@01.software/sdk 0.67.0 → 0.68.0

package/dist/{collection-client-D4HEOoO_.d.ts → collection-client-IOaWsTMI.d.ts}

@@ -1,8 +1,8 @@
-import { G as DebugConfig, ak as RetryConfig, i as ApiQueryOptions, P as PayloadFindResponse, L as PayloadMutationResponse, cU as ApiDeleteOptions, cV as PublicReadQueryOptions } from './types-I2k6Laad.js';
-import './payload-types-jdsUXunB.js';
+import { cU as DebugConfig, c_ as RetryConfig, cN as ApiQueryOptions, cX as PayloadFindResponse, cY as PayloadMutationResponse, dc as ApiDeleteOptions, dd as PublicReadQueryOptions } from './types-CLRw0aDa.js';
+import './payload-types-BY1uZFRf.js';
 import { GenerateMetadataOptions, Metadata } from './metadata.js';
-import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-BU79hCFB.js';
-import { C as CollectionType } from './types-BusejG-v.js';
+import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-Do27Udj6.js';
+import { C as CollectionType } from './types-AWSVpuPE.js';
 
 interface FetchOptions extends RequestInit {
     apiUrl?: string;

package/dist/{collection-client-jrNFGbrO.d.cts → collection-client-MbIJ5KzW.d.cts}

@@ -1,8 +1,8 @@
-import { G as DebugConfig, ak as RetryConfig, i as ApiQueryOptions, P as PayloadFindResponse, L as PayloadMutationResponse, cU as ApiDeleteOptions, cV as PublicReadQueryOptions } from './types-CvdBV3ri.cjs';
-import './payload-types-jdsUXunB.cjs';
+import { cU as DebugConfig, c_ as RetryConfig, cN as ApiQueryOptions, cX as PayloadFindResponse, cY as PayloadMutationResponse, dc as ApiDeleteOptions, dd as PublicReadQueryOptions } from './types-csjaig4G.cjs';
+import './payload-types-BY1uZFRf.cjs';
 import { GenerateMetadataOptions, Metadata } from './metadata.cjs';
-import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-CCQ3MdLE.cjs';
-import { C as CollectionType } from './types-BPwXAFZ7.cjs';
+import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-Dw5ElJs_.cjs';
+import { C as CollectionType } from './types-DnIuxgu2.cjs';
 
 interface FetchOptions extends RequestInit {
     apiUrl?: string;

package/dist/{const-BU79hCFB.d.ts → const-Do27Udj6.d.ts}

@@ -1,10 +1,10 @@
-import './payload-types-jdsUXunB.js';
+import './payload-types-BY1uZFRf.js';
 
 /**
  * Internal collections that should not be exposed via SDK.
  * Includes Payload system collections and admin-only collections.
  */
-declare const INTERNAL_COLLECTIONS: readonly ["users", "payload-kv", "payload-locked-documents", "payload-preferences", "payload-migrations", "payload-folders", "field-configs", "system-media", "track-assets", "audiences", "email-logs", "api-usage", "tenant-mcp-usage-daily", "subscriptions", "billing-history", "billing-consent-receipts", "usage-rate-cards", "usage-invoices", "inventory-reservations", "inventory-adjustments", "payment-sessions", "payment-event-inbox", "payment-refund-attempts", "portone-payment-interactions", "commerce-payment-webhook-routes", "commerce-notification-intents", "commerce-idempotency-records", "product-collection-items", "order-status-logs", "fulfillment-events", "tenant-commerce-config", "customer-oauth-clients", "customer-consent-receipts", "customer-group-grants", "api-keys", "personal-access-tokens", "tenant-entitlements", "tenant-purge-jobs", "direct-upload-sessions", "webhook-events", "webhook-deliveries", "webhook-outbox-deliveries", "audit-logs", "plans", "webhooks", "custom-field-definitions", "event-registrations", "event-admission-holds", "event-admission-types", "customer-payment-methods", "tenant-payment-credentials", "membership-unapplied-paid-evidence", "commerce-payment-accounts", "payment-provider-customer-aliases"];
+declare const INTERNAL_COLLECTIONS: readonly ["benefit-voucher-definitions", "users", "payload-kv", "payload-locked-documents", "payload-preferences", "payload-migrations", "payload-folders", "field-configs", "system-media", "track-assets", "audiences", "email-logs", "api-usage", "tenant-mcp-usage-daily", "subscriptions", "billing-history", "billing-consent-receipts", "usage-rate-cards", "usage-invoices", "inventory-reservations", "inventory-adjustments", "payment-sessions", "payment-event-inbox", "payment-refund-attempts", "portone-payment-interactions", "commerce-payment-webhook-routes", "commerce-notification-intents", "commerce-idempotency-records", "product-collection-items", "order-status-logs", "fulfillment-events", "tenant-commerce-config", "customer-oauth-clients", "customer-consent-receipts", "customer-group-grants", "api-keys", "personal-access-tokens", "tenant-entitlements", "tenant-purge-jobs", "direct-upload-sessions", "webhook-events", "webhook-deliveries", "webhook-outbox-deliveries", "audit-logs", "plans", "webhooks", "custom-field-definitions", "event-registrations", "event-admission-holds", "event-admission-types", "customer-payment-methods", "tenant-payment-credentials", "membership-unapplied-paid-evidence", "commerce-payment-accounts", "payment-provider-customer-aliases"];
 type InternalCollection = (typeof INTERNAL_COLLECTIONS)[number];
 /**
  * Array of browser-public collection names for runtime use (e.g., Zod enum validation).

package/dist/{const-CCQ3MdLE.d.cts → const-Dw5ElJs_.d.cts}

@@ -1,10 +1,10 @@
-import './payload-types-jdsUXunB.cjs';
+import './payload-types-BY1uZFRf.cjs';
 
 /**
  * Internal collections that should not be exposed via SDK.
  * Includes Payload system collections and admin-only collections.
  */
-declare const INTERNAL_COLLECTIONS: readonly ["users", "payload-kv", "payload-locked-documents", "payload-preferences", "payload-migrations", "payload-folders", "field-configs", "system-media", "track-assets", "audiences", "email-logs", "api-usage", "tenant-mcp-usage-daily", "subscriptions", "billing-history", "billing-consent-receipts", "usage-rate-cards", "usage-invoices", "inventory-reservations", "inventory-adjustments", "payment-sessions", "payment-event-inbox", "payment-refund-attempts", "portone-payment-interactions", "commerce-payment-webhook-routes", "commerce-notification-intents", "commerce-idempotency-records", "product-collection-items", "order-status-logs", "fulfillment-events", "tenant-commerce-config", "customer-oauth-clients", "customer-consent-receipts", "customer-group-grants", "api-keys", "personal-access-tokens", "tenant-entitlements", "tenant-purge-jobs", "direct-upload-sessions", "webhook-events", "webhook-deliveries", "webhook-outbox-deliveries", "audit-logs", "plans", "webhooks", "custom-field-definitions", "event-registrations", "event-admission-holds", "event-admission-types", "customer-payment-methods", "tenant-payment-credentials", "membership-unapplied-paid-evidence", "commerce-payment-accounts", "payment-provider-customer-aliases"];
+declare const INTERNAL_COLLECTIONS: readonly ["benefit-voucher-definitions", "users", "payload-kv", "payload-locked-documents", "payload-preferences", "payload-migrations", "payload-folders", "field-configs", "system-media", "track-assets", "audiences", "email-logs", "api-usage", "tenant-mcp-usage-daily", "subscriptions", "billing-history", "billing-consent-receipts", "usage-rate-cards", "usage-invoices", "inventory-reservations", "inventory-adjustments", "payment-sessions", "payment-event-inbox", "payment-refund-attempts", "portone-payment-interactions", "commerce-payment-webhook-routes", "commerce-notification-intents", "commerce-idempotency-records", "product-collection-items", "order-status-logs", "fulfillment-events", "tenant-commerce-config", "customer-oauth-clients", "customer-consent-receipts", "customer-group-grants", "api-keys", "personal-access-tokens", "tenant-entitlements", "tenant-purge-jobs", "direct-upload-sessions", "webhook-events", "webhook-deliveries", "webhook-outbox-deliveries", "audit-logs", "plans", "webhooks", "custom-field-definitions", "event-registrations", "event-admission-holds", "event-admission-types", "customer-payment-methods", "tenant-payment-credentials", "membership-unapplied-paid-evidence", "commerce-payment-accounts", "payment-provider-customer-aliases"];
 type InternalCollection = (typeof INTERNAL_COLLECTIONS)[number];
 /**
  * Array of browser-public collection names for runtime use (e.g., Zod enum validation).

package/dist/embedded-admin/server.cjs

@@ -202,6 +202,11 @@ var createValidationError = (message, details, userMessage, suggestion, status)
 // src/embedded-admin/index.ts
 var EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60;
 var EMBEDDED_ADMIN_APP_KEY = "primary";
+var EMBEDDED_ADMIN_TENANT_ROLES = [
+  "tenant-admin",
+  "tenant-editor",
+  "tenant-viewer"
+];
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 }
@@ -266,6 +271,14 @@ async function fetchEmbeddedAdminJwks(consoleOrigin, options = {}) {
   return parseJwks(JSON.parse(text));
 }
 async function verifyEmbeddedAdminSession(options) {
+  const allowedRoles = options.allowedRoles ?? ["super-admin", "tenant-admin"];
+  if (!Array.isArray(allowedRoles) || allowedRoles.some(
+    (role) => !["super-admin", ...EMBEDDED_ADMIN_TENANT_ROLES].includes(role)
+  )) {
+    throw createValidationError(
+      "Embedded admin receiver allowedRoles is invalid."
+    );
+  }
   const issuer = normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {
     allowLoopbackHttp: options.allowLoopbackHttp === true
   });
@@ -298,7 +311,9 @@ async function verifyEmbeddedAdminSession(options) {
     }
   );
   const lifetime = typeof payload.exp === "number" && typeof payload.iat === "number" ? payload.exp - payload.iat : Number.POSITIVE_INFINITY;
-  if (typeof protectedHeader.kid !== "string" || protectedHeader.kid.length === 0 || !Number.isInteger(payload.iat) || !Number.isInteger(payload.nbf) || !Number.isInteger(payload.exp) || payload.iat > currentSecond || lifetime <= 0 || lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS || payload.nbf !== payload.iat || payload.aud !== destination || typeof payload.jti !== "string" || payload.jti.length === 0 || payload.app_key !== EMBEDDED_ADMIN_APP_KEY || payload.channel_id !== options.channelId || payload.dest !== destination || typeof payload.operator_id !== "string" || payload.operator_id.length === 0 || payload.sub !== payload.operator_id || typeof payload.tenant_id !== "string" || payload.tenant_id.length === 0 || payload.tenant_role !== "super-admin" && payload.tenant_role !== "tenant-admin") {
+  if (typeof protectedHeader.kid !== "string" || protectedHeader.kid.length === 0 || !Number.isInteger(payload.iat) || !Number.isInteger(payload.nbf) || !Number.isInteger(payload.exp) || payload.iat > currentSecond || lifetime <= 0 || lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS || payload.nbf !== payload.iat || payload.aud !== destination || typeof payload.jti !== "string" || payload.jti.length === 0 || payload.app_key !== EMBEDDED_ADMIN_APP_KEY || payload.channel_id !== options.channelId || payload.dest !== destination || typeof payload.operator_id !== "string" || payload.operator_id.length === 0 || payload.sub !== payload.operator_id || typeof payload.tenant_id !== "string" || payload.tenant_id.length === 0 || !["super-admin", ...EMBEDDED_ADMIN_TENANT_ROLES].includes(
+    payload.tenant_role
+  ) || !allowedRoles.includes(payload.tenant_role)) {
     throw new Error("Embedded admin session claims are invalid.");
   }
   return payload;

