@kadanza/extension-sdk 0.0.6 → 0.0.7

package/README.md

@@ -45,3 +45,7 @@ npm install
 | `npm run docs`        | Generate HTML API docs under `docs/api/`             |
 | `npm run docs:check`  | Validate TypeDoc without writing output              |
 | `npm run check:types` | Check published package types with arethetypeswrong  |
+
+`npm run dev` serves the playground at `https://localhost:5000` (accept the
+self-signed certificate warning once). Use this HTTPS origin for the parent
+iframe URL and add it to the API's CORS allowlist.

package/dist/extension-sdk.cjs

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e={handshakeInit:`HANDSHAKE_INIT`,handshakeAck:`HANDSHAKE_ACK`,requestTokenRefresh:`REQUEST_TOKEN_REFRESH`,tokenRefresh:`TOKEN_REFRESH`,loadPageSettings:`LOAD_PAGE_SETTINGS`,updatePageSettings:`UPDATE_PAGE_SETTINGS`,pageSettingsUpdated:`PAGE_SETTINGS_UPDATED`};function t(e,t,n){if(!window.parent||window.parent===window)throw Error(`Extension is not running inside a parent frame.`);let r=n===void 0?{type:e}:{type:e,payload:n};window.parent.postMessage(r,t)}function n(e,t){let n=n=>{n.origin===e&&(!n.data||typeof n.data!=`object`||!(`type`in n.data)||t(n))};return window.addEventListener(`message`,n),()=>window.removeEventListener(`message`,n)}var r=new Set([`localhost`,`127.0.0.1`,`[::1]`]),i=class extends Error{constructor(e){super(e),this.name=`InvalidOriginError`}};function a(e){if(!e)throw new i(`Missing "tenantUrl" search parameter required to establish parent origin.`);let t;try{t=new URL(e)}catch{throw new i(`Invalid tenantUrl: "${e}".`)}let n=r.has(t.hostname),a=t.protocol===`https:`,o=t.protocol===`http:`&&n;if(!a&&!o)throw new i(`tenantUrl must use https (or http on localhost). Received: "${t.protocol}//${t.host}".`);return t.origin}function o(e=window.location.search){return new URLSearchParams(e).get(`tenantUrl`)}var s=1e4,c=class{#e=null;#t=null;#n=!1;#r=!1;#i=null;#a=null;#o=null;#s=null;#c=null;#l=null;#u=null;#d=new Set;#f=new Set;get isConnected(){return this.#n}async connect(r={}){if(this.#v(),this.#n&&this.#i&&this.#a&&this.#o)return{authToken:this.#i,extensionDetails:this.#a,designTokens:this.#o,pageSettings:this.#s};if(this.#c)throw Error(`Handshake already in progress.`);let i=o();this.#e=a(i),this.#t?.(),this.#t=n(this.#e,e=>this.#p(e));let c=r.timeoutMs??s,l=new Promise((e,t)=>{let n=setTimeout(()=>{this.#c=null,t(Error(`Handshake timed out after ${c}ms.`))},c);this.#c={resolve:e,reject:t,timer:n}});try{t(e.handshakeInit,this.#e)}catch(e){throw this.#b(this.#c),this.#c=null,this.#t?.(),this.#t=null,this.#e=null,e}return l}destroy(){this.#r=!0,this.#n=!1,this.#t?.(),this.#t=null,this.#e=null,this.#S(this.#c,Error(`SDK destroyed.`)),this.#S(this.#l,Error(`SDK destroyed.`)),this.#S(this.#u,Error(`SDK destroyed.`)),this.#c=null,this.#l=null,this.#u=null,this.#d.clear(),this.#f.clear(),this.#i=null,this.#a=null,this.#o=null,this.#s=null}getAuthToken(){return this.#i}getExtensionDetails(){return this.#a}getDesignTokens(){return this.#o}getPageSettings(){return this.#s}async requestTokenRefresh(n={}){if(this.#y(),this.#l)throw Error(`Token refresh already in progress.`);let r=n.timeoutMs??s,i=this.#e,a=new Promise((e,t)=>{let n=setTimeout(()=>{this.#l=null,t(Error(`Token refresh timed out after ${r}ms.`))},r);this.#l={resolve:e,reject:t,timer:n}});return t(e.requestTokenRefresh,i),a}async updatePageSettings(n,r={}){if(this.#y(),this.#u)throw Error(`Page settings update already in progress.`);let i=r.timeoutMs??s,a=this.#e,o=new Promise((e,t)=>{let n=setTimeout(()=>{this.#u=null,t(Error(`Page settings update timed out after ${i}ms.`))},i);this.#u={resolve:e,reject:t,timer:n}});return t(e.updatePageSettings,a,n),o}onLoadPageSettings(e){return this.#d.add(e),()=>{this.#d.delete(e)}}onTokenRefresh(e){return this.#f.add(e),()=>{this.#f.delete(e)}}#p(t){let{type:n,payload:r}=t.data;switch(n){case e.handshakeAck:this.#m(r);break;case e.tokenRefresh:this.#h(r);break;case e.loadPageSettings:this.#g(r);break;case e.pageSettingsUpdated:this.#_(r);break;default:break}}#m(e){if(!e?.authToken||!e.extensionDetails||!e.designTokens){this.#S(this.#c,Error(`Invalid HANDSHAKE_ACK payload.`)),this.#c=null;return}this.#i=e.authToken,this.#a=e.extensionDetails,this.#o=e.designTokens,this.#s=e.pageSettings??null,this.#n=!0;let t=this.#c;this.#c=null,this.#x(t,{authToken:this.#i,extensionDetails:this.#a,designTokens:this.#o,pageSettings:this.#s})}#h(e){if(!e?.authToken){this.#S(this.#l,Error(`Invalid TOKEN_REFRESH payload.`)),this.#l=null;return}this.#i=e.authToken;let t=this.#l;this.#l=null,this.#x(t,this.#i);for(let e of this.#f)e(this.#i)}#g(e){let t=e??{};this.#s=t;for(let e of this.#d)e(t)}#_(e){if(!e||typeof e.success!=`boolean`){this.#S(this.#u,Error(`Invalid PAGE_SETTINGS_UPDATED payload.`)),this.#u=null;return}let t=this.#u;this.#u=null,this.#x(t,e)}#v(){if(this.#r)throw Error(`SDK has been destroyed.`)}#y(){if(this.#v(),!this.#n||!this.#e)throw Error(`SDK is not connected. Call connect() first.`)}#b(e){e&&clearTimeout(e.timer)}#x(e,t){e&&(clearTimeout(e.timer),e.resolve(t))}#S(e,t){e&&(clearTimeout(e.timer),e.reject(t))}},l=()=>new c;exports.CONNECTION_EVENTS=e,exports.ExtensionSDK=c,exports.InvalidOriginError=i,exports.createExtensionSDK=l,exports.readTenantUrlFromLocation=o,exports.resolveAllowedOrigin=a;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});function e(e){if(e.startsWith(`/`))return e;let t=new URL(e);return t.hostname=`api.${t.hostname}`,t.origin}function t(t,n){if(!n.startsWith(`/`)||n.startsWith(`//`))throw Error(`API endpoint must be a root-relative path starting with a single "/".`);return`${e(t).replace(/\/+$/,``)}${n}`}async function n(e,n,r={}){let i=new Headers(r.headers);i.has(`Content-Type`)||i.set(`Content-Type`,`application/json`),i.set(`Authorization`,`Bearer ${n.token}`),i.set(`X-Tenant`,n.tenantDomain);let a=await fetch(t(n.baseUrl,e),{...r,headers:i});if(!a.ok){let e=a.statusText?` ${a.statusText}`:``;throw Error(`API call failed: ${a.status}${e}.`)}return await a.json()}var r={handshakeInit:`HANDSHAKE_INIT`,handshakeAck:`HANDSHAKE_ACK`,requestTokenRefresh:`REQUEST_TOKEN_REFRESH`,tokenRefresh:`TOKEN_REFRESH`,loadPageSettings:`LOAD_PAGE_SETTINGS`,updatePageSettings:`UPDATE_PAGE_SETTINGS`,pageSettingsUpdated:`PAGE_SETTINGS_UPDATED`,navigationChange:`NAVIGATION_CHANGE`};function i(e,t,n){if(!window.parent||window.parent===window)throw Error(`Extension is not running inside a parent frame.`);let r=n===void 0?{type:e}:{type:e,payload:n};window.parent.postMessage(r,t)}function a(e,t){let n=n=>{n.origin===e&&(!n.data||typeof n.data!=`object`||!(`type`in n.data)||t(n))};return window.addEventListener(`message`,n),()=>window.removeEventListener(`message`,n)}var o=new Set([`localhost`,`127.0.0.1`,`[::1]`]),s=class extends Error{constructor(e){super(e),this.name=`InvalidOriginError`}};function c(e){if(!e)throw new s(`Missing "tenantUrl" search parameter required to establish parent origin.`);let t;try{t=new URL(e)}catch{throw new s(`Invalid tenantUrl: "${e}".`)}let n=o.has(t.hostname),r=t.protocol===`https:`,i=t.protocol===`http:`&&n;if(!r&&!i)throw new s(`tenantUrl must use https (or http on localhost). Received: "${t.protocol}//${t.host}".`);return t.origin}function l(e=window.location.search){return new URLSearchParams(e).get(`tenantUrl`)}var u=1e4,d=12e4,f=3e4,p=2147483647,m=class{#e=null;#t=null;#n=!1;#r=!1;#i=null;#a=null;#o=null;#s=null;#c=!1;#l=d;#u=null;#d=!1;#f=null;#p=null;#m=null;#h=new Set;#g=new Set;get isConnected(){return this.#n}async connect(e={}){if(this.#S(),this.#n&&this.#i&&this.#a&&this.#o)return{authToken:this.#i,extensionDetails:this.#a,designTokens:this.#o,pageSettings:this.#s};if(this.#f)throw Error(`Handshake already in progress.`);this.#w(e);let t=l();this.#e=c(t),this.#t?.(),this.#t=a(this.#e,e=>this.#_(e));let n=e.timeoutMs??u,o=new Promise((e,t)=>{let r=setTimeout(()=>{this.#f=null,t(Error(`Handshake timed out after ${n}ms.`))},n);this.#f={resolve:e,reject:t,timer:r}});try{i(r.handshakeInit,this.#e)}catch(e){throw this.#j(this.#f),this.#f=null,this.#t?.(),this.#t=null,this.#e=null,this.#D(),e}return o}destroy(){this.#r=!0,this.#n=!1,this.#D(),this.#c=!1,this.#d=!1,this.#t?.(),this.#t=null,this.#e=null,this.#N(this.#f,Error(`SDK destroyed.`)),this.#N(this.#p,Error(`SDK destroyed.`)),this.#N(this.#m,Error(`SDK destroyed.`)),this.#f=null,this.#p=null,this.#m=null,this.#h.clear(),this.#g.clear(),this.#i=null,this.#a=null,this.#o=null,this.#s=null}getAuthToken(){return this.#i}getExtensionDetails(){return this.#a}getDesignTokens(){return this.#o}getPageSettings(){return this.#s}async apiCall(e,t={}){return this.#C(),n(e,{baseUrl:this.#a.baseUrl,tenantDomain:this.#a.tenantDomain,token:this.#i.jwt},t)}async emitRequestTokenRefresh(e={}){if(this.#C(),this.#p)throw Error(`Token refresh already in progress.`);let t=e.timeoutMs??u,n=this.#e,a=new Promise((e,n)=>{let r=setTimeout(()=>{this.#p=null,n(Error(`Token refresh timed out after ${t}ms.`))},t);this.#p={resolve:e,reject:n,timer:r}});return i(r.requestTokenRefresh,n),a}async emitUpdatePageSettings(e,t={}){if(this.#C(),this.#m)throw Error(`Page settings update already in progress.`);let n=t.timeoutMs??u,a=this.#e,o=new Promise((e,t)=>{let r=setTimeout(()=>{this.#m=null,t(Error(`Page settings update timed out after ${n}ms.`))},n);this.#m={resolve:e,reject:t,timer:r}});return i(r.updatePageSettings,a,e),o}onLoadPageSettings(e){return this.#h.add(e),()=>{this.#h.delete(e)}}onTokenRefresh(e){return this.#g.add(e),()=>{this.#g.delete(e)}}emitNavigationChange(e){this.#C(),i(r.navigationChange,this.#e,e)}#_(e){let{type:t,payload:n}=e.data;switch(t){case r.handshakeAck:this.#v(n);break;case r.tokenRefresh:this.#y(n);break;case r.loadPageSettings:this.#b(n);break;case r.pageSettingsUpdated:this.#x(n);break;default:break}}#v(e){if(!e?.authToken||!e.extensionDetails||!e.designTokens){this.#N(this.#f,Error(`Invalid HANDSHAKE_ACK payload.`)),this.#f=null;return}this.#i=e.authToken,this.#a=e.extensionDetails,this.#o=e.designTokens,this.#s=e.pageSettings??null,this.#n=!0;let t=this.#f;this.#f=null,this.#M(t,{authToken:this.#i,extensionDetails:this.#a,designTokens:this.#o,pageSettings:this.#s}),this.#d=!1,this.#O()}#y(e){if(!e?.authToken){this.#N(this.#p,Error(`Invalid TOKEN_REFRESH payload.`)),this.#p=null;return}this.#i=e.authToken;let t=this.#p;this.#p=null,this.#M(t,this.#i);for(let e of this.#g)e(this.#i);this.#d=!1,this.#O()}#b(e){let t=e??{};this.#s=t;for(let e of this.#h)e(t)}#x(e){if(!e||typeof e.success!=`boolean`){this.#N(this.#m,Error(`Invalid PAGE_SETTINGS_UPDATED payload.`)),this.#m=null;return}let t=this.#m;this.#m=null,this.#M(t,e)}#S(){if(this.#r)throw Error(`SDK has been destroyed.`)}#C(){if(this.#S(),!this.#n||!this.#e)throw Error(`SDK is not connected. Call connect() first.`)}#w(e){if(e.authTokenBufferMs!==void 0&&(!Number.isFinite(e.authTokenBufferMs)||e.authTokenBufferMs<0))throw Error(`authTokenBufferMs must be a finite non-negative number.`);this.#c=e.authTokenAutoRefresh===!0,this.#l=e.authTokenBufferMs??d,this.#d=!1,this.#D()}#T(e){let t=Number(e.expires);return Number.isFinite(t)?t*1e3:null}#E(e){let t=this.#T(e);return t===null?null:Math.max(0,t-this.#l-Date.now())}#D(){this.#u!==null&&(clearTimeout(this.#u),this.#u=null)}#O(){if(this.#D(),!this.#c||!this.#n||this.#r||!this.#i)return;let e=this.#E(this.#i);if(e===null)return;let t=Math.min(e,p);this.#u=setTimeout(()=>{this.#u=null,this.#k()},t)}async#k(){if(!this.#c||!this.#n||this.#r||!this.#i)return;let e=this.#i,t=this.#E(e);if(t!==null){if(t>0){this.#O();return}if(this.#p){this.#A(e);return}try{await this.emitRequestTokenRefresh()}catch{this.#A(e)}}}#A(e){if(!this.#c||!this.#n||this.#r||this.#i?.jwt!==e.jwt||this.#d)return;let t=this.#T(e);if(t===null)return;let n=t-Date.now();if(n<=0)return;this.#d=!0,this.#D();let r=Math.min(f,n);this.#u=setTimeout(()=>{this.#u=null,this.#k()},r)}#j(e){e&&clearTimeout(e.timer)}#M(e,t){e&&(clearTimeout(e.timer),e.resolve(t))}#N(e,t){e&&(clearTimeout(e.timer),e.reject(t))}},h=()=>new m;exports.CONNECTION_EVENTS=r,exports.ExtensionSDK=m,exports.InvalidOriginError=s,exports.createExtensionSDK=h,exports.readTenantUrlFromLocation=l,exports.resolveAllowedOrigin=c;
 //# sourceMappingURL=extension-sdk.cjs.map

