion)\n\nexport const createServiceUnavailableError = (\n  message?: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) =>\n  new ServiceUnavailableError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n  )\n\nexport const createUsageLimitError = (\n  message: string,\n  usage: { limit: number; current: number; remaining: number },\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new UsageLimitError(message, usage, details, userMessage, suggestion)\n\nexport const createAuthError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new AuthError(message, details, userMessage, suggestion, requestId)\n\nexport const createPermissionError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new PermissionError(message, details, userMessage, suggestion, requestId)\n\nexport const createNotFoundError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new NotFoundError(message, details, userMessage, suggestion, requestId)\n\nexport const createConflictError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ConflictError(message, details, userMessage, suggestion, requestId)\n\nexport const createRateLimitError = (\n  message: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) =>\n  new RateLimitError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n    requestId,\n  )\n","import { createValidationError } from '../core/internal/errors'\n\nexport const EMBEDDED_ADMIN_PROTOCOL_VERSION = 1 as const\nexport const EMBEDDED_ADMIN_CHALLENGE_MESSAGE =\n  '01.embedded-admin.challenge' as const\nexport const EMBEDDED_ADMIN_READY_MESSAGE = '01.embedded-admin.ready' as const\nexport const EMBEDDED_ADMIN_SESSION_MESSAGE =\n  '01.embedded-admin.session' as const\nexport const EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60 as const\nexport const EMBEDDED_ADMIN_APP_KEY = 'primary' as const\n\nconst DEFAULT_RECEIVER_TIMEOUT_MS = 35_000\nconst MAX_RECEIVER_TIMEOUT_MS = 120_000\nconst MAX_LABEL_LENGTH = 80\nconst MAX_PATH_LENGTH = 512\n\nexport type EmbeddedAdminChallengeMessage = {\n  type: typeof EMBEDDED_ADMIN_CHALLENGE_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminReadyMessage = {\n  type: typeof EMBEDDED_ADMIN_READY_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminSessionMessage = {\n  type: typeof EMBEDDED_ADMIN_SESSION_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n  token: string\n}\n\nexport type EmbeddedAdminBindingConfiguration = {\n  enabled: boolean\n  label: string\n  origin: string\n  path: string\n}\n\nexport type EmbeddedAdminSessionReceipt = {\n  requestId: string\n  token: string\n}\n\nexport type ReceiveEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  /** Exact Console origin configured by the receiver deployment. */\n  consoleOrigin: string\n  /** Cancels the one-shot receiver and closes every transferred port. */\n  signal?: AbortSignal\n  /** Defaults to 35 seconds and is capped at 120 seconds. */\n  timeoutMs?: number\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n  )\n}\n\nexport function normalizeEmbeddedAdminExactOrigin(\n  value: unknown,\n  options: { allowLoopbackHttp?: boolean } = {},\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (!trimmed || trimmed.length > 2048) return null\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed)\n  } catch {\n    return null\n  }\n\n  const allowedProtocol =\n    parsed.protocol === 'https:' ||\n    (options.allowLoopbackHttp === true &&\n      parsed.protocol === 'http:' &&\n      isLoopbackHostname(parsed.hostname))\n  if (!allowedProtocol || parsed.hostname.includes('*')) return null\n  if (parsed.username || parsed.password || parsed.search || parsed.hash) {\n    return null\n  }\n  if (parsed.pathname !