@geniee-inc/sfa-kit 1.16.0 → 1.17.0

package/GUIDE.md

@@ -21,7 +21,97 @@ import pkg from '@geniee-inc/sfa-kit/package.json';
 // pkg.version -> '1.14.0'
 ```
 
-Two additional subpaths are available: `@geniee-inc/sfa-kit/signing` exposes bundle-signing utilities (`computeContentHash`, `computeSignature`, `createManifest`, `createManifestFromDirectory`) for Node.js environments, and `./package.json` exposes the manifest. Internal modules cannot be imported directly.
+Three additional subpaths are available: `@geniee-inc/sfa-kit/signing` exposes bundle-manifest utilities, `@geniee-inc/sfa-kit/bundle` builds and signs a static bundle in one call (both Node.js-only), and `./package.json` exposes the manifest. Internal modules cannot be imported directly.
+
+### Static bundle manifest (custom-tab uploads)
+
+A page uploaded through GENIEE's SFA/CRM settings UI as a custom tab is a framework-free static bundle — `index.html` + `manifest.json` + `assets/` — not a Next.js app. Its `manifest.json` carries the three fields Keystone's `BundleSignatureVerifier` reads: `studio_version`, `content_hash`, `signature`.
+
+**The signing key lives only in Keystone, so a page build never computes the signature itself.** It hashes the bundle locally and asks Keystone to sign:
+
+```ts
+import {
+  readBundleFiles,
+  computeContentHash,
+} from '@geniee-inc/sfa-kit/signing';
+import type { BundleManifest } from '@geniee-inc/sfa-kit/signing';
+
+const files = await readBundleFiles('dist');
+const contentHash = computeContentHash(files);
+
+// Keystone holds the signing key, so ask it for the signature. The Bearer token
+// is the same one the rest of the API is called with.
+const response = await fetch(`${apiBase}/v1/pages/sign`, {
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    Authorization: `Bearer ${accessToken}`,
+  },
+  body: JSON.stringify({
+    studio_version: studioVersion,
+    content_hash: contentHash,
+  }),
+});
+if (!response.ok) throw new Error(`Signing failed: ${response.status}`);
+const { signature } = (await response.json()) as { signature: string };
+
+const manifest: BundleManifest = {
+  studio_version: studioVersion, // the Studio build version, NOT the sfa-kit npm version
+  content_hash: contentHash,
+  signature,
+};
+```
+
+### Building the bundle
+
+`@geniee-inc/sfa-kit/bundle` does the whole build in one call: it bundles the entry module with esbuild, writes `index.html`, hashes the result, gets the signature from Keystone and writes `manifest.json`.
+
+```ts
+import { buildStaticBundle } from '@geniee-inc/sfa-kit/bundle';
+
+await buildStaticBundle({
+  entry: 'entry.tsx', // renders <SfaLoginGate>…</SfaLoginGate> into #root
+  outDir: 'dist',
+  studioVersion: '0.5.0', // the Studio build version, NOT the sfa-kit npm version
+  apiBase: 'https://keystone-api-staging.chikyu.mobi',
+  accessToken: token,
+});
+```
+
+Or from the command line, which is the shorter path when a build script drives it:
+
+```bash
+SFA_KIT_ACCESS_TOKEN=<token> npx sfa-kit-bundle \
+  --entry entry.tsx \
+  --out dist \
+  --studio-version 0.5.0 \
+  --api-base https://keystone-api-staging.chikyu.mobi
+```
+
+The token comes from the environment rather than a flag, so it stays out of shell history and the process list.
+
+Then zip the **contents** of `dist/` — the bundle's files have to sit at the zip root, not inside a wrapper folder. Zipping is left to the caller: Node ships no zip writer, and every caller already has one.
+
+`esbuild` is an optional peer dependency; install it alongside the kit. Its options are fixed: JS, JSX, TS and CSS bundle, but there is no loader for images or fonts, so a page importing a `.png`, `.svg` or a font — including through `url()` in CSS — fails to build. Inline such assets as data URIs, or reference them by absolute URL.
+Nothing is written when signing fails, so a failed build never leaves an unsigned bundle behind to be uploaded by mistake.
+
+`studioVersion` has no default on purpose. The signature covers `"{studio_version}:{content_hash}"` and Keystone reads the field back separately, so a guessed value produces a valid signature over the wrong version.
+
+### Signing exports
+
+The lower-level pieces `buildStaticBundle` uses, for a caller that builds its own way:
+
+| Export                        | Needs the signing key |
+| ----------------------------- | --------------------- |
+| `readBundleFiles`             | No                    |
+| `computeContentHash`          | No                    |
+| `computeSignature`            | **Yes**               |
+| `createManifest`              | **Yes**               |
+| `createManifestFromDirectory` | **Yes**               |
+
+The three key-taking exports exist for the service that holds the key. Calling them from a page build means inventing a key, which Keystone will not accept — and the mistake is invisible at first, because bundle verification ships in `disabled` mode: the upload succeeds, and only starts failing once the mode is switched to `enforced`.
+
+`content_hash` must come from `computeContentHash`, never from hashing files back to back. The algorithm length-prefixes each path and each file's contents before feeding them into one running SHA-256; without those prefixes `"ab" + "c"` and `"a" + "bc"` hash identically, and the result never matches Keystone's own computation.
 
 ## Architecture
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geniee-inc/sfa-kit",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "React hooks and components for building pages that connect to GENIEE SFA/CRM data.",
   "type": "module",
   "main": "./src/index.js",
@@ -17,8 +17,19 @@
       "import": "./src/signing.js",
       "default": "./src/signing.js"
     },
+    "./bundle": {
+      "types": "./src/bundle.d.ts",
+      "import": "./src/bundle.js",
+      "default": "./src/bundle.js"
+    },
     "./package.json": "./package.json"
   },
+  "bin": {
+    "sfa-kit-bundle": "./src/bin/sfa-kit-bundle.js"
+  },
+  "engines": {
+    "node": ">=20.1.0"
+  },
   "sideEffects": false,
   "files": [
     "src",
@@ -33,9 +44,15 @@
   "license": "MIT",
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",
-    "react-dom": "^18.0.0 || ^19.0.0"
+    "react-dom": "^18.0.0 || ^19.0.0",
+    "esbuild": ">=0.18.0"
   },
   "dependencies": {
     "tslib": "^2.3.0"
+  },
+  "peerDependenciesMeta": {
+    "esbuild": {
+      "optional": true
+    }
   }
 }

package/src/bin/sfa-kit-bundle.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * @description Runs the bundler from the command line.
