SignKit v0.1.17

Added

• A server-rendered contract worklist with title/recipient search, status views, bounded pages, and whole-instance counts. Action-required badges and icon-only actions with localized tooltips work on desktop and mobile (#233, #237).
• Advertise the worklist read endpoint as session-only in system capabilities; it is not added to the API-key surface.

Changed

• Simplify sender authoring/review wording and workspace-management navigation while keeping the shared Luma layout (#229).
• Reuse request-local authorization work and bound D1 list/summary reads with additive D1 and PostgreSQL indexes (#235).

Fixed

• Load independent completion, seal, and delivery details in parallel without blocking the contract page. Clear previous completion state and supersede older seal-status reads after a seal request (#237).
• Retain completion verification compatibility for historical sends without a recorded ready-event identifier (#229).

Security

• Worklist action flags are informational and never grant signing authority. No shared authorization cache is introduced. Known deployment risks remain documented in docs/architecture/deployment-and-risks.md; Vercel remains CI-only. Portable cross-case Unicode search remains tracked separately in #236.

SignKit v0.1.16

Publishes create-signkit 0.1.9 with authoritative active-deployment confirmation after Cloudflare version activation. The CLI checks the created deployment identity, the exact requested Worker version, and 100% active traffic before reconciling triggers and recording success. Malformed, error, stale, wrong-version, and split-traffic responses remain failures. No SignKit application, database, auth, mail, or signing behavior changes from v0.1.15.

SignKit v0.1.15

Added

• Let operators explicitly replace expired completion-access links and requeue exhausted completion emails, with audited, idempotent recovery and actionable delivery-failure details (#218). Existing contracts are never automatically resent.

Changed

• Publish create-signkit 0.1.8 with the pinned official cf CLI for Cloudflare account/resource discovery, D1 migrations, secret-name inspection, and version activation. Worker uploads, trigger reconciliation, and D1 exports retain the verified Wrangler compatibility path.
• Complete the four-part minimal refactoring: shared ready/sign/approve operation contracts, neutral runtime dependencies, bounded-stream/backoff primitives, and browser/Rust CLI HTTP problem handling (#223, #224, #225, #226). Authorization, database publication, public API, audit hashes, and document formats remain unchanged.

Fixed

• Recover interrupted completion-PDF publication, reject document sets beyond completion limits before sending, report maintenance failures, and distinguish status refresh from explicit recovery (#217).
• Protect in-flight signature assets from orphan collection and bound D1 sweep statements so collection continues to advance (#219).

Security

• Known residual risks remain documented in docs/architecture/deployment-and-risks.md, including jurisdiction-dependent e-signature requirements. The optional PAdES B-B/B-T instance seal is not a recipient certificate signature or a claim of advanced or qualified status; Vercel remains CI-only. The refactoring verification does not establish full Workers product E2E or large-PDF Worker resource limits.

SignKit v0.1.14

SignKit v0.1.14

• Replace an individual recipient's invitation from the Recipients tab without recreating the envelope or changing its documents.
• Confirm old-link invalidation, distinguish queued mail from delivery, and safely retry ambiguous results without duplicate replacements.
• Preserve successful replacement feedback even when the subsequent status refresh fails.
• Render repeated-recipient invitation delivery history without duplicate-key errors.

This release does not change database schemas, credentials, deployment resources or published completion artifacts. The independently versioned deployment CLI remains create-signkit@0.1.7.

SignKit v0.1.13

SignKit v0.1.13

Completion emails now include the verified, immutable completed PDF when it fits the portable attachment budget. SMTP, Cloudflare Workers email bindings and Cloudflare REST preserve the same published bytes.

Missing publication or temporary storage failures retry instead of sending without the attachment. Integrity failures prevent sending. Larger PDFs use explicit English/Japanese copy with the existing secure-download link.

Existing published artifacts remain immutable. No new secret, database migration or mail-provider/host coupling is introduced. The product and Rust CLI are v0.1.13; create-signkit keeps its independent npm version 0.1.7.

See #198 and #199. Live attachment verification follows deployment and is tracked in the issue.

SignKit v0.1.12

Fixes

• Keep recipients on a verified read-only confirmation after signing or approving, including an immediate page reload. A receipt restores neither document access nor mutation authority.
• Use role-neutral shared access and failure wording for approvers and other recipients in English and Japanese.
• Keep theme/language controls usable and breadcrumbs within the shared mobile header at 320px and 390px.
• Clarify fresh-instance bootstrap guidance after installation or upgrade; initialized instances retain their existing owner.

Installation

The independently versioned deployment bootstrapper is create-signkit@0.1.7. The application and Rust CLI are v0.1.12; the application root remains private and is not published as an npm package.

Cloudflare, Node, Rust CLI, and Docker release artifacts are checksum-verified and accompanied by GitHub provenance attestations. The npm bootstrapper is published through Trusted Publishing.

Existing signing limitations and deployment risks remain documented in docs/architecture/deployment-and-risks.md. This release does not claim qualified recipient signatures or legal certification.

SignKit v0.1.11

SignKit v0.1.11

This patch release improves the end-to-end completion experience without changing existing published evidence or requiring a schema migration.

• Completed envelopes now lead with the final PDF and accessible, native downloads; original documents remain clearly separated.
• Sender tabs show lifecycle-appropriate read-only field layouts, recipient progress, and distinct email delivery status. Envelopes closed before sending no longer claim to have been sent.
• Revisiting a used invitation link shows an envelope-bound completed-action receipt instead of a generic invalid-link message, without restoring signing or document authority.
• Fix D1 approval publication, wrap evidence appendix content within page margins, and correctly encode accented PDF text.
• Add regression coverage for actual downloaded bytes, 390px layouts, keyboard navigation, lifecycle branches, approval persistence, and PDF encoding and bounds.

The application and Rust CLI are v0.1.11. The independently versioned deployment bootstrapper remains create-signkit v0.1.6. The application root package remains private and is not published to npm.

SignKit v0.1.10

Browserless recipient review and decisions in the Rust CLI, backed by a recipient-only capability API. Includes real-backend sender-to-recipient E2E coverage and explicit consent boundaries. See CHANGELOG.md for details.

SignKit v0.1.9

Fixes Cloudflare D1 recipient viewing and signing (#170), restores PDF-only sent documents in the Documents tab (#171), and paints PDF content reliably on first load and after resize, including Japanese contracts (#172).

See CHANGELOG.md for details and current security limitations.

SignKit v0.1.8

Patch release: advertise the revision history and diff endpoints in system capabilities for agent discovery. No authorization or persistence semantics change. See CHANGELOG.md for details.