package/dist/extension-sdk.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"extension-sdk.cjs","names":["#connected","#assertNotDestroyed","#authToken","#extensionDetails","#designTokens","#pageSettings","#pendingHandshake","#allowedOrigin","#unsubscribe","#onMessage","#clearPending","#destroyed","#rejectPending","#pendingTokenRefresh","#pendingPageSettingsUpdate","#loadPageSettingsHandlers","#tokenRefreshHandlers","#assertConnected","#handleHandshakeAck","#handleTokenRefresh","#handleLoadPageSettings","#handlePageSettingsUpdated","#resolvePending"],"sources":["../src/events.ts","../src/messaging.ts","../src/origin.ts","../src/ExtensionSDK.ts","../src/index.ts"],"sourcesContent":["/**\n * Wire event type strings for parent/child `postMessage` communication.\n *\n * Keys are SDK-facing names; values are the strings sent on the wire.\n * Comments mark message direction relative to the extension (child).\n */\nexport const CONNECTION_EVENTS = {\n  /** Child → parent: start handshake. */\n  handshakeInit: \"HANDSHAKE_INIT\",\n  /** Parent → child: handshake success with auth and context. */\n  handshakeAck: \"HANDSHAKE_ACK\",\n  /** Child → parent: request a new auth token. */\n  requestTokenRefresh: \"REQUEST_TOKEN_REFRESH\",\n  /** Parent → child: new auth token (reply or push). */\n  tokenRefresh: \"TOKEN_REFRESH\",\n  /** Parent → child: open/load page settings UI with values. */\n  loadPageSettings: \"LOAD_PAGE_SETTINGS\",\n  /** Child → parent: persist updated page settings. */\n  updatePageSettings: \"UPDATE_PAGE_SETTINGS\",\n  /** Parent → child: result of a page settings update. */\n  pageSettingsUpdated: \"PAGE_SETTINGS_UPDATED\",\n} as const;\n\n/** Union of all {@link CONNECTION_EVENTS} wire string values. */\nexport type ConnectionEvent =\n  (typeof CONNECTION_EVENTS)[keyof typeof CONNECTION_EVENTS];\n","import type { ConnectionEvent } from \"./events\";\nimport type { ExtensionMessage } from \"./types\";\n\nexport type MessageHandler = (event: MessageEvent<ExtensionMessage>) => void;\n\nexport function postToParent(\n  type: ConnectionEvent,\n  allowedOrigin: string,\n  payload?: unknown,\n): void {\n  if (!window.parent || window.parent === window) {\n    throw new Error(\"Extension is not running inside a parent frame.\");\n  }\n\n  const message: ExtensionMessage = payload === undefined ? { type } : { type, payload };\n  window.parent.postMessage(message, allowedOrigin);\n}\n\nexport function subscribeToParentMessages(\n  allowedOrigin: string,\n  handler: MessageHandler,\n): () => void {\n  const listener = (event: MessageEvent) => {\n    if (event.origin !== allowedOrigin) {\n      return;\n    }\n\n    if (!event.data || typeof event.data !== \"object\" || !(\"type\" in event.data)) {\n      return;\n    }\n\n    handler(event as MessageEvent<ExtensionMessage>);\n  };\n\n  window.addEventListener(\"message\", listener);\n  return () => window.removeEventListener(\"message\", listener);\n}\n","const LOCALHOST_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n\n/** Thrown when `tenantUrl` is missing or not a safe postMessage origin. */\nexport class InvalidOriginError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidOriginError\";\n  }\n}\n\n/**\n * Parses and validates a tenant URL into a postMessage-safe origin.\n * Allows https always; http only for localhost / 127.0.0.1 / [::1].\n *\n * @param tenantUrl - Absolute URL from the `tenantUrl` search param.\n * @returns Origin string suitable for `postMessage` targetOrigin.\n * @throws {InvalidOriginError} When missing, unparsable, or disallowed scheme/host.\n */\nexport function resolveAllowedOrigin(tenantUrl: string | null): string {\n  if (!tenantUrl) {\n    throw new InvalidOriginError(\n      'Missing \"tenantUrl\" search parameter required to establish parent origin.',\n    );\n  }\n\n  let url: URL;\n  try {\n    url = new URL(tenantUrl);\n  } catch {\n    throw new InvalidOriginError(`Invalid tenantUrl: \"${tenantUrl}\".`);\n  }\n\n  const isLocalhost = LOCALHOST_HOSTS.has(url.hostname);\n  const isHttps = url.protocol === \"https:\";\n  const isLocalHttp = url.protocol === \"http:\" && isLocalhost;\n\n  if (!isHttps && !isLocalHttp) {\n    throw new InvalidOriginError(\n      `tenantUrl must use https (or http on localhost). Received: \"${url.protocol}//${url.host}\".`,\n    );\n  }\n\n  return url.origin;\n}\n\n/**\n * Reads the parent-supplied `tenantUrl` from a URL search string.\n *\n * The parent must pass `tenantUrl` on the iframe `src` so\n * {@link resolveAllowedOrigin} can whitelist the parent origin.\n *\n * @param search - Query string (defaults to `window.location.search`).\n */\nexport function readTenantUrlFromLocation(\n  search: string = window.location.search,\n): string | null {\n  return new URLSearchParams(search).get(\"tenantUrl\");\n}\n","import { CONNECTION_EVENTS } from \"./events\";\nimport { postToParent, subscribeToParentMessages } from \"./messaging\";\nimport { readTenantUrlFromLocation, resolveAllowedOrigin } from \"./origin\";\nimport type {\n  ConnectOptions,\n  DesignTokens,\n  ExtensionDetails,\n  ExtensionMessage,\n  HandshakePayload,\n  PageSettings,\n  PageSettingsUpdatedPayload,\n  RequestOptions,\n  ScopedExtensionToken,\n  TokenRefreshPayload,\n} from \"./types\";\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\n/**\n * Public contract for talking to the Kadanza parent frame over `postMessage`.\n *\n * Requires a `tenantUrl` search param on the extension URL so\n * {@link connect} can validate the parent origin.\n */\nexport interface IExtensionSDK {\n  /**\n   * Establishes the parent connection and waits for `HANDSHAKE_ACK`.\n   *\n   * If already connected with cached handshake data, returns that payload\n   * without sending another init. Concurrent calls while a handshake is\n   * in progress throw.\n   *\n   * @param options - Optional handshake timeout (default 10s).\n   * @throws {InvalidOriginError} When `tenantUrl` is missing or invalid.\n   * @throws When not embedded in a parent frame, already handshaking,\n   *   destroyed, or the handshake times out / returns an invalid payload.\n   */\n  connect(options?: ConnectOptions): Promise<HandshakePayload>;\n\n  /**\n   * Tears down listeners and cached state. Rejects any in-flight requests.\n   * The instance cannot be reused after destroy.\n   */\n  destroy(): void;\n\n  /** Whether a successful handshake has completed and not been destroyed. */\n  readonly isConnected: boolean;\n\n  /** Last auth token from handshake or refresh; `null` until connected. */\n  getAuthToken(): ScopedExtensionToken | null;\n\n  /** Extension context from handshake; `null` until connected. */\n  getExtensionDetails(): ExtensionDetails | null;\n\n  /** Design tokens from handshake; `null` until connected. */\n  getDesignTokens(): DesignTokens | null;\n\n  /**\n   * Latest page settings from handshake or `LOAD_PAGE_SETTINGS`;\n   * `null` until set.\n   */\n  getPageSettings(): PageSettings | null;\n\n  /**\n   * Asks the parent for a new token and waits for `TOKEN_REFRESH`.\n   *\n   * @param options - Optional request timeout (default 10s).\n   * @throws When not connected, a refresh is already in progress,\n   *   or the request times out / returns an invalid payload.\n   */\n  requestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;\n\n  /**\n   * Pushes page settings to the parent and waits for `PAGE_SETTINGS_UPDATED`.\n   *\n   * @param settings - Settings object to send.\n   * @param options - Optional request timeout (default 10s).\n   * @throws When not connected, an update is already in progress,\n   *   or the request times out / returns an invalid payload.\n   */\n  updatePageSettings(\n    settings: PageSettings,\n    options?: RequestOptions,\n  ): Promise<PageSettingsUpdatedPayload>;\n\n  /**\n   * Registers a handler for parent-initiated `LOAD_PAGE_SETTINGS`.\n   *\n   * @returns Unsubscribe function.\n   */\n  onLoadPageSettings(handler: (settings: PageSettings) => void): () => void;\n\n  /**\n   * Registers a handler for token updates (requested or parent-pushed).\n   *\n   * @returns Unsubscribe function.\n   */\n  onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void;\n}\n\ntype Pending<T> = {\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n  timer: ReturnType<typeof setTimeout>;\n};\n\n/** Default {@link IExtensionSDK} implementation. Prefer {@link createExtensionSDK}. */\nexport class ExtensionSDK implements IExtensionSDK {\n  #allowedOrigin: string | null = null;\n  #unsubscribe: (() => void) | null = null;\n  #connected = false;\n  #destroyed = false;\n\n  #authToken: ScopedExtensionToken | null = null;\n  #extensionDetails: ExtensionDetails | null = null;\n  #designTokens: DesignTokens | null = null;\n  #pageSettings: PageSettings | null = null;\n\n  #pendingHandshake: Pending<HandshakePayload> | null = null;\n  #pendingTokenRefresh: Pending<ScopedExtensionToken> | null = null;\n  #pendingPageSettingsUpdate: Pending<PageSettingsUpdatedPayload> | null = null;\n\n  #loadPageSettingsHandlers = new Set<(settings: PageSettings) => void>();\n  #tokenRefreshHandlers = new Set<(token: ScopedExtensionToken) => void>();\n\n  get isConnected(): boolean {\n    return this.#connected;\n  }\n\n  async connect(options: ConnectOptions = {}): Promise<HandshakePayload> {\n    this.#assertNotDestroyed();\n\n    if (this.#connected && this.#authToken && this.#extensionDetails && this.#designTokens) {\n      return {\n        authToken: this.#authToken,\n        extensionDetails: this.#extensionDetails,\n        designTokens: this.#designTokens,\n        pageSettings: this.#pageSettings,\n      };\n    }\n\n    if (this.#pendingHandshake) {\n      throw new Error(\"Handshake already in progress.\");\n    }\n\n    const tenantUrl = readTenantUrlFromLocation();\n    this.#allowedOrigin = resolveAllowedOrigin(tenantUrl);\n\n    this.#unsubscribe?.();\n    this.#unsubscribe = subscribeToParentMessages(\n      this.#allowedOrigin,\n      (event) => this.#onMessage(event),\n    );\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n    const handshakePromise = new Promise<HandshakePayload>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingHandshake = null;\n        reject(new Error(`Handshake timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingHandshake = { resolve, reject, timer };\n    });\n\n    try {\n      postToParent(CONNECTION_EVENTS.handshakeInit, this.#allowedOrigin);\n    } catch (error) {\n      this.#clearPending(this.#pendingHandshake);\n      this.#pendingHandshake = null;\n      this.#unsubscribe?.();\n      this.#unsubscribe = null;\n      this.#allowedOrigin = null;\n      throw error;\n    }\n\n    return handshakePromise;\n  }\n\n  destroy(): void {\n    this.#destroyed = true;\n    this.#connected = false;\n\n    this.#unsubscribe?.();\n    this.#unsubscribe = null;\n    this.#allowedOrigin = null;\n\n    this.#rejectPending(this.#pendingHandshake, new Error(\"SDK destroyed.\"));\n    this.#rejectPending(this.#pendingTokenRefresh, new Error(\"SDK destroyed.\"));\n    this.#rejectPending(this.#pendingPageSettingsUpdate, new Error(\"SDK destroyed.\"));\n    this.#pendingHandshake = null;\n    this.#pendingTokenRefresh = null;\n    this.#pendingPageSettingsUpdate = null;\n\n    this.#loadPageSettingsHandlers.clear();\n    this.#tokenRefreshHandlers.clear();\n\n    this.#authToken = null;\n    this.#extensionDetails = null;\n    this.#designTokens = null;\n    this.#pageSettings = null;\n  }\n\n  getAuthToken(): ScopedExtensionToken | null {\n    return this.#authToken;\n  }\n\n  getExtensionDetails(): ExtensionDetails | null {\n    return this.#extensionDetails;\n  }\n\n  getDesignTokens(): DesignTokens | null {\n    return this.#designTokens;\n  }\n\n  getPageSettings(): PageSettings | null {\n    return this.#pageSettings;\n  }\n\n  async requestTokenRefresh(\n    options: RequestOptions = {},\n  ): Promise<ScopedExtensionToken> {\n    this.#assertConnected();\n\n    if (this.#pendingTokenRefresh) {\n      throw new Error(\"Token refresh already in progress.\");\n    }\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const allowedOrigin = this.#allowedOrigin!;\n\n    const promise = new Promise<ScopedExtensionToken>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingTokenRefresh = null;\n        reject(new Error(`Token refresh timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingTokenRefresh = { resolve, reject, timer };\n    });\n\n    postToParent(CONNECTION_EVENTS.requestTokenRefresh, allowedOrigin);\n    return promise;\n  }\n\n  async updatePageSettings(\n    settings: PageSettings,\n    options: RequestOptions = {},\n  ): Promise<PageSettingsUpdatedPayload> {\n    this.#assertConnected();\n\n    if (this.#pendingPageSettingsUpdate) {\n      throw new Error(\"Page settings update already in progress.\");\n    }\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const allowedOrigin = this.#allowedOrigin!;\n\n    const promise = new Promise<PageSettingsUpdatedPayload>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingPageSettingsUpdate = null;\n        reject(new Error(`Page settings update timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingPageSettingsUpdate = { resolve, reject, timer };\n    });\n\n    postToParent(CONNECTION_EVENTS.updatePageSettings, allowedOrigin, settings);\n    return promise;\n  }\n\n  onLoadPageSettings(handler: (settings: PageSettings) => void): () => void {\n    this.#loadPageSettingsHandlers.add(handler);\n    return () => {\n      this.#loadPageSettingsHandlers.delete(handler);\n    };\n  }\n\n  onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void {\n    this.#tokenRefreshHandlers.add(handler);\n    return () => {\n      this.#tokenRefreshHandlers.delete(handler);\n    };\n  }\n\n  #onMessage(event: MessageEvent<ExtensionMessage>): void {\n    const { type, payload } = event.data;\n\n    switch (type) {\n      case CONNECTION_EVENTS.handshakeAck:\n        this.#handleHandshakeAck(payload as HandshakePayload | undefined);\n        break;\n      case CONNECTION_EVENTS.tokenRefresh:\n        this.#handleTokenRefresh(payload as TokenRefreshPayload | undefined);\n        break;\n      case CONNECTION_EVENTS.loadPageSettings:\n        this.#handleLoadPageSettings(payload as PageSettings | undefined);\n        break;\n      case CONNECTION_EVENTS.pageSettingsUpdated:\n        this.#handlePageSettingsUpdated(\n          payload as PageSettingsUpdatedPayload | undefined,\n        );\n        break;\n      default:\n        break;\n    }\n  }\n\n  #handleHandshakeAck(payload: HandshakePayload | undefined): void {\n    if (!payload?.authToken || !payload.extensionDetails || !payload.designTokens) {\n      this.#rejectPending(\n        this.#pendingHandshake,\n        new Error(\"Invalid HANDSHAKE_ACK payload.\"),\n      );\n      this.#pendingHandshake = null;\n      return;\n    }\n\n    this.#authToken = payload.authToken;\n    this.#extensionDetails = payload.extensionDetails;\n    this.#designTokens = payload.designTokens;\n    this.#pageSettings = payload.pageSettings ?? null;\n    this.#connected = true;\n\n    const pending = this.#pendingHandshake;\n    this.#pendingHandshake = null;\n    this.#resolvePending(pending, {\n      authToken: this.#authToken,\n      extensionDetails: this.#extensionDetails,\n      designTokens: this.#designTokens,\n      pageSettings: this.#pageSettings,\n    });\n  }\n\n  #handleTokenRefresh(payload: TokenRefreshPayload | undefined): void {\n    if (!payload?.authToken) {\n      this.#rejectPending(\n        this.#pendingTokenRefresh,\n        new Error(\"Invalid TOKEN_REFRESH payload.\"),\n      );\n      this.#pendingTokenRefresh = null;\n      return;\n    }\n\n    this.#authToken = payload.authToken;\n\n    const pending = this.#pendingTokenRefresh;\n    this.#pendingTokenRefresh = null;\n    this.#resolvePending(pending, this.#authToken);\n\n    for (const handler of this.#tokenRefreshHandlers) {\n      handler(this.#authToken);\n    }\n  }\n\n  #handleLoadPageSettings(payload: PageSettings | undefined): void {\n    const settings = payload ?? {};\n    this.#pageSettings = settings;\n\n    for (const handler of this.#loadPageSettingsHandlers) {\n      handler(settings);\n    }\n  }\n\n  #handlePageSettingsUpdated(\n    payload: PageSettingsUpdatedPayload | undefined,\n  ): void {\n    if (!payload || typeof payload.success !== \"boolean\") {\n      this.#rejectPending(\n        this.#pendingPageSettingsUpdate,\n        new Error(\"Invalid PAGE_SETTINGS_UPDATED payload.\"),\n      );\n      this.#pendingPageSettingsUpdate = null;\n      return;\n    }\n\n    const pending = this.#pendingPageSettingsUpdate;\n    this.#pendingPageSettingsUpdate = null;\n    this.#resolvePending(pending, payload);\n  }\n\n  #assertNotDestroyed(): void {\n    if (this.#destroyed) {\n      throw new Error(\"SDK has been destroyed.\");\n    }\n  }\n\n  #assertConnected(): void {\n    this.#assertNotDestroyed();\n    if (!this.#connected || !this.#allowedOrigin) {\n      throw new Error(\"SDK is not connected. Call connect() first.\");\n    }\n  }\n\n  #clearPending(pending: { timer: ReturnType<typeof setTimeout> } | null): void {\n    if (pending) {\n      clearTimeout(pending.timer);\n    }\n  }\n\n  #resolvePending<T>(pending: Pending<T> | null, value: T): void {\n    if (!pending) {\n      return;\n    }\n    clearTimeout(pending.timer);\n    pending.resolve(value);\n  }\n\n  #rejectPending(\n    pending: { timer: ReturnType<typeof setTimeout>; reject: (reason?: unknown) => void } | null,\n    reason: unknown,\n  ): void {\n    if (!pending) {\n      return;\n    }\n    clearTimeout(pending.timer);\n    pending.reject(reason);\n  }\n}\n","import { ExtensionSDK, type IExtensionSDK } from \"./ExtensionSDK\";\n\nexport { ExtensionSDK, type IExtensionSDK } from \"./ExtensionSDK\";\nexport { CONNECTION_EVENTS, type ConnectionEvent } from \"./events\";\nexport {\n  InvalidOriginError,\n  readTenantUrlFromLocation,\n  resolveAllowedOrigin,\n} from \"./origin\";\nexport type {\n  ConnectOptions,\n  DesignTokens,\n  ExtensionDetails,\n  ExtensionMessage,\n  HandshakePayload,\n  PageSettings,\n  PageSettingsUpdatedPayload,\n  RequestOptions,\n  ScopedExtensionToken,\n  TokenRefreshPayload,\n} from \"./types\";\n\n/** Creates a new {@link IExtensionSDK} instance for the current extension frame. */\nexport const createExtensionSDK = (): IExtensionSDK => {\n  return new ExtensionSDK();\n};\n"],"mappings":"mEAMA,IAAa,EAAoB,CAE/B,cAAe,iBAEf,aAAc,gBAEd,oBAAqB,wBAErB,aAAc,gBAEd,iBAAkB,qBAElB,mBAAoB,uBAEpB,oBAAqB,uBACvB,EChBA,SAAgB,EACd,EACA,EACA,EACM,CACN,GAAI,CAAC,OAAO,QAAU,OAAO,SAAW,OACtC,MAAU,MAAM,iDAAiD,EAGnE,IAAM,EAA4B,IAAY,IAAA,GAAY,CAAE,MAAK,EAAI,CAAE,OAAM,SAAQ,EACrF,OAAO,OAAO,YAAY,EAAS,CAAa,CAClD,CAEA,SAAgB,EACd,EACA,EACY,CACZ,IAAM,EAAY,GAAwB,CACpC,EAAM,SAAW,IAIjB,CAAC,EAAM,MAAQ,OAAO,EAAM,MAAS,UAAY,EAAE,SAAU,EAAM,OAIvE,EAAQ,CAAuC,EACjD,EAGA,OADA,OAAO,iBAAiB,UAAW,CAAQ,MAC9B,OAAO,oBAAoB,UAAW,CAAQ,CAC7D,CCpCA,IAAM,EAAkB,IAAI,IAAI,CAAC,YAAa,YAAa,OAAO,CAAC,EAGtD,EAAb,cAAwC,KAAM,CAC5C,YAAY,EAAiB,CAC3B,MAAM,CAAO,EACb,KAAK,KAAO,oBACd,CACF,EAUA,SAAgB,EAAqB,EAAkC,CACrE,GAAI,CAAC,EACH,MAAM,IAAI,EACR,2EACF,EAGF,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAS,CACzB,MAAQ,CACN,MAAM,IAAI,EAAmB,uBAAuB,EAAU,GAAG,CACnE,CAEA,IAAM,EAAc,EAAgB,IAAI,EAAI,QAAQ,EAC9C,EAAU,EAAI,WAAa,SAC3B,EAAc,EAAI,WAAa,SAAW,EAEhD,GAAI,CAAC,GAAW,CAAC,EACf,MAAM,IAAI,EACR,+DAA+D,EAAI,SAAS,IAAI,EAAI,KAAK,GAC3F,EAGF,OAAO,EAAI,MACb,CAUA,SAAgB,EACd,EAAiB,OAAO,SAAS,OAClB,CACf,OAAO,IAAI,gBAAgB,CAAM,CAAC,CAAC,IAAI,WAAW,CACpD,CCzCA,IAAM,EAAqB,IA2Fd,EAAb,KAAmD,CACjD,GAAgC,KAChC,GAAoC,KACpC,GAAa,GACb,GAAa,GAEb,GAA0C,KAC1C,GAA6C,KAC7C,GAAqC,KACrC,GAAqC,KAErC,GAAsD,KACtD,GAA6D,KAC7D,GAAyE,KAEzE,GAA4B,IAAI,IAChC,GAAwB,IAAI,IAE5B,IAAI,aAAuB,CACzB,OAAO,KAAKA,EACd,CAEA,MAAM,QAAQ,EAA0B,CAAC,EAA8B,CAGrE,GAFA,KAAKC,GAAoB,EAErB,KAAKD,IAAc,KAAKE,IAAc,KAAKC,IAAqB,KAAKC,GACvE,MAAO,CACL,UAAW,KAAKF,GAChB,iBAAkB,KAAKC,GACvB,aAAc,KAAKC,GACnB,aAAc,KAAKC,EACrB,EAGF,GAAI,KAAKC,GACP,MAAU,MAAM,gCAAgC,EAGlD,IAAM,EAAY,EAA0B,EAC5C,KAAKC,GAAiB,EAAqB,CAAS,EAEpD,KAAKC,KAAe,EACpB,KAAKA,GAAe,EAClB,KAAKD,GACJ,GAAU,KAAKE,GAAW,CAAK,CAClC,EAEA,IAAM,EAAY,EAAQ,WAAa,EAEjC,EAAmB,IAAI,SAA2B,EAAS,IAAW,CAC1E,IAAM,EAAQ,eAAiB,CAC7B,KAAKH,GAAoB,KACzB,EAAW,MAAM,6BAA6B,EAAU,IAAI,CAAC,CAC/D,EAAG,CAAS,EAEZ,KAAKA,GAAoB,CAAE,UAAS,SAAQ,OAAM,CACpD,CAAC,EAED,GAAI,CACF,EAAa,EAAkB,cAAe,KAAKC,EAAc,CACnE,OAAS,EAAO,CAMd,MALA,KAAKG,GAAc,KAAKJ,EAAiB,EACzC,KAAKA,GAAoB,KACzB,KAAKE,KAAe,EACpB,KAAKA,GAAe,KACpB,KAAKD,GAAiB,KAChB,CACR,CAEA,OAAO,CACT,CAEA,SAAgB,CACd,KAAKI,GAAa,GAClB,KAAKX,GAAa,GAElB,KAAKQ,KAAe,EACpB,KAAKA,GAAe,KACpB,KAAKD,GAAiB,KAEtB,KAAKK,GAAe,KAAKN,GAAuB,MAAM,gBAAgB,CAAC,EACvE,KAAKM,GAAe,KAAKC,GAA0B,MAAM,gBAAgB,CAAC,EAC1E,KAAKD,GAAe,KAAKE,GAAgC,MAAM,gBAAgB,CAAC,EAChF,KAAKR,GAAoB,KACzB,KAAKO,GAAuB,KAC5B,KAAKC,GAA6B,KAElC,KAAKC,GAA0B,MAAM,EACrC,KAAKC,GAAsB,MAAM,EAEjC,KAAKd,GAAa,KAClB,KAAKC,GAAoB,KACzB,KAAKC,GAAgB,KACrB,KAAKC,GAAgB,IACvB,CAEA,cAA4C,CAC1C,OAAO,KAAKH,EACd,CAEA,qBAA+C,CAC7C,OAAO,KAAKC,EACd,CAEA,iBAAuC,CACrC,OAAO,KAAKC,EACd,CAEA,iBAAuC,CACrC,OAAO,KAAKC,EACd,CAEA,MAAM,oBACJ,EAA0B,CAAC,EACI,CAG/B,GAFA,KAAKY,GAAiB,EAElB,KAAKJ,GACP,MAAU,MAAM,oCAAoC,EAGtD,IAAM,EAAY,EAAQ,WAAa,EACjC,EAAgB,KAAKN,GAErB,EAAU,IAAI,SAA+B,EAAS,IAAW,CACrE,IAAM,EAAQ,eAAiB,CAC7B,KAAKM,GAAuB,KAC5B,EAAW,MAAM,iCAAiC,EAAU,IAAI,CAAC,CACnE,EAAG,CAAS,EAEZ,KAAKA,GAAuB,CAAE,UAAS,SAAQ,OAAM,CACvD,CAAC,EAGD,OADA,EAAa,EAAkB,oBAAqB,CAAa,EAC1D,CACT,CAEA,MAAM,mBACJ,EACA,EAA0B,CAAC,EACU,CAGrC,GAFA,KAAKI,GAAiB,EAElB,KAAKH,GACP,MAAU,MAAM,2CAA2C,EAG7D,IAAM,EAAY,EAAQ,WAAa,EACjC,EAAgB,KAAKP,GAErB,EAAU,IAAI,SAAqC,EAAS,IAAW,CAC3E,IAAM,EAAQ,eAAiB,CAC7B,KAAKO,GAA6B,KAClC,EAAW,MAAM,wCAAwC,EAAU,IAAI,CAAC,CAC1E,EAAG,CAAS,EAEZ,KAAKA,GAA6B,CAAE,UAAS,SAAQ,OAAM,CAC7D,CAAC,EAGD,OADA,EAAa,EAAkB,mBAAoB,EAAe,CAAQ,EACnE,CACT,CAEA,mBAAmB,EAAuD,CAExE,OADA,KAAKC,GAA0B,IAAI,CAAO,MAC7B,CACX,KAAKA,GAA0B,OAAO,CAAO,CAC/C,CACF,CAEA,eAAe,EAA4D,CAEzE,OADA,KAAKC,GAAsB,IAAI,CAAO,MACzB,CACX,KAAKA,GAAsB,OAAO,CAAO,CAC3C,CACF,CAEA,GAAW,EAA6C,CACtD,GAAM,CAAE,OAAM,WAAY,EAAM,KAEhC,OAAQ,EAAR,CACE,KAAK,EAAkB,aACrB,KAAKE,GAAoB,CAAuC,EAChE,MACF,KAAK,EAAkB,aACrB,KAAKC,GAAoB,CAA0C,EACnE,MACF,KAAK,EAAkB,iBACrB,KAAKC,GAAwB,CAAmC,EAChE,MACF,KAAK,EAAkB,oBACrB,KAAKC,GACH,CACF,EACA,MACF,QACE,KACJ,CACF,CAEA,GAAoB,EAA6C,CAC/D,GAAI,CAAC,GAAS,WAAa,CAAC,EAAQ,kBAAoB,CAAC,EAAQ,aAAc,CAC7E,KAAKT,GACH,KAAKN,GACD,MAAM,gCAAgC,CAC5C,EACA,KAAKA,GAAoB,KACzB,MACF,CAEA,KAAKJ,GAAa,EAAQ,UAC1B,KAAKC,GAAoB,EAAQ,iBACjC,KAAKC,GAAgB,EAAQ,aAC7B,KAAKC,GAAgB,EAAQ,cAAgB,KAC7C,KAAKL,GAAa,GAElB,IAAM,EAAU,KAAKM,GACrB,KAAKA,GAAoB,KACzB,KAAKgB,GAAgB,EAAS,CAC5B,UAAW,KAAKpB,GAChB,iBAAkB,KAAKC,GACvB,aAAc,KAAKC,GACnB,aAAc,KAAKC,EACrB,CAAC,CACH,CAEA,GAAoB,EAAgD,CAClE,GAAI,CAAC,GAAS,UAAW,CACvB,KAAKO,GACH,KAAKC,GACD,MAAM,gCAAgC,CAC5C,EACA,KAAKA,GAAuB,KAC5B,MACF,CAEA,KAAKX,GAAa,EAAQ,UAE1B,IAAM,EAAU,KAAKW,GACrB,KAAKA,GAAuB,KAC5B,KAAKS,GAAgB,EAAS,KAAKpB,EAAU,EAE7C,IAAK,IAAM,KAAW,KAAKc,GACzB,EAAQ,KAAKd,EAAU,CAE3B,CAEA,GAAwB,EAAyC,CAC/D,IAAM,EAAW,GAAW,CAAC,EAC7B,KAAKG,GAAgB,EAErB,IAAK,IAAM,KAAW,KAAKU,GACzB,EAAQ,CAAQ,CAEpB,CAEA,GACE,EACM,CACN,GAAI,CAAC,GAAW,OAAO,EAAQ,SAAY,UAAW,CACpD,KAAKH,GACH,KAAKE,GACD,MAAM,wCAAwC,CACpD,EACA,KAAKA,GAA6B,KAClC,MACF,CAEA,IAAM,EAAU,KAAKA,GACrB,KAAKA,GAA6B,KAClC,KAAKQ,GAAgB,EAAS,CAAO,CACvC,CAEA,IAA4B,CAC1B,GAAI,KAAKX,GACP,MAAU,MAAM,yBAAyB,CAE7C,CAEA,IAAyB,CAEvB,GADA,KAAKV,GAAoB,EACrB,CAAC,KAAKD,IAAc,CAAC,KAAKO,GAC5B,MAAU,MAAM,6CAA6C,CAEjE,CAEA,GAAc,EAAgE,CACxE,GACF,aAAa,EAAQ,KAAK,CAE9B,CAEA,GAAmB,EAA4B,EAAgB,CACxD,IAGL,aAAa,EAAQ,KAAK,EAC1B,EAAQ,QAAQ,CAAK,EACvB,CAEA,GACE,EACA,EACM,CACD,IAGL,aAAa,EAAQ,KAAK,EAC1B,EAAQ,OAAO,CAAM,EACvB,CACF,EC1Ya,MACJ,IAAI"}
+{"version":3,"file":"extension-sdk.cjs","names":["#connected","#assertNotDestroyed","#authToken","#extensionDetails","#designTokens","#pageSettings","#pendingHandshake","#configureAuthTokenAutoRefresh","#allowedOrigin","#unsubscribe","#onMessage","#clearPending","#clearProactiveTokenRefreshTimer","#destroyed","#authTokenAutoRefresh","#authTokenRefreshRetryUsed","#rejectPending","#pendingTokenRefresh","#pendingPageSettingsUpdate","#loadPageSettingsHandlers","#tokenRefreshHandlers","#assertConnected","#handleHandshakeAck","#handleTokenRefresh","#handleLoadPageSettings","#handlePageSettingsUpdated","#resolvePending","#scheduleProactiveTokenRefresh","#authTokenBufferMs","#parseExpiresAtMs","#authTokenRefreshTimer","#getProactiveRefreshDelayMs","#runProactiveTokenRefresh","#handleProactiveRefreshFailure"],"sources":["../src/api.ts","../src/events.ts","../src/messaging.ts","../src/origin.ts","../src/ExtensionSDK.ts","../src/index.ts"],"sourcesContent":["interface ApiRequestContext {\n  baseUrl: string;\n  tenantDomain: string;\n  token: string;\n}\n\nfunction deriveApiUrl(baseUrl: string): string {\n  if (baseUrl.startsWith(\"/\")) {\n    return baseUrl;\n  }\n\n  const url = new URL(baseUrl);\n  url.hostname = `api.${url.hostname}`;\n  return url.origin;\n}\n\nfunction resolveApiEndpoint(baseUrl: string, endpoint: string): string {\n  if (!endpoint.startsWith(\"/\") || endpoint.startsWith(\"//\")) {\n    throw new Error(\n      'API endpoint must be a root-relative path starting with a single \"/\".',\n    );\n  }\n\n  return `${deriveApiUrl(baseUrl).replace(/\\/+$/, \"\")}${endpoint}`;\n}\n\nexport async function callApi<T>(\n  endpoint: string,\n  context: ApiRequestContext,\n  options: RequestInit = {},\n): Promise<T> {\n  const headers = new Headers(options.headers);\n\n  if (!headers.has(\"Content-Type\")) {\n    headers.set(\"Content-Type\", \"application/json\");\n  }\n\n  headers.set(\"Authorization\", `Bearer ${context.token}`);\n  headers.set(\"X-Tenant\", context.tenantDomain);\n\n  const response = await fetch(resolveApiEndpoint(context.baseUrl, endpoint), {\n    ...options,\n    headers,\n  });\n\n  if (!response.ok) {\n    const statusText = response.statusText ? ` ${response.statusText}` : \"\";\n    throw new Error(`API call failed: ${response.status}${statusText}.`);\n  }\n\n  return (await response.json()) as T;\n}\n","/**\n * Wire event type strings for parent/child `postMessage` communication.\n *\n * Keys are SDK-facing names; values are the strings sent on the wire.\n * Comments mark message direction relative to the extension (child).\n */\nexport const CONNECTION_EVENTS = {\n  /** Child → parent: start handshake. */\n  handshakeInit: \"HANDSHAKE_INIT\",\n  /** Parent → child: handshake success with auth and context. */\n  handshakeAck: \"HANDSHAKE_ACK\",\n  /** Child → parent: request a new auth token. */\n  requestTokenRefresh: \"REQUEST_TOKEN_REFRESH\",\n  /** Parent → child: new auth token (reply or push). */\n  tokenRefresh: \"TOKEN_REFRESH\",\n  /** Parent → child: open/load page settings UI with values. */\n  loadPageSettings: \"LOAD_PAGE_SETTINGS\",\n  /** Child → parent: persist updated page settings. */\n  updatePageSettings: \"UPDATE_PAGE_SETTINGS\",\n  /** Parent → child: result of a page settings update. */\n  pageSettingsUpdated: \"PAGE_SETTINGS_UPDATED\",\n  /** Child → parent: extension route changed. */\n  navigationChange: \"NAVIGATION_CHANGE\",\n} as const;\n\n/** Union of all {@link CONNECTION_EVENTS} wire string values. */\nexport type ConnectionEvent =\n  (typeof CONNECTION_EVENTS)[keyof typeof CONNECTION_EVENTS];\n","import type { ConnectionEvent } from \"./events\";\nimport type { ExtensionMessage } from \"./types\";\n\nexport type MessageHandler = (event: MessageEvent<ExtensionMessage>) => void;\n\nexport function postToParent(\n  type: ConnectionEvent,\n  allowedOrigin: string,\n  payload?: unknown,\n): void {\n  if (!window.parent || window.parent === window) {\n    throw new Error(\"Extension is not running inside a parent frame.\");\n  }\n\n  const message: ExtensionMessage = payload === undefined ? { type } : { type, payload };\n  window.parent.postMessage(message, allowedOrigin);\n}\n\nexport function subscribeToParentMessages(\n  allowedOrigin: string,\n  handler: MessageHandler,\n): () => void {\n  const listener = (event: MessageEvent) => {\n    if (event.origin !== allowedOrigin) {\n      return;\n    }\n\n    if (!event.data || typeof event.data !== \"object\" || !(\"type\" in event.data)) {\n      return;\n    }\n\n    handler(event as MessageEvent<ExtensionMessage>);\n  };\n\n  window.addEventListener(\"message\", listener);\n  return () => window.removeEventListener(\"message\", listener);\n}\n","const LOCALHOST_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n\n/** Thrown when `tenantUrl` is missing or not a safe postMessage origin. */\nexport class InvalidOriginError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidOriginError\";\n  }\n}\n\n/**\n * Parses and validates a tenant URL into a postMessage-safe origin.\n * Allows https always; http only for localhost / 127.0.0.1 / [::1].\n *\n * @param tenantUrl - Absolute URL from the `tenantUrl` search param.\n * @returns Origin string suitable for `postMessage` targetOrigin.\n * @throws {InvalidOriginError} When missing, unparsable, or disallowed scheme/host.