Trigger.dev v3 + Signbee: Long-Running AI Contract Generation & Signing Tasks (2026)

import { task, wait, retry, logger, AbortTaskRunError } from "@trigger.dev/sdk/v3";
import crypto from "crypto";

export interface ContractTaskPayload {
  dealId: string;
  customerLegalName: string;
  customerSignerName: string;
  customerSignerEmail: string;
  accountOwnerName: string;
  accountOwnerEmail: string;
  annualValueUsd: number;
  customSecurityClauses: string[];
  dataResidencyRegion: "US-EAST" | "EU-FRANKFURT" | "UK-LONDON";
}

export interface SignbeeSignedTokenPayload {
  document_id: string;
  title: string;
  status: "signed";
  recipient_name: string;
  recipient_email: string;
  signed_at: string;
  sha256_hash: string;
  signed_pdf_url: string;
  verify_url: string;
}

export const generateAndSignEnterpriseContract = task({
  id: "generate-and-sign-enterprise-contract",
  retry: {
    maxAttempts: 3,
    factor: 2,
    minTimeoutInMs: 2000,
    maxTimeoutInMs: 30000,
  },
  run: async (payload: ContractTaskPayload) => {
    logger.info("Starting AI enterprise contract synthesis", { dealId: payload.dealId });

    // Phase 1: Synthesize multi-schedule CommonMark contract (can run 45-90s safely)
    const effectiveDate = new Date().toISOString().split("T")[0];
    const customClausesMarkdown = payload.customSecurityClauses
      .map((clause, index) => `### 3.${index + 1} Negotiated Security Rider\n${clause}`)
      .join("\n\n");

    const draftedMarkdown = [
      `# Master Enterprise Subscription Agreement`,
      ``,
      `**Effective Date:** ${effectiveDate}  `,
      `**Provider:** Acme Autonomous Systems Ltd.  `,
      `**Customer:** ${payload.customerLegalName}  `,
      `**Data Residency Zone:** ${payload.dataResidencyRegion}`,
      ``,
      `## 1. Commercial Order Schedule`,
      `| Line Item | Provisioned Scope | Annual Fee (USD) |`,
      `|---|---|---|`,
      `| Enterprise Core Platform | Unlimited Autonomous Workflows | $${payload.annualValueUsd.toLocaleString()} |`,
      `| Regional Data Isolation | Dedicated ${payload.dataResidencyRegion} KMS Vault | Included |`,
      `| Cryptographic E-Sign Audit | SHA-256 Tamper-Evident Sealing | Included |`,
      ``,
      `## 2. Governing Law & Payment Terms`,
      `Fees are invoiced annually in advance and payable within thirty (30) calendar days. Late balances accrue interest at 1.0% per month.`,
      ``,
      `## 3. Custom Security & Compliance Schedules`,
      customClausesMarkdown,
    ].join("\n");

    // Phase 2: Create a durable Trigger.dev Waitpoint Token (valid for 14 days)
    const signingWaitToken = await wait.createToken({
      timeout: "14d",
      idempotencyKey: `signbee-wait-${payload.dealId}`,
      tags: [`deal:${payload.dealId}`, `region:${payload.dataResidencyRegion}`],
    });

    // Phase 3: Dispatch contract via Signbee REST API with isolated retry block
    const dispatchResult = await retry.onThrow(
      async () => {
        const webhookUrl = new URL("/api/webhooks/signbee-trigger", process.env.NEXT_PUBLIC_APP_URL);
        webhookUrl.searchParams.set("tokenId", signingWaitToken.id);
        webhookUrl.searchParams.set("dealId", payload.dealId);

        const response = await fetch("https://signb.ee/api/v1/send", {
          method: "POST",
          headers: {
            "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
            "Content-Type": "application/json",
          },
          body: JSON.stringify({
            title: `Enterprise MSA — ${payload.customerLegalName} (${effectiveDate})`,
            markdown: draftedMarkdown,
            sender_name: payload.accountOwnerName,
            sender_email: payload.accountOwnerEmail,
            recipient_name: payload.customerSignerName,
            recipient_email: payload.customerSignerEmail,
            expires_in_days: 14,
            webhook_url: webhookUrl.toString(),
          }),
        });

        if (response.status === 401 || response.status === 422) {
          const text = await response.text();
          throw new AbortTaskRunError(`Permanent Signbee validation error (${response.status}): ${text}`);
        }

        if (!response.ok) {
          throw new Error(`Signbee API HTTP ${response.status}`);
        }

        return (await response.json()) as {
          id: string;
          status: string;
          signing_url: string;
          verify_url: string;
        };
      },
      { maxAttempts: 4 }
    );

    logger.info("Contract dispatched via Signbee; freezing container until signed", {
      documentId: dispatchResult.id,
      waitTokenId: signingWaitToken.id,
    });

