<!-- source-hash: 585108e1683f75548fc4f177781fa0c8 -->
A client-side `fetch` wrapper for embedded surfaces (chat, ticket center, widgets) that automatically attaches bearer-act-as proxy authentication headers from `sessionStorage` while enforcing same-origin security.

## Key Components

### `embedAuthedFetch(url, init?)`
Drop-in replacement for `fetch()` that:
- Normalizes `RequestInit.headers` (handles `Headers` instance, tuple arrays, or plain objects) into `Record<string, string>`
- Delegates to `applyProxyAuth` to merge `Authorization` and `X-Chat-Act-As` headers — **proxy credentials always win** over caller-supplied headers
- Defaults `Content-Type: application/json` when no headers are provided
- Forces `credentials: 'same-origin'` to ensure Supabase auth cookies are included alongside bearer tokens

### `assertSameOrigin(url)` *(internal)*
Defense-in-depth guard that:
- Resolves all URL forms (relative, absolute, protocol-relative, whitespace-prefixed) against `window.location.href` via the WHATWG `URL` constructor — bypasses regex shortcuts vulnerable to `\t`/`\n` prefix tricks
- Blocks non-`http(s):` schemes explicitly (`javascript:`, `data:`, `blob:`, etc.)
- Throws on cross-origin destinations before any bearer token leaves the page
- Skips silently during SSR (`typeof window === 'undefined'`)

## Usage Example

```typescript
// JSON POST to chat API — proxy headers attached automatically
const res = await embedAuthedFetch('/api/chat/messages', {
  method: 'POST',
  body: JSON.stringify({ message: 'Hello' }),
})

// GET with explicit empty headers — skips Content-Type default
const upload = await embedAuthedFetch('/api/storage/generate-upload-url', {
  method: 'GET',
  headers: {},
})

// Vanilla fetch — use for routes that don't need bearer-act-as
const profile = await fetch('/api/profile/me', { credentials: 'same-origin' })
```

> Routes outside the `/api/chat/*`, `/api/docs/chat/*`, or `/api/storage/generate-upload-url` surfaces should use vanilla `fetch` — this wrapper is scoped to embedded auth contexts only.