@geniee-inc/sfa-kit 1.16.0 → 1.18.0

package/src/lib/bundle/esbuild-loader.d.ts

@@ -0,0 +1,25 @@
+/** The slice of esbuild's API the bundler uses. */
+export interface EsbuildModule {
+    build(options: {
+        entryPoints: string[];
+        outfile: string;
+        bundle: boolean;
+        minify: boolean;
+        format: 'esm';
+        jsx: 'automatic';
+        target: string;
+    }): Promise<unknown>;
+}
+/**
+ * @description Loads esbuild at call time.
+ *
+ * esbuild is an optional peer: it is a build-time tool for the one caller that
+ * packages a static bundle, and adding it to `dependencies` would put a
+ * platform-specific binary into every install of a package whose runtime needs
+ * nothing but `tslib`.
+ *
+ * NOTE: the specifier goes through a variable so TypeScript does not resolve
+ * `esbuild` at compile time. Naming it directly would make the kit fail to
+ * build wherever esbuild is absent — which is everywhere it is not being used.
+ */
+export declare function loadEsbuild(): Promise<EsbuildModule>;

package/src/lib/bundle/esbuild-loader.js

@@ -0,0 +1,27 @@
+import { __awaiter } from "tslib";
+/**
+ * @description Loads esbuild at call time.
+ *
+ * esbuild is an optional peer: it is a build-time tool for the one caller that
+ * packages a static bundle, and adding it to `dependencies` would put a
+ * platform-specific binary into every install of a package whose runtime needs
+ * nothing but `tslib`.
+ *
+ * NOTE: the specifier goes through a variable so TypeScript does not resolve
+ * `esbuild` at compile time. Naming it directly would make the kit fail to
+ * build wherever esbuild is absent — which is everywhere it is not being used.
+ */
+export function loadEsbuild() {
+    return __awaiter(this, void 0, void 0, function* () {
+        const specifier = 'esbuild';
+        try {
+            return (yield import(specifier));
+        }
+        catch (thrown) {
+            const reason = thrown instanceof Error ? thrown.message : String(thrown);
+            throw new Error('esbuild is required to build a static bundle but could not be loaded ' +
+                `(${reason}). Install it alongside @geniee-inc/sfa-kit ` +
+                '(npm install --save-dev esbuild).');
+        }
+    });
+}

package/src/lib/bundle/index.d.ts

@@ -0,0 +1,2 @@
+export type { BuildStaticBundleOptions } from './build-static-bundle.js';
+export { buildStaticBundle } from './build-static-bundle.js';

package/src/lib/bundle/index.js

@@ -0,0 +1 @@
+export { buildStaticBundle } from './build-static-bundle.js';

package/src/lib/bundle/request-signature.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @description Asks Keystone to sign a bundle, returning the signature.
+ *
+ * The signing key never leaves Keystone: deploying it to the page builder as
+ * well was the original design and was dropped because Studio's secret store is
+ * per project while the key must be identical across all of them (SFAJAI-186).
+ * The caller computes `contentHash` locally and Keystone signs it.
+ *
+ * NOTE: every failure throws. An unsigned bundle uploads successfully while
+ * Keystone's verifier runs in `disabled` mode, so returning "no signature" here
+ * would produce an artifact that looks fine and starts being rejected the day
+ * the mode is switched to `enforced` — with nothing on this side to explain it.
+ *
+ * @param apiBase - Keystone API base. A trailing slash is trimmed.
+ * @param accessToken - The same Bearer token the rest of the API is called with.
+ */
+export declare function requestSignature({ apiBase, accessToken, studioVersion, contentHash, }: {
+    readonly apiBase: string;
+    readonly accessToken: string;
+    readonly studioVersion: string;
+    readonly contentHash: string;
+}): Promise<string>;

