@geniee-inc/sfa-kit 1.17.0 → 1.19.0

package/GUIDE.md

@@ -25,16 +25,27 @@ Three additional subpaths are available: `@geniee-inc/sfa-kit/signing` exposes b
 
 ### Static bundle manifest (custom-tab uploads)
 
-A page uploaded through GENIEE's SFA/CRM settings UI as a custom tab is a framework-free static bundle — `index.html` + `manifest.json` + `assets/` — not a Next.js app. Its `manifest.json` carries the three fields Keystone's `BundleSignatureVerifier` reads: `studio_version`, `content_hash`, `signature`.
+A page uploaded through GENIEE's SFA/CRM settings UI as a custom tab is a framework-free static bundle — `index.html` + `manifest.json` + `assets/` — not a Next.js app. Its `manifest.json` carries three fields:
+
+| Field             | Signed | Meaning                                                                                      |
+| ----------------- | ------ | -------------------------------------------------------------------------------------------- |
+| `content_hash`    | Yes    | SHA-256 over every other file in the bundle (see `computeContentHash`)                       |
+| `signature`       | -      | HMAC-SHA-256 of `content_hash`, computed by Keystone                                         |
+| `sfa_kit_version` | No     | The sfa-kit version that ran the build. Keystone stores it with the page for troubleshooting |
+
+Editing any file after signing changes `content_hash`, and a new `content_hash` needs a new signature that only Keystone can compute, so an edited bundle fails verification.
+
+A manifest that also carries `studio_version` is the legacy format: its signature covers `"{studio_version}:{content_hash}"`. Keystone accepts both and tells them apart by whether `studio_version` is present.
 
 **The signing key lives only in Keystone, so a page build never computes the signature itself.** It hashes the bundle locally and asks Keystone to sign:
 
 ```ts
+import pkg from '@geniee-inc/sfa-kit/package.json';
 import {
   readBundleFiles,
   computeContentHash,
 } from '@geniee-inc/sfa-kit/signing';
-import type { BundleManifest } from '@geniee-inc/sfa-kit/signing';
+import type { ContentHashManifest } from '@geniee-inc/sfa-kit/signing';
 
 const files = await readBundleFiles('dist');
 const contentHash = computeContentHash(files);
@@ -47,16 +58,13 @@ const response = await fetch(`${apiBase}/v1/pages/sign`, {
     'Content-Type': 'application/json',
     Authorization: `Bearer ${accessToken}`,
   },
-  body: JSON.stringify({
-    studio_version: studioVersion,
-    content_hash: contentHash,
-  }),
+  body: JSON.stringify({ content_hash: contentHash }),
 });
 if (!response.ok) throw new Error(`Signing failed: ${response.status}`);
 const { signature } = (await response.json()) as { signature: string };
 
-const manifest: BundleManifest = {
-  studio_version: studioVersion, // the Studio build version, NOT the sfa-kit npm version
+const manifest: ContentHashManifest = {
+  sfa_kit_version: pkg.version,
   content_hash: contentHash,
   signature,
 };
@@ -72,7 +80,6 @@ import { buildStaticBundle } from '@geniee-inc/sfa-kit/bundle';
 await buildStaticBundle({
   entry: 'entry.tsx', // renders <SfaLoginGate>…</SfaLoginGate> into #root
   outDir: 'dist',
-  studioVersion: '0.5.0', // the Studio build version, NOT the sfa-kit npm version
   apiBase: 'https://keystone-api-staging.chikyu.mobi',
   accessToken: token,
 });
@@ -84,7 +91,6 @@ Or from the command line, which is the shorter path when a build script drives i
 SFA_KIT_ACCESS_TOKEN=<token> npx sfa-kit-bundle \
   --entry entry.tsx \
   --out dist \
-  --studio-version 0.5.0 \
   --api-base https://keystone-api-staging.chikyu.mobi
 ```
 
@@ -95,7 +101,9 @@ Then zip the **contents** of `dist/` — the bundle's files have to sit at the z
 `esbuild` is an optional peer dependency; install it alongside the kit. Its options are fixed: JS, JSX, TS and CSS bundle, but there is no loader for images or fonts, so a page importing a `.png`, `.svg` or a font — including through `url()` in CSS — fails to build. Inline such assets as data URIs, or reference them by absolute URL.
 Nothing is written when signing fails, so a failed build never leaves an unsigned bundle behind to be uploaded by mistake.
 