+ *
+ * Exported so the test suite drives the same entry point the `bin` does, and
+ * so a caller embedding it can pass argv explicitly.
+ *
+ * @returns The process exit code. 0 on success, 1 on any failure.
+ */
+export declare function runBundleCli(argv: readonly string[], env: Readonly<Record<string, string | undefined>>, out: {
+    log(message: string): void;
+    error(message: string): void;
+}): Promise<number>;

package/src/bin/sfa-kit-bundle.js

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+import { __awaiter } from "tslib";
+import { basename } from 'node:path';
+import { parseArgs } from 'node:util';
+import { buildStaticBundle } from '../lib/bundle/index.js';
+/** The access token is read from here, never from an argument. */
+const TOKEN_ENV = 'SFA_KIT_ACCESS_TOKEN';
+const USAGE = `sfa-kit-bundle — build and sign a static bundle for an SFA/CRM custom tab
+
+Usage:
+  ${TOKEN_ENV}=<token> npx sfa-kit-bundle \\
+    --entry entry.tsx \\
+    --out dist \\
+    --studio-version 0.5.0 \\
+    --api-base https://keystone-api-staging.chikyu.mobi
+
+Options:
+  --entry           Entry module that mounts the page into #root. Required.
+  --out             Output directory. Required.
+  --studio-version  The Studio build version this bundle targets, not the
+                    sfa-kit npm version. Required.
+  --api-base        Keystone API base, without a trailing slash. Required.
+  --title           <title> of the generated index.html. Default: SFA/CRM.
+  --help            Show this message.
+
+Environment:
+  ${TOKEN_ENV}  Bearer token for Keystone, the same one the rest of the
+  API is called with. Required, and read from the environment rather than an
+  argument so it does not land in shell history or in the process list.
+
+Writes index.html, assets/bundle.js and a signed manifest.json. Zip the
+contents of the output directory — the files have to sit at the zip root.
+Needs esbuild installed alongside the kit.`;
+const OPTIONS = {
+    entry: { type: 'string' },
+    out: { type: 'string' },
+    'studio-version': { type: 'string' },
+    'api-base': { type: 'string' },
+    title: { type: 'string' },
+    help: { type: 'boolean' },
+};
+/**
+ * @description Reads the flags, reporting a malformed command line as data.
+ *
+ * NOTE: `parseArgs` throws on a misspelled flag, a flag with no value, and a
+ * stray positional. Left to propagate, those would reject the promise the bin
+ * only attaches `.then()` to, and the user would get a stack trace where the
+ * usage text belongs.
+ */
+function parseCliOptions(argv) {
+    try {
+        const { values } = parseArgs({
+            args: [...argv],
+            options: OPTIONS,
+            allowPositionals: false,
+        });
+        return { values };
+    }
+    catch (thrown) {
+        return { error: thrown instanceof Error ? thrown.message : String(thrown) };
+    }
+}
+/**
+ * @description Runs the bundler from the command line.
+ *
+ * Exported so the test suite drives the same entry point the `bin` does, and
+ * so a caller embedding it can pass argv explicitly.
+ *
+ * @returns The process exit code. 0 on success, 1 on any failure.
+ */
+export function runBundleCli(argv, env, out) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f;
+        const parsed = parseCliOptions(argv);
+        if (parsed.error != null) {
+            out.error(`${parsed.error}\n\n${USAGE}`);
+            return 1;
+        }
+        const values = parsed.values;
+        if (values.help) {
+            out.log(USAGE);
+            return 0;
+        }
+        const missing = ['entry', 'out', 'studio-version', 'api-base']
+            .filter(name => { var _a; return ((_a = values[name]) !== null && _a !== void 0 ? _a : '') === ''; })
+            .map(name => `--${name}`);
+        const accessToken = (_a = env[TOKEN_ENV]) !== null && _a !== void 0 ? _a : '';
+        if (accessToken === '')
+            missing.push(TOKEN_ENV);
+        if (missing.length > 0) {
+            out.error(`Missing required: ${missing.join(', ')}\n\n${USAGE}`);
+            return 1;
+        }
+        try {
+            const manifest = yield buildStaticBundle(Object.assign({ entry: (_b = values.entry) !== null && _b !== void 0 ? _b : '', outDir: (_c = values.out) !== null && _c !== void 0 ? _c : '', studioVersion: (_d = values['studio-version']) !== null && _d !== void 0 ? _d : '', apiBase: (_e = values['api-base']) !== null && _e !== void 0 ? _e : '', accessToken }, (((_f = values.title) !== null && _f !== void 0 ? _f : '') === '' ? {} : { title: values.title })));
+            out.log(`Built and signed ${values.out} ` +
+                `(studio_version ${manifest.studio_version}, ` +
+                `content_hash ${manifest.content_hash}).`);
+            return 0;
+        }
+        catch (thrown) {
+            // NOTE: buildStaticBundle removes what it wrote, so there is normally
+            // nothing left to upload. The one case where output survives — cleanup
+            // itself failing — says so in its own message.
+            out.error(`${thrown instanceof Error ? thrown.message : String(thrown)}\n` +
+                'Nothing was signed, so nothing is ready to upload.');
+            return 1;
+        }
+    });
+}
+/** True when this module is what node was asked to run, not an import of it. */
+function isEntryPoint() {
+    // NOTE: the file name, not a substring of the path. `includes()` would also
+    // fire for a consumer script under, say, ~/work/sfa-kit-bundle-demo/, which
+    // would start the CLI merely because that script imported runBundleCli.
+    //
+    // `import.meta.url` would be the exact comparison, but Jest transforms this
+    // file to CommonJS, where that syntax does not parse and the whole suite
+    // fails to load.
+    const invoked = process.argv[1];
+    if (invoked == null)
+        return false;
+    const name = basename(invoked);
+    return name === 'sfa-kit-bundle' || name === 'sfa-kit-bundle.js';
+}
+/* istanbul ignore next -- the process wiring is exercised by running the bin */
+if (isEntryPoint()) {
+    // NOTE: no top-level await — the package's module target does not allow it.