\n */\nexport function resolveAllowedOrigin(tenantUrl: string | null): string {\n  if (!tenantUrl) {\n    throw new InvalidOriginError(\n      'Missing \"tenantUrl\" search parameter required to establish parent origin.',\n    );\n  }\n\n  let url: URL;\n  try {\n    url = new URL(tenantUrl);\n  } catch {\n    throw new InvalidOriginError(`Invalid tenantUrl: \"${tenantUrl}\".`);\n  }\n\n  const isLocalhost = LOCALHOST_HOSTS.has(url.hostname);\n  const isHttps = url.protocol === \"https:\";\n  const isLocalHttp = url.protocol === \"http:\" && isLocalhost;\n\n  if (!isHttps && !isLocalHttp) {\n    throw new InvalidOriginError(\n      `tenantUrl must use https (or http on localhost). Received: \"${url.protocol}//${url.host}\".`,\n    );\n  }\n\n  return url.origin;\n}\n\n/**\n * Reads the parent-supplied `tenantUrl` from a URL search string.\n *\n * The parent must pass `tenantUrl` on the iframe `src` so\n * {@link resolveAllowedOrigin} can whitelist the parent origin.\n *\n * @param search - Query string (defaults to `window.location.search`).\n */\nexport function readTenantUrlFromLocation(\n  search: string = window.location.search,\n): string | null {\n  return new URLSearchParams(search).get(\"tenantUrl\");\n}\n","import { callApi } from \"./api\";\nimport { CONNECTION_EVENTS } from \"./events\";\nimport { postToParent, subscribeToParentMessages } from \"./messaging\";\nimport { readTenantUrlFromLocation, resolveAllowedOrigin } from \"./origin\";\nimport type {\n  ConnectOptions,\n  DesignTokens,\n  ExtensionDetails,\n  ExtensionMessage,\n  HandshakePayload,\n  NavigationChangePayload,\n  PageSettings,\n  PageSettingsUpdatedPayload,\n  RequestOptions,\n  ScopedExtensionToken,\n  TokenRefreshPayload,\n  UpdatePageSettingsPayload,\n} from \"./types\";\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst DEFAULT_AUTH_TOKEN_BUFFER_MS = 120_000;\nconst AUTO_REFRESH_RETRY_DELAY_MS = 30_000;\n/** Largest delay `setTimeout` can reliably use in browsers. */\nconst MAX_TIMEOUT_MS = 2_147_483_647;\n\n/**\n * Public contract for talking to the Kadanza parent frame over `postMessage`.\n *\n * Requires a `tenantUrl` search param on the extension URL so\n * {@link connect} can validate the parent origin.\n */\nexport interface IExtensionSDK {\n  /**\n   * Establishes the parent connection and waits for `HANDSHAKE_ACK`.\n   *\n   * If already connected with cached handshake data, returns that payload\n   * without sending another init. Concurrent calls while a handshake is\n   * in progress throw.\n   *\n   * Opt-in proactive refresh can be enabled with\n   * `authTokenAutoRefresh: true` (optional `authTokenBufferMs`).\n   *\n   * @param options - Handshake timeout and optional auth-token auto-refresh.\n   * @throws {InvalidOriginError} When `tenantUrl` is missing or invalid.\n   * @throws When not embedded in a parent frame, already handshaking,\n   *   destroyed, or the handshake times out / returns an invalid payload.\n   */\n  connect(options?: ConnectOptions): Promise<HandshakePayload>;\n\n  /**\n   * Tears down listeners, proactive refresh timers, and cached state.\n   * Rejects any in-flight requests. The instance cannot be reused after destroy.\n   */\n  destroy(): void;\n\n  /** Whether a successful handshake has completed and not been destroyed. */\n  readonly isConnected: boolean;\n\n  /** Last auth token from handshake or refresh; `null` until connected. */\n  getAuthToken(): ScopedExtensionToken | null;\n\n  /** Extension context from handshake; `null` until connected. */\n  getExtensionDetails(): ExtensionDetails | null;\n\n  /** Design tokens from handshake; `null` until connected. */\n  getDesignTokens(): DesignTokens | null;\n\n  /**\n   * Latest page settings from handshake or `LOAD_PAGE_SETTINGS`;\n   * `null` until set.\n   */\n  getPageSettings(): PageSettings | null;\n\n  /**\n   * Calls the Kadanza Platform API with the current connection credentials.\n   *\n   * The API origin is derived from the handshake `baseUrl`. Authorization and\n   * tenant headers are managed by the SDK and cannot be overridden.\n   *\n   * @typeParam T - Expected JSON response body.\n   * @param endpoint - Root-relative API path.\n   * @param options - Standard fetch options.\n   * @throws When not connected, the endpoint is invalid, the request fails,\n   *   or the response is not successful JSON.\n   */\n  apiCall<T>(endpoint: string, options?: RequestInit): Promise<T>;\n\n  /**\n   * Asks the parent for a new token and waits for `TOKEN_REFRESH`.\n   *\n   * @param options - Optional request timeout (default 10s).\n   * @throws When not connected, a refresh is already in progress,\n   *   or the request times out / returns an invalid payload.\n   */\n  emitRequestTokenRefresh(\n    options?: RequestOptions,\n  ): Promise<ScopedExtensionToken>;\n\n  /**\n   * Pushes page settings to the parent and waits for `PAGE_SETTINGS_UPDATED`.\n   *\n   * @param payload - Update payload containing the settings object.\n   * @param options - Optional request timeout (default 10s).\n   * @throws When not connected, an update is already in progress,\n   *   or the request times out / returns an invalid payload.\n   */\n  emitUpdatePageSettings(\n    payload: UpdatePageSettingsPayload,\n    options?: RequestOptions,\n  ): Promise<PageSettingsUpdatedPayload>;\n\n  /**\n   * Registers a handler for parent-initiated `LOAD_PAGE_SETTINGS`.\n   *\n   * @returns Unsubscribe function.\n   */\n  onLoadPageSettings(handler: (settings: PageSettings) => void): () => void;\n\n  /**\n   * Registers a handler for token updates (requested or parent-pushed).\n   *\n   * @returns Unsubscribe function.\n   */\n  onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void;\n\n  /**\n   * Notifies the parent that the extension's route changed.\n   *\n   * Wire: `NAVIGATION_CHANGE` (fire-and-forget).\n   *\n   * @param payload - Navigation change payload (`path` within the extension).\n   * @throws When not connected or destroyed.\n   */\n  emitNavigationChange(payload: NavigationChangePayload): void;\n}\n\ntype Pending<T> = {\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n  timer: ReturnType<typeof setTimeout>;\n};\n\n/** Default {@link IExtensionSDK} implementation. Prefer {@link createExtensionSDK}. */\nexport class ExtensionSDK implements IExtensionSDK {\n  #allowedOrigin: string | null = null;\n  #unsubscribe: (() => void) | null = null;\n  #connected = false;\n  #destroyed = false;\n\n  #authToken: ScopedExtensionToken | null = null;\n  #extensionDetails: ExtensionDetails | null = null;\n  #designTokens: DesignTokens | null = null;\n  #pageSettings: PageSettings | null = null;\n\n  #authTokenAutoRefresh = false;\n  #authTokenBufferMs = DEFAULT_AUTH_TOKEN_BUFFER_MS;\n  #authTokenRefreshTimer: ReturnType<typeof setTimeout> | null = null;\n  #authTokenRefreshRetryUsed = false;\n\n  #pendingHandshake: Pending<HandshakePayload> | null = null;\n  #pendingTokenRefresh: Pending<ScopedExtensionToken> | null = null;\n  #pendingPageSettingsUpdate: Pending<PageSettingsUpdatedPayload> | null = null;\n\n  #loadPageSettingsHandlers = new Set<(settings: PageSettings) => void>();\n  #tokenRefreshHandlers = new Set<(token: ScopedExtensionToken) => void>();\n\n  get isConnected(): boolean {\n    return this.#connected;\n  }\n\n  async connect(options: ConnectOptions = {}): Promise<HandshakePayload> {\n    this.#assertNotDestroyed();\n\n    if (this.#connected && this.#authToken && this.#extensionDetails && this.#designTokens) {\n      return {\n        authToken: this.#authToken,\n        extensionDetails: this.#extensionDetails,\n        designTokens: this.#designTokens,\n        pageSettings: this.#pageSettings,\n      };\n    }\n\n    if (this.#pendingHandshake) {\n      throw new Error(\"Handshake already in progress.\");\n    }\n\n    this.#configureAuthTokenAutoRefresh(options);\n\n    const tenantUrl = readTenantUrlFromLocation();\n    this.#allowedOrigin = resolveAllowedOrigin(tenantUrl);\n\n    this.#unsubscribe?.();\n    this.#unsubscribe = subscribeToParentMessages(\n      this.#allowedOrigin,\n      (event) => this.#onMessage(event),\n    );\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n    const handshakePromise = new Promise<HandshakePayload>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingHandshake = null;\n        reject(new Error(`Handshake timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingHandshake = { resolve, reject, timer };\n    });\n\n    try {\n      postToParent(CONNECTION_EVENTS.handshakeInit, this.#allowedOrigin);\n    } catch (error) {\n      this.#clearPending(this.#pendingHandshake);\n      this.#pendingHandshake = null;\n      this.#unsubscribe?.();\n      this.#unsubscribe = null;\n      this.#allowedOrigin = null;\n      this.#clearProactiveTokenRefreshTimer();\n      throw error;\n    }\n\n    return handshakePromise;\n  }\n\n  destroy(): void {\n    this.#destroyed = true;\n    this.#connected = false;\n\n    this.#clearProactiveTokenRefreshTimer();\n    this.#authTokenAutoRefresh = false;\n    this.#authTokenRefreshRetryUsed = false;\n\n    this.#unsubscribe?.();\n    this.#unsubscribe = null;\n    this.#allowedOrigin = null;\n\n    this.#rejectPending(this.#pendingHandshake, new Error(\"SDK destroyed.\"));\n    this.#rejectPending(this.#pendingTokenRefresh, new Error(\"SDK destroyed.\"));\n    this.#rejectPending(this.#pendingPageSettingsUpdate, new Error(\"SDK destroyed.\"));\n    this.#pendingHandshake = null;\n    this.#pendingTokenRefresh = null;\n    this.#pendingPageSettingsUpdate = null;\n\n    this.#loadPageSettingsHandlers.clear();\n    this.#tokenRefreshHandlers.clear();\n\n    this.#authToken = null;\n    this.#extensionDetails = null;\n    this.#designTokens = null;\n    this.#pageSettings = null;\n  }\n\n  getAuthToken(): ScopedExtensionToken | null {\n    return this.#authToken;\n  }\n\n  getExtensionDetails(): ExtensionDetails | null {\n    return this.#extensionDetails;\n  }\n\n  getDesignTokens(): DesignTokens | null {\n    return this.#designTokens;\n  }\n\n  getPageSettings(): PageSettings | null {\n    return this.#pageSettings;\n  }\n\n  async apiCall<T>(\n    endpoint: string,\n    options: RequestInit = {},\n  ): Promise<T> {\n    this.#assertConnected();\n\n    return callApi<T>(\n      endpoint,\n      {\n        baseUrl: this.#extensionDetails!.baseUrl,\n        tenantDomain: this.#extensionDetails!.tenantDomain,\n        token: this.#authToken!.jwt,\n      },\n      options,\n    );\n  }\n\n  async emitRequestTokenRefresh(\n    options: RequestOptions = {},\n  ): Promise<ScopedExtensionToken> {\n    this.#assertConnected();\n\n    if (this.#pendingTokenRefresh) {\n      throw new Error(\"Token refresh already in progress.\");\n    }\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const allowedOrigin = this.#allowedOrigin!;\n\n    const promise = new Promise<ScopedExtensionToken>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingTokenRefresh = null;\n        reject(new Error(`Token refresh timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingTokenRefresh = { resolve, reject, timer };\n    });\n\n    postToParent(CONNECTION_EVENTS.requestTokenRefresh, allowedOrigin);\n    return promise;\n  }\n\n  async emitUpdatePageSettings(\n    payload: UpdatePageSettingsPayload,\n    options: RequestOptions = {},\n  ): Promise<PageSettingsUpdatedPayload> {\n    this.#assertConnected();\n\n    if (this.#pendingPageSettingsUpdate) {\n      throw new Error(\"Page settings update already in progress.\");\n    }\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const allowedOrigin = this.#allowedOrigin!;\n\n    const promise = new Promise<PageSettingsUpdatedPayload>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingPageSettingsUpdate = null;\n        reject(new Error(`Page settings update timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingPageSettingsUpdate = { resolve, reject, timer };\n    });\n\n    postToParent(CONNECTION_EVENTS.updatePageSettings, allowedOrigin, payload);\n    return promise;\n  }\n\n  onLoadPageSettings(handler: (settings: PageSettings) => void): () => void {\n    this.#loadPageSettingsHandlers.add(handler);\n    return () => {\n      this.#loadPageSettingsHandlers.delete(handler);\n    };\n  }\n\n  onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void {\n    this.#tokenRefreshHandlers.add(handler);\n    return () => {\n      this.#tokenRefreshHandlers.delete(handler);\n    };\n  }\n\n  emitNavigationChange(payload: NavigationChangePayload): void {\n    this.#assertConnected();\n    postToParent(\n      CONNECTION_EVENTS.navigationChange,\n      this.#allowedOrigin!,\n      payload,\n    );\n  }\n\n  #onMessage(event: MessageEvent<ExtensionMessage>): void {\n    const { type, payload } = event.data;\n\n    switch (type) {\n      case CONNECTION_EVENTS.handshakeAck:\n        this.#handleHandshakeAck(payload as HandshakePayload | undefined);\n        break;\n      case CONNECTION_EVENTS.tokenRefresh:\n        this.#handleTokenRefresh(payload as TokenRefreshPayload | undefined);\n        break;\n      case CONNECTION_EVENTS.loadPageSettings:\n        this.#handleLoadPageSettings(payload as PageSettings | undefined);\n        break;\n      case CONNECTION_EVENTS.pageSettingsUpdated:\n        this.#handlePageSettingsUpdated(\n          payload as PageSettingsUpdatedPayload | undefined,\n        );\n        break;\n      default:\n        break;\n    }\n  }\n\n  #handleHandshakeAck(payload: HandshakePayload | undefined): void {\n    if (!payload?.authToken || !payload.extensionDetails || !payload.designTokens) {\n      this.#rejectPending(\n        this.#pendingHandshake,\n        new Error(\"Invalid HANDSHAKE_ACK payload.\"),\n      );\n      this.#pendingHandshake = null;\n      return;\n    }\n\n    this.#authToken = payload.authToken;\n    this.#extensionDetails = payload.extensionDetails;\n    this.#designTokens = payload.designTokens;\n    this.#pageSettings = payload.pageSettings ?? null;\n    this.#connected = true;\n\n    const pending = this.#pendingHandshake;\n    this.#pendingHandshake = null;\n    this.#resolvePending(pending, {\n      authToken: this.#authToken,\n      extensionDetails: this.#extensionDetails,\n      designTokens: this.#designTokens,\n      pageSettings: this.#pageSettings,\n    });\n\n    this.#authTokenRefreshRetryUsed = false;\n    this.#scheduleProactiveTokenRefresh();\n  }\n\n  #handleTokenRefresh(payload: TokenRefreshPayload | undefined): void {\n    if (!payload?.authToken) {\n      this.#rejectPending(\n        this.#pendingTokenRefresh,\n        new Error(\"Invalid TOKEN_REFRESH payload.\"),\n      );\n      this.#pendingTokenRefresh = null;\n      return;\n    }\n\n    this.#authToken = payload.authToken;\n\n    const pending = this.#pendingTokenRefresh;\n    this.#pendingTokenRefresh = null;\n    this.#resolvePending(pending, this.#authToken);\n\n    for (const handler of this.#tokenRefreshHandlers) {\n      handler(this.#authToken);\n    }\n\n    this.#authTokenRefreshRetryUsed = false;\n    this.#scheduleProactiveTokenRefresh();\n  }\n\n  #handleLoadPageSettings(payload: PageSettings | undefined): void {\n    const settings = payload ?? {};\n    this.#pageSettings = settings;\n\n    for (const handler of this.#loadPageSettingsHandlers) {\n      handler(settings);\n    }\n  }\n\n  #handlePageSettingsUpdated(\n    payload: PageSettingsUpdatedPayload | undefined,\n  ): void {\n    if (!payload || typeof payload.success !== \"boolean\") {\n      this.#rejectPending(\n        this.#pendingPageSettingsUpdate,\n        new Error(\"Invalid PAGE_SETTINGS_UPDATED payload.\"),\n      );\n      this.#pendingPageSettingsUpdate = null;\n      return;\n    }\n\n    const pending = this.#pendingPageSettingsUpdate;\n    this.#pendingPageSettingsUpdate = null;\n    this.#resolvePending(pending, payload);\n  }\n\n  #assertNotDestroyed(): void {\n    if (this.#destroyed) {\n      throw new Error(\"SDK has been destroyed.\");\n    }\n  }\n\n  #assertConnected(): void {\n    this.#assertNotDestroyed();\n    if (!this.#connected || !this.#allowedOrigin) {\n      throw new Error(\"SDK is not connected. Call connect() first.\");\n    }\n  }\n\n  #configureAuthTokenAutoRefresh(options: ConnectOptions): void {\n    if (options.authTokenBufferMs !== undefined) {\n      if (\n        !Number.isFinite(options.authTokenBufferMs) ||\n        options.authTokenBufferMs < 0\n      ) {\n        throw new Error(\n          \"authTokenBufferMs must be a finite non-negative number.\",\n        );\n      }\n    }\n\n    this.#authTokenAutoRefresh = options.authTokenAutoRefresh === true;\n    this.#authTokenBufferMs =\n      options.authTokenBufferMs ?? DEFAULT_AUTH_TOKEN_BUFFER_MS;\n    this.#authTokenRefreshRetryUsed = false;\n    this.#clearProactiveTokenRefreshTimer();\n  }\n\n  #parseExpiresAtMs(token: ScopedExtensionToken): number | null {\n    const expiresSec = Number(token.expires);\n    if (!Number.isFinite(expiresSec)) {\n      return null;\n    }\n    return expiresSec * 1000;\n  }\n\n  #getProactiveRefreshDelayMs(token: ScopedExtensionToken): number | null {\n    const expiresAtMs = this.#parseExpiresAtMs(token);\n    if (expiresAtMs === null) {\n      return null;\n    }\n    return Math.max(0, expiresAtMs - this.#authTokenBufferMs - Date.now());\n  }\n\n  #clearProactiveTokenRefreshTimer(): void {\n    if (this.#authTokenRefreshTimer !== null) {\n      clearTimeout(this.#authTokenRefreshTimer);\n      this.#authTokenRefreshTimer = null;\n    }\n  }\n\n  #scheduleProactiveTokenRefresh(): void {\n    this.#clearProactiveTokenRefreshTimer();\n\n    if (\n      !this.#authTokenAutoRefresh ||\n      !this.#connected ||\n      this.#destroyed ||\n      !this.#authToken\n    ) {\n      return;\n    }\n\n    const delayMs = this.#getProactiveRefreshDelayMs(this.#authToken);\n    if (delayMs === null) {\n      return;\n    }\n\n    const clampedDelay = Math.min(delayMs, MAX_TIMEOUT_MS);\n    this.#authTokenRefreshTimer = setTimeout(() => {\n      this.#authTokenRefreshTimer = null;\n      void this.#runProactiveTokenRefresh();\n    }, clampedDelay);\n  }\n\n  async #runProactiveTokenRefresh(): Promise<void> {\n    if (\n      !this.#authTokenAutoRefresh ||\n      !this.#connected ||\n      this.#destroyed ||\n      !this.#authToken\n    ) {\n      return;\n    }\n\n    const tokenAtRequest = this.#authToken;\n    const delayMs = this.#getProactiveRefreshDelayMs(tokenAtRequest);\n    if (delayMs === null) {\n      return;\n    }\n\n    if (delayMs > 0) {\n      this.#scheduleProactiveTokenRefresh();\n      return;\n    }\n\n    if (this.#pendingTokenRefresh) {\n      this.#handleProactiveRefreshFailure(tokenAtRequest);\n      return;\n    }\n\n    try {\n      await this.emitRequestTokenRefresh();\n    } catch {\n      this.#handleProactiveRefreshFailure(tokenAtRequest);\n    }\n  }\n\n  #handleProactiveRefreshFailure(tokenAtRequest: ScopedExtensionToken): void {\n    if (\n      !this.#authTokenAutoRefresh ||\n      !this.#connected ||\n      this.#destroyed ||\n      this.#authToken?.jwt !== tokenAtRequest.jwt\n    ) {\n      return;\n    }\n\n    if (this.#authTokenRefreshRetryUsed) {\n      return;\n    }\n\n    const expiresAtMs = this.#parseExpiresAtMs(tokenAtRequest);\n    if (expiresAtMs === null) {\n      return;\n    }\n\n    const remainingMs = expiresAtMs - Date.now();\n    if (remainingMs <= 0) {\n      return;\n    }\n\n    this.#authTokenRefreshRetryUsed = true;\n    this.#clearProactiveTokenRefreshTimer();\n\n    const retryDelay = Math.min(AUTO_REFRESH_RETRY_DELAY_MS, remainingMs);\n    this.#authTokenRefreshTimer = setTimeout(() => {\n      this.#authTokenRefreshTimer = null;\n      void this.#runProactiveTokenRefresh();\n    }, retryDelay);\n  }\n\n  #clearPending(pending: { timer: ReturnType<typeof setTimeout> } | null): void {\n    if (pending) {\n      clearTimeout(pending.timer);\n    }\n  }\n\n  #resolvePending<T>(pending: Pending<T> | null, value: T): void {\n    if (!pending) {\n      return;\n    }\n    clearTimeout(pending.timer);\n    pending.resolve(value);\n  }\n\n  #rejectPending(\n    pending: { timer: ReturnType<typeof setTimeout>; reject: (reason?: unknown) => void } | null,\n    reason: unknown,\n  ): void {\n    if (!pending) {\n      return;\n    }\n    clearTimeout(pending.timer);\n    pending.reject(reason);\n  }\n}\n","import { ExtensionSDK, type IExtensionSDK } from \"./ExtensionSDK\";\n\nexport { ExtensionSDK, type IExtensionSDK } from \"./ExtensionSDK\";\nexport { CONNECTION_EVENTS, type ConnectionEvent } from \"./events\";\nexport {\n  InvalidOriginError,\n  readTenantUrlFromLocation,\n  resolveAllowedOrigin,\n} from \"./origin\";\nexport type {\n  ConnectOptions,\n  DesignTokens,\n  ExtensionDetails,\n  ExtensionMessage,\n  HandshakePayload,\n  NavigationChangePayload,\n  PageSettings,\n  PageSettingsUpdatedPayload,\n  RequestOptions,\n  ScopedExtensionToken,\n  TokenRefreshPayload,\n  UpdatePageSettingsPayload,\n} from \"./types\";\n\n/** Creates a new {@link IExtensionSDK} instance for the current extension frame. */\nexport const createExtensionSDK = (): IExtensionSDK => {\n  return new ExtensionSDK();\n};\n"],"mappings":"mEAMA,SAAS,EAAa,EAAyB,CAC7C,GAAI,EAAQ,WAAW,GAAG,EACxB,OAAO,EAGT,IAAM,EAAM,IAAI,IAAI,CAAO,EAE3B,MADA,GAAI,SAAW,OAAO,EAAI,WACnB,EAAI,MACb,CAEA,SAAS,EAAmB,EAAiB,EAA0B,CACrE,GAAI,CAAC,EAAS,WAAW,GAAG,GAAK,EAAS,WAAW,IAAI,EACvD,MAAU,MACR,uEACF,EAGF,MAAO,GAAG,EAAa,CAAO,CAAC,CAAC,QAAQ,OAAQ,EAAE,IAAI,GACxD,CAEA,eAAsB,EACpB,EACA,EACA,EAAuB,CAAC,EACZ,CACZ,IAAM,EAAU,IAAI,QAAQ,EAAQ,OAAO,EAEtC,EAAQ,IAAI,cAAc,GAC7B,EAAQ,IAAI,eAAgB,kBAAkB,EAGhD,EAAQ,IAAI,gBAAiB,UAAU,EAAQ,OAAO,EACtD,EAAQ,IAAI,WAAY,EAAQ,YAAY,EAE5C,IAAM,EAAW,MAAM,MAAM,EAAmB,EAAQ,QAAS,CAAQ,EAAG,CAC1E,GAAG,EACH,SACF,CAAC,EAED,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAa,EAAS,WAAa,IAAI,EAAS,aAAe,GACrE,MAAU,MAAM,oBAAoB,EAAS,SAAS,EAAW,EAAE,CACrE,CAEA,OAAQ,MAAM,EAAS,KAAK,CAC9B,CC7CA,IAAa,EAAoB,CAE/B,cAAe,iBAEf,aAAc,gBAEd,oBAAqB,wBAErB,aAAc,gBAEd,iBAAkB,qBAElB,mBAAoB,uBAEpB,oBAAqB,wBAErB,iBAAkB,mBACpB,EClBA,SAAgB,EACd,EACA,EACA,EACM,CACN,GAAI,CAAC,OAAO,QAAU,OAAO,SAAW,OACtC,MAAU,MAAM,iDAAiD,EAGnE,IAAM,EAA4B,IAAY,IAAA,GAAY,CAAE,MAAK,EAAI,CAAE,OAAM,SAAQ,EACrF,OAAO,OAAO,YAAY,EAAS,CAAa,CAClD,CAEA,SAAgB,EACd,EACA,EACY,CACZ,IAAM,EAAY,GAAwB,CACpC,EAAM,SAAW,IAIjB,CAAC,EAAM,MAAQ,OAAO,EAAM,MAAS,UAAY,EAAE,SAAU,EAAM,OAIvE,EAAQ,CAAuC,EACjD,EAGA,OADA,OAAO,iBAAiB,UAAW,CAAQ,MAC9B,OAAO,oBAAoB,UAAW,CAAQ,CAC7D,CCpCA,IAAM,EAAkB,IAAI,IAAI,CAAC,YAAa,YAAa,OAAO,CAAC,EAGtD,EAAb,cAAwC,KAAM,CAC5C,YAAY,EAAiB,CAC3B,MAAM,CAAO,EACb,KAAK,KAAO,oBACd,CACF,EAUA,SAAgB,EAAqB,EAAkC,CACrE,GAAI,CAAC,EACH,MAAM,IAAI,EACR,2EACF,EAGF,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAS,CACzB,MAAQ,CACN,MAAM,IAAI,EAAmB,uBAAuB,EAAU,GAAG,CACnE,CAEA,IAAM,EAAc,EAAgB,IAAI,EAAI,QAAQ,EAC9C,EAAU,EAAI,WAAa,SAC3B,EAAc,EAAI,WAAa,SAAW,EAEhD,GAAI,CAAC,GAAW,CAAC,EACf,MAAM,IAAI,EACR,+DAA+D,EAAI,SAAS,IAAI,EAAI,KAAK,GAC3F,EAGF,OAAO,EAAI,MACb,CAUA,SAAgB,EACd,EAAiB,OAAO,SAAS,OAClB,CACf,OAAO,IAAI,gBAAgB,CAAM,CAAC,CAAC,IAAI,WAAW,CACpD,CCtCA,IAAM,EAAqB,IACrB,EAA+B,KAC/B,EAA8B,IAE9B,EAAiB,WAwHV,EAAb,KAAmD,CACjD,GAAgC,KAChC,GAAoC,KACpC,GAAa,GACb,GAAa,GAEb,GAA0C,KAC1C,GAA6C,KAC7C,GAAqC,KACrC,GAAqC,KAErC,GAAwB,GACxB,GAAqB,EACrB,GAA+D,KAC/D,GAA6B,GAE7B,GAAsD,KACtD,GAA6D,KAC7D,GAAyE,KAEzE,GAA4B,IAAI,IAChC,GAAwB,IAAI,IAE5B,IAAI,aAAuB,CACzB,OAAO,KAAKA,EACd,CAEA,MAAM,QAAQ,EAA0B,CAAC,EAA8B,CAGrE,GAFA,KAAKC,GAAoB,EAErB,KAAKD,IAAc,KAAKE,IAAc,KAAKC,IAAqB,KAAKC,GACvE,MAAO,CACL,UAAW,KAAKF,GAChB,iBAAkB,KAAKC,GACvB,aAAc,KAAKC,GACnB,aAAc,KAAKC,EACrB,EAGF,GAAI,KAAKC,GACP,MAAU,MAAM,gCAAgC,EAGlD,KAAKC,GAA+B,CAAO,EAE3C,IAAM,EAAY,EAA0B,EAC5C,KAAKC,GAAiB,EAAqB,CAAS,EAEpD,KAAKC,KAAe,EACpB,KAAKA,GAAe,EAClB,KAAKD,GACJ,GAAU,KAAKE,GAAW,CAAK,CAClC,EAEA,IAAM,EAAY,EAAQ,WAAa,EAEjC,EAAmB,IAAI,SAA2B,EAAS,IAAW,CAC1E,IAAM,EAAQ,eAAiB,CAC7B,KAAKJ,GAAoB,KACzB,EAAW,MAAM,6BAA6B,EAAU,IAAI,CAAC,CAC/D,EAAG,CAAS,EAEZ,KAAKA,GAAoB,CAAE,UAAS,SAAQ,OAAM,CACpD,CAAC,EAED,GAAI,CACF,EAAa,EAAkB,cAAe,KAAKE,EAAc,CACnE,OAAS,EAAO,CAOd,MANA,KAAKG,GAAc,KAAKL,EAAiB,EACzC,KAAKA,GAAoB,KACzB,KAAKG,KAAe,EACpB,KAAKA,GAAe,KACpB,KAAKD,GAAiB,KACtB,KAAKI,GAAiC,EAChC,CACR,CAEA,OAAO,CACT,CAEA,SAAgB,CACd,KAAKC,GAAa,GAClB,KAAKb,GAAa,GAElB,KAAKY,GAAiC,EACtC,KAAKE,GAAwB,GAC7B,KAAKC,GAA6B,GAElC,KAAKN,KAAe,EACpB,KAAKA,GAAe,KACpB,KAAKD,GAAiB,KAEtB,KAAKQ,GAAe,KAAKV,GAAuB,MAAM,gBAAgB,CAAC,EACvE,KAAKU,GAAe,KAAKC,GAA0B,MAAM,gBAAgB,CAAC,EAC1E,KAAKD,GAAe,KAAKE,GAAgC,MAAM,gBAAgB,CAAC,EAChF,KAAKZ,GAAoB,KACzB,KAAKW,GAAuB,KAC5B,KAAKC,GAA6B,KAElC,KAAKC,GAA0B,MAAM,EACrC,KAAKC,GAAsB,MAAM,EAEjC,KAAKlB,GAAa,KAClB,KAAKC,GAAoB,KACzB,KAAKC,GAAgB,KACrB,KAAKC,GAAgB,IACvB,CAEA,cAA4C,CAC1C,OAAO,KAAKH,EACd,CAEA,qBAA+C,CAC7C,OAAO,KAAKC,EACd,CAEA,iBAAuC,CACrC,OAAO,KAAKC,EACd,CAEA,iBAAuC,CACrC,OAAO,KAAKC,EACd,CAEA,MAAM,QACJ,EACA,EAAuB,CAAC,EACZ,CAGZ,OAFA,KAAKgB,GAAiB,EAEf,EACL,EACA,CACE,QAAS,KAAKlB,GAAmB,QACjC,aAAc,KAAKA,GAAmB,aACtC,MAAO,KAAKD,GAAY,GAC1B,EACA,CACF,CACF,CAEA,MAAM,wBACJ,EAA0B,CAAC,EACI,CAG/B,GAFA,KAAKmB,GAAiB,EAElB,KAAKJ,GACP,MAAU,MAAM,oCAAoC,EAGtD,IAAM,EAAY,EAAQ,WAAa,EACjC,EAAgB,KAAKT,GAErB,EAAU,IAAI,SAA+B,EAAS,IAAW,CACrE,IAAM,EAAQ,eAAiB,CAC7B,KAAKS,GAAuB,KAC5B,EAAW,MAAM,iCAAiC,EAAU,IAAI,CAAC,CACnE,EAAG,CAAS,EAEZ,KAAKA,GAAuB,CAAE,UAAS,SAAQ,OAAM,CACvD,CAAC,EAGD,OADA,EAAa,EAAkB,oBAAqB,CAAa,EAC1D,CACT,CAEA,MAAM,uBACJ,EACA,EAA0B,CAAC,EACU,CAGrC,GAFA,KAAKI,GAAiB,EAElB,KAAKH,GACP,MAAU,MAAM,2CAA2C,EAG7D,IAAM,EAAY,EAAQ,WAAa,EACjC,EAAgB,KAAKV,GAErB,EAAU,IAAI,SAAqC,EAAS,IAAW,CAC3E,IAAM,EAAQ,eAAiB,CAC7B,KAAKU,GAA6B,KAClC,EAAW,MAAM,wCAAwC,EAAU,IAAI,CAAC,CAC1E,EAAG,CAAS,EAEZ,KAAKA,GAA6B,CAAE,UAAS,SAAQ,OAAM,CAC7D,CAAC,EAGD,OADA,EAAa,EAAkB,mBAAoB,EAAe,CAAO,EAClE,CACT,CAEA,mBAAmB,EAAuD,CAExE,OADA,KAAKC,GAA0B,IAAI,CAAO,MAC7B,CACX,KAAKA,GAA0B,OAAO,CAAO,CAC/C,CACF,CAEA,eAAe,EAA4D,CAEzE,OADA,KAAKC,GAAsB,IAAI,CAAO,MACzB,CACX,KAAKA,GAAsB,OAAO,CAAO,CAC3C,CACF,CAEA,qBAAqB,EAAwC,CAC3D,KAAKC,GAAiB,EACtB,EACE,EAAkB,iBAClB,KAAKb,GACL,CACF,CACF,CAEA,GAAW,EAA6C,CACtD,GAAM,CAAE,OAAM,WAAY,EAAM,KAEhC,OAAQ,EAAR,CACE,KAAK,EAAkB,aACrB,KAAKc,GAAoB,CAAuC,EAChE,MACF,KAAK,EAAkB,aACrB,KAAKC,GAAoB,CAA0C,EACnE,MACF,KAAK,EAAkB,iBACrB,KAAKC,GAAwB,CAAmC,EAChE,MACF,KAAK,EAAkB,oBACrB,KAAKC,GACH,CACF,EACA,MACF,QACE,KACJ,CACF,CAEA,GAAoB,EAA6C,CAC/D,GAAI,CAAC,GAAS,WAAa,CAAC,EAAQ,kBAAoB,CAAC,EAAQ,aAAc,CAC7E,KAAKT,GACH,KAAKV,GACD,MAAM,gCAAgC,CAC5C,EACA,KAAKA,GAAoB,KACzB,MACF,CAEA,KAAKJ,GAAa,EAAQ,UAC1B,KAAKC,GAAoB,EAAQ,iBACjC,KAAKC,GAAgB,EAAQ,aAC7B,KAAKC,GAAgB,EAAQ,cAAgB,KAC7C,KAAKL,GAAa,GAElB,IAAM,EAAU,KAAKM,GACrB,KAAKA,GAAoB,KACzB,KAAKoB,GAAgB,EAAS,CAC5B,UAAW,KAAKxB,GAChB,iBAAkB,KAAKC,GACvB,aAAc,KAAKC,GACnB,aAAc,KAAKC,EACrB,CAAC,EAED,KAAKU,GAA6B,GAClC,KAAKY,GAA+B,CACtC,CAEA,GAAoB,EAAgD,CAClE,GAAI,CAAC,GAAS,UAAW,CACvB,KAAKX,GACH,KAAKC,GACD,MAAM,gCAAgC,CAC5C,EACA,KAAKA,GAAuB,KAC5B,MACF,CAEA,KAAKf,GAAa,EAAQ,UAE1B,IAAM,EAAU,KAAKe,GACrB,KAAKA,GAAuB,KAC5B,KAAKS,GAAgB,EAAS,KAAKxB,EAAU,EAE7C,IAAK,IAAM,KAAW,KAAKkB,GACzB,EAAQ,KAAKlB,EAAU,EAGzB,KAAKa,GAA6B,GAClC,KAAKY,GAA+B,CACtC,CAEA,GAAwB,EAAyC,CAC/D,IAAM,EAAW,GAAW,CAAC,EAC7B,KAAKtB,GAAgB,EAErB,IAAK,IAAM,KAAW,KAAKc,GACzB,EAAQ,CAAQ,CAEpB,CAEA,GACE,EACM,CACN,GAAI,CAAC,GAAW,OAAO,EAAQ,SAAY,UAAW,CACpD,KAAKH,GACH,KAAKE,GACD,MAAM,wCAAwC,CACpD,EACA,KAAKA,GAA6B,KAClC,MACF,CAEA,IAAM,EAAU,KAAKA,GACrB,KAAKA,GAA6B,KAClC,KAAKQ,GAAgB,EAAS,CAAO,CACvC,CAEA,IAA4B,CAC1B,GAAI,KAAKb,GACP,MAAU,MAAM,yBAAyB,CAE7C,CAEA,IAAyB,CAEvB,GADA,KAAKZ,GAAoB,EACrB,CAAC,KAAKD,IAAc,CAAC,KAAKQ,GAC5B,MAAU,MAAM,6CAA6C,CAEjE,CAEA,GAA+B,EAA+B,CAC5D,GAAI,EAAQ,oBAAsB,IAAA,KAE9B,CAAC,OAAO,SAAS,EAAQ,iBAAiB,GAC1C,EAAQ,kBAAoB,GAE5B,MAAU,MACR,yDACF,EAIJ,KAAKM,GAAwB,EAAQ,uBAAyB,GAC9D,KAAKc,GACH,EAAQ,mBAAqB,EAC/B,KAAKb,GAA6B,GAClC,KAAKH,GAAiC,CACxC,CAEA,GAAkB,EAA4C,CAC5D,IAAM,EAAa,OAAO,EAAM,OAAO,EAIvC,OAHK,OAAO,SAAS,CAAU,EAGxB,EAAa,IAFX,IAGX,CAEA,GAA4B,EAA4C,CACtE,IAAM,EAAc,KAAKiB,GAAkB,CAAK,EAIhD,OAHI,IAAgB,KACX,KAEF,KAAK,IAAI,EAAG,EAAc,KAAKD,GAAqB,KAAK,IAAI,CAAC,CACvE,CAEA,IAAyC,CACnC,KAAKE,KAA2B,OAClC,aAAa,KAAKA,EAAsB,EACxC,KAAKA,GAAyB,KAElC,CAEA,IAAuC,CAGrC,GAFA,KAAKlB,GAAiC,EAGpC,CAAC,KAAKE,IACN,CAAC,KAAKd,IACN,KAAKa,IACL,CAAC,KAAKX,GAEN,OAGF,IAAM,EAAU,KAAK6B,GAA4B,KAAK7B,EAAU,EAChE,GAAI,IAAY,KACd,OAGF,IAAM,EAAe,KAAK,IAAI,EAAS,CAAc,EACrD,KAAK4B,GAAyB,eAAiB,CAC7C,KAAKA,GAAyB,KAC9B,KAAUE,GAA0B,CACtC,EAAG,CAAY,CACjB,CAEA,KAAMA,IAA2C,CAC/C,GACE,CAAC,KAAKlB,IACN,CAAC,KAAKd,IACN,KAAKa,IACL,CAAC,KAAKX,GAEN,OAGF,IAAM,EAAiB,KAAKA,GACtB,EAAU,KAAK6B,GAA4B,CAAc,EAC3D,OAAY,KAIhB,IAAI,EAAU,EAAG,CACf,KAAKJ,GAA+B,EACpC,MACF,CAEA,GAAI,KAAKV,GAAsB,CAC7B,KAAKgB,GAA+B,CAAc,EAClD,MACF,CAEA,GAAI,CACF,MAAM,KAAK,wBAAwB,CACrC,MAAQ,CACN,KAAKA,GAA+B,CAAc,CACpD,CAXA,CAYF,CAEA,GAA+B,EAA4C,CAUzE,GARE,CAAC,KAAKnB,IACN,CAAC,KAAKd,IACN,KAAKa,IACL,KAAKX,IAAY,MAAQ,EAAe,KAKtC,KAAKa,GACP,OAGF,IAAM,EAAc,KAAKc,GAAkB,CAAc,EACzD,GAAI,IAAgB,KAClB,OAGF,IAAM,EAAc,EAAc,KAAK,IAAI,EAC3C,GAAI,GAAe,EACjB,OAGF,KAAKd,GAA6B,GAClC,KAAKH,GAAiC,EAEtC,IAAM,EAAa,KAAK,IAAI,EAA6B,CAAW,EACpE,KAAKkB,GAAyB,eAAiB,CAC7C,KAAKA,GAAyB,KAC9B,KAAUE,GAA0B,CACtC,EAAG,CAAU,CACf,CAEA,GAAc,EAAgE,CACxE,GACF,aAAa,EAAQ,KAAK,CAE9B,CAEA,GAAmB,EAA4B,EAAgB,CACxD,IAGL,aAAa,EAAQ,KAAK,EAC1B,EAAQ,QAAQ,CAAK,EACvB,CAEA,GACE,EACA,EACM,CACD,IAGL,aAAa,EAAQ,KAAK,EAC1B,EAAQ,OAAO,CAAM,EACvB,CACF,EC7lBa,MACJ,IAAI"}