-`studioVersion` has no default on purpose. The signature covers `"{studio_version}:{content_hash}"` and Keystone reads the field back separately, so a guessed value produces a valid signature over the wrong version.
+`sfa_kit_version` is filled in automatically with the version of the sfa-kit that ran the build. esbuild bundles whichever copy of sfa-kit the entry module imports, which is normally the same one, but a project with two installed copies can record one version and ship the other.
+
+`studioVersion` (`--studio-version`) is deprecated. When given, the bundle is signed in the legacy format and the manifest carries `studio_version`. Omit it.
 
 ### Signing exports
 
@@ -109,7 +117,7 @@ The lower-level pieces `buildStaticBundle` uses, for a caller that builds its ow
 | `createManifest`              | **Yes**               |
 | `createManifestFromDirectory` | **Yes**               |
 
-The three key-taking exports exist for the service that holds the key. Calling them from a page build means inventing a key, which Keystone will not accept — and the mistake is invisible at first, because bundle verification ships in `disabled` mode: the upload succeeds, and only starts failing once the mode is switched to `enforced`.
+The three key-taking exports produce the legacy format, signed over `"{studio_version}:{content_hash}"`. They exist for the service that holds the key. Calling them from a page build means inventing a key, which Keystone will not accept — and the mistake is invisible at first, because bundle verification ships in `disabled` mode: the upload succeeds, and only starts failing once the mode is switched to `enforced`.
 
 `content_hash` must come from `computeContentHash`, never from hashing files back to back. The algorithm length-prefixes each path and each file's contents before feeding them into one running SHA-256; without those prefixes `"ab" + "c"` and `"a" + "bc"` hash identically, and the result never matches Keystone's own computation.
 
@@ -128,7 +136,7 @@ Every page uses `SfaLoginGate` as the outermost wrapper. It auto-detects the hos
 
 ### Props
 
-- **`apiBase`** (optional) — Overrides the auto-detected Keystone API endpoint. When omitted, the endpoint is resolved from a hostname: the embedding SFA/CRM host's when the page runs inside the iframe, the page's own when it runs standalone. Non-production environments (`stg.chikyu.mobi`, `dev01`-`dev09`, `devdc`, `deva0`, `dev-docker`, `dev.chikyu.local`, `localhost`, `127.0.0.1`, `[::1]`, and every Amplify host of the new frontend under `*.amplify.axiom.chikyu.mobi`: PR previews plus the `devNN.waf.` / `stg.waf.` record-detail hosts) use `https://keystone-api-staging.chikyu.mobi`; everything else (`app.chikyu.net`, any hostname not in that list) uses `https://keystone-api-production.chikyu.mobi`. Production is the fallback on purpose so a page that reaches a customer never silently talks to staging.
+- **`apiBase`** (optional) — Overrides the auto-detected Keystone API endpoint. When omitted, the endpoint is resolved from a hostname: the embedding SFA/CRM host's when the page runs inside the iframe, the page's own when it runs standalone. `dev09` (`dev09.chikyu.mobi` and `dev09.waf.amplify.axiom.chikyu.mobi`) has a Keystone of its own and uses `https://keystone-api-dev09.chikyu.mobi`. The other non-production environments (`stg.chikyu.mobi`, `dev01`-`dev08`, `devdc`, `deva0`, `dev-docker`, `dev.chikyu.local`, `localhost`, `127.0.0.1`, `[::1]`, and every Amplify host of the new frontend under `*.amplify.axiom.chikyu.mobi`: PR previews plus the `devNN.waf.` / `stg.waf.` record-detail hosts) use `https://keystone-api-staging.chikyu.mobi`; everything else (`app.chikyu.net`, any hostname not in that list) uses `https://keystone-api-production.chikyu.mobi`. Production is the fallback on purpose so a page that reaches a customer never silently talks to staging.
 - **`trustedOrigin`** (optional) — The origin of the SFA/CRM host page (e.g. `"https://app.chikyu.net"`). When provided and the page runs inside an iframe, `SfaLoginGate` uses the postMessage code-exchange flow (`POST /v1/auth/exchange`) instead of a login form. Injected automatically by Keystone's content endpoint at serve time.
 - **`defaultOrganizationId`** (optional) — The org ID to auto-select when the user's account belongs to multiple organizations. **Set this to the org that generated the page's metadata** (the org used in Step 0 schema discovery). Without this prop, multi-org accounts auto-select the first available org, which may not be the intended one. Use an env var, not a literal: `defaultOrganizationId={Number(process.env.NEXT_PUBLIC_DEFAULT_ORG_ID)}`.
 - **`objectKey`** (optional) — The object this page is built for (e.g. `"companies"`). The standalone DevToolbar shows it in the page-info tooltip and in the record ID placeholder. Pass it at **both** levels; omit it only if the page genuinely has no object.
@@ -222,6 +230,8 @@ const { record, isLoading, error, refetch } = useRecord('companies', 'abc123');
 