package/src/lib/bundle/request-signature.js

@@ -0,0 +1,81 @@
+import { __awaiter } from "tslib";
+/**
+ * Both the hash sent and the signature returned are hex SHA-256 / HMAC-SHA-256
+ * digests, so the same shape applies in each direction.
+ */
+const HEX_DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+/** Matches the timeout the documented Python flow uses for the same call. */
+const SIGN_TIMEOUT_MS = 30000;
+/**
+ * @description Asks Keystone to sign a bundle, returning the signature.
+ *
+ * The signing key never leaves Keystone: deploying it to the page builder as
+ * well was the original design and was dropped because Studio's secret store is
+ * per project while the key must be identical across all of them (SFAJAI-186).
+ * The caller computes `contentHash` locally and Keystone signs it.
+ *
+ * NOTE: every failure throws. An unsigned bundle uploads successfully while
+ * Keystone's verifier runs in `disabled` mode, so returning "no signature" here
+ * would produce an artifact that looks fine and starts being rejected the day
+ * the mode is switched to `enforced` — with nothing on this side to explain it.
+ *
+ * @param apiBase - Keystone API base. A trailing slash is trimmed.
+ * @param accessToken - The same Bearer token the rest of the API is called with.
+ */
+export function requestSignature(_a) {
+    return __awaiter(this, arguments, void 0, function* ({ apiBase, accessToken, studioVersion, contentHash, }) {
+        if (!HEX_DIGEST_PATTERN.test(contentHash)) {
+            throw new Error(`content_hash must be a 64-character hex digest, got ${JSON.stringify(contentHash)}`);
+        }
+        // 末尾のスラッシュを落とす。付いたままだと //v1/pages/sign になり、多くの
+        // ゲートウェイが 404 を返すため、設定ミスが認証の問題に見える
+        const base = apiBase.replace(/\/+$/, '');
+        const url = `${base}/v1/pages/sign`;
+        // NOTE: a bad host gives "fetch failed" and an empty apiBase "Failed to parse
+        // URL from /v1/pages/sign" — neither names the endpoint, the base, or the
+        // fact that the bundle is now unsigned.
+        const response = yield globalThis
+            .fetch(url, {
+            // NOTE: without a deadline a server that accepts the connection and never
+            // answers hangs the build, leaving an unsigned output directory behind.
+            signal: AbortSignal.timeout(SIGN_TIMEOUT_MS),
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body: JSON.stringify({
+                studio_version: studioVersion,
+                content_hash: contentHash,
+            }),
+        })
+            .catch((thrown) => {
+            throw new Error(`POST ${url} could not be reached ` +
+                `(${thrown instanceof Error ? thrown.message : String(thrown)}). ` +
+                'The bundle was not signed; check the API base and network access.');
+        });
+        if (!response.ok) {
+            const detail = yield response.text().catch(() => '');
+            // NOTE: the endpoint exists (SFAJAI-186), so a 404 is a wrong apiBase and a
+            // 401 a token from another org — not a reason to ship the bundle unsigned.
+            throw new Error(`POST /v1/pages/sign failed: ${response.status} ${response.statusText}` +
+                `${detail ? ` — ${detail}` : ''}. The bundle was not signed and must ` +
+                'not be uploaded; check the API base and the access token.');
+        }
+        // NOTE: a proxy answering 200 with an HTML page would throw a bare
+        // SyntaxError here, escaping the messages built for every other failure.
+        const payload = (yield response.json().catch(() => null));
+        if (payload == null || typeof payload.signature !== 'string') {
+            throw new Error(`POST ${url} returned no signature. The bundle was not signed.`);
+        }
+        // NOTE: the hash sent is validated, so the signature coming back is too. An
+        // error page echoed into this field would otherwise be written into
+        // manifest.json, upload fine while the verifier is `disabled`, and fail only
+        // once it is switched to `enforced`.
+        if (!HEX_DIGEST_PATTERN.test(payload.signature)) {
+            throw new Error(`POST ${url} returned ${JSON.stringify(payload.signature)}, which is ` +
+                'not an HMAC-SHA-256 hex digest. The bundle was not signed.');
+        }
+        return payload.signature;
+    });
+}

package/src/lib/provider/SfaClient.d.ts

@@ -124,6 +124,19 @@ export declare class SfaClient implements SfaClientInterface {
     private objectsPath;
     /** @description Returns the field-types catalog path for the current mode. */
     private fieldTypesPath;
+    /**
+     * @description Sets the auth headers, returning the token it used.
+     *
+     * NOTE: the caller keeps that token so a 401 can name it. Reading `this.auth`
+     * at the 401 would give the same value today — `auth` is readonly and
+     * `SfaProvider` builds a new client per token — but returning it from here
+     * keeps the answer true by construction.
+     *
+     * NOTE: this owns the `Authorization` header. It runs after any caller
+     * headers are spread in, so a caller-supplied one is overwritten — and if
+     * the client has no auth, the returned `undefined` would not describe it.
+     * Callers pass `If-Match` and the like, never `Authorization`.
+     */
     private applyAuth;
     /**
      * @description GET request with auth headers. Works for all read-only