package/dist/extension-sdk.js

@@ -1,16 +1,41 @@
+//#region src/api.ts
+function e(e) {
+	if (e.startsWith("/")) return e;
+	let t = new URL(e);
+	return t.hostname = `api.${t.hostname}`, t.origin;
+}
+function t(t, n) {
+	if (!n.startsWith("/") || n.startsWith("//")) throw Error("API endpoint must be a root-relative path starting with a single \"/\".");
+	return `${e(t).replace(/\/+$/, "")}${n}`;
+}
+async function n(e, n, r = {}) {
+	let i = new Headers(r.headers);
+	i.has("Content-Type") || i.set("Content-Type", "application/json"), i.set("Authorization", `Bearer ${n.token}`), i.set("X-Tenant", n.tenantDomain);
+	let a = await fetch(t(n.baseUrl, e), {
+		...r,
+		headers: i
+	});
+	if (!a.ok) {
+		let e = a.statusText ? ` ${a.statusText}` : "";
+		throw Error(`API call failed: ${a.status}${e}.`);
+	}
+	return await a.json();
+}
+//#endregion
 //#region src/events.ts
-var e = {
+var r = {
 	handshakeInit: "HANDSHAKE_INIT",
 	handshakeAck: "HANDSHAKE_ACK",
 	requestTokenRefresh: "REQUEST_TOKEN_REFRESH",
 	tokenRefresh: "TOKEN_REFRESH",
 	loadPageSettings: "LOAD_PAGE_SETTINGS",
 	updatePageSettings: "UPDATE_PAGE_SETTINGS",
-	pageSettingsUpdated: "PAGE_SETTINGS_UPDATED"
+	pageSettingsUpdated: "PAGE_SETTINGS_UPDATED",
+	navigationChange: "NAVIGATION_CHANGE"
 };
 //#endregion
 //#region src/messaging.ts
-function t(e, t, n) {
+function i(e, t, n) {
 	if (!window.parent || window.parent === window) throw Error("Extension is not running inside a parent frame.");
 	let r = n === void 0 ? { type: e } : {
 		type: e,
@@ -18,7 +43,7 @@ function t(e, t, n) {
 	};
 	window.parent.postMessage(r, t);
 }
-function n(e, t) {
+function a(e, t) {
 	let n = (n) => {
 		n.origin === e && (!n.data || typeof n.data != "object" || !("type" in n.data) || t(n));
 	};
@@ -26,33 +51,33 @@ function n(e, t) {
 }
 //#endregion
 //#region src/origin.ts
-var r = /* @__PURE__ */ new Set([
+var o = /* @__PURE__ */ new Set([
 	"localhost",
 	"127.0.0.1",
 	"[::1]"
-]), i = class extends Error {
+]), s = class extends Error {
 	constructor(e) {
 		super(e), this.name = "InvalidOriginError";
 	}
 };
-function a(e) {
-	if (!e) throw new i("Missing \"tenantUrl\" search parameter required to establish parent origin.");
+function c(e) {
+	if (!e) throw new s("Missing \"tenantUrl\" search parameter required to establish parent origin.");
 	let t;
 	try {
 		t = new URL(e);
 	} catch {
-		throw new i(`Invalid tenantUrl: "${e}".`);
+		throw new s(`Invalid tenantUrl: "${e}".`);
 	}
-	let n = r.has(t.hostname), a = t.protocol === "https:", o = t.protocol === "http:" && n;
-	if (!a && !o) throw new i(`tenantUrl must use https (or http on localhost). Received: "${t.protocol}//${t.host}".`);
+	let n = o.has(t.hostname), r = t.protocol === "https:", i = t.protocol === "http:" && n;
+	if (!r && !i) throw new s(`tenantUrl must use https (or http on localhost). Received: "${t.protocol}//${t.host}".`);
 	return t.origin;
 }
-function o(e = window.location.search) {
+function l(e = window.location.search) {
 	return new URLSearchParams(e).get("tenantUrl");
 }
 //#endregion
 //#region src/ExtensionSDK.ts
-var s = 1e4, c = class {
+var u = 1e4, d = 12e4, f = 3e4, p = 2147483647, m = class {
 	#e = null;
 	#t = null;
 	#n = !1;
@@ -61,43 +86,48 @@ var s = 1e4, c = class {
 	#a = null;
 	#o = null;
 	#s = null;
-	#c = null;
-	#l = null;
+	#c = !1;
+	#l = d;
 	#u = null;
-	#d = /* @__PURE__ */ new Set();
-	#f = /* @__PURE__ */ new Set();
+	#d = !1;
+	#f = null;
+	#p = null;
+	#m = null;
+	#h = /* @__PURE__ */ new Set();
+	#g = /* @__PURE__ */ new Set();
 	get isConnected() {
 		return this.#n;
 	}
-	async connect(r = {}) {
-		if (this.#v(), this.#n && this.#i && this.#a && this.#o) return {
+	async connect(e = {}) {
+		if (this.#S(), this.#n && this.#i && this.#a && this.#o) return {
 			authToken: this.#i,
 			extensionDetails: this.#a,
 			designTokens: this.#o,
 			pageSettings: this.#s
 		};
-		if (this.#c) throw Error("Handshake already in progress.");
-		let i = o();
-		this.#e = a(i), this.#t?.(), this.#t = n(this.#e, (e) => this.#p(e));
-		let c = r.timeoutMs ?? s, l = new Promise((e, t) => {
-			let n = setTimeout(() => {
-				this.#c = null, t(/* @__PURE__ */ Error(`Handshake timed out after ${c}ms.`));
-			}, c);
-			this.#c = {
+		if (this.#f) throw Error("Handshake already in progress.");
+		this.#w(e);
+		let t = l();
+		this.#e = c(t), this.#t?.(), this.#t = a(this.#e, (e) => this.#_(e));
+		let n = e.timeoutMs ?? u, o = new Promise((e, t) => {
+			let r = setTimeout(() => {
+				this.#f = null, t(/* @__PURE__ */ Error(`Handshake timed out after ${n}ms.`));
+			}, n);
+			this.#f = {
 				resolve: e,
 				reject: t,
-				timer: n
+				timer: r
 			};
 		});
 		try {
-			t(e.handshakeInit, this.#e);
+			i(r.handshakeInit, this.#e);
 		} catch (e) {
-			throw this.#b(this.#c), this.#c = null, this.#t?.(), this.#t = null, this.#e = null, e;
+			throw this.#j(this.#f), this.#f = null, this.#t?.(), this.#t = null, this.#e = null, this.#D(), e;
 		}
-		return l;
+		return o;
 	}
 	destroy() {
-		this.#r = !0, this.#n = !1, this.#t?.(), this.#t = null, this.#e = null, this.#S(this.#c, /* @__PURE__ */ Error("SDK destroyed.")), this.#S(this.#l, /* @__PURE__ */ Error("SDK destroyed.")), this.#S(this.#u, /* @__PURE__ */ Error("SDK destroyed.")), this.#c = null, this.#l = null, this.#u = null, this.#d.clear(), this.#f.clear(), this.#i = null, this.#a = null, this.#o = null, this.#s = null;
+		this.#r = !0, this.#n = !1, this.#D(), this.#c = !1, this.#d = !1, this.#t?.(), this.#t = null, this.#e = null, this.#N(this.#f, /* @__PURE__ */ Error("SDK destroyed.")), this.#N(this.#p, /* @__PURE__ */ Error("SDK destroyed.")), this.#N(this.#m, /* @__PURE__ */ Error("SDK destroyed.")), this.#f = null, this.#p = null, this.#m = null, this.#h.clear(), this.#g.clear(), this.#i = null, this.#a = null, this.#o = null, this.#s = null;
 	}
 	getAuthToken() {
 		return this.#i;
@@ -111,116 +141,182 @@ var s = 1e4, c = class {
 	getPageSettings() {
 		return this.#s;
 	}
-	async requestTokenRefresh(n = {}) {
-		if (this.#y(), this.#l) throw Error("Token refresh already in progress.");
-		let r = n.timeoutMs ?? s, i = this.#e, a = new Promise((e, t) => {
-			let n = setTimeout(() => {
-				this.#l = null, t(/* @__PURE__ */ Error(`Token refresh timed out after ${r}ms.`));
-			}, r);
-			this.#l = {
+	async apiCall(e, t = {}) {
+		return this.#C(), n(e, {
+			baseUrl: this.#a.baseUrl,
+			tenantDomain: this.#a.tenantDomain,
+			token: this.#i.jwt
+		}, t);
+	}
+	async emitRequestTokenRefresh(e = {}) {
+		if (this.#C(), this.#p) throw Error("Token refresh already in progress.");
+		let t = e.timeoutMs ?? u, n = this.#e, a = new Promise((e, n) => {
+			let r = setTimeout(() => {
+				this.#p = null, n(/* @__PURE__ */ Error(`Token refresh timed out after ${t}ms.`));
+			}, t);
+			this.#p = {
 				resolve: e,
-				reject: t,
-				timer: n
+				reject: n,
+				timer: r
 			};
 		});
-		return t(e.requestTokenRefresh, i), a;
-	}
-	async updatePageSettings(n, r = {}) {
-		if (this.#y(), this.#u) throw Error("Page settings update already in progress.");
-		let i = r.timeoutMs ?? s, a = this.#e, o = new Promise((e, t) => {
-			let n = setTimeout(() => {
-				this.#u = null, t(/* @__PURE__ */ Error(`Page settings update timed out after ${i}ms.`));
-			}, i);
-			this.#u = {
+		return i(r.requestTokenRefresh, n), a;
+	}
+	async emitUpdatePageSettings(e, t = {}) {
+		if (this.#C(), this.#m) throw Error("Page settings update already in progress.");
+		let n = t.timeoutMs ?? u, a = this.#e, o = new Promise((e, t) => {
+			let r = setTimeout(() => {
+				this.#m = null, t(/* @__PURE__ */ Error(`Page settings update timed out after ${n}ms.`));
+			}, n);
+			this.#m = {
 				resolve: e,
 				reject: t,
-				timer: n
+				timer: r
 			};
 		});
-		return t(e.updatePageSettings, a, n), o;
+		return i(r.updatePageSettings, a, e), o;
 	}
 	onLoadPageSettings(e) {
-		return this.#d.add(e), () => {
-			this.#d.delete(e);
+		return this.#h.add(e), () => {
+			this.#h.delete(e);
 		};
 	}
 	onTokenRefresh(e) {
-		return this.#f.add(e), () => {
-			this.#f.delete(e);
+		return this.#g.add(e), () => {
+			this.#g.delete(e);
 		};
 	}
-	#p(t) {
-		let { type: n, payload: r } = t.data;
-		switch (n) {
-			case e.handshakeAck:
-				this.#m(r);
+	emitNavigationChange(e) {
+		this.#C(), i(r.navigationChange, this.#e, e);
+	}
+	#_(e) {
+		let { type: t, payload: n } = e.data;
+		switch (t) {
+			case r.handshakeAck:
+				this.#v(n);
 				break;
-			case e.tokenRefresh:
-				this.#h(r);
+			case r.tokenRefresh:
+				this.#y(n);
 				break;
-			case e.loadPageSettings:
-				this.#g(r);
+			case r.loadPageSettings:
+				this.#b(n);
 				break;
-			case e.pageSettingsUpdated:
-				this.#_(r);
+			case r.pageSettingsUpdated:
+				this.#x(n);
 				break;
 			default: break;
 		}
 	}
-	#m(e) {
+	#v(e) {
 		if (!e?.authToken || !e.extensionDetails || !e.designTokens) {
-			this.#S(this.#c, /* @__PURE__ */ Error("Invalid HANDSHAKE_ACK payload.")), this.#c = null;
+			this.#N(this.#f, /* @__PURE__ */ Error("Invalid HANDSHAKE_ACK payload.")), this.#f = null;
 			return;
 		}
 		this.#i = e.authToken, this.#a = e.extensionDetails, this.#o = e.designTokens, this.#s = e.pageSettings ?? null, this.#n = !0;
-		let t = this.#c;
-		this.#c = null, this.#x(t, {
+		let t = this.#f;
+		this.#f = null, this.#M(t, {
 			authToken: this.#i,
 			extensionDetails: this.#a,
 			designTokens: this.#o,
 			pageSettings: this.#s
-		});
+		}), this.#d = !1, this.#O();
 	}
-	#h(e) {
+	#y(e) {
 		if (!e?.authToken) {
-			this.#S(this.#l, /* @__PURE__ */ Error("Invalid TOKEN_REFRESH payload.")), this.#l = null;
+			this.#N(this.#p, /* @__PURE__ */ Error("Invalid TOKEN_REFRESH payload.")), this.#p = null;
 			return;
 		}
 		this.#i = e.authToken;
-		let t = this.#l;
-		this.#l = null, this.#x(t, this.#i);
-		for (let e of this.#f) e(this.#i);
+		let t = this.#p;
+		this.#p = null, this.#M(t, this.#i);
+		for (let e of this.#g) e(this.#i);
+		this.#d = !1, this.#O();
 	}
-	#g(e) {
+	#b(e) {
 		let t = e ?? {};
 		this.#s = t;
-		for (let e of this.#d) e(t);
+		for (let e of this.#h) e(t);
 	}
-	#_(e) {
+	#x(e) {
 		if (!e || typeof e.success != "boolean") {
-			this.#S(this.#u, /* @__PURE__ */ Error("Invalid PAGE_SETTINGS_UPDATED payload.")), this.#u = null;
+			this.#N(this.#m, /* @__PURE__ */ Error("Invalid PAGE_SETTINGS_UPDATED payload.")), this.#m = null;
 			return;
 		}
-		let t = this.#u;
-		this.#u = null, this.#x(t, e);
+		let t = this.#m;
+		this.#m = null, this.#M(t, e);
 	}
-	#v() {
+	#S() {
 		if (this.#r) throw Error("SDK has been destroyed.");
 	}
-	#y() {
-		if (this.#v(), !this.#n || !this.#e) throw Error("SDK is not connected. Call connect() first.");
+	#C() {
+		if (this.#S(), !this.#n || !this.#e) throw Error("SDK is not connected. Call connect() first.");
 	}
-	#b(e) {
+	#w(e) {
+		if (e.authTokenBufferMs !== void 0 && (!Number.isFinite(e.authTokenBufferMs) || e.authTokenBufferMs < 0)) throw Error("authTokenBufferMs must be a finite non-negative number.");
+		this.#c = e.authTokenAutoRefresh === !0, this.#l = e.authTokenBufferMs ?? d, this.#d = !1, this.#D();
+	}
+	#T(e) {
+		let t = Number(e.expires);
+		return Number.isFinite(t) ? t * 1e3 : null;
+	}
+	#E(e) {
+		let t = this.#T(e);
+		return t === null ? null : Math.max(0, t - this.#l - Date.now());
+	}
+	#D() {
+		this.#u !== null && (clearTimeout(this.#u), this.#u = null);
+	}
+	#O() {
+		if (this.#D(), !this.#c || !this.#n || this.#r || !this.#i) return;
+		let e = this.#E(this.#i);
+		if (e === null) return;
+		let t = Math.min(e, p);
+		this.#u = setTimeout(() => {
+			this.#u = null, this.#k();
+		}, t);
+	}
+	async #k() {
+		if (!this.#c || !this.#n || this.#r || !this.#i) return;
+		let e = this.#i, t = this.#E(e);
+		if (t !== null) {
+			if (t > 0) {
+				this.#O();
+				return;
+			}
+			if (this.#p) {
+				this.#A(e);
+				return;
+			}
+			try {
+				await this.emitRequestTokenRefresh();
+			} catch {
+				this.#A(e);
+			}
+		}
+	}
+	#A(e) {
+		if (!this.#c || !this.#n || this.#r || this.#i?.jwt !== e.jwt || this.#d) return;
+		let t = this.#T(e);
+		if (t === null) return;
+		let n = t - Date.now();
+		if (n <= 0) return;
+		this.#d = !0, this.#D();
+		let r = Math.min(f, n);
+		this.#u = setTimeout(() => {
+			this.#u = null, this.#k();
+		}, r);
+	}
+	#j(e) {
 		e && clearTimeout(e.timer);
 	}
-	#x(e, t) {
+	#M(e, t) {
 		e && (clearTimeout(e.timer), e.resolve(t));
 	}
-	#S(e, t) {
+	#N(e, t) {
 		e && (clearTimeout(e.timer), e.reject(t));
 	}
-}, l = () => new c();
+}, h = () => new m();
 //#endregion
-export { e as CONNECTION_EVENTS, c as ExtensionSDK, i as InvalidOriginError, l as createExtensionSDK, o as readTenantUrlFromLocation, a as resolveAllowedOrigin };
+export { r as CONNECTION_EVENTS, m as ExtensionSDK, s as InvalidOriginError, h as createExtensionSDK, l as readTenantUrlFromLocation, c as resolveAllowedOrigin };
 
