@01.software/sdk 0.70.1 → 0.72.1

package/dist/embedded-admin/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/embedded-admin/server.ts","../../src/core/errors.ts","../../src/embedded-admin/index.ts"],"sourcesContent":["import {\n  createLocalJWKSet,\n  jwtVerify,\n  type JSONWebKeySet,\n  type JWTPayload,\n} from 'jose'\nimport { createValidationError } from '../core/internal/errors'\nimport {\n  EMBEDDED_ADMIN_APP_KEY,\n  EMBEDDED_ADMIN_TENANT_ROLES,\n  type EmbeddedAdminTenantRole,\n  EMBEDDED_ADMIN_SESSION_TTL_SECONDS,\n  normalizeEmbeddedAdminExactOrigin,\n} from './index'\n\nconst ALGORITHMS = ['RS256', 'ES256'] as const\nconst MAX_JWKS_BYTES = 64 * 1024\n\nexport type EmbeddedAdminRole = 'super-admin' | EmbeddedAdminTenantRole\n\nexport type EmbeddedAdminSessionClaims = JWTPayload & {\n  app_key: typeof EMBEDDED_ADMIN_APP_KEY\n  channel_id: string\n  dest: string\n  operator_id: string\n  tenant_id: string\n  tenant_role: EmbeddedAdminRole\n}\n\nexport type VerifyEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  /** Receiver-owned exact allowlist. Defaults to super-admin and tenant-admin. Never accept this from browser input. */\n  allowedRoles?: readonly EmbeddedAdminRole[]\n  channelId: string\n  consoleOrigin: string\n  destination: string\n  fetch?: typeof globalThis.fetch\n  jwks?: JSONWebKeySet\n  now?: number\n  token: string\n}\n\nexport type FetchEmbeddedAdminJwksOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  fetch?: typeof globalThis.fetch\n}\n\nfunction parseJwks(value: unknown): JSONWebKeySet {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  const keys = (value as Record<string, unknown>).keys\n  if (!Array.isArray(keys) || keys.length === 0 || keys.length > 2) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  const privateMembers = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k']\n  for (const key of keys) {\n    if (!key || typeof key !== 'object' || Array.isArray(key)) {\n      throw new Error('Embedded admin JWKS is invalid.')\n    }\n    const record = key as Record<string, unknown>\n    if (\n      typeof record.kid !== 'string' ||\n      record.kid.length === 0 ||\n      privateMembers.some((member) => member in record)\n    ) {\n      throw new Error('Embedded admin JWKS is invalid.')\n    }\n  }\n  return { keys: keys as JSONWebKeySet['keys'] }\n}\n\nexport async function fetchEmbeddedAdminJwks(\n  consoleOrigin: string,\n  options: FetchEmbeddedAdminJwksOptions = {},\n): Promise<JSONWebKeySet> {\n  const issuer = normalizeEmbeddedAdminExactOrigin(consoleOrigin, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  if (!issuer) {\n    throw createValidationError('consoleOrigin must be one exact origin.')\n  }\n\n  const response = await (options.fetch ?? globalThis.fetch)(\n    new URL('/api/embedded-admin', issuer),\n    { cache: 'no-store', headers: { Accept: 'application/json' } },\n  )\n  if (!response.ok) throw new Error('Embedded admin JWKS is unavailable.')\n  const text = await response.text()\n  if (new TextEncoder().encode(text).byteLength > MAX_JWKS_BYTES) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  return parseJwks(JSON.parse(text) as unknown)\n}\n\n/** Verifies the Console assertion before the receiver establishes an app session. */\nexport async function verifyEmbeddedAdminSession(\n  options: VerifyEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionClaims> {\n  const allowedRoles = options.allowedRoles ?? ['super-admin', 'tenant-admin']\n  if (\n    !Array.isArray(allowedRoles) ||\n    allowedRoles.some(\n      (role) => !['super-admin', ...EMBEDDED_ADMIN_TENANT_ROLES].includes(role),\n    )\n  ) {\n    throw createValidationError(\n      'Embedded admin receiver allowedRoles is invalid.',\n    )\n  }\n  const issuer = normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  const destination = normalizeEmbeddedAdminExactOrigin(options.destination, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  if (!issuer || !destination) {\n    throw createValidationError(\n      'consoleOrigin and destination must be exact origins.',\n    )\n  }\n  if (\n    typeof options.channelId !== 'string' ||\n    options.channelId.length < 16 ||\n    options.channelId.length > 128 ||\n    typeof options.token !== 'string' ||\n    options.token.length === 0\n  ) {\n    throw createValidationError('Embedded admin session input is invalid.')\n  }\n\n  const jwks = options.jwks\n    ? parseJwks(options.jwks)\n    : await fetchEmbeddedAdminJwks(issuer, {\n        allowLoopbackHttp: options.allowLoopbackHttp,\n        fetch: options.fetch,\n      })\n  const currentSecond = options.now ?? Math.floor(Date.now() / 1000)\n  const { payload, protectedHeader } = await jwtVerify(\n    options.token,\n    createLocalJWKSet(jwks),\n    {\n      algorithms: [...ALGORITHMS],\n      audience: destination,\n      clockTolerance: 0,\n      currentDate: new Date(currentSecond * 1000),\n      issuer,\n      requiredClaims: ['iat', 'nbf', 'exp', 'jti', 'sub'],\n    },\n  )\n\n  const lifetime =\n    typeof payload.exp === 'number' && typeof payload.iat === 'number'\n      ? payload.exp - payload.iat\n      : Number.POSITIVE_INFINITY\n  if (\n    typeof protectedHeader.kid !== 'string' ||\n    protectedHeader.kid.length === 0 ||\n    !Number.isInteger(payload.iat) ||\n    !Number.isInteger(payload.nbf) ||\n    !Number.isInteger(payload.exp) ||\n    (payload.iat as number) > currentSecond ||\n    lifetime <= 0 ||\n    lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS ||\n    payload.nbf !== payload.iat ||\n    payload.aud !== destination ||\n    typeof payload.jti !== 'string' ||\n    payload.jti.length === 0 ||\n    payload.app_key !== EMBEDDED_ADMIN_APP_KEY ||\n    payload.channel_id !== options.channelId ||\n    payload.dest !== destination ||\n    typeof payload.operator_id !== 'string' ||\n    payload.operator_id.length === 0 ||\n    payload.sub !== payload.operator_id ||\n    typeof payload.tenant_id !== 'string' ||\n    payload.tenant_id.length === 0 ||\n    !['super-admin', ...EMBEDDED_ADMIN_TENANT_ROLES].includes(\n      payload.tenant_role as string,\n    ) ||\n    !allowedRoles.includes(payload.tenant_role as EmbeddedAdminRole)\n  ) {\n    throw new Error('Embedded admin session claims are invalid.')\n  }\n\n  return payload as EmbeddedAdminSessionClaims\n}\n","const SDK_ERROR_BRAND = Symbol.for('@01.software/sdk/SDKError')\nconst SDK_ERROR_TYPE_BRAND = Symbol.for('@01.software/sdk/SDKError.type')\n\ntype SDKErrorType =\n  | 'NetworkError'\n  | 'ValidationError'\n  | 'ApiError'\n  | 'ConfigError'\n  | 'TimeoutError'\n  | 'GoneError'\n  | 'ServiceUnavailableError'\n  | 'UsageLimitError'\n  | 'AuthError'\n  | 'PermissionError'\n  | 'NotFoundError'\n  | 'ConflictError'\n  | 'RateLimitError'\n\nfunction defineSDKErrorBrand(error: SDKError): void {\n  Object.defineProperty(error, SDK_ERROR_BRAND, {\n    value: true,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nfunction defineSDKErrorType(error: SDKError, type: SDKErrorType): void {\n  Object.defineProperty(error, SDK_ERROR_TYPE_BRAND, {\n    value: type,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nexport class SDKError extends Error {\n  readonly code: string\n  readonly status?: number\n  readonly details?: unknown\n  readonly userMessage?: string\n  readonly suggestion?: string\n  readonly requestId?: string\n  readonly kind?: 'commerce'\n  readonly reason?: CommerceErrorCode | 'unknown_commerce_error'\n  readonly rawReason?: string\n  /** Machine-readable reason from a non-commerce API response. */\n  readonly apiReason?: string\n  readonly retryable?: boolean\n  readonly retryAfter?: number\n\n  constructor(\n    code: string,\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(message)\n    this.name = 'SDKError'\n    this.code = code\n    this.status = status\n    this.details = details\n    this.userMessage = userMessage\n    this.suggestion = suggestion\n    this.requestId = requestId\n    defineSDKErrorBrand(this)\n\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, new.target)\n    }\n  }\n\n  getUserMessage(): string {\n    return this.userMessage || this.message\n  }\n\n  toJSON() {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      details: this.details,\n      userMessage: this.userMessage,\n      suggestion: this.suggestion,\n      ...(this.requestId !== undefined && { requestId: this.requestId }),\n      ...(this.kind !== undefined && { kind: this.kind }),\n      ...(this.reason !== undefined && { reason: this.reason }),\n      ...(this.rawReason !== undefined && { rawReason: this.rawReason }),\n      ...(this.apiReason !== undefined && { apiReason: this.apiReason }),\n      ...(this.retryable !== undefined && { retryable: this.retryable }),\n      ...(this.retryAfter !== undefined && { retryAfter: this.retryAfter }),\n    }\n  }\n}\n\n/**\n * Canonical Cart/Checkout/PaymentSession error reasons. This public SDK mirror\n * intentionally does not import the private contracts package; parity is\n * enforced by a type test.\n */\nexport const COMMERCE_ERROR_CODES = [\n  'validation_failed',\n  'bad_request',\n  'unauthorized',\n  'forbidden',\n  'account_suspended',\n  'key_invalid',\n  'pat_tenant_header_forbidden',\n  'tenant_mismatch',\n  'test_tenant_expired',\n  'token_invalid',\n  'token_expired',\n  'origin_not_allowed',\n  'server_credentials_required',\n  'role_denied',\n  'scope_denied',\n  'feature_disabled',\n  'not_found',\n  'conflict',\n  'locked',\n  'cart_revision_conflict',\n  'rate_limit_exceeded',\n  'usage_limit_exceeded',\n  'service_unavailable',\n  'idempotency_conflict',\n  'idempotency_in_progress',\n  'idempotency_key_required',\n  'invalid_idempotency_key',\n  'cart_not_active',\n  'cart_locked',\n  'cart_empty',\n  'cart_market_unavailable',\n  'cart_market_mismatch',\n  'checkout_not_open',\n  'checkout_already_open',\n  'payment_slot_held',\n  'reservation_expired',\n  'payment_session_not_cancelable',\n  'payment_session_conflict',\n  'provider_identity_mismatch',\n  'managed_refund_attestation_forbidden',\n  'payment_method_unavailable',\n  'provider_unavailable',\n  'lock_timeout',\n  'price_changed',\n  'pricing_fact_in_use',\n  'insufficient_stock',\n  'reservation_conflict',\n  'stock_lock_unavailable',\n  'variant_not_found',\n  'variant_stock_write_failed',\n  'stock_invariant_violation',\n  'payment_confirmation_in_flight',\n  'checkout_reservation_release_requires_transaction',\n  'admission_metadata_invalid',\n  'admission_metadata_required',\n  'admission_not_eligible',\n  'admission_eligibility_unavailable',\n  'admission_authority_unavailable',\n  'admission_customer_binding_required',\n  'admission_eligibility_unproven',\n  'capacity_exceeded',\n  'admission_required',\n  'occurrence_lock_unavailable',\n  'occurrence_not_open',\n  'admission_type_capacity_exceeded',\n  'admission_type_occurrence_mismatch',\n  'admission_hold_expired',\n  'admission_hold_checkout_item_conflict',\n  'admission_hold_checkout_conflict',\n  'admission_hold_quantity_mismatch',\n  'admission_hold_unbound',\n  'admission_hold_missing',\n  'admission_hold_checkout_item_missing',\n  'admission_hold_expiry_failed',\n  'admission_hold_expiry_requires_transaction',\n  'admission_hold_line_item_mismatch',\n  'admission_materialization_failed',\n  'variant_inactive',\n  'variant_product_mismatch',\n  'product_not_public',\n  'product_not_eligible',\n  'purchase_limit_exceeded',\n  'market_not_found',\n  'market_shipping_currency_unsupported',\n  'missing_market_rate',\n  'missing_shipping_amount',\n  'no_enabled_payment_provider',\n  'product_market_unavailable',\n  'unsupported_currency',\n  'missing_price_row',\n  'payment_provider_currency_unsupported',\n  'discount_code_not_found',\n  'discount_not_started',\n  'discount_expired',\n  'discount_usage_limit',\n  'discount_per_customer_limit',\n  'discount_customer_required',\n  'discount_first_order_only',\n  'discount_customer_not_eligible',\n  'discount_customer_excluded',\n  'discount_items_required',\n  'discount_product_not_eligible',\n  'discount_product_excluded',\n  'discount_min_order_amount',\n  'discount_currency_scope_required',\n  'discount_allocation_method_unsupported',\n  'currency_mismatch',\n  'customer_token_required',\n  'market_required',\n  'server_derived',\n  'internal_error',\n] as const\n\nexport type CommerceErrorCode = (typeof COMMERCE_ERROR_CODES)[number]\n\ntype CommerceSDKErrorBase = SDKError & {\n  readonly kind: 'commerce'\n  readonly requestId: string\n  readonly retryable: boolean\n  readonly retryAfter?: number\n  readonly details?: Record<string, unknown>\n}\n\nexport type CommerceSDKError = CommerceSDKErrorBase &\n  (\n    | { readonly reason: CommerceErrorCode; readonly rawReason?: never }\n    | {\n        readonly reason: 'unknown_commerce_error'\n        readonly rawReason: string\n      }\n  )\n\nconst COMMERCE_ERROR_CODE_SET: ReadonlySet<string> = new Set(\n  COMMERCE_ERROR_CODES,\n)\nconst COMMERCE_ERROR_ENVELOPE_KEYS = new Set([\n  'error',\n  'reason',\n  'requestId',\n  'retryable',\n  'details',\n])\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nexport type CommerceErrorEnvelope = {\n  error: string\n  reason: string\n  requestId: string\n  retryable: boolean\n  details?: Record<string, unknown>\n}\n\nfunction commerceProtocolError(\n  issue: string,\n  trustedRequestId?: string,\n): SDKError {\n  return createApiError(\n    'Invalid canonical commerce error response.',\n    502,\n    { protocol: 'commerce-error-envelope', issue },\n    'The server returned an incompatible commerce error response.',\n    'Verify that the Console commerce contract is deployed before using this SDK version.',\n    trustedRequestId,\n  )\n}\n\n/** @internal Strictly parse a canonical commerce error without retaining its raw body. */\nexport function parseCommerceErrorEnvelope(\n  body: unknown,\n  headerRequestId?: string,\n): CommerceErrorEnvelope {\n  if (headerRequestId === undefined) {\n    throw commerceProtocolError('missing_request_id_header')\n  }\n  if (headerRequestId.length === 0) {\n    throw commerceProtocolError('empty_request_id_header')\n  }\n  if (!isPlainRecord(body)) {\n    throw commerceProtocolError('expected_object', headerRequestId)\n  }\n  if (Object.keys(body).some((key) => !COMMERCE_ERROR_ENVELOPE_KEYS.has(key))) {\n    throw commerceProtocolError('unexpected_field', headerRequestId)\n  }\n  if (\n    typeof body.error !