package/dist/embedded-admin/server.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/embedded-admin/server.ts","../../src/core/errors.ts","../../src/embedded-admin/index.ts"],"sourcesContent":["import {\n  createLocalJWKSet,\n  jwtVerify,\n  type JSONWebKeySet,\n  type JWTPayload,\n} from 'jose'\nimport { createValidationError } from '../core/internal/errors'\nimport {\n  EMBEDDED_ADMIN_APP_KEY,\n  EMBEDDED_ADMIN_SESSION_TTL_SECONDS,\n  normalizeEmbeddedAdminExactOrigin,\n} from './index'\n\nconst ALGORITHMS = ['RS256', 'ES256'] as const\nconst MAX_JWKS_BYTES = 64 * 1024\n\nexport type EmbeddedAdminRole = 'super-admin' | 'tenant-admin'\n\nexport type EmbeddedAdminSessionClaims = JWTPayload & {\n  app_key: typeof EMBEDDED_ADMIN_APP_KEY\n  channel_id: string\n  dest: string\n  operator_id: string\n  tenant_id: string\n  tenant_role: EmbeddedAdminRole\n}\n\nexport type VerifyEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  channelId: string\n  consoleOrigin: string\n  destination: string\n  fetch?: typeof globalThis.fetch\n  jwks?: JSONWebKeySet\n  now?: number\n  token: string\n}\n\nexport type FetchEmbeddedAdminJwksOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  fetch?: typeof globalThis.fetch\n}\n\nfunction parseJwks(value: unknown): JSONWebKeySet {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  const keys = (value as Record<string, unknown>).keys\n  if (!Array.isArray(keys) || keys.length === 0 || keys.length > 2) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  const privateMembers = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k']\n  for (const key of keys) {\n    if (!key || typeof key !== 'object' || Array.isArray(key)) {\n      throw new Error('Embedded admin JWKS is invalid.')\n    }\n    const record = key as Record<string, unknown>\n    if (\n      typeof record.kid !== 'string' ||\n      record.kid.length === 0 ||\n      privateMembers.some((member) => member in record)\n    ) {\n      throw new Error('Embedded admin JWKS is invalid.')\n    }\n  }\n  return { keys: keys as JSONWebKeySet['keys'] }\n}\n\nexport async function fetchEmbeddedAdminJwks(\n  consoleOrigin: string,\n  options: FetchEmbeddedAdminJwksOptions = {},\n): Promise<JSONWebKeySet> {\n  const issuer = normalizeEmbeddedAdminExactOrigin(consoleOrigin, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  if (!issuer) {\n    throw createValidationError('consoleOrigin must be one exact origin.')\n  }\n\n  const response = await (options.fetch ?? globalThis.fetch)(\n    new URL('/api/embedded-admin', issuer),\n    { cache: 'no-store', headers: { Accept: 'application/json' } },\n  )\n  if (!response.ok) throw new Error('Embedded admin JWKS is unavailable.')\n  const text = await response.text()\n  if (new TextEncoder().encode(text).byteLength > MAX_JWKS_BYTES) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  return parseJwks(JSON.parse(text) as unknown)\n}\n\n/** Verifies the Console assertion before the receiver establishes an app session. */\nexport async function verifyEmbeddedAdminSession(\n  options: VerifyEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionClaims> {\n  const issuer = normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  const destination = normalizeEmbeddedAdminExactOrigin(options.destination, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  if (!issuer || !destination) {\n    throw createValidationError(\n      'consoleOrigin and destination must be exact origins.',\n    )\n  }\n  if (\n    typeof options.channelId !== 'string' ||\n    options.channelId.length < 16 ||\n    options.channelId.length > 128 ||\n    typeof options.token !== 'string' ||\n    options.token.length === 0\n  ) {\n    throw createValidationError('Embedded admin session input is invalid.')\n  }\n\n  const jwks = options.jwks\n    ? parseJwks(options.jwks)\n    : await fetchEmbeddedAdminJwks(issuer, {\n        allowLoopbackHttp: options.allowLoopbackHttp,\n        fetch: options.fetch,\n      })\n  const currentSecond = options.now ?? Math.floor(Date.now() / 1000)\n  const { payload, protectedHeader } = await jwtVerify(\n    options.token,\n    createLocalJWKSet(jwks),\n    {\n      algorithms: [...ALGORITHMS],\n      audience: destination,\n      clockTolerance: 0,\n      currentDate: new Date(currentSecond * 1000),\n      issuer,\n      requiredClaims: ['iat', 'nbf', 'exp', 'jti', 'sub'],\n    },\n  )\n\n  const lifetime =\n    typeof payload.exp === 'number' && typeof payload.iat === 'number'\n      ? payload.exp - payload.iat\n      : Number.POSITIVE_INFINITY\n  if (\n    typeof protectedHeader.kid !== 'string' ||\n    protectedHeader.kid.length === 0 ||\n    !Number.isInteger(payload.iat) ||\n    !Number.isInteger(payload.nbf) ||\n    !Number.isInteger(payload.exp) ||\n    (payload.iat as number) > currentSecond ||\n    lifetime <= 0 ||\n    lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS ||\n    payload.nbf !== payload.iat ||\n    payload.aud !== destination ||\n    typeof payload.jti !== 'string' ||\n    payload.jti.length === 0 ||\n    payload.app_key !== EMBEDDED_ADMIN_APP_KEY ||\n    payload.channel_id !== options.channelId ||\n    payload.dest !== destination ||\n    typeof payload.operator_id !== 'string' ||\n    payload.operator_id.length === 0 ||\n    payload.sub !== payload.operator_id ||\n    typeof payload.tenant_id !== 'string' ||\n    payload.tenant_id.length === 0 ||\n    (payload.tenant_role !== 'super-admin' &&\n      payload.tenant_role !== 'tenant-admin')\n  ) {\n    throw new Error('Embedded admin session claims are invalid.')\n  }\n\n  return payload as EmbeddedAdminSessionClaims\n}\n","const SDK_ERROR_BRAND = Symbol.for('@01.software/sdk/SDKError')\nconst SDK_ERROR_TYPE_BRAND = Symbol.for('@01.software/sdk/SDKError.type')\n\ntype SDKErrorType =\n  | 'NetworkError'\n  | 'ValidationError'\n  | 'ApiError'\n  | 'ConfigError'\n  | 'TimeoutError'\n  | 'GoneError'\n  | 'ServiceUnavailableError'\n  | 'UsageLimitError'\n  | 'AuthError'\n  | 'PermissionError'\n  | 'NotFoundError'\n  | 'ConflictError'\n  | 'RateLimitError'\n\nfunction defineSDKErrorBrand(error: SDKError): void {\n  Object.defineProperty(error, SDK_ERROR_BRAND, {\n    value: true,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nfunction defineSDKErrorType(error: SDKError, type: SDKErrorType): void {\n  Object.defineProperty(error, SDK_ERROR_TYPE_BRAND, {\n    value: type,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nexport class SDKError extends Error {\n  readonly code: string\n  readonly status?: number\n  readonly details?: unknown\n  readonly userMessage?: string\n  readonly suggestion?: string\n  readonly requestId?: string\n  readonly kind?: 'commerce'\n  readonly reason?: CommerceErrorCode | 'unknown_commerce_error'\n  readonly rawReason?: string\n  /** Machine-readable reason from a non-commerce API response. */\n  readonly apiReason?: string\n  readonly retryable?: boolean\n  readonly retryAfter?: number\n\n  constructor(\n    code: string,\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(message)\n    this.name = 'SDKError'\n    this.code = code\n    this.status = status\n    this.details = details\n    this.userMessage = userMessage\n    this.suggestion = suggestion\n    this.requestId = requestId\n    defineSDKErrorBrand(this)\n\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, new.target)\n    }\n  }\n\n  getUserMessage(): string {\n    return this.userMessage || this.message\n  }\n\n  toJSON() {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      details: this.details,\n      userMessage: this.userMessage,\n      suggestion: this.suggestion,\n      ...(this.requestId !== undefined && { requestId: this.requestId }),\n      ...(this.kind !== undefined && { kind: this.kind }),\n      ...(this.reason !== undefined && { reason: this.reason }),\n      ...(this.rawReason !== undefined && { rawReason: this.rawReason }),\n      ...(this.apiReason !== undefined && { apiReason: this.apiReason }),\n      ...(this.retryable !== undefined && { retryable: this.retryable }),\n      ...(this.retryAfter !== undefined && { retryAfter: this.retryAfter }),\n    }\n  }\n}\n\n/**\n * Canonical Cart/Checkout/PaymentSession error reasons. This public SDK mirror\n * intentionally does not import the private contracts package; parity is\n * enforced by a type test.\n */\nexport const COMMERCE_ERROR_CODES = [\n  'validation_failed',\n  'bad_request',\n  'unauthorized',\n  'forbidden',\n  'account_suspended',\n  'key_invalid',\n  'pat_tenant_header_forbidden',\n  'tenant_mismatch',\n  'test_tenant_expired',\n  'token_invalid',\n  'token_expired',\n  'origin_not_allowed',\n  'server_credentials_required',\n  'role_denied',\n  'scope_denied',\n  'feature_disabled',\n  'not_found',\n  'conflict',\n  'locked',\n  'cart_revision_conflict',\n  'rate_limit_exceeded',\n  'usage_limit_exceeded',\n  'service_unavailable',\n  'idempotency_conflict',\n  'idempotency_in_progress',\n  'idempotency_key_required',\n  'invalid_idempotency_key',\n  'cart_not_active',\n  'cart_locked',\n  'cart_empty',\n  'cart_market_unavailable',\n  'cart_market_mismatch',\n  'checkout_not_open',\n  'checkout_already_open',\n  'payment_slot_held',\n  'reservation_expired',\n  'payment_session_not_cancelable',\n  'payment_session_conflict',\n  'provider_identity_mismatch',\n  'managed_refund_attestation_forbidden',\n  'payment_method_unavailable',\n  'provider_unavailable',\n  'lock_timeout',\n  'price_changed',\n  'pricing_fact_in_use',\n  'insufficient_stock',\n  'reservation_conflict',\n  'stock_lock_unavailable',\n  'variant_not_found',\n  'variant_stock_write_failed',\n  'stock_invariant_violation',\n  'payment_confirmation_in_flight',\n  'checkout_reservation_release_requires_transaction',\n  'admission_metadata_invalid',\n  'admission_metadata_required',\n  'capacity_exceeded',\n  'occurrence_lock_unavailable',\n  'occurrence_not_open',\n  'admission_type_capacity_exceeded',\n  'admission_type_occurrence_mismatch',\n  'admission_hold_expired',\n  'admission_hold_checkout_item_conflict',\n  'admission_hold_checkout_conflict',\n  'admission_hold_quantity_mismatch',\n  'admission_hold_unbound',\n  'admission_hold_missing',\n  'admission_hold_checkout_item_missing',\n  'admission_hold_expiry_failed',\n  'admission_hold_expiry_requires_transaction',\n  'admission_hold_line_item_mismatch',\n  'admission_materialization_failed',\n  'variant_inactive',\n  'variant_product_mismatch',\n  'product_not_public',\n  'market_not_found',\n  'market_shipping_currency_unsupported',\n  'missing_market_rate',\n  'missing_shipping_amount',\n  'no_enabled_payment_provider',\n  'product_market_unavailable',\n  'unsupported_currency',\n  'missing_price_row',\n  'payment_provider_currency_unsupported',\n  'discount_code_not_found',\n  'discount_not_started',\n  'discount_expired',\n  'discount_usage_limit',\n  'discount_per_customer_limit',\n  'discount_customer_required',\n  'discount_first_order_only',\n  'discount_customer_not_eligible',\n  'discount_customer_excluded',\n  'discount_items_required',\n  'discount_product_not_eligible',\n  'discount_product_excluded',\n  'discount_min_order_amount',\n  'discount_currency_scope_required',\n  'discount_allocation_method_unsupported',\n  'currency_mismatch',\n  'customer_token_required',\n  'market_required',\n  'server_derived',\n  'internal_error',\n] as const\n\nexport type CommerceErrorCode = (typeof COMMERCE_ERROR_CODES)[number]\n\ntype CommerceSDKErrorBase = SDKError & {\n  readonly kind: 'commerce'\n  readonly requestId: string\n  readonly retryable: boolean\n  readonly retryAfter?: number\n  readonly details?: Record<string, unknown>\n}\n\nexport type CommerceSDKError = CommerceSDKErrorBase &\n  (\n    | { readonly reason: CommerceErrorCode; readonly rawReason?: never }\n    | {\n        readonly reason: 'unknown_commerce_error'\n        readonly rawReason: string\n      }\n  )\n\nconst COMMERCE_ERROR_CODE_SET: ReadonlySet<string> = new Set(\n  COMMERCE_ERROR_CODES,\n)\nconst COMMERCE_ERROR_ENVELOPE_KEYS = new Set([\n  'error',\n  'reason',\n  'requestId',\n  'retryable',\n  'details',\n])\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nexport type CommerceErrorEnvelope = {\n  error: string\n  reason: string\n  requestId: string\n  retryable: boolean\n  details?: Record<string, unknown>\n}\n\nfunction commerceProtocolError(\n  issue: string,\n  trustedRequestId?: string,\n): SDKError {\n  return createApiError(\n    'Invalid canonical commerce error response.',\n    502,\n    { protocol: 'commerce-error-envelope', issue },\n    'The server returned an incompatible commerce error response.',\n    'Verify that the Console commerce contract is deployed before using this SDK version.',\n    trustedRequestId,\n  )\n}\n\n/** @internal Strictly parse a canonical commerce error without retaining its raw body. */\nexport function parseCommerceErrorEnvelope(\n  body: unknown,\n  headerRequestId?: string,\n): CommerceErrorEnvelope {\n  if (headerRequestId === undefined) {\n    throw commerceProtocolError('missing_request_id_header')\n  }\n  if (headerRequestId.length === 0) {\n    throw commerceProtocolError('empty_request_id_header')\n  }\n  if (!isPlainRecord(body)) {\n    throw commerceProtocolError('expected_object', headerRequestId)\n  }\n  if (Object.keys(body).some((key) => !COMMERCE_ERROR_ENVELOPE_KEYS.has(key))) {\n    throw commerceProtocolError('unexpected_field', headerRequestId)\n  }\n  if (\n    typeof body.error !== 'string' ||\n    body.error.length === 0 ||\n    typeof body.reason !== 'string' ||\n    body.reason.length === 0 ||\n    typeof body.requestId !== 'string' ||\n    body.requestId.length === 0 ||\n    (body.retryable !== undefined && typeof body.retryable !== 'boolean') ||\n    (body.details !