 //# sourceMappingURL=extension-sdk.js.map

package/dist/extension-sdk.js.map

@@ -1 +1 @@
-{"version":3,"file":"extension-sdk.js","names":["#connected","#assertNotDestroyed","#authToken","#extensionDetails","#designTokens","#pageSettings","#pendingHandshake","#allowedOrigin","#unsubscribe","#onMessage","#clearPending","#destroyed","#rejectPending","#pendingTokenRefresh","#pendingPageSettingsUpdate","#loadPageSettingsHandlers","#tokenRefreshHandlers","#assertConnected","#handleHandshakeAck","#handleTokenRefresh","#handleLoadPageSettings","#handlePageSettingsUpdated","#resolvePending"],"sources":["../src/events.ts","../src/messaging.ts","../src/origin.ts","../src/ExtensionSDK.ts","../src/index.ts"],"sourcesContent":["/**\n * Wire event type strings for parent/child `postMessage` communication.\n *\n * Keys are SDK-facing names; values are the strings sent on the wire.\n * Comments mark message direction relative to the extension (child).\n */\nexport const CONNECTION_EVENTS = {\n  /** Child → parent: start handshake. */\n  handshakeInit: \"HANDSHAKE_INIT\",\n  /** Parent → child: handshake success with auth and context. */\n  handshakeAck: \"HANDSHAKE_ACK\",\n  /** Child → parent: request a new auth token. */\n  requestTokenRefresh: \"REQUEST_TOKEN_REFRESH\",\n  /** Parent → child: new auth token (reply or push). */\n  tokenRefresh: \"TOKEN_REFRESH\",\n  /** Parent → child: open/load page settings UI with values. */\n  loadPageSettings: \"LOAD_PAGE_SETTINGS\",\n  /** Child → parent: persist updated page settings. */\n  updatePageSettings: \"UPDATE_PAGE_SETTINGS\",\n  /** Parent → child: result of a page settings update. */\n  pageSettingsUpdated: \"PAGE_SETTINGS_UPDATED\",\n} as const;\n\n/** Union of all {@link CONNECTION_EVENTS} wire string values. */\nexport type ConnectionEvent =\n  (typeof CONNECTION_EVENTS)[keyof typeof CONNECTION_EVENTS];\n","import type { ConnectionEvent } from \"./events\";\nimport type { ExtensionMessage } from \"./types\";\n\nexport type MessageHandler = (event: MessageEvent<ExtensionMessage>) => void;\n\nexport function postToParent(\n  type: ConnectionEvent,\n  allowedOrigin: string,\n  payload?: unknown,\n): void {\n  if (!window.parent || window.parent === window) {\n    throw new Error(\"Extension is not running inside a parent frame.\");\n  }\n\n  const message: ExtensionMessage = payload === undefined ? { type } : { type, payload };\n  window.parent.postMessage(message, allowedOrigin);\n}\n\nexport function subscribeToParentMessages(\n  allowedOrigin: string,\n  handler: MessageHandler,\n): () => void {\n  const listener = (event: MessageEvent) => {\n    if (event.origin !== allowedOrigin) {\n      return;\n    }\n\n    if (!event.data || typeof event.data !== \"object\" || !(\"type\" in event.data)) {\n      return;\n    }\n\n    handler(event as MessageEvent<ExtensionMessage>);\n  };\n\n  window.addEventListener(\"message\", listener);\n  return () => window.removeEventListener(\"message\", listener);\n}\n","const LOCALHOST_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n\n/** Thrown when `tenantUrl` is missing or not a safe postMessage origin. */\nexport class InvalidOriginError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidOriginError\";\n  }\n}\n\n/**\n * Parses and validates a tenant URL into a postMessage-safe origin.\n * Allows https always; http only for localhost / 127.0.0.1 / [::1].\n *\n * @param tenantUrl - Absolute URL from the `tenantUrl` search param.\n * @returns Origin string suitable for `postMessage` targetOrigin.\n * @throws {InvalidOriginError} When missing, unparsable, or disallowed scheme/host.\n */\nexport function resolveAllowedOrigin(tenantUrl: string | null): string {\n  if (!tenantUrl) {\n    throw new InvalidOriginError(\n      'Missing \"tenantUrl\" search parameter required to establish parent origin.',\n    );\n  }\n\n  let url: URL;\n  try {\n    url = new URL(tenantUrl);\n  } catch {\n    throw new InvalidOriginError(`Invalid tenantUrl: \"${tenantUrl}\".`);\n  }\n\n  const isLocalhost = LOCALHOST_HOSTS.has(url.hostname);\n  const isHttps = url.protocol === \"https:\";\n  const isLocalHttp = url.protocol === \"http:\" && isLocalhost;\n\n  if (!isHttps && !isLocalHttp) {\n    throw new InvalidOriginError(\n      `tenantUrl must use https (or http on localhost). Received: \"${url.protocol}//${url.host}\".`,\n    );\n  }\n\n  return url.origin;\n}\n\n/**\n * Reads the parent-supplied `tenantUrl` from a URL search string.\n *\n * The parent must pass `tenantUrl` on the iframe `src` so\n * {@link resolveAllowedOrigin} can whitelist the parent origin.\n *\n * @param search - Query string (defaults to `window.location.search`).\n */\nexport function readTenantUrlFromLocation(\n  search: string = window.location.search,\n): string | null {\n  return new URLSearchParams(search).get(\"tenantUrl\");\n}\n","import { CONNECTION_EVENTS } from \"./events\";\nimport { postToParent, subscribeToParentMessages } from \"./messaging\";\nimport { readTenantUrlFromLocation, resolveAllowedOrigin } from \"./origin\";\nimport type {\n  ConnectOptions,\n  DesignTokens,\n  ExtensionDetails,\n  ExtensionMessage,\n  HandshakePayload,\n  PageSettings,\n  PageSettingsUpdatedPayload,\n  RequestOptions,\n  ScopedExtensionToken,\n  TokenRefreshPayload,\n} from \"./types\";\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\n/**\n * Public contract for talking to the Kadanza parent frame over `postMessage`.\n *\n * Requires a `tenantUrl` search param on the extension URL so\n * {@link connect} can validate the parent origin.\n */\nexport interface IExtensionSDK {\n  /**\n   * Establishes the parent connection and waits for `HANDSHAKE_ACK`.\n   *\n   * If already connected with cached handshake data, returns that payload\n   * without sending another init. Concurrent calls while a handshake is\n   * in progress throw.\n   *\n   * @param options - Optional handshake timeout (default 10s).\n   * @throws {InvalidOriginError} When `tenantUrl` is missing or invalid.\n   * @throws When not embedded in a parent frame, already handshaking,\n   *   destroyed, or the handshake times out / returns an invalid payload.\n   */\n  connect(options?: ConnectOptions): Promise<HandshakePayload>;\n\n  /**\n   * Tears down listeners and cached state. Rejects any in-flight requests.\n   * The instance cannot be reused after destroy.\n   */\n  destroy(): void;\n\n  /** Whether a successful handshake has completed and not been destroyed. */\n  readonly isConnected: boolean;\n\n  /** Last auth token from handshake or refresh; `null` until connected. */\n  getAuthToken(): ScopedExtensionToken | null;\n\n  /** Extension context from handshake; `null` until connected. */\n  getExtensionDetails(): ExtensionDetails | null;\n\n  /** Design tokens from handshake; `null` until connected. */\n  getDesignTokens(): DesignTokens | null;\n\n  /**\n   * Latest page settings from handshake or `LOAD_PAGE_SETTINGS`;\n   * `null` until set.\n   */\n  getPageSettings(): PageSettings | null;\n\n  /**\n   * Asks the parent for a new token and waits for `TOKEN_REFRESH`.\n   *\n   * @param options - Optional request timeout (default 10s).\n   * @throws When not connected, a refresh is already in progress,\n   *   or the request times out / returns an invalid payload.\n   */\n  requestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;\n\n  /**\n   * Pushes page settings to the parent and waits for `PAGE_SETTINGS_UPDATED`.\n   *\n   * @param settings - Settings object to send.\n   * @param options - Optional request timeout (default 10s).\n   * @throws When not connected, an update is already in progress,\n   *   or the request times out / returns an invalid payload.\n   */\n  updatePageSettings(\n    settings: PageSettings,\n    options?: RequestOptions,\n  ): Promise<PageSettingsUpdatedPayload>;\n\n  /**\n   * Registers a handler for parent-initiated `LOAD_PAGE_SETTINGS`.\n   *\n   * @returns Unsubscribe function.\n   */\n  onLoadPageSettings(handler: (settings: PageSettings) => void): () => void;\n\n  /**\n   * Registers a handler for token updates (requested or parent-pushed).\n   *\n   * @returns Unsubscribe function.\n   */\n  onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void;\n}\n\ntype Pending<T> = {\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n  timer: ReturnType<typeof setTimeout>;\n};\n\n/** Default {@link IExtensionSDK} implementation. Prefer {@link createExtensionSDK}. */\nexport class ExtensionSDK implements IExtensionSDK {\n  #allowedOrigin: string | null = null;\n  #unsubscribe: (() => void) | null = null;\n  #connected = false;\n  #destroyed = false;\n\n  #authToken: ScopedExtensionToken | null = null;\n  #extensionDetails: ExtensionDetails | null = null;\n  #designTokens: DesignTokens | null = null;\n  #pageSettings: PageSettings | null = null;\n\n  #pendingHandshake: Pending<HandshakePayload> | null = null;\n  #pendingTokenRefresh: Pending<ScopedExtensionToken> | null = null;\n  #pendingPageSettingsUpdate: Pending<PageSettingsUpdatedPayload> | null = null;\n\n  #loadPageSettingsHandlers = new Set<(settings: PageSettings) => void>();\n  #tokenRefreshHandlers = new Set<(token: ScopedExtensionToken) => void>();\n\n  get isConnected(): boolean {\n    return this.#connected;\n  }\n\n  async connect(options: ConnectOptions = {}): Promise<HandshakePayload> {\n    this.#assertNotDestroyed();\n\n    if (this.#connected && this.#authToken && this.#extensionDetails && this.#designTokens) {\n      return {\n        authToken: this.#authToken,\n        extensionDetails: this.#extensionDetails,\n        designTokens: this.#designTokens,\n        pageSettings: this.#pageSettings,\n      };\n    }\n\n    if (this.#pendingHandshake) {\n      throw new Error(\"Handshake already in progress.\");\n    }\n\n    const tenantUrl = readTenantUrlFromLocation();\n    this.#allowedOrigin = resolveAllowedOrigin(tenantUrl);\n\n    this.#unsubscribe?.();\n    this.#unsubscribe = subscribeToParentMessages(\n      this.#allowedOrigin,\n      (event) => this.#onMessage(event),\n    );\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n    const handshakePromise = new Promise<HandshakePayload>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingHandshake = null;\n        reject(new Error(`Handshake timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingHandshake = { resolve, reject, timer };\n    });\n\n    try {\n      postToParent(CONNECTION_EVENTS.handshakeInit, this.#allowedOrigin);\n    } catch (error) {\n      this.#clearPending(this.#pendingHandshake);\n      this.#pendingHandshake = null;\n      this.#unsubscribe?.();\n      this.#unsubscribe = null;\n      this.#allowedOrigin = null;\n      throw error;\n    }\n\n    return handshakePromise;\n  }\n\n  destroy(): void {\n    this.#destroyed = true;\n    this.#connected = false;\n\n    this.#unsubscribe?.();\n    this.#unsubscribe = null;\n    this.#allowedOrigin = null;\n\n    this.#rejectPending(this.#pendingHandshake, new Error(\"SDK destroyed.\"));\n    this.#rejectPending(this.#pendingTokenRefresh, new Error(\"SDK destroyed.\"));\n    this.#rejectPending(this.#pendingPageSettingsUpdate, new Error(\"SDK destroyed.\"));\n    this.#pendingHandshake = null;\n    this.#pendingTokenRefresh = null;\n    this.#pendingPageSettingsUpdate = null;\n\n    this.#loadPageSettingsHandlers.clear();\n    this.#tokenRefreshHandlers.clear();\n\n    this.#authToken = null;\n    this.#extensionDetails = null;\n    this.#designTokens = null;\n    this.#pageSettings = null;\n  }\n\n  getAuthToken(): ScopedExtensionToken | null {\n    return this.#authToken;\n  }\n\n  getExtensionDetails(): ExtensionDetails | null {\n    return this.#extensionDetails;\n  }\n\n  getDesignTokens(): DesignTokens | null {\n    return this.#designTokens;\n  }\n\n  getPageSettings(): PageSettings | null {\n    return this.#pageSettings;\n  }\n\n  async requestTokenRefresh(\n    options: RequestOptions = {},\n  ): Promise<ScopedExtensionToken> {\n    this.#assertConnected();\n\n    if (this.#pendingTokenRefresh) {\n      throw new Error(\"Token refresh already in progress.\");\n    }\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const allowedOrigin = this.#allowedOrigin!;\n\n    const promise = new Promise<ScopedExtensionToken>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingTokenRefresh = null;\n        reject(new Error(`Token refresh timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingTokenRefresh = { resolve, reject, timer };\n    });\n\n    postToParent(CONNECTION_EVENTS.requestTokenRefresh, allowedOrigin);\n    return promise;\n  }\n\n  async updatePageSettings(\n    settings: PageSettings,\n    options: RequestOptions = {},\n  ): Promise<PageSettingsUpdatedPayload> {\n    this.#assertConnected();\n\n    if (this.#pendingPageSettingsUpdate) {\n      throw new Error(\"Page settings update already in progress.\");\n    }\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const allowedOrigin = this.#allowedOrigin!;\n\n    const promise = new Promise<PageSettingsUpdatedPayload>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingPageSettingsUpdate = null;\n        reject(new Error(`Page settings update timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingPageSettingsUpdate = { resolve, reject, timer };\n    });\n\n    postToParent(CONNECTION_EVENTS.updatePageSettings, allowedOrigin, settings);\n    return promise;\n  }\n\n  onLoadPageSettings(handler: (settings: PageSettings) => void): () => void {\n    this.#loadPageSettingsHandlers.add(handler);\n    return () => {\n      this.#loadPageSettingsHandlers.delete(handler);\n    };\n  }\n\n  onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void {\n    this.#tokenRefreshHandlers.add(handler);\n    return () => {\n      this.#tokenRefreshHandlers.delete(handler);\n    };\n  }\n\n  #onMessage(event: MessageEvent<ExtensionMessage>): void {\n    const { type, payload } = event.data;\n\n    switch (type) {\n      case CONNECTION_EVENTS.handshakeAck:\n        this.#handleHandshakeAck(payload as HandshakePayload | undefined);\n        break;\n      case CONNECTION_EVENTS.tokenRefresh:\n        this.#handleTokenRefresh(payload as TokenRefreshPayload | undefined);\n        break;\n      case CONNECTION_EVENTS.loadPageSettings:\n        this.#handleLoadPageSettings(payload as PageSettings | undefined);\n        break;\n      case CONNECTION_EVENTS.pageSettingsUpdated:\n        this.#handlePageSettingsUpdated(\n          payload as PageSettingsUpdatedPayload | undefined,\n        );\n        break;\n      default:\n        break;\n    }\n  }\n\n  #handleHandshakeAck(payload: HandshakePayload | undefined): void {\n    if (!payload?.authToken || !payload.extensionDetails || !payload.designTokens) {\n      this.#rejectPending(\n        this.#pendingHandshake,\n        new Error(\"Invalid HANDSHAKE_ACK payload.\"),\n      );\n      this.#pendingHandshake = null;\n      return;\n    }\n\n    this.#authToken = payload.authToken;\n    this.#extensionDetails = payload.extensionDetails;\n    this.#designTokens = payload.designTokens;\n    this.#pageSettings = payload.pageSettings ?? null;\n    this.#connected = true;\n\n    const pending = this.#pendingHandshake;\n    this.#pendingHandshake = null;\n    this.#resolvePending(pending, {\n      authToken: this.#authToken,\n      extensionDetails: this.#extensionDetails,\n      designTokens: this.#designTokens,\n      pageSettings: this.#pageSettings,\n    });\n  }\n\n  #handleTokenRefresh(payload: TokenRefreshPayload | undefined): void {\n    if (!payload?.authToken) {\n      this.#rejectPending(\n        this.#pendingTokenRefresh,\n        new Error(\"Invalid TOKEN_REFRESH payload.\"),\n      );\n      this.#pendingTokenRefresh = null;\n      return;\n    }\n\n    this.#authToken = payload.authToken;\n\n    const pending = this.#pendingTokenRefresh;\n    this.#pendingTokenRefresh = null;\n    this.#resolvePending(pending, this.#authToken);\n\n    for (const handler of this.#tokenRefreshHandlers) {\n      handler(this.#authToken);\n    }\n  }\n\n  #handleLoadPageSettings(payload: PageSettings | undefined): void {\n    const settings = payload ?? {};\n    this.#pageSettings = settings;\n\n    for (const handler of this.#loadPageSettingsHandlers) {\n      handler(settings);\n    }\n  }\n\n  #handlePageSettingsUpdated(\n    payload: PageSettingsUpdatedPayload | undefined,\n  ): void {\n    if (!payload || typeof payload.success !== \"boolean\") {\n      this.#rejectPending(\n        this.#pendingPageSettingsUpdate,\n        new Error(\"Invalid PAGE_SETTINGS_UPDATED payload.\"),\n      );\n      this.#pendingPageSettingsUpdate = null;\n      return;\n    }\n\n    const pending = this.#pendingPageSettingsUpdate;\n    this.#pendingPageSettingsUpdate = null;\n    this.#resolvePending(pending, payload);\n  }\n\n  #assertNotDestroyed(): void {\n    if (this.#destroyed) {\n      throw new Error(\"SDK has been destroyed.\");\n    }\n  }\n\n  #assertConnected(): void {\n    this.#assertNotDestroyed();\n    if (!this.#connected || !this.#allowedOrigin) {\n      throw new Error(\"SDK is not connected. Call connect() first.