boldsign

# Changelog

All notable changes to this project will be documented in this file.

## [0.10.0] - 2026-07-14

### Added
- `Boldsign.FormField` — typed builders for coordinate-placed signer form fields (`signature/2`, `initial/2`, `date_signed/2`, `text_box/2`, `checkbox/2`, plus `build/3`). These emit BoldSign's **`type`** key (not `fieldType`) — a field object sent with `fieldType` is silently ignored and defaults to a signature field, so a date field renders as a second signature, a checkbox as a signature, and so on, with no error. Bounds accept a `%{x:, y:, width:, height:}` map or an `{x, y, width, height}` tuple, in 96-DPI px from the page top-left.

### Notes
- Documented on `Boldsign.TextTag` that definition-based text tags on `document/send` (`useTextTags: true` + `textTagDefinitions`) did not persist a document in live testing — the API returns `201` with a `documentId`, but the document 403s on read, is absent from `document/list`, and consumes no API credit. Prefer `Boldsign.FormField` coordinate placement for `document/send`.

## [0.9.0] - 2026-07-13

### Added
- `Boldsign.TextTag` — typed builders for BoldSign text-tag form-field definitions: `signature/2`, `initial/2`, `date_signed/2`, `text_box/2`, `checkbox/2`, plus `build/3` as an escape hatch for any field `type`. Callers get the correct BoldSign type strings (`"Signature"`, `"DateSigned"`, ...) and sensible default sizes instead of hand-writing the `textTagDefinitions` payload. Place a `{{definition_id}}` placeholder in the document, pass the built definitions as `textTagDefinitions` with `useTextTags: true`, and BoldSign replaces the placeholder with the typed field.

## [0.8.1] - 2026-07-03

### Fixed
- `Boldsign.WebhookPlug` now acknowledges BoldSign's endpoint-verification ping (`X-BoldSign-Event: Verification`) with `200 OK` before signature validation. The ping is sent before any webhook signing secret exists, so it can never carry a valid signature; previously the plug rejected it with 401 and BoldSign's dashboard "Verify" button always failed.

## [0.8.0] - 2026-06-30

### Changed
- Bumped the package version to `0.8.0`.
- Replaced Bypass-backed tests with a small Bandit-backed local test server.
- Multipart uploads now use raw request bodies to avoid creating atoms from dynamic BoldSign form field names.

### Fixed
- Empty multipart list fields now encode as `"[]"` instead of being omitted.
- Multipart field names and filenames now percent-escape `"`, CR, and LF in content disposition headers.
- Webhook signature parsing now handles BoldSign headers with a space after the comma, such as `t=TIMESTAMP, s0=SIGNATURE`.

### Tests
- Added regression coverage for empty list multipart encoding, raw multipart request encoding, multipart content disposition escaping, and spaced webhook signature headers.

## [0.7.0] - 2026-06-28

### Added
- OAuth bearer token support via `Boldsign.new(access_token: ...)`.
- New `Boldsign.Contact`, `Boldsign.ContactGroup`, `Boldsign.CustomField`, and `Boldsign.Plan` modules.
- Additional document endpoints for attachments, audit logs, tags, recipient authentication, recipient changes, expiry updates, prefill updates, team/behalf lists, and draft sending.
- Additional template endpoints for tags, embedded request/create/edit URLs, and embedded merge request URLs.
- `Boldsign.User.update_metadata/2`.

### Changed
- Bumped the package version to `0.7.0`.
- Refreshed the README and LiveBook embedded signing example for the current API surface, current regional endpoints, API-key or OAuth auth, and hosted-PDF usage.
- Expanded request handling so document and template operations can automatically switch between JSON and multipart payloads where the official BoldSign API allows file uploads.
- Updated the default regional base URLs to match the current official BoldSign endpoints, including CA and AU regions.

### Fixed
- Added compatibility with `req` 0.6 by converting multipart form-part names to atoms at the request boundary while preserving the exact BoldSign wire field names.
- Corrected several HTTP verb and query-parameter mismatches in existing document, template, team, user, and identity verification wrappers.
- Aligned identity verification requests with the current official API contract.

### Tests
- Added extensive local HTTP server coverage across client auth, documents, templates, contacts, contact groups, custom fields, users, teams, identity verification, plan APIs, and multipart encoding.
- Added multipart regression coverage for Req-compatible atom part names, including bracketed/dotted BoldSign field names.

## [0.5.2] - 2026-04-12

### Fixed
- Send document requests now stay on JSON by default and only switch to multipart when `files` are actually present.
- Multipart form encoding now follows the official BoldSign SDK pattern for file uploads plus JSON-encoded complex fields such as `signers` and `textTagDefinitions`.

## [0.5.0] - 2026-04-10

### Added
- Initial release with support for BoldSign REST API.
- `Boldsign` module for client configuration.
- `Boldsign.Document` for document management (send, create, list, download, etc.).
- `Boldsign.Template` for template-based operations.
- `Boldsign.User` and `Boldsign.Team` for administrative operations.
- `Boldsign.Brand` for brand management.
- `Boldsign.SenderIdentity` for sender identity management.
- `Boldsign.IdentityVerification` for KYC/identity verification flows.
- `Boldsign.Webhook` with signature verification.
- `Boldsign.WebhookPlug` and `Boldsign.Webhook.Handler` for easy Phoenix integration.
- `Boldsign.File` helper for multipart uploads.
- Livebook example for embedded signing.