== 'string' ||\n    body.error.length === 0 ||\n    typeof body.reason !== 'string' ||\n    body.reason.length === 0 ||\n    typeof body.requestId !== 'string' ||\n    body.requestId.length === 0 ||\n    (body.retryable !== undefined && typeof body.retryable !== 'boolean') ||\n    (body.details !== undefined && !isPlainRecord(body.details))\n  ) {\n    throw commerceProtocolError('invalid_field', headerRequestId)\n  }\n\n  if (headerRequestId !== undefined && headerRequestId !== body.requestId) {\n    throw commerceProtocolError('request_id_mismatch', headerRequestId)\n  }\n\n  return {\n    error: body.error,\n    reason: body.reason,\n    requestId: body.requestId,\n    retryable: body.retryable === true,\n    ...(body.details === undefined ? {} : { details: body.details }),\n  }\n}\n\n/** @internal Validate and apply the canonical commerce error envelope. */\nexport function enhanceCommerceError(\n  error: SDKError,\n  body: unknown,\n  headerRequestId?: string,\n): SDKError {\n  const envelope = parseCommerceErrorEnvelope(body, headerRequestId)\n\n  const known = COMMERCE_ERROR_CODE_SET.has(envelope.reason)\n  Object.assign(error, {\n    code: envelope.reason,\n    kind: 'commerce' as const,\n    reason: known\n      ? (envelope.reason as CommerceErrorCode)\n      : 'unknown_commerce_error',\n    ...(known ? {} : { rawReason: envelope.reason }),\n    requestId: envelope.requestId,\n    retryable: envelope.retryable,\n    details: envelope.details,\n  })\n  return error\n}\n\n/** @internal Apply a non-commerce reason without canonical-commerce validation. */\nexport function enhanceNonCommerceError(\n  error: SDKError,\n  reason: unknown,\n): SDKError {\n  if (typeof reason === 'string') Object.assign(error, { apiReason: reason })\n  return error\n}\n\n/**\n * Read the server-provided machine reason across strict commerce and\n * non-commerce SDK errors. Unknown commerce reasons are returned verbatim.\n */\nexport function getSDKErrorReason(error: SDKError): string | undefined {\n  if (error.kind !== 'commerce') return error.apiReason\n  return error.reason === 'unknown_commerce_error'\n    ? error.rawReason\n    : error.reason\n}\n\nexport function isCommerceSDKError(error: unknown): error is CommerceSDKError {\n  if (!isSDKError(error) || error.kind !== 'commerce') return false\n  if (\n    typeof error.requestId !== 'string' ||\n    typeof error.retryable !== 'boolean' ||\n    (error.retryAfter !== undefined &&\n      (!Number.isSafeInteger(error.retryAfter) || error.retryAfter < 0)) ||\n    typeof error.reason !== 'string'\n  ) {\n    return false\n  }\n  return error.reason === 'unknown_commerce_error'\n    ? typeof error.rawReason === 'string'\n    : COMMERCE_ERROR_CODE_SET.has(error.reason) && error.rawReason === undefined\n}\n\nexport class NetworkError extends SDKError {\n  constructor(\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('NETWORK_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'NetworkError'\n    defineSDKErrorType(this, 'NetworkError')\n  }\n}\n\nexport class ValidationError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    status = 400,\n  ) {\n    super('VALIDATION_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'ValidationError'\n    defineSDKErrorType(this, 'ValidationError')\n  }\n}\n\nexport class ApiError extends SDKError {\n  constructor(\n    message: string,\n    status: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'API_ERROR',\n      message,\n      status,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'ApiError'\n    defineSDKErrorType(this, 'ApiError')\n  }\n}\n\nexport class ConfigError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('CONFIG_ERROR', message, undefined, details, userMessage, suggestion)\n    this.name = 'ConfigError'\n    defineSDKErrorType(this, 'ConfigError')\n  }\n}\n\nexport class TimeoutError extends SDKError {\n  constructor(\n    message = 'Request timed out.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('TIMEOUT_ERROR', message, 408, details, userMessage, suggestion)\n    this.name = 'TimeoutError'\n    defineSDKErrorType(this, 'TimeoutError')\n  }\n}\n\nexport class GoneError extends SDKError {\n  constructor(\n    message = 'The requested resource is no longer available.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('GONE_ERROR', message, 410, details, userMessage, suggestion)\n    this.name = 'GoneError'\n    defineSDKErrorType(this, 'GoneError')\n  }\n}\n\nexport class ServiceUnavailableError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message = 'Service temporarily unavailable.',\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super(\n      'SERVICE_UNAVAILABLE_ERROR',\n      message,\n      503,\n      details,\n      userMessage,\n      suggestion,\n    )\n    this.name = 'ServiceUnavailableError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'ServiceUnavailableError')\n  }\n}\n\nexport class UsageLimitError extends SDKError {\n  readonly usage: { limit: number; current: number; remaining: number }\n\n  constructor(\n    message: string,\n    usage: { limit: number; current: number; remaining: number },\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('USAGE_LIMIT_ERROR', message, 429, details, userMessage, suggestion)\n    this.name = 'UsageLimitError'\n    this.usage = usage\n    defineSDKErrorType(this, 'UsageLimitError')\n  }\n\n  toJSON() {\n    return {\n      ...super.toJSON(),\n      usage: this.usage,\n    }\n  }\n}\n\nexport class AuthError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'auth_error',\n      message,\n      401,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'AuthError'\n    defineSDKErrorType(this, 'AuthError')\n  }\n}\n\nexport class PermissionError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'permission_error',\n      message,\n      403,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'PermissionError'\n    defineSDKErrorType(this, 'PermissionError')\n  }\n}\n\nexport class NotFoundError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'not_found',\n      message,\n      404,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'NotFoundError'\n    defineSDKErrorType(this, 'NotFoundError')\n  }\n}\n\nexport class ConflictError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super('conflict', message, 409, details, userMessage, suggestion, requestId)\n    this.name = 'ConflictError'\n    defineSDKErrorType(this, 'ConflictError')\n  }\n}\n\nexport class RateLimitError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message: string,\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'rate_limit_exceeded',\n      message,\n      429,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'RateLimitError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'RateLimitError')\n  }\n}\n\nfunction hasBrandedSDKErrorShape(error: unknown): error is SDKError {\n  if (error === null || typeof error !== 'object') return false\n\n  const candidate = error as Record<PropertyKey, unknown>\n  return (\n    candidate[SDK_ERROR_BRAND] === true &&\n    typeof candidate.name === 'string' &&\n    typeof candidate.code === 'string' &&\n    typeof candidate.message === 'string' &&\n    (candidate.status === undefined || typeof candidate.status === 'number') &&\n    (candidate.userMessage === undefined ||\n      typeof candidate.userMessage === 'string') &&\n    (candidate.suggestion === undefined ||\n      typeof candidate.suggestion === 'string') &&\n    (candidate.requestId === undefined ||\n      typeof candidate.requestId === 'string') &&\n    (candidate.kind === undefined || candidate.kind === 'commerce') &&\n    (candidate.reason === undefined || typeof candidate.reason === 'string') &&\n    (candidate.rawReason === undefined ||\n      typeof candidate.rawReason === 'string') &&\n    (candidate.apiReason === undefined ||\n      typeof candidate.apiReason === 'string') &&\n    (candidate.retryable === undefined ||\n      typeof candidate.retryable === 'boolean') &&\n    (candidate.retryAfter === undefined ||\n      typeof candidate.retryAfter === 'number') &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nfunction hasSDKErrorType(error: unknown, type: SDKErrorType): boolean {\n  return (\n    hasBrandedSDKErrorShape(error) &&\n    (error as unknown as Record<PropertyKey, unknown>)[SDK_ERROR_TYPE_BRAND] ===\n      type\n  )\n}\n\nexport function isSDKError(error: unknown): error is SDKError {\n  return error instanceof SDKError || hasBrandedSDKErrorShape(error)\n}\n\nexport function isNetworkError(error: unknown): error is NetworkError {\n  return error instanceof NetworkError || hasSDKErrorType(error, 'NetworkError')\n}\n\nexport function isValidationError(error: unknown): error is ValidationError {\n  if (\n    error instanceof ValidationError ||\n    hasSDKErrorType(error, 'ValidationError')\n  ) {\n    return true\n  }\n  if (error == null || typeof error !== 'object') return false\n\n  const candidate = error as {\n    code?: unknown\n    name?: unknown\n    message?: unknown\n    getUserMessage?: unknown\n    toJSON?: unknown\n  }\n  return (\n    candidate.name === 'ValidationError' &&\n    candidate.code === 'VALIDATION_ERROR' &&\n    typeof candidate.message === 'string' &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nexport function isApiError(error: unknown): error is ApiError {\n  return error instanceof ApiError || hasSDKErrorType(error, 'ApiError')\n}\n\nexport function isConfigError(error: unknown): error is ConfigError {\n  return error instanceof ConfigError || hasSDKErrorType(error, 'ConfigError')\n}\n\nexport function isTimeoutError(error: unknown): error is TimeoutError {\n  return error instanceof TimeoutError || hasSDKErrorType(error, 'TimeoutError')\n}\n\nexport function isGoneError(error: unknown): error is GoneError {\n  return error instanceof GoneError || hasSDKErrorType(error, 'GoneError')\n}\n\nexport function isServiceUnavailableError(\n  error: unknown,\n): error is ServiceUnavailableError {\n  return (\n    error instanceof ServiceUnavailableError ||\n    hasSDKErrorType(error, 'ServiceUnavailableError')\n  )\n}\n\nexport function isUsageLimitError(error: unknown): error is UsageLimitError {\n  return (\n    error instanceof UsageLimitError ||\n    hasSDKErrorType(error, 'UsageLimitError')\n  )\n}\n\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError || hasSDKErrorType(error, 'AuthError')\n}\n\nexport function isPermissionError(error: unknown): error is PermissionError {\n  return (\n    error instanceof PermissionError ||\n    hasSDKErrorType(error, 'PermissionError')\n  )\n}\n\nexport function isNotFoundError(error: unknown): error is NotFoundError {\n  return (\n    error instanceof NotFoundError || hasSDKErrorType(error, 'NotFoundError')\n  )\n}\n\nexport function isConflictError(error: unknown): error is ConflictError {\n  return (\n    error instanceof ConflictError || hasSDKErrorType(error, 'ConflictError')\n  )\n}\n\nexport function isRateLimitError(error: unknown): error is RateLimitError {\n  return (\n    error instanceof RateLimitError || hasSDKErrorType(error, 'RateLimitError')\n  )\n}\n\nexport const createNetworkError = (\n  message: string,\n  status?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new NetworkError(message, status, details, userMessage, suggestion)\n\nexport const createValidationError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  status?: number,\n) => new ValidationError(message, details, userMessage, suggestion, status)\n\nexport const createApiError = (\n  message: string,\n  status: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ApiError(message, status, details, userMessage, suggestion, requestId)\n\nexport const createConfigError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new ConfigError(message, details, userMessage, suggestion)\n\nexport const createTimeoutError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new TimeoutError(message, details, userMessage, suggestion)\n\nexport const createGoneError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new GoneError(message, details, userMessage, suggestion)\n\nexport const createServiceUnavailableError = (\n  message?: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) =>\n  new ServiceUnavailableError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n  )\n\nexport const createUsageLimitError = (\n  message: string,\n  usage: { limit: number; current: number; remaining: number },\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new UsageLimitError(message, usage, details, userMessage, suggestion)\n\nexport const createAuthError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new AuthError(message, details, userMessage, suggestion, requestId)\n\nexport const createPermissionError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new PermissionError(message, details, userMessage, suggestion, requestId)\n\nexport const createNotFoundError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new NotFoundError(message, details, userMessage, suggestion, requestId)\n\nexport const createConflictError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ConflictError(message, details, userMessage, suggestion, requestId)\n\nexport const createRateLimitError = (\n  message: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) =>\n  new RateLimitError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n    requestId,\n  )\n","import { createValidationError } from '../core/internal/errors'\n\nexport const EMBEDDED_ADMIN_PROTOCOL_VERSION = 1 as const\nexport const EMBEDDED_ADMIN_CHALLENGE_MESSAGE =\n  '01.embedded-admin.challenge' as const\nexport const EMBEDDED_ADMIN_READY_MESSAGE = '01.embedded-admin.ready' as const\nexport const EMBEDDED_ADMIN_SESSION_MESSAGE =\n  '01.embedded-admin.session' as const\nexport const EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60 as const\nexport const EMBEDDED_ADMIN_APP_KEY = 'primary' as const\n\nconst DEFAULT_RECEIVER_TIMEOUT_MS = 35_000\nconst MAX_RECEIVER_TIMEOUT_MS = 120_000\nconst MAX_LABEL_LENGTH = 80\nconst MAX_PATH_LENGTH = 512\n\nexport type EmbeddedAdminChallengeMessage = {\n  type: typeof EMBEDDED_ADMIN_CHALLENGE_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminReadyMessage = {\n  type: typeof EMBEDDED_ADMIN_READY_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminSessionMessage = {\n  type: typeof EMBEDDED_ADMIN_SESSION_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n  token: string\n}\n\n/** Exact execution roles; this list grants no platform data permissions. */\nexport const EMBEDDED_ADMIN_TENANT_ROLES = [\n  'tenant-admin',\n  'tenant-editor',\n  'tenant-viewer',\n] as const\nexport type EmbeddedAdminTenantRole =\n  (typeof EMBEDDED_ADMIN_TENANT_ROLES)[number]\n\n/** Missing legacy settings retain administrator-only execution; invalid settings fail closed. */\nexport function normalizeEmbeddedAdminAllowedRoles(\n  value: unknown,\n): EmbeddedAdminTenantRole[] | null {\n  if (value === undefined || value === null) return ['tenant-admin']\n  if (\n    !Array.isArray(value) ||\n    value.some((role) => !EMBEDDED_ADMIN_TENANT_ROLES.includes(role))\n  )\n    return null\n  return EMBEDDED_ADMIN_TENANT_ROLES.filter((role) => value.includes(role))\n}\n\nexport type EmbeddedAdminBindingConfiguration = {\n  allowedRoles?: EmbeddedAdminTenantRole[]\n  enabled: boolean\n  label: string\n  origin: string\n  path: string\n}\n\nexport type EmbeddedAdminSessionReceipt = {\n  requestId: string\n  token: string\n}\n\nexport type ReceiveEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  /** Exact Console origin configured by the receiver deployment. */\n  consoleOrigin: string\n  /** Cancels the one-shot receiver and closes every transferred port. */\n  signal?: AbortSignal\n  /** Defaults to 35 seconds and is capped at 120 seconds. */\n  timeoutMs?: number\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n  )\n}\n\nexport function normalizeEmbeddedAdminExactOrigin(\n  value: unknown,\n  options: { allowLoopbackHttp?: boolean } = {},\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (!trimmed || trimmed.length > 2048) return null\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed)\n  } catch {\n    return null\n  }\n\n  const allowedProtocol =\n    parsed.protocol === 'https:' ||\n    (options.allowLoopbackHttp === true &&\n      parsed.protocol === 'http:' &&\n      isLoopbackHostname(parsed.hostname))\n  if (!allowedProtocol || parsed.hostname.includes('*')) return null\n  if (parsed.username || parsed.password || parsed.search || parsed.hash) {\n    return null\n  }\n  if (parsed.pathname !== '/' || trimmed.endsWith('/')) return null\n\n  return parsed.origin\n}\n\nexport function normalizeEmbeddedAdminRelativePath(\n  value: unknown,\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (\n    !trimmed.startsWith('/') ||\n    trimmed.startsWith('//') ||\n    trimmed.length > MAX_PATH_LENGTH\n  ) {\n    return null\n  }\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed, 'https://embedded.invalid')\n  } catch {\n    return null\n  }\n\n  if (\n    parsed.origin !== 'https://embedded.invalid' ||\n    parsed.pathname.startsWith('//') ||\n    parsed.search ||\n    parsed.hash ||\n    parsed.username ||\n    parsed.password\n  ) {\n    return null\n  }\n\n  return parsed.pathname\n}\n\nexport function normalizeEmbeddedAdminBindingConfiguration(\n  value: unknown,\n  options: {\n    allowLoopbackConsoleHttp?: boolean\n    consoleOrigin?: string\n  } = {},\n): EmbeddedAdminBindingConfiguration {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw createValidationError('Embedded admin binding must be an object.')\n  }\n\n  const input = value as Record<string, unknown>\n  const allowedRoles = normalizeEmbeddedAdminAllowedRoles(input.allowedRoles)\n  if (!allowedRoles)\n    throw createValidationError(\n      'Embedded admin allowedRoles must contain only tenant execution roles.',\n    )\n  const label = typeof input.label === 'string' ? input.label.trim() : ''\n  const origin = normalizeEmbeddedAdminExactOrigin(input.origin)\n  const path = normalizeEmbeddedAdminRelativePath(input.path)\n  const consoleOrigin = options.consoleOrigin\n    ? normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n        allowLoopbackHttp: options.allowLoopbackConsoleHttp === true,\n      })\n    : null\n\n  if (!label || label.length > MAX_LABEL_LENGTH) {\n    throw createValidationError(\n      `Embedded admin label must be between 1 and ${MAX_LABEL_LENGTH} characters.`,\n    )\n  }\n  if (!origin) {\n    throw createValidationError(\n      'Embedded admin origin must be an exact HTTPS origin without a path, query, fragment, wildcard, or credentials.',\n    )\n  }\n  if (!path) {\n    throw createValidationError(\n      'Embedded admin path must begin with / and must not include a query or fragment.',\n    )\n  }\n  if (consoleOrigin && origin === consoleOrigin) {\n    throw createValidationError(\n      'Embedded admin origin must be different from the Console origin.',\n    )\n  }\n\n  return {\n    allowedRoles,\n    enabled: input.enabled !== false,\n    label,\n    origin,\n    path,\n  }\n}\n\nexport function isEmbeddedAdminChallengeMessage(\n  value: unknown,\n): value is EmbeddedAdminChallengeMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_CHALLENGE_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminReadyMessage(\n  value: unknown,\n): value is EmbeddedAdminReadyMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_READY_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminSessionMessage(\n  value: unknown,\n): value is EmbeddedAdminSessionMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_SESSION_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128 &&\n    typeof message.token === 'string' &&\n    message.token.length > 0\n  )\n}\n\n/**\n * Receives one Console assertion through the exact parent/origin challenge\n * channel. Forward the returned token immediately to the receiver backend;\n * never persist, log, decode, or use it as Console API authority in-browser.\n */\nexport function receiveEmbeddedAdminSession(\n  options: ReceiveEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionReceipt> {\n  if (typeof window === 'undefined' || window.parent === window) {\n    return Promise.reject(\n      createValidationError(\n        'receiveEmbeddedAdminSession must run inside an embedded browser frame.',\n      ),\n    )\n  }\n\n  const consoleOrigin = normalizeEmbeddedAdminExactOrigin(\n    options.consoleOrigin,\n    { allowLoopbackHttp: options.allowLoopbackHttp === true },\n  )\n  if (!consoleOrigin) {\n    return Promise.reject(\n      createValidationError('consoleOrigin must be one exact HTTPS origin.'),\n    )\n  }\n\n  const timeoutMs = options.timeoutMs ?? DEFAULT_RECEIVER_TIMEOUT_MS\n  if (\n    !Number.isInteger(timeoutMs) ||\n    timeoutMs <= 0 ||\n    timeoutMs > MAX_RECEIVER_TIMEOUT_MS\n  ) {\n    return Promise.reject(\n      createValidationError(\n        `timeoutMs must be an integer between 1 and ${MAX_RECEIVER_TIMEOUT_MS}.`,\n      ),\n    )\n  }\n\n  return new Promise((resolve, reject) => {\n    const ports = new Set<MessagePort>()\n    let settled = false\n\n    const closePorts = () => {\n      for (const port of ports) port.close()\n      ports.clear()\n    }\n    const cleanup = () => {\n      window.removeEventListener('message', acceptChallenge)\n      options.signal?.removeEventListener('abort', abort)\n      clearTimeout(timer)\n      closePorts()\n    }\n    const finish = (receipt: EmbeddedAdminSessionReceipt) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      resolve(receipt)\n    }\n    const fail = (error: Error) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      reject(error)\n    }\n    const abort = () =>\n      fail(new Error('Embedded admin session receipt aborted.'))\n    const acceptSession = (\n      event: MessageEvent<unknown>,\n      expectedRequestId: string,\n    ) => {\n      if (\n        !isEmbeddedAdminSessionMessage(event.data) ||\n        event.data.requestId !== expectedRequestId\n      ) {\n        return\n      }\n      finish({ requestId: event.data.requestId, token: event.data.token })\n    }\n    const acceptChallenge = (event: MessageEvent<unknown>) => {\n      if (\n        event.source !== window.parent ||\n        event.origin !== consoleOrigin ||\n        !isEmbeddedAdminChallengeMessage(event.data) ||\n        event.ports.length !== 1\n      ) {\n        for (const port of event.ports) port.close()\n        return\n      }\n\n      const port = event.ports[0]!\n      const requestId = event.data.requestId\n      ports.add(port)\n      port.addEventListener('message', (message) => {\n        acceptSession(message, requestId)\n      })\n      port.start()\n      port.postMessage({\n        type: EMBEDDED_ADMIN_READY_MESSAGE,\n        version: EMBEDDED_ADMIN_PROTOCOL_VERSION,\n        requestId,\n      } satisfies EmbeddedAdminReadyMessage)\n    }\n\n    const timer = setTimeout(() => {\n      fail(new Error('Timed out waiting for an embedded admin session.'))\n    }, timeoutMs)\n\n    if (options.signal?.aborted) {\n      abort()\n      return\n    }\n    options.signal?.addEventListener('abort', abort, { once: true })\n    window.addEventListener('message', acceptChallenge)\n  })\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;;;ACLP,IAAM,kBAAkB,uBAAO,IAAI,2BAA2B;AAC9D,IAAM,uBAAuB,uBAAO,IAAI,gCAAgC;AAiBxE,SAAS,oBAAoB,OAAuB;AAClD,SAAO,eAAe,OAAO,iBAAiB;AAAA,IAC5C,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAiB,MAA0B;AACrE,SAAO,eAAe,OAAO,sBAAsB;AAAA,IACjD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAelC,YACE,MACA,SACA,QACA,SACA,aACA,YACA,WACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,aAAa;AAClB,SAAK,YAAY;AACjB,wBAAoB,IAAI;AAExB,QAAI,MAAM,mBAAmB;AAC3B,YAAM,kBAAkB,MAAM,UAAU;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,iBAAyB;AACvB,WAAO,KAAK,eAAe,KAAK;AAAA,EAClC;AAAA,EAEA,SAAS;AACP,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,YAAY,KAAK;AAAA,MACjB,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,SAAS,UAAa,EAAE,MAAM,KAAK,KAAK;AAAA,MACjD,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;AAAA,MACvD,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,eAAe,UAAa,EAAE,YAAY,KAAK,WAAW;AAAA,IACrE;AAAA,EACF;AACF;AAOO,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqBA,IAAM,0BAA+C,IAAI;AAAA,EACvD;AACF;AAuJO,IAAM,kBAAN,cAA8B,SAAS;AAAA,EAC5C,YACE,SACA,SACA,aACA,YACA,SAAS,KACT;AACA,UAAM,oBAAoB,SAAS,QAAQ,SAAS,aAAa,UAAU;AAC3E,SAAK,OAAO;AACZ,uBAAmB,MAAM,iBAAiB;AAAA,EAC5C;AACF;AAuWO,IAAM,wBAAwB,CACnC,SACA,SACA,aACA,YACA,WACG,IAAI,gBAAgB,SAAS,SAAS,aAAa,YAAY,MAAM;;;ACvvBnE,IAAM,qCAAqC;AAC3C,IAAM,yBAAyB;AA2B/B,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AACF;AAyCA,SAAS,mBAAmB,UAA2B;AACrD,SACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEO,SAAS,kCACd,OACA,UAA2C,CAAC,GAC7B;AACf,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,QAAQ,SAAS,KAAM,QAAO;AAE9C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,OAAO;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,kBACJ,OAAO,aAAa,YACnB,QAAQ,sBAAsB,QAC7B,OAAO,aAAa,WACpB,mBAAmB,OAAO,QAAQ;AACtC,MAAI,CAAC,mBAAmB,OAAO,SAAS,SAAS,GAAG,EAAG,QAAO;AAC9D,MAAI,OAAO,YAAY,OAAO,YAAY,OAAO,UAAU,OAAO,MAAM;AACtE,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,OAAO,QAAQ,SAAS,GAAG,EAAG,QAAO;AAE7D,SAAO,OAAO;AAChB;;;AFnGA,IAAM,aAAa,CAAC,SAAS,OAAO;AACpC,IAAM,iBAAiB,KAAK;AAiC5B,SAAS,UAAU,OAA+B;AAChD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,OAAQ,MAAkC;AAChD,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,KAAK,KAAK,SAAS,GAAG;AAChE,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,iBAAiB,CAAC,KAAK,KAAK,KAAK,MAAM,MAAM,MAAM,OAAO,GAAG;AACnE,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACzD,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,UAAM,SAAS;AACf,QACE,OAAO,OAAO,QAAQ,YACtB,OAAO,IAAI,WAAW,KACtB,eAAe,KAAK,CAAC,WAAW,UAAU,MAAM,GAChD;AACA,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AAAA,EACF;AACA,SAAO,EAAE,KAAoC;AAC/C;AAEA,eAAsB,uBACpB,eACA,UAAyC,CAAC,GAClB;AACxB,QAAM,SAAS,kCAAkC,eAAe;AAAA,IAC9D,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,UAAM,sBAAsB,yCAAyC;AAAA,EACvE;AAEA,QAAM,WAAW,OAAO,QAAQ,SAAS,WAAW;AAAA,IAClD,IAAI,IAAI,uBAAuB,MAAM;AAAA,IACrC,EAAE,OAAO,YAAY,SAAS,EAAE,QAAQ,mBAAmB,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,qCAAqC;AACvE,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,gBAAgB;AAC9D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,SAAO,UAAU,KAAK,MAAM,IAAI,CAAY;AAC9C;AAGA,eAAsB,2BACpB,SACqC;AACrC,QAAM,eAAe,QAAQ,gBAAgB,CAAC,eAAe,cAAc;AAC3E,MACE,CAAC,MAAM,QAAQ,YAAY,KAC3B,aAAa;AAAA,IACX,CAAC,SAAS,CAAC,CAAC,eAAe,GAAG,2BAA2B,EAAE,SAAS,IAAI;AAAA,EAC1E,GACA;AACA,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,kCAAkC,QAAQ,eAAe;AAAA,IACtE,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,QAAM,cAAc,kCAAkC,QAAQ,aAAa;AAAA,IACzE,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,MAAI,CAAC,UAAU,CAAC,aAAa;AAC3B,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,MACE,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,SAAS,MAC3B,QAAQ,UAAU,SAAS,OAC3B,OAAO,QAAQ,UAAU,YACzB,QAAQ,MAAM,WAAW,GACzB;AACA,UAAM,sBAAsB,0CAA0C;AAAA,EACxE;AAEA,QAAM,OAAO,QAAQ,OACjB,UAAU,QAAQ,IAAI,IACtB,MAAM,uBAAuB,QAAQ;AAAA,IACnC,mBAAmB,QAAQ;AAAA,IAC3B,OAAO,QAAQ;AAAA,EACjB,CAAC;AACL,QAAM,gBAAgB,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACjE,QAAM,EAAE,SAAS,gBAAgB,IAAI,MAAM;AAAA,IACzC,QAAQ;AAAA,IACR,kBAAkB,IAAI;AAAA,IACtB;AAAA,MACE,YAAY,CAAC,GAAG,UAAU;AAAA,MAC1B,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,aAAa,IAAI,KAAK,gBAAgB,GAAI;AAAA,MAC1C;AAAA,MACA,gBAAgB,CAAC,OAAO,OAAO,OAAO,OAAO,KAAK;AAAA,IACpD;AAAA,EACF;AAEA,QAAM,WACJ,OAAO,QAAQ,QAAQ,YAAY,OAAO,QAAQ,QAAQ,WACtD,QAAQ,MAAM,QAAQ,MACtB,OAAO;AACb,MACE,OAAO,gBAAgB,QAAQ,YAC/B,gBAAgB,IAAI,WAAW,KAC/B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC7B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC7B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC5B,QAAQ,MAAiB,iBAC1B,YAAY,KACZ,WAAW,sCACX,QAAQ,QAAQ,QAAQ,OACxB,QAAQ,QAAQ,eAChB,OAAO,QAAQ,QAAQ,YACvB,QAAQ,IAAI,WAAW,KACvB,QAAQ,YAAY,0BACpB,QAAQ,eAAe,QAAQ,aAC/B,QAAQ,SAAS,eACjB,OAAO,QAAQ,gBAAgB,YAC/B,QAAQ,YAAY,WAAW,KAC/B,QAAQ,QAAQ,QAAQ,eACxB,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,WAAW,KAC7B,CAAC,CAAC,eAAe,GAAG,2BAA2B,EAAE;AAAA,IAC/C,QAAQ;AAAA,EACV,KACA,CAAC,aAAa,SAAS,QAAQ,WAAgC,GAC/D;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/embedded-admin/server.ts","../../src/core/errors.ts","../../src/embedded-admin/actions.ts","../../src/embedded-admin/index.ts"],"sourcesContent":["import {\n  createLocalJWKSet,\n  jwtVerify,\n  type JSONWebKeySet,\n  type JWTPayload,\n} from 'jose'\nimport { createValidationError } from '../core/internal/errors'\nimport {\n  EMBEDDED_ADMIN_APP_KEY,\n  EMBEDDED_ADMIN_TENANT_ROLES,\n  type EmbeddedAdminTenantRole,\n  EMBEDDED_ADMIN_SESSION_TTL_SECONDS,\n  EMBEDDED_ADMIN_EXECUTION_AUDIENCE_PREFIX,\n  normalizeEmbeddedAdminExactOrigin,\n  normalizeEmbeddedAdminRelativePath,\n  normalizeEmbeddedAdminExecutionContext,\n  embeddedAdminExecutionContextsEqual,\n  type EmbeddedAdminExecutionContext,\n} from './index'\n\nconst ALGORITHMS = ['RS256', 'ES256'] as const\nconst MAX_JWKS_BYTES = 64 * 1024\n\nexport type EmbeddedAdminRole = 'super-admin' | EmbeddedAdminTenantRole\n\nexport type EmbeddedAdminSessionClaims = JWTPayload & {\n  app_key: typeof EMBEDDED_ADMIN_APP_KEY\n  channel_id: string\n  dest: string\n  operator_id: string\n  tenant_id: string\n  tenant_role: EmbeddedAdminRole\n}\n\nexport type VerifyEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  /** Receiver-owned exact allowlist. Defaults to super-admin and tenant-admin. Never accept this from browser input. */\n  allowedRoles?: readonly EmbeddedAdminRole[]\n  channelId: string\n  consoleOrigin: string\n  destination: string\n  fetch?: typeof globalThis.fetch\n  jwks?: JSONWebKeySet\n  now?: number\n  token: string\n}\n\nexport type EmbeddedAdminExecutionClaims = EmbeddedAdminSessionClaims & {\n  protocol_version: 2\n  frame_url: string\n  execution_context: EmbeddedAdminExecutionContext\n}\n\nexport type VerifyEmbeddedAdminExecutionOptions = Omit<\n  VerifyEmbeddedAdminSessionOptions,\n  'now'\n> & {\n  /** Trusted integer Unix seconds; defaults to Math.floor(Date.now() / 1000). */\n  clock?: () => number\n  /** Exact URL pinned by the receiver deployment, including its configured path. */\n  frameUrl: string\n  execution: EmbeddedAdminExecutionContext\n  /**\n   * Atomically claim this identity in a shared durable store, retaining it until\n   * at least expiresAt + 60 seconds. Claim only: MUST NOT perform business\n   * effects. False, timeout, uncertain commit or failure denies execution.\n   * Business effects may start only after this verifier successfully returns;\n   * their transaction/outbox and business idempotency remain app-owned.\n   */\n  consumeExecution: (identity: {\n    issuer: string\n    tenantId: string\n    operatorId: string\n    appKey: typeof EMBEDDED_ADMIN_APP_KEY\n    executionId: string\n    expiresAt: number\n  }) => Promise<boolean>\n}\n\nexport type FetchEmbeddedAdminJwksOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  fetch?: typeof globalThis.fetch\n}\n\nfunction parseJwks(value: unknown): JSONWebKeySet {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  const keys = (value as Record<string, unknown>).keys\n  if (!Array.isArray(keys) || keys.length === 0 || keys.length > 2) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  const privateMembers = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k']\n  for (const key of keys) {\n    if (!key || typeof key !== 'object' || Array.isArray(key)) {\n      throw new Error('Embedded admin JWKS is invalid.')\n    }\n    const record = key as Record<string, unknown>\n    if (\n      typeof record.kid !== 'string' ||\n      record.kid.length === 0 ||\n      privateMembers.some((member) => member in record)\n    ) {\n      throw new Error('Embedded admin JWKS is invalid.')\n    }\n  }\n  return { keys: keys as JSONWebKeySet['keys'] }\n}\n\nexport async function fetchEmbeddedAdminJwks(\n  consoleOrigin: string,\n  options: FetchEmbeddedAdminJwksOptions = {},\n): Promise<JSONWebKeySet> {\n  const issuer = normalizeEmbeddedAdminExactOrigin(consoleOrigin, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  if (!issuer) {\n    throw createValidationError('consoleOrigin must be one exact origin.')\n  }\n\n  const response = await (options.fetch ?? globalThis.fetch)(\n    new URL('/api/embedded-admin', issuer),\n    { cache: 'no-store', headers: { Accept: 'application/json' } },\n  )\n  if (!response.ok) throw new Error('Embedded admin JWKS is unavailable.')\n  const text = await response.text()\n  if (new TextEncoder().encode(text).byteLength > MAX_JWKS_BYTES) {\n    throw new Error('Embedded admin JWKS is invalid.')\n  }\n  return parseJwks(JSON.parse(text) as unknown)\n}\n\n/** Verifies the Console assertion before the receiver establishes an app session. */\nexport async function verifyEmbeddedAdminSession(\n  options: VerifyEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionClaims> {\n  const claims = await verifySession(options)\n  if (\n    'protocol_version' in claims ||\n    'execution_context' in claims ||\n    'token_use' in claims\n  ) {\n    throw new Error('An action assertion requires execution verification.')\n  }\n  return claims\n}\n\nexport async function verifyEmbeddedAdminExecution(\n  options: VerifyEmbeddedAdminExecutionOptions,\n): Promise<EmbeddedAdminExecutionClaims> {\n  if (typeof options.consumeExecution !== 'function') {\n    throw createValidationError('A durable execution consumer is required.')\n  }\n  const clock = options.clock ?? (() => Math.floor(Date.now() / 1000))\n  const currentSecond = () => {\n    const now = clock()\n    if (!Number.isSafeInteger(now) || now < 0)\n      throw createValidationError('A trusted Unix-second clock is required.')\n    return now\n  }\n  const claims = await verifySession({ ...options, now: currentSecond() }, true)\n  const execution = normalizeEmbeddedAdminExecutionContext(\n    claims.execution_context,\n  )\n  const frame = new URL(options.frameUrl)\n  const path = normalizeEmbeddedAdminRelativePath(frame.pathname)\n  if (\n    claims.protocol_version !== 2 ||\n    !['super-admin', 'tenant-admin'].includes(claims.tenant_role) ||\n    'token_use' in claims ||\n    !path ||\n    frame.origin !== claims.dest ||\n    `${frame.origin}${path}` !== options.frameUrl ||\n    claims.frame_url !== options.frameUrl ||\n    claims.exp !== execution.expiresAt ||\n    currentSecond() >= execution.expiresAt ||\n    !embeddedAdminExecutionContextsEqual(execution, options.execution)\n  )\n    throw new Error(\n      'Embedded admin execution context does not match its assertion.',\n    )\n  // Only authenticated signed input reaches the application replay store.\n  const consumed = await options.consumeExecution({\n    issuer: claims.iss!,\n    tenantId: claims.tenant_id,\n    operatorId: claims.operator_id,\n    appKey: claims.app_key,\n    executionId: execution.executionId,\n    expiresAt: execution.expiresAt,\n  })\n  if (consumed !== true)\n    throw new Error('Embedded admin execution was already consumed.')\n  // A claim may complete after D (even after receipt GC). It grants no business\n  // approval unless a fresh trusted clock still places completion before D.\n  if (currentSecond() >= execution.expiresAt)\n    throw new Error('Embedded admin execution expired during consumption.')\n  return {\n    ...claims,\n    protocol_version: 2,\n    frame_url: options.frameUrl,\n    execution_context: execution,\n  }\n}\n\nasync function verifySession(\n  options: VerifyEmbeddedAdminSessionOptions,\n  executionPurpose = false,\n): Promise<EmbeddedAdminSessionClaims> {\n  const allowedRoles = options.allowedRoles ?? ['super-admin', 'tenant-admin']\n  if (\n    !Array.isArray(allowedRoles) ||\n    allowedRoles.some(\n      (role) => !['super-admin', ...EMBEDDED_ADMIN_TENANT_ROLES].includes(role),\n    )\n  ) {\n    throw createValidationError(\n      'Embedded admin receiver allowedRoles is invalid.',\n    )\n  }\n  const issuer = normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  const destination = normalizeEmbeddedAdminExactOrigin(options.destination, {\n    allowLoopbackHttp: options.allowLoopbackHttp === true,\n  })\n  if (!issuer || !destination) {\n    throw createValidationError(\n      'consoleOrigin and destination must be exact origins.',\n    )\n  }\n  const audience = executionPurpose\n    ? `${EMBEDDED_ADMIN_EXECUTION_AUDIENCE_PREFIX}${destination}`\n    : destination\n  if (\n    typeof options.channelId !== 'string' ||\n    options.channelId.length < 16 ||\n    options.channelId.length > 128 ||\n    typeof options.token !== 'string' ||\n    options.token.length === 0\n  ) {\n    throw createValidationError('Embedded admin session input is invalid.')\n  }\n\n  const jwks = options.jwks\n    ? parseJwks(options.jwks)\n    : await fetchEmbeddedAdminJwks(issuer, {\n        allowLoopbackHttp: options.allowLoopbackHttp,\n        fetch: options.fetch,\n      })\n  const currentSecond = options.now ?? Math.floor(Date.now() / 1000)\n  const { payload, protectedHeader } = await jwtVerify(\n    options.token,\n    createLocalJWKSet(jwks),\n    {\n      algorithms: [...ALGORITHMS],\n      audience,\n      clockTolerance: 0,\n      currentDate: new Date(currentSecond * 1000),\n      issuer,\n      requiredClaims: ['iat', 'nbf', 'exp', 'jti', 'sub'],\n    },\n  )\n\n  const lifetime =\n    typeof payload.exp === 'number' && typeof payload.iat === 'number'\n      ? payload.exp - payload.iat\n      : Number.POSITIVE_INFINITY\n  if (\n    typeof protectedHeader.kid !== 'string' ||\n    protectedHeader.kid.length === 0 ||\n    !Number.isInteger(payload.iat) ||\n    !Number.isInteger(payload.nbf) ||\n    !Number.isInteger(payload.exp) ||\n    (payload.iat as number) > currentSecond ||\n    lifetime <= 0 ||\n    lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS ||\n    payload.nbf !== payload.iat ||\n    payload.aud !== audience ||\n    typeof payload.jti !== 'string' ||\n    payload.jti.length === 0 ||\n    payload.app_key !== EMBEDDED_ADMIN_APP_KEY ||\n    payload.channel_id !== options.channelId ||\n    payload.dest !== destination ||\n    typeof payload.operator_id !== 'string' ||\n    payload.operator_id.length === 0 ||\n    payload.sub !== payload.operator_id ||\n    typeof payload.tenant_id !== 'string' ||\n    payload.tenant_id.length === 0 ||\n    !['super-admin', ...EMBEDDED_ADMIN_TENANT_ROLES].includes(\n      payload.tenant_role as string,\n    ) ||\n    !allowedRoles.includes(payload.tenant_role as EmbeddedAdminRole)\n  ) {\n    throw new Error('Embedded admin session claims are invalid.')\n  }\n\n  return payload as EmbeddedAdminSessionClaims\n}\n","const SDK_ERROR_BRAND = Symbol.for('@01.software/sdk/SDKError')\nconst SDK_ERROR_TYPE_BRAND = Symbol.for('@01.software/sdk/SDKError.type')\n\ntype SDKErrorType =\n  | 'NetworkError'\n  | 'ValidationError'\n  | 'ApiError'\n  | 'ConfigError'\n  | 'TimeoutError'\n  | 'GoneError'\n  | 'ServiceUnavailableError'\n  | 'UsageLimitError'\n  | 'AuthError'\n  | 'PermissionError'\n  | 'NotFoundError'\n  | 'ConflictError'\n  | 'RateLimitError'\n\nfunction defineSDKErrorBrand(error: SDKError): void {\n  Object.defineProperty(error, SDK_ERROR_BRAND, {\n    value: true,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nfunction defineSDKErrorType(error: SDKError, type: SDKErrorType): void {\n  Object.defineProperty(error, SDK_ERROR_TYPE_BRAND, {\n    value: type,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  })\n}\n\nexport class SDKError extends Error {\n  readonly code: string\n  readonly status?: number\n  readonly details?: unknown\n  readonly userMessage?: string\n  readonly suggestion?: string\n  readonly requestId?: string\n  readonly kind?: 'commerce'\n  readonly reason?: CommerceErrorCode | 'unknown_commerce_error'\n  readonly rawReason?: string\n  /** Machine-readable reason from a non-commerce API response. */\n  readonly apiReason?: string\n  readonly retryable?: boolean\n  readonly retryAfter?: number\n\n  constructor(\n    code: string,\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(message)\n    this.name = 'SDKError'\n    this.code = code\n    this.status = status\n    this.details = details\n    this.userMessage = userMessage\n    this.suggestion = suggestion\n    this.requestId = requestId\n    defineSDKErrorBrand(this)\n\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, new.target)\n    }\n  }\n\n  getUserMessage(): string {\n    return this.userMessage || this.message\n  }\n\n  toJSON() {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      details: this.details,\n      userMessage: this.userMessage,\n      suggestion: this.suggestion,\n      ...(this.requestId !== undefined && { requestId: this.requestId }),\n      ...(this.kind !== undefined && { kind: this.kind }),\n      ...(this.reason !== undefined && { reason: this.reason }),\n      ...(this.rawReason !== undefined && { rawReason: this.rawReason }),\n      ...(this.apiReason !== undefined && { apiReason: this.apiReason }),\n      ...(this.retryable !== undefined && { retryable: this.retryable }),\n      ...(this.retryAfter !== undefined && { retryAfter: this.retryAfter }),\n    }\n  }\n}\n\n/**\n * Canonical Cart/Checkout/PaymentSession error reasons. This public SDK mirror\n * intentionally does not import the private contracts package; parity is\n * enforced by a type test.