== undefined && !isPlainRecord(body.details))\n  ) {\n    throw commerceProtocolError('invalid_field', headerRequestId)\n  }\n\n  if (headerRequestId !== undefined && headerRequestId !== body.requestId) {\n    throw commerceProtocolError('request_id_mismatch', headerRequestId)\n  }\n\n  return {\n    error: body.error,\n    reason: body.reason,\n    requestId: body.requestId,\n    retryable: body.retryable === true,\n    ...(body.details === undefined ? {} : { details: body.details }),\n  }\n}\n\n/** @internal Validate and apply the canonical commerce error envelope. */\nexport function enhanceCommerceError(\n  error: SDKError,\n  body: unknown,\n  headerRequestId?: string,\n): SDKError {\n  const envelope = parseCommerceErrorEnvelope(body, headerRequestId)\n\n  const known = COMMERCE_ERROR_CODE_SET.has(envelope.reason)\n  Object.assign(error, {\n    code: envelope.reason,\n    kind: 'commerce' as const,\n    reason: known\n      ? (envelope.reason as CommerceErrorCode)\n      : 'unknown_commerce_error',\n    ...(known ? {} : { rawReason: envelope.reason }),\n    requestId: envelope.requestId,\n    retryable: envelope.retryable,\n    details: envelope.details,\n  })\n  return error\n}\n\n/** @internal Apply a non-commerce reason without canonical-commerce validation. */\nexport function enhanceNonCommerceError(\n  error: SDKError,\n  reason: unknown,\n): SDKError {\n  if (typeof reason === 'string') Object.assign(error, { apiReason: reason })\n  return error\n}\n\n/**\n * Read the server-provided machine reason across strict commerce and\n * non-commerce SDK errors. Unknown commerce reasons are returned verbatim.\n */\nexport function getSDKErrorReason(error: SDKError): string | undefined {\n  if (error.kind !== 'commerce') return error.apiReason\n  return error.reason === 'unknown_commerce_error'\n    ? error.rawReason\n    : error.reason\n}\n\nexport function isCommerceSDKError(error: unknown): error is CommerceSDKError {\n  if (!isSDKError(error) || error.kind !== 'commerce') return false\n  if (\n    typeof error.requestId !== 'string' ||\n    typeof error.retryable !== 'boolean' ||\n    (error.retryAfter !== undefined &&\n      (!Number.isSafeInteger(error.retryAfter) || error.retryAfter < 0)) ||\n    typeof error.reason !== 'string'\n  ) {\n    return false\n  }\n  return error.reason === 'unknown_commerce_error'\n    ? typeof error.rawReason === 'string'\n    : COMMERCE_ERROR_CODE_SET.has(error.reason) && error.rawReason === undefined\n}\n\nexport class NetworkError extends SDKError {\n  constructor(\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('NETWORK_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'NetworkError'\n    defineSDKErrorType(this, 'NetworkError')\n  }\n}\n\nexport class ValidationError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    status = 400,\n  ) {\n    super('VALIDATION_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'ValidationError'\n    defineSDKErrorType(this, 'ValidationError')\n  }\n}\n\nexport class ApiError extends SDKError {\n  constructor(\n    message: string,\n    status: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'API_ERROR',\n      message,\n      status,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'ApiError'\n    defineSDKErrorType(this, 'ApiError')\n  }\n}\n\nexport class ConfigError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('CONFIG_ERROR', message, undefined, details, userMessage, suggestion)\n    this.name = 'ConfigError'\n    defineSDKErrorType(this, 'ConfigError')\n  }\n}\n\nexport class TimeoutError extends SDKError {\n  constructor(\n    message = 'Request timed out.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('TIMEOUT_ERROR', message, 408, details, userMessage, suggestion)\n    this.name = 'TimeoutError'\n    defineSDKErrorType(this, 'TimeoutError')\n  }\n}\n\nexport class GoneError extends SDKError {\n  constructor(\n    message = 'The requested resource is no longer available.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('GONE_ERROR', message, 410, details, userMessage, suggestion)\n    this.name = 'GoneError'\n    defineSDKErrorType(this, 'GoneError')\n  }\n}\n\nexport class ServiceUnavailableError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message = 'Service temporarily unavailable.',\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super(\n      'SERVICE_UNAVAILABLE_ERROR',\n      message,\n      503,\n      details,\n      userMessage,\n      suggestion,\n    )\n    this.name = 'ServiceUnavailableError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'ServiceUnavailableError')\n  }\n}\n\nexport class UsageLimitError extends SDKError {\n  readonly usage: { limit: number; current: number; remaining: number }\n\n  constructor(\n    message: string,\n    usage: { limit: number; current: number; remaining: number },\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('USAGE_LIMIT_ERROR', message, 429, details, userMessage, suggestion)\n    this.name = 'UsageLimitError'\n    this.usage = usage\n    defineSDKErrorType(this, 'UsageLimitError')\n  }\n\n  toJSON() {\n    return {\n      ...super.toJSON(),\n      usage: this.usage,\n    }\n  }\n}\n\nexport class AuthError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'auth_error',\n      message,\n      401,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'AuthError'\n    defineSDKErrorType(this, 'AuthError')\n  }\n}\n\nexport class PermissionError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'permission_error',\n      message,\n      403,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'PermissionError'\n    defineSDKErrorType(this, 'PermissionError')\n  }\n}\n\nexport class NotFoundError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'not_found',\n      message,\n      404,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'NotFoundError'\n    defineSDKErrorType(this, 'NotFoundError')\n  }\n}\n\nexport class ConflictError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super('conflict', message, 409, details, userMessage, suggestion, requestId)\n    this.name = 'ConflictError'\n    defineSDKErrorType(this, 'ConflictError')\n  }\n}\n\nexport class RateLimitError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message: string,\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'rate_limit_exceeded',\n      message,\n      429,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'RateLimitError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'RateLimitError')\n  }\n}\n\nfunction hasBrandedSDKErrorShape(error: unknown): error is SDKError {\n  if (error === null || typeof error !== 'object') return false\n\n  const candidate = error as Record<PropertyKey, unknown>\n  return (\n    candidate[SDK_ERROR_BRAND] === true &&\n    typeof candidate.name === 'string' &&\n    typeof candidate.code === 'string' &&\n    typeof candidate.message === 'string' &&\n    (candidate.status === undefined || typeof candidate.status === 'number') &&\n    (candidate.userMessage === undefined ||\n      typeof candidate.userMessage === 'string') &&\n    (candidate.suggestion === undefined ||\n      typeof candidate.suggestion === 'string') &&\n    (candidate.requestId === undefined ||\n      typeof candidate.requestId === 'string') &&\n    (candidate.kind === undefined || candidate.kind === 'commerce') &&\n    (candidate.reason === undefined || typeof candidate.reason === 'string') &&\n    (candidate.rawReason === undefined ||\n      typeof candidate.rawReason === 'string') &&\n    (candidate.apiReason === undefined ||\n      typeof candidate.apiReason === 'string') &&\n    (candidate.retryable === undefined ||\n      typeof candidate.retryable === 'boolean') &&\n    (candidate.retryAfter === undefined ||\n      typeof candidate.retryAfter === 'number') &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nfunction hasSDKErrorType(error: unknown, type: SDKErrorType): boolean {\n  return (\n    hasBrandedSDKErrorShape(error) &&\n    (error as unknown as Record<PropertyKey, unknown>)[SDK_ERROR_TYPE_BRAND] ===\n      type\n  )\n}\n\nexport function isSDKError(error: unknown): error is SDKError {\n  return error instanceof SDKError || hasBrandedSDKErrorShape(error)\n}\n\nexport function isNetworkError(error: unknown): error is NetworkError {\n  return error instanceof NetworkError || hasSDKErrorType(error, 'NetworkError')\n}\n\nexport function isValidationError(error: unknown): error is ValidationError {\n  if (\n    error instanceof ValidationError ||\n    hasSDKErrorType(error, 'ValidationError')\n  ) {\n    return true\n  }\n  if (error == null || typeof error !== 'object') return false\n\n  const candidate = error as {\n    code?: unknown\n    name?: unknown\n    message?: unknown\n    getUserMessage?: unknown\n    toJSON?: unknown\n  }\n  return (\n    candidate.name === 'ValidationError' &&\n    candidate.code === 'VALIDATION_ERROR' &&\n    typeof candidate.message === 'string' &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nexport function isApiError(error: unknown): error is ApiError {\n  return error instanceof ApiError || hasSDKErrorType(error, 'ApiError')\n}\n\nexport function isConfigError(error: unknown): error is ConfigError {\n  return error instanceof ConfigError || hasSDKErrorType(error, 'ConfigError')\n}\n\nexport function isTimeoutError(error: unknown): error is TimeoutError {\n  return error instanceof TimeoutError || hasSDKErrorType(error, 'TimeoutError')\n}\n\nexport function isGoneError(error: unknown): error is GoneError {\n  return error instanceof GoneError || hasSDKErrorType(error, 'GoneError')\n}\n\nexport function isServiceUnavailableError(\n  error: unknown,\n): error is ServiceUnavailableError {\n  return (\n    error instanceof ServiceUnavailableError ||\n    hasSDKErrorType(error, 'ServiceUnavailableError')\n  )\n}\n\nexport function isUsageLimitError(error: unknown): error is UsageLimitError {\n  return (\n    error instanceof UsageLimitError ||\n    hasSDKErrorType(error, 'UsageLimitError')\n  )\n}\n\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError || hasSDKErrorType(error, 'AuthError')\n}\n\nexport function isPermissionError(error: unknown): error is PermissionError {\n  return (\n    error instanceof PermissionError ||\n    hasSDKErrorType(error, 'PermissionError')\n  )\n}\n\nexport function isNotFoundError(error: unknown): error is NotFoundError {\n  return (\n    error instanceof NotFoundError || hasSDKErrorType(error, 'NotFoundError')\n  )\n}\n\nexport function isConflictError(error: unknown): error is ConflictError {\n  return (\n    error instanceof ConflictError || hasSDKErrorType(error, 'ConflictError')\n  )\n}\n\nexport function isRateLimitError(error: unknown): error is RateLimitError {\n  return (\n    error instanceof RateLimitError || hasSDKErrorType(error, 'RateLimitError')\n  )\n}\n\nexport const createNetworkError = (\n  message: string,\n  status?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new NetworkError(message, status, details, userMessage, suggestion)\n\nexport const createValidationError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  status?: number,\n) => new ValidationError(message, details, userMessage, suggestion, status)\n\nexport const createApiError = (\n  message: string,\n  status: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ApiError(message, status, details, userMessage, suggestion, requestId)\n\nexport const createConfigError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new ConfigError(message, details, userMessage, suggestion)\n\nexport const createTimeoutError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new TimeoutError(message, details, userMessage, suggestion)\n\nexport const createGoneError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new GoneError(message, details, userMessage, suggestion)\n\nexport const createServiceUnavailableError = (\n  message?: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) =>\n  new ServiceUnavailableError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n  )\n\nexport const createUsageLimitError = (\n  message: string,\n  usage: { limit: number; current: number; remaining: number },\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new UsageLimitError(message, usage, details, userMessage, suggestion)\n\nexport const createAuthError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new AuthError(message, details, userMessage, suggestion, requestId)\n\nexport const createPermissionError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new PermissionError(message, details, userMessage, suggestion, requestId)\n\nexport const createNotFoundError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new NotFoundError(message, details, userMessage, suggestion, requestId)\n\nexport const createConflictError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ConflictError(message, details, userMessage, suggestion, requestId)\n\nexport const createRateLimitError = (\n  message: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) =>\n  new RateLimitError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n    requestId,\n  )\n","import { createValidationError } from '../core/internal/errors'\n\nexport const EMBEDDED_ADMIN_PROTOCOL_VERSION = 1 as const\nexport const EMBEDDED_ADMIN_CHALLENGE_MESSAGE =\n  '01.embedded-admin.challenge' as const\nexport const EMBEDDED_ADMIN_READY_MESSAGE = '01.embedded-admin.ready' as const\nexport const EMBEDDED_ADMIN_SESSION_MESSAGE =\n  '01.embedded-admin.session' as const\nexport const EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60 as const\nexport const EMBEDDED_ADMIN_APP_KEY = 'primary' as const\n\nconst DEFAULT_RECEIVER_TIMEOUT_MS = 35_000\nconst MAX_RECEIVER_TIMEOUT_MS = 120_000\nconst MAX_LABEL_LENGTH = 80\nconst MAX_PATH_LENGTH = 512\n\nexport type EmbeddedAdminChallengeMessage = {\n  type: typeof EMBEDDED_ADMIN_CHALLENGE_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminReadyMessage = {\n  type: typeof EMBEDDED_ADMIN_READY_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminSessionMessage = {\n  type: typeof EMBEDDED_ADMIN_SESSION_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n  token: string\n}\n\nexport type EmbeddedAdminBindingConfiguration = {\n  enabled: boolean\n  label: string\n  origin: string\n  path: string\n}\n\nexport type EmbeddedAdminSessionReceipt = {\n  requestId: string\n  token: string\n}\n\nexport type ReceiveEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  /** Exact Console origin configured by the receiver deployment. */\n  consoleOrigin: string\n  /** Cancels the one-shot receiver and closes every transferred port. */\n  signal?: AbortSignal\n  /** Defaults to 35 seconds and is capped at 120 seconds. */\n  timeoutMs?: number\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n  )\n}\n\nexport function normalizeEmbeddedAdminExactOrigin(\n  value: unknown,\n  options: { allowLoopbackHttp?: boolean } = {},\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (!trimmed || trimmed.length > 2048) return null\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed)\n  } catch {\n    return null\n  }\n\n  const allowedProtocol =\n    parsed.protocol === 'https:' ||\n    (options.allowLoopbackHttp === true &&\n      parsed.protocol === 'http:' &&\n      isLoopbackHostname(parsed.hostname))\n  if (!allowedProtocol || parsed.hostname.includes('*')) return null\n  if (parsed.username || parsed.password || parsed.search || parsed.hash) {\n    return null\n  }\n  if (parsed.pathname !