@memberjunction/esignature 0.0.1 → 5.40.1

package/dist/server/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../src/server/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,SAAS,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AACxF,OAAO,EACH,sBAAsB,EAGtB,2BAA2B,GAE9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAyB5D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,iBAAyB,EACzB,WAAqB,EACrB,QAA4B;IAE5B,MAAM,EAAE,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAA0B,uBAAuB,EAAE,WAAW,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,iBAAiB,MAAM,CAAC;IAChF,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,IAAI,0BAA0B,CAAC;IAEnE,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAClF,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,WAAqB,EAAE,QAA4B;IAC5F,MAAM,EAAE,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAe,WAAW,EAAE,WAAW,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,iDAAiD,IAAI,CAAC,UAAU,wBAAwB,MAAM,IAAI,CAAC,CAAC;QAC9G,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAQC;IAED,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACxE,MAAM,EAAE,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IAEzC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACtD,SAAS,CAAC,gGAAgG,CAAC,CAAC;QAC5G,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvD,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,WAAW;QACrB,WAAW;QACX,QAAQ;KACX,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAA0B,uBAAuB,EAAE,WAAW,CAAC,CAAC;IACxG,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC;IACjC,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;IAC7B,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC;IAC/B,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC5B,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC;IACxC,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;IACzI,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC7F,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,cAAc,CACzB,IAAY,EACZ,WAAmB,EACnB,QAAgB,EAChB,WAAqB,EACrB,QAA4B;IAE5B,MAAM,EAAE,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,eAAe,CAAmB,eAAe,EAAE,WAAW,CAAC,CAAC;IAC1F,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5F,QAAQ,CAAC,aAAa,GAAG,2BAA2B,CAAC,oBAAoB,CAAC;IAC1E,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,qBAAqB,CAChC,WAAmB,EACnB,QAAgB,EAChB,WAAqB,EACrB,QAA4B;IAE5B,MAAM,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACnB,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,4 @@
+export * from './SignatureEngine.js';
+export * from './util.js';
+export * from './artifacts.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAKA,cAAc,mBAAmB,CAAC;AAClC,cAAc,QAAQ,CAAC;AACvB,cAAc,aAAa,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,9 @@
+// SERVER-SIDE PUBLIC API — imported via '@memberjunction/esignature/server'.
+// Adds credential decryption + envelope-lifecycle persistence on top of the metadata cache.
+// Depends on the server-only @memberjunction/credentials package, which is why these live behind
+// the '/server' subpath. SignatureEngineBase (metadata-only) is exported from the root entry,
+// '@memberjunction/esignature', NOT here — re-export it there to keep one source of truth.
+export * from './SignatureEngine.js';
+export * from './util.js';
+export * from './artifacts.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4FAA4F;AAC5F,iGAAiG;AACjG,8FAA8F;AAC9F,2FAA2F;AAC3F,cAAc,mBAAmB,CAAC;AAClC,cAAc,QAAQ,CAAC;AACvB,cAAc,aAAa,CAAC"}

package/dist/server/util.d.ts

@@ -0,0 +1,26 @@
+import { UserInfo } from '@memberjunction/core';
+import { MJSignatureAccountEntity, MJSignatureProviderEntity } from '@memberjunction/core-entities';
+import { BaseSignatureProvider } from '../BaseSignatureProvider.js';
+/** Options for initializing a signature driver from an account + provider pair. */
+export interface AccountSignatureDriverOptions {
+    /** The signature account entity (carries CredentialID + Configuration). */
+    accountEntity: MJSignatureAccountEntity;
+    /** The signature provider entity (carries ServerDriverKey + Configuration). */
+    providerEntity: MJSignatureProviderEntity;
+    /** Context user for DB operations and credential decryption. */
+    contextUser: UserInfo;
+}
+/**
+ * Resolve + initialize a signature provider driver for an account, using the Credential Engine.
+ *
+ * Mirrors MJStorage's `initializeDriverWithAccountCredentials`:
+ * 1. Resolve the driver by `provider.ServerDriverKey` via `MJGlobal.ClassFactory`.
+ * 2. Merge provider Configuration (defaults) + account Configuration (overrides) into the base config.
+ * 3. If the account has a CredentialID, decrypt it via the Credential Engine and overlay the values,
+ *    wiring an `onTokenRefresh` callback that persists rotated tokens back via `updateCredential`.
+ * 4. Call `driver.initialize(...)`.
+ *
+ * Credential values take precedence over Configuration, matching the Storage merge order.
+ */
+export declare function initializeDriverWithAccountCredentials(options: AccountSignatureDriverOptions): Promise<BaseSignatureProvider>;
+//# sourceMappingURL=util.d.ts.map