\n */\nexport const COMMERCE_ERROR_CODES = [\n  'validation_failed',\n  'bad_request',\n  'unauthorized',\n  'forbidden',\n  'account_suspended',\n  'key_invalid',\n  'pat_tenant_header_forbidden',\n  'tenant_mismatch',\n  'test_tenant_expired',\n  'token_invalid',\n  'token_expired',\n  'origin_not_allowed',\n  'server_credentials_required',\n  'role_denied',\n  'scope_denied',\n  'feature_disabled',\n  'not_found',\n  'conflict',\n  'locked',\n  'cart_revision_conflict',\n  'rate_limit_exceeded',\n  'usage_limit_exceeded',\n  'service_unavailable',\n  'idempotency_conflict',\n  'idempotency_in_progress',\n  'idempotency_key_required',\n  'invalid_idempotency_key',\n  'cart_not_active',\n  'cart_locked',\n  'cart_empty',\n  'shipping_address_required',\n  'cart_market_unavailable',\n  'cart_market_mismatch',\n  'checkout_not_open',\n  'checkout_already_open',\n  'payment_slot_held',\n  'reservation_expired',\n  'payment_session_not_cancelable',\n  'payment_session_conflict',\n  'provider_identity_mismatch',\n  'managed_refund_attestation_forbidden',\n  'payment_method_unavailable',\n  'provider_unavailable',\n  'lock_timeout',\n  'price_changed',\n  'pricing_fact_in_use',\n  'insufficient_stock',\n  'credit_insufficient',\n  'reservation_conflict',\n  'stock_lock_unavailable',\n  'variant_not_found',\n  'variant_stock_write_failed',\n  'stock_invariant_violation',\n  'payment_confirmation_in_flight',\n  'checkout_reservation_release_requires_transaction',\n  'admission_metadata_invalid',\n  'admission_metadata_required',\n  'admission_not_eligible',\n  'admission_eligibility_unavailable',\n  'admission_authority_unavailable',\n  'admission_customer_binding_required',\n  'admission_eligibility_unproven',\n  'capacity_exceeded',\n  'admission_required',\n  'occurrence_lock_unavailable',\n  'occurrence_not_open',\n  'admission_type_capacity_exceeded',\n  'admission_type_occurrence_mismatch',\n  'admission_hold_expired',\n  'admission_hold_checkout_item_conflict',\n  'admission_hold_checkout_conflict',\n  'admission_hold_quantity_mismatch',\n  'admission_hold_unbound',\n  'admission_hold_missing',\n  'admission_hold_checkout_item_missing',\n  'admission_hold_expiry_failed',\n  'admission_hold_expiry_requires_transaction',\n  'admission_hold_line_item_mismatch',\n  'admission_materialization_failed',\n  'variant_inactive',\n  'variant_product_mismatch',\n  'product_not_public',\n  'product_not_eligible',\n  'purchase_limit_exceeded',\n  'market_not_found',\n  'market_shipping_currency_unsupported',\n  'missing_market_rate',\n  'missing_shipping_amount',\n  'no_enabled_payment_provider',\n  'product_market_unavailable',\n  'unsupported_currency',\n  'missing_price_row',\n  'payment_provider_currency_unsupported',\n  'discount_code_not_found',\n  'discount_not_started',\n  'discount_expired',\n  'discount_usage_limit',\n  'discount_per_customer_limit',\n  'discount_customer_required',\n  'discount_first_order_only',\n  'discount_customer_not_eligible',\n  'discount_customer_excluded',\n  'discount_items_required',\n  'discount_product_not_eligible',\n  'discount_product_excluded',\n  'discount_min_order_amount',\n  'discount_currency_scope_required',\n  'discount_allocation_method_unsupported',\n  'currency_mismatch',\n  'customer_token_required',\n  'market_required',\n  'server_derived',\n  'internal_error',\n] as const\n\nexport type CommerceErrorCode = (typeof COMMERCE_ERROR_CODES)[number]\n\ntype CommerceSDKErrorBase = SDKError & {\n  readonly kind: 'commerce'\n  readonly requestId: string\n  readonly retryable: boolean\n  readonly retryAfter?: number\n  readonly details?: Record<string, unknown>\n}\n\nexport type CommerceSDKError = CommerceSDKErrorBase &\n  (\n    | { readonly reason: CommerceErrorCode; readonly rawReason?: never }\n    | {\n        readonly reason: 'unknown_commerce_error'\n        readonly rawReason: string\n      }\n  )\n\nconst COMMERCE_ERROR_CODE_SET: ReadonlySet<string> = new Set(\n  COMMERCE_ERROR_CODES,\n)\nconst COMMERCE_ERROR_ENVELOPE_KEYS = new Set([\n  'error',\n  'reason',\n  'requestId',\n  'retryable',\n  'details',\n])\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nexport type CommerceErrorEnvelope = {\n  error: string\n  reason: string\n  requestId: string\n  retryable: boolean\n  details?: Record<string, unknown>\n}\n\nfunction commerceProtocolError(\n  issue: string,\n  trustedRequestId?: string,\n): SDKError {\n  return createApiError(\n    'Invalid canonical commerce error response.',\n    502,\n    { protocol: 'commerce-error-envelope', issue },\n    'The server returned an incompatible commerce error response.',\n    'Verify that the Console commerce contract is deployed before using this SDK version.',\n    trustedRequestId,\n  )\n}\n\n/** @internal Strictly parse a canonical commerce error without retaining its raw body. */\nexport function parseCommerceErrorEnvelope(\n  body: unknown,\n  headerRequestId?: string,\n): CommerceErrorEnvelope {\n  if (headerRequestId === undefined) {\n    throw commerceProtocolError('missing_request_id_header')\n  }\n  if (headerRequestId.length === 0) {\n    throw commerceProtocolError('empty_request_id_header')\n  }\n  if (!isPlainRecord(body)) {\n    throw commerceProtocolError('expected_object', headerRequestId)\n  }\n  if (Object.keys(body).some((key) => !COMMERCE_ERROR_ENVELOPE_KEYS.has(key))) {\n    throw commerceProtocolError('unexpected_field', headerRequestId)\n  }\n  if (\n    typeof body.error !== 'string' ||\n    body.error.length === 0 ||\n    typeof body.reason !== 'string' ||\n    body.reason.length === 0 ||\n    typeof body.requestId !== 'string' ||\n    body.requestId.length === 0 ||\n    (body.retryable !== undefined && typeof body.retryable !== 'boolean') ||\n    (body.details !== undefined && !isPlainRecord(body.details))\n  ) {\n    throw commerceProtocolError('invalid_field', headerRequestId)\n  }\n\n  if (headerRequestId !== undefined && headerRequestId !== body.requestId) {\n    throw commerceProtocolError('request_id_mismatch', headerRequestId)\n  }\n\n  return {\n    error: body.error,\n    reason: body.reason,\n    requestId: body.requestId,\n    retryable: body.retryable === true,\n    ...(body.details === undefined ? {} : { details: body.details }),\n  }\n}\n\n/** @internal Validate and apply the canonical commerce error envelope. */\nexport function enhanceCommerceError(\n  error: SDKError,\n  body: unknown,\n  headerRequestId?: string,\n): SDKError {\n  const envelope = parseCommerceErrorEnvelope(body, headerRequestId)\n\n  const known = COMMERCE_ERROR_CODE_SET.has(envelope.reason)\n  Object.assign(error, {\n    code: envelope.reason,\n    kind: 'commerce' as const,\n    reason: known\n      ? (envelope.reason as CommerceErrorCode)\n      : 'unknown_commerce_error',\n    ...(known ? {} : { rawReason: envelope.reason }),\n    requestId: envelope.requestId,\n    retryable: envelope.retryable,\n    details: envelope.details,\n  })\n  return error\n}\n\n/** @internal Apply a non-commerce reason without canonical-commerce validation. */\nexport function enhanceNonCommerceError(\n  error: SDKError,\n  reason: unknown,\n): SDKError {\n  if (typeof reason === 'string') Object.assign(error, { apiReason: reason })\n  return error\n}\n\n/**\n * Read the server-provided machine reason across strict commerce and\n * non-commerce SDK errors. Unknown commerce reasons are returned verbatim.\n */\nexport function getSDKErrorReason(error: SDKError): string | undefined {\n  if (error.kind !== 'commerce') return error.apiReason\n  return error.reason === 'unknown_commerce_error'\n    ? error.rawReason\n    : error.reason\n}\n\nexport function isCommerceSDKError(error: unknown): error is CommerceSDKError {\n  if (!isSDKError(error) || error.kind !== 'commerce') return false\n  if (\n    typeof error.requestId !== 'string' ||\n    typeof error.retryable !== 'boolean' ||\n    (error.retryAfter !== undefined &&\n      (!Number.isSafeInteger(error.retryAfter) || error.retryAfter < 0)) ||\n    typeof error.reason !== 'string'\n  ) {\n    return false\n  }\n  return error.reason === 'unknown_commerce_error'\n    ? typeof error.rawReason === 'string'\n    : COMMERCE_ERROR_CODE_SET.has(error.reason) && error.rawReason === undefined\n}\n\nexport class NetworkError extends SDKError {\n  constructor(\n    message: string,\n    status?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('NETWORK_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'NetworkError'\n    defineSDKErrorType(this, 'NetworkError')\n  }\n}\n\nexport class ValidationError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    status = 400,\n  ) {\n    super('VALIDATION_ERROR', message, status, details, userMessage, suggestion)\n    this.name = 'ValidationError'\n    defineSDKErrorType(this, 'ValidationError')\n  }\n}\n\nexport class ApiError extends SDKError {\n  constructor(\n    message: string,\n    status: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'API_ERROR',\n      message,\n      status,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'ApiError'\n    defineSDKErrorType(this, 'ApiError')\n  }\n}\n\nexport class ConfigError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('CONFIG_ERROR', message, undefined, details, userMessage, suggestion)\n    this.name = 'ConfigError'\n    defineSDKErrorType(this, 'ConfigError')\n  }\n}\n\nexport class TimeoutError extends SDKError {\n  constructor(\n    message = 'Request timed out.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('TIMEOUT_ERROR', message, 408, details, userMessage, suggestion)\n    this.name = 'TimeoutError'\n    defineSDKErrorType(this, 'TimeoutError')\n  }\n}\n\nexport class GoneError extends SDKError {\n  constructor(\n    message = 'The requested resource is no longer available.',\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('GONE_ERROR', message, 410, details, userMessage, suggestion)\n    this.name = 'GoneError'\n    defineSDKErrorType(this, 'GoneError')\n  }\n}\n\nexport class ServiceUnavailableError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message = 'Service temporarily unavailable.',\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super(\n      'SERVICE_UNAVAILABLE_ERROR',\n      message,\n      503,\n      details,\n      userMessage,\n      suggestion,\n    )\n    this.name = 'ServiceUnavailableError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'ServiceUnavailableError')\n  }\n}\n\nexport class UsageLimitError extends SDKError {\n  readonly usage: { limit: number; current: number; remaining: number }\n\n  constructor(\n    message: string,\n    usage: { limit: number; current: number; remaining: number },\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n  ) {\n    super('USAGE_LIMIT_ERROR', message, 429, details, userMessage, suggestion)\n    this.name = 'UsageLimitError'\n    this.usage = usage\n    defineSDKErrorType(this, 'UsageLimitError')\n  }\n\n  toJSON() {\n    return {\n      ...super.toJSON(),\n      usage: this.usage,\n    }\n  }\n}\n\nexport class AuthError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'auth_error',\n      message,\n      401,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'AuthError'\n    defineSDKErrorType(this, 'AuthError')\n  }\n}\n\nexport class PermissionError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'permission_error',\n      message,\n      403,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'PermissionError'\n    defineSDKErrorType(this, 'PermissionError')\n  }\n}\n\nexport class NotFoundError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'not_found',\n      message,\n      404,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'NotFoundError'\n    defineSDKErrorType(this, 'NotFoundError')\n  }\n}\n\nexport class ConflictError extends SDKError {\n  constructor(\n    message: string,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super('conflict', message, 409, details, userMessage, suggestion, requestId)\n    this.name = 'ConflictError'\n    defineSDKErrorType(this, 'ConflictError')\n  }\n}\n\nexport class RateLimitError extends SDKError {\n  readonly retryAfter?: number\n\n  constructor(\n    message: string,\n    retryAfter?: number,\n    details?: unknown,\n    userMessage?: string,\n    suggestion?: string,\n    requestId?: string,\n  ) {\n    super(\n      'rate_limit_exceeded',\n      message,\n      429,\n      details,\n      userMessage,\n      suggestion,\n      requestId,\n    )\n    this.name = 'RateLimitError'\n    this.retryAfter = retryAfter\n    defineSDKErrorType(this, 'RateLimitError')\n  }\n}\n\nfunction hasBrandedSDKErrorShape(error: unknown): error is SDKError {\n  if (error === null || typeof error !== 'object') return false\n\n  const candidate = error as Record<PropertyKey, unknown>\n  return (\n    candidate[SDK_ERROR_BRAND] === true &&\n    typeof candidate.name === 'string' &&\n    typeof candidate.code === 'string' &&\n    typeof candidate.message === 'string' &&\n    (candidate.status === undefined || typeof candidate.status === 'number') &&\n    (candidate.userMessage === undefined ||\n      typeof candidate.userMessage === 'string') &&\n    (candidate.suggestion === undefined ||\n      typeof candidate.suggestion === 'string') &&\n    (candidate.requestId === undefined ||\n      typeof candidate.requestId === 'string') &&\n    (candidate.kind === undefined || candidate.kind === 'commerce') &&\n    (candidate.reason === undefined || typeof candidate.reason === 'string') &&\n    (candidate.rawReason === undefined ||\n      typeof candidate.rawReason === 'string') &&\n    (candidate.apiReason === undefined ||\n      typeof candidate.apiReason === 'string') &&\n    (candidate.retryable === undefined ||\n      typeof candidate.retryable === 'boolean') &&\n    (candidate.retryAfter === undefined ||\n      typeof candidate.retryAfter === 'number') &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nfunction hasSDKErrorType(error: unknown, type: SDKErrorType): boolean {\n  return (\n    hasBrandedSDKErrorShape(error) &&\n    (error as unknown as Record<PropertyKey, unknown>)[SDK_ERROR_TYPE_BRAND] ===\n      type\n  )\n}\n\nexport function isSDKError(error: unknown): error is SDKError {\n  return error instanceof SDKError || hasBrandedSDKErrorShape(error)\n}\n\nexport function isNetworkError(error: unknown): error is NetworkError {\n  return error instanceof NetworkError || hasSDKErrorType(error, 'NetworkError')\n}\n\nexport function isValidationError(error: unknown): error is ValidationError {\n  if (\n    error instanceof ValidationError ||\n    hasSDKErrorType(error, 'ValidationError')\n  ) {\n    return true\n  }\n  if (error == null || typeof error !