[github-actions]

🤖 Merging this PR tags the version below, creates the GitHub Release with these notes, and publishes the four packages under latest.

0.4.0 (2026-09-10)

The production release of the backend: one library for hosts that mint in-process, one
service that runs from environment alone as a function or a container, and a runbook by
role. Migration notes: docs/upgrading.md; operations:
docs/operations/production.md.

⚠ Breaking changes

• Package rename: @blinkbitcoin/esign-server is now @blinkbitcoin/esign-node
  (packages/esign-node), platform-named like esign-react / esign-react-native.
  No aliases: update every import, including the /docusign, /express and /knex
  subpaths. (#83, 97e55a3)
• The service is a package and its image is renamed: examples/full-service-demo
  is now packages/esign-service (@blinkbitcoin/esign-service, published); the image
  ghcr.io/blinkbitcoin/esign-api is now ghcr.io/blinkbitcoin/esign-service. (#83)
• The service is no longer an Express app. createApp() is gone; the entry points
  are createESignApp(env, deps) (Fetch) and startServer(env) on
  @blinkbitcoin/esign-service/node. The container command is node dist/node.js,
  migrations are node dist/node.js migrate (was dist/migrate.js). express,
  helmet, cors and express-rate-limit are no longer dependencies. (#86, 302ab25)
• ESIGN_ENV=production replaces NODE_ENV=production as the production switch
  (GraphQL introspection off; demo DocuSign hosts and the mock provider refused unless
  ESIGN_ALLOW_DEMO=true; a client's own prefill refused unless
  ESIGN_ALLOW_CLIENT_PREFILL=true). The image sets ESIGN_ENV=production itself; a
  non-container deployment that relied on NODE_ENV must set it. (#84, #86)
• Boot checks moved earlier and changed shape: DOCUSIGN_HMAC_KEY and
  DOCUSIGN_TEMPLATE_ID are required only when envelope orchestration is on; a mint
  requires DOCUSIGN_WEBFORM_ID and DOCUSIGN_RETURN_URL at provider selection;
  validateSecurityConfig() is validateConfig(env, { runtime }). (#84, #86)

Features

• node: production guard (ESIGN_ENV, ESIGN_ALLOW_DEMO), hosted-form boot checks
  (HOSTED_FORM_SETTINGS, incl. the return URL that used to fail silently), private key
  from DOCUSIGN_PRIVATE_KEY_BASE64 / DOCUSIGN_PRIVATE_KEY_FILE,
  hostedFormProviderFromEnv, and two presets that serve the mint, the return-URL
  bridge and /health: createHostedFormRouter (Express) and createHostedFormApp
  (Fetch), with a prefill hook so the host computes locked terms from its own data;
  a hook rejects with Errors.validationError → 400. (#84, e621645)
• service: one deployable for the mint and the full envelope orchestration,
  capability by environment: the mint is always on, DATABASE_URL adds /graphql,
  POST /webhook/esign and the Knex store. Entries for Node (the image, in-memory rate
  limits, TRUST_PROXY), Vercel and Cloudflare Workers (mint only). Session
  verification via SESSION_JWKS_URL or SESSION_HS256_SECRET (JWT_SECRET stays an
  alias). Locked terms via a TERMS_URL callback (TERMS_SHARED_SECRET,
  TERMS_TIMEOUT_MS; plaintext refused in production unless private or
  TERMS_ALLOW_INSECURE=true). Deploy templates for Compose, Kubernetes, Vercel,
  Cloudflare and NixOS ship in the package; /health reports the capabilities that
  are on. (#86, 302ab25)
• demo: the mint-only demo builds, ships a Dockerfile and uses the hosted-form router (#85) (aad60ca)

Documentation

• The production runbook by role (DocuSign go-live, backend, DevOps, mobile, verification,
  failure modes), a "who are you" router and a backend-options table in the README, and
  the architecture docs and diagrams redrawn for the two tiers. (#87, 0ecf631)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v0.4.0

🌻