== '/' || trimmed.endsWith('/')) return null\n\n  return parsed.origin\n}\n\nexport function normalizeEmbeddedAdminRelativePath(\n  value: unknown,\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (\n    !trimmed.startsWith('/') ||\n    trimmed.startsWith('//') ||\n    trimmed.length > MAX_PATH_LENGTH\n  ) {\n    return null\n  }\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed, 'https://embedded.invalid')\n  } catch {\n    return null\n  }\n\n  if (\n    parsed.origin !== 'https://embedded.invalid' ||\n    parsed.pathname.startsWith('//') ||\n    parsed.search ||\n    parsed.hash ||\n    parsed.username ||\n    parsed.password\n  ) {\n    return null\n  }\n\n  return parsed.pathname\n}\n\nexport function normalizeEmbeddedAdminBindingConfiguration(\n  value: unknown,\n  options: {\n    allowLoopbackConsoleHttp?: boolean\n    consoleOrigin?: string\n  } = {},\n): EmbeddedAdminBindingConfiguration {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw createValidationError('Embedded admin binding must be an object.')\n  }\n\n  const input = value as Record<string, unknown>\n  const label = typeof input.label === 'string' ? input.label.trim() : ''\n  const origin = normalizeEmbeddedAdminExactOrigin(input.origin)\n  const path = normalizeEmbeddedAdminRelativePath(input.path)\n  const consoleOrigin = options.consoleOrigin\n    ? normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n        allowLoopbackHttp: options.allowLoopbackConsoleHttp === true,\n      })\n    : null\n\n  if (!label || label.length > MAX_LABEL_LENGTH) {\n    throw createValidationError(\n      `Embedded admin label must be between 1 and ${MAX_LABEL_LENGTH} characters.`,\n    )\n  }\n  if (!origin) {\n    throw createValidationError(\n      'Embedded admin origin must be an exact HTTPS origin without a path, query, fragment, wildcard, or credentials.',\n    )\n  }\n  if (!path) {\n    throw createValidationError(\n      'Embedded admin path must begin with / and must not include a query or fragment.',\n    )\n  }\n  if (consoleOrigin && origin === consoleOrigin) {\n    throw createValidationError(\n      'Embedded admin origin must be different from the Console origin.',\n    )\n  }\n\n  return {\n    enabled: input.enabled !== false,\n    label,\n    origin,\n    path,\n  }\n}\n\nexport function isEmbeddedAdminChallengeMessage(\n  value: unknown,\n): value is EmbeddedAdminChallengeMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_CHALLENGE_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminReadyMessage(\n  value: unknown,\n): value is EmbeddedAdminReadyMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_READY_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminSessionMessage(\n  value: unknown,\n): value is EmbeddedAdminSessionMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_SESSION_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128 &&\n    typeof message.token === 'string' &&\n    message.token.length > 0\n  )\n}\n\n/**\n * Receives one Console assertion through the exact parent/origin challenge\n * channel. Forward the returned token immediately to the receiver backend;\n * never persist, log, decode, or use it as Console API authority in-browser.\n */\nexport function receiveEmbeddedAdminSession(\n  options: ReceiveEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionReceipt> {\n  if (typeof window === 'undefined' || window.parent === window) {\n    return Promise.reject(\n      createValidationError(\n        'receiveEmbeddedAdminSession must run inside an embedded browser frame.',\n      ),\n    )\n  }\n\n  const consoleOrigin = normalizeEmbeddedAdminExactOrigin(\n    options.consoleOrigin,\n    { allowLoopbackHttp: options.allowLoopbackHttp === true },\n  )\n  if (!consoleOrigin) {\n    return Promise.reject(\n      createValidationError('consoleOrigin must be one exact HTTPS origin.'),\n    )\n  }\n\n  const timeoutMs = options.timeoutMs ?? DEFAULT_RECEIVER_TIMEOUT_MS\n  if (\n    !Number.isInteger(timeoutMs) ||\n    timeoutMs <= 0 ||\n    timeoutMs > MAX_RECEIVER_TIMEOUT_MS\n  ) {\n    return Promise.reject(\n      createValidationError(\n        `timeoutMs must be an integer between 1 and ${MAX_RECEIVER_TIMEOUT_MS}.`,\n      ),\n    )\n  }\n\n  return new Promise((resolve, reject) => {\n    const ports = new Set<MessagePort>()\n    let settled = false\n\n    const closePorts = () => {\n      for (const port of ports) port.close()\n      ports.clear()\n    }\n    const cleanup = () => {\n      window.removeEventListener('message', acceptChallenge)\n      options.signal?.removeEventListener('abort', abort)\n      clearTimeout(timer)\n      closePorts()\n    }\n    const finish = (receipt: EmbeddedAdminSessionReceipt) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      resolve(receipt)\n    }\n    const fail = (error: Error) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      reject(error)\n    }\n    const abort = () =>\n      fail(new Error('Embedded admin session receipt aborted.'))\n    const acceptSession = (\n      event: MessageEvent<unknown>,\n      expectedRequestId: string,\n    ) => {\n      if (\n        !isEmbeddedAdminSessionMessage(event.data) ||\n        event.data.requestId !== expectedRequestId\n      ) {\n        return\n      }\n      finish({ requestId: event.data.requestId, token: event.data.token })\n    }\n    const acceptChallenge = (event: MessageEvent<unknown>) => {\n      if (\n        event.source !== window.parent ||\n        event.origin !== consoleOrigin ||\n        !isEmbeddedAdminChallengeMessage(event.data) ||\n        event.ports.length !== 1\n      ) {\n        for (const port of event.ports) port.close()\n        return\n      }\n\n      const port = event.ports[0]!\n      const requestId = event.data.requestId\n      ports.add(port)\n      port.addEventListener('message', (message) => {\n        acceptSession(message, requestId)\n      })\n      port.start()\n      port.postMessage({\n        type: EMBEDDED_ADMIN_READY_MESSAGE,\n        version: EMBEDDED_ADMIN_PROTOCOL_VERSION,\n        requestId,\n      } satisfies EmbeddedAdminReadyMessage)\n    }\n\n    const timer = setTimeout(() => {\n      fail(new Error('Timed out waiting for an embedded admin session.'))\n    }, timeoutMs)\n\n    if (options.signal?.aborted) {\n      abort()\n      return\n    }\n    options.signal?.addEventListener('abort', abort, { once: true })\n    window.addEventListener('message', acceptChallenge)\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAKO;;;ACLP,IAAM,kBAAkB,uBAAO,IAAI,2BAA2B;AAC9D,IAAM,uBAAuB,uBAAO,IAAI,gCAAgC;AAiBxE,SAAS,oBAAoB,OAAuB;AAClD,SAAO,eAAe,OAAO,iBAAiB;AAAA,IAC5C,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAiB,MAA0B;AACrE,SAAO,eAAe,OAAO,sBAAsB;AAAA,IACjD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAelC,YACE,MACA,SACA,QACA,SACA,aACA,YACA,WACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,aAAa;AAClB,SAAK,YAAY;AACjB,wBAAoB,IAAI;AAExB,QAAI,MAAM,mBAAmB;AAC3B,YAAM,kBAAkB,MAAM,UAAU;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,iBAAyB;AACvB,WAAO,KAAK,eAAe,KAAK;AAAA,EAClC;AAAA,EAEA,SAAS;AACP,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,YAAY,KAAK;AAAA,MACjB,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,SAAS,UAAa,EAAE,MAAM,KAAK,KAAK;AAAA,MACjD,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;AAAA,MACvD,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,eAAe,UAAa,EAAE,YAAY,KAAK,WAAW;AAAA,IACrE;AAAA,EACF;AACF;AAOO,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqBA,IAAM,0BAA+C,IAAI;AAAA,EACvD;AACF;AAuJO,IAAM,kBAAN,cAA8B,SAAS;AAAA,EAC5C,YACE,SACA,SACA,aACA,YACA,SAAS,KACT;AACA,UAAM,oBAAoB,SAAS,QAAQ,SAAS,aAAa,UAAU;AAC3E,SAAK,OAAO;AACZ,uBAAmB,MAAM,iBAAiB;AAAA,EAC5C;AACF;AAuWO,IAAM,wBAAwB,CACnC,SACA,SACA,aACA,YACA,WACG,IAAI,gBAAgB,SAAS,SAAS,aAAa,YAAY,MAAM;;;AC/uBnE,IAAM,qCAAqC;AAC3C,IAAM,yBAAyB;AAiDtC,SAAS,mBAAmB,UAA2B;AACrD,SACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEO,SAAS,kCACd,OACA,UAA2C,CAAC,GAC7B;AACf,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,QAAQ,SAAS,KAAM,QAAO;AAE9C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,OAAO;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,kBACJ,OAAO,aAAa,YACnB,QAAQ,sBAAsB,QAC7B,OAAO,aAAa,WACpB,mBAAmB,OAAO,QAAQ;AACtC,MAAI,CAAC,mBAAmB,OAAO,SAAS,SAAS,GAAG,EAAG,QAAO;AAC9D,MAAI,OAAO,YAAY,OAAO,YAAY,OAAO,UAAU,OAAO,MAAM;AACtE,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,OAAO,QAAQ,SAAS,GAAG,EAAG,QAAO;AAE7D,SAAO,OAAO;AAChB;;;AF9EA,IAAM,aAAa,CAAC,SAAS,OAAO;AACpC,IAAM,iBAAiB,KAAK;AA+B5B,SAAS,UAAU,OAA+B;AAChD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,OAAQ,MAAkC;AAChD,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,KAAK,KAAK,SAAS,GAAG;AAChE,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,iBAAiB,CAAC,KAAK,KAAK,KAAK,MAAM,MAAM,MAAM,OAAO,GAAG;AACnE,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACzD,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,UAAM,SAAS;AACf,QACE,OAAO,OAAO,QAAQ,YACtB,OAAO,IAAI,WAAW,KACtB,eAAe,KAAK,CAAC,WAAW,UAAU,MAAM,GAChD;AACA,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AAAA,EACF;AACA,SAAO,EAAE,KAAoC;AAC/C;AAEA,eAAsB,uBACpB,eACA,UAAyC,CAAC,GAClB;AACxB,QAAM,SAAS,kCAAkC,eAAe;AAAA,IAC9D,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,UAAM,sBAAsB,yCAAyC;AAAA,EACvE;AAEA,QAAM,WAAW,OAAO,QAAQ,SAAS,WAAW;AAAA,IAClD,IAAI,IAAI,uBAAuB,MAAM;AAAA,IACrC,EAAE,OAAO,YAAY,SAAS,EAAE,QAAQ,mBAAmB,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,qCAAqC;AACvE,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,gBAAgB;AAC9D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,SAAO,UAAU,KAAK,MAAM,IAAI,CAAY;AAC9C;AAGA,eAAsB,2BACpB,SACqC;AACrC,QAAM,SAAS,kCAAkC,QAAQ,eAAe;AAAA,IACtE,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,QAAM,cAAc,kCAAkC,QAAQ,aAAa;AAAA,IACzE,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,MAAI,CAAC,UAAU,CAAC,aAAa;AAC3B,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,MACE,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,SAAS,MAC3B,QAAQ,UAAU,SAAS,OAC3B,OAAO,QAAQ,UAAU,YACzB,QAAQ,MAAM,WAAW,GACzB;AACA,UAAM,sBAAsB,0CAA0C;AAAA,EACxE;AAEA,QAAM,OAAO,QAAQ,OACjB,UAAU,QAAQ,IAAI,IACtB,MAAM,uBAAuB,QAAQ;AAAA,IACnC,mBAAmB,QAAQ;AAAA,IAC3B,OAAO,QAAQ;AAAA,EACjB,CAAC;AACL,QAAM,gBAAgB,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACjE,QAAM,EAAE,SAAS,gBAAgB,IAAI,UAAM;AAAA,IACzC,QAAQ;AAAA,QACR,+BAAkB,IAAI;AAAA,IACtB;AAAA,MACE,YAAY,CAAC,GAAG,UAAU;AAAA,MAC1B,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,aAAa,IAAI,KAAK,gBAAgB,GAAI;AAAA,MAC1C;AAAA,MACA,gBAAgB,CAAC,OAAO,OAAO,OAAO,OAAO,KAAK;AAAA,IACpD;AAAA,EACF;AAEA,QAAM,WACJ,OAAO,QAAQ,QAAQ,YAAY,OAAO,QAAQ,QAAQ,WACtD,QAAQ,MAAM,QAAQ,MACtB,OAAO;AACb,MACE,OAAO,gBAAgB,QAAQ,YAC/B,gBAAgB,IAAI,WAAW,KAC/B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC7B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC7B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC5B,QAAQ,MAAiB,iBAC1B,YAAY,KACZ,WAAW,sCACX,QAAQ,QAAQ,QAAQ,OACxB,QAAQ,QAAQ,eAChB,OAAO,QAAQ,QAAQ,YACvB,QAAQ,IAAI,WAAW,KACvB,QAAQ,YAAY,0BACpB,QAAQ,eAAe,QAAQ,aAC/B,QAAQ,SAAS,eACjB,OAAO,QAAQ,gBAAgB,YAC/B,QAAQ,YAAY,WAAW,KAC/B,QAAQ,QAAQ,QAAQ,eACxB,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,WAAW,KAC5B,QAAQ,gBAAgB,iBACvB,QAAQ,gBAAgB,gBAC1B;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/embedded-admin/server.ts","../../src/core/errors.ts","../../src/embedded-admin/index.ts"],"sourcesContent":["import {\n  createLocalJWKSet,\n  jwtVerify,\n  type JSONWebKeySet,\n  type JWTPayload,\n} from 'jose'\nimport { createValidationError } from '../core/internal/errors'\nimport {\n  EMBEDDED_ADMIN_APP_KEY,\n  EMBEDDED_ADMIN_TENANT_ROLES,\n  type EmbeddedAdminTenantRole,\n  EMBEDDED_ADMIN_SESSION_TTL_SECONDS,\n  normalizeEmbeddedAdminExactOrigin,\n} from './index'\n\nconst ALGORITHMS = ['RS256', 'ES256'] as const\nconst MAX_JWKS_BYTES = 64 * 1024\n\nexport type EmbeddedAdminRole = 'super-admin' | EmbeddedAdminTenantRole\n\nexport type EmbeddedAdminSessionClaims = JWTPayload & {\n  app_key: typeof EMBEDDED_ADMIN_APP_KEY\n  channel_id: string\n  dest: string\n  operator_id: string\n  tenant_id: string\n  tenant_role: EmbeddedAdminRole\n}\n\nexport type VerifyEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  /** Receiver-owned exact allowlist. Defaults to super-admin and tenant-admin. Never accept this from browser input. */\n  allowedRoles?: readonly EmbeddedAdminRole[]\n  channelId: string\n  consoleOrigin: string\n  destination: string\n  fetch?: typeof globalThis.fetch\n  jwks?: JSONWebKeySet\n  now?: number\n  token: string\n}\n\nexport type FetchEmbeddedAdminJwksOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  fetch?: typeof globalThis.fetch\n}\n\nfunction parseJwks(value: unknown): JSONWebKeySet {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  const keys = (value as Record<string, unknown>).keys\n  if (!Array.isArray(keys) || keys.length === 0 || keys.length > 2) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  const privateMembers = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k']\n  for (const key of keys) {\n    if (!key || typeof key !