== 'object') return false\n\n  const candidate = error as {\n    code?: unknown\n    name?: unknown\n    message?: unknown\n    getUserMessage?: unknown\n    toJSON?: unknown\n  }\n  return (\n    candidate.name === 'ValidationError' &&\n    candidate.code === 'VALIDATION_ERROR' &&\n    typeof candidate.message === 'string' &&\n    typeof candidate.getUserMessage === 'function' &&\n    typeof candidate.toJSON === 'function'\n  )\n}\n\nexport function isApiError(error: unknown): error is ApiError {\n  return error instanceof ApiError || hasSDKErrorType(error, 'ApiError')\n}\n\nexport function isConfigError(error: unknown): error is ConfigError {\n  return error instanceof ConfigError || hasSDKErrorType(error, 'ConfigError')\n}\n\nexport function isTimeoutError(error: unknown): error is TimeoutError {\n  return error instanceof TimeoutError || hasSDKErrorType(error, 'TimeoutError')\n}\n\nexport function isGoneError(error: unknown): error is GoneError {\n  return error instanceof GoneError || hasSDKErrorType(error, 'GoneError')\n}\n\nexport function isServiceUnavailableError(\n  error: unknown,\n): error is ServiceUnavailableError {\n  return (\n    error instanceof ServiceUnavailableError ||\n    hasSDKErrorType(error, 'ServiceUnavailableError')\n  )\n}\n\nexport function isUsageLimitError(error: unknown): error is UsageLimitError {\n  return (\n    error instanceof UsageLimitError ||\n    hasSDKErrorType(error, 'UsageLimitError')\n  )\n}\n\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError || hasSDKErrorType(error, 'AuthError')\n}\n\nexport function isPermissionError(error: unknown): error is PermissionError {\n  return (\n    error instanceof PermissionError ||\n    hasSDKErrorType(error, 'PermissionError')\n  )\n}\n\nexport function isNotFoundError(error: unknown): error is NotFoundError {\n  return (\n    error instanceof NotFoundError || hasSDKErrorType(error, 'NotFoundError')\n  )\n}\n\nexport function isConflictError(error: unknown): error is ConflictError {\n  return (\n    error instanceof ConflictError || hasSDKErrorType(error, 'ConflictError')\n  )\n}\n\nexport function isRateLimitError(error: unknown): error is RateLimitError {\n  return (\n    error instanceof RateLimitError || hasSDKErrorType(error, 'RateLimitError')\n  )\n}\n\nexport const createNetworkError = (\n  message: string,\n  status?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new NetworkError(message, status, details, userMessage, suggestion)\n\nexport const createValidationError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  status?: number,\n) => new ValidationError(message, details, userMessage, suggestion, status)\n\nexport const createApiError = (\n  message: string,\n  status: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ApiError(message, status, details, userMessage, suggestion, requestId)\n\nexport const createConfigError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new ConfigError(message, details, userMessage, suggestion)\n\nexport const createTimeoutError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new TimeoutError(message, details, userMessage, suggestion)\n\nexport const createGoneError = (\n  message?: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new GoneError(message, details, userMessage, suggestion)\n\nexport const createServiceUnavailableError = (\n  message?: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) =>\n  new ServiceUnavailableError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n  )\n\nexport const createUsageLimitError = (\n  message: string,\n  usage: { limit: number; current: number; remaining: number },\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n) => new UsageLimitError(message, usage, details, userMessage, suggestion)\n\nexport const createAuthError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new AuthError(message, details, userMessage, suggestion, requestId)\n\nexport const createPermissionError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new PermissionError(message, details, userMessage, suggestion, requestId)\n\nexport const createNotFoundError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new NotFoundError(message, details, userMessage, suggestion, requestId)\n\nexport const createConflictError = (\n  message: string,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) => new ConflictError(message, details, userMessage, suggestion, requestId)\n\nexport const createRateLimitError = (\n  message: string,\n  retryAfter?: number,\n  details?: unknown,\n  userMessage?: string,\n  suggestion?: string,\n  requestId?: string,\n) =>\n  new RateLimitError(\n    message,\n    retryAfter,\n    details,\n    userMessage,\n    suggestion,\n    requestId,\n  )\n","import { createValidationError } from '../core/internal/errors'\n\n/** v2 purpose separation must also fail the original v1 verifier's audience check. */\nexport const EMBEDDED_ADMIN_EXECUTION_AUDIENCE_PREFIX =\n  'urn:01-software:embedded-admin-execution:' as const\n\nexport const EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION = 2 as const\nexport const EMBEDDED_ADMIN_ACTION_CAPABILITY = 'collection-actions' as const\nexport const EMBEDDED_ADMIN_MAX_ACTIONS = 20\nexport const EMBEDDED_ADMIN_MAX_SELECTED_IDS = 100\n\nexport type EmbeddedAdminAction = {\n  id: string\n  label: string\n  collection: string\n  requiresSelection: boolean\n}\n\nexport type EmbeddedAdminExecutionContext = {\n  executionId: string\n  expiresAt: number\n  actionId: string\n  collection: string\n  selectedIds: string[]\n}\n\nconst ACTION_ID = /^[a-z][a-z0-9_-]{0,63}$/\nconst COLLECTION = /^[a-z][a-z0-9-]{0,63}$/\nconst EXECUTION_ID =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/\n\nfunction recordWithKeys(\n  value: unknown,\n  keys: string[],\n): Record<string, unknown> {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw createValidationError('Invalid embedded admin action context.')\n  }\n  const record = value as Record<string, unknown>\n  if (Object.keys(record).some((key) => !keys.includes(key))) {\n    throw createValidationError('Invalid embedded admin action context.')\n  }\n  return record\n}\n\nexport function normalizeEmbeddedAdminActions(\n  value: unknown,\n): EmbeddedAdminAction[] {\n  if (value === undefined || value === null) return []\n  if (!Array.isArray(value) || value.length > EMBEDDED_ADMIN_MAX_ACTIONS) {\n    throw createValidationError('Invalid embedded admin actions.')\n  }\n  const ids = new Set<string>()\n  return value.map((value) => {\n    const action = recordWithKeys(value, [\n      'id',\n      'label',\n      'collection',\n      'requiresSelection',\n    ])\n    if (\n      typeof action.id !== 'string' ||\n      !ACTION_ID.test(action.id) ||\n      ids.has(action.id) ||\n      typeof action.label !== 'string' ||\n      !action.label.trim() ||\n      action.label.trim().length > 80 ||\n      typeof action.collection !== 'string' ||\n      !COLLECTION.test(action.collection) ||\n      typeof action.requiresSelection !== 'boolean'\n    )\n      throw createValidationError(\n        'Invalid embedded admin action configuration.',\n      )\n    ids.add(action.id)\n    return {\n      id: action.id,\n      label: action.label.trim(),\n      collection: action.collection,\n      requiresSelection: action.requiresSelection,\n    }\n  })\n}\n\nexport function normalizeEmbeddedAdminExecutionContext(\n  value: unknown,\n): EmbeddedAdminExecutionContext {\n  const input = recordWithKeys(value, [\n    'executionId',\n    'expiresAt',\n    'actionId',\n    'collection',\n    'selectedIds',\n  ])\n  if (\n    typeof input.executionId !== 'string' ||\n    !EXECUTION_ID.test(input.executionId) ||\n    typeof input.expiresAt !== 'number' ||\n    !Number.isSafeInteger(input.expiresAt) ||\n    input.expiresAt <= 0 ||\n    typeof input.actionId !== 'string' ||\n    !ACTION_ID.test(input.actionId) ||\n    typeof input.collection !== 'string' ||\n    !COLLECTION.test(input.collection) ||\n    !Array.isArray(input.selectedIds) ||\n    input.selectedIds.length > EMBEDDED_ADMIN_MAX_SELECTED_IDS ||\n    input.selectedIds.some(\n      (id) =>\n        typeof id !== 'string' ||\n        !id ||\n        id.length > 128 ||\n        id.trim() !== id ||\n        Array.from(id).some(\n          (character) =>\n            character.charCodeAt(0) <= 0x20 || character.charCodeAt(0) === 0x7f,\n        ),\n    ) ||\n    new Set(input.selectedIds).size !== input.selectedIds.length\n  )\n    throw createValidationError('Invalid embedded admin execution context.')\n  return {\n    executionId: input.executionId,\n    expiresAt: input.expiresAt,\n    actionId: input.actionId,\n    collection: input.collection,\n    selectedIds: [...(input.selectedIds as string[])].sort(),\n  }\n}\n\nexport function embeddedAdminExecutionContextsEqual(\n  left: unknown,\n  right: unknown,\n): boolean {\n  try {\n    return (\n      JSON.stringify(normalizeEmbeddedAdminExecutionContext(left)) ===\n      JSON.stringify(normalizeEmbeddedAdminExecutionContext(right))\n    )\n  } catch {\n    return false\n  }\n}\n","import { createValidationError } from '../core/internal/errors'\nimport {\n  EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION,\n  EMBEDDED_ADMIN_ACTION_CAPABILITY,\n  normalizeEmbeddedAdminActions,\n  normalizeEmbeddedAdminExecutionContext,\n  type EmbeddedAdminAction,\n  type EmbeddedAdminExecutionContext,\n} from './actions'\n\nexport * from './actions'\n\nexport const EMBEDDED_ADMIN_PROTOCOL_VERSION = 1 as const\nexport const EMBEDDED_ADMIN_CHALLENGE_MESSAGE =\n  '01.embedded-admin.challenge' as const\nexport const EMBEDDED_ADMIN_READY_MESSAGE = '01.embedded-admin.ready' as const\nexport const EMBEDDED_ADMIN_SESSION_MESSAGE =\n  '01.embedded-admin.session' as const\nexport const EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60 as const\nexport const EMBEDDED_ADMIN_APP_KEY = 'primary' as const\n\nconst DEFAULT_RECEIVER_TIMEOUT_MS = 35_000\nconst MAX_RECEIVER_TIMEOUT_MS = 120_000\nconst MAX_LABEL_LENGTH = 80\nconst MAX_PATH_LENGTH = 512\n\nexport type EmbeddedAdminChallengeMessage = {\n  type: typeof EMBEDDED_ADMIN_CHALLENGE_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminReadyMessage = {\n  type: typeof EMBEDDED_ADMIN_READY_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n}\n\nexport type EmbeddedAdminSessionMessage = {\n  type: typeof EMBEDDED_ADMIN_SESSION_MESSAGE\n  version: typeof EMBEDDED_ADMIN_PROTOCOL_VERSION\n  requestId: string\n  token: string\n}\n\n/** Exact execution roles; this list grants no platform data permissions. */\nexport const EMBEDDED_ADMIN_TENANT_ROLES = [\n  'tenant-admin',\n  'tenant-editor',\n  'tenant-viewer',\n] as const\nexport type EmbeddedAdminTenantRole =\n  (typeof EMBEDDED_ADMIN_TENANT_ROLES)[number]\n\n/** Missing legacy settings retain administrator-only execution; invalid settings fail closed. */\nexport function normalizeEmbeddedAdminAllowedRoles(\n  value: unknown,\n): EmbeddedAdminTenantRole[] | null {\n  if (value === undefined || value === null) return ['tenant-admin']\n  if (\n    !Array.isArray(value) ||\n    value.some((role) => !EMBEDDED_ADMIN_TENANT_ROLES.includes(role))\n  )\n    return null\n  return EMBEDDED_ADMIN_TENANT_ROLES.filter((role) => value.includes(role))\n}\n\nexport type EmbeddedAdminBindingConfiguration = {\n  /** Explicit opt-in; missing values keep sandbox downloads disabled. */\n  allowDownloads?: boolean\n  allowedRoles?: EmbeddedAdminTenantRole[]\n  enabled: boolean\n  label: string\n  origin: string\n  path: string\n  actions?: EmbeddedAdminAction[]\n}\n\nexport type EmbeddedAdminSessionReceipt = {\n  requestId: string\n  token: string\n}\n\nexport type EmbeddedAdminExecutionReceipt = EmbeddedAdminSessionReceipt & {\n  execution: EmbeddedAdminExecutionContext\n}\n\nexport type ReceiveEmbeddedAdminSessionOptions = {\n  /** Test fixtures only. Production integrations must keep HTTPS enforcement. */\n  allowLoopbackHttp?: boolean\n  /** Exact Console origin configured by the receiver deployment. */\n  consoleOrigin: string\n  /** Cancels the one-shot receiver and closes every transferred port. */\n  signal?: AbortSignal\n  /** Defaults to 35 seconds and is capped at 120 seconds. */\n  timeoutMs?: number\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n  )\n}\n\nexport function normalizeEmbeddedAdminExactOrigin(\n  value: unknown,\n  options: { allowLoopbackHttp?: boolean } = {},\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (!trimmed || trimmed.length > 2048) return null\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed)\n  } catch {\n    return null\n  }\n\n  const allowedProtocol =\n    parsed.protocol === 'https:' ||\n    (options.allowLoopbackHttp === true &&\n      parsed.protocol === 'http:' &&\n      isLoopbackHostname(parsed.hostname))\n  if (!allowedProtocol || parsed.hostname.includes('*')) return null\n  if (parsed.username || parsed.password || parsed.search || parsed.hash) {\n    return null\n  }\n  if (parsed.pathname !== '/' || trimmed.endsWith('/')) return null\n\n  return parsed.origin\n}\n\nexport function normalizeEmbeddedAdminRelativePath(\n  value: unknown,\n): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (\n    !trimmed.startsWith('/') ||\n    trimmed.startsWith('//') ||\n    trimmed.length > MAX_PATH_LENGTH\n  ) {\n    return null\n  }\n\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed, 'https://embedded.invalid')\n  } catch {\n    return null\n  }\n\n  if (\n    parsed.origin !== 'https://embedded.invalid' ||\n    parsed.pathname.startsWith('//') ||\n    parsed.search ||\n    parsed.hash ||\n    parsed.username ||\n    parsed.password\n  ) {\n    return null\n  }\n\n  return parsed.pathname\n}\n\nexport function normalizeEmbeddedAdminBindingConfiguration(\n  value: unknown,\n  options: {\n    allowLoopbackConsoleHttp?: boolean\n    consoleOrigin?: string\n  } = {},\n): EmbeddedAdminBindingConfiguration & { allowDownloads: boolean } {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw createValidationError('Embedded admin binding must be an object.')