+    void runBundleCli(process.argv.slice(2), process.env, {
+        log: message => console.log(message),
+        error: message => console.error(message),
+    })
+        .then(code => {
+        process.exitCode = code;
+    })
+        .catch((thrown) => {
+        // Nothing above should reject, but an unhandled rejection would exit 0
+        // on some Node versions — reporting a failed build as a success.
+        console.error(thrown instanceof Error ? thrown.message : String(thrown));
+        process.exitCode = 1;
+    });
+}

package/src/bundle.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Static bundle builder for GENIEE SFA/CRM custom-tab uploads.
+ *
+ * This subpath export (`@geniee-inc/sfa-kit/bundle`) is Node.js-only and needs
+ * `esbuild` installed alongside the kit. It produces the framework-free
+ * `index.html` + `assets/bundle.js` + signed `manifest.json` a page is uploaded
+ * as; the caller zips the result.
+ *
+ * @example
+ * ```ts
+ * import { buildStaticBundle } from '@geniee-inc/sfa-kit/bundle';
+ *
+ * await buildStaticBundle({
+ *   entry: 'entry.tsx',
+ *   outDir: 'dist',
+ *   studioVersion: '0.5.0',
+ *   apiBase: 'https://keystone-api-staging.chikyu.mobi',
+ *   accessToken: token,
+ * });
+ * ```
+ *
+ * @packageDocumentation
+ */
+export type { BundleManifest } from './lib/signing/index.js';
+export type { BuildStaticBundleOptions } from './lib/bundle/index.js';
+export { buildStaticBundle } from './lib/bundle/index.js';

package/src/bundle.js

@@ -0,0 +1 @@
+export { buildStaticBundle } from './lib/bundle/index.js';

package/src/lib/bundle/build-static-bundle.d.ts

@@ -0,0 +1,45 @@
+import type { BundleManifest } from '../signing/types.js';
+export interface BuildStaticBundleOptions {
+    /** Entry module that mounts the page, e.g. `entry.tsx`. */
+    readonly entry: string;
+    /** Directory the bundle is written to. Created if absent. */
+    readonly outDir: string;
+    /**
+     * The Studio build version this bundle targets — not the sfa-kit npm version.
+     *
+     * NOTE: required on purpose. The signature covers
+     * `"{studio_version}:{content_hash}"` and Keystone reads the field back
+     * separately, so a default would sign the wrong version perfectly well.
+     */
+    readonly studioVersion: string;
+    /** Keystone API base, e.g. `https://keystone-api-staging.chikyu.mobi`. */
+    readonly apiBase: string;
+    /** The same Bearer token the rest of the Keystone API is called with. */
+    readonly accessToken: string;
+    /** Title of the generated `index.html`. */
+    readonly title?: string;
+    /**
+     * Extra manifest fields, e.g. `name` or `displayName`. Keystone ignores
+     * everything but the three signed fields, which cannot be overridden here.
+     */
+    readonly manifestExtras?: Readonly<Record<string, unknown>>;
+}
+/**
+ * @description Builds the framework-free static bundle a page is uploaded as
+ * to become a custom tab, and signs it.
+ *
+ * Produces `index.html`, `assets/bundle.js` and a signed `manifest.json` in
+ * `outDir`. The caller zips that directory's contents — the files have to sit
+ * at the zip root. Zipping is left out because Node ships no zip writer, and a
+ * dependency for it would reach a package whose runtime needs only `tslib`.
+ *
+ * Signing is not optional, and a failure removes the output: an unsigned bundle
+ * uploads successfully while Keystone's verifier runs in `disabled` mode and
+ * only starts failing at `enforced`, so a half-built directory left behind is
+ * something a caller can still zip and upload by mistake.
+ *
+ * **Node.js only**, and needs `esbuild` installed alongside the kit.
+ *
+ * @returns The manifest that was written.
+ */
+export declare function buildStaticBundle({ entry, outDir, studioVersion, apiBase, accessToken, title, manifestExtras, }: BuildStaticBundleOptions): Promise<BundleManifest>;

package/src/lib/bundle/build-static-bundle.js

@@ -0,0 +1,263 @@
+import { __awaiter } from "tslib";
+import { mkdir, readFile, readdir, rm, stat, writeFile, } from 'node:fs/promises';
+import { join, posix, relative } from 'node:path';
+import { computeContentHash } from '../signing/compute-content-hash.js';
+import { readBundleFiles } from '../signing/read-bundle-files.js';
+import { loadEsbuild } from './esbuild-loader.js';
+import { requestSignature } from './request-signature.js';
+/** Where the bundled script lands inside the output directory. */
+const BUNDLE_PATH = 'assets/bundle.js';
+/** esbuild writes this beside the script when the entry imports any CSS. */
+const STYLES_PATH = 'assets/bundle.css';
+/**
+ * Every path this builder writes, relative to `outDir` with forward slashes.
+ *
+ * NOTE: full paths, not top-level names. Matching on names would accept any
+ * directory shaped like a static site — an `index.html` beside an `assets/`
+ * folder — and clear it.
+ */
+const OWN_OUTPUT = new Set([
+    'index.html',
+    'manifest.json',
+    BUNDLE_PATH,
+    STYLES_PATH,
+]);
+/** How many unexpected paths an error names before it stops listing them. */
+const UNEXPECTED_SHOWN = 5;
+/**
+ * Removed rather than refused. Opening the output directory in Finder to zip
+ * it — which GUIDE.md tells the reader to do — leaves a `.DS_Store` behind,
+ * and refusing it would wedge the build → zip → rebuild loop on a hidden file.
+ */
+const JUNK_FILES = new Set(['.DS_Store', 'Thumbs.db']);
+/**
+ * @description Builds the framework-free static bundle a page is uploaded as
+ * to become a custom tab, and signs it.
+ *
+ * Produces `index.html`, `assets/bundle.js` and a signed `manifest.json` in
+ * `outDir`. The caller zips that directory's contents — the files have to sit
+ * at the zip root. Zipping is left out because Node ships no zip writer, and a
+ * dependency for it would reach a package whose runtime needs only `tslib`.
+ *
+ * Signing is not optional, and a failure removes the output: an unsigned bundle
+ * uploads successfully while Keystone's verifier runs in `disabled` mode and
+ * only starts failing at `enforced`, so a half-built directory left behind is
+ * something a caller can still zip and upload by mistake.
