Skip to content

v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Sep 22:46
v0.4.0
00a980f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.4.0 (2026-09-10)

The production release of the backend: one library for hosts that mint in-process, one
service that runs from environment alone as a function or a container, and a runbook by
role. Migration notes: docs/upgrading.md; operations:
docs/operations/production.md.

⚠ Breaking changes

  • Package rename: @blinkbitcoin/esign-server is now @blinkbitcoin/esign-node
    (packages/esign-node), platform-named like esign-react / esign-react-native.
    No aliases: update every import, including the /docusign, /express and /knex
    subpaths. (#83, 97e55a3)
  • The service is a package and its image is renamed: examples/full-service-demo
    is now packages/esign-service (@blinkbitcoin/esign-service, published); the image
    ghcr.io/blinkbitcoin/esign-api is now ghcr.io/blinkbitcoin/esign-service. (#83)
  • The service is no longer an Express app. createApp() is gone; the entry points
    are createESignApp(env, deps) (Fetch) and startServer(env) on
    @blinkbitcoin/esign-service/node. The container command is node dist/node.js,
    migrations are node dist/node.js migrate (was dist/migrate.js). express,
    helmet, cors and express-rate-limit are no longer dependencies. (#86, 302ab25)
  • ESIGN_ENV=production replaces NODE_ENV=production as the production switch
    (GraphQL introspection off; demo DocuSign hosts and the mock provider refused unless
    ESIGN_ALLOW_DEMO=true; a client's own prefill refused unless
    ESIGN_ALLOW_CLIENT_PREFILL=true). The image sets ESIGN_ENV=production itself; a
    non-container deployment that relied on NODE_ENV must set it. (#84, #86)
  • Boot checks moved earlier and changed shape: DOCUSIGN_HMAC_KEY and
    DOCUSIGN_TEMPLATE_ID are required only when envelope orchestration is on; a mint
    requires DOCUSIGN_WEBFORM_ID and DOCUSIGN_RETURN_URL at provider selection;
    validateSecurityConfig() is validateConfig(env, { runtime }). (#84, #86)

Features

  • node: production guard (ESIGN_ENV, ESIGN_ALLOW_DEMO), hosted-form boot checks
    (HOSTED_FORM_SETTINGS, incl. the return URL that used to fail silently), private key
    from DOCUSIGN_PRIVATE_KEY_BASE64 / DOCUSIGN_PRIVATE_KEY_FILE,
    hostedFormProviderFromEnv, and two presets that serve the mint, the return-URL
    bridge and /health: createHostedFormRouter (Express) and createHostedFormApp
    (Fetch), with a prefill hook so the host computes locked terms from its own data;
    a hook rejects with Errors.validationError → 400. (#84, e621645)
  • service: one deployable for the mint and the full envelope orchestration,
    capability by environment: the mint is always on, DATABASE_URL adds /graphql,
    POST /webhook/esign and the Knex store. Entries for Node (the image, in-memory rate
    limits, TRUST_PROXY), Vercel and Cloudflare Workers (mint only). Session
    verification via SESSION_JWKS_URL or SESSION_HS256_SECRET (JWT_SECRET stays an
    alias). Locked terms via a TERMS_URL callback (TERMS_SHARED_SECRET,
    TERMS_TIMEOUT_MS; plaintext refused in production unless private or
    TERMS_ALLOW_INSECURE=true). Deploy templates for Compose, Kubernetes, Vercel,
    Cloudflare and NixOS ship in the package; /health reports the capabilities that
    are on. (#86, 302ab25)
  • demo: the mint-only demo builds, ships a Dockerfile and uses the hosted-form router (#85) (aad60ca)

Documentation

  • The production runbook by role (DocuSign go-live, backend, DevOps, mobile, verification,
    failure modes), a "who are you" router and a backend-options table in the README, and
    the architecture docs and diagrams redrawn for the two tiers. (#87, 0ecf631)
Assets 2
Loading