package/dist/server/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../src/server/util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,mFAAmF;AACnF,MAAM,WAAW,6BAA6B;IAC1C,2EAA2E;IAC3E,aAAa,EAAE,wBAAwB,CAAC;IACxC,+EAA+E;IAC/E,cAAc,EAAE,yBAAyB,CAAC;IAC1C,gEAAgE;IAChE,WAAW,EAAE,QAAQ,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sCAAsC,CACxD,OAAO,EAAE,6BAA6B,GACvC,OAAO,CAAC,qBAAqB,CAAC,CA0BhC"}

package/dist/server/util.js

@@ -0,0 +1,94 @@
+import { LogStatus } from '@memberjunction/core';
+import { MJGlobal } from '@memberjunction/global';
+import { CredentialEngine } from '@memberjunction/credentials';
+import { BaseSignatureProvider } from '../BaseSignatureProvider.js';
+/**
+ * Resolve + initialize a signature provider driver for an account, using the Credential Engine.
+ *
+ * Mirrors MJStorage's `initializeDriverWithAccountCredentials`:
+ * 1. Resolve the driver by `provider.ServerDriverKey` via `MJGlobal.ClassFactory`.
+ * 2. Merge provider Configuration (defaults) + account Configuration (overrides) into the base config.
+ * 3. If the account has a CredentialID, decrypt it via the Credential Engine and overlay the values,
+ *    wiring an `onTokenRefresh` callback that persists rotated tokens back via `updateCredential`.
+ * 4. Call `driver.initialize(...)`.
+ *
+ * Credential values take precedence over Configuration, matching the Storage merge order.
+ */
+export async function initializeDriverWithAccountCredentials(options) {
+    const { accountEntity, providerEntity, contextUser } = options;
+    const driver = MJGlobal.Instance.ClassFactory.CreateInstance(BaseSignatureProvider, providerEntity.ServerDriverKey);
+    if (!driver) {
+        throw new Error(`Failed to create signature driver for provider "${providerEntity.Name}" ` +
+            `with driver key "${providerEntity.ServerDriverKey}".`);
+    }
+    const baseConfig = buildBaseConfig(accountEntity, providerEntity);
+    if (accountEntity.CredentialID) {
+        await applyCredentialValues(driver, baseConfig, accountEntity, contextUser);
+    }
+    else {
+        await driver.initialize(baseConfig);
+        LogStatus(`[eSignature] Initialized account "${accountEntity.Name}" from Configuration only (no credential set).`);
+    }
+    return driver;
+}
+/** Build the non-secret base config: account identity + merged provider/account Configuration JSON. */
+function buildBaseConfig(accountEntity, providerEntity) {
+    return {
+        accountId: accountEntity.ID,
+        accountName: accountEntity.Name,
+        ...parseConfiguration(providerEntity.Configuration, `provider "${providerEntity.Name}"`),
+        ...parseConfiguration(accountEntity.Configuration, `account "${accountEntity.Name}"`),
+    };
+}
+/** Decrypt the account's credential, overlay its values, and initialize the driver with token refresh. */
+async function applyCredentialValues(driver, baseConfig, accountEntity, contextUser) {
+    await CredentialEngine.Instance.Config(false, contextUser);
+    const credentialEntity = CredentialEngine.Instance.getCredentialById(accountEntity.CredentialID);
+    if (!credentialEntity) {
+        throw new Error(`Credential with ID ${accountEntity.CredentialID} not found for account "${accountEntity.Name}".`);
+    }
+    const resolved = await CredentialEngine.Instance.getCredential(credentialEntity.Name, {
+        credentialId: accountEntity.CredentialID,
+        contextUser,
+        subsystem: 'eSignature',
+    });
+    const onTokenRefresh = buildTokenRefreshCallback(accountEntity, resolved.values, contextUser);
+    await driver.initialize({
+        ...baseConfig,
+        ...resolved.values,
+        onTokenRefresh,
+    });
+}
+/** Build a callback that persists rotated OAuth tokens back to the Credential Engine. */
+function buildTokenRefreshCallback(accountEntity, currentValues, contextUser) {
+    return async (newRefreshToken, newAccessToken) => {
+        try {
+            const updatedValues = { ...currentValues, refreshToken: newRefreshToken };
+            if (newAccessToken) {
+                updatedValues.accessToken = newAccessToken;
+            }
+            await CredentialEngine.Instance.updateCredential(accountEntity.CredentialID, updatedValues, contextUser);
+            LogStatus(`[eSignature] Persisted refreshed tokens for account "${accountEntity.Name}".`);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error(`[eSignature] Failed to persist refreshed tokens for account "${accountEntity.Name}": ${message}. ` +
+                `Authentication may fail after server restart.`);
+        }
+    };
+}
+/** Parse a Configuration JSON string into an object; returns {} on null/invalid (logged). */
+function parseConfiguration(configJson, label) {
+    if (!configJson) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(configJson);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        LogStatus(`[eSignature] Ignoring invalid Configuration JSON on ${label}.`);
+        return {};
+    }
+}
+//# sourceMappingURL=util.js.map

