@cavuno/board 1.26.0 → 1.28.0

package/dist/server.d.mts

@@ -0,0 +1,111 @@
+import { BoardSdk } from './index.mjs';
+import './jobs-DK5mPBgq.mjs';
+import './salaries-CrJsaZe6.mjs';
+
+/**
+ * Session cookie codec — pure (no framework imports, no node imports) so it
+ * stays hermetically testable and platform-neutral: helpers speak cookie
+ * STRINGS (`Set-Cookie` values / `Cookie` headers), never framework response
+ * objects. The session is the SDK bearer pair plus the access-token expiry;
+ * it lives in ONE httpOnly cookie owned by the host app (the SDK never sees
+ * storage on the server — ADR-0006).
+ */
+interface BoardSession {
+    accessToken: string;
+    refreshToken: string;
+    /** Access-token expiry, epoch ms (from board_auth_session). */
+    expiresAt: number;
+}
+declare const SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
+/**
+ * The session cookie name, optionally board-scoped. One origin can serve
+ * multiple boards (the hosted platform scopes its grant cookie per account
+ * for this reason) — a multi-board host MUST pass its board identifier so
+ * sessions cannot clobber each other; single-board apps omit it.
+ */
+declare function sessionCookieName(board?: string): string;
+declare function serializeSessionCookie(session: BoardSession, options?: {
+    board?: string;
+}): string;
+declare function clearSessionCookie(options?: {
+    board?: string