== 'object' || Array.isArray(key)) {\n      throw new Error('Embedded admin JWKS is invalid.')\n    }\n    const record = key as Record<string, unknown>\n    if (\n      typeof record.kid !== 'string' ||\n      record.kid.length === 0 ||\n      privateMembers.some((member) => member in record)\n    ) {\n      throw new Error('Embedded admin JWKS is invalid.')\n    }\n  }\n  return { keys: keys as JSONWebKeySet['keys'] }\n}\n\nexport async function fetchEmbeddedAdminJwks(\n  consoleOrigin: string,\n  options: FetchEmbeddedAdminJwksOptions = {},\n): Promise<JSONWebKeySet> {\n  const issuer = normalizeEmbeddedAdminExactOrigin(consoleOrigin, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  if (!issuer) {\n    throw createValidationError('consoleOrigin must be one exact origin.')\n  }\n\n  const response = await (options.fetch ?? globalThis.fetch)(\n    new URL('/api/embedded-admin', issuer),\n    { cache: 'no-store', headers: { Accept: 'application/json' } },\n  )\n  if (!response.ok) throw new Error('Embedded admin JWKS is unavailable.')\n  const text = await response.text()\n  if (new TextEncoder().encode(text).byteLength > MAX_JWKS_BYTES) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  return parseJwks(JSON.parse(text) as unknown)\n}\n\n/** Verifies the Console assertion before the receiver establishes an app session. */\nexport async function verifyEmbeddedAdminSession(\n  options: VerifyEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionClaims> {\n  const allowedRoles = options.allowedRoles ?? ['super-admin', 'tenant-admin']\n  if (\n    !Array.isArray(allowedRoles) ||\n    allowedRoles.some(\n      (role) => !['super-admin', ...EMBEDDED_ADMIN_TENANT_ROLES].includes(role),\n    )\n  ) {\n    throw createValidationError(\n      'Embedded admin receiver allowedRoles is invalid.',\n    )\n  }\n  const issuer = normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  const destination = normalizeEmbeddedAdminExactOrigin(options.destination, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  if (!issuer || !destination) {\n    throw createValidationError(\n      'consoleOrigin and destination must be exact origins.',\n    )\n  }\n  if (\n    typeof options.channelId !== 'string' ||\n    options.channelId.length < 16 ||\n    options.channelId.length > 128 ||\n    typeof options.token !== 'string' ||\n    options.token.length === 0\n  ) {\n    throw createValidationError('Embedded admin session input is invalid.')\n  }\n\n  const jwks = options.jwks\n    ? parseJwks(options.jwks)\n    : await fetchEmbeddedAdminJwks(issuer, {\n        allowLoopbackHttp: options.allowLoopbackHttp,\n        fetch: options.fetch,\n      })\n  const currentSecond = options.now ?? Math.floor(Date.now() / 1000)\n  const { payload, protectedHeader } = await jwtVerify(\n    options.token,\n    createLocalJWKSet(jwks),\n    {\n      algorithms: [...ALGORITHMS],\n      audience: destination,\n      clockTolerance: 0,\n      currentDate: new Date(currentSecond * 1000),\n      issuer,\n      requiredClaims: ['iat', 'nbf', 'exp', 'jti', 'sub'],\n    },\n  )\n\n  const lifetime =\n    typeof payload.exp === 'number' && typeof payload.iat === 'number'\n      ? payload.exp - payload.iat\n      : Number.POSITIVE_INFINITY\n  if (\n    typeof protectedHeader.kid !== 'string' ||\n    protectedHeader.kid.length === 0 ||\n    !Number.isInteger(payload.iat) ||\n    !Number.isInteger(payload.nbf) ||\n    !Number.isInteger(payload.exp) ||\n    (payload.iat as number) > currentSecond ||\n    lifetime <= 0 ||\n    lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS ||\n    payload.nbf !== payload.iat ||\n    payload.aud !== destination ||\n    typeof payload.jti !== 'string' ||\n    payload.jti.length === 0 ||\n    payload.app_key !== EMBEDDED_ADMIN_APP_KEY ||\n    payload.channel_id !== options.channelId ||\n    payload.dest !== destination ||\n    typeof payload.operator_id !== 'string' ||\n    payload.operator_id.length === 0 ||\n    payload.sub !== payload.operator_id ||\n    typeof payload.tenant_id !== 'string' ||\n    payload.tenant_id.length === 0 ||\n    !['super-admin', ...EMBEDDED_ADMIN_TENANT_ROLES].includes(\n      payload.tenant_role as string,\n    ) ||\n    !allowedRoles.includes(payload.tenant_role as EmbeddedAdminRole)\n  ) {\n    throw new Error('Embedded admin session claims are invalid.')\n  }\n\n  return payload as EmbeddedAdminSessionClaims\n}\n","const SDK_ERROR_BRAND = Symbol.for('@01.software/sdk/SDKError')\nconst SDK_ERROR_TYPE_BRAND = Symbol.for('@01.software/sdk/SDKError.type')\n\ntype SDKErrorType =\n  | 'NetworkError'\n  | 'ValidationError'\n  | 'ApiError'\n  | 'ConfigError'\n  | 'TimeoutError'\n  | 'GoneError'\n  | 'ServiceUnavailableError'\n  | 'UsageLimitError'\n  | 'AuthError'\n  | 'PermissionError'\n  | 'NotFoundError'\n  | 'ConflictError'\n  | 'RateLimitError'\n\nfunction defineSDKErrorBrand(error: SDKError): void {\n  Object.defineProperty(error, SDK_ERROR_BRAND, {\n    value: true,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nfunction defineSDKErrorType(error: SDKError, type: SDKErrorType): void {\n  Object.defineProperty(error, SDK_ERROR_TYPE_BRAND, {\n    value: type,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nexport class SDKError extends Error {\n  readonly code: string\n  readonly status?: number\n  readonly details?: unknown\n  readonly userMessage?: string\n  readonly suggestion?: string\n  readonly requestId?: string\n  readonly kind?: 'commerce'\n  readonly reason?: CommerceErrorCode | 'unknown_commerce_error'\n  readonly rawReason?: string\n  /** Machine-readable reason from a non-commerce API response. */\n  readonly apiReason?: string\n  readonly retryable?: boolean\n  readonly retryAfter?: number\n\n  constructor(\n    code: string,\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(message)\n    this.name = 'SDKError'\n    this.code = code\n    this.status = status\n    this.details = details\n    this.userMessage = userMessage\n    this.suggestion = suggestion\n    this.requestId = requestId\n    defineSDKErrorBrand(this)\n\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, new.target)\n    }\n  }\n\n  getUserMessage(): string {\n    return this.userMessage || this.message\n  }\n\n  toJSON() {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      details: this.details,\n      userMessage: this.userMessage,\n      suggestion: this.suggestion,\n      ...(this.requestId !== undefined && { requestId: this.requestId }),\n      ...(this.kind !== undefined && { kind: this.kind }),\n      ...(this.reason !== undefined && { reason: this.reason }),\n      ...(this.rawReason !== undefined && { rawReason: this.rawReason }),\n      ...(this.apiReason !== undefined && { apiReason: this.apiReason }),\n      ...(this.retryable !== undefined && { retryable: this.retryable }),\n      ...(this.retryAfter !== undefined && { retryAfter: this.retryAfter }),\n    }\n  }\n}\n\n/**\n * Canonical Cart/Checkout/PaymentSession error reasons. This public SDK mirror\n * intentionally does not import the private contracts package; parity is\n * enforced by a type test.\n */\nexport const COMMERCE_ERROR_CODES = [\n  'validation_failed',\n  'bad_request',\n  'unauthorized',\n  'forbidden',\n  'account_suspended',\n  'key_invalid',\n  'pat_tenant_header_forbidden',\n  'tenant_mismatch',\n  'test_tenant_expired',\n  'token_invalid',\n  'token_expired',\n  'origin_not_allowed',\n  'server_credentials_required',\n  'role_denied',\n  'scope_denied',\n  'feature_disabled',\n  'not_found',\n  'conflict',\n  'locked',\n  'cart_revision_conflict',\n  'rate_limit_exceeded',\n  'usage_limit_exceeded',\n  'service_unavailable',\n  'idempotency_conflict',\n  'idempotency_in_progress',\n  'idempotency_key_required',\n  'invalid_idempotency_key',\n  'cart_not_active',\n  'cart_locked',\n  'cart_empty',\n  'cart_market_unavailable',\n  'cart_market_mismatch',\n  'checkout_not_open',\n  'checkout_already_open',\n  'payment_slot_held',\n  'reservation_expired',\n  'payment_session_not_cancelable',\n  'payment_session_conflict',\n  'provider_identity_mismatch',\n  'managed_refund_attestation_forbidden',\n  'payment_method_unavailable',\n  'provider_unavailable',\n  'lock_timeout',\n  'price_changed',\n  'pricing_fact_in_use',\n  'insufficient_stock',\n  'reservation_conflict',\n  'stock_lock_unavailable',\n  'variant_not_found',\n  'variant_stock_write_failed',\n  'stock_invariant_violation',\n  'payment_confirmation_in_flight',\n  'checkout_reservation_release_requires_transaction',\n  'admission_metadata_invalid',\n  'admission_metadata_required',\n  'capacity_exceeded',\n  'occurrence_lock_unavailable',\n  'occurrence_not_open',\n  'admission_type_capacity_exceeded',\n  'admission_type_occurrence_mismatch',\n  'admission_hold_expired',\n  'admission_hold_checkout_item_conflict',\n  'admission_hold_checkout_conflict',\n  'admission_hold_quantity_mismatch',\n  'admission_hold_unbound',\n  'admission_hold_missing',\n  'admission_hold_checkout_item_missing',\n  'admission_hold_expiry_failed',\n  'admission_hold_expiry_requires_transaction',\n  'admission_hold_line_item_mismatch',\n  'admission_materialization_failed',\n  'variant_inactive',\n  'variant_product_mismatch',\n  'product_not_public',\n  'market_not_found',\n  'market_shipping_currency_unsupported',\n  'missing_market_rate',\n  'missing_shipping_amount',\n  'no_enabled_payment_provider',\n  'product_market_unavailable',\n  'unsupported_currency',\n  'missing_price_row',\n  'payment_provider_currency_unsupported',\n  'discount_code_not_found',\n  'discount_not_started',\n  'discount_expired',\n  'discount_usage_limit',\n  'discount_per_customer_limit',\n  'discount_customer_required',\n  'discount_first_order_only',\n  'discount_customer_not_eligible',\n  'discount_customer_excluded',\n  'discount_items_required',\n  'discount_product_not_eligible',\n  'discount_product_excluded',\n  'discount_min_order_amount',\n  'discount_currency_scope_required',\n  'discount_allocation_method_unsupported',\n  'currency_mismatch',\n  'customer_token_required',\n  'market_required',\n  'server_derived',\n  'internal_error',\n] as const\n\nexport type CommerceErrorCode = (typeof COMMERCE_ERROR_CODES)[number]\n\ntype CommerceSDKErrorBase = SDKError & {\n  readonly kind: 'commerce'\n  readonly requestId: string\n  readonly retryable: boolean\n  readonly retryAfter?: number\n  readonly details?: Record<string, unknown>\n}\n\nexport type CommerceSDKError = CommerceSDKErrorBase &\n  (\n    | { readonly reason: CommerceErrorCode; readonly rawReason?: never }\n    | {\n        readonly reason: 'unknown_commerce_error'\n        readonly rawReason: string\n      }\n  )\n\nconst COMMERCE_ERROR_CODE_SET: ReadonlySet<string> = new Set(\n  COMMERCE_ERROR_CODES,\n)\nconst COMMERCE_ERROR_ENVELOPE_KEYS = new Set([\n  'error',\n  'reason',\n  'requestId',\n  'retryable',\n  'details',\n])\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nexport type CommerceErrorEnvelope = {\n  error: string\n  reason: string\n  requestId: string\n  retryable: boolean\n  details?: Record<string, unknown>\n}\n\nfunction commerceProtocolError(\n  issue: string,\n  trustedRequestId?: string,\n): SDKError {\n  return createApiError(\n    'Invalid canonical commerce error response.',\n    502,\n    { protocol: 'commerce-error-envelope', issue },\n    'The server returned an incompatible commerce error response.',\n    'Verify that the Console commerce contract is deployed before using this SDK version.',\n    trustedRequestId,\n  )\n}\n\n/** @internal Strictly parse a canonical commerce error without retaining its raw body. */\nexport function parseCommerceErrorEnvelope(\n  body: unknown,\n  headerRequestId?: string,\n): CommerceErrorEnvelope {\n  if (headerRequestId === undefined) {\n    throw commerceProtocolError('missing_request_id_header')\n  }\n  if (headerRequestId.length === 0) {\n    throw commerceProtocolError('empty_request_id_header')\n  }\n  if (!isPlainRecord(body)) {\n    throw commerceProtocolError('expected_object', headerRequestId)\n  }\n  if (Object.keys(body).some((key) => !COMMERCE_ERROR_ENVELOPE_KEYS.has(key))) {\n    throw commerceProtocolError('unexpected_field', headerRequestId)\n  }\n  if (\n    typeof body.error !== 'string' ||\n    body.error.length === 0 ||\n    typeof body.reason !== 'string' ||\n    body.reason.length === 0 ||\n    typeof body.requestId !== 'string' ||\n    body.requestId.length === 0 ||\n    (body.retryable !== undefined && typeof body.retryable !== 'boolean') ||\n    (body.details !== undefined && !isPlainRecord(body.details))\n  ) {\n    throw commerceProtocolError('invalid_field', headerRequestId)\n  }\n\n  if (headerRequestId !== undefined && headerRequestId !== body.requestId) {\n    throw commerceProtocolError('request_id_mismatch', headerRequestId)\n  }\n\n  return {\n    error: body.error,\n    reason: body.reason,\n    requestId: body.requestId,\n    retryable: body.retryable === true,\n    ...