package/dist/server/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/server/util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAY,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAajE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CACxD,OAAsC;IAEtC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CACxD,qBAAqB,EACrB,cAAc,CAAC,eAAe,CACjC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,mDAAmD,cAAc,CAAC,IAAI,IAAI;YACtE,oBAAoB,cAAc,CAAC,eAAe,IAAI,CAC7D,CAAC;IACN,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAElE,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACJ,MAAM,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACpC,SAAS,CACL,qCAAqC,aAAa,CAAC,IAAI,gDAAgD,CAC1G,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,uGAAuG;AACvG,SAAS,eAAe,CACpB,aAAuC,EACvC,cAAyC;IAEzC,OAAO;QACH,SAAS,EAAE,aAAa,CAAC,EAAE;QAC3B,WAAW,EAAE,aAAa,CAAC,IAAI;QAC/B,GAAG,kBAAkB,CAAC,cAAc,CAAC,aAAa,EAAE,aAAa,cAAc,CAAC,IAAI,GAAG,CAAC;QACxF,GAAG,kBAAkB,CAAC,aAAa,CAAC,aAAa,EAAE,YAAY,aAAa,CAAC,IAAI,GAAG,CAAC;KACxF,CAAC;AACN,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,qBAAqB,CAChC,MAA6B,EAC7B,UAAmC,EACnC,aAAuC,EACvC,WAAqB;IAErB,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAE3D,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACjG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACX,sBAAsB,aAAa,CAAC,YAAY,2BAA2B,aAAa,CAAC,IAAI,IAAI,CACpG,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAClF,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,WAAW;QACX,SAAS,EAAE,YAAY;KAC1B,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,yBAAyB,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE9F,MAAM,MAAM,CAAC,UAAU,CAAC;QACpB,GAAG,UAAU;QACb,GAAG,QAAQ,CAAC,MAAM;QAClB,cAAc;KACjB,CAAC,CAAC;AACP,CAAC;AAED,yFAAyF;AACzF,SAAS,yBAAyB,CAC9B,aAAuC,EACvC,aAAqC,EACrC,WAAqB;IAErB,OAAO,KAAK,EAAE,eAAuB,EAAE,cAAuB,EAAE,EAAE;QAC9D,IAAI,CAAC;YACD,MAAM,aAAa,GAA2B,EAAE,GAAG,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;YAClG,IAAI,cAAc,EAAE,CAAC;gBACjB,aAAa,CAAC,WAAW,GAAG,cAAc,CAAC;YAC/C,CAAC;YACD,MAAM,gBAAgB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;YACzG,SAAS,CAAC,wDAAwD,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CACT,gEAAgE,aAAa,CAAC,IAAI,MAAM,OAAO,IAAI;gBAC/F,+CAA+C,CACtD,CAAC;QACN,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AAED,6FAA6F;AAC7F,SAAS,kBAAkB,CAAC,UAAyB,EAAE,KAAa;IAChE,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACL,SAAS,CAAC,uDAAuD,KAAK,GAAG,CAAC,CAAC;QAC3E,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Normalized, provider-agnostic types for the MemberJunction eSignature primitive.
+ *
+ * These types form the contract between the engine and any concrete signature provider
+ * (DocuSign, Adobe Sign, Dropbox Sign, …). They contain NO MemberJunction data dependencies
+ * so the contract can be imported on the client as well as the server.
+ */
+/**
+ * The full set of operations a signature provider may support. Core operations are always
+ * implemented; optional operations return a "not supported" result by default and are
+ * advertised via {@link BaseSignatureProvider.getSupportedOperations}.
+ */
+export type SignatureOperation = 'CreateEnvelope' | 'GetEnvelopeStatus' | 'DownloadSignedDocument' | 'VoidEnvelope' | 'CreateEmbeddedSigningUrl' | 'ApplyTemplate' | 'ResendNotification' | 'ParseWebhookEvent' | 'VerifyWebhookSignature';
+/**
+ * Normalized envelope lifecycle status. Each provider maps its own status vocabulary onto
+ * this set. `Unknown` is used when a provider returns a status we don't recognize.
+ */
+export type EnvelopeStatus = 'Draft' | 'Sent' | 'Delivered' | 'Signed' | 'Completed' | 'Declined' | 'Voided' | 'Unknown';