\");\n    }\n  }\n\n  #clearPending(pending: { timer: ReturnType<typeof setTimeout> } | null): void {\n    if (pending) {\n      clearTimeout(pending.timer);\n    }\n  }\n\n  #resolvePending<T>(pending: Pending<T> | null, value: T): void {\n    if (!pending) {\n      return;\n    }\n    clearTimeout(pending.timer);\n    pending.resolve(value);\n  }\n\n  #rejectPending(\n    pending: { timer: ReturnType<typeof setTimeout>; reject: (reason?: unknown) => void } | null,\n    reason: unknown,\n  ): void {\n    if (!pending) {\n      return;\n    }\n    clearTimeout(pending.timer);\n    pending.reject(reason);\n  }\n}\n","import { ExtensionSDK, type IExtensionSDK } from \"./ExtensionSDK\";\n\nexport { ExtensionSDK, type IExtensionSDK } from \"./ExtensionSDK\";\nexport { CONNECTION_EVENTS, type ConnectionEvent } from \"./events\";\nexport {\n  InvalidOriginError,\n  readTenantUrlFromLocation,\n  resolveAllowedOrigin,\n} from \"./origin\";\nexport type {\n  ConnectOptions,\n  DesignTokens,\n  ExtensionDetails,\n  ExtensionMessage,\n  HandshakePayload,\n  PageSettings,\n  PageSettingsUpdatedPayload,\n  RequestOptions,\n  ScopedExtensionToken,\n  TokenRefreshPayload,\n} from \"./types\";\n\n/** Creates a new {@link IExtensionSDK} instance for the current extension frame. */\nexport const createExtensionSDK = (): IExtensionSDK => {\n  return new ExtensionSDK();\n};\n"],"mappings":";AAMA,IAAa,IAAoB;CAE/B,eAAe;CAEf,cAAc;CAEd,qBAAqB;CAErB,cAAc;CAEd,kBAAkB;CAElB,oBAAoB;CAEpB,qBAAqB;AACvB;;;AChBA,SAAgB,EACd,GACA,GACA,GACM;CACN,IAAI,CAAC,OAAO,UAAU,OAAO,WAAW,QACtC,MAAU,MAAM,iDAAiD;CAGnE,IAAM,IAA4B,MAAY,KAAA,IAAY,EAAE,QAAK,IAAI;EAAE;EAAM;CAAQ;CACrF,OAAO,OAAO,YAAY,GAAS,CAAa;AAClD;AAEA,SAAgB,EACd,GACA,GACY;CACZ,IAAM,KAAY,MAAwB;EACpC,EAAM,WAAW,MAIjB,CAAC,EAAM,QAAQ,OAAO,EAAM,QAAS,YAAY,EAAE,UAAU,EAAM,SAIvE,EAAQ,CAAuC;CACjD;CAGA,OADA,OAAO,iBAAiB,WAAW,CAAQ,SAC9B,OAAO,oBAAoB,WAAW,CAAQ;AAC7D;;;ACpCA,IAAM,oBAAkB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAO,CAAC,GAGtD,IAAb,cAAwC,MAAM;CAC5C,YAAY,GAAiB;EAE3B,AADA,MAAM,CAAO,GACb,KAAK,OAAO;CACd;AACF;AAUA,SAAgB,EAAqB,GAAkC;CACrE,IAAI,CAAC,GACH,MAAM,IAAI,EACR,6EACF;CAGF,IAAI;CACJ,IAAI;EACF,IAAM,IAAI,IAAI,CAAS;CACzB,QAAQ;EACN,MAAM,IAAI,EAAmB,uBAAuB,EAAU,GAAG;CACnE;CAEA,IAAM,IAAc,EAAgB,IAAI,EAAI,QAAQ,GAC9C,IAAU,EAAI,aAAa,UAC3B,IAAc,EAAI,aAAa,WAAW;CAEhD,IAAI,CAAC,KAAW,CAAC,GACf,MAAM,IAAI,EACR,+DAA+D,EAAI,SAAS,IAAI,EAAI,KAAK,GAC3F;CAGF,OAAO,EAAI;AACb;AAUA,SAAgB,EACd,IAAiB,OAAO,SAAS,QAClB;CACf,OAAO,IAAI,gBAAgB,CAAM,CAAC,CAAC,IAAI,WAAW;AACpD;;;ACzCA,IAAM,IAAqB,KA2Fd,IAAb,MAAmD;CACjD,KAAgC;CAChC,KAAoC;CACpC,KAAa;CACb,KAAa;CAEb,KAA0C;CAC1C,KAA6C;CAC7C,KAAqC;CACrC,KAAqC;CAErC,KAAsD;CACtD,KAA6D;CAC7D,KAAyE;CAEzE,qBAA4B,IAAI,IAAsC;CACtE,qBAAwB,IAAI,IAA2C;CAEvE,IAAI,cAAuB;EACzB,OAAO,KAAKA;CACd;CAEA,MAAM,QAAQ,IAA0B,CAAC,GAA8B;EAGrE,IAFA,KAAKC,GAAoB,GAErB,KAAKD,MAAc,KAAKE,MAAc,KAAKC,MAAqB,KAAKC,IACvE,OAAO;GACL,WAAW,KAAKF;GAChB,kBAAkB,KAAKC;GACvB,cAAc,KAAKC;GACnB,cAAc,KAAKC;EACrB;EAGF,IAAI,KAAKC,IACP,MAAU,MAAM,gCAAgC;EAGlD,IAAM,IAAY,EAA0B;EAI5C,AAHA,KAAKC,KAAiB,EAAqB,CAAS,GAEpD,KAAKC,KAAe,GACpB,KAAKA,KAAe,EAClB,KAAKD,KACJ,MAAU,KAAKE,GAAW,CAAK,CAClC;EAEA,IAAM,IAAY,EAAQ,aAAa,GAEjC,IAAmB,IAAI,SAA2B,GAAS,MAAW;GAC1E,IAAM,IAAQ,iBAAiB;IAE7B,AADA,KAAKH,KAAoB,MACzB,EAAO,gBAAI,MAAM,6BAA6B,EAAU,IAAI,CAAC;GAC/D,GAAG,CAAS;GAEZ,KAAKA,KAAoB;IAAE;IAAS;IAAQ;GAAM;EACpD,CAAC;EAED,IAAI;GACF,EAAa,EAAkB,eAAe,KAAKC,EAAc;EACnE,SAAS,GAAO;GAMd,MALA,KAAKG,GAAc,KAAKJ,EAAiB,GACzC,KAAKA,KAAoB,MACzB,KAAKE,KAAe,GACpB,KAAKA,KAAe,MACpB,KAAKD,KAAiB,MAChB;EACR;EAEA,OAAO;CACT;CAEA,UAAgB;EAqBd,AApBA,KAAKI,KAAa,IAClB,KAAKX,KAAa,IAElB,KAAKQ,KAAe,GACpB,KAAKA,KAAe,MACpB,KAAKD,KAAiB,MAEtB,KAAKK,GAAe,KAAKN,IAAmB,gBAAI,MAAM,gBAAgB,CAAC,GACvE,KAAKM,GAAe,KAAKC,IAAsB,gBAAI,MAAM,gBAAgB,CAAC,GAC1E,KAAKD,GAAe,KAAKE,IAA4B,gBAAI,MAAM,gBAAgB,CAAC,GAChF,KAAKR,KAAoB,MACzB,KAAKO,KAAuB,MAC5B,KAAKC,KAA6B,MAElC,KAAKC,GAA0B,MAAM,GACrC,KAAKC,GAAsB,MAAM,GAEjC,KAAKd,KAAa,MAClB,KAAKC,KAAoB,MACzB,KAAKC,KAAgB,MACrB,KAAKC,KAAgB;CACvB;CAEA,eAA4C;EAC1C,OAAO,KAAKH;CACd;CAEA,sBAA+C;EAC7C,OAAO,KAAKC;CACd;CAEA,kBAAuC;EACrC,OAAO,KAAKC;CACd;CAEA,kBAAuC;EACrC,OAAO,KAAKC;CACd;CAEA,MAAM,oBACJ,IAA0B,CAAC,GACI;EAG/B,IAFA,KAAKY,GAAiB,GAElB,KAAKJ,IACP,MAAU,MAAM,oCAAoC;EAGtD,IAAM,IAAY,EAAQ,aAAa,GACjC,IAAgB,KAAKN,IAErB,IAAU,IAAI,SAA+B,GAAS,MAAW;GACrE,IAAM,IAAQ,iBAAiB;IAE7B,AADA,KAAKM,KAAuB,MAC5B,EAAO,gBAAI,MAAM,iCAAiC,EAAU,IAAI,CAAC;GACnE,GAAG,CAAS;GAEZ,KAAKA,KAAuB;IAAE;IAAS;IAAQ;GAAM;EACvD,CAAC;EAGD,OADA,EAAa,EAAkB,qBAAqB,CAAa,GAC1D;CACT;CAEA,MAAM,mBACJ,GACA,IAA0B,CAAC,GACU;EAGrC,IAFA,KAAKI,GAAiB,GAElB,KAAKH,IACP,MAAU,MAAM,2CAA2C;EAG7D,IAAM,IAAY,EAAQ,aAAa,GACjC,IAAgB,KAAKP,IAErB,IAAU,IAAI,SAAqC,GAAS,MAAW;GAC3E,IAAM,IAAQ,iBAAiB;IAE7B,AADA,KAAKO,KAA6B,MAClC,EAAO,gBAAI,MAAM,wCAAwC,EAAU,IAAI,CAAC;GAC1E,GAAG,CAAS;GAEZ,KAAKA,KAA6B;IAAE;IAAS;IAAQ;GAAM;EAC7D,CAAC;EAGD,OADA,EAAa,EAAkB,oBAAoB,GAAe,CAAQ,GACnE;CACT;CAEA,mBAAmB,GAAuD;EAExE,OADA,KAAKC,GAA0B,IAAI,CAAO,SAC7B;GACX,KAAKA,GAA0B,OAAO,CAAO;EAC/C;CACF;CAEA,eAAe,GAA4D;EAEzE,OADA,KAAKC,GAAsB,IAAI,CAAO,SACzB;GACX,KAAKA,GAAsB,OAAO,CAAO;EAC3C;CACF;CAEA,GAAW,GAA6C;EACtD,IAAM,EAAE,SAAM,eAAY,EAAM;EAEhC,QAAQ,GAAR;GACE,KAAK,EAAkB;IACrB,KAAKE,GAAoB,CAAuC;IAChE;GACF,KAAK,EAAkB;IACrB,KAAKC,GAAoB,CAA0C;IACnE;GACF,KAAK,EAAkB;IACrB,KAAKC,GAAwB,CAAmC;IAChE;GACF,KAAK,EAAkB;IACrB,KAAKC,GACH,CACF;IACA;GACF,SACE;EACJ;CACF;CAEA,GAAoB,GAA6C;EAC/D,IAAI,CAAC,GAAS,aAAa,CAAC,EAAQ,oBAAoB,CAAC,EAAQ,cAAc;GAK7E,AAJA,KAAKT,GACH,KAAKN,IACL,gBAAI,MAAM,gCAAgC,CAC5C,GACA,KAAKA,KAAoB;GACzB;EACF;EAMA,AAJA,KAAKJ,KAAa,EAAQ,WAC1B,KAAKC,KAAoB,EAAQ,kBACjC,KAAKC,KAAgB,EAAQ,cAC7B,KAAKC,KAAgB,EAAQ,gBAAgB,MAC7C,KAAKL,KAAa;EAElB,IAAM,IAAU,KAAKM;EAErB,AADA,KAAKA,KAAoB,MACzB,KAAKgB,GAAgB,GAAS;GAC5B,WAAW,KAAKpB;GAChB,kBAAkB,KAAKC;GACvB,cAAc,KAAKC;GACnB,cAAc,KAAKC;EACrB,CAAC;CACH;CAEA,GAAoB,GAAgD;EAClE,IAAI,CAAC,GAAS,WAAW;GAKvB,AAJA,KAAKO,GACH,KAAKC,IACL,gBAAI,MAAM,gCAAgC,CAC5C,GACA,KAAKA,KAAuB;GAC5B;EACF;EAEA,KAAKX,KAAa,EAAQ;EAE1B,IAAM,IAAU,KAAKW;EAErB,AADA,KAAKA,KAAuB,MAC5B,KAAKS,GAAgB,GAAS,KAAKpB,EAAU;EAE7C,KAAK,IAAM,KAAW,KAAKc,IACzB,EAAQ,KAAKd,EAAU;CAE3B;CAEA,GAAwB,GAAyC;EAC/D,IAAM,IAAW,KAAW,CAAC;EAC7B,KAAKG,KAAgB;EAErB,KAAK,IAAM,KAAW,KAAKU,IACzB,EAAQ,CAAQ;CAEpB;CAEA,GACE,GACM;EACN,IAAI,CAAC,KAAW,OAAO,EAAQ,WAAY,WAAW;GAKpD,AAJA,KAAKH,GACH,KAAKE,IACL,gBAAI,MAAM,wCAAwC,CACpD,GACA,KAAKA,KAA6B;GAClC;EACF;EAEA,IAAM,IAAU,KAAKA;EAErB,AADA,KAAKA,KAA6B,MAClC,KAAKQ,GAAgB,GAAS,CAAO;CACvC;CAEA,KAA4B;EAC1B,IAAI,KAAKX,IACP,MAAU,MAAM,yBAAyB;CAE7C;CAEA,KAAyB;EAEvB,IADA,KAAKV,GAAoB,GACrB,CAAC,KAAKD,MAAc,CAAC,KAAKO,IAC5B,MAAU,MAAM,6CAA6C;CAEjE;CAEA,GAAc,GAAgE;EAC5E,AAAI,KACF,aAAa,EAAQ,KAAK;CAE9B;CAEA,GAAmB,GAA4B,GAAgB;EACxD,MAGL,aAAa,EAAQ,KAAK,GAC1B,EAAQ,QAAQ,CAAK;CACvB;CAEA,GACE,GACA,GACM;EACD,MAGL,aAAa,EAAQ,KAAK,GAC1B,EAAQ,OAAO,CAAM;CACvB;AACF,GC1Ya,UACJ,IAAI,EAAa"}
+{"version":3,"file":"extension-sdk.js","names":["#connected","#assertNotDestroyed","#authToken","#extensionDetails","#designTokens","#pageSettings","#pendingHandshake","#configureAuthTokenAutoRefresh","#allowedOrigin","#unsubscribe","#onMessage","#clearPending","#clearProactiveTokenRefreshTimer","#destroyed","#authTokenAutoRefresh","#authTokenRefreshRetryUsed","#rejectPending","#pendingTokenRefresh","#pendingPageSettingsUpdate","#loadPageSettingsHandlers","#tokenRefreshHandlers","#assertConnected","#handleHandshakeAck","#handleTokenRefresh","#handleLoadPageSettings","#handlePageSettingsUpdated","#resolvePending","#scheduleProactiveTokenRefresh","#authTokenBufferMs","#parseExpiresAtMs","#authTokenRefreshTimer","#getProactiveRefreshDelayMs","#runProactiveTokenRefresh","#handleProactiveRefreshFailure"],"sources":["../src/api.ts","../src/events.ts","../src/messaging.ts","../src/origin.ts","../src/ExtensionSDK.ts","../src/index.ts"],"sourcesContent":["interface ApiRequestContext {\n  baseUrl: string;\n  tenantDomain: string;\n  token: string;\n}\n\nfunction deriveApiUrl(baseUrl: string): string {\n  if (baseUrl.startsWith(\"/\")) {\n    return baseUrl;\n  }\n\n  const url = new URL(baseUrl);\n  url.hostname = `api.${url.hostname}`;\n  return url.origin;\n}\n\nfunction resolveApiEndpoint(baseUrl: string, endpoint: string): string {\n  if (!endpoint.startsWith(\"/\") || endpoint.startsWith(\"//\")) {\n    throw new Error(\n      'API endpoint must be a root-relative path starting with a single \"/\".',\n    );\n  }\n\n  return `${deriveApiUrl(baseUrl).replace(/\\/+$/, \"\")}${endpoint}`;\n}\n\nexport async function callApi<T>(\n  endpoint: string,\n  context: ApiRequestContext,\n  options: RequestInit = {},\n): Promise<T> {\n  const headers = new Headers(options.headers);\n\n  if (!headers.has(\"Content-Type\")) {\n    headers.set(\"Content-Type\", \"application/json\");\n  }\n\n  headers.set(\"Authorization\", `Bearer ${context.token}`);\n  headers.set(\"X-Tenant\", context.tenantDomain);\n\n  const response = await fetch(resolveApiEndpoint(context.baseUrl, endpoint), {\n    ...options,\n    headers,\n  });\n\n  if (!response.ok) {\n    const statusText = response.statusText ? ` ${response.statusText}` : \"\";\n    throw new Error(`API call failed: ${response.status}${statusText}.`);\n  }\n\n  return (await response.json()) as T;\n}\n","/**\n * Wire event type strings for parent/child `postMessage` communication.\n *\n * Keys are SDK-facing names; values are the strings sent on the wire.\n * Comments mark message direction relative to the extension (child).\n */\nexport const CONNECTION_EVENTS = {\n  /** Child → parent: start handshake. */\n  handshakeInit: \"HANDSHAKE_INIT\",\n  /** Parent → child: handshake success with auth and context. */\n  handshakeAck: \"HANDSHAKE_ACK\",\n  /** Child → parent: request a new auth token. */\n  requestTokenRefresh: \"REQUEST_TOKEN_REFRESH\",\n  /** Parent → child: new auth token (reply or push). */\n  tokenRefresh: \"TOKEN_REFRESH\",\n  /** Parent → child: open/load page settings UI with values. */\n  loadPageSettings: \"LOAD_PAGE_SETTINGS\",\n  /** Child → parent: persist updated page settings. */\n  updatePageSettings: \"UPDATE_PAGE_SETTINGS\",\n  /** Parent → child: result of a page settings update. */\n  pageSettingsUpdated: \"PAGE_SETTINGS_UPDATED\",\n  /** Child → parent: extension route changed. */\n  navigationChange: \"NAVIGATION_CHANGE\",\n} as const;\n\n/** Union of all {@link CONNECTION_EVENTS} wire string values. */\nexport type ConnectionEvent =\n  (typeof CONNECTION_EVENTS)[keyof typeof CONNECTION_EVENTS];\n","import type { ConnectionEvent } from \"./events\";\nimport type { ExtensionMessage } from \"./types\";\n\nexport type MessageHandler = (event: MessageEvent<ExtensionMessage>) => void;\n\nexport function postToParent(\n  type: ConnectionEvent,\n  allowedOrigin: string,\n  payload?: unknown,\n): void {\n  if (!window.parent || window.parent === window) {\n    throw new Error(\"Extension is not running inside a parent frame.\");\n  }\n\n  const message: ExtensionMessage = payload === undefined ? { type } : { type, payload };\n  window.parent.postMessage(message, allowedOrigin);\n}\n\nexport function subscribeToParentMessages(\n  allowedOrigin: string,\n  handler: MessageHandler,\n): () => void {\n  const listener = (event: MessageEvent) => {\n    if (event.origin !== allowedOrigin) {\n      return;\n    }\n\n    if (!event.data || typeof event.data !== \"object\" || !(\"type\" in event.data)) {\n      return;\n    }\n\n    handler(event as MessageEvent<ExtensionMessage>);\n  };\n\n  window.addEventListener(\"message\", listener);\n  return () => window.removeEventListener(\"message\", listener);\n}\n","const LOCALHOST_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n\n/** Thrown when `tenantUrl` is missing or not a safe postMessage origin. */\nexport class InvalidOriginError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidOriginError\";\n  }\n}\n\n/**\n * Parses and validates a tenant URL into a postMessage-safe origin.\n * Allows https always; http only for localhost / 127.0.0.1 / [::1].\n *\n * @param tenantUrl - Absolute URL from the `tenantUrl` search param.\n * @returns Origin string suitable for `postMessage` targetOrigin.\n * @throws {InvalidOriginError} When missing, unparsable, or disallowed scheme/host.\n */\nexport function resolveAllowedOrigin(tenantUrl: string | null): string {\n  if (!tenantUrl) {\n    throw new InvalidOriginError(\n      'Missing \"tenantUrl\" search parameter required to establish parent origin.',\n    );\n  }\n\n  let url: URL;\n  try {\n    url = new URL(tenantUrl);\n  } catch {\n    throw new InvalidOriginError(`Invalid tenantUrl: \"${tenantUrl}\".`);\n  }\n\n  const isLocalhost = LOCALHOST_HOSTS.has(url.hostname);\n  const isHttps = url.protocol === \"https:\";\n  const isLocalHttp = url.protocol === \"http:\" && isLocalhost;\n\n  if (!isHttps && !isLocalHttp) {\n    throw new InvalidOriginError(\n      `tenantUrl must use https (or http on localhost). Received: \"${url.protocol}//${url.host}\".`,\n    );\n  }\n\n  return url.origin;\n}\n\n/**\n * Reads the parent-supplied `tenantUrl` from a URL search string.\n *\n * The parent must pass `tenantUrl` on the iframe `src` so\n * {@link resolveAllowedOrigin} can whitelist the parent origin.\n *\n * @param search - Query string (defaults to `window.location.search`).\n */\nexport function readTenantUrlFromLocation(\n  search: string = window.location.search,\n): string | null {\n  return new URLSearchParams(search).get(\"tenantUrl\");\n}\n","import { callApi } from \"./api\";\nimport { CONNECTION_EVENTS } from \"./events\";\nimport { postToParent, subscribeToParentMessages } from \"./messaging\";\nimport { readTenantUrlFromLocation, resolveAllowedOrigin } from \"./origin\";\nimport type {\n  ConnectOptions,\n  DesignTokens,\n  ExtensionDetails,\n  ExtensionMessage,\n  HandshakePayload,\n  NavigationChangePayload,\n  PageSettings,\n  PageSettingsUpdatedPayload,\n  RequestOptions,\n  ScopedExtensionToken,\n  TokenRefreshPayload,\n  UpdatePageSettingsPayload,\n} from \"./types\";\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst DEFAULT_AUTH_TOKEN_BUFFER_MS = 120_000;\nconst AUTO_REFRESH_RETRY_DELAY_MS = 30_000;\n/** Largest delay `setTimeout` can reliably use in browsers. */\nconst MAX_TIMEOUT_MS = 2_147_483_647;\n\n/**\n * Public contract for talking to the Kadanza parent frame over `postMessage`.\n *\n * Requires a `tenantUrl` search param on the extension URL so\n * {@link connect} can validate the parent origin.\n */\nexport interface IExtensionSDK {\n  /**\n   * Establishes the parent connection and waits for `HANDSHAKE_ACK`.\n   *\n   * If already connected with cached handshake data, returns that payload\n   * without sending another init. Concurrent calls while a handshake is\n   * in progress throw.\n   *\n   * Opt-in proactive refresh can be enabled with\n   * `authTokenAutoRefresh: true` (optional `authTokenBufferMs`).\n   *\n   * @param options - Handshake timeout and optional auth-token auto-refresh.\n   * @throws {InvalidOriginError} When `tenantUrl` is missing or invalid.\n   * @throws When not embedded in a parent frame, already handshaking,\n   *   destroyed, or the handshake times out / returns an invalid payload.\n   */\n  connect(options?: ConnectOptions): Promise<HandshakePayload>;\n\n  /**\n   * Tears down listeners, proactive refresh timers, and cached state.\n   * Rejects any in-flight requests. The instance cannot be reused after destroy.\n   */\n  destroy(): void;\n\n  /** Whether a successful handshake has completed and not been destroyed. */\n  readonly isConnected: boolean;\n\n  /** Last auth token from handshake or refresh; `null` until connected. */\n  getAuthToken(): ScopedExtensionToken | null;\n\n  /** Extension context from handshake; `null` until connected. */\n  getExtensionDetails(): ExtensionDetails | null;\n\n  /** Design tokens from handshake; `null` until connected. */\n  getDesignTokens(): DesignTokens | null;\n\n  /**\n   * Latest page settings from handshake or `LOAD_PAGE_SETTINGS`;\n   * `null` until set.\n   */\n  getPageSettings(): PageSettings | null;\n\n  /**\n   * Calls the Kadanza Platform API with the current connection credentials.\n   *\n   * The API origin is derived from the handshake `baseUrl`. Authorization and\n   * tenant headers are managed by the SDK and cannot be overridden.\n   *\n   * @typeParam T - Expected JSON response body.\n   * @param endpoint - Root-relative API path.\n   * @param options - Standard fetch options.\n   * @throws When not connected, the endpoint is invalid, the request fails,\n   *   or the response is not successful JSON.\n   */\n  apiCall<T>(endpoint: string, options?: RequestInit): Promise<T>;\n\n  /**\n   * Asks the parent for a new token and waits for `TOKEN_REFRESH`.\n   *\n   * @param options - Optional request timeout (default 10s).\n   * @throws When not connected, a refresh is already in progress,\n   *   or the request times out / returns an invalid payload.\n   */\n  emitRequestTokenRefresh(\n    options?: RequestOptions,\n  ): Promise<ScopedExtensionToken>;\n\n  /**\n   * Pushes page settings to the parent and waits for `PAGE_SETTINGS_UPDATED`.\n   *\n   * @param payload - Update payload containing the settings object.\n   * @param options - Optional request timeout (default 10s).\n   * @throws When not connected, an update is already in progress,\n   *   or the request times out / returns an invalid payload.\n   */\n  emitUpdatePageSettings(\n    payload: UpdatePageSettingsPayload,\n    options?: RequestOptions,\n  ): Promise<PageSettingsUpdatedPayload>;\n\n  /**\n   * Registers a handler for parent-initiated `LOAD_PAGE_SETTINGS`.\n   *\n   * @returns Unsubscribe function.\n   */\n  onLoadPageSettings(handler: (settings: PageSettings) => void): () => void;\n\n  /**\n   * Registers a handler for token updates (requested or parent-pushed).\n   *\n   * @returns Unsubscribe function.\n   */\n  onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void;\n\n  /**\n   * Notifies the parent that the extension's route changed.\n   *\n   * Wire: `NAVIGATION_CHANGE` (fire-and-forget).\n   *\n   * @param payload - Navigation change payload (`path` within the extension).\n   * @throws When not connected or destroyed.\n   */\n  emitNavigationChange(payload: NavigationChangePayload): void;\n}\n\ntype Pending<T> = {\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n  timer: ReturnType<typeof setTimeout>;\n};\n\n/** Default {@link IExtensionSDK} implementation. Prefer {@link createExtensionSDK}. */\nexport class ExtensionSDK implements IExtensionSDK {\n  #allowedOrigin: string | null = null;\n  #unsubscribe: (() => void) | null = null;\n  #connected = false;\n  #destroyed = false;\n\n  #authToken: ScopedExtensionToken | null = null;\n  #extensionDetails: ExtensionDetails | null = null;\n  #designTokens: DesignTokens | null = null;\n  #pageSettings: PageSettings | null = null;\n\n  #authTokenAutoRefresh = false;\n  #authTokenBufferMs = DEFAULT_AUTH_TOKEN_BUFFER_MS;\n  #authTokenRefreshTimer: ReturnType<typeof setTimeout> | null = null;\n  #authTokenRefreshRetryUsed = false;\n\n  #pendingHandshake: Pending<HandshakePayload> | null = null;\n  #pendingTokenRefresh: Pending<ScopedExtensionToken> | null = null;\n  #pendingPageSettingsUpdate: Pending<PageSettingsUpdatedPayload> | null = null;\n\n  #loadPageSettingsHandlers = new Set<(settings: PageSettings) => void>();\n  #tokenRefreshHandlers = new Set<(token: ScopedExtensionToken) => void>();\n\n  get isConnected(): boolean {\n    return this.#connected;\n  }\n\n  async connect(options: ConnectOptions = {}): Promise<HandshakePayload> {\n    this.#assertNotDestroyed();\n\n    if (this.#connected && this.#authToken && this.#extensionDetails && this.#designTokens) {\n      return {\n        authToken: this.#authToken,\n        extensionDetails: this.#extensionDetails,\n        designTokens: this.#designTokens,\n        pageSettings: this.#pageSettings,\n      };\n    }\n\n    if (this.#pendingHandshake) {\n      throw new Error(\"Handshake already in progress.\");\n    }\n\n    this.#configureAuthTokenAutoRefresh(options);\n\n    const tenantUrl = readTenantUrlFromLocation();\n    this.#allowedOrigin = resolveAllowedOrigin(tenantUrl);\n\n    this.#unsubscribe?.();\n    this.#unsubscribe = subscribeToParentMessages(\n      this.#allowedOrigin,\n      (event) => this.#onMessage(event),\n    );\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n    const handshakePromise = new Promise<HandshakePayload>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingHandshake = null;\n        reject(new Error(`Handshake timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingHandshake = { resolve, reject, timer };\n    });\n\n    try {\n      postToParent(CONNECTION_EVENTS.handshakeInit, this.#allowedOrigin);\n    } catch (error) {\n      this.#clearPending(this.#pendingHandshake);\n      this.#pendingHandshake = null;\n      this.#unsubscribe?.();\n      this.#unsubscribe = null;\n      this.#allowedOrigin = null;\n      this.#clearProactiveTokenRefreshTimer();\n      throw error;\n    }\n\n    return handshakePromise;\n  }\n\n  destroy(): void {\n    this.#destroyed = true;\n    this.#connected = false;\n\n    this.#clearProactiveTokenRefreshTimer();\n    this.#authTokenAutoRefresh = false;\n    this.#authTokenRefreshRetryUsed = false;\n\n    this.#unsubscribe?.();\n    this.#unsubscribe = null;\n    this.#allowedOrigin = null;\n\n    this.#rejectPending(this.#pendingHandshake, new Error(\"SDK destroyed.\"));\n    this.#rejectPending(this.#pendingTokenRefresh, new Error(\"SDK destroyed.\"));\n    this.#rejectPending(this.#pendingPageSettingsUpdate, new Error(\"SDK destroyed.\"));\n    this.#pendingHandshake = null;\n    this.#pendingTokenRefresh = null;\n    this.#pendingPageSettingsUpdate = null;\n\n    this.#loadPageSettingsHandlers.clear();\n    this.#tokenRefreshHandlers.clear();\n\n    this.#authToken = null;\n    this.#extensionDetails = null;\n    this.#designTokens = null;\n    this.#pageSettings = null;\n  }\n\n  getAuthToken(): ScopedExtensionToken | null {\n    return this.