+ *
+ * **Node.js only**, and needs `esbuild` installed alongside the kit.
+ *
+ * @returns The manifest that was written.
+ */
+export function buildStaticBundle(_a) {
+    return __awaiter(this, arguments, void 0, function* ({ entry, outDir, studioVersion, apiBase, accessToken, title = 'SFA/CRM', manifestExtras = {}, }) {
+        for (const [name, value] of [
+            ['entry', entry],
+            ['outDir', outDir],
+            ['studioVersion', studioVersion],
+            ['apiBase', apiBase],
+            ['accessToken', accessToken],
+        ]) {
+            // NOTE: checked before esbuild runs. An empty apiBase otherwise surfaces as
+            // "Failed to parse URL from /v1/pages/sign" after a full build.
+            // NOTE: `== null` as well as empty. The subpath is published, and a JS
+            // caller omitting a field would otherwise pay for a full build to reach
+            // `Authorization: Bearer undefined`.
+            if (value == null || value === '') {
+                throw new Error(`${name} is required and must not be empty`);
+            }
+        }
+        // Serialised now so a value that cannot be JSON — cyclic, a BigInt — fails
+        // before anything is written, rather than after Keystone has signed.
+        assertSerialisable(manifestExtras);
+        const esbuild = yield loadEsbuild();
+        yield prepareOutDir(outDir);
+        yield mkdir(join(outDir, 'assets'), { recursive: true });
+        try {
+            yield esbuild.build({
+                entryPoints: [entry],
+                outfile: join(outDir, BUNDLE_PATH),
+                bundle: true,
+                minify: true,
+                format: 'esm',
+                jsx: 'automatic',
+                target: 'es2020',
+            });
+            // entry が CSS を import していると esbuild が bundle.css も書き出す。
+            // index.html から参照しないと、署名も検証も通ったうえで無スタイルの画面が
+            // 出る — どこにも失敗が現れない
+            const hasStyles = yield stat(join(outDir, STYLES_PATH)).then(() => true, () => false);
+            yield writeFile(join(outDir, 'index.html'), renderIndexHtml(title, hasStyles), 'utf-8');
+            // manifest.json is written last: the hash covers every other file, so the
+            // directory has to be complete before it is computed.
+            const contentHash = computeContentHash(yield readBundleFiles(outDir));
+            const manifest = {
+                studio_version: studioVersion,
+                content_hash: contentHash,
+                signature: yield requestSignature({
+                    apiBase,
+                    accessToken,
+                    studioVersion,
+                    contentHash,
+                }),
+            };
+            yield writeFile(join(outDir, 'manifest.json'), 
+            // NOTE: the decorative fields go first so the three signed ones cannot be
+            // overwritten by a caller's extras.
+            `${JSON.stringify(Object.assign(Object.assign({}, manifestExtras), manifest), null, 2)}\n`, 'utf-8');
+            return manifest;
+        }
+        catch (thrown) {
+            // Whatever was written is a bundle in every respect but the manifest, and
+            // a caller can still zip and upload it.
+            yield removeOwnOutput(outDir).catch(() => {
+                throw new Error(`${thrown instanceof Error ? thrown.message : String(thrown)} ` +
+                    `Additionally, ${outDir} could not be cleaned up — delete it by ` +
+                    'hand rather than uploading it; it carries no signature.');
+            });
+            throw thrown;
+        }
+    });
+}
+/** Fails now on a value `JSON.stringify` would reject after the bundle is signed. */
+function assertSerialisable(extras) {
+    try {
+        JSON.stringify(extras);
+    }
+    catch (thrown) {
+        throw new Error('manifestExtras must be JSON-serialisable ' +
+            `(${thrown instanceof Error ? thrown.message : String(thrown)})`);
+    }
+}
+/**
+ * @description Empties the output directory of previous build output, and
+ * refuses to touch anything else.
+ *
+ * NOTE: `outDir` comes from a caller's flag, so nothing is deleted recursively
+ * — `--out src` would take the source tree with it. Only the exact files this
+ * builder writes are removed, and any other file at any depth stops the build:
+ * a leftover lands in `content_hash` and then has to be in the zip for the
+ * signature to match, which quietly makes it part of the bundle.
+ *
+ * NOTE: matching those names is not enough to claim the directory. `index.html`
+ * beside `assets/bundle.js` is also what a hand-written static site looks like,
+ * and deleting one would be unrecoverable. A `manifest.json` carrying the three
+ * signed fields is the proof, because only this builder writes one.
+ */
+function prepareOutDir(outDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        // NOTE: names only. Reading contents here — as readBundleFiles does — would
+        // pull the whole directory into memory to decide it is the wrong directory,
+        // so `--out .` in a repository would run out of memory instead of refusing.
+        const entries = yield readdir(outDir, {
+            recursive: true,
+            withFileTypes: true,
+        }).catch((thrown) => {
+            // Only "it is not there yet" means there is nothing to check. Swallowing
+            // every error would turn a permission problem into a silent build over
+            // whatever the directory held.
+            if (thrown.code === 'ENOENT')
+                return null;
+            throw thrown;
+        });
+        if (entries == null)
+            return;
+        const unexpected = [];
+        const junk = [];
+        const own = [];
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            const parent = (_a = entry.parentPath) !== null && _a !== void 0 ? _a : entry.path;
+            const path = relative(outDir, join(parent, entry.name))
+                .split(/[\\/]/)
+                .join(posix.sep);
+            if (OWN_OUTPUT.has(path)) {
+                own.push(path);
+                continue;
+            }
+            // NOTE: collected, not deleted yet. Removing junk from a directory the
+            // next few lines may refuse to touch would contradict the promise above.