 Returns `{ record: SfaRecord | null, isLoading, error, refetch }`.
 
+The result always describes the `collection` and `recordId` passed right now: from the first render after either changes it reports no record and no error — with `isLoading` while the new fetch runs — so the previous record or error never shows as the answer to the new one. An empty `recordId` with a collection given sets `error` instead of fetching. Disabling the hook (`enabled: false`) without changing them keeps the record already fetched.
+
 ### useRecordList
 
 Fetches a paginated list of records. Supports cursor-based pagination (Keystone API).
@@ -715,7 +725,7 @@ The state for `status === 'error'`. Renders `⚠ 取得失敗` and, when given `
 
 Props: `{ onRetry?: () => void, message?: string, retryLabel?: string }`. Without `onRetry` no link is rendered — a dead control is worse than none.
 
-The server's error text is deliberately not shown: it is wording the reader cannot act on. Pages that need it still have `error` from the hook, and `RecordList` / `RecordView` report it through their `onError` prop.
+The server's error text is deliberately not shown: it is wording the reader cannot act on. Pages that need it still have `error` from the hook, and `RecordList` / `RecordView` report it through their `onError` prop (`RecordView` does not for an empty record id — see [RecordView](#recordview)).
 
 `refetch` retries whichever step failed. On `useRelatedRecords` that includes a failed describe: retrying only the list would do nothing, because without relationship metadata the list never ran.
 
@@ -814,6 +824,10 @@ Props:
 
 Each group: `title?` (heading), `layout?` (`"1-col"` | `"2-col"` | `"3-col"`), `fields` (field names).
 
+**States.** While the record is fetched it shows "Loading...". A failed fetch shows `FetchErrorState` and calls `onError`. When no record is specified — `collection` or `recordId` is empty — it shows `EmptyState` with "レコードが指定されていません" and does **not** call `onError`: nothing was fetched, so there is no failure to report. `useRecord` on its own still sets `error` for an empty record id (a collection given, no record picked), so a page built on the hook can word that case itself.
+
+**Heading.** `title` if given, else the record's own title, else the values of its title fields joined by spaces. Only values a reader understands go into the heading — a reference or choice field without a label is left out rather than showing its id or code.
+
 ### RecordList
 
 Displays a paginated table of records.
@@ -834,6 +848,8 @@ Props:
 
 `RecordView` takes the same prop and, without it, names its `title` — the label it already shows as the heading — so a page that passed `title="会社"` gets `⚠ 会社の取得に失敗` for free.
 
+**States.** While the list is fetched it shows "Loading...". A failed fetch shows `FetchErrorState` and calls `onError`. Without a `collection` nothing is asked, so instead of "0 records" it shows `EmptyState` with "オブジェクトが指定されていません".
+
 ### FieldRenderer
 