    // Phase 4: Freeze task execution (CRIU checkpoint, $0 compute while waiting)
    const waitResult = await wait.forToken<SignbeeSignedTokenPayload>(signingWaitToken.id);

    if (!waitResult.ok) {
      logger.warn("Counterparty did not sign within 14-day window", {
        dealId: payload.dealId,
        documentId: dispatchResult.id,
      });
      return {
        status: "EXPIRED",
        dealId: payload.dealId,
        documentId: dispatchResult.id,
      };
    }

    const signedData = waitResult.output;

    // Phase 5: Download executed PDF, verify SHA-256 integrity, and archive
    const integrityCheck = await retry.onThrow(
      async () => {
        const pdfResponse = await fetch(signedData.signed_pdf_url);
        if (!pdfResponse.ok) {
          throw new Error(`Failed to download signed PDF: HTTP ${pdfResponse.status}`);
        }
        const pdfBuffer = Buffer.from(await pdfResponse.arrayBuffer());
        const computedSha256 = crypto.createHash("sha256").update(pdfBuffer).digest("hex");

        return {
          byteLength: pdfBuffer.byteLength,
          computedSha256,
          reportedSha256: signedData.sha256_hash,
          verifiedMatch: computedSha256 === signedData.sha256_hash,
        };
      },
      { maxAttempts: 3 }
    );

    return {
      status: "SIGNED_AND_ARCHIVED",
      dealId: payload.dealId,
      documentId: signedData.document_id,
      signedAt: signedData.signed_at,
      verifyUrl: signedData.verify_url,
      integrityCheck,
    };
  },
});

import { NextRequest, NextResponse } from "next/server";
import crypto from "crypto";
import { wait } from "@trigger.dev/sdk/v3";
import type { SignbeeSignedTokenPayload } from "@/trigger/ai-contract-signing";

function isValidSignbeeHmac(rawBody: string, headerSig: string | null, secret: string): boolean {
  if (!headerSig) return false;
  const providedHex = headerSig.replace(/^sha256=/, "");
  const expectedHex = crypto.createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");

  const a = Buffer.from(providedHex, "hex");
  const b = Buffer.from(expectedHex, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

export async function POST(req: NextRequest) {
  const rawBody = await req.text();
  const signature = req.headers.get("x-signbee-signature");
  const secret = process.env.SIGNBEE_WEBHOOK_SECRET;

  if (!secret || !isValidSignbeeHmac(rawBody, signature, secret)) {
    return NextResponse.json({ error: "Unauthorized webhook signature" }, { status: 401 });
  }

  const tokenId = req.nextUrl.searchParams.get("tokenId");
  if (!tokenId) {
    return NextResponse.json({ error: "Missing Trigger.dev waitpoint tokenId" }, { status: 400 });
  }

  const body = JSON.parse(rawBody);

  if (body.event === "document.signed") {
    const signedPayload: SignbeeSignedTokenPayload = {
      document_id: body.data.document_id,
      title: body.data.title,
      status: "signed",
      recipient_name: body.data.recipient_name,
      recipient_email: body.data.recipient_email,
      signed_at: body.data.signed_at,
      sha256_hash: body.data.sha256_hash,
      signed_pdf_url: body.data.signed_pdf_url,
      verify_url: body.data.verify_url,
    };

    // Wake the checkpointed Trigger.dev v3 container immediately
    await wait.completeToken<SignbeeSignedTokenPayload>(tokenId, signedPayload);

    return NextResponse.json({ resumed: true, tokenId }, { status: 200 });
  }

  return NextResponse.json({ ignoredEvent: body.event }, { status: 200 });
}

// Stage A: Internal Legal Ops Approval Gate (48-hour SLA)
const legalReviewToken = await wait.createToken({
  timeout: "48h",
  idempotencyKey: `legal-approval-${payload.dealId}`,
});

// Send Slack interactive approval button or Trigger.dev React public token URL
await notifyLegalOpsSlackChannel({
  dealId: payload.dealId,
  proposedMarkdown: draftedMarkdown,
  approveTokenId: legalReviewToken.id,
});

const legalDecision = await wait.forToken<{
  approved: boolean;
  revisedMarkdown?: string;
  reviewerEmail: string;
}>(legalReviewToken.id);

if (!legalDecision.ok || !legalDecision.output.approved) {
  return { status: "REJECTED_BY_LEGAL_OPS", dealId: payload.dealId };
}

// Use Legal's edited markdown if modified, otherwise use AI draft
const finalApprovedMarkdown = legalDecision.output.revisedMarkdown ?? draftedMarkdown;

// Stage B: External Counterparty Signing Gate via Signbee REST API
const clientSignToken = await wait.createToken({
  timeout: "14d",
  idempotencyKey: `client-sign-${payload.dealId}`,
});