#authToken;\n  }\n\n  getExtensionDetails(): ExtensionDetails | null {\n    return this.#extensionDetails;\n  }\n\n  getDesignTokens(): DesignTokens | null {\n    return this.#designTokens;\n  }\n\n  getPageSettings(): PageSettings | null {\n    return this.#pageSettings;\n  }\n\n  async apiCall<T>(\n    endpoint: string,\n    options: RequestInit = {},\n  ): Promise<T> {\n    this.#assertConnected();\n\n    return callApi<T>(\n      endpoint,\n      {\n        baseUrl: this.#extensionDetails!.baseUrl,\n        tenantDomain: this.#extensionDetails!.tenantDomain,\n        token: this.#authToken!.jwt,\n      },\n      options,\n    );\n  }\n\n  async emitRequestTokenRefresh(\n    options: RequestOptions = {},\n  ): Promise<ScopedExtensionToken> {\n    this.#assertConnected();\n\n    if (this.#pendingTokenRefresh) {\n      throw new Error(\"Token refresh already in progress.\");\n    }\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const allowedOrigin = this.#allowedOrigin!;\n\n    const promise = new Promise<ScopedExtensionToken>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingTokenRefresh = null;\n        reject(new Error(`Token refresh timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingTokenRefresh = { resolve, reject, timer };\n    });\n\n    postToParent(CONNECTION_EVENTS.requestTokenRefresh, allowedOrigin);\n    return promise;\n  }\n\n  async emitUpdatePageSettings(\n    payload: UpdatePageSettingsPayload,\n    options: RequestOptions = {},\n  ): Promise<PageSettingsUpdatedPayload> {\n    this.#assertConnected();\n\n    if (this.#pendingPageSettingsUpdate) {\n      throw new Error(\"Page settings update already in progress.\");\n    }\n\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const allowedOrigin = this.#allowedOrigin!;\n\n    const promise = new Promise<PageSettingsUpdatedPayload>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.#pendingPageSettingsUpdate = null;\n        reject(new Error(`Page settings update timed out after ${timeoutMs}ms.`));\n      }, timeoutMs);\n\n      this.#pendingPageSettingsUpdate = { resolve, reject, timer };\n    });\n\n    postToParent(CONNECTION_EVENTS.updatePageSettings, allowedOrigin, payload);\n    return promise;\n  }\n\n  onLoadPageSettings(handler: (settings: PageSettings) => void): () => void {\n    this.#loadPageSettingsHandlers.add(handler);\n    return () => {\n      this.#loadPageSettingsHandlers.delete(handler);\n    };\n  }\n\n  onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void {\n    this.#tokenRefreshHandlers.add(handler);\n    return () => {\n      this.#tokenRefreshHandlers.delete(handler);\n    };\n  }\n\n  emitNavigationChange(payload: NavigationChangePayload): void {\n    this.#assertConnected();\n    postToParent(\n      CONNECTION_EVENTS.navigationChange,\n      this.#allowedOrigin!,\n      payload,\n    );\n  }\n\n  #onMessage(event: MessageEvent<ExtensionMessage>): void {\n    const { type, payload } = event.data;\n\n    switch (type) {\n      case CONNECTION_EVENTS.handshakeAck:\n        this.#handleHandshakeAck(payload as HandshakePayload | undefined);\n        break;\n      case CONNECTION_EVENTS.tokenRefresh:\n        this.#handleTokenRefresh(payload as TokenRefreshPayload | undefined);\n        break;\n      case CONNECTION_EVENTS.loadPageSettings:\n        this.#handleLoadPageSettings(payload as PageSettings | undefined);\n        break;\n      case CONNECTION_EVENTS.pageSettingsUpdated:\n        this.#handlePageSettingsUpdated(\n          payload as PageSettingsUpdatedPayload | undefined,\n        );\n        break;\n      default:\n        break;\n    }\n  }\n\n  #handleHandshakeAck(payload: HandshakePayload | undefined): void {\n    if (!payload?.authToken || !payload.extensionDetails || !payload.designTokens) {\n      this.#rejectPending(\n        this.#pendingHandshake,\n        new Error(\"Invalid HANDSHAKE_ACK payload.\"),\n      );\n      this.#pendingHandshake = null;\n      return;\n    }\n\n    this.#authToken = payload.authToken;\n    this.#extensionDetails = payload.extensionDetails;\n    this.#designTokens = payload.designTokens;\n    this.#pageSettings = payload.pageSettings ?? null;\n    this.#connected = true;\n\n    const pending = this.#pendingHandshake;\n    this.#pendingHandshake = null;\n    this.#resolvePending(pending, {\n      authToken: this.#authToken,\n      extensionDetails: this.#extensionDetails,\n      designTokens: this.#designTokens,\n      pageSettings: this.#pageSettings,\n    });\n\n    this.#authTokenRefreshRetryUsed = false;\n    this.#scheduleProactiveTokenRefresh();\n  }\n\n  #handleTokenRefresh(payload: TokenRefreshPayload | undefined): void {\n    if (!payload?.authToken) {\n      this.#rejectPending(\n        this.#pendingTokenRefresh,\n        new Error(\"Invalid TOKEN_REFRESH payload.\"),\n      );\n      this.#pendingTokenRefresh = null;\n      return;\n    }\n\n    this.#authToken = payload.authToken;\n\n    const pending = this.#pendingTokenRefresh;\n    this.#pendingTokenRefresh = null;\n    this.#resolvePending(pending, this.#authToken);\n\n    for (const handler of this.#tokenRefreshHandlers) {\n      handler(this.#authToken);\n    }\n\n    this.#authTokenRefreshRetryUsed = false;\n    this.#scheduleProactiveTokenRefresh();\n  }\n\n  #handleLoadPageSettings(payload: PageSettings | undefined): void {\n    const settings = payload ?? {};\n    this.#pageSettings = settings;\n\n    for (const handler of this.#loadPageSettingsHandlers) {\n      handler(settings);\n    }\n  }\n\n  #handlePageSettingsUpdated(\n    payload: PageSettingsUpdatedPayload | undefined,\n  ): void {\n    if (!payload || typeof payload.success !== \"boolean\") {\n      this.#rejectPending(\n        this.#pendingPageSettingsUpdate,\n        new Error(\"Invalid PAGE_SETTINGS_UPDATED payload.\"),\n      );\n      this.#pendingPageSettingsUpdate = null;\n      return;\n    }\n\n    const pending = this.#pendingPageSettingsUpdate;\n    this.#pendingPageSettingsUpdate = null;\n    this.#resolvePending(pending, payload);\n  }\n\n  #assertNotDestroyed(): void {\n    if (this.#destroyed) {\n      throw new Error(\"SDK has been destroyed.\");\n    }\n  }\n\n  #assertConnected(): void {\n    this.#assertNotDestroyed();\n    if (!this.#connected || !this.#allowedOrigin) {\n      throw new Error(\"SDK is not connected. Call connect() first.\");\n    }\n  }\n\n  #configureAuthTokenAutoRefresh(options: ConnectOptions): void {\n    if (options.authTokenBufferMs !== undefined) {\n      if (\n        !Number.isFinite(options.authTokenBufferMs) ||\n        options.authTokenBufferMs < 0\n      ) {\n        throw new Error(\n          \"authTokenBufferMs must be a finite non-negative number.\",\n        );\n      }\n    }\n\n    this.#authTokenAutoRefresh = options.authTokenAutoRefresh === true;\n    this.#authTokenBufferMs =\n      options.authTokenBufferMs ?? DEFAULT_AUTH_TOKEN_BUFFER_MS;\n    this.#authTokenRefreshRetryUsed = false;\n    this.#clearProactiveTokenRefreshTimer();\n  }\n\n  #parseExpiresAtMs(token: ScopedExtensionToken): number | null {\n    const expiresSec = Number(token.expires);\n    if (!Number.isFinite(expiresSec)) {\n      return null;\n    }\n    return expiresSec * 1000;\n  }\n\n  #getProactiveRefreshDelayMs(token: ScopedExtensionToken): number | null {\n    const expiresAtMs = this.#parseExpiresAtMs(token);\n    if (expiresAtMs === null) {\n      return null;\n    }\n    return Math.max(0, expiresAtMs - this.#authTokenBufferMs - Date.now());\n  }\n\n  #clearProactiveTokenRefreshTimer(): void {\n    if (this.#authTokenRefreshTimer !== null) {\n      clearTimeout(this.#authTokenRefreshTimer);\n      this.#authTokenRefreshTimer = null;\n    }\n  }\n\n  #scheduleProactiveTokenRefresh(): void {\n    this.#clearProactiveTokenRefreshTimer();\n\n    if (\n      !this.#authTokenAutoRefresh ||\n      !this.#connected ||\n      this.#destroyed ||\n      !this.#authToken\n    ) {\n      return;\n    }\n\n    const delayMs = this.#getProactiveRefreshDelayMs(this.#authToken);\n    if (delayMs === null) {\n      return;\n    }\n\n    const clampedDelay = Math.min(delayMs, MAX_TIMEOUT_MS);\n    this.#authTokenRefreshTimer = setTimeout(() => {\n      this.#authTokenRefreshTimer = null;\n      void this.#runProactiveTokenRefresh();\n    }, clampedDelay);\n  }\n\n  async #runProactiveTokenRefresh(): Promise<void> {\n    if (\n      !this.#authTokenAutoRefresh ||\n      !this.#connected ||\n      this.#destroyed ||\n      !this.#authToken\n    ) {\n      return;\n    }\n\n    const tokenAtRequest = this.#authToken;\n    const delayMs = this.#getProactiveRefreshDelayMs(tokenAtRequest);\n    if (delayMs === null) {\n      return;\n    }\n\n    if (delayMs > 0) {\n      this.#scheduleProactiveTokenRefresh();\n      return;\n    }\n\n    if (this.#pendingTokenRefresh) {\n      this.#handleProactiveRefreshFailure(tokenAtRequest);\n      return;\n    }\n\n    try {\n      await this.emitRequestTokenRefresh();\n    } catch {\n      this.#handleProactiveRefreshFailure(tokenAtRequest);\n    }\n  }\n\n  #handleProactiveRefreshFailure(tokenAtRequest: ScopedExtensionToken): void {\n    if (\n      !this.#authTokenAutoRefresh ||\n      !this.#connected ||\n      this.#destroyed ||\n      this.#authToken?.jwt !== tokenAtRequest.jwt\n    ) {\n      return;\n    }\n\n    if (this.#authTokenRefreshRetryUsed) {\n      return;\n    }\n\n    const expiresAtMs = this.#parseExpiresAtMs(tokenAtRequest);\n    if (expiresAtMs === null) {\n      return;\n    }\n\n    const remainingMs = expiresAtMs - Date.now();\n    if (remainingMs <= 0) {\n      return;\n    }\n\n    this.#authTokenRefreshRetryUsed = true;\n    this.#clearProactiveTokenRefreshTimer();\n\n    const retryDelay = Math.min(AUTO_REFRESH_RETRY_DELAY_MS, remainingMs);\n    this.#authTokenRefreshTimer = setTimeout(() => {\n      this.#authTokenRefreshTimer = null;\n      void this.#runProactiveTokenRefresh();\n    }, retryDelay);\n  }\n\n  #clearPending(pending: { timer: ReturnType<typeof setTimeout> } | null): void {\n    if (pending) {\n      clearTimeout(pending.timer);\n    }\n  }\n\n  #resolvePending<T>(pending: Pending<T> | null, value: T): void {\n    if (!pending) {\n      return;\n    }\n    clearTimeout(pending.timer);\n    pending.resolve(value);\n  }\n\n  #rejectPending(\n    pending: { timer: ReturnType<typeof setTimeout>; reject: (reason?: unknown) => void } | null,\n    reason: unknown,\n  ): void {\n    if (!pending) {\n      return;\n    }\n    clearTimeout(pending.timer);\n    pending.reject(reason);\n  }\n}\n","import { ExtensionSDK, type IExtensionSDK } from \"./ExtensionSDK\";\n\nexport { ExtensionSDK, type IExtensionSDK } from \"./ExtensionSDK\";\nexport { CONNECTION_EVENTS, type ConnectionEvent } from \"./events\";\nexport {\n  InvalidOriginError,\n  readTenantUrlFromLocation,\n  resolveAllowedOrigin,\n} from \"./origin\";\nexport type {\n  ConnectOptions,\n  DesignTokens,\n  ExtensionDetails,\n  ExtensionMessage,\n  HandshakePayload,\n  NavigationChangePayload,\n  PageSettings,\n  PageSettingsUpdatedPayload,\n  RequestOptions,\n  ScopedExtensionToken,\n  TokenRefreshPayload,\n  UpdatePageSettingsPayload,\n} from \"./types\";\n\n/** Creates a new {@link IExtensionSDK} instance for the current extension frame. */\nexport const createExtensionSDK = (): IExtensionSDK => {\n  return new ExtensionSDK();\n};\n"],"mappings":";AAMA,SAAS,EAAa,GAAyB;CAC7C,IAAI,EAAQ,WAAW,GAAG,GACxB,OAAO;CAGT,IAAM,IAAM,IAAI,IAAI,CAAO;CAE3B,OADA,EAAI,WAAW,OAAO,EAAI,YACnB,EAAI;AACb;AAEA,SAAS,EAAmB,GAAiB,GAA0B;CACrE,IAAI,CAAC,EAAS,WAAW,GAAG,KAAK,EAAS,WAAW,IAAI,GACvD,MAAU,MACR,yEACF;CAGF,OAAO,GAAG,EAAa,CAAO,CAAC,CAAC,QAAQ,QAAQ,EAAE,IAAI;AACxD;AAEA,eAAsB,EACpB,GACA,GACA,IAAuB,CAAC,GACZ;CACZ,IAAM,IAAU,IAAI,QAAQ,EAAQ,OAAO;CAO3C,AALK,EAAQ,IAAI,cAAc,KAC7B,EAAQ,IAAI,gBAAgB,kBAAkB,GAGhD,EAAQ,IAAI,iBAAiB,UAAU,EAAQ,OAAO,GACtD,EAAQ,IAAI,YAAY,EAAQ,YAAY;CAE5C,IAAM,IAAW,MAAM,MAAM,EAAmB,EAAQ,SAAS,CAAQ,GAAG;EAC1E,GAAG;EACH;CACF,CAAC;CAED,IAAI,CAAC,EAAS,IAAI;EAChB,IAAM,IAAa,EAAS,aAAa,IAAI,EAAS,eAAe;EACrE,MAAU,MAAM,oBAAoB,EAAS,SAAS,EAAW,EAAE;CACrE;CAEA,OAAQ,MAAM,EAAS,KAAK;AAC9B;;;AC7CA,IAAa,IAAoB;CAE/B,eAAe;CAEf,cAAc;CAEd,qBAAqB;CAErB,cAAc;CAEd,kBAAkB;CAElB,oBAAoB;CAEpB,qBAAqB;CAErB,kBAAkB;AACpB;;;AClBA,SAAgB,EACd,GACA,GACA,GACM;CACN,IAAI,CAAC,OAAO,UAAU,OAAO,WAAW,QACtC,MAAU,MAAM,iDAAiD;CAGnE,IAAM,IAA4B,MAAY,KAAA,IAAY,EAAE,QAAK,IAAI;EAAE;EAAM;CAAQ;CACrF,OAAO,OAAO,YAAY,GAAS,CAAa;AAClD;AAEA,SAAgB,EACd,GACA,GACY;CACZ,IAAM,KAAY,MAAwB;EACpC,EAAM,WAAW,MAIjB,CAAC,EAAM,QAAQ,OAAO,EAAM,QAAS,YAAY,EAAE,UAAU,EAAM,SAIvE,EAAQ,CAAuC;CACjD;CAGA,OADA,OAAO,iBAAiB,WAAW,CAAQ,SAC9B,OAAO,oBAAoB,WAAW,CAAQ;AAC7D;;;ACpCA,IAAM,oBAAkB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAO,CAAC,GAGtD,IAAb,cAAwC,MAAM;CAC5C,YAAY,GAAiB;EAE3B,AADA,MAAM,CAAO,GACb,KAAK,OAAO;CACd;AACF;AAUA,SAAgB,EAAqB,GAAkC;CACrE,IAAI,CAAC,GACH,MAAM,IAAI,EACR,6EACF;CAGF,IAAI;CACJ,IAAI;EACF,IAAM,IAAI,IAAI,CAAS;CACzB,QAAQ;EACN,MAAM,IAAI,EAAmB,uBAAuB,EAAU,GAAG;CACnE;CAEA,IAAM,IAAc,EAAgB,IAAI,EAAI,QAAQ,GAC9C,IAAU,EAAI,aAAa,UAC3B,IAAc,EAAI,aAAa,WAAW;CAEhD,IAAI,CAAC,KAAW,CAAC,GACf,MAAM,IAAI,EACR,+DAA+D,EAAI,SAAS,IAAI,EAAI,KAAK,GAC3F;CAGF,OAAO,EAAI;AACb;AAUA,SAAgB,EACd,IAAiB,OAAO,SAAS,QAClB;CACf,OAAO,IAAI,gBAAgB,CAAM,CAAC,CAAC,IAAI,WAAW;AACpD;;;ACtCA,IAAM,IAAqB,KACrB,IAA+B,MAC/B,IAA8B,KAE9B,IAAiB,YAwHV,IAAb,MAAmD;CACjD,KAAgC;CAChC,KAAoC;CACpC,KAAa;CACb,KAAa;CAEb,KAA0C;CAC1C,KAA6C;CAC7C,KAAqC;CACrC,KAAqC;CAErC,KAAwB;CACxB,KAAqB;CACrB,KAA+D;CAC/D,KAA6B;CAE7B,KAAsD;CACtD,KAA6D;CAC7D,KAAyE;CAEzE,qBAA4B,IAAI,IAAsC;CACtE,qBAAwB,IAAI,IAA2C;CAEvE,IAAI,cAAuB;EACzB,OAAO,KAAKA;CACd;CAEA,MAAM,QAAQ,IAA0B,CAAC,GAA8B;EAGrE,IAFA,KAAKC,GAAoB,GAErB,KAAKD,MAAc,KAAKE,MAAc,KAAKC,MAAqB,KAAKC,IACvE,OAAO;GACL,WAAW,KAAKF;GAChB,kBAAkB,KAAKC;GACvB,cAAc,KAAKC;GACnB,cAAc,KAAKC;EACrB;EAGF,IAAI,KAAKC,IACP,MAAU,MAAM,gCAAgC;EAGlD,KAAKC,GAA+B,CAAO;EAE3C,IAAM,IAAY,EAA0B;EAI5C,AAHA,KAAKC,KAAiB,EAAqB,CAAS,GAEpD,KAAKC,KAAe,GACpB,KAAKA,KAAe,EAClB,KAAKD,KACJ,MAAU,KAAKE,GAAW,CAAK,CAClC;EAEA,IAAM,IAAY,EAAQ,aAAa,GAEjC,IAAmB,IAAI,SAA2B,GAAS,MAAW;GAC1E,IAAM,IAAQ,iBAAiB;IAE7B,AADA,KAAKJ,KAAoB,MACzB,EAAO,gBAAI,MAAM,6BAA6B,EAAU,IAAI,CAAC;GAC/D,GAAG,CAAS;GAEZ,KAAKA,KAAoB;IAAE;IAAS;IAAQ;GAAM;EACpD,CAAC;EAED,IAAI;GACF,EAAa,EAAkB,eAAe,KAAKE,EAAc;EACnE,SAAS,GAAO;GAOd,MANA,KAAKG,GAAc,KAAKL,EAAiB,GACzC,KAAKA,KAAoB,MACzB,KAAKG,KAAe,GACpB,KAAKA,KAAe,MACpB,KAAKD,KAAiB,MACtB,KAAKI,GAAiC,GAChC;EACR;EAEA,OAAO;CACT;CAEA,UAAgB;EAyBd,AAxBA,KAAKC,KAAa,IAClB,KAAKb,KAAa,IAElB,KAAKY,GAAiC,GACtC,KAAKE,KAAwB,IAC7B,KAAKC,KAA6B,IAElC,KAAKN,KAAe,GACpB,KAAKA,KAAe,MACpB,KAAKD,KAAiB,MAEtB,KAAKQ,GAAe,KAAKV,IAAmB,gBAAI,MAAM,gBAAgB,CAAC,GACvE,KAAKU,GAAe,KAAKC,IAAsB,gBAAI,MAAM,gBAAgB,CAAC,GAC1E,KAAKD,GAAe,KAAKE,IAA4B,gBAAI,MAAM,gBAAgB,CAAC,GAChF,KAAKZ,KAAoB,MACzB,KAAKW,KAAuB,MAC5B,KAAKC,KAA6B,MAElC,KAAKC,GAA0B,MAAM,GACrC,KAAKC,GAAsB,MAAM,GAEjC,KAAKlB,KAAa,MAClB,KAAKC,KAAoB,MACzB,KAAKC,KAAgB,MACrB,KAAKC,KAAgB;CACvB;CAEA,eAA4C;EAC1C,OAAO,KAAKH;CACd;CAEA,sBAA+C;EAC7C,OAAO,KAAKC;CACd;CAEA,kBAAuC;EACrC,OAAO,KAAKC;CACd;CAEA,kBAAuC;EACrC,OAAO,KAAKC;CACd;CAEA,MAAM,QACJ,GACA,IAAuB,CAAC,GACZ;EAGZ,OAFA,KAAKgB,GAAiB,GAEf,EACL,GACA;GACE,SAAS,KAAKlB,GAAmB;GACjC,cAAc,KAAKA,GAAmB;GACtC,OAAO,KAAKD,GAAY;EAC1B,GACA,CACF;CACF;CAEA,MAAM,wBACJ,IAA0B,CAAC,GACI;EAG/B,IAFA,KAAKmB,GAAiB,GAElB,KAAKJ,IACP,MAAU,MAAM,oCAAoC;EAGtD,IAAM,IAAY,EAAQ,aAAa,GACjC,IAAgB,KAAKT,IAErB,IAAU,IAAI,SAA+B,GAAS,MAAW;GACrE,IAAM,IAAQ,iBAAiB;IAE7B,AADA,KAAKS,KAAuB,MAC5B,EAAO,gBAAI,MAAM,iCAAiC,EAAU,IAAI,CAAC;GACnE,GAAG,CAAS;GAEZ,KAAKA,KAAuB;IAAE;IAAS;IAAQ;GAAM;EACvD,CAAC;EAGD,OADA,EAAa,EAAkB,qBAAqB,CAAa,GAC1D;CACT;CAEA,MAAM,uBACJ,GACA,IAA0B,CAAC,GACU;EAGrC,IAFA,KAAKI,GAAiB,GAElB,KAAKH,IACP,MAAU,MAAM,2CAA2C;EAG7D,IAAM,IAAY,EAAQ,aAAa,GACjC,IAAgB,KAAKV,IAErB,IAAU,IAAI,SAAqC,GAAS,MAAW;GAC3E,IAAM,IAAQ,iBAAiB;IAE7B,AADA,KAAKU,KAA6B,MAClC,EAAO,gBAAI,MAAM,wCAAwC,EAAU,IAAI,CAAC;GAC1E,GAAG,CAAS;GAEZ,KAAKA,KAA6B;IAAE;IAAS;IAAQ;GAAM;EAC7D,CAAC;EAGD,OADA,EAAa,EAAkB,oBAAoB,GAAe,CAAO,GAClE;CACT;CAEA,mBAAmB,GAAuD;EAExE,OADA,KAAKC,GAA0B,IAAI,CAAO,SAC7B;GACX,KAAKA,GAA0B,OAAO,CAAO;EAC/C;CACF;CAEA,eAAe,GAA4D;EAEzE,OADA,KAAKC,GAAsB,IAAI,CAAO,SACzB;GACX,KAAKA,GAAsB,OAAO,CAAO;EAC3C;CACF;CAEA,qBAAqB,GAAwC;EAE3D,AADA,KAAKC,GAAiB,GACtB,EACE,EAAkB,kBAClB,KAAKb,IACL,CACF;CACF;CAEA,GAAW,GAA6C;EACtD,IAAM,EAAE,SAAM,eAAY,EAAM;EAEhC,QAAQ,GAAR;GACE,KAAK,EAAkB;IACrB,KAAKc,GAAoB,CAAuC;IAChE;GACF,KAAK,EAAkB;IACrB,KAAKC,GAAoB,CAA0C;IACnE;GACF,KAAK,EAAkB;IACrB,KAAKC,GAAwB,CAAmC;IAChE;GACF,KAAK,EAAkB;IACrB,KAAKC,GACH,CACF;IACA;GACF,SACE;EACJ;CACF;CAEA,GAAoB,GAA6C;EAC/D,IAAI,CAAC,GAAS,aAAa,CAAC,EAAQ,oBAAoB,CAAC,EAAQ,cAAc;GAK7E,AAJA,KAAKT,GACH,KAAKV,IACL,gBAAI,MAAM,gCAAgC,CAC5C,GACA,KAAKA,KAAoB;GACzB;EACF;EAMA,AAJA,KAAKJ,KAAa,EAAQ,WAC1B,KAAKC,KAAoB,EAAQ,kBACjC,KAAKC,KAAgB,EAAQ,cAC7B,KAAKC,KAAgB,EAAQ,gBAAgB,MAC7C,KAAKL,KAAa;EAElB,IAAM,IAAU,KAAKM;EAUrB,AATA,KAAKA,KAAoB,MACzB,KAAKoB,GAAgB,GAAS;GAC5B,WAAW,KAAKxB;GAChB,kBAAkB,KAAKC;GACvB,cAAc,KAAKC;GACnB,cAAc,KAAKC;EACrB,CAAC,GAED,KAAKU,KAA6B,IAClC,KAAKY,GAA+B;CACtC;CAEA,GAAoB,GAAgD;EAClE,IAAI,CAAC,GAAS,WAAW;GAKvB,AAJA,KAAKX,GACH,KAAKC,IACL,gBAAI,MAAM,gCAAgC,CAC5C,GACA,KAAKA,KAAuB;GAC5B;EACF;EAEA,KAAKf,KAAa,EAAQ;EAE1B,IAAM,IAAU,KAAKe;EAErB,AADA,KAAKA,KAAuB,MAC5B,KAAKS,GAAgB,GAAS,KAAKxB,EAAU;EAE7C,KAAK,IAAM,KAAW,KAAKkB,IACzB,EAAQ,KAAKlB,EAAU;EAIzB,AADA,KAAKa,KAA6B,IAClC,KAAKY,GAA+B;CACtC;CAEA,GAAwB,GAAyC;EAC/D,IAAM,IAAW,KAAW,CAAC;EAC7B,KAAKtB,KAAgB;EAErB,KAAK,IAAM,KAAW,KAAKc,IACzB,EAAQ,CAAQ;CAEpB;CAEA,GACE,GACM;EACN,IAAI,CAAC,KAAW,OAAO,EAAQ,WAAY,WAAW;GAKpD,AAJA,KAAKH,GACH,KAAKE,IACL,gBAAI,MAAM,wCAAwC,CACpD,GACA,KAAKA,KAA6B;GAClC;EACF;EAEA,IAAM,IAAU,KAAKA;EAErB,AADA,KAAKA,KAA6B,MAClC,KAAKQ,GAAgB,GAAS,CAAO;CACvC;CAEA,KAA4B;EAC1B,IAAI,KAAKb,IACP,MAAU,MAAM,yBAAyB;CAE7C;CAEA,KAAyB;EAEvB,IADA,KAAKZ,GAAoB,GACrB,CAAC,KAAKD,MAAc,CAAC,KAAKQ,IAC5B,MAAU,MAAM,6CAA6C;CAEjE;CAEA,GAA+B,GAA+B;EAC5D,IAAI,EAAQ,sBAAsB,KAAA,MAE9B,CAAC,OAAO,SAAS,EAAQ,iBAAiB,KAC1C,EAAQ,oBAAoB,IAE5B,MAAU,MACR,yDACF;EAQJ,AAJA,KAAKM,KAAwB,EAAQ,yBAAyB,IAC9D,KAAKc,KACH,EAAQ,qBAAqB,GAC/B,KAAKb,KAA6B,IAClC,KAAKH,GAAiC;CACxC;CAEA,GAAkB,GAA4C;EAC5D,IAAM,IAAa,OAAO,EAAM,OAAO;EAIvC,OAHK,OAAO,SAAS,CAAU,IAGxB,IAAa,MAFX;CAGX;CAEA,GAA4B,GAA4C;EACtE,IAAM,IAAc,KAAKiB,GAAkB,CAAK;EAIhD,OAHI,MAAgB,OACX,OAEF,KAAK,IAAI,GAAG,IAAc,KAAKD,KAAqB,KAAK,IAAI,CAAC;CACvE;CAEA,KAAyC;EACvC,AAAI,KAAKE,OAA2B,SAClC,aAAa,KAAKA,EAAsB,GACxC,KAAKA,KAAyB;CAElC;CAEA,KAAuC;EAGrC,IAFA,KAAKlB,GAAiC,GAGpC,CAAC,KAAKE,MACN,CAAC,KAAKd,MACN,KAAKa,MACL,CAAC,KAAKX,IAEN;EAGF,IAAM,IAAU,KAAK6B,GAA4B,KAAK7B,EAAU;EAChE,IAAI,MAAY,MACd;EAGF,IAAM,IAAe,KAAK,IAAI,GAAS,CAAc;EACrD,KAAK4B,KAAyB,iBAAiB;GAE7C,AADA,KAAKA,KAAyB,MAC9B,KAAUE,GAA0B;EACtC,GAAG,CAAY;CACjB;CAEA,MAAMA,KAA2C;EAC/C,IACE,CAAC,KAAKlB,MACN,CAAC,KAAKd,MACN,KAAKa,MACL,CAAC,KAAKX,IAEN;EAGF,IAAM,IAAiB,KAAKA,IACtB,IAAU,KAAK6B,GAA4B,CAAc;EAC3D,UAAY,MAIhB;OAAI,IAAU,GAAG;IACf,KAAKJ,GAA+B;IACpC;GACF;GAEA,IAAI,KAAKV,IAAsB;IAC7B,KAAKgB,GAA+B,CAAc;IAClD;GACF;GAEA,IAAI;IACF,MAAM,KAAK,wBAAwB;GACrC,QAAQ;IACN,KAAKA,GAA+B,CAAc;GACpD;EAXA;CAYF;CAEA,GAA+B,GAA4C;EAUzE,IARE,CAAC,KAAKnB,MACN,CAAC,KAAKd,MACN,KAAKa,MACL,KAAKX,IAAY,QAAQ,EAAe,OAKtC,KAAKa,IACP;EAGF,IAAM,IAAc,KAAKc,GAAkB,CAAc;EACzD,IAAI,MAAgB,MAClB;EAGF,IAAM,IAAc,IAAc,KAAK,IAAI;EAC3C,IAAI,KAAe,GACjB;EAIF,AADA,KAAKd,KAA6B,IAClC,KAAKH,GAAiC;EAEtC,IAAM,IAAa,KAAK,IAAI,GAA6B,CAAW;EACpE,KAAKkB,KAAyB,iBAAiB;GAE7C,AADA,KAAKA,KAAyB,MAC9B,KAAUE,GAA0B;EACtC,GAAG,CAAU;CACf;CAEA,GAAc,GAAgE;EAC5E,AAAI,KACF,aAAa,EAAQ,KAAK;CAE9B;CAEA,GAAmB,GAA4B,GAAgB;EACxD,MAGL,aAAa,EAAQ,KAAK,GAC1B,EAAQ,QAAQ,CAAK;CACvB;CAEA,GACE,GACA,GACM;EACD,MAGL,aAAa,EAAQ,KAAK,GAC1B,EAAQ,OAAO,CAAM;CACvB;AACF,GC7lBa,UACJ,IAAI,EAAa"}