(body.details === undefined ? {} : { details: body.details }),\n  }\n}\n\n/** @internal Validate and apply the canonical commerce error envelope. */\nexport function enhanceCommerceError(\n  error: SDKError,\n  body: unknown,\n  headerRequestId?: string,\n): SDKError {\n  const envelope = parseCommerceErrorEnvelope(body, headerRequestId)\n\n  const known = COMMERCE_ERROR_CODE_SET.has(envelope.reason)\n  Object.assign(error, {\n    code: envelope.reason,\n    kind: 'commerce' as const,\n    reason: known\n      ? (envelope.reason as CommerceErrorCode)\n      : 'unknown_commerce_error',\n    ...(known ? {} : { rawReason: envelope.reason }),\n    requestId: envelope.requestId,\n    retryable: envelope.retryable,\n    details: envelope.details,\n  })\n  return error\n}\n\n/** @internal Apply a non-commerce reason without canonical-commerce validation. */\nexport function enhanceNonCommerceError(\n  error: SDKError,\n  reason: unknown,\n): SDKError {\n  if (typeof reason === 'string') Object.assign(error, { apiReason: reason })\n  return error\n}\n\n/**\n * Read the server-provided machine reason across strict commerce and\n * non-commerce SDK errors. Unknown commerce reasons are returned verbatim.\n */\nexport function getSDKErrorReason(error: SDKError): string | undefined {\n  if (error.kind !== 'commerce') return error.apiReason\n  return error.reason === 'unknown_commerce_error'\n    ? error.rawReason\n    : error.reason\n}\n\nexport function isCommerceSDKError(error: unknown): error is CommerceSDKError {\n  if (!isSDKError(error) || error.kind !== 'commerce') return false\n  if (\n    typeof error.requestId !== 'string' ||\n    typeof error.retryable !== 'boolean' ||\n    (error.retryAfter !== undefined &&\n      (!Number.isSafeInteger(error.retryAfter) || error.retryAfter < 0)) ||\n    typeof error.reason !== 'string'\n  ) {\n    return false\n  }\n  return error.reason === 'unknown_commerce_error'\n    ? typeof error.rawReason === 'string'\n    : COMMERCE_ERROR_CODE_SET.has(error.reason) && error.rawReason === undefined\n}\n\nexport class NetworkError extends SDKError {\n  constructor(\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('NETWORK_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'NetworkError'\n    defineSDKErrorType(this, 'NetworkError')\n  }\n}\n\nexport class ValidationError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    status = 400,\n  ) {\n    super('VALIDATION_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'ValidationError'\n    defineSDKErrorType(this, 'ValidationError')\n  }\n}\n\nexport class ApiError extends SDKError {\n  constructor(\n    message: string,\n    status: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'API_ERROR',\n      message,\n      status,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'ApiError'\n    defineSDKErrorType(this, 'ApiError')\n  }\n}\n\nexport class ConfigError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('CONFIG_ERROR', message, undefined, details, userMessage, suggestion)\n    this.name = 'ConfigError'\n    defineSDKErrorType(this, 'ConfigError')\n  }\n}\n\nexport class TimeoutError extends SDKError {\n  constructor(\n    message = 'Request timed out.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('TIMEOUT_ERROR', message, 408, details, userMessage, suggestion)\n    this.name = 'TimeoutError'\n    defineSDKErrorType(this, 'TimeoutError')\n  }\n}\n\nexport class GoneError extends SDKError {\n  constructor(\n    message = 'The requested resource is no longer available.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('GONE_ERROR', message, 410, details, userMessage, suggestion)\n    this.name = 'GoneError'\n    defineSDKErrorType(this, 'GoneError')\n  }\n}\n\nexport class ServiceUnavailableError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message = 'Service temporarily unavailable.',\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super(\n      'SERVICE_UNAVAILABLE_ERROR',\n      message,\n      503,\n      details,\n      userMessage,\n      suggestion,\n    )\n    this.name = 'ServiceUnavailableError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'ServiceUnavailableError')\n  }\n}\n\nexport class UsageLimitError extends SDKError {\n  readonly usage: { limit: number; current: number; remaining: number }\n\n  constructor(\n    message: string,\n    usage: { limit: number; current: number; remaining: number },\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('USAGE_LIMIT_ERROR', message, 429, details, userMessage, suggestion)\n    this.name = 'UsageLimitError'\n    this.usage = usage\n    defineSDKErrorType(this, 'UsageLimitError')\n  }\n\n  toJSON() {\n    return {\n      ...super.toJSON(),\n      usage: this.usage,\n    }\n  }\n}\n\nexport class AuthError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'auth_error',\n      message,\n      401,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'AuthError'\n    defineSDKErrorType(this, 'AuthError')\n  }\n}\n\nexport class PermissionError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'permission_error',\n      message,\n      403,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'PermissionError'\n    defineSDKErrorType(this, 'PermissionError')\n  }\n}\n\nexport class NotFoundError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'not_found',\n      message,\n      404,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'NotFoundError'\n    defineSDKErrorType(this, 'NotFoundError')\n  }\n}\n\nexport class ConflictError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super('conflict', message, 409, details, userMessage, suggestion, requestId)\n    this.name = 'ConflictError'\n    defineSDKErrorType(this, 'ConflictError')\n  }\n}\n\nexport class RateLimitError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message: string,\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'rate_limit_exceeded',\n      message,\n      429,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'RateLimitError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'RateLimitError')\n  }\n}\n\nfunction hasBrandedSDKErrorShape(error: unknown): error is SDKError {\n  if (error === null || typeof error !== 'object') return false\n\n  const candidate = error as Record<PropertyKey, unknown>\n  return (\n    candidate[SDK_ERROR_BRAND] === true &&\n    typeof candidate.name === 'string' &&\n    typeof candidate.code === 'string' &&\n    typeof candidate.message === 'string' &&\n    (candidate.status === undefined || typeof candidate.status === 'number') &&\n    (candidate.userMessage === undefined ||\n      typeof candidate.userMessage === 'string') &&\n    (candidate.suggestion === undefined ||\n      typeof candidate.suggestion === 'string') &&\n    (candidate.requestId === undefined ||\n      typeof candidate.requestId === 'string') &&\n    (candidate.kind === undefined || candidate.kind === 'commerce') &&\n    (candidate.reason === undefined || typeof candidate.reason === 'string') &&\n    (candidate.rawReason === undefined ||\n      typeof candidate.rawReason === 'string') &&\n    (candidate.apiReason === undefined ||\n      typeof candidate.apiReason === 'string') &&\n    (candidate.retryable === undefined ||\n      typeof candidate.retryable === 'boolean') &&\n    (candidate.retryAfter === undefined ||\n      typeof candidate.retryAfter === 'number') &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nfunction hasSDKErrorType(error: unknown, type: SDKErrorType): boolean {\n  return (\n    hasBrandedSDKErrorShape(error) &&\n    (error as unknown as Record<PropertyKey, unknown>)[SDK_ERROR_TYPE_BRAND] ===\n      type\n  )\n}\n\nexport function isSDKError(error: unknown): error is SDKError {\n  return error instanceof SDKError || hasBrandedSDKErrorShape(error)\n}\n\nexport function isNetworkError(error: unknown): error is NetworkError {\n  return error instanceof NetworkError || hasSDKErrorType(error, 'NetworkError')\n}\n\nexport function isValidationError(error: unknown): error is ValidationError {\n  if (\n    error instanceof ValidationError ||\n    hasSDKErrorType(error, 'ValidationError')\n  ) {\n    return true\n  }\n  if (error == null || typeof error !== 'object') return false\n\n  const candidate = error as {\n    code?: unknown\n    name?: unknown\n    message?: unknown\n    getUserMessage?: unknown\n    toJSON?: unknown\n  }\n  return (\n    candidate.name === 'ValidationError' &&\n    candidate.code === 'VALIDATION_ERROR' &&\n    typeof candidate.message === 'string' &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nexport function isApiError(error: unknown): error is ApiError {\n  return error instanceof ApiError || hasSDKErrorType(error, 'ApiError')\n}\n\nexport function isConfigError(error: unknown): error is ConfigError {\n  return error instanceof ConfigError || hasSDKErrorType(error, 'ConfigError')\n}\n\nexport function isTimeoutError(error: unknown): error is TimeoutError {\n  return error instanceof TimeoutError || hasSDKErrorType(error, 'TimeoutError')\n}\n\nexport function isGoneError(error: unknown): error is GoneError {\n  return error instanceof GoneError || hasSDKErrorType(error, 'GoneError')\n}\n\nexport function isServiceUnavailableError(\n  error: unknown,\n): error is ServiceUnavailableError {\n  return (\n    error instanceof ServiceUnavailableError ||\n    hasSDKErrorType(error, 'ServiceUnavailableError')\n  )\n}\n\nexport function isUsageLimitError(error: unknown): error is UsageLimitError {\n  return (\n    error instanceof UsageLimitError ||\n    hasSDKErrorType(error, 'UsageLimitError')\n  )\n}\n\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError || hasSDKErrorType(error, 'AuthError')\n}\n\nexport function isPermissionError(error: unknown): error is PermissionError {\n  return (\n    error instanceof PermissionError ||\n    hasSDKErrorType(error, 'PermissionError')\n  )\n}\n\nexport function isNotFoundError(error: unknown): error is NotFoundError {\n  return (\n    error instanceof NotFoundError || hasSDKErrorType(error, 'NotFoundError')\n  )\n}\n\nexport function isConflictError(error: unknown): error is ConflictError {\n  return (\n    error instanceof ConflictError || hasSDKErrorType(error, 'ConflictError')\n  )\n}\n\nexport function isRateLimitError(error: unknown): error is RateLimitError {\n  return (\n    error instanceof RateLimitError || hasSDKErrorType(error, 'RateLimitError')\n  )\n}\n\nexport const createNetworkError = (\n  message: string,\n  status?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new NetworkError(message, status, details, userMessage, suggestion)\n\nexport const createValidationError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  status?: number,\n) => new ValidationError(message, details, userMessage, suggestion, status)\n\nexport const createApiError = (\n  message: string,\n  status: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ApiError(message, status, details, userMessage, suggestion, requestId)\n\nexport const createConfigError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new ConfigError(message, details, userMessage, suggestion)\n\nexport const createTimeoutError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new TimeoutError(message, details, userMessage, suggestion)\n\nexport const createGoneError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new GoneError(message, details, userMessage, suggestion)\n\nexport const createServiceUnavailableError = (\n  message?: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) =>\n  new ServiceUnavailableError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n  )\n\nexport const createUsageLimitError = (\n  message: string,\n  usage: { limit: number; current: number; remaining: number },\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new UsageLimitError(message, usage, details, userMessage, suggestion)\n\nexport const createAuthError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new AuthError(message, details, userMessage, suggestion, requestId)\n\nexport const createPermissionError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new PermissionError(message, details, userMessage, suggestion, requestId)\n\nexport const createNotFoundError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new NotFoundError(message, details, userMessage, suggestion, requestId)\n\nexport const createConflictError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ConflictError(message, details, userMessage, suggestion, requestId)\n\nexport const createRateLimitError = (\n  message: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) =>\n  new RateLimitError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n    requestId,\n  )\n","import { createValidationError } from '../core/internal/errors'\n\nexport const EMBEDDED_ADMIN_PROTOCOL_VERSION = 1 as const\nexport const EMBEDDED_ADMIN_CHALLENGE_MESSAGE =\n  '01.embedded-admin.challenge' as const\nexport const EMBEDDED_ADMIN_READY_MESSAGE = '01.embedded-admin.ready' as const\nexport const EMBEDDED_ADMIN_SESSION_MESSAGE =\n  '01.embedded-admin.session' as const\nexport const EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60 as const\nexport const EMBEDDED_ADMIN_APP_KEY = 'primary' as const\n\nconst DEFAULT_RECEIVER_TIMEOUT_MS = 35_000\nconst MAX_RECEIVER_TIMEOUT_MS = 120_000\nconst MAX_LABEL_LENGTH = 80\nconst MAX_PATH_LENGTH = 512\n\nexport type EmbeddedAdminChallengeMessage = {\n  type: typeof EMBEDDED_ADMIN_CHALLENGE_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminReadyMessage = {\n  type: typeof EMBEDDED_ADMIN_READY_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminSessionMessage = {\n  type: typeof EMBEDDED_ADMIN_SESSION_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n  token: string\n}\n\n/** Exact execution roles; this list grants no platform data permissions. */\nexport const EMBEDDED_ADMIN_TENANT_ROLES = [\n  'tenant-admin',\n  'tenant-editor',\n  'tenant-viewer',\n] as const\nexport type EmbeddedAdminTenantRole =\n  (typeof EMBEDDED_ADMIN_TENANT_ROLES)[number]\n\n/** Missing legacy settings retain administrator-only execution; invalid settings fail closed. */\nexport function normalizeEmbeddedAdminAllowedRoles(\n  value: unknown,\n): EmbeddedAdminTenantRole[] | null {\n  if (value === undefined || value === null) return ['tenant-admin']\n  if (\n    !Array.isArray(value) ||\n    value.some((role) => !EMBEDDED_ADMIN_TENANT_ROLES.includes(role))\n  )\n    return null\n  return EMBEDDED_ADMIN_TENANT_ROLES.filter((role) => value.includes(role))\n}\n\nexport type EmbeddedAdminBindingConfiguration = {\n  allowedRoles?: EmbeddedAdminTenantRole[]\n  enabled: boolean\n  label: string\n  origin: string\n  path: string\n}\n\nexport type EmbeddedAdminSessionReceipt = {\n  requestId: string\n  token: string\n}\n\nexport type ReceiveEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  /** Exact Console origin configured by the receiver deployment. */\n  consoleOrigin: string\n  /** Cancels the one-shot receiver and closes every transferred port. */\n  signal?: AbortSignal\n  /** Defaults to 35 seconds and is capped at 120 seconds. */\n  timeoutMs?: number\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n  )\n}\n\nexport function normalizeEmbeddedAdminExactOrigin(\n  value: unknown,\n  options: { allowLoopbackHttp?: boolean } = {},\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (!trimmed || trimmed.length > 2048) return null\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed)\n  } catch {\n    return null\n  }\n\n  const allowedProtocol =\n    parsed.protocol === 'https:' ||\n    (options.allowLoopbackHttp === true &&\n      parsed.protocol === 'http:' &&\n      isLoopbackHostname(parsed.hostname))\n  if (!allowedProtocol || parsed.hostname.includes('*')) return null\n  if (parsed.username || parsed.password || parsed.search || parsed.hash) {\n    return null\n  }\n  if (parsed.pathname !