== '/' || trimmed.endsWith('/')) return null\n\n  return parsed.origin\n}\n\nexport function normalizeEmbeddedAdminRelativePath(\n  value: unknown,\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (\n    !trimmed.startsWith('/') ||\n    trimmed.startsWith('//') ||\n    trimmed.length > MAX_PATH_LENGTH\n  ) {\n    return null\n  }\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed, 'https://embedded.invalid')\n  } catch {\n    return null\n  }\n\n  if (\n    parsed.origin !== 'https://embedded.invalid' ||\n    parsed.pathname.startsWith('//') ||\n    parsed.search ||\n    parsed.hash ||\n    parsed.username ||\n    parsed.password\n  ) {\n    return null\n  }\n\n  return parsed.pathname\n}\n\nexport function normalizeEmbeddedAdminBindingConfiguration(\n  value: unknown,\n  options: {\n    allowLoopbackConsoleHttp?: boolean\n    consoleOrigin?: string\n  } = {},\n): EmbeddedAdminBindingConfiguration {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw createValidationError('Embedded admin binding must be an object.')\n  }\n\n  const input = value as Record<string, unknown>\n  const label = typeof input.label === 'string' ? input.label.trim() : ''\n  const origin = normalizeEmbeddedAdminExactOrigin(input.origin)\n  const path = normalizeEmbeddedAdminRelativePath(input.path)\n  const consoleOrigin = options.consoleOrigin\n    ? normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n        allowLoopbackHttp: options.allowLoopbackConsoleHttp === true,\n      })\n    : null\n\n  if (!label || label.length > MAX_LABEL_LENGTH) {\n    throw createValidationError(\n      `Embedded admin label must be between 1 and ${MAX_LABEL_LENGTH} characters.`,\n    )\n  }\n  if (!origin) {\n    throw createValidationError(\n      'Embedded admin origin must be an exact HTTPS origin without a path, query, fragment, wildcard, or credentials.',\n    )\n  }\n  if (!path) {\n    throw createValidationError(\n      'Embedded admin path must begin with / and must not include a query or fragment.',\n    )\n  }\n  if (consoleOrigin && origin === consoleOrigin) {\n    throw createValidationError(\n      'Embedded admin origin must be different from the Console origin.',\n    )\n  }\n\n  return {\n    enabled: input.enabled !== false,\n    label,\n    origin,\n    path,\n  }\n}\n\nexport function isEmbeddedAdminChallengeMessage(\n  value: unknown,\n): value is EmbeddedAdminChallengeMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_CHALLENGE_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminReadyMessage(\n  value: unknown,\n): value is EmbeddedAdminReadyMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_READY_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminSessionMessage(\n  value: unknown,\n): value is EmbeddedAdminSessionMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_SESSION_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128 &&\n    typeof message.token === 'string' &&\n    message.token.length > 0\n  )\n}\n\n/**\n * Receives one Console assertion through the exact parent/origin challenge\n * channel. Forward the returned token immediately to the receiver backend;\n * never persist, log, decode, or use it as Console API authority in-browser.