 Renders a single field value based on its kind. Used internally by RecordView and RecordList. Use directly when building custom layouts.
@@ -842,6 +858,10 @@ Renders a single field value based on its kind. Used internally by RecordView an
 <FieldRenderer fieldValue={someField} fieldName="company_name" />
 ```
 
+It shows `label` (formatted by the API). When `label` is empty or `null`, it falls back to `value` only for `text` / `number` / `date` / `datetime` / `computed` fields whose value is a number, a boolean or a string that is not markup; a choice or reference field, whose value is a code or an id, shows `—` instead. The RecordView heading follows the same rule.
+
+A single-line `text` value becomes a link when it is a URL, an email address, or a phone number — a Japanese number starting with 0 with 10 or 11 digits (`03-1234-5678`), or an international one starting with `+` with 8 to 15 digits. Postal codes (`100-0001`) and dates (`2026-09-28`) stay plain text.
+
 ## Design tokens
 
 All kit components use CSS custom properties with `--sfa-*` prefixes. Use these in your generated UI for visual consistency with SFA/CRM:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geniee-inc/sfa-kit",
-  "version": "1.17.0",
+  "version": "1.19.0",
   "description": "React hooks and components for building pages that connect to GENIEE SFA/CRM data.",
   "type": "module",
   "main": "./src/index.js",

package/src/bin/sfa-kit-bundle.js

@@ -11,16 +11,15 @@ Usage:
   ${TOKEN_ENV}=<token> npx sfa-kit-bundle \\
     --entry entry.tsx \\
     --out dist \\
-    --studio-version 0.5.0 \\
     --api-base https://keystone-api-staging.chikyu.mobi
 
 Options:
   --entry           Entry module that mounts the page into #root. Required.
   --out             Output directory. Required.
-  --studio-version  The Studio build version this bundle targets, not the
-                    sfa-kit npm version. Required.
   --api-base        Keystone API base, without a trailing slash. Required.
   --title           <title> of the generated index.html. Default: SFA/CRM.
+  --studio-version  Deprecated; omit it. When given, the bundle is signed in
+                    the legacy format, over "{studio_version}:{content_hash}".
   --help            Show this message.
 
 Environment:
@@ -28,7 +27,8 @@ Environment:
   API is called with. Required, and read from the environment rather than an
   argument so it does not land in shell history or in the process list.
 
-Writes index.html, assets/bundle.js and a signed manifest.json. Zip the
+Writes index.html, assets/bundle.js and a signed manifest.json, which records
+this sfa-kit version as sfa_kit_version. Zip the
 contents of the output directory — the files have to sit at the zip root.
 Needs esbuild installed alongside the kit.`;
 const OPTIONS = {
@@ -70,7 +70,7 @@ function parseCliOptions(argv) {
  */
 export function runBundleCli(argv, env, out) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e, _f;
+        var _a, _b, _c, _d, _e;
         const parsed = parseCliOptions(argv);
         if (parsed.error != null) {
             out.error(`${parsed.error}\n\n${USAGE}`);
@@ -81,7 +81,7 @@ export function runBundleCli(argv, env, out) {
             out.log(USAGE);
             return 0;
         }
-        const missing = ['entry', 'out', 'studio-version', 'api-base']
+        const missing = ['entry', 'out', 'api-base']
             .filter(name => { var _a; return ((_a = values[name]) !== null && _a !== void 0 ? _a : '') === ''; })
             .map(name => `--${name}`);
         const accessToken = (_a = env[TOKEN_ENV]) !== null && _a !== void 0 ? _a : '';
@@ -91,10 +91,18 @@ export function runBundleCli(argv, env, out) {
             out.error(`Missing required: ${missing.join(', ')}\n\n${USAGE}`);
             return 1;
         }
+        // NOTE: an empty value is refused, not read as "omitted". Omitting the flag
+        // switches the signing format, and a script whose variable came out empty
+        // should hear about it rather than quietly get the other format.
+        const studioVersion = values['studio-version'];