package/dist/index.d.cts

@@ -19,6 +19,8 @@ export declare const CONNECTION_EVENTS: {
     readonly updatePageSettings: "UPDATE_PAGE_SETTINGS";
     /** Parent → child: result of a page settings update. */
     readonly pageSettingsUpdated: "PAGE_SETTINGS_UPDATED";
+    /** Child → parent: extension route changed. */
+    readonly navigationChange: "NAVIGATION_CHANGE";
 };
 
 /** Union of all {@link CONNECTION_EVENTS} wire string values. */
@@ -28,6 +30,30 @@ export declare type ConnectionEvent = (typeof CONNECTION_EVENTS)[keyof typeof CO
 export declare interface ConnectOptions {
     /** Handshake timeout in milliseconds (default 10_000). */
     timeoutMs?: number;
+    /**
+     * Enables proactive token refresh. After the handshake, the SDK reads the
+     * token's Unix-seconds `expires` value and arms a one-shot timer for
+     * `expires - authTokenBufferMs`; it does not run a polling interval.
+     *
+     * Every successful manual, automatic, or parent-pushed token update cancels
+     * the previous timer and schedules a new one from the new token's expiry.
+     * If an automatic request fails, it retries once after 30 seconds while the
+     * same token is still current and unexpired. {@link ExtensionSDK.destroy}
+     * clears the timer. Missing or invalid expiry values disable scheduling for
+     * that token without failing the connection.
+     *
+     * Default: `false`.
+     */
+    authTokenAutoRefresh?: boolean;
+    /**
+     * How many milliseconds before token expiry the one-shot refresh timer
+     * should fire. Must be finite and non-negative. If the token is already
+     * inside this buffer when received, refresh is requested immediately.
+     *
+     * Default: `120_000` (2 minutes). Ignored unless
+     * {@link authTokenAutoRefresh} is enabled.
+     */
+    authTokenBufferMs?: number;
 }
 
 /** Creates a new {@link IExtensionSDK} instance for the current extension frame. */
@@ -69,10 +95,12 @@ export declare class ExtensionSDK implements IExtensionSDK {
     getExtensionDetails(): ExtensionDetails | null;
     getDesignTokens(): DesignTokens | null;
     getPageSettings(): PageSettings | null;
-    requestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;
-    updatePageSettings(settings: PageSettings, options?: RequestOptions): Promise<PageSettingsUpdatedPayload>;
+    apiCall<T>(endpoint: string, options?: RequestInit): Promise<T>;
+    emitRequestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;
+    emitUpdatePageSettings(payload: UpdatePageSettingsPayload, options?: RequestOptions): Promise<PageSettingsUpdatedPayload>;
     onLoadPageSettings(handler: (settings: PageSettings) => void): () => void;
     onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void;
+    emitNavigationChange(payload: NavigationChangePayload): void;
 }
 
 /** Payload delivered with a successful `HANDSHAKE_ACK`. */
@@ -97,15 +125,18 @@ export declare interface IExtensionSDK {
      * without sending another init. Concurrent calls while a handshake is
      * in progress throw.
      *
-     * @param options - Optional handshake timeout (default 10s).
+     * Opt-in proactive refresh can be enabled with
+     * `authTokenAutoRefresh: true` (optional `authTokenBufferMs`).
+     *
+     * @param options - Handshake timeout and optional auth-token auto-refresh.
      * @throws {InvalidOriginError} When `tenantUrl` is missing or invalid.
      * @throws When not embedded in a parent frame, already handshaking,
      *   destroyed, or the handshake times out / returns an invalid payload.
      */
     connect(options?: ConnectOptions): Promise<HandshakePayload>;
     /**
-     * Tears down listeners and cached state. Rejects any in-flight requests.
-     * The instance cannot be reused after destroy.
+     * Tears down listeners, proactive refresh timers, and cached state.
+     * Rejects any in-flight requests. The instance cannot be reused after destroy.
      */
     destroy(): void;
     /** Whether a successful handshake has completed and not been destroyed. */
@@ -121,6 +152,19 @@ export declare interface IExtensionSDK {
      * `null` until set.
      */
     getPageSettings(): PageSettings | null;
+    /**
+     * Calls the Kadanza Platform API with the current connection credentials.
+     *
+     * The API origin is derived from the handshake `baseUrl`. Authorization and
+     * tenant headers are managed by the SDK and cannot be overridden.
+     *
+     * @typeParam T - Expected JSON response body.
+     * @param endpoint - Root-relative API path.
+     * @param options - Standard fetch options.
+     * @throws When not connected, the endpoint is invalid, the request fails,
+     *   or the response is not successful JSON.
+     */
+    apiCall<T>(endpoint: string, options?: RequestInit): Promise<T>;
     /**
      * Asks the parent for a new token and waits for `TOKEN_REFRESH`.
      *
@@ -128,16 +172,16 @@ export declare interface IExtensionSDK {
      * @throws When not connected, a refresh is already in progress,
      *   or the request times out / returns an invalid payload.
      */
-    requestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;
+    emitRequestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;
     /**
      * Pushes page settings to the parent and waits for `PAGE_SETTINGS_UPDATED`.
      *
-     * @param settings - Settings object to send.
+     * @param payload - Update payload containing the settings object.
      * @param options - Optional request timeout (default 10s).
      * @throws When not connected, an update is already in progress,
      *   or the request times out / returns an invalid payload.
      */
-    updatePageSettings(settings: PageSettings, options?: RequestOptions): Promise<PageSettingsUpdatedPayload>;
+    emitUpdatePageSettings(payload: UpdatePageSettingsPayload, options?: RequestOptions): Promise<PageSettingsUpdatedPayload>;
     /**
      * Registers a handler for parent-initiated `LOAD_PAGE_SETTINGS`.
      *
@@ -150,6 +194,15 @@ export declare interface IExtensionSDK {
      * @returns Unsubscribe function.
      */
     onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void;
+    /**
+     * Notifies the parent that the extension's route changed.
+     *
+     * Wire: `NAVIGATION_CHANGE` (fire-and-forget).
+     *
+     * @param payload - Navigation change payload (`path` within the extension).
+     * @throws When not connected or destroyed.
+     */
+    emitNavigationChange(payload: NavigationChangePayload): void;
 }
 
 /** Thrown when `tenantUrl` is missing or not a safe postMessage origin. */
@@ -157,6 +210,11 @@ export declare class InvalidOriginError extends Error {
     constructor(message: string);
 }
 
+/** Payload for `NAVIGATION_CHANGE` (child → parent). */
+export declare interface NavigationChangePayload {
+    path: string;
+}
+
 /** Opaque page-level settings bag owned by the extension and synced with the parent. */
 export declare type PageSettings = Record<string, unknown>;
 
@@ -203,4 +261,9 @@ export declare interface TokenRefreshPayload {
     authToken: ScopedExtensionToken;
 }
 
+/** Payload for `UPDATE_PAGE_SETTINGS` (child → parent). */
+export declare interface UpdatePageSettingsPayload {
+    settings: PageSettings;
+}
+
 export { }

package/dist/index.d.ts

@@ -19,6 +19,8 @@ export declare const CONNECTION_EVENTS: {
     readonly updatePageSettings: "UPDATE_PAGE_SETTINGS";
     /** Parent → child: result of a page settings update. */
     readonly pageSettingsUpdated: "PAGE_SETTINGS_UPDATED";
+    /** Child → parent: extension route changed. */
+    readonly navigationChange: "NAVIGATION_CHANGE";
 };
 
 /** Union of all {@link CONNECTION_EVENTS} wire string values. */
@@ -28,6 +30,30 @@ export declare type ConnectionEvent = (typeof CONNECTION_EVENTS)[keyof typeof CO
 export declare interface ConnectOptions {
     /** Handshake timeout in milliseconds (default 10_000). */
     timeoutMs?: number;
+    /**
+     * Enables proactive token refresh. After the handshake, the SDK reads the
+     * token's Unix-seconds `expires` value and arms a one-shot timer for
+     * `expires - authTokenBufferMs`; it does not run a polling interval.
+     *
+     * Every successful manual, automatic, or parent-pushed token update cancels
+     * the previous timer and schedules a new one from the new token's expiry.
+     * If an automatic request fails, it retries once after 30 seconds while the
+     * same token is still current and unexpired. {@link ExtensionSDK.destroy}
+     * clears the timer. Missing or invalid expiry values disable scheduling for
+     * that token without failing the connection.
+     *
+     * Default: `false`.
+     */
+    authTokenAutoRefresh?: boolean;
+    /**
+     * How many milliseconds before token expiry the one-shot refresh timer
+     * should fire. Must be finite and non-negative. If the token is already
+     * inside this buffer when received, refresh is requested immediately.
+     *
+     * Default: `120_000` (2 minutes). Ignored unless
+     * {@link authTokenAutoRefresh} is enabled.
+     */
+    authTokenBufferMs?: number;
 }
 
 /** Creates a new {@link IExtensionSDK} instance for the current extension frame. */
@@ -69,10 +95,12 @@ export declare class ExtensionSDK implements IExtensionSDK {
     getExtensionDetails(): ExtensionDetails | null;
     getDesignTokens(): DesignTokens | null;
     getPageSettings(): PageSettings | null;
-    requestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;
-    updatePageSettings(settings: PageSettings, options?: RequestOptions): Promise<PageSettingsUpdatedPayload>;
+    apiCall<T>(endpoint: string, options?: RequestInit): Promise<T>;
+    emitRequestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;
+    emitUpdatePageSettings(payload: UpdatePageSettingsPayload, options?: RequestOptions): Promise<PageSettingsUpdatedPayload>;
     onLoadPageSettings(handler: (settings: PageSettings) => void): () => void;
     onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void;
+    emitNavigationChange(payload: NavigationChangePayload): void;
 }
 
 /** Payload delivered with a successful `HANDSHAKE_ACK`. */
@@ -97,15 +125,18 @@ export declare interface IExtensionSDK {
      * without sending another init. Concurrent calls while a handshake is
      * in progress throw.
      *
-     * @param options - Optional handshake timeout (default 10s).
+     * Opt-in proactive refresh can be enabled with
+     * `authTokenAutoRefresh: true` (optional `authTokenBufferMs`).
+     *
+     * @param options - Handshake timeout and optional auth-token auto-refresh.
      * @throws {InvalidOriginError} When `tenantUrl` is missing or invalid.
      * @throws When not embedded in a parent frame, already handshaking,
      *   destroyed, or the handshake times out / returns an invalid payload.
      */
     connect(options?: ConnectOptions): Promise<HandshakePayload>;
     /**
-     * Tears down listeners and cached state. Rejects any in-flight requests.
-     * The instance cannot be reused after destroy.
+     * Tears down listeners, proactive refresh timers, and cached state.
+     * Rejects any in-flight requests. The instance cannot be reused after destroy.
      */
     destroy(): void;
     /** Whether a successful handshake has completed and not been destroyed. */
@@ -121,6 +152,19 @@ export declare interface IExtensionSDK {
      * `null` until set.
      */
     getPageSettings(): PageSettings | null;
+    /**
+     * Calls the Kadanza Platform API with the current connection credentials.
+     *
+     * The API origin is derived from the handshake `baseUrl`. Authorization and
+     * tenant headers are managed by the SDK and cannot be overridden.
+     *
+     * @typeParam T - Expected JSON response body.
+     * @param endpoint - Root-relative API path.
+     * @param options - Standard fetch options.
+     * @throws When not connected, the endpoint is invalid, the request fails,
+     *   or the response is not successful JSON.
+     */
+    apiCall<T>(endpoint: string, options?: RequestInit): Promise<T>;
     /**
      * Asks the parent for a new token and waits for `TOKEN_REFRESH`.
      *
@@ -128,16 +172,16 @@ export declare interface IExtensionSDK {
      * @throws When not connected, a refresh is already in progress,
      *   or the request times out / returns an invalid payload.
      */
-    requestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;
+    emitRequestTokenRefresh(options?: RequestOptions): Promise<ScopedExtensionToken>;
     /**
      * Pushes page settings to the parent and waits for `PAGE_SETTINGS_UPDATED`.
      *
-     * @param settings - Settings object to send.
+     * @param payload - Update payload containing the settings object.
      * @param options - Optional request timeout (default 10s).
      * @throws When not connected, an update is already in progress,
      *   or the request times out / returns an invalid payload.
      */
-    updatePageSettings(settings: PageSettings, options?: RequestOptions): Promise<PageSettingsUpdatedPayload>;
+    emitUpdatePageSettings(payload: UpdatePageSettingsPayload, options?: RequestOptions): Promise<PageSettingsUpdatedPayload>;
     /**
      * Registers a handler for parent-initiated `LOAD_PAGE_SETTINGS`.
      *
@@ -150,6 +194,15 @@ export declare interface IExtensionSDK {
      * @returns Unsubscribe function.
      */
     onTokenRefresh(handler: (token: ScopedExtensionToken) => void): () => void;
+    /**
+     * Notifies the parent that the extension's route changed.
+     *
+     * Wire: `NAVIGATION_CHANGE` (fire-and-forget).
+     *
+     * @param payload - Navigation change payload (`path` within the extension).
+     * @throws When not connected or destroyed.
+     */
+    emitNavigationChange(payload: NavigationChangePayload): void;
 }
 
 /** Thrown when `tenantUrl` is missing or not a safe postMessage origin. */
@@ -157,6 +210,11 @@ export declare class InvalidOriginError extends Error {
     constructor(message: string);
 }
 
+/** Payload for `NAVIGATION_CHANGE` (child → parent). */
+export declare interface NavigationChangePayload {
+    path: string;
+}
+
 /** Opaque page-level settings bag owned by the extension and synced with the parent. */
 export declare type PageSettings = Record<string, unknown>;
 
@@ -203,4 +261,9 @@ export declare interface TokenRefreshPayload {
     authToken: ScopedExtensionToken;
 }
 
+/** Payload for `UPDATE_PAGE_SETTINGS` (child → parent). */
+export declare interface UpdatePageSettingsPayload {
+    settings: PageSettings;
+}
+
 export { }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadanza/extension-sdk",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Helpers for building extensions",
   "keywords": [
     "kadanza",
@@ -46,6 +46,7 @@
     "prepublishOnly": "npm run build && npm run check:types"
   },
   "devDependencies": {
+    "@vitejs/plugin-basic-ssl": "^2.3.0",
     "typedoc": "^0.28.20",
     "typescript": "~6.0.2",
     "vite": "^8.1.1",