POS token creation accepts explicit POS-scoped access roles only. Generic roles
such as ROLE_MANAGER and global administrative roles are rejected by the input
schema. The API also validates issuer permissions and rejects legacy unsafe
POS tokens during authentication. The API release migration preserves keys containing exactly ROLE_MANAGER by
converting them to scoped roles. Other unsupported combinations need replacement. Full-access token schemas retain their separate administrative contract.
Build and test with pnpm --filter @deliverart/sdk-js-api-token build and
pnpm --filter @deliverart/sdk-js-api-token test.