\n */\nexport function receiveEmbeddedAdminSession(\n  options: ReceiveEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionReceipt> {\n  if (typeof window === 'undefined' || window.parent === window) {\n    return Promise.reject(\n      createValidationError(\n        'receiveEmbeddedAdminSession must run inside an embedded browser frame.',\n      ),\n    )\n  }\n\n  const consoleOrigin = normalizeEmbeddedAdminExactOrigin(\n    options.consoleOrigin,\n    { allowLoopbackHttp: options.allowLoopbackHttp === true },\n  )\n  if (!consoleOrigin) {\n    return Promise.reject(\n      createValidationError('consoleOrigin must be one exact HTTPS origin.'),\n    )\n  }\n\n  const timeoutMs = options.timeoutMs ?? DEFAULT_RECEIVER_TIMEOUT_MS\n  if (\n    !Number.isInteger(timeoutMs) ||\n    timeoutMs <= 0 ||\n    timeoutMs > MAX_RECEIVER_TIMEOUT_MS\n  ) {\n    return Promise.reject(\n      createValidationError(\n        `timeoutMs must be an integer between 1 and ${MAX_RECEIVER_TIMEOUT_MS}.`,\n      ),\n    )\n  }\n\n  return new Promise((resolve, reject) => {\n    const ports = new Set<MessagePort>()\n    let settled = false\n\n    const closePorts = () => {\n      for (const port of ports) port.close()\n      ports.clear()\n    }\n    const cleanup = () => {\n      window.removeEventListener('message', acceptChallenge)\n      options.signal?.removeEventListener('abort', abort)\n      clearTimeout(timer)\n      closePorts()\n    }\n    const finish = (receipt: EmbeddedAdminSessionReceipt) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      resolve(receipt)\n    }\n    const fail = (error: Error) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      reject(error)\n    }\n    const abort = () =>\n      fail(new Error('Embedded admin session receipt aborted.'))\n    const acceptSession = (\n      event: MessageEvent<unknown>,\n      expectedRequestId: string,\n    ) => {\n      if (\n        !isEmbeddedAdminSessionMessage(event.data) ||\n        event.data.requestId !== expectedRequestId\n      ) {\n        return\n      }\n      finish({ requestId: event.data.requestId, token: event.data.token })\n    }\n    const acceptChallenge = (event: MessageEvent<unknown>) => {\n      if (\n        event.source !== window.parent ||\n        event.origin !== consoleOrigin ||\n        !isEmbeddedAdminChallengeMessage(event.data) ||\n        event.ports.length !== 1\n      ) {\n        for (const port of event.ports) port.close()\n        return\n      }\n\n      const port = event.ports[0]!\n      const requestId = event.data.requestId\n      ports.add(port)\n      port.addEventListener('message', (message) => {\n        acceptSession(message, requestId)\n      })\n      port.start()\n      port.postMessage({\n        type: EMBEDDED_ADMIN_READY_MESSAGE,\n        version: EMBEDDED_ADMIN_PROTOCOL_VERSION,\n        requestId,\n      } satisfies EmbeddedAdminReadyMessage)\n    }\n\n    const timer = setTimeout(() => {\n      fail(new Error('Timed out waiting for an embedded admin session.'))