package/src/lib/provider/SfaClient.js

@@ -388,14 +388,31 @@ export class SfaClient {
         return this.mode === 'direct' ? '/v1/field-types' : '/field-types';
     }
     // ── Private transport ──
+    /**
+     * @description Sets the auth headers, returning the token it used.
+     *
+     * NOTE: the caller keeps that token so a 401 can name it. Reading `this.auth`
+     * at the 401 would give the same value today — `auth` is readonly and
+     * `SfaProvider` builds a new client per token — but returning it from here
+     * keeps the answer true by construction.
+     *
+     * NOTE: this owns the `Authorization` header. It runs after any caller
+     * headers are spread in, so a caller-supplied one is overwritten — and if
+     * the client has no auth, the returned `undefined` would not describe it.
+     * Callers pass `If-Match` and the like, never `Authorization`.
+     */
     applyAuth(headers) {
         var _a;
-        if ((_a = this.auth) === null || _a === void 0 ? void 0 : _a.accessToken) {
-            headers['Authorization'] = `Bearer ${this.auth.accessToken}`;
+        const accessToken = (_a = this.auth) === null || _a === void 0 ? void 0 : _a.accessToken;
+        if (accessToken) {
+            headers['Authorization'] = `Bearer ${accessToken}`;
         }
         if (this.organizationId) {
             headers['organization-id'] = this.organizationId;
         }
+        // NOTE: 空文字は「トークンを送っていない」。値として返すと、受け手は
+        // 差し替え済みの遅れ着信と区別できず、認証なしの 401 を握り潰す
+        return accessToken || undefined;
     }
     /**
      * @description GET request with auth headers. Works for all read-only
@@ -408,7 +425,7 @@ export class SfaClient {
             const headers = {
                 'Content-Type': 'application/json',
             };
-            this.applyAuth(headers);
+            const sentToken = this.applyAuth(headers);
             const response = yield globalThis.fetch(url, {
                 method: 'GET',
                 headers,
@@ -416,7 +433,7 @@ export class SfaClient {
             });
             if (!response.ok) {
                 if (response.status === 401)
-                    (_a = this.onAuthError) === null || _a === void 0 ? void 0 : _a.call(this);
+                    (_a = this.onAuthError) === null || _a === void 0 ? void 0 : _a.call(this, sentToken);
                 const text = yield response.text().catch(() => '');
                 throw new SfaApiError(response.status, response.statusText, text, url);
             }
@@ -434,7 +451,7 @@ export class SfaClient {
             const headers = {
                 'Content-Type': 'application/json',
             };
-            this.applyAuth(headers);
+            const sentToken = this.applyAuth(headers);
             const response = yield globalThis.fetch(url, {
                 method: 'POST',
                 headers,
@@ -443,7 +460,7 @@ export class SfaClient {
             });
             if (!response.ok) {
                 if (response.status === 401)
-                    (_a = this.onAuthError) === null || _a === void 0 ? void 0 : _a.call(this);
+                    (_a = this.onAuthError) === null || _a === void 0 ? void 0 : _a.call(this, sentToken);
                 const text = yield response.text().catch(() => '');
                 throw new SfaApiError(response.status, response.statusText, text, url);
             }
@@ -460,7 +477,7 @@ export class SfaClient {
             var _a;
             const url = `${this.apiBase}${path}`;
             const headers = Object.assign({ 'Content-Type': 'application/json' }, options === null || options === void 0 ? void 0 : options.headers);
-            this.applyAuth(headers);
+            const sentToken = this.applyAuth(headers);
             const response = yield globalThis.fetch(url, {
                 method,
                 headers,
@@ -469,7 +486,7 @@ export class SfaClient {
             });
             if (!response.ok) {
                 if (response.status === 401)
-                    (_a = this.onAuthError) === null || _a === void 0 ? void 0 : _a.call(this);
+                    (_a = this.onAuthError) === null || _a === void 0 ? void 0 : _a.call(this, sentToken);
                 const text = yield response.text().catch(() => '');
                 if (response.status === 412) {
                     throw SfaConflictError.fromBody(response.status, response.statusText, text, url);

