function createSpaCurrentUser({ fetchJson }) {
  async function requestCurrentUser() {
    const debugRequests = [];
    let user = null;
    try {
      const result = await fetchJson("https://spa.oracle.com/oalcrm/web/api/identity-management/users/current", {
        method: "GET", credentials: "include", cache: "no-store", headers: { Accept: "application/json" }
      }, "requestCurrentUser", debugRequests);
      if (!result?.user || !Array.isArray(result.user.roles) || result.user.roles.some(role => typeof role !== "string")) {
        throw new Error("requestCurrentUser returned invalid user roles.");
      }
      user = { id: result.user.id, name: result.user.name, roles: result.user.roles };
      return { ok: true, user, debugRequests };
    } catch (error) {
      for (const entry of debugRequests) { entry.status = "failed"; entry.error = error.message; }
      error.debugRequests = debugRequests;
      throw error;
    } finally {
      // The identity token is not needed by content scripts or debug, including on failures.
      for (const entry of debugRequests) {
        entry.responseBody = JSON.stringify(user ? { user, token: "(redacted)" } : { error: "Identity response omitted." }, null, 2);
        entry.responseBodyTruncated = false;
      }
    }
  }
  return { requestCurrentUser };
}