+            if (JUNK_FILES.has(entry.name)) {
+                junk.push(join(parent, entry.name));
+                continue;
+            }
+            unexpected.push(path);
+            if (unexpected.length > UNEXPECTED_SHOWN)
+                break;
+        }
+        if (unexpected.length > 0) {
+            const shown = unexpected.slice(0, UNEXPECTED_SHOWN).sort().join(', ');
+            const more = unexpected.length > UNEXPECTED_SHOWN ? ', and more' : '';
+            throw new Error(`${outDir} holds files this build did not produce ` +
+                `(${shown}${more}). They would be hashed into the bundle. ` +
+                'Point --out at an empty directory, or clear it first.');
+        }
+        if (own.length > 0 && !(yield hasOwnManifest(outDir))) {
+            throw new Error(`${outDir} holds ${own.sort().join(', ')} but no manifest.json this ` +
+                'builder wrote, so it is not a previous build of this bundle and will ' +
+                'not be overwritten. Point --out at an empty directory, or clear it ' +
+                'first.');
+        }
+        for (const path of junk) {
+            yield rm(path, { force: true });
+        }
+        yield removeOwnOutput(outDir);
+    });
+}
+/** Whether the directory carries a manifest only this builder could have written. */
+function hasOwnManifest(outDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const raw = yield readFile(join(outDir, 'manifest.json'), 'utf-8').catch(() => null);
+        if (raw == null)
+            return false;
+        try {
+            const parsed = JSON.parse(raw);
+            return ['studio_version', 'content_hash', 'signature'].every(field => typeof parsed[field] === 'string' && parsed[field] !== '');
+        }
+        catch (_a) {
+            return false;
+        }
+    });
+}
+/**
+ * @description Deletes the files this builder writes, and nothing else.
+ *
+ * NOTE: separate from {@link prepareOutDir} because the failure path needs the
+ * removal without the validation. Reusing the checking function there would
+ * throw on any stray file and leave the unsigned bundle exactly where the
+ * contract promises it will not be.
+ */
+function removeOwnOutput(outDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        for (const path of OWN_OUTPUT) {
+            yield rm(join(outDir, path), { force: true });
+        }
+    });
+}
+/** The host page for the bundle: the script, and the stylesheet if there is one. */
+function renderIndexHtml(title, hasStyles) {
+    const stylesheet = hasStyles
+        ? `\n    <link rel="stylesheet" href="./${STYLES_PATH}" />`
+        : '';
+    return `<!doctype html>
+<html lang="ja">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${escapeHtml(title)}</title>${stylesheet}
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="./${BUNDLE_PATH}"></script>
+  </body>
+</html>
+`;
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}

package/src/lib/bundle/esbuild-loader.d.ts

@@ -0,0 +1,25 @@
+/** The slice of esbuild's API the bundler uses. */
+export interface EsbuildModule {
+    build(options: {
+        entryPoints: string[];
+        outfile: string;
+        bundle: boolean;
+        minify: boolean;
+        format: 'esm';
+        jsx: 'automatic';
+        target: string;
+    }): Promise<unknown>;
+}
+/**
+ * @description Loads esbuild at call time.
+ *
+ * esbuild is an optional peer: it is a build-time tool for the one caller that
+ * packages a static bundle, and adding it to `dependencies` would put a
+ * platform-specific binary into every install of a package whose runtime needs
+ * nothing but `tslib`.
+ *
+ * NOTE: the specifier goes through a variable so TypeScript does not resolve
+ * `esbuild` at compile time. Naming it directly would make the kit fail to
+ * build wherever esbuild is absent — which is everywhere it is not being used.
+ */
+export declare function loadEsbuild(): Promise<EsbuildModule>;

package/src/lib/bundle/esbuild-loader.js

@@ -0,0 +1,27 @@
+import { __awaiter } from "tslib";
+/**
+ * @description Loads esbuild at call time.
+ *
+ * esbuild is an optional peer: it is a build-time tool for the one caller that
+ * packages a static bundle, and adding it to `dependencies` would put a
+ * platform-specific binary into every install of a package whose runtime needs
+ * nothing but `tslib`.
+ *
+ * NOTE: the specifier goes through a variable so TypeScript does not resolve
+ * `esbuild` at compile time. Naming it directly would make the kit fail to
+ * build wherever esbuild is absent — which is everywhere it is not being used.
+ */
+export function loadEsbuild() {
+    return __awaiter(this, void 0, void 0, function* () {
+        const specifier = 'esbuild';
+        try {
+            return (yield import(specifier));
+        }
+        catch (thrown) {
+            const reason = thrown instanceof Error ? thrown.message : String(thrown);
+            throw new Error('esbuild is required to build a static bundle but could not be loaded ' +
+                `(${reason}). Install it alongside @geniee-inc/sfa-kit ` +
+                '(npm install --save-dev esbuild).');
+        }
+    });
+}

package/src/lib/bundle/index.d.ts

@@ -0,0 +1,2 @@
+export type { BuildStaticBundleOptions } from './build-static-bundle.js';
+export { buildStaticBundle } from './build-static-bundle.js';

package/src/lib/bundle/index.js

@@ -0,0 +1 @@
+export { buildStaticBundle } from './build-static-bundle.js';

package/src/lib/bundle/request-signature.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @description Asks Keystone to sign a bundle, returning the signature.
+ *
+ * The signing key never leaves Keystone: deploying it to the page builder as
+ * well was the original design and was dropped because Studio's secret store is
+ * per project while the key must be identical across all of them (SFAJAI-186).
+ * The caller computes `contentHash` locally and Keystone signs it.
+ *
+ * NOTE: every failure throws. An unsigned bundle uploads successfully while
+ * Keystone's verifier runs in `disabled` mode, so returning "no signature" here
+ * would produce an artifact that looks fine and starts being rejected the day
+ * the mode is switched to `enforced` — with nothing on this side to explain it.
+ *
+ * @param apiBase - Keystone API base. A trailing slash is trimmed.
+ * @param accessToken - The same Bearer token the rest of the API is called with.
+ */
+export declare function requestSignature({ apiBase, accessToken, studioVersion, contentHash, }: {
+    readonly apiBase: string;
+    readonly accessToken: string;
+    readonly studioVersion: string;
+    readonly contentHash: string;
+}): Promise<string>;

package/src/lib/bundle/request-signature.js

@@ -0,0 +1,81 @@
+import { __awaiter } from "tslib";
+/**
+ * Both the hash sent and the signature returned are hex SHA-256 / HMAC-SHA-256
+ * digests, so the same shape applies in each direction.
+ */
+const HEX_DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+/** Matches the timeout the documented Python flow uses for the same call. */
+const SIGN_TIMEOUT_MS = 30000;
+/**
+ * @description Asks Keystone to sign a bundle, returning the signature.
