{"_id":"@absolutejs/esign","name":"@absolutejs/esign","dist-tags":{"latest":"0.0.1"},"versions":{"0.0.1":{"name":"@absolutejs/esign","version":"0.0.1","description":"Provider-neutral e-signature requests, sessions, status reconciliation, and webhook contracts","type":"module","license":"BSL-1.1","author":"Alex Kahn","sideEffects":false,"main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"build":"bun build src/index.ts --outdir dist --target node --external '@absolutejs/esign' && tsc --project tsconfig.build.json","typecheck":"tsc --noEmit","test":"bun test","check:package":"absolute-changelog check","prepublishOnly":"bun run check:package"},"devDependencies":{"@absolutejs/changelog":"^0.6.0","@types/node":"^22.0.0","typescript":"^5.9.3"},"peerDependencies":{"@absolutejs/linked-providers":">=0.0.6 <0.1.0"},"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/absolutejs/esign.git"},"homepage":"https://github.com/absolutejs/esign","bugs":{"url":"https://github.com/absolutejs/esign/issues"},"_id":"@absolutejs/esign@0.0.1","_integrity":"sha512-Wcb5y6FF89vyNejYYxjyO+wElPo3XY0ej7I9X088LC6r1q8pY/9bvIx59wHWGFDZAvTkNPUkhbMYptyhgibFqQ==","_nodeVersion":"26.3.0","_npmVersion":"10.8.3","shasum":"0f766b82907c7a9d79bfb15b8455e2d2b10af87f","dist":{"integrity":"sha512-Wcb5y6FF89vyNejYYxjyO+wElPo3XY0ej7I9X088LC6r1q8pY/9bvIx59wHWGFDZAvTkNPUkhbMYptyhgibFqQ==","shasum":"0f766b82907c7a9d79bfb15b8455e2d2b10af87f","tarball":"https://registry.npmjs.org/@absolutejs/esign/-/esign-0.0.1.tgz","fileCount":7,"unpackedSize":18906,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIG4Ol2vOASlgno1KG02oySWsULaV7nTphWfuygnt5cUGAiEA/UGUL+rDK2ZO3Iriu4I0bt1UQhBsOz9yf+3J2t6VIIQ="}]},"_npmUser":{"name":"alexkahndev","email":"alexkahn2019@gmail.com"},"directories":{},"maintainers":[{"name":"alexkahndev","email":"alexkahn2019@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/esign_0.0.1_1789071157951_0.4488670392107996"},"_hasShrinkwrap":false}},"time":{"created":"2026-09-10T20:12:37.718Z","0.0.1":"2026-09-10T20:12:38.083Z","modified":"2026-09-10T20:12:38.456Z"},"maintainers":[{"name":"alexkahndev","email":"alexkahn2019@gmail.com"}],"description":"Provider-neutral e-signature requests, sessions, status reconciliation, and webhook contracts","homepage":"https://github.com/absolutejs/esign","repository":{"type":"git","url":"git+https://github.com/absolutejs/esign.git"},"author":"Alex Kahn","bugs":{"url":"https://github.com/absolutejs/esign/issues"},"license":"BSL-1.1","readme":"# @absolutejs/esign\n\nProvider-neutral electronic signing for Node.js and Bun. Own agreement versions, identities, permissions, persistence, and billing in your application; swap providers through the same signing contract.\n\nThe initial adapters are `@absolutejs/esign-docusign` and `@absolutejs/esign-dropbox-sign`. Install only the adapters you use. This package has no provider SDK, database, UI framework, or implicit network initialization.\n\n## Contract\n\n- `createRequest`: PDFs, signer identities, signature field placement, and an application reference.\n- `getRequest`: current provider state and individual signer status.\n- `createSigningSession`: short-lived access for a **server-authorized** signer already on that request.\n- `downloadCompleted`: completed PDF; separate audit certificate when supported.\n- `cancelRequest`: cancel the provider request.\n- `verifyWebhook`: verify the provider's authentication and return a reconciliation hint.\n- `capabilities`: embedded signing, ordered signing, cancellation, and separate audit downloads.\n\nSignature fields use one-based pages and provider document coordinates (72 DPI). Document/signer IDs are local identifiers; persist the provider signer IDs returned by `createRequest`. Always authorize by your saved participant-to-provider-signer mapping, never a caller-supplied email or signer ID.\n\n## Account connections\n\n`linkedESignProvider(resolver, { ownerRef, provider, bindingId }, factory)` accepts the existing `@absolutejs/linked-providers` resolver. It resolves the binding for that owner and supplies a fresh token callback to the adapter. The host stores and encrypts grants, refreshes tokens, and handles revocation. Provider OAuth helpers are also exported by each adapter; their caller must generate unpredictable state, bind it to the signed-in account, validate and consume it once, and persist tokens securely.\n\n## Durable workflow\n\n1. Save an immutable document revision and SHA-256 digest (`documentDigest`) before sending.\n2. Persist a creation operation before calling the provider. Do not automatically retry an ambiguous POST timeout; reconcile the operation before allowing another send.\n3. Save provider request and signer IDs against that revision. Do not change providers after a request is sent; cancel and create a new revision instead.\n4. Check ownership and recipient role before issuing a signing session.\n5. Verify callback authentication, deduplicate callback IDs, and call `reconcileSignatureRequest` using the **saved request ID and reference**. Callback bodies and browser return URLs never establish completion.\n6. Retrieve and persist the completed PDF and audit artifact when available. A completed request can precede PDF generation; retry artifact retrieval separately without re-sending.\n\nDropbox Sign's event hash authenticates event time and type, not every payload field. Re-fetching the saved request is mandatory. Preserve terminal state against out-of-order callbacks; an interrupted refresh must not erase a known completed state.\n\nHTTP errors exclude vendor response bodies and access tokens. Creation POSTs are never automatically retried. All HTTP requests have bounded timeouts. Callback routes should enforce body-size limits and return each adapter's `webhookAcknowledgement` after durable processing.\n\n## Development\n\n`bun run build`, `bun run typecheck`; adapter contract tests live in `../esign-adapters/test`. Tests inject `fetch` and make no external requests. Live account and sandbox acceptance tests are required before enabling a provider for real agreements.\n","readmeFilename":"README.md","_rev":"1-201ba786586d314073c88df0c1f3299d"}