[yacinekahlerras-turbodocx]

Closes #220

What was wrong (all five claims confirmed on develop)

1. java.md pinned 0.7.0 in Maven, Gradle Kotlin and Gradle Groovy. The published version is 0.8.0.
2. php.md read config from $_ENV, which is empty on a stock php.ini (variables_order = "GPCS"), so configure throws on missing credentials.
3. "readonly classes" is a PHP 8.2 feature, but the SDK requires ^8.1. The SDK actually uses readonly properties (8.1) and never readonly class.
4. The javascript.md .env example left out TURBODOCX_SENDER_EMAIL, which TurboSign requires.
5. turbosign.md never showed sendEmail: false + createSigningUrl in any language tab.

Fix

• Java pins 0.7.0 -> 0.8.0 on every SDK page: java.md, turbosign.md, index.md, deliverable.md, quote.md, webhooks.md, partner-java.md. The new Java tab needs 0.8.0.
• $_ENV[...] -> getenv(...) ?: null for nullable config arguments, so an unset variable is null, not false, under declare(strict_types=1). PartnerClientConfig and TurboWebhooks::configureFromCredentials() take non-nullable strings, so those use getenv(...) ?: '' instead (matching fromEnvironment()), which turns an unset variable into the SDK's own clear AuthenticationException. The webhook receiver's secret uses ?: '' too, so an unset secret fails closed with a 401. The webhook PHP verification sample (static/scripts/webhooks/verification/php.php) reads getenv('WEBHOOK_SECRET') too. Besides php.md, the same bug was on turbosign, deliverable, webhooks, partner-php, quote and the SDK index page, so those are fixed too. No snippet under docs/ used $_ENV[...] ?? default; the one in the static webhook sample was rewritten to getenv(...) ?: (that would have needed a different fix, because getenv() returns false, not null).
• "readonly classes" -> "readonly properties" in php.md, turbosign.md, deliverable.md and partner-php.md. The Typed Classes section (anchor #readonly-classes kept, so existing links still work) now matches the real constructors:
  • Field::$required is ?bool = null, where null means required. The page showed bool $required = false, which reads as "optional by default".
  • Recipient now lists phone, externalId and identityVerification.
• javascript.md and the JS tab of the TurboSign page's Environment Variables: .env adds TURBODOCX_SENDER_EMAIL (required) and TURBODOCX_SENDER_NAME (optional).
• turbosign.md: new section Send without emails and sign in your app (#send-without-emails), right after "Prepare for signing". It says the URL is the signer's reusable signing link for passcode / no-verification signers (single-use only for external_idv / override). It has JS, Python, PHP, Go and Java tabs, an info admonition for the Enable identity verification prerequisite (linking to the setup guide), and a pointer to the Embedded Signing guide for framing.

Verification

• Every new tab was run word for word against a local API with the current SDKs. Each one created the document with sendEmail false and printed a real signing URL:
  • JS: compiled with tsc --strict, then run.
  • Python: run.
  • PHP: run.
  • Go: go vet + run.
  • Java: javac + run against the 0.8.0 jar.
• Docusaurus build: passes. It reports 9 broken anchors, all already on develop. Three are on pages this PR edits (deliverable.md, partner-php.md), but they point at anchors that are missing on develop too, and the edited lines don't touch them.
• Browser check of the built site:
  • The new heading renders and each of the 5 tabs shows sendEmail + createSigningUrl.
  • The prerequisite admonition renders, and its link opens "Set Up Your Organization for Embedded Signing".
  • The Java page shows 0.8.0 and no 0.7.0.
  • The JS .env shows TURBODOCX_SENDER_EMAIL=.
  • The PHP page has no $_ENV and no "readonly classes".

🤖 Generated with Claude Code

Update (2026-10-21): rebased on current develop (after #227, which brought the Ruby SDK tabs back), and 6be3463 brings the PR up to the 0.9.0 SDKs, released 2026-10-20:

• Java pins are 0.9.0 on every SDK page (0.9.0 is on Maven Central; it still has sendEmail / createSigningUrl and the constructors the new Java tab uses).
• Send without emails: a Ruby tab (send_signature(..., sendEmail: false) + create_signing_url(document_id, recipient_id:)); one line on what else the opt-out covers (initial CC email, later signers' turn emails, scheduled reminders); result.recipients[0].id without !, since recipients is always present in 0.9.0.
• PHP Typed Classes: Recipient now shows ?int $signingOrder = null and the new ?string $role, as in 0.9.0.
• Go webhook verification: 0.9.0 treats ToleranceSeconds: 0 as the 300s default and rejects every delivery on a negative value, so the old "-1 disables the timestamp check" advice is replaced.

