- Shipped
- August 6, 2026 at 6:36 PM UTC
- Author
- kamo
- Commit
- b6e9c88
Eight 1:1 routes: /api/docs/legal/member/** through forwardToApi (PATH ONLY — forwardToApi owns the query string) and /api/esig/member/** direct to ESIG_SERVICE_URL with generateOTK, because APIService forwards /api/docs/** and nothing forwards /api/esig/**. One OTK, one upstream request per route: OTKAuthFilter does getAndDelete. The PDF routes stream bytes and preserve the upstream status, so a 409 (the frozen content digest no longer matches the stored bytes) reaches the wizard as a 409 rather than as a corrupt PDF. Consent is the one route that must not parse its success body: ESigService answers it with an empty 200. Every wizard rule lives in a pure module because vitest here collects only .test.ts in the node environment. A signable document renders from the esign route — those are the bytes ESigService flattens, and what you see must be what you sign; an acknowledge-only document renders from DocsService's version-pinned route. The step axis is orderIndex order and the attestation step exists even for a package with zero documents to sign.