+ *
+ * The signing key never leaves Keystone: deploying it to the page builder as
+ * well was the original design and was dropped because Studio's secret store is
+ * per project while the key must be identical across all of them (SFAJAI-186).
+ * The caller computes `contentHash` locally and Keystone signs it.
+ *
+ * NOTE: every failure throws. An unsigned bundle uploads successfully while
+ * Keystone's verifier runs in `disabled` mode, so returning "no signature" here
+ * would produce an artifact that looks fine and starts being rejected the day
+ * the mode is switched to `enforced` — with nothing on this side to explain it.
+ *
+ * @param apiBase - Keystone API base. A trailing slash is trimmed.
+ * @param accessToken - The same Bearer token the rest of the API is called with.
+ */
+export function requestSignature(_a) {
+    return __awaiter(this, arguments, void 0, function* ({ apiBase, accessToken, studioVersion, contentHash, }) {
+        if (!HEX_DIGEST_PATTERN.test(contentHash)) {
+            throw new Error(`content_hash must be a 64-character hex digest, got ${JSON.stringify(contentHash)}`);
+        }
+        // 末尾のスラッシュを落とす。付いたままだと //v1/pages/sign になり、多くの
+        // ゲートウェイが 404 を返すため、設定ミスが認証の問題に見える
+        const base = apiBase.replace(/\/+$/, '');
+        const url = `${base}/v1/pages/sign`;
+        // NOTE: a bad host gives "fetch failed" and an empty apiBase "Failed to parse
+        // URL from /v1/pages/sign" — neither names the endpoint, the base, or the
+        // fact that the bundle is now unsigned.
+        const response = yield globalThis
+            .fetch(url, {
+            // NOTE: without a deadline a server that accepts the connection and never
+            // answers hangs the build, leaving an unsigned output directory behind.
+            signal: AbortSignal.timeout(SIGN_TIMEOUT_MS),
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body: JSON.stringify({
+                studio_version: studioVersion,
+                content_hash: contentHash,
+            }),
+        })
+            .catch((thrown) => {
+            throw new Error(`POST ${url} could not be reached ` +
+                `(${thrown instanceof Error ? thrown.message : String(thrown)}). ` +
+                'The bundle was not signed; check the API base and network access.');
+        });
+        if (!response.ok) {
+            const detail = yield response.text().catch(() => '');
+            // NOTE: the endpoint exists (SFAJAI-186), so a 404 is a wrong apiBase and a
+            // 401 a token from another org — not a reason to ship the bundle unsigned.
+            throw new Error(`POST /v1/pages/sign failed: ${response.status} ${response.statusText}` +
+                `${detail ? ` — ${detail}` : ''}. The bundle was not signed and must ` +
+                'not be uploaded; check the API base and the access token.');
+        }
+        // NOTE: a proxy answering 200 with an HTML page would throw a bare
+        // SyntaxError here, escaping the messages built for every other failure.
+        const payload = (yield response.json().catch(() => null));
+        if (payload == null || typeof payload.signature !== 'string') {
+            throw new Error(`POST ${url} returned no signature. The bundle was not signed.`);
+        }
+        // NOTE: the hash sent is validated, so the signature coming back is too. An
+        // error page echoed into this field would otherwise be written into
+        // manifest.json, upload fine while the verifier is `disabled`, and fail only
+        // once it is switched to `enforced`.
+        if (!HEX_DIGEST_PATTERN.test(payload.signature)) {
+            throw new Error(`POST ${url} returned ${JSON.stringify(payload.signature)}, which is ` +
+                'not an HMAC-SHA-256 hex digest. The bundle was not signed.');
+        }
+        return payload.signature;
+    });
+}

package/src/lib/signing/compute-content-hash.d.ts

@@ -1,4 +1,4 @@
-import type { FileEntry } from './types';
+import type { FileEntry } from './types.js';
 /**
  * Computes the SHA-256 content hash matching Keystone's
  * {@link https://github.com/chikyuinc/chikyu/blob/branch_main/keystone/src/keystone/features/pages/domain/page_bundle_integrity.py compute_content_hash}.

package/src/lib/signing/compute-signature.d.ts

@@ -4,6 +4,23 @@
  *
  * Signs the message `"{studioVersion}:{contentHash}"` with the given key.
  *
+ * **The signing key lives only in Keystone (`KEYSTONE_STUDIO__SIGNING_KEY`),
+ * so a page build cannot call this.** Deploying the key to Studio as well was
+ * the original design and was dropped in SFAJAI-186: Studio's secret store is
+ * per project, while the key has to be identical across all of them. Keystone
+ * now signs on request, and a page build asks it:
+ *
+ * ```ts
+ * const files = await readBundleFiles('dist');
+ * const contentHash = computeContentHash(files);
+ * // POST /v1/pages/sign { studio_version, content_hash } -> { signature }
+ * ```
+ *
+ * Reach for this only from a service that legitimately holds the key. Signing
+ * with a made-up one is not caught at upload time while the verifier runs in
+ * `disabled` mode — the bundle is accepted, and only starts failing once the
+ * mode is switched to `enforced`.
+ *
  * @param studioVersion - Studio version stored as page metadata.
  * @param contentHash - Hex-encoded SHA-256 from {@link computeContentHash}.
  * @param signingKey - Signing key as a UTF-8 string or raw bytes.

package/src/lib/signing/compute-signature.js

@@ -5,6 +5,23 @@ import { createHmac } from 'node:crypto';
  *
  * Signs the message `"{studioVersion}:{contentHash}"` with the given key.
  *
+ * **The signing key lives only in Keystone (`KEYSTONE_STUDIO__SIGNING_KEY`),
+ * so a page build cannot call this.** Deploying the key to Studio as well was
+ * the original design and was dropped in SFAJAI-186: Studio's secret store is
+ * per project, while the key has to be identical across all of them. Keystone
+ * now signs on request, and a page build asks it:
+ *
+ * ```ts
+ * const files = await readBundleFiles('dist');
+ * const contentHash = computeContentHash(files);
+ * // POST /v1/pages/sign { studio_version, content_hash } -> { signature }
+ * ```
+ *
+ * Reach for this only from a service that legitimately holds the key. Signing
+ * with a made-up one is not caught at upload time while the verifier runs in
+ * `disabled` mode — the bundle is accepted, and only starts failing once the
+ * mode is switched to `enforced`.