\n  }\n\n  const input = value as Record<string, unknown>\n  if (\n    input.allowDownloads !== undefined &&\n    typeof input.allowDownloads !== 'boolean'\n  ) {\n    throw createValidationError('allowDownloads must be a boolean.')\n  }\n  const allowedRoles = normalizeEmbeddedAdminAllowedRoles(input.allowedRoles)\n  if (!allowedRoles)\n    throw createValidationError(\n      'Embedded admin allowedRoles must contain only tenant execution roles.',\n    )\n  const label = typeof input.label === 'string' ? input.label.trim() : ''\n  const origin = normalizeEmbeddedAdminExactOrigin(input.origin)\n  const path = normalizeEmbeddedAdminRelativePath(input.path)\n  const consoleOrigin = options.consoleOrigin\n    ? normalizeEmbeddedAdminExactOrigin(options.consoleOrigin, {\n        allowLoopbackHttp: options.allowLoopbackConsoleHttp === true,\n      })\n    : null\n\n  if (!label || label.length > MAX_LABEL_LENGTH) {\n    throw createValidationError(\n      `Embedded admin label must be between 1 and ${MAX_LABEL_LENGTH} characters.`,\n    )\n  }\n  if (!origin) {\n    throw createValidationError(\n      'Embedded admin origin must be an exact HTTPS origin without a path, query, fragment, wildcard, or credentials.',\n    )\n  }\n  if (!path) {\n    throw createValidationError(\n      'Embedded admin path must begin with / and must not include a query or fragment.',\n    )\n  }\n  if (consoleOrigin && origin === consoleOrigin) {\n    throw createValidationError(\n      'Embedded admin origin must be different from the Console origin.',\n    )\n  }\n\n  return {\n    allowedRoles,\n    enabled: input.enabled !== false,\n    allowDownloads: input.allowDownloads === true,\n    label,\n    origin,\n    path,\n    ...(input.actions === undefined\n      ? {}\n      : { actions: normalizeEmbeddedAdminActions(input.actions) }),\n  }\n}\n\nexport function isEmbeddedAdminChallengeMessage(\n  value: unknown,\n): value is EmbeddedAdminChallengeMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_CHALLENGE_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminReadyMessage(\n  value: unknown,\n): value is EmbeddedAdminReadyMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_READY_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128\n  )\n}\n\nexport function isEmbeddedAdminSessionMessage(\n  value: unknown,\n): value is EmbeddedAdminSessionMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false\n  const message = value as Record<string, unknown>\n  return (\n    message.type === EMBEDDED_ADMIN_SESSION_MESSAGE &&\n    message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION &&\n    typeof message.requestId === 'string' &&\n    message.requestId.length >= 16 &&\n    message.requestId.length <= 128 &&\n    typeof message.token === 'string' &&\n    message.token.length > 0\n  )\n}\n\n/**\n * Receives one Console assertion through the exact parent/origin challenge\n * channel. Forward the returned token immediately to the receiver backend;\n * never persist, log, decode, or use it as Console API authority in-browser.\n */\nexport function receiveEmbeddedAdminSession(\n  options: ReceiveEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminSessionReceipt> {\n  return receiveSession(options, false)\n}\n\n/** Receives a v2 action only. It never silently accepts an identity-only launch. */\nexport function receiveEmbeddedAdminExecution(\n  options: ReceiveEmbeddedAdminSessionOptions,\n): Promise<EmbeddedAdminExecutionReceipt> {\n  return receiveSession(options, true) as Promise<EmbeddedAdminExecutionReceipt>\n}\n\nfunction receiveSession(\n  options: ReceiveEmbeddedAdminSessionOptions,\n  action: boolean,\n): Promise<EmbeddedAdminSessionReceipt | EmbeddedAdminExecutionReceipt> {\n  if (typeof window === 'undefined' || window.parent === window) {\n    return Promise.reject(\n      createValidationError(\n        'receiveEmbeddedAdminSession must run inside an embedded browser frame.',\n      ),\n    )\n  }\n\n  const consoleOrigin = normalizeEmbeddedAdminExactOrigin(\n    options.consoleOrigin,\n    { allowLoopbackHttp: options.allowLoopbackHttp === true },\n  )\n  if (!consoleOrigin) {\n    return Promise.reject(\n      createValidationError('consoleOrigin must be one exact HTTPS origin.'),\n    )\n  }\n\n  const timeoutMs = options.timeoutMs ?? DEFAULT_RECEIVER_TIMEOUT_MS\n  if (\n    !Number.isInteger(timeoutMs) ||\n    timeoutMs <= 0 ||\n    timeoutMs > MAX_RECEIVER_TIMEOUT_MS\n  ) {\n    return Promise.reject(\n      createValidationError(\n        `timeoutMs must be an integer between 1 and ${MAX_RECEIVER_TIMEOUT_MS}.`,\n      ),\n    )\n  }\n\n  return new Promise((resolve, reject) => {\n    const ports = new Set<MessagePort>()\n    let settled = false\n\n    const closePorts = () => {\n      for (const port of ports) port.close()\n      ports.clear()\n    }\n    const cleanup = () => {\n      window.removeEventListener('message', acceptChallenge)\n      options.signal?.removeEventListener('abort', abort)\n      clearTimeout(timer)\n      closePorts()\n    }\n    const finish = (\n      receipt: EmbeddedAdminSessionReceipt | EmbeddedAdminExecutionReceipt,\n    ) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      resolve(receipt)\n    }\n    const fail = (error: Error) => {\n      if (settled) return\n      settled = true\n      cleanup()\n      reject(error)\n    }\n    const abort = () =>\n      fail(new Error('Embedded admin session receipt aborted.'))\n    const acceptSession = (\n      event: MessageEvent<unknown>,\n      expectedRequestId: string,\n    ) => {\n      if (action) {\n        const message = event.data as Record<string, unknown> | null\n        if (\n          !message ||\n          message.type !== EMBEDDED_ADMIN_SESSION_MESSAGE ||\n          message.version !== EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION ||\n          message.requestId !== expectedRequestId ||\n          typeof message.token !== 'string' ||\n          !message.token\n        )\n          return\n        try {\n          finish({\n            requestId: expectedRequestId,\n            token: message.token,\n            execution: normalizeEmbeddedAdminExecutionContext(\n              message.execution,\n            ),\n          })\n        } catch {\n          fail(new Error('Invalid embedded admin execution message.'))\n        }\n      } else {\n        if (\n          !isEmbeddedAdminSessionMessage(event.data) ||\n          event.data.requestId !== expectedRequestId\n        )\n          return\n        finish({ requestId: event.data.requestId, token: event.data.token })\n      }\n    }\n    const acceptChallenge = (event: MessageEvent<unknown>) => {\n      if (\n        event.source !== window.parent ||\n        event.origin !== consoleOrigin ||\n        event.ports.length !== 1\n      ) {\n        for (const port of event.ports) port.close()\n        return\n      }\n\n      const challenge = event.data as Record<string, unknown> | null\n      const actionChallenge =\n        challenge?.type === EMBEDDED_ADMIN_CHALLENGE_MESSAGE &&\n        challenge.version === EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION &&\n        typeof challenge.requestId === 'string' &&\n        challenge.requestId.length >= 16 &&\n        challenge.requestId.length <= 128\n      const supported = action\n        ? actionChallenge &&\n          Array.isArray(challenge?.capabilities) &&\n          challenge.capabilities.length === 1 &&\n          challenge.capabilities[0] === EMBEDDED_ADMIN_ACTION_CAPABILITY\n        : isEmbeddedAdminChallengeMessage(event.data)\n      if (!supported) {\n        if (actionChallenge)\n          event.ports[0]!.postMessage({\n            type: '01.embedded-admin.error',\n            version: 2,\n            requestId: challenge.requestId,\n            reason: 'unsupported',\n          })\n        for (const port of event.ports) port.close()\n        return\n      }\n\n      const port = event.ports[0]!\n      const requestId = (event.data as EmbeddedAdminChallengeMessage).requestId\n      ports.add(port)\n      port.addEventListener('message', (message) => {\n        acceptSession(message, requestId)\n      })\n      port.start()\n      port.postMessage({\n        type: EMBEDDED_ADMIN_READY_MESSAGE,\n        version: action\n          ? EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION\n          : EMBEDDED_ADMIN_PROTOCOL_VERSION,\n        requestId,\n        ...(action ? { capabilities: [EMBEDDED_ADMIN_ACTION_CAPABILITY] } : {}),\n      })\n    }\n\n    const timer = setTimeout(() => {\n      fail(new Error('Timed out waiting for an embedded admin session.'))\n    }, timeoutMs)\n\n    if (options.signal?.aborted) {\n      abort()\n      return\n    }\n    options.signal?.addEventListener('abort', abort, { once: true })\n    window.addEventListener('message', acceptChallenge)\n  })\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;;;ACLP,IAAM,kBAAkB,uBAAO,IAAI,2BAA2B;AAC9D,IAAM,uBAAuB,uBAAO,IAAI,gCAAgC;AAiBxE,SAAS,oBAAoB,OAAuB;AAClD,SAAO,eAAe,OAAO,iBAAiB;AAAA,IAC5C,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAiB,MAA0B;AACrE,SAAO,eAAe,OAAO,sBAAsB;AAAA,IACjD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAelC,YACE,MACA,SACA,QACA,SACA,aACA,YACA,WACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,aAAa;AAClB,SAAK,YAAY;AACjB,wBAAoB,IAAI;AAExB,QAAI,MAAM,mBAAmB;AAC3B,YAAM,kBAAkB,MAAM,UAAU;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,iBAAyB;AACvB,WAAO,KAAK,eAAe,KAAK;AAAA,EAClC;AAAA,EAEA,SAAS;AACP,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,YAAY,KAAK;AAAA,MACjB,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,SAAS,UAAa,EAAE,MAAM,KAAK,KAAK;AAAA,MACjD,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;AAAA,MACvD,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;AAAA,MAChE,GAAI,KAAK,eAAe,UAAa,EAAE,YAAY,KAAK,WAAW;AAAA,IACrE;AAAA,EACF;AACF;AAOO,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqBA,IAAM,0BAA+C,IAAI;AAAA,EACvD;AACF;AAuJO,IAAM,kBAAN,cAA8B,SAAS;AAAA,EAC5C,YACE,SACA,SACA,aACA,YACA,SAAS,KACT;AACA,UAAM,oBAAoB,SAAS,QAAQ,SAAS,aAAa,UAAU;AAC3E,SAAK,OAAO;AACZ,uBAAmB,MAAM,iBAAiB;AAAA,EAC5C;AACF;AAuWO,IAAM,wBAAwB,CACnC,SACA,SACA,aACA,YACA,WACG,IAAI,gBAAgB,SAAS,SAAS,aAAa,YAAY,MAAM;;;AC9vBnE,IAAM,2CACX;AAKK,IAAM,kCAAkC;AAiB/C,IAAM,YAAY;AAClB,IAAM,aAAa;AACnB,IAAM,eACJ;AAEF,SAAS,eACP,OACA,MACyB;AACzB,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,sBAAsB,wCAAwC;AAAA,EACtE;AACA,QAAM,SAAS;AACf,MAAI,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC,GAAG;AAC1D,UAAM,sBAAsB,wCAAwC;AAAA,EACtE;AACA,SAAO;AACT;AAyCO,SAAS,uCACd,OAC+B;AAC/B,QAAM,QAAQ,eAAe,OAAO;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MACE,OAAO,MAAM,gBAAgB,YAC7B,CAAC,aAAa,KAAK,MAAM,WAAW,KACpC,OAAO,MAAM,cAAc,YAC3B,CAAC,OAAO,cAAc,MAAM,SAAS,KACrC,MAAM,aAAa,KACnB,OAAO,MAAM,aAAa,YAC1B,CAAC,UAAU,KAAK,MAAM,QAAQ,KAC9B,OAAO,MAAM,eAAe,YAC5B,CAAC,WAAW,KAAK,MAAM,UAAU,KACjC,CAAC,MAAM,QAAQ,MAAM,WAAW,KAChC,MAAM,YAAY,SAAS,mCAC3B,MAAM,YAAY;AAAA,IAChB,CAAC,OACC,OAAO,OAAO,YACd,CAAC,MACD,GAAG,SAAS,OACZ,GAAG,KAAK,MAAM,MACd,MAAM,KAAK,EAAE,EAAE;AAAA,MACb,CAAC,cACC,UAAU,WAAW,CAAC,KAAK,MAAQ,UAAU,WAAW,CAAC,MAAM;AAAA,IACnE;AAAA,EACJ,KACA,IAAI,IAAI,MAAM,WAAW,EAAE,SAAS,MAAM,YAAY;AAEtD,UAAM,sBAAsB,2CAA2C;AACzE,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,aAAa,CAAC,GAAI,MAAM,WAAwB,EAAE,KAAK;AAAA,EACzD;AACF;AAEO,SAAS,oCACd,MACA,OACS;AACT,MAAI;AACF,WACE,KAAK,UAAU,uCAAuC,IAAI,CAAC,MAC3D,KAAK,UAAU,uCAAuC,KAAK,CAAC;AAAA,EAEhE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC3HO,IAAM,qCAAqC;AAC3C,IAAM,yBAAyB;AAKtC,IAAM,kBAAkB;AAsBjB,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AACF;AAgDA,SAAS,mBAAmB,UAA2B;AACrD,SACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEO,SAAS,kCACd,OACA,UAA2C,CAAC,GAC7B;AACf,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,QAAQ,SAAS,KAAM,QAAO;AAE9C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,OAAO;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,kBACJ,OAAO,aAAa,YACnB,QAAQ,sBAAsB,QAC7B,OAAO,aAAa,WACpB,mBAAmB,OAAO,QAAQ;AACtC,MAAI,CAAC,mBAAmB,OAAO,SAAS,SAAS,GAAG,EAAG,QAAO;AAC9D,MAAI,OAAO,YAAY,OAAO,YAAY,OAAO,UAAU,OAAO,MAAM;AACtE,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,OAAO,QAAQ,SAAS,GAAG,EAAG,QAAO;AAE7D,SAAO,OAAO;AAChB;AAEO,SAAS,mCACd,OACe;AACf,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MACE,CAAC,QAAQ,WAAW,GAAG,KACvB,QAAQ,WAAW,IAAI,KACvB,QAAQ,SAAS,iBACjB;AACA,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,SAAS,0BAA0B;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MACE,OAAO,WAAW,8BAClB,OAAO,SAAS,WAAW,IAAI,KAC/B,OAAO,UACP,OAAO,QACP,OAAO,YACP,OAAO,UACP;AACA,WAAO;AAAA,EACT;AAEA,SAAO,OAAO;AAChB;;;AHjJA,IAAM,aAAa,CAAC,SAAS,OAAO;AACpC,IAAM,iBAAiB,KAAK;AAiE5B,SAAS,UAAU,OAA+B;AAChD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,OAAQ,MAAkC;AAChD,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,KAAK,KAAK,SAAS,GAAG;AAChE,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,iBAAiB,CAAC,KAAK,KAAK,KAAK,MAAM,MAAM,MAAM,OAAO,GAAG;AACnE,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACzD,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,UAAM,SAAS;AACf,QACE,OAAO,OAAO,QAAQ,YACtB,OAAO,IAAI,WAAW,KACtB,eAAe,KAAK,CAAC,WAAW,UAAU,MAAM,GAChD;AACA,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AAAA,EACF;AACA,SAAO,EAAE,KAAoC;AAC/C;AAEA,eAAsB,uBACpB,eACA,UAAyC,CAAC,GAClB;AACxB,QAAM,SAAS,kCAAkC,eAAe;AAAA,IAC9D,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,UAAM,sBAAsB,yCAAyC;AAAA,EACvE;AAEA,QAAM,WAAW,OAAO,QAAQ,SAAS,WAAW;AAAA,IAClD,IAAI,IAAI,uBAAuB,MAAM;AAAA,IACrC,EAAE,OAAO,YAAY,SAAS,EAAE,QAAQ,mBAAmB,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,qCAAqC;AACvE,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,gBAAgB;AAC9D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,SAAO,UAAU,KAAK,MAAM,IAAI,CAAY;AAC9C;AAGA,eAAsB,2BACpB,SACqC;AACrC,QAAM,SAAS,MAAM,cAAc,OAAO;AAC1C,MACE,sBAAsB,UACtB,uBAAuB,UACvB,eAAe,QACf;AACA,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,SAAO;AACT;AAEA,eAAsB,6BACpB,SACuC;AACvC,MAAI,OAAO,QAAQ,qBAAqB,YAAY;AAClD,UAAM,sBAAsB,2CAA2C;AAAA,EACzE;AACA,QAAM,QAAQ,QAAQ,UAAU,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAClE,QAAM,gBAAgB,MAAM;AAC1B,UAAM,MAAM,MAAM;AAClB,QAAI,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM;AACtC,YAAM,sBAAsB,0CAA0C;AACxE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,cAAc,EAAE,GAAG,SAAS,KAAK,cAAc,EAAE,GAAG,IAAI;AAC7E,QAAM,YAAY;AAAA,IAChB,OAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,IAAI,QAAQ,QAAQ;AACtC,QAAM,OAAO,mCAAmC,MAAM,QAAQ;AAC9D,MACE,OAAO,qBAAqB,KAC5B,CAAC,CAAC,eAAe,cAAc,EAAE,SAAS,OAAO,WAAW,KAC5D,eAAe,UACf,CAAC,QACD,MAAM,WAAW,OAAO,QACxB,GAAG,MAAM,MAAM,GAAG,IAAI,OAAO,QAAQ,YACrC,OAAO,cAAc,QAAQ,YAC7B,OAAO,QAAQ,UAAU,aACzB,cAAc,KAAK,UAAU,aAC7B,CAAC,oCAAoC,WAAW,QAAQ,SAAS;AAEjE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAEF,QAAM,WAAW,MAAM,QAAQ,iBAAiB;AAAA,IAC9C,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,aAAa,UAAU;AAAA,IACvB,WAAW,UAAU;AAAA,EACvB,CAAC;AACD,MAAI,aAAa;AACf,UAAM,IAAI,MAAM,gDAAgD;AAGlE,MAAI,cAAc,KAAK,UAAU;AAC/B,UAAM,IAAI,MAAM,sDAAsD;AACxE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,mBAAmB;AAAA,EACrB;AACF;AAEA,eAAe,cACb,SACA,mBAAmB,OACkB;AACrC,QAAM,eAAe,QAAQ,gBAAgB,CAAC,eAAe,cAAc;AAC3E,MACE,CAAC,MAAM,QAAQ,YAAY,KAC3B,aAAa;AAAA,IACX,CAAC,SAAS,CAAC,CAAC,eAAe,GAAG,2BAA2B,EAAE,SAAS,IAAI;AAAA,EAC1E,GACA;AACA,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,kCAAkC,QAAQ,eAAe;AAAA,IACtE,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,QAAM,cAAc,kCAAkC,QAAQ,aAAa;AAAA,IACzE,mBAAmB,QAAQ,sBAAsB;AAAA,EACnD,CAAC;AACD,MAAI,CAAC,UAAU,CAAC,aAAa;AAC3B,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,mBACb,GAAG,wCAAwC,GAAG,WAAW,KACzD;AACJ,MACE,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,SAAS,MAC3B,QAAQ,UAAU,SAAS,OAC3B,OAAO,QAAQ,UAAU,YACzB,QAAQ,MAAM,WAAW,GACzB;AACA,UAAM,sBAAsB,0CAA0C;AAAA,EACxE;AAEA,QAAM,OAAO,QAAQ,OACjB,UAAU,QAAQ,IAAI,IACtB,MAAM,uBAAuB,QAAQ;AAAA,IACnC,mBAAmB,QAAQ;AAAA,IAC3B,OAAO,QAAQ;AAAA,EACjB,CAAC;AACL,QAAM,gBAAgB,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACjE,QAAM,EAAE,SAAS,gBAAgB,IAAI,MAAM;AAAA,IACzC,QAAQ;AAAA,IACR,kBAAkB,IAAI;AAAA,IACtB;AAAA,MACE,YAAY,CAAC,GAAG,UAAU;AAAA,MAC1B;AAAA,MACA,gBAAgB;AAAA,MAChB,aAAa,IAAI,KAAK,gBAAgB,GAAI;AAAA,MAC1C;AAAA,MACA,gBAAgB,CAAC,OAAO,OAAO,OAAO,OAAO,KAAK;AAAA,IACpD;AAAA,EACF;AAEA,QAAM,WACJ,OAAO,QAAQ,QAAQ,YAAY,OAAO,QAAQ,QAAQ,WACtD,QAAQ,MAAM,QAAQ,MACtB,OAAO;AACb,MACE,OAAO,gBAAgB,QAAQ,YAC/B,gBAAgB,IAAI,WAAW,KAC/B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC7B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC7B,CAAC,OAAO,UAAU,QAAQ,GAAG,KAC5B,QAAQ,MAAiB,iBAC1B,YAAY,KACZ,WAAW,sCACX,QAAQ,QAAQ,QAAQ,OACxB,QAAQ,QAAQ,YAChB,OAAO,QAAQ,QAAQ,YACvB,QAAQ,IAAI,WAAW,KACvB,QAAQ,YAAY,0BACpB,QAAQ,eAAe,QAAQ,aAC/B,QAAQ,SAAS,eACjB,OAAO,QAAQ,gBAAgB,YAC/B,QAAQ,YAAY,WAAW,KAC/B,QAAQ,QAAQ,QAAQ,eACxB,OAAO,QAAQ,cAAc,YAC7B,QAAQ,UAAU,WAAW,KAC7B,CAAC,CAAC,eAAe,GAAG,2BAA2B,EAAE;AAAA,IAC/C,QAAQ;AAAA,EACV,KACA,CAAC,aAAa,SAAS,QAAQ,WAAgC,GAC/D;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,SAAO;AACT;","names":[]}

package/dist/embedded-admin.cjs

@@ -20,20 +20,29 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/embedded-admin/index.ts
 var embedded_admin_exports = {};
 __export(embedded_admin_exports, {
+  EMBEDDED_ADMIN_ACTION_CAPABILITY: () => EMBEDDED_ADMIN_ACTION_CAPABILITY,
+  EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION: () => EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION,
   EMBEDDED_ADMIN_APP_KEY: () => EMBEDDED_ADMIN_APP_KEY,
   EMBEDDED_ADMIN_CHALLENGE_MESSAGE: () => EMBEDDED_ADMIN_CHALLENGE_MESSAGE,
+  EMBEDDED_ADMIN_EXECUTION_AUDIENCE_PREFIX: () => EMBEDDED_ADMIN_EXECUTION_AUDIENCE_PREFIX,
+  EMBEDDED_ADMIN_MAX_ACTIONS: () => EMBEDDED_ADMIN_MAX_ACTIONS,
+  EMBEDDED_ADMIN_MAX_SELECTED_IDS: () => EMBEDDED_ADMIN_MAX_SELECTED_IDS,
   EMBEDDED_ADMIN_PROTOCOL_VERSION: () => EMBEDDED_ADMIN_PROTOCOL_VERSION,
   EMBEDDED_ADMIN_READY_MESSAGE: () => EMBEDDED_ADMIN_READY_MESSAGE,
   EMBEDDED_ADMIN_SESSION_MESSAGE: () => EMBEDDED_ADMIN_SESSION_MESSAGE,
   EMBEDDED_ADMIN_SESSION_TTL_SECONDS: () => EMBEDDED_ADMIN_SESSION_TTL_SECONDS,
   EMBEDDED_ADMIN_TENANT_ROLES: () => EMBEDDED_ADMIN_TENANT_ROLES,
+  embeddedAdminExecutionContextsEqual: () => embeddedAdminExecutionContextsEqual,
   isEmbeddedAdminChallengeMessage: () => isEmbeddedAdminChallengeMessage,
   isEmbeddedAdminReadyMessage: () => isEmbeddedAdminReadyMessage,
   isEmbeddedAdminSessionMessage: () => isEmbeddedAdminSessionMessage,
+  normalizeEmbeddedAdminActions: () => normalizeEmbeddedAdminActions,
   normalizeEmbeddedAdminAllowedRoles: () => normalizeEmbeddedAdminAllowedRoles,
   normalizeEmbeddedAdminBindingConfiguration: () => normalizeEmbeddedAdminBindingConfiguration,
   normalizeEmbeddedAdminExactOrigin: () => normalizeEmbeddedAdminExactOrigin,
+  normalizeEmbeddedAdminExecutionContext: () => normalizeEmbeddedAdminExecutionContext,
   normalizeEmbeddedAdminRelativePath: () => normalizeEmbeddedAdminRelativePath,
+  receiveEmbeddedAdminExecution: () => receiveEmbeddedAdminExecution,
   receiveEmbeddedAdminSession: () => receiveEmbeddedAdminSession
 });
 module.exports = __toCommonJS(embedded_admin_exports);
@@ -125,6 +134,7 @@ var COMMERCE_ERROR_CODES = [
   "cart_not_active",
   "cart_locked",
   "cart_empty",
+  "shipping_address_required",
   "cart_market_unavailable",
   "cart_market_mismatch",
   "checkout_not_open",
@@ -141,6 +151,7 @@ var COMMERCE_ERROR_CODES = [
   "price_changed",
   "pricing_fact_in_use",
   "insufficient_stock",
+  "credit_insufficient",
   "reservation_conflict",
   "stock_lock_unavailable",
   "variant_not_found",
@@ -219,6 +230,81 @@ var ValidationError = class extends SDKError {
 };
 var createValidationError = (message, details, userMessage, suggestion, status) => new ValidationError(message, details, userMessage, suggestion, status);
 
+// src/embedded-admin/actions.ts
+var EMBEDDED_ADMIN_EXECUTION_AUDIENCE_PREFIX = "urn:01-software:embedded-admin-execution:";
+var EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION = 2;
+var EMBEDDED_ADMIN_ACTION_CAPABILITY = "collection-actions";
+var EMBEDDED_ADMIN_MAX_ACTIONS = 20;
+var EMBEDDED_ADMIN_MAX_SELECTED_IDS = 100;
+var ACTION_ID = /^[a-z][a-z0-9_-]{0,63}$/;
+var COLLECTION = /^[a-z][a-z0-9-]{0,63}$/;
+var EXECUTION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function recordWithKeys(value, keys) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw createValidationError("Invalid embedded admin action context.");
+  }
+  const record = value;
+  if (Object.keys(record).some((key) => !keys.includes(key))) {
+    throw createValidationError("Invalid embedded admin action context.");
+  }
+  return record;
+}
+function normalizeEmbeddedAdminActions(value) {
+  if (value === void 0 || value === null) return [];
+  if (!Array.isArray(value) || value.length > EMBEDDED_ADMIN_MAX_ACTIONS) {
+    throw createValidationError("Invalid embedded admin actions.");
+  }
+  const ids = /* @__PURE__ */ new Set();
+  return value.map((value2) => {
+    const action = recordWithKeys(value2, [
+      "id",
+      "label",
+      "collection",
+      "requiresSelection"
+    ]);
+    if (typeof action.id !== "string" || !ACTION_ID.test(action.id) || ids.has(action.id) || typeof action.label !== "string" || !action.label.trim() || action.label.trim().length > 80 || typeof action.collection !== "string" || !COLLECTION.test(action.collection) || typeof action.requiresSelection !== "boolean")
+      throw createValidationError(
+        "Invalid embedded admin action configuration."
+      );
+    ids.add(action.id);
+    return {
+      id: action.id,
+      label: action.label.trim(),
+      collection: action.collection,
+      requiresSelection: action.requiresSelection
+    };
+  });
+}
+function normalizeEmbeddedAdminExecutionContext(value) {
+  const input = recordWithKeys(value, [
+    "executionId",
+    "expiresAt",
+    "actionId",
+    "collection",
+    "selectedIds"
+  ]);
+  if (typeof input.executionId !== "string" || !EXECUTION_ID.test(input.executionId) || typeof input.expiresAt !== "number" || !Number.isSafeInteger(input.expiresAt) || input.expiresAt <= 0 || typeof input.actionId !== "string" || !ACTION_ID.test(input.actionId) || typeof input.collection !== "string" || !COLLECTION.test(input.collection) || !Array.isArray(input.selectedIds) || input.selectedIds.length > EMBEDDED_ADMIN_MAX_SELECTED_IDS || input.selectedIds.some(
+    (id) => typeof id !== "string" || !id || id.length > 128 || id.trim() !== id || Array.from(id).some(
+      (character) => character.charCodeAt(0) <= 32 || character.charCodeAt(0) === 127
+    )
+  ) || new Set(input.selectedIds).size !== input.selectedIds.length)
+    throw createValidationError("Invalid embedded admin execution context.");
+  return {
+    executionId: input.executionId,
+    expiresAt: input.expiresAt,
+    actionId: input.actionId,
+    collection: input.collection,
+    selectedIds: [...input.selectedIds].sort()
+  };
+}
+function embeddedAdminExecutionContextsEqual(left, right) {
+  try {
+    return JSON.stringify(normalizeEmbeddedAdminExecutionContext(left)) === JSON.stringify(normalizeEmbeddedAdminExecutionContext(right));
+  } catch {
+    return false;
+  }
+}
+
 // src/embedded-admin/index.ts
 var EMBEDDED_ADMIN_PROTOCOL_VERSION = 1;
 var EMBEDDED_ADMIN_CHALLENGE_MESSAGE = "01.embedded-admin.challenge";
@@ -284,6 +370,9 @@ function normalizeEmbeddedAdminBindingConfiguration(value, options = {}) {
     throw createValidationError("Embedded admin binding must be an object.");
   }
   const input = value;
+  if (input.allowDownloads !== void 0 && typeof input.allowDownloads !== "boolean") {
+    throw createValidationError("allowDownloads must be a boolean.");
+  }
   const allowedRoles = normalizeEmbeddedAdminAllowedRoles(input.allowedRoles);
   if (!allowedRoles)
     throw createValidationError(
@@ -318,9 +407,11 @@ function normalizeEmbeddedAdminBindingConfiguration(value, options = {}) {
   return {
     allowedRoles,
     enabled: input.enabled !== false,
+    allowDownloads: input.allowDownloads === true,
     label,
     origin,
-    path
+    path,
+    ...input.actions === void 0 ? {} : { actions: normalizeEmbeddedAdminActions(input.actions) }
   };
 }
 function isEmbeddedAdminChallengeMessage(value) {
@@ -339,6 +430,12 @@ function isEmbeddedAdminSessionMessage(value) {
   return message.type === EMBEDDED_ADMIN_SESSION_MESSAGE && message.version === EMBEDDED_ADMIN_PROTOCOL_VERSION && typeof message.requestId === "string" && message.requestId.length >= 16 && message.requestId.length <= 128 && typeof message.token === "string" && message.token.length > 0;
 }
 function receiveEmbeddedAdminSession(options) {
+  return receiveSession(options, false);
+}
+function receiveEmbeddedAdminExecution(options) {
+  return receiveSession(options, true);
+}
+function receiveSession(options, action) {
   if (typeof window === "undefined" || window.parent === window) {
     return Promise.reject(
       createValidationError(
@@ -390,13 +487,43 @@ function receiveEmbeddedAdminSession(options) {
     };
     const abort = () => fail(new Error("Embedded admin session receipt aborted."));
     const acceptSession = (event, expectedRequestId) => {
-      if (!isEmbeddedAdminSessionMessage(event.data) || event.data.requestId !== expectedRequestId) {
-        return;
+      if (action) {
+        const message = event.data;
+        if (!message || message.type !== EMBEDDED_ADMIN_SESSION_MESSAGE || message.version !== EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION || message.requestId !== expectedRequestId || typeof message.token !== "string" || !message.token)
+          return;
+        try {
+          finish({
+            requestId: expectedRequestId,
+            token: message.token,
+            execution: normalizeEmbeddedAdminExecutionContext(
+              message.execution
+            )
+          });
+        } catch {
+          fail(new Error("Invalid embedded admin execution message."));
+        }
+      } else {
+        if (!isEmbeddedAdminSessionMessage(event.data) || event.data.requestId !== expectedRequestId)
+          return;
+        finish({ requestId: event.data.requestId, token: event.data.token });
       }
-      finish({ requestId: event.data.requestId, token: event.data.token });
     };
     const acceptChallenge = (event) => {
-      if (event.source !== window.parent || event.origin !== consoleOrigin || !isEmbeddedAdminChallengeMessage(event.data) || event.ports.length !== 1) {
+      if (event.source !== window.parent || event.origin !== consoleOrigin || event.ports.length !== 1) {
+        for (const port2 of event.ports) port2.close();
+        return;
+      }
+      const challenge = event.data;
+      const actionChallenge = challenge?.type === EMBEDDED_ADMIN_CHALLENGE_MESSAGE && challenge.version === EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION && typeof challenge.requestId === "string" && challenge.requestId.length >= 16 && challenge.requestId.length <= 128;
+      const supported = action ? actionChallenge && Array.isArray(challenge?.capabilities) && challenge.capabilities.length === 1 && challenge.capabilities[0] === EMBEDDED_ADMIN_ACTION_CAPABILITY : isEmbeddedAdminChallengeMessage(event.data);
+      if (!supported) {
+        if (actionChallenge)
+          event.ports[0].postMessage({
+            type: "01.embedded-admin.error",
+            version: 2,
+            requestId: challenge.requestId,
+            reason: "unsupported"
+          });
         for (const port2 of event.ports) port2.close();
         return;
       }
@@ -409,8 +536,9 @@ function receiveEmbeddedAdminSession(options) {
       port.start();
       port.postMessage({
         type: EMBEDDED_ADMIN_READY_MESSAGE,
-        version: EMBEDDED_ADMIN_PROTOCOL_VERSION,
-        requestId
+        version: action ? EMBEDDED_ADMIN_ACTION_PROTOCOL_VERSION : EMBEDDED_ADMIN_PROTOCOL_VERSION,
+        requestId,
+        ...action ? { capabilities: [EMBEDDED_ADMIN_ACTION_CAPABILITY] } : {}
       });
     };
     const timer = setTimeout(() => {