== '/' || trimmed.endsWith('/')) return null\n\n  return parsed.origin\n}\n\nexport function normalizeEmbeddedAdminRelativePath(\n  value: unknown,\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (\n    !trimmed.startsWith('/') ||\n    trimmed.startsWith('//') ||\n    trimmed.length > MAX_PATH_LENGTH\n  ) {\n    return null\n  }\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed, 'https://embedded.invalid')\n  } catch {\n    return null\n  }\n\n  if (\n    parsed.origin !== 'https://embedded.invalid' ||\n    parsed.pathname.startsWith('//') ||\n    parsed.search ||\n    parsed.hash ||\n    parsed.username ||\n    parsed.password\n  ) {\n    return null\n  }\n\n  return parsed.pathname\n}\n\nexport function normalizeEmbeddedAdminBindingConfiguration(\n  value: unknown,\n  options: {\n    allowLoopbackConsoleHttp?: boolean\n    consoleOrigin?: string\n  } = {},\n): EmbeddedAdminBindingConfiguration {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw createValidationError('Embedded admin binding must be an object.')\n  }\n\n  const input = value as Record<string, unknown>\n  const allowedRoles = normalizeEmbeddedAdminAllowedRoles(input.allowedRoles)\n  if (!allowedRoles)\n    throw createValidationError(\n      'Embedded admin allowedRoles must contain only tenant execution roles.',\n    )\n  const label = typeof input.label === 'string' ? input.label.trim() : ''\n  const origin = normalizeEmbeddedAdminExactOrigin(input.origin)\n  const path = normalizeEmbeddedAdminRelativePath(input.path)\n  const consoleOrigin = options.consoleOrigin\n    ? normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n        allowLoopbackHttp: options.allowLoopbackConsoleHttp === true,\n      })\n    : null\n\n  if (!label || label.length > MAX_LABEL_LENGTH) {\n    throw createValidationError(\n      `Embedded admin label must be between 1 and ${MAX_LABEL_LENGTH} characters.`,\n    )\n  }\n  if (!origin) {\n    throw createValidationError(\n      'Embedded admin origin must be an exact HTTPS origin without a path, query, fragment, wildcard, or credentials.',\n    )\n  }\n  if (!path) {\n    throw createValidationError(\n      'Embedded admin path must begin with / and must not include a query or fragment.',\n    )\n  }\n  if (consoleOrigin && origin === consoleOrigin) {\n    throw createValidationError(\n      'Embedded admin origin must be different from the Console origin.',\n    )\n  }\n\n  return {\n    allowedRoles,\n    enabled: input.enabled !== false,\n    label,\n    origin,\n    path,\n  }\n}\n\nexport function isEmbeddedAdminChallengeMessage(\n  value: unknown,\n): value is EmbeddedAdminChallengeMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_CHALLENGE_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminReadyMessage(\n  value: unknown,\n): value is EmbeddedAdminReadyMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_READY_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminSessionMessage(\n  value: unknown,\n): value is EmbeddedAdminSessionMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_SESSION_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128 &&\n    typeof message.token === 'string' &&\n    message.token.length > 0\n  )\n}\n\n/**\n * Receives one Console assertion through the exact parent/origin challenge\n * channel. Forward the returned token immediately to the receiver backend;\n * never persist, log, decode, or use it as Console API authority in-browser.\n */\nexport function receiveEmbeddedAdminSession(\n  options: ReceiveEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionReceipt> {\n  if (typeof window === 'undefined' || window.parent === window) {\n    return Promise.reject(\n      createValidationError(\n        'receiveEmbeddedAdminSession must run inside an embedded browser frame.',\n      ),\n    )\n  }\n\n  const consoleOrigin = normalizeEmbeddedAdminExactOrigin(\n    options.consoleOrigin,\n    { allowLoopbackHttp: options.allowLoopbackHttp === true },\n  )\n  if (!consoleOrigin) {\n    return Promise.reject(\n      createValidationError('consoleOrigin must be one exact HTTPS origin.'),\n    )\n  }\n\n  const timeoutMs = options.timeoutMs ?? DEFAULT_RECEIVER_TIMEOUT_MS\n  if (\n    !Number.isInteger(timeoutMs) ||\n    timeoutMs <= 0 ||\n    timeoutMs > MAX_RECEIVER_TIMEOUT_MS\n  ) {\n    return Promise.reject(\n      createValidationError(\n        `timeoutMs must be an integer between 1 and ${MAX_RECEIVER_TIMEOUT_MS}.`,\n      ),\n    )\n  }\n\n  return new Promise((resolve, reject) => {\n    const ports = new Set<MessagePort>()\n    let settled = false\n\n    const closePorts = () => {\n      for (const port of ports) port.close()\n      ports.clear()\n    }\n    const cleanup = () => {\n      window.removeEventListener('message', acceptChallenge)\n      options.signal?.removeEventListener('abort', abort)\n      clearTimeout(timer)\n      closePorts()\n    }\n    const finish = (receipt: EmbeddedAdminSessionReceipt) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      resolve(receipt)\n    }\n    const fail = (error: Error) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      reject(error)\n    }\n    const abort = () =>\n      fail(new Error('Embedded admin session receipt aborted.'))\n    const acceptSession = (\n      event: MessageEvent<unknown>,\n      expectedRequestId: string,\n    ) => {\n      if (\n        !isEmbeddedAdminSessionMessage(event.data) ||\n        event.data.requestId !== expectedRequestId\n      ) {\n        return\n      }\n      finish({ requestId: event.data.requestId, token: event.data.token })\n    }\n    const acceptChallenge = (event: MessageEvent<unknown>) => {\n      if (\n        event.source !== window.parent ||\n        event.origin !== consoleOrigin ||\n        !isEmbeddedAdminChallengeMessage(event.data) ||\n        event.ports.length !== 1\n      ) {\n        for (const port of event.ports) port.close()\n        return\n      }\n\n      const port = event.ports[0]!\n      const requestId = event.data.requestId\n      ports.add(port)\n      port.addEventListener('message', (message) => {\n        acceptSession(message, requestId)\n      })\n      port.start()\n      port.postMessage({\n        type: EMBEDDED_ADMIN_READY_MESSAGE,\n        version: EMBEDDED_ADMIN_PROTOCOL_VERSION,\n        requestId,\n      } satisfies EmbeddedAdminReadyMessage)\n    }\n\n    const timer = setTimeout(() => {\n      fail(new Error('Timed out waiting for an embedded admin session.'))\n    }, timeoutMs)\n\n    if (options.signal?.aborted) {\n      abort()\n      return\n    }\n    options.signal?.addEventListener('abort', abort, { once: true })\n    window.addEventListener('message', acceptChallenge)\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAKO;;;ACLP,IAAM,kBAAkB,uBAAO,IAAI,2BAA2B;AAC9D,IAAM,uBAAuB,uBAAO,IAAI,gCAAgC;AAiBxE,SAAS,oBAAoB,OAAuB;AAClD,SAAO,eAAe,OAAO,iBAAiB;AAAA,IAC5C,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAiB,MAA0B;AACrE,SAAO,eAAe,OAAO,sBAAsB;AAAA,IACjD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAelC,YACE,MACA,SACA,QACA,SACA,aACA,YACA,WACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,aAAa;AAClB,SAAK,YAAY;AACjB,wBAAoB,IAAI;AAExB,QAAI,MAAM,mBAAmB;AAC3B,YAAM,kBAAkB,MAAM,UAAU;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,iBAAyB;AACvB,WAAO,KAAK,eAAe,KAAK;AAAA,EAClC;AAAA,EAEA,SAAS;AACP,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,YAAY,KAAK;AAAA,MACjB,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,SAAS,UAAa,EAAE,MAAM,KAAK,KAAK;AAAA,MACjD,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;AAAA,MACvD,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,eAAe,UAAa,EAAE,YAAY,KAAK,WAAW;AAAA,IACrE;AAAA,EACF;AACF;AAOO,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqBA,IAAM,0BAA+C,IAAI;AAAA,EACvD;AACF;AAuJO,IAAM,kBAAN,cAA8B,SAAS;AAAA,EAC5C,YACE,SACA,SACA,aACA,YACA,SAAS,KACT;AACA,UAAM,oBAAoB,SAAS,QAAQ,SAAS,aAAa,UAAU;AAC3E,SAAK,OAAO;AACZ,uBAAmB,MAAM,iBAAiB;AAAA,EAC5C;AACF;AAuWO,IAAM,wBAAwB,CACnC,SACA,SACA,aACA,YACA,WACG,IAAI,gBAAgB,SAAS,SAAS,aAAa,YAAY,MAAM;;;AC/uBnE,IAAM,qCAAqC;AAC3C,IAAM,yBAAyB;AA2B/B,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AACF;AAyCA,SAAS,mBAAmB,UAA2B;AACrD,SACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEO,SAAS,kCACd,OACA,UAA2C,CAAC,GAC7B;AACf,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,QAAQ,SAAS,KAAM,QAAO;AAE9C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,OAAO;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,kBACJ,OAAO,aAAa,YACnB,QAAQ,sBAAsB,QAC7B,OAAO,aAAa,WACpB,mBAAmB,OAAO,QAAQ;AACtC,MAAI,CAAC,mBAAmB,OAAO,SAAS,SAAS,GAAG,EAAG,QAAO;AAC9D,MAAI,OAAO,YAAY,OAAO,YAAY,OAAO,UAAU,OAAO,MAAM;AACtE,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,OAAO,QAAQ,SAAS,GAAG,EAAG,QAAO;AAE7D,SAAO,OAAO;AAChB;;;AFnGA,IAAM,aAAa,CAAC,SAAS,OAAO;AACpC,IAAM,iBAAiB,KAAK;AAiC5B,SAAS,UAAU,OAA+B;AAChD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,OAAQ,MAAkC;AAChD,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,KAAK,KAAK,SAAS,GAAG;AAChE,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,iBAAiB,CAAC,KAAK,KAAK,KAAK,MAAM,MAAM,MAAM,OAAO,GAAG;AACnE,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACzD,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,UAAM,SAAS;AACf,QACE,OAAO,OAAO,QAAQ,YACtB,OAAO,IAAI,WAAW,KACtB,eAAe,KAAK,CAAC,WAAW,UAAU,MAAM,GAChD;AACA,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AAAA,EACF;AACA,SAAO,EAAE,KAAoC;AAC/C;AAEA,eAAsB,uBACpB,eACA,UAAyC,CAAC,GAClB;AACxB,QAAM,SAAS,kCAAkC,eAAe;AAAA,IAC9D,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,UAAM,sBAAsB,yCAAyC;AAAA,EACvE;AAEA,QAAM,WAAW,OAAO,QAAQ,SAAS,WAAW;AAAA,IAClD,IAAI,IAAI,uBAAuB,MAAM;AAAA,IACrC,EAAE,OAAO,YAAY,SAAS,EAAE,QAAQ,mBAAmB,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,qCAAqC;AACvE,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,gBAAgB;AAC9D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,SAAO,UAAU,KAAK,MAAM,IAAI,CAAY;AAC9C;AAGA,eAAsB,2BACpB,SACqC;AACrC,QAAM,eAAe,QAAQ,gBAAgB,CAAC,eAAe,cAAc;AAC3E,MACE,CAAC,MAAM,QAAQ,YAAY,KAC3B,aAAa;AAAA,IACX,CAAC,SAAS,CAAC,CAAC,eAAe,GAAG,2BAA2B,EAAE,SAAS,IAAI;AAAA,EAC1E,GACA;AACA,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,kCAAkC,QAAQ,eAAe;AAAA,IACtE,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,QAAM,cAAc,kCAAkC,QAAQ,aAAa;AAAA,IACzE,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,MAAI,CAAC,UAAU,CAAC,aAAa;AAC3B,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,MACE,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,SAAS,MAC3B,QAAQ,UAAU,SAAS,OAC3B,OAAO,QAAQ,UAAU,YACzB,QAAQ,MAAM,WAAW,GACzB;AACA,UAAM,sBAAsB,0CAA0C;AAAA,EACxE;AAEA,QAAM,OAAO,QAAQ,OACjB,UAAU,QAAQ,IAAI,IACtB,MAAM,uBAAuB,QAAQ;AAAA,IACnC,mBAAmB,QAAQ;AAAA,IAC3B,OAAO,QAAQ;AAAA,EACjB,CAAC;AACL,QAAM,gBAAgB,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACjE,QAAM,EAAE,SAAS,gBAAgB,IAAI,UAAM;AAAA,IACzC,QAAQ;AAAA,QACR,+BAAkB,IAAI;AAAA,IACtB;AAAA,MACE,YAAY,CAAC,GAAG,UAAU;AAAA,MAC1B,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,aAAa,IAAI,KAAK,gBAAgB,GAAI;AAAA,MAC1C;AAAA,MACA,gBAAgB,CAAC,OAAO,OAAO,OAAO,OAAO,KAAK;AAAA,IACpD;AAAA,EACF;AAEA,QAAM,WACJ,OAAO,QAAQ,QAAQ,YAAY,OAAO,QAAQ,QAAQ,WACtD,QAAQ,MAAM,QAAQ,MACtB,OAAO;AACb,MACE,OAAO,gBAAgB,QAAQ,YAC/B,gBAAgB,IAAI,WAAW,KAC/B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC7B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC7B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC5B,QAAQ,MAAiB,iBAC1B,YAAY,KACZ,WAAW,sCACX,QAAQ,QAAQ,QAAQ,OACxB,QAAQ,QAAQ,eAChB,OAAO,QAAQ,QAAQ,YACvB,QAAQ,IAAI,WAAW,KACvB,QAAQ,YAAY,0BACpB,QAAQ,eAAe,QAAQ,aAC/B,QAAQ,SAAS,eACjB,OAAO,QAAQ,gBAAgB,YAC/B,QAAQ,YAAY,WAAW,KAC/B,QAAQ,QAAQ,QAAQ,eACxB,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,WAAW,KAC7B,CAAC,CAAC,eAAe,GAAG,2BAA2B,EAAE;AAAA,IAC/C,QAAQ;AAAA,EACV,KACA,CAAC,aAAa,SAAS,QAAQ,WAAgC,GAC/D;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,SAAO;AACT;","names":[]}