+/**
+ * Callback a provider invokes when it refreshes OAuth tokens, so the engine can persist the
+ * new tokens back to the Credential Engine. Mirrors the Storage subsystem's TokenRefreshCallback.
+ */
+export type SignatureTokenRefreshCallback = (newRefreshToken: string, newAccessToken?: string) => Promise<void>;
+/**
+ * Configuration handed to a provider's {@link BaseSignatureProvider.initialize}. It is the merge
+ * of (provider defaults + account overrides + decrypted credential values), assembled by the
+ * engine. Providers read whatever keys they need; unknown keys are ignored.
+ */
+export interface SignatureProviderConfig {
+    /** The MJ: Signature Accounts.ID this provider instance is bound to, if any. */
+    accountId?: string;
+    /** Human-readable account name, for logging. */
+    accountName?: string;
+    /** Invoked by the provider after an OAuth token refresh so the engine can persist tokens. */
+    onTokenRefresh?: SignatureTokenRefreshCallback;
+    /**
+     * Shared secret used to verify inbound webhook signatures (e.g. DocuSign Connect HMAC,
+     * Dropbox Sign / PandaDoc callback HMAC). Lives in the account's encrypted MJ: Credentials row
+     * alongside the other provider secrets — never an environment variable. When absent, strict
+     * webhook verification fails closed (the engine rejects the event).
+     */
+    connectHmacKey?: string;
+    /** Provider-specific config + decrypted credential values (integrationKey, privateKey, …). */
+    [key: string]: unknown;
+}
+/** A signer to be added to an envelope. */
+export interface SignatureRecipientInput {
+    email: string;
+    name?: string;
+    /** Signing order; lower routes first. Defaults to 1 per recipient if omitted. */
+    routingOrder?: number;
+    /** Template role name, when using {@link BaseSignatureProvider.ApplyTemplate}. */
+    role?: string;
+}
+/** A document to include in an envelope. */
+export interface SignatureDocumentInput {
+    bytes: Buffer;
+    filename: string;
+    /** MIME type, e.g. application/pdf. */
+    contentType: string;
+    /** Provider document id; the engine assigns a sequential id when omitted. */
+    documentId?: string;
+}
+/** Request to create (and optionally send) a signature envelope. */
+export interface CreateEnvelopeRequest {
+    /** Email subject / envelope title. */
+    title: string;
+    message?: string;
+    documents: SignatureDocumentInput[];
+    recipients: SignatureRecipientInput[];
+    /** true → send immediately ('sent'); false → create as draft ('created'). Defaults to true. */
+    sendImmediately?: boolean;
+    /** Provider custom fields / envelope metadata. */
+    metadata?: Record<string, string>;
+}
+/** Per-recipient status snapshot returned by {@link BaseSignatureProvider.GetEnvelopeStatus}. */
+export interface RecipientStatus {
+    email: string;
+    name?: string;
+    status: EnvelopeStatus;
+    /** Provider recipient id, for correlation. */
+    externalRecipientId?: string;
+    /** ISO timestamp the recipient signed, when applicable. */
+    signedAt?: string;
+}
+/** Result of creating an envelope. */
+export interface EnvelopeResult {
+    Success: boolean;
+    externalEnvelopeId?: string;
+    status?: EnvelopeStatus;
+    /** When the provider returns an inline signing URL (embedded flows). */
+    signingUrl?: string;
+    ErrorMessage?: string;
+}
+/** Result of querying envelope status. */
+export interface EnvelopeStatusResult {
+    Success: boolean;
+    status: EnvelopeStatus;
+    recipients?: RecipientStatus[];
+    ErrorMessage?: string;
+}
+/** Result of downloading the executed/signed document. */
