@teamscala/service-boot 0.23.467 → 0.23.469

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.467",
+  "version": "0.23.469",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/public-agreement-router.ts

@@ -11,9 +11,19 @@
  * Off-the-shelf path (building-applications): typed ORPC procedure, not a
  * hand-written Hono handler; writes go through context.prisma inside the
  * handler (orpc-is-the-only-api) so the audit trigger sees the ORPC caller.
- * Multi-party model: signature_data holds a parties roster (JSON); each party
- * is gated by its own email and the agreement completes only when every party
- * has signed; single-signer falls back to signer_email/signer_name.
+ * ONE signing model, the DocuSign recipients shape: signature_data holds a
+ * parties roster (JSON), each party is gated by its own email, and the
+ * agreement completes only when every party has signed. A single signer is a
+ * roster of one -- there is no separate single-signer path.
+ *
+ * A legacy signer_email/signer_name fallback used to sit alongside this and was
+ * deleted 2026-09-03: measured across every agreement on the platform, 13 of 14
+ * carried a roster and ZERO used the fallback (the 14th was an unsent draft with
+ * no signature_data at all). It was never exercised, and it was not inert -- its
+ * write put a BARE STRING into signature_data, which would have destroyed the
+ * roster of any agreement that reached it. Keeping it also meant every change to
+ * this handler had to be made twice: the Prisma 8 timestamptz fix that made
+ * signing work at all had to be applied to both branches of one function.
  *
  * This module holds the three procedures (verify/sign/verifyDocument); the
  * supporting machinery lives as siblings (agreement-signing-evidence,
@@ -25,6 +35,7 @@ import { os } from "@orpc/server";
 import * as v from "valibot";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { queryRows } from "@teamscala/db/query-rows";
+import { recordEvent } from "@teamscala/event-log/record-event";
 import type { PrismaClient } from "@teamscala/db/client";
 import { signAgreementAccessToken } from "@teamscala/document-signing/agreement-access-token";
 import {
@@ -114,19 +125,9 @@ export const publicAgreementRouter = {
 			};
 		}
 
-		// Legacy single-signer path.
-		const matched =
-			String(agreement.signer_email ?? "")
-				.trim()
-				.toLowerCase() === email;
-		if (!matched) return { matched: false as const };
-		return {
-			matched: true,
-			name: agreement.name,
-			signerName: agreement.signer_name,
-			signedAt: agreement.signed_at,
-			accessToken: signAgreementAccessToken(agreementId, email, Date.now()),
-		};
+		// No roster means the agreement was never prepared for signing. It is
+		// not viewable, and it is certainly not signable.
+		return { matched: false as const };
 	}),
 
 	// Commit the authed party's signature. Returns { ok, parties } so the block
@@ -309,52 +310,39 @@ export const publicAgreementRouter = {
 				return result;
 			}
 
-			// Legacy single-signer path.
-			const signerEmail = String(agreement.signer_email ?? "")
-				.trim()
-				.toLowerCase();
-			if (!signerEmail || signerEmail !== email) {
-				return {
-					ok: false as const,
-					error: "This email does not match the agreement's signer.",
-				};
-			}
-			if (agreement.signed_at) {
-				return {
-					ok: true as const,
-					alreadySigned: true,
-					signedAt: agreement.signed_at,
-					signerName: agreement.signer_name,
-				};
-			}
-			const updated = await context.prisma.agreements.update({
-				where: { id: agreementId },
-				data: {
-					signature_data: input.signatureData ?? agreement.signer_name ?? "",
-					signed_at: nowInstant,
-					viewed_at: nowInstant,
-					signed_by: agreement.contact_id ?? null,
-					...(input.signerName ? { signer_name: input.signerName } : {}),
-				},
-			});
-			// Every captured identity → CRM: connect this signer to client_database.
-			await connectSignerToCrm(
-				context.prisma,
-				agreement,
-				email,
-				input.signerName ?? agreement.signer_name,
-				input.company,
-			);
+			// An agreement with no roster was never prepared for signing.
+			// Refuse rather than invent a signer.
 			return {
-				ok: true as const,
-				signedAt: updated.signed_at,
-				signerName: updated.signer_name,
-				payUrl: await invoicePayUrl(agreementId, originFrom(context.headers)),
+				ok: false as const,
+				error: "This agreement has no signers recorded and cannot be signed.",
 			};
 		} catch (err) {
-			log.error(
-				`[publicAgreement.sign] failed: ${err instanceof Error ? err.message : String(err)}`,
-			);
+			const detail = err instanceof Error ? err.message : String(err);
+			log.error(`[publicAgreement.sign] failed: ${detail}`);
+			// A LOG LINE IS NOT A RECORD. Measured 2026-09-03: signing was broken
+			// for every signer for hours -- first a 404 on the procedure, then a
+			// Prisma 8 codec rejecting the timestamp write -- and error_logs held
+			// ZERO rows the whole time. The page returned 200, the service was
+			// running, the deploy was green, and the signer saw only "Could not
+			// submit your signature.", which reads as transient and invites a
+			// retry that fails identically. The failure was discovered by a human
+			// being unable to sign, which is the same shape as
+			// page-server.render.failed above and takes the same cure: emit a
+			// durable event so a surface can answer "is signing failing" without
+			// somebody attempting a signature.
+			//
+			// Fire-and-forget and last: telemetry may never change what the signer
+			// is served, and this path is already handling a failure
+			// (observability-is-passive). The agreement id and the signer role
+			// make a recorded event lead to the specific failure.
+			recordEvent({
+				kind: "agreement.sign.failed",
+				payload: {
+					agreementId,
+					error: detail.slice(0, 500),
+					errorName: err instanceof Error ? err.name : "unknown",
+				},
+			});
 			return { ok: false as const, error: "Could not submit your signature." };
 		}
 	}),