- Shipped
- September 9, 2026 at 10:36 PM UTC
- Author
- Kamo
- Commit
- cbd94e3
`@kamo/esign-core` now carries the consumer disclosure itself — six clauses, every language the product signs in, and `consentDisclosure(locale, brand)` to fill the sender's name in. It was in kamo-signer's dictionary; it belongs here for two reasons. It is shown on TWO surfaces, and a signer following an emailed link must be agreeing to the same words as a member signing the same document from inside the platform. And it is VERSIONED: `CONSENT_DISCLOSURE_VERSION` is written onto the recipient row at consent time and printed on the certificate of completion, so "they accepted the disclosure" names a specific text — which it cannot do if a translation pipeline can revise the words without anyone bumping the version. Changing the wording is therefore a version bump here AND in ESigService's EsignCertificateService. Old certificates keep naming the old version, which is the point of having one. The publish step now accepts either credential the registry takes. NPM_PUBLISH_TOKEN goes out as a bearer token, which is what kamo-js uses and what run 12016 failed for want of — that secret exists on kamo-js and not on this repo. GIT_CLONE_TOKEN, which this repo does have, is a Forgejo user token; the package registry accepts those only as BASIC auth, and answers a bare 401 when one is sent as a bearer, with nothing to say the scheme was the problem. It tries the bearer first, falls back to basic, and proves the credential with `npm whoami` before building anything — so a credential that cannot publish says so instead of failing three steps later inside `pnpm publish`.