+export interface SignedDocumentResult {
+    Success: boolean;
+    document?: {
+        bytes: Buffer;
+        filename: string;
+        contentType: string;
+    };
+    ErrorMessage?: string;
+}
+/** Generic result for operations that only succeed or fail (void, resend, …). */
+export interface OperationResult {
+    Success: boolean;
+    ErrorMessage?: string;
+}
+/** Request to create an embedded (in-app) signing URL for a recipient. */
+export interface EmbeddedSigningRequest {
+    externalEnvelopeId: string;
+    recipientEmail: string;
+    recipientName?: string;
+    /** URL the provider redirects to after the signing ceremony completes. */
+    returnUrl: string;
+}
+/** Result of creating an embedded signing URL. */
+export interface SigningUrlResult {
+    Success: boolean;
+    signingUrl?: string;
+    ErrorMessage?: string;
+}
+/** Request to create an envelope from a provider-hosted template. */
+export interface TemplateEnvelopeRequest {
+    /** Provider template identifier. */
+    templateId: string;
+    title: string;
+    message?: string;
+    /** Recipients keyed by the template's role names. */
+    recipients: SignatureRecipientInput[];
+    sendImmediately?: boolean;
+    metadata?: Record<string, string>;
+}
+/**
+ * Outcome of {@link BaseSignatureProvider.VerifyWebhookSignature}. Three-state so the engine can
+ * distinguish "no secret configured" (verification not possible) from "configured but the signature
+ * didn't match" — enabling a verify-if-configured policy:
+ *   - `Verified`      — a secret is configured and the signature matched. Accept.
+ *   - `Failed`        — a secret is configured but the signature was missing/invalid. **Reject.**
+ *   - `NotConfigured` — no secret is configured, so authenticity can't be checked. Accept with a
+ *                       logged warning (the endpoint still functions during setup; tightens to
+ *                       strict automatically once a key is set).
+ */
+export type WebhookVerificationResult = 'Verified' | 'Failed' | 'NotConfigured';
+/**
+ * A normalized inbound webhook event (DocuSign Connect, Adobe events, …) after the driver has
+ * verified the payload signature/HMAC and mapped it onto our vocabulary. Drivers return `null`
+ * from {@link BaseSignatureProvider.ParseWebhookEvent} for payloads they don't handle.
+ */
+export interface NormalizedSignatureEvent {
+    externalEnvelopeId: string;
+    status: EnvelopeStatus;
+    /** ISO timestamp the event occurred. */
+    occurredAt: string;
+    /** Original payload, retained for audit. */
+    raw: unknown;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GACxB,gBAAgB,GAChB,mBAAmB,GACnB,wBAAwB,GACxB,cAAc,GACd,0BAA0B,GAC1B,eAAe,GACf,oBAAoB,GACpB,mBAAmB,GACnB,wBAAwB,CAAC;AAE/B;;;GAGG;AACH,MAAM,MAAM,cAAc,GACpB,OAAO,GACP,MAAM,GACN,WAAW,GACX,QAAQ,GACR,WAAW,GACX,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhH;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACpC,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8FAA8F;IAC9F,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IAClC,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,sBAAsB,EAAE,CAAC;IACpC,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,+FAA+F;IAC/F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,CAAC;IACvB,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACnC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACpC,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEhF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACrC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,cAAc,CAAC;IACvB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,GAAG,EAAE,OAAO,CAAC;CAChB"}