package/dist/embedded-admin/server.d.cts

@@ -1,7 +1,7 @@
 import { JWTPayload, JSONWebKeySet } from 'jose';
-import { EMBEDDED_ADMIN_APP_KEY } from '../embedded-admin.cjs';
+import { EmbeddedAdminTenantRole, EMBEDDED_ADMIN_APP_KEY } from '../embedded-admin.cjs';
 
-type EmbeddedAdminRole = 'super-admin' | 'tenant-admin';
+type EmbeddedAdminRole = 'super-admin' | EmbeddedAdminTenantRole;
 type EmbeddedAdminSessionClaims = JWTPayload & {
     app_key: typeof EMBEDDED_ADMIN_APP_KEY;
     channel_id: string;
@@ -13,6 +13,8 @@ type EmbeddedAdminSessionClaims = JWTPayload & {
 type VerifyEmbeddedAdminSessionOptions = {
     /** Test fixtures only. Production integrations must keep HTTPS enforcement. */
     allowLoopbackHttp?: boolean;
+    /** Receiver-owned exact allowlist. Defaults to super-admin and tenant-admin. Never accept this from browser input. */
+    allowedRoles?: readonly EmbeddedAdminRole[];
     channelId: string;
     consoleOrigin: string;
     destination: string;

package/dist/embedded-admin/server.d.ts

@@ -1,7 +1,7 @@
 import { JWTPayload, JSONWebKeySet } from 'jose';
-import { EMBEDDED_ADMIN_APP_KEY } from '../embedded-admin.js';
+import { EmbeddedAdminTenantRole, EMBEDDED_ADMIN_APP_KEY } from '../embedded-admin.js';
 
-type EmbeddedAdminRole = 'super-admin' | 'tenant-admin';
+type EmbeddedAdminRole = 'super-admin' | EmbeddedAdminTenantRole;
 type EmbeddedAdminSessionClaims = JWTPayload & {
     app_key: typeof EMBEDDED_ADMIN_APP_KEY;
     channel_id: string;
@@ -13,6 +13,8 @@ type EmbeddedAdminSessionClaims = JWTPayload & {
 type VerifyEmbeddedAdminSessionOptions = {
     /** Test fixtures only. Production integrations must keep HTTPS enforcement. */
     allowLoopbackHttp?: boolean;
+    /** Receiver-owned exact allowlist. Defaults to super-admin and tenant-admin. Never accept this from browser input. */
+    allowedRoles?: readonly EmbeddedAdminRole[];
     channelId: string;
     consoleOrigin: string;
     destination: string;

package/dist/embedded-admin/server.js

@@ -180,6 +180,11 @@ var createValidationError = (message, details, userMessage, suggestion, status)
 // src/embedded-admin/index.ts
 var EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60;
 var EMBEDDED_ADMIN_APP_KEY = "primary";
+var EMBEDDED_ADMIN_TENANT_ROLES = [
+  "tenant-admin",
+  "tenant-editor",
+  "tenant-viewer"
+];
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 }
@@ -244,6 +249,14 @@ async function fetchEmbeddedAdminJwks(consoleOrigin, options = {}) {
   return parseJwks(JSON.parse(text));
 }
 async function verifyEmbeddedAdminSession(options) {
+  const allowedRoles = options.allowedRoles ?? ["super-admin", "tenant-admin"];
+  if (!Array.isArray(allowedRoles) || allowedRoles.some(
+    (role) => !["super-admin", ...EMBEDDED_ADMIN_TENANT_ROLES].includes(role)
+  )) {
+    throw createValidationError(
+      "Embedded admin receiver allowedRoles is invalid."
+    );
+  }
   const issuer = normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {
     allowLoopbackHttp: options.allowLoopbackHttp === true
   });
@@ -276,7 +289,9 @@ async function verifyEmbeddedAdminSession(options) {
     }
   );
   const lifetime = typeof payload.exp === "number" && typeof payload.iat === "number" ? payload.exp - payload.iat : Number.POSITIVE_INFINITY;
-  if (typeof protectedHeader.kid !== "string" || protectedHeader.kid.length === 0 || !Number.isInteger(payload.iat) || !Number.isInteger(payload.nbf) || !Number.isInteger(payload.exp) || payload.iat > currentSecond || lifetime <= 0 || lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS || payload.nbf !== payload.iat || payload.aud !== destination || typeof payload.jti !== "string" || payload.jti.length === 0 || payload.app_key !== EMBEDDED_ADMIN_APP_KEY || payload.channel_id !== options.channelId || payload.dest !== destination || typeof payload.operator_id !== "string" || payload.operator_id.length === 0 || payload.sub !== payload.operator_id || typeof payload.tenant_id !== "string" || payload.tenant_id.length === 0 || payload.tenant_role !== "super-admin" && payload.tenant_role !== "tenant-admin") {
+  if (typeof protectedHeader.kid !== "string" || protectedHeader.kid.length === 0 || !Number.isInteger(payload.iat) || !Number.isInteger(payload.nbf) || !Number.isInteger(payload.exp) || payload.iat > currentSecond || lifetime <= 0 || lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS || payload.nbf !== payload.iat || payload.aud !== destination || typeof payload.jti !== "string" || payload.jti.length === 0 || payload.app_key !== EMBEDDED_ADMIN_APP_KEY || payload.channel_id !== options.channelId || payload.dest !== destination || typeof payload.operator_id !== "string" || payload.operator_id.length === 0 || payload.sub !== payload.operator_id || typeof payload.tenant_id !== "string" || payload.tenant_id.length === 0 || !["super-admin", ...EMBEDDED_ADMIN_TENANT_ROLES].includes(
+    payload.tenant_role
+  ) || !allowedRoles.includes(payload.tenant_role)) {
     throw new Error("Embedded admin session claims are invalid.");
   }
   return payload;