+        if (studioVersion != null && studioVersion.trim() === '') {
+            out.error(`--studio-version must not be empty. Omit it to sign content_hash alone.\n\n${USAGE}`);
+            return 1;
+        }
         try {
-            const manifest = yield buildStaticBundle(Object.assign({ entry: (_b = values.entry) !== null && _b !== void 0 ? _b : '', outDir: (_c = values.out) !== null && _c !== void 0 ? _c : '', studioVersion: (_d = values['studio-version']) !== null && _d !== void 0 ? _d : '', apiBase: (_e = values['api-base']) !== null && _e !== void 0 ? _e : '', accessToken }, (((_f = values.title) !== null && _f !== void 0 ? _f : '') === '' ? {} : { title: values.title })));
+            const manifest = yield buildStaticBundle(Object.assign(Object.assign({ entry: (_b = values.entry) !== null && _b !== void 0 ? _b : '', outDir: (_c = values.out) !== null && _c !== void 0 ? _c : '', apiBase: (_d = values['api-base']) !== null && _d !== void 0 ? _d : '', accessToken }, (((_e = values.title) !== null && _e !== void 0 ? _e : '') === '' ? {} : { title: values.title })), (studioVersion == null ? {} : { studioVersion })));
             out.log(`Built and signed ${values.out} ` +
-                `(studio_version ${manifest.studio_version}, ` +
+                `(sfa_kit_version ${manifest.sfa_kit_version}, ` +
                 `content_hash ${manifest.content_hash}).`);
             return 0;
         }

package/src/bundle.d.ts

@@ -13,7 +13,6 @@
  * await buildStaticBundle({
  *   entry: 'entry.tsx',
  *   outDir: 'dist',
- *   studioVersion: '0.5.0',
  *   apiBase: 'https://keystone-api-staging.chikyu.mobi',
  *   accessToken: token,
  * });
@@ -21,6 +20,6 @@
  *
  * @packageDocumentation
  */
-export type { BundleManifest } from './lib/signing/index.js';
+export type { BundleManifest, ContentHashManifest, } from './lib/signing/index.js';
 export type { BuildStaticBundleOptions } from './lib/bundle/index.js';
 export { buildStaticBundle } from './lib/bundle/index.js';

package/src/index.d.ts

@@ -34,7 +34,7 @@ export { ErrorBoundary } from './lib/components/ErrorBoundary';
 export { EmptyState } from './lib/components/EmptyState';
 export { FetchErrorState } from './lib/components/FetchErrorState';
 export { ErrorSnackbar } from './lib/components/ErrorSnackbar';
-export type { SfaAuth, SfaApiMode, SfaClientConfig, SfaRecord, SfaListResponse, SfaListParams, SfaFieldValue, SfaFieldKind, SfaFieldValueMapping, FieldGroupSpec, FieldGroupLayout, SfaFieldDescriptor, SfaFieldOption, SfaRelationDescriptor, SfaObjectDetail, SfaObjectSummary, SfaObjectCatalog, SfaObjectPermissions, SfaObjectOrigin, SfaRelationshipKind, SfaCardinality, SfaDescribeResult, SfaFieldTypeDescriptor, SfaFieldTypeCatalog, SfaFilterOperator, SfaCreateOptions, SfaFieldError, SfaBulkRowStatus, SfaBulkRowResult, SfaBulkRowError, SfaBulkUpdateRow, SfaBulkDeleteRow, } from './lib/provider/types';
+export type { SfaAuth, SfaApiMode, SfaAuthErrorHandler, SfaClientConfig, SfaRecord, SfaListResponse, SfaListParams, SfaFieldValue, SfaFieldKind, SfaFieldValueMapping, FieldGroupSpec, FieldGroupLayout, SfaFieldDescriptor, SfaFieldOption, SfaRelationDescriptor, SfaObjectDetail, SfaObjectSummary, SfaObjectCatalog, SfaObjectPermissions, SfaObjectOrigin, SfaRelationshipKind, SfaCardinality, SfaDescribeResult, SfaFieldTypeDescriptor, SfaFieldTypeCatalog, SfaFilterOperator, SfaCreateOptions, SfaFieldError, SfaBulkRowStatus, SfaBulkRowResult, SfaBulkRowError, SfaBulkUpdateRow, SfaBulkDeleteRow, } from './lib/provider/types';
 export { SFA_BULK_MAX_ROWS } from './lib/provider/SfaClient';
 export type { SfaSession, AuthResult, OrganizationChoice, } from './lib/auth/types';
 export { buildRecordDetailUrl, resolveHostOrigin, } from './lib/navigation/record-detail-url';

package/src/lib/auth/resolve-api-base.d.ts

@@ -1,12 +1,14 @@
 export declare const KEYSTONE_PRODUCTION_API_BASE = "https://keystone-api-production.chikyu.mobi";
 export declare const KEYSTONE_STAGING_API_BASE = "https://keystone-api-staging.chikyu.mobi";
+export declare const KEYSTONE_DEV09_API_BASE = "https://keystone-api-dev09.chikyu.mobi";
 /**