package/src/lib/provider/SfaProvider.d.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { SfaApiMode, SfaAuth, SfaClientInterface } from './types';
+import type { SfaApiMode, SfaAuth, SfaAuthErrorHandler, SfaClientInterface } from './types';
 export interface SfaContextValue {
     readonly client: SfaClientInterface;
     readonly auth: SfaAuth | undefined;
@@ -14,7 +14,7 @@ interface SfaProviderProps {
     readonly auth?: SfaAuth;
     readonly mode?: SfaApiMode;
     readonly organizationId?: string;
-    readonly onAuthError?: () => void;
+    readonly onAuthError?: SfaAuthErrorHandler;
     /**
      * Disable mutation hooks (create/update/delete). Defaults to false.
      *

package/src/lib/provider/SfaProvider.js

@@ -38,7 +38,7 @@ export function SfaProvider({ apiBase, auth, mode, organizationId, onAuthError,
         auth: stableAuth,
         mode: resolvedMode,
         organizationId: resolvedOrgId,
-        onAuthError: () => { var _a; return (_a = onAuthErrorRef.current) === null || _a === void 0 ? void 0 : _a.call(onAuthErrorRef); },
+        onAuthError: rejectedToken => { var _a; return (_a = onAuthErrorRef.current) === null || _a === void 0 ? void 0 : _a.call(onAuthErrorRef, rejectedToken); },
     }), [apiBase, stableAuth, resolvedMode, resolvedOrgId]);
     const value = useMemo(() => ({
         client,

package/src/lib/provider/types.d.ts

@@ -2,12 +2,23 @@ export interface SfaAuth {
     readonly accessToken: string;
 }
 export type SfaApiMode = 'direct' | 'proxy';
+/**
+ * @description Called when a request came back 401, naming the token it was
+ * sent with.
+ *
+ * `rejectedToken` is the access token that request carried, or `undefined`
+ * when it went out unauthenticated. A caller that swaps tokens needs it to
+ * tell a late reply about a token it has already replaced from a rejection of
+ * the one it holds now: the first is nothing to act on, the second means the
+ * session has to be re-established.
+ */
+export type SfaAuthErrorHandler = (rejectedToken: string | undefined) => void;
 export interface SfaClientConfig {
     readonly apiBase: string;
     readonly auth?: SfaAuth;
     readonly mode: SfaApiMode;
     readonly organizationId?: string;
-    readonly onAuthError?: () => void;
+    readonly onAuthError?: SfaAuthErrorHandler;
 }
 /**
  * @description Normalized field kinds aligned with keystone's 10-type model.

package/src/lib/signing/compute-content-hash.d.ts

@@ -1,4 +1,4 @@
-import type { FileEntry } from './types';
+import type { FileEntry } from './types.js';
 /**
  * Computes the SHA-256 content hash matching Keystone's
  * {@link https://github.com/chikyuinc/chikyu/blob/branch_main/keystone/src/keystone/features/pages/domain/page_bundle_integrity.py compute_content_hash}.

package/src/lib/signing/compute-signature.d.ts

@@ -4,6 +4,23 @@
  *
  * Signs the message `"{studioVersion}:{contentHash}"` with the given key.
  *
+ * **The signing key lives only in Keystone (`KEYSTONE_STUDIO__SIGNING_KEY`),
+ * so a page build cannot call this.** Deploying the key to Studio as well was
+ * the original design and was dropped in SFAJAI-186: Studio's secret store is
+ * per project, while the key has to be identical across all of them. Keystone
+ * now signs on request, and a page build asks it:
+ *
+ * ```ts
+ * const files = await readBundleFiles('dist');
+ * const contentHash = computeContentHash(files);
+ * // POST /v1/pages/sign { studio_version, content_hash } -> { signature }
+ * ```
+ *
+ * Reach for this only from a service that legitimately holds the key. Signing
+ * with a made-up one is not caught at upload time while the verifier runs in
+ * `disabled` mode — the bundle is accepted, and only starts failing once the
+ * mode is switched to `enforced`.
+ *
  * @param studioVersion - Studio version stored as page metadata.
  * @param contentHash - Hex-encoded SHA-256 from {@link computeContentHash}.
  * @param signingKey - Signing key as a UTF-8 string or raw bytes.