+ *
  * @param studioVersion - Studio version stored as page metadata.
  * @param contentHash - Hex-encoded SHA-256 from {@link computeContentHash}.
  * @param signingKey - Signing key as a UTF-8 string or raw bytes.

package/src/lib/signing/create-manifest-from-directory.d.ts

@@ -1,9 +1,19 @@
-import type { BundleManifest } from './types';
+import type { BundleManifest } from './types.js';
 /**
  * Reads a dist directory and creates a signed {@link BundleManifest}.
  *
- * Walks the directory tree, constructs {@link FileEntry} objects with
- * forward-slash relative paths, and delegates to {@link createManifest}.
+ * Walks the directory tree via {@link readBundleFiles} and delegates to
+ * {@link createManifest}.
+ *
+ * **Requires the shared signing key, which page builds do not have.** Keystone
+ * holds it and is the only party that signs: an earlier design deployed it to
+ * Studio as well, and was abandoned because Studio's secret store is per
+ * project while the key must be identical everywhere (SFAJAI-186). Use this
+ * only from a service that legitimately holds the key. A page build calls
+ * {@link readBundleFiles} + {@link computeContentHash} and posts the hash to
+ * `POST /v1/pages/sign` instead — signing with an invented key produces a
+ * bundle that uploads today, while the verifier runs in `disabled` mode, and
+ * starts failing the moment it is switched to `enforced`.
  *
  * This function is **Node.js-only** and must not be used in browser
  * environments. It does NOT write the manifest file to disk; the caller

package/src/lib/signing/create-manifest-from-directory.js

@@ -1,12 +1,21 @@
 import { __awaiter } from "tslib";
-import { readdir, readFile } from 'node:fs/promises';
-import { join, relative, posix } from 'node:path';
-import { createManifest } from './create-manifest';
+import { createManifest } from './create-manifest.js';
+import { readBundleFiles } from './read-bundle-files.js';
 /**
  * Reads a dist directory and creates a signed {@link BundleManifest}.
  *
- * Walks the directory tree, constructs {@link FileEntry} objects with
- * forward-slash relative paths, and delegates to {@link createManifest}.
+ * Walks the directory tree via {@link readBundleFiles} and delegates to
+ * {@link createManifest}.
+ *
+ * **Requires the shared signing key, which page builds do not have.** Keystone
+ * holds it and is the only party that signs: an earlier design deployed it to
+ * Studio as well, and was abandoned because Studio's secret store is per
+ * project while the key must be identical everywhere (SFAJAI-186). Use this
+ * only from a service that legitimately holds the key. A page build calls
+ * {@link readBundleFiles} + {@link computeContentHash} and posts the hash to
+ * `POST /v1/pages/sign` instead — signing with an invented key produces a
+ * bundle that uploads today, while the verifier runs in `disabled` mode, and
+ * starts failing the moment it is switched to `enforced`.
  *
  * This function is **Node.js-only** and must not be used in browser
  * environments. It does NOT write the manifest file to disk; the caller
@@ -18,29 +27,7 @@ import { createManifest } from './create-manifest';
  */
 export function createManifestFromDirectory(distDir, studioVersion, signingKey) {
     return __awaiter(this, void 0, void 0, function* () {
-        const files = yield collectFiles(distDir);
+        const files = yield readBundleFiles(distDir);
         return createManifest(studioVersion, files, signingKey);
     });
 }
-/**
- * Recursively collects all files under a directory as {@link FileEntry} objects.
- * Paths are normalized to POSIX forward slashes.
- */
-function collectFiles(dir) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const entries = yield readdir(dir, { withFileTypes: true, recursive: true });
-        const files = [];
-        for (const entry of entries) {
-            if (!entry.isFile())
-                continue;
-            const parentPath = (_a = entry.parentPath) !== null && _a !== void 0 ? _a : entry.path;
-            const absolutePath = join(parentPath, entry.name);
-            const relativePath = relative(dir, absolutePath);
-            const posixPath = relativePath.split(/[\\/]/).join(posix.sep);
-            const content = yield readFile(absolutePath);
-            files.push({ path: posixPath, content });
-        }
-        return files;
-    });
-}

package/src/lib/signing/create-manifest.d.ts

@@ -1,4 +1,4 @@
-import type { BundleManifest, FileEntry } from './types';
+import type { BundleManifest, FileEntry } from './types.js';
 /**
  * Creates a signed {@link BundleManifest} from a list of bundle files.
  *
@@ -6,6 +6,12 @@ import type { BundleManifest, FileEntry } from './types';
  * Callers can spread decorative fields (e.g. `sfaKitVersion` for the npm
  * package version, `name`, `displayName`) on top before writing to disk.
  *
+ * **Requires the shared signing key, which page builds do not have** — see
+ * {@link computeSignature}. A page build computes `content_hash` with
+ * {@link computeContentHash} and gets the signature from Keystone's
+ * `POST /v1/pages/sign`, then writes the three fields as a
+ * {@link BundleManifest} literal.
+ *
  * @param studioVersion - Studio version stored as page metadata.
  * @param files - All files in the bundle (manifest.json is automatically excluded).
  * @param signingKey - Signing key as a UTF-8 string or raw bytes.

package/src/lib/signing/create-manifest.js

@@ -1,5 +1,5 @@
-import { computeContentHash } from './compute-content-hash';
-import { computeSignature } from './compute-signature';
+import { computeContentHash } from './compute-content-hash.js';
+import { computeSignature } from './compute-signature.js';
 /**
  * Creates a signed {@link BundleManifest} from a list of bundle files.
  *
@@ -7,6 +7,12 @@ import { computeSignature } from './compute-signature';
  * Callers can spread decorative fields (e.g. `sfaKitVersion` for the npm
  * package version, `name`, `displayName`) on top before writing to disk.
  *
+ * **Requires the shared signing key, which page builds do not have** — see
+ * {@link computeSignature}. A page build computes `content_hash` with
+ * {@link computeContentHash} and gets the signature from Keystone's
+ * `POST /v1/pages/sign`, then writes the three fields as a
+ * {@link BundleManifest} literal.
+ *
  * @param studioVersion - Studio version stored as page metadata.