Every snippet in the new section was checked against the 0.9.0 sources for all six SDKs, and the PHP config snippets against each config class's constructor types.

[yacinekahlerras-turbodocx]

Review round 1: what was found and fixed

An independent review compiled or ran each new language tab against the current SDKs and compared the Typed Classes section with the real constructors. It also probed the getenv() change under strict_types, rebuilt the site and checked the links. Fixes are in 954c92f.

Found and fixed

1. The new Java tab wouldn't compile with the version pinned higher up on the same page. turbosign.md (and index, deliverable, quote, webhooks, partner-java) still pinned 0.7.0, which has no sendEmail / createSigningUrl. Every Java pin on the SDK pages is now 0.8.0.
2. "Single-use" was wrong for the example's signer. For a passcode or no-verification signer, createSigningUrl returns the reusable signing link, valid for the life of the document. Only external_idv / override links are single-use (about five minutes). The section and all five tab comments are corrected, and the section says to treat the link like a password.
3. The JS .env on the TurboSign page also lacked TURBODOCX_SENDER_EMAIL. Added, along with TURBODOCX_SENDER_NAME.
4. getenv() returns false for an unset variable, so under declare(strict_types=1) an unset optional senderName threw a TypeError. Nullable config arguments now use getenv(...) ?: null. I ran the PHP snippet under strict_types with TURBODOCX_SENDER_NAME unset: it configures and works. PartnerClientConfig takes non-nullable strings, so the partner page keeps a bare getenv().
5. "Readonly classes" was still on the Deliverable and Partner PHP pages. Fixed.
6. The webhook PHP verification sample (rendered on the Webhooks page) used $_ENV['WEBHOOK_SECRET'] ?? '...', which always falls back to the placeholder on stock PHP. It now uses getenv().
7. The PR description said none of the 9 pre-existing broken anchors were on edited pages. Three are on deliverable.md and partner-php.md. All 9 also exist on develop, and the edited lines don't touch them. The description is corrected.

Confirmed correct

• All five new tabs:
  • JS: tsc --strict.
  • Go: go vet / go build.
  • Java: javac against the 0.8.0 jar.
  • Python: keyword arguments and dict returns.
  • PHP: lint and constructors under strict_types.
• Typed Classes now matches Recipient, Field (?bool $required = null), FieldMetadata and FieldConditional exactly.
• The prerequisite wording matches the setup guide, and both new links resolve.
• No $_ENV remains under docs/, and no snippet relied on ?? default.

Re-verified after the fix

The build passes with the same 9 pre-existing broken anchors, and the TurboSign page has no 0.7.0 left.

🤖 Generated with Claude Code

[yacinekahlerras-turbodocx]

Review round 2: what was found and fixed

A second independent review ran all five new tabs word for word against the API, and confirmed:

• createSigningUrl twice for the same signer returns the identical reusable URL, while external_idv / override URLs are single-use, as the docs say.

It also ran every PHP config snippet under declare(strict_types=1) with variables set, partly unset, and all unset, and grepped the whole site for the same classes of bug. Fixes are in a44db60.

Found and fixed

1. TurboWebhooks::configureFromCredentials() takes non-nullable strings. Round 1's getenv(...) ?: null made an unset variable throw a TypeError (with or without strict types). It now uses ?: '', matching the SDK's own fromEnvironment(). Re-checked under strict types: unset gives AuthenticationException: API key or access token is required.
2. The partner page's bare getenv() gave a TypeError (bool given) under strict types. It now uses ?: ''. Re-checked: AuthenticationException: Partner API key is required.
3. The webhook receiver's $secret = getenv(...) could pass false into verifyWebhookSignature(string). That is a TypeError (500) under strict types. It now uses ?: '', which fails closed: it returns false, giving a 401.
4. The new PHP tab was missing use TurboDocx\TurboSign;, unlike every other PHP tab on the page. Added.
5. The PR description overstated "no ?? default snippet". It is now scoped to docs/; the static webhook sample did use one and was fixed in round 1.

Confirmed correct

• All five tabs:
  • JS: tsc --strict + run.
  • Python: run.
  • PHP: run under strict types.
  • Go: go vet + run.
  • Java: javac + run on 0.8.0.
• Site-wide checks:
  • no Java pin below 0.8.0
  • no $_ENV
  • no "readonly class"
  • every TurboSign env block has TURBODOCX_SENDER_EMAIL
  • no reusable link called "single-use"
• Typed Classes matches the SDK constructors, and both new links resolve.
• The build passes with the same 9 broken anchors as develop. None of them were added by this PR.

🤖 Generated with Claude Code