@teamscala/service-boot 0.23.467 → 0.23.468

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.467",
+  "version": "0.23.468",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/public-agreement-router.ts

@@ -11,9 +11,19 @@
  * Off-the-shelf path (building-applications): typed ORPC procedure, not a
  * hand-written Hono handler; writes go through context.prisma inside the
  * handler (orpc-is-the-only-api) so the audit trigger sees the ORPC caller.
- * Multi-party model: signature_data holds a parties roster (JSON); each party
- * is gated by its own email and the agreement completes only when every party
- * has signed; single-signer falls back to signer_email/signer_name.
+ * ONE signing model, the DocuSign recipients shape: signature_data holds a
+ * parties roster (JSON), each party is gated by its own email, and the
+ * agreement completes only when every party has signed. A single signer is a
+ * roster of one -- there is no separate single-signer path.
+ *
+ * A legacy signer_email/signer_name fallback used to sit alongside this and was
+ * deleted 2026-09-03: measured across every agreement on the platform, 13 of 14
+ * carried a roster and ZERO used the fallback (the 14th was an unsent draft with
+ * no signature_data at all). It was never exercised, and it was not inert -- its
+ * write put a BARE STRING into signature_data, which would have destroyed the
+ * roster of any agreement that reached it. Keeping it also meant every change to
+ * this handler had to be made twice: the Prisma 8 timestamptz fix that made
+ * signing work at all had to be applied to both branches of one function.
  *
  * This module holds the three procedures (verify/sign/verifyDocument); the
  * supporting machinery lives as siblings (agreement-signing-evidence,
@@ -114,19 +124,9 @@ export const publicAgreementRouter = {
 			};
 		}
 
-		// Legacy single-signer path.
-		const matched =
-			String(agreement.signer_email ?? "")
-				.trim()
-				.toLowerCase() === email;
-		if (!matched) return { matched: false as const };
-		return {
-			matched: true,
-			name: agreement.name,
-			signerName: agreement.signer_name,
-			signedAt: agreement.signed_at,
-			accessToken: signAgreementAccessToken(agreementId, email, Date.now()),
-		};
+		// No roster means the agreement was never prepared for signing. It is
+		// not viewable, and it is certainly not signable.
+		return { matched: false as const };
 	}),
 
 	// Commit the authed party's signature. Returns { ok, parties } so the block
@@ -309,47 +309,11 @@ export const publicAgreementRouter = {
 				return result;
 			}
 
-			// Legacy single-signer path.
-			const signerEmail = String(agreement.signer_email ?? "")
-				.trim()
-				.toLowerCase();
-			if (!signerEmail || signerEmail !== email) {
-				return {
-					ok: false as const,
-					error: "This email does not match the agreement's signer.",
-				};
-			}
-			if (agreement.signed_at) {
-				return {
-					ok: true as const,
-					alreadySigned: true,
-					signedAt: agreement.signed_at,
-					signerName: agreement.signer_name,
-				};
-			}
-			const updated = await context.prisma.agreements.update({
-				where: { id: agreementId },
-				data: {
-					signature_data: input.signatureData ?? agreement.signer_name ?? "",
-					signed_at: nowInstant,
-					viewed_at: nowInstant,
-					signed_by: agreement.contact_id ?? null,
-					...(input.signerName ? { signer_name: input.signerName } : {}),
-				},
-			});
-			// Every captured identity → CRM: connect this signer to client_database.
-			await connectSignerToCrm(
-				context.prisma,
-				agreement,
-				email,
-				input.signerName ?? agreement.signer_name,
-				input.company,
-			);
+			// An agreement with no roster was never prepared for signing.
+			// Refuse rather than invent a signer.
 			return {
-				ok: true as const,
-				signedAt: updated.signed_at,
-				signerName: updated.signer_name,
-				payUrl: await invoicePayUrl(agreementId, originFrom(context.headers)),
+				ok: false as const,
+				error: "This agreement has no signers recorded and cannot be signed.",
 			};
 		} catch (err) {
 			log.error(