package/src/lib/signing/compute-signature.js

@@ -5,6 +5,23 @@ import { createHmac } from 'node:crypto';
  *
  * Signs the message `"{studioVersion}:{contentHash}"` with the given key.
  *
+ * **The signing key lives only in Keystone (`KEYSTONE_STUDIO__SIGNING_KEY`),
+ * so a page build cannot call this.** Deploying the key to Studio as well was
+ * the original design and was dropped in SFAJAI-186: Studio's secret store is
+ * per project, while the key has to be identical across all of them. Keystone
+ * now signs on request, and a page build asks it:
+ *
+ * ```ts
+ * const files = await readBundleFiles('dist');
+ * const contentHash = computeContentHash(files);
+ * // POST /v1/pages/sign { studio_version, content_hash } -> { signature }
+ * ```
+ *
+ * Reach for this only from a service that legitimately holds the key. Signing
+ * with a made-up one is not caught at upload time while the verifier runs in
+ * `disabled` mode — the bundle is accepted, and only starts failing once the
+ * mode is switched to `enforced`.
+ *
  * @param studioVersion - Studio version stored as page metadata.
  * @param contentHash - Hex-encoded SHA-256 from {@link computeContentHash}.
  * @param signingKey - Signing key as a UTF-8 string or raw bytes.

package/src/lib/signing/create-manifest-from-directory.d.ts

@@ -1,9 +1,19 @@
-import type { BundleManifest } from './types';
+import type { BundleManifest } from './types.js';
 /**
  * Reads a dist directory and creates a signed {@link BundleManifest}.
  *
- * Walks the directory tree, constructs {@link FileEntry} objects with
- * forward-slash relative paths, and delegates to {@link createManifest}.
+ * Walks the directory tree via {@link readBundleFiles} and delegates to
+ * {@link createManifest}.
+ *
+ * **Requires the shared signing key, which page builds do not have.** Keystone
+ * holds it and is the only party that signs: an earlier design deployed it to
+ * Studio as well, and was abandoned because Studio's secret store is per
+ * project while the key must be identical everywhere (SFAJAI-186). Use this
+ * only from a service that legitimately holds the key. A page build calls
+ * {@link readBundleFiles} + {@link computeContentHash} and posts the hash to
+ * `POST /v1/pages/sign` instead — signing with an invented key produces a
+ * bundle that uploads today, while the verifier runs in `disabled` mode, and
+ * starts failing the moment it is switched to `enforced`.
  *
  * This function is **Node.js-only** and must not be used in browser
  * environments. It does NOT write the manifest file to disk; the caller

package/src/lib/signing/create-manifest-from-directory.js

@@ -1,12 +1,21 @@
 import { __awaiter } from "tslib";
-import { readdir, readFile } from 'node:fs/promises';
-import { join, relative, posix } from 'node:path';
-import { createManifest } from './create-manifest';
+import { createManifest } from './create-manifest.js';
+import { readBundleFiles } from './read-bundle-files.js';
 /**
  * Reads a dist directory and creates a signed {@link BundleManifest}.
  *
- * Walks the directory tree, constructs {@link FileEntry} objects with
- * forward-slash relative paths, and delegates to {@link createManifest}.
+ * Walks the directory tree via {@link readBundleFiles} and delegates to
+ * {@link createManifest}.
+ *
+ * **Requires the shared signing key, which page builds do not have.** Keystone
+ * holds it and is the only party that signs: an earlier design deployed it to
+ * Studio as well, and was abandoned because Studio's secret store is per
+ * project while the key must be identical everywhere (SFAJAI-186). Use this
+ * only from a service that legitimately holds the key. A page build calls
+ * {@link readBundleFiles} + {@link computeContentHash} and posts the hash to
+ * `POST /v1/pages/sign` instead — signing with an invented key produces a
+ * bundle that uploads today, while the verifier runs in `disabled` mode, and
+ * starts failing the moment it is switched to `enforced`.
  *
  * This function is **Node.js-only** and must not be used in browser
  * environments. It does NOT write the manifest file to disk; the caller
@@ -18,29 +27,7 @@ import { createManifest } from './create-manifest';
  */
 export function createManifestFromDirectory(distDir, studioVersion, signingKey) {
     return __awaiter(this, void 0, void 0, function* () {
-        const files = yield collectFiles(distDir);
+        const files = yield readBundleFiles(distDir);
         return createManifest(studioVersion, files, signingKey);
     });
 }
-/**
- * Recursively collects all files under a directory as {@link FileEntry} objects.
- * Paths are normalized to POSIX forward slashes.
- */
-function collectFiles(dir) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const entries = yield readdir(dir, { withFileTypes: true, recursive: true });
-        const files = [];
-        for (const entry of entries) {
-            if (!entry.isFile())
-                continue;
-            const parentPath = (_a = entry.parentPath) !== null && _a !== void 0 ? _a : entry.path;
-            const absolutePath = join(parentPath, entry.name);
-            const relativePath = relative(dir, absolutePath);
-            const posixPath = relativePath.split(/[\\/]/).join(posix.sep);
-            const content = yield readFile(absolutePath);
-            files.push({ path: posixPath, content });
-        }
-        return files;
-    });
-}

package/src/lib/signing/create-manifest.d.ts

@@ -1,4 +1,4 @@
-import type { BundleManifest, FileEntry } from './types';
+import type { BundleManifest, FileEntry } from './types.js';
 /**
  * Creates a signed {@link BundleManifest} from a list of bundle files.
  *
@@ -6,6 +6,12 @@ import type { BundleManifest, FileEntry } from './types';
  * Callers can spread decorative fields (e.g. `sfaKitVersion` for the npm
  * package version, `name`, `displayName`) on top before writing to disk.
  *
+ * **Requires the shared signing key, which page builds do not have** — see
+ * {@link computeSignature}. A page build computes `content_hash` with
+ * {@link computeContentHash} and gets the signature from Keystone's
+ * `POST /v1/pages/sign`, then writes the three fields as a
+ * {@link BundleManifest} literal.
+ *
  * @param studioVersion - Studio version stored as page metadata.
  * @param files - All files in the bundle (manifest.json is automatically excluded).
  * @param signingKey - Signing key as a UTF-8 string or raw bytes.

package/src/lib/signing/create-manifest.js

@@ -1,5 +1,5 @@
-import { computeContentHash } from './compute-content-hash';
-import { computeSignature } from './compute-signature';
+import { computeContentHash } from './compute-content-hash.js';
+import { computeSignature } from './compute-signature.js';
 /**
  * Creates a signed {@link BundleManifest} from a list of bundle files.
  *
@@ -7,6 +7,12 @@ import { computeSignature } from './compute-signature';
  * Callers can spread decorative fields (e.g. `sfaKitVersion` for the npm
  * package version, `name`, `displayName`) on top before writing to disk.
  *
+ * **Requires the shared signing key, which page builds do not have** — see
+ * {@link computeSignature}. A page build computes `content_hash` with
+ * {@link computeContentHash} and gets the signature from Keystone's
+ * `POST /v1/pages/sign`, then writes the three fields as a
+ * {@link BundleManifest} literal.
+ *
  * @param studioVersion - Studio version stored as page metadata.
  * @param files - All files in the bundle (manifest.json is automatically excluded).
  * @param signingKey - Signing key as a UTF-8 string or raw bytes.

package/src/lib/signing/index.d.ts

@@ -1,5 +1,6 @@
-export type { BundleManifest, FileEntry } from './types';
-export { computeContentHash } from './compute-content-hash';
-export { computeSignature } from './compute-signature';
-export { createManifest } from './create-manifest';
-export { createManifestFromDirectory } from './create-manifest-from-directory';
+export type { BundleManifest, FileEntry } from './types.js';
+export { computeContentHash } from './compute-content-hash.js';
+export { readBundleFiles } from './read-bundle-files.js';
+export { computeSignature } from './compute-signature.js';
+export { createManifest } from './create-manifest.js';
+export { createManifestFromDirectory } from './create-manifest-from-directory.js';

package/src/lib/signing/index.js

@@ -1,4 +1,5 @@
-export { computeContentHash } from './compute-content-hash';
-export { computeSignature } from './compute-signature';
-export { createManifest } from './create-manifest';
-export { createManifestFromDirectory } from './create-manifest-from-directory';
+export { computeContentHash } from './compute-content-hash.js';
+export { readBundleFiles } from './read-bundle-files.js';
+export { computeSignature } from './compute-signature.js';
+export { createManifest } from './create-manifest.js';
+export { createManifestFromDirectory } from './create-manifest-from-directory.js';