\n    }, timeoutMs)\n\n    if (options.signal?.aborted) {\n      abort()\n      return\n    }\n    options.signal?.addEventListener('abort', abort, { once: true })\n    window.addEventListener('message', acceptChallenge)\n  })\n}\n"],"mappings":";AAAA,IAAM,kBAAkB,uBAAO,IAAI,2BAA2B;AAC9D,IAAM,uBAAuB,uBAAO,IAAI,gCAAgC;AAiBxE,SAAS,oBAAoB,OAAuB;AAClD,SAAO,eAAe,OAAO,iBAAiB;AAAA,IAC5C,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAiB,MAA0B;AACrE,SAAO,eAAe,OAAO,sBAAsB;AAAA,IACjD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAelC,YACE,MACA,SACA,QACA,SACA,aACA,YACA,WACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,aAAa;AAClB,SAAK,YAAY;AACjB,wBAAoB,IAAI;AAExB,QAAI,MAAM,mBAAmB;AAC3B,YAAM,kBAAkB,MAAM,UAAU;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,iBAAyB;AACvB,WAAO,KAAK,eAAe,KAAK;AAAA,EAClC;AAAA,EAEA,SAAS;AACP,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,YAAY,KAAK;AAAA,MACjB,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,SAAS,UAAa,EAAE,MAAM,KAAK,KAAK;AAAA,MACjD,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;AAAA,MACvD,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,eAAe,UAAa,EAAE,YAAY,KAAK,WAAW;AAAA,IACrE;AAAA,EACF;AACF;AAOO,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqBA,IAAM,0BAA+C,IAAI;AAAA,EACvD;AACF;AAuJO,IAAM,kBAAN,cAA8B,SAAS;AAAA,EAC5C,YACE,SACA,SACA,aACA,YACA,SAAS,KACT;AACA,UAAM,oBAAoB,SAAS,QAAQ,SAAS,aAAa,UAAU;AAC3E,SAAK,OAAO;AACZ,uBAAmB,MAAM,iBAAiB;AAAA,EAC5C;AACF;AAuWO,IAAM,wBAAwB,CACnC,SACA,SACA,aACA,YACA,WACG,IAAI,gBAAgB,SAAS,SAAS,aAAa,YAAY,MAAM;;;ACrvBnE,IAAM,kCAAkC;AACxC,IAAM,mCACX;AACK,IAAM,+BAA+B;AACrC,IAAM,iCACX;AACK,IAAM,qCAAqC;AAC3C,IAAM,yBAAyB;AAEtC,IAAM,8BAA8B;AACpC,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AACzB,IAAM,kBAAkB;AA4CxB,SAAS,mBAAmB,UAA2B;AACrD,SACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEO,SAAS,kCACd,OACA,UAA2C,CAAC,GAC7B;AACf,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,QAAQ,SAAS,KAAM,QAAO;AAE9C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,OAAO;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,kBACJ,OAAO,aAAa,YACnB,QAAQ,sBAAsB,QAC7B,OAAO,aAAa,WACpB,mBAAmB,OAAO,QAAQ;AACtC,MAAI,CAAC,mBAAmB,OAAO,SAAS,SAAS,GAAG,EAAG,QAAO;AAC9D,MAAI,OAAO,YAAY,OAAO,YAAY,OAAO,UAAU,OAAO,MAAM;AACtE,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,OAAO,QAAQ,SAAS,GAAG,EAAG,QAAO;AAE7D,SAAO,OAAO;AAChB;AAEO,SAAS,mCACd,OACe;AACf,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MACE,CAAC,QAAQ,WAAW,GAAG,KACvB,QAAQ,WAAW,IAAI,KACvB,QAAQ,SAAS,iBACjB;AACA,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,SAAS,0BAA0B;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MACE,OAAO,WAAW,8BAClB,OAAO,SAAS,WAAW,IAAI,KAC/B,OAAO,UACP,OAAO,QACP,OAAO,YACP,OAAO,UACP;AACA,WAAO;AAAA,EACT;AAEA,SAAO,OAAO;AAChB;AAEO,SAAS,2CACd,OACA,UAGI,CAAC,GAC8B;AACnC,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,sBAAsB,2CAA2C;AAAA,EACzE;AAEA,QAAM,QAAQ;AACd,QAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,MAAM,KAAK,IAAI;AACrE,QAAM,SAAS,kCAAkC,MAAM,MAAM;AAC7D,QAAM,OAAO,mCAAmC,MAAM,IAAI;AAC1D,QAAM,gBAAgB,QAAQ,gBAC1B,kCAAkC,QAAQ,eAAe;AAAA,IACvD,mBAAmB,QAAQ,6BAA6B;AAAA,EAC1D,CAAC,IACD;AAEJ,MAAI,CAAC,SAAS,MAAM,SAAS,kBAAkB;AAC7C,UAAM;AAAA,MACJ,8CAA8C,gBAAgB;AAAA,IAChE;AAAA,EACF;AACA,MAAI,CAAC,QAAQ;AACX,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,MAAM;AACT,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,MAAI,iBAAiB,WAAW,eAAe;AAC7C,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,MAAM,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,gCACd,OACwC;AACxC,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,UAAU;AAChB,SACE,QAAQ,SAAS,oCACjB,QAAQ,YAAY,mCACpB,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,UAAU,MAC5B,QAAQ,UAAU,UAAU;AAEhC;AAEO,SAAS,4BACd,OACoC;AACpC,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,UAAU;AAChB,SACE,QAAQ,SAAS,gCACjB,QAAQ,YAAY,mCACpB,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,UAAU,MAC5B,QAAQ,UAAU,UAAU;AAEhC;AAEO,SAAS,8BACd,OACsC;AACtC,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,UAAU;AAChB,SACE,QAAQ,SAAS,kCACjB,QAAQ,YAAY,mCACpB,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,UAAU,MAC5B,QAAQ,UAAU,UAAU,OAC5B,OAAO,QAAQ,UAAU,YACzB,QAAQ,MAAM,SAAS;AAE3B;AAOO,SAAS,4BACd,SACsC;AACtC,MAAI,OAAO,WAAW,eAAe,OAAO,WAAW,QAAQ;AAC7D,WAAO,QAAQ;AAAA,MACb;AAAA,QACE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,gBAAgB;AAAA,IACpB,QAAQ;AAAA,IACR,EAAE,mBAAmB,QAAQ,sBAAsB,KAAK;AAAA,EAC1D;AACA,MAAI,CAAC,eAAe;AAClB,WAAO,QAAQ;AAAA,MACb,sBAAsB,+CAA+C;AAAA,IACvE;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,aAAa;AACvC,MACE,CAAC,OAAO,UAAU,SAAS,KAC3B,aAAa,KACb,YAAY,yBACZ;AACA,WAAO,QAAQ;AAAA,MACb;AAAA,QACE,8CAA8C,uBAAuB;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AAEA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,QAAQ,oBAAI,IAAiB;AACnC,QAAI,UAAU;AAEd,UAAM,aAAa,MAAM;AACvB,iBAAW,QAAQ,MAAO,MAAK,MAAM;AACrC,YAAM,MAAM;AAAA,IACd;AACA,UAAM,UAAU,MAAM;AACpB,aAAO,oBAAoB,WAAW,eAAe;AACrD,cAAQ,QAAQ,oBAAoB,SAAS,KAAK;AAClD,mBAAa,KAAK;AAClB,iBAAW;AAAA,IACb;AACA,UAAM,SAAS,CAAC,YAAyC;AACvD,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,cAAQ,OAAO;AAAA,IACjB;AACA,UAAM,OAAO,CAAC,UAAiB;AAC7B,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,aAAO,KAAK;AAAA,IACd;AACA,UAAM,QAAQ,MACZ,KAAK,IAAI,MAAM,yCAAyC,CAAC;AAC3D,UAAM,gBAAgB,CACpB,OACA,sBACG;AACH,UACE,CAAC,8BAA8B,MAAM,IAAI,KACzC,MAAM,KAAK,cAAc,mBACzB;AACA;AAAA,MACF;AACA,aAAO,EAAE,WAAW,MAAM,KAAK,WAAW,OAAO,MAAM,KAAK,MAAM,CAAC;AAAA,IACrE;AACA,UAAM,kBAAkB,CAAC,UAAiC;AACxD,UACE,MAAM,WAAW,OAAO,UACxB,MAAM,WAAW,iBACjB,CAAC,gCAAgC,MAAM,IAAI,KAC3C,MAAM,MAAM,WAAW,GACvB;AACA,mBAAWA,SAAQ,MAAM,MAAO,CAAAA,MAAK,MAAM;AAC3C;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,MAAM,CAAC;AAC1B,YAAM,YAAY,MAAM,KAAK;AAC7B,YAAM,IAAI,IAAI;AACd,WAAK,iBAAiB,WAAW,CAAC,YAAY;AAC5C,sBAAc,SAAS,SAAS;AAAA,MAClC,CAAC;AACD,WAAK,MAAM;AACX,WAAK,YAAY;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT;AAAA,MACF,CAAqC;AAAA,IACvC;AAEA,UAAM,QAAQ,WAAW,MAAM;AAC7B,WAAK,IAAI,MAAM,kDAAkD,CAAC;AAAA,IACpE,GAAG,SAAS;AAEZ,QAAI,QAAQ,QAAQ,SAAS;AAC3B,YAAM;AACN;AAAA,IACF;AACA,YAAQ,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAC/D,WAAO,iBAAiB,WAAW,eAAe;AAAA,EACpD,CAAC;AACH;","names":["port"]}

package/dist/errors.cjs

@@ -163,6 +163,7 @@ var COMMERCE_ERROR_CODES = [
   "payment_session_not_cancelable",
   "payment_session_conflict",
   "provider_identity_mismatch",
+  "managed_refund_attestation_forbidden",
   "payment_method_unavailable",
   "provider_unavailable",
   "lock_timeout",