  * @param files - All files in the bundle (manifest.json is automatically excluded).
  * @param signingKey - Signing key as a UTF-8 string or raw bytes.

package/src/lib/signing/index.d.ts

@@ -1,5 +1,6 @@
-export type { BundleManifest, FileEntry } from './types';
-export { computeContentHash } from './compute-content-hash';
-export { computeSignature } from './compute-signature';
-export { createManifest } from './create-manifest';
-export { createManifestFromDirectory } from './create-manifest-from-directory';
+export type { BundleManifest, FileEntry } from './types.js';
+export { computeContentHash } from './compute-content-hash.js';
+export { readBundleFiles } from './read-bundle-files.js';
+export { computeSignature } from './compute-signature.js';
+export { createManifest } from './create-manifest.js';
+export { createManifestFromDirectory } from './create-manifest-from-directory.js';

package/src/lib/signing/index.js

@@ -1,4 +1,5 @@
-export { computeContentHash } from './compute-content-hash';
-export { computeSignature } from './compute-signature';
-export { createManifest } from './create-manifest';
-export { createManifestFromDirectory } from './create-manifest-from-directory';
+export { computeContentHash } from './compute-content-hash.js';
+export { readBundleFiles } from './read-bundle-files.js';
+export { computeSignature } from './compute-signature.js';
+export { createManifest } from './create-manifest.js';
+export { createManifestFromDirectory } from './create-manifest-from-directory.js';

package/src/lib/signing/read-bundle-files.d.ts

@@ -0,0 +1,19 @@
+import type { FileEntry } from './types.js';
+/**
+ * @description Reads every file under a built bundle directory as a
+ * {@link FileEntry}, ready for {@link computeContentHash}.
+ *
+ * This is the key-free half of building a bundle manifest: it needs no signing
+ * key, so a page build can compute its own `content_hash` and ask Keystone for
+ * the signature (`POST /v1/pages/sign`) rather than holding the shared secret.
+ *
+ * Paths are relative to `bundleDir` and use forward slashes on every platform,
+ * because the content hash is computed over the path bytes — a Windows
+ * backslash would hash to a different value than the same bundle built on
+ * Linux, and Keystone would reject it.
+ *
+ * **Node.js only.** Uses `node:fs`, so it must not reach a browser bundle.
+ *
+ * @param bundleDir - Absolute or relative path to the built bundle (e.g. `dist`).
+ */
+export declare function readBundleFiles(bundleDir: string): Promise<FileEntry[]>;

package/src/lib/signing/read-bundle-files.js

@@ -0,0 +1,41 @@
+import { __awaiter } from "tslib";
+import { readdir, readFile } from 'node:fs/promises';
+import { join, relative, posix } from 'node:path';
+/**
+ * @description Reads every file under a built bundle directory as a
+ * {@link FileEntry}, ready for {@link computeContentHash}.
+ *
+ * This is the key-free half of building a bundle manifest: it needs no signing
+ * key, so a page build can compute its own `content_hash` and ask Keystone for
+ * the signature (`POST /v1/pages/sign`) rather than holding the shared secret.
+ *
+ * Paths are relative to `bundleDir` and use forward slashes on every platform,
+ * because the content hash is computed over the path bytes — a Windows
+ * backslash would hash to a different value than the same bundle built on
+ * Linux, and Keystone would reject it.
+ *
+ * **Node.js only.** Uses `node:fs`, so it must not reach a browser bundle.
+ *
+ * @param bundleDir - Absolute or relative path to the built bundle (e.g. `dist`).
+ */
+export function readBundleFiles(bundleDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const entries = yield readdir(bundleDir, {
+            withFileTypes: true,
+            recursive: true,
+        });
+        const files = [];
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            const parentPath = (_a = entry.parentPath) !== null && _a !== void 0 ? _a : entry.path;
+            const absolutePath = join(parentPath, entry.name);
+            const relativePath = relative(bundleDir, absolutePath);
+            const posixPath = relativePath.split(/[\\/]/).join(posix.sep);
+            const content = yield readFile(absolutePath);
+            files.push({ path: posixPath, content });
+        }
+        return files;
+    });
+}

package/src/lib/version.d.ts

@@ -1 +1 @@
-export declare const SFA_KIT_VERSION = "1.16.0";
+export declare const SFA_KIT_VERSION = "1.17.0";

package/src/lib/version.js

@@ -1,3 +1,3 @@
 // このファイルは libs/sfa-kit/scripts/sync-version.cjs が生成する。
 // 手で編集しないこと。バージョンを上げるときは libs/sfa-kit/package.json を変更する。
-export const SFA_KIT_VERSION = '1.16.0';
+export const SFA_KIT_VERSION = '1.17.0';

package/src/signing.d.ts

@@ -5,14 +5,19 @@
  * and should not be imported in browser environments. It uses `node:crypto`
  * for SHA-256 and HMAC-SHA-256 operations.
  *
+ * The signing key lives only in Keystone, so a page build computes the content
+ * hash here and asks Keystone for the signature. Only `readBundleFiles` and
+ * `computeContentHash` are usable without the key.
+ *
  * @example
  * ```ts
- * import { createManifestFromDirectory } from '@geniee-inc/sfa-kit/signing';
+ * import { readBundleFiles, computeContentHash } from '@geniee-inc/sfa-kit/signing';
  *
- * const manifest = await createManifestFromDirectory('./dist', '0.5.0', signingKey);
+ * const contentHash = computeContentHash(await readBundleFiles('./dist'));
+ * // POST /v1/pages/sign { studio_version, content_hash } -> { signature }
  * ```
  *
  * @packageDocumentation
  */
-export type { BundleManifest, FileEntry } from './lib/signing';
-export { computeContentHash, computeSignature, createManifest, createManifestFromDirectory, } from './lib/signing';
+export type { BundleManifest, FileEntry } from './lib/signing/index.js';
+export { computeContentHash, readBundleFiles, computeSignature, createManifest, createManifestFromDirectory, } from './lib/signing/index.js';

package/src/signing.js

@@ -1 +1 @@
-export { computeContentHash, computeSignature, createManifest, createManifestFromDirectory, } from './lib/signing';
+export { computeContentHash, readBundleFiles, computeSignature, createManifest, createManifestFromDirectory, } from './lib/signing/index.js';