package/dist/types.js

@@ -0,0 +1,9 @@
+/**
+ * Normalized, provider-agnostic types for the MemberJunction eSignature primitive.
+ *
+ * These types form the contract between the engine and any concrete signature provider
+ * (DocuSign, Adobe Sign, Dropbox Sign, …). They contain NO MemberJunction data dependencies
+ * so the contract can be imported on the client as well as the server.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/package.json

@@ -1,10 +1,47 @@
 {
   "name": "@memberjunction/esignature",
-  "version": "0.0.1",
-  "description": "OIDC trusted publishing setup package for @memberjunction/esignature",
-  "keywords": [
-    "oidc",
-    "trusted-publishing",
-    "setup"
-  ]
+  "version": "5.40.1",
+  "description": "MemberJunction eSignature primitive — pluggable provider contract and normalized types for sending documents for electronic signature (DocuSign, Adobe Sign, …). The optional server engine is exposed via the '@memberjunction/esignature/server' subpath.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "server": [
+        "dist/server/index.d.ts"
+      ]
+    }
+  },
+  "files": [
+    "/dist"
+  ],
+  "scripts": {
+    "build": "tsc && tsc-alias -f",
+    "watch": "tsc -w",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
+  },
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/MemberJunction/MJ"
+  },
+  "dependencies": {
+    "@memberjunction/global": "5.40.1",
+    "@memberjunction/core": "5.40.1",
+    "@memberjunction/core-entities": "5.40.1",
+    "@memberjunction/credentials": "5.40.1",
+    "@memberjunction/storage": "5.40.1"
+  }
 }

package/README.md

@@ -1,45 +0,0 @@
-# @memberjunction/esignature
-
-## ⚠️ IMPORTANT NOTICE ⚠️
-
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
-
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
-
-## Purpose
-
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@memberjunction/esignature`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
-
-## What is OIDC Trusted Publishing?
-
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
-
-## Setup Instructions
-
-To properly configure OIDC trusted publishing for this package:
-
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
-
-## DO NOT USE THIS PACKAGE
-
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
-
-## More Information
-
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
-
----
-
-**Maintained for OIDC setup purposes only**