package/src/lib/signing/read-bundle-files.d.ts

@@ -0,0 +1,19 @@
+import type { FileEntry } from './types.js';
+/**
+ * @description Reads every file under a built bundle directory as a
+ * {@link FileEntry}, ready for {@link computeContentHash}.
+ *
+ * This is the key-free half of building a bundle manifest: it needs no signing
+ * key, so a page build can compute its own `content_hash` and ask Keystone for
+ * the signature (`POST /v1/pages/sign`) rather than holding the shared secret.
+ *
+ * Paths are relative to `bundleDir` and use forward slashes on every platform,
+ * because the content hash is computed over the path bytes — a Windows
+ * backslash would hash to a different value than the same bundle built on
+ * Linux, and Keystone would reject it.
+ *
+ * **Node.js only.** Uses `node:fs`, so it must not reach a browser bundle.
+ *
+ * @param bundleDir - Absolute or relative path to the built bundle (e.g. `dist`).
+ */
+export declare function readBundleFiles(bundleDir: string): Promise<FileEntry[]>;

package/src/lib/signing/read-bundle-files.js

@@ -0,0 +1,41 @@
+import { __awaiter } from "tslib";
+import { readdir, readFile } from 'node:fs/promises';
+import { join, relative, posix } from 'node:path';
+/**
+ * @description Reads every file under a built bundle directory as a
+ * {@link FileEntry}, ready for {@link computeContentHash}.
+ *
+ * This is the key-free half of building a bundle manifest: it needs no signing
+ * key, so a page build can compute its own `content_hash` and ask Keystone for
+ * the signature (`POST /v1/pages/sign`) rather than holding the shared secret.
+ *
+ * Paths are relative to `bundleDir` and use forward slashes on every platform,
+ * because the content hash is computed over the path bytes — a Windows
+ * backslash would hash to a different value than the same bundle built on
+ * Linux, and Keystone would reject it.
+ *
+ * **Node.js only.** Uses `node:fs`, so it must not reach a browser bundle.
+ *
+ * @param bundleDir - Absolute or relative path to the built bundle (e.g. `dist`).
+ */
+export function readBundleFiles(bundleDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const entries = yield readdir(bundleDir, {
+            withFileTypes: true,
+            recursive: true,
+        });
+        const files = [];
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            const parentPath = (_a = entry.parentPath) !== null && _a !== void 0 ? _a : entry.path;
+            const absolutePath = join(parentPath, entry.name);
+            const relativePath = relative(bundleDir, absolutePath);
+            const posixPath = relativePath.split(/[\\/]/).join(posix.sep);
+            const content = yield readFile(absolutePath);
+            files.push({ path: posixPath, content });
+        }
+        return files;
+    });
+}

package/src/lib/version.d.ts

@@ -1 +1 @@
-export declare const SFA_KIT_VERSION = "1.16.0";
+export declare const SFA_KIT_VERSION = "1.18.0";

package/src/lib/version.js

@@ -1,3 +1,3 @@
 // このファイルは libs/sfa-kit/scripts/sync-version.cjs が生成する。
 // 手で編集しないこと。バージョンを上げるときは libs/sfa-kit/package.json を変更する。
-export const SFA_KIT_VERSION = '1.16.0';
+export const SFA_KIT_VERSION = '1.18.0';

package/src/signing.d.ts

@@ -5,14 +5,19 @@
  * and should not be imported in browser environments. It uses `node:crypto`
  * for SHA-256 and HMAC-SHA-256 operations.
  *
+ * The signing key lives only in Keystone, so a page build computes the content
+ * hash here and asks Keystone for the signature. Only `readBundleFiles` and
+ * `computeContentHash` are usable without the key.
+ *
  * @example
  * ```ts
- * import { createManifestFromDirectory } from '@geniee-inc/sfa-kit/signing';
+ * import { readBundleFiles, computeContentHash } from '@geniee-inc/sfa-kit/signing';
  *
- * const manifest = await createManifestFromDirectory('./dist', '0.5.0', signingKey);
+ * const contentHash = computeContentHash(await readBundleFiles('./dist'));
+ * // POST /v1/pages/sign { studio_version, content_hash } -> { signature }
  * ```
  *
  * @packageDocumentation
  */
-export type { BundleManifest, FileEntry } from './lib/signing';
-export { computeContentHash, computeSignature, createManifest, createManifestFromDirectory, } from './lib/signing';
+export type { BundleManifest, FileEntry } from './lib/signing/index.js';
+export { computeContentHash, readBundleFiles, computeSignature, createManifest, createManifestFromDirectory, } from './lib/signing/index.js';

package/src/signing.js

@@ -1 +1 @@
-export { computeContentHash, computeSignature, createManifest, createManifestFromDirectory, } from './lib/signing';
+export { computeContentHash, readBundleFiles, computeSignature, createManifest, createManifestFromDirectory, } from './lib/signing/index.js';