  * @description Resolves the Keystone API base URL from an origin.
  *
- * Every non-production chikyu environment — `stg.chikyu.mobi`, the dev tier,
- * local development, and Amplify PR previews — uses the staging Keystone API.
- * Everything else — `app.chikyu.net`, an origin this table does not know, or
- * no origin at all — uses production.
+ * `dev09` has a keystone of its own. Every other non-production chikyu
+ * environment — `stg.chikyu.mobi`, the rest of the dev tier, local development,
+ * and Amplify PR previews — uses the staging Keystone API. Everything else —
+ * `app.chikyu.net`, an origin this table does not know, or no origin at all —
+ * uses production.
  *
  * Production is the fallback on purpose: a page that reaches a real customer
  * must never silently talk to staging. A developer on an unrecognised host

package/src/lib/auth/resolve-api-base.js

@@ -1,6 +1,10 @@
 export const KEYSTONE_PRODUCTION_API_BASE = 'https://keystone-api-production.chikyu.mobi';
 export const KEYSTONE_STAGING_API_BASE = 'https://keystone-api-staging.chikyu.mobi';
-/** Dev-tier chikyu (legacy frontend) hosts: dev01-dev09, devdc, deva0, and the like. */
+export const KEYSTONE_DEV09_API_BASE = 'https://keystone-api-dev09.chikyu.mobi';
+/**
+ * Dev-tier chikyu (legacy frontend) hosts: dev01-dev08, devdc, deva0, and the
+ * like. `dev09` matches this too but is taken by `DEV09_HOSTNAMES` first.
+ */
 const DEV_HOST_PATTERN = /^dev\w+\.chikyu\.mobi$/;
 /**
  * Amplify-hosted new frontend. Covers PR previews
@@ -21,13 +25,26 @@ const LOCAL_HOSTNAMES = new Set([
 ]);
 /** Shared pre-production chikyu environments. */
 const STAGING_HOSTNAMES = new Set(['stg.chikyu.mobi']);
+/**
+ * dev09 has a keystone of its own. One keystone delegates to exactly one chikyu
+ * environment, so the staging keystone follows `stg` and this one follows
+ * `dev09`, the JapanAI Studio integration environment. Both of dev09's frontends
+ * are listed: the legacy chikyu host and the Amplify host that frames the page.
+ * Exact hostnames, because `DEV_HOST_PATTERN` and `AMPLIFY_PATTERN` below would
+ * otherwise claim them for staging.
+ */
+const DEV09_HOSTNAMES = new Set([
+    'dev09.chikyu.mobi',
+    'dev09.waf.amplify.axiom.chikyu.mobi',
+]);
 /**
  * @description Resolves the Keystone API base URL from an origin.
  *
- * Every non-production chikyu environment — `stg.chikyu.mobi`, the dev tier,
- * local development, and Amplify PR previews — uses the staging Keystone API.
- * Everything else — `app.chikyu.net`, an origin this table does not know, or
- * no origin at all — uses production.
+ * `dev09` has a keystone of its own. Every other non-production chikyu
+ * environment — `stg.chikyu.mobi`, the rest of the dev tier, local development,
+ * and Amplify PR previews — uses the staging Keystone API. Everything else —
+ * `app.chikyu.net`, an origin this table does not know, or no origin at all —
+ * uses production.
  *
  * Production is the fallback on purpose: a page that reaches a real customer
  * must never silently talk to staging. A developer on an unrecognised host
@@ -41,6 +58,8 @@ export function resolveApiBase(origin) {
     const hostname = hostnameOf(origin);
     if (hostname == null)
         return KEYSTONE_PRODUCTION_API_BASE;
+    if (DEV09_HOSTNAMES.has(hostname))
+        return KEYSTONE_DEV09_API_BASE;
     const isNonProduction = STAGING_HOSTNAMES.has(hostname) ||
         LOCAL_HOSTNAMES.has(hostname) ||
         DEV_HOST_PATTERN.test(hostname) ||

package/src/lib/auth/useEmbedSession.d.ts

@@ -1,3 +1,4 @@
+import type { SfaAuthErrorHandler } from '../provider/types';
 import type { EmbedContext } from './embed-protocol';
 import type { SfaSession } from './types';
 export type EmbedPhase = {
@@ -28,7 +29,7 @@ export type EmbedPhase = {
 export interface EmbedSessionState {
     readonly phase: EmbedPhase;
     /** Passed to SfaProvider so a 401 triggers the code-request fallback. */
-    readonly handleAuthError: () => void;
+    readonly handleAuthError: SfaAuthErrorHandler;
 }
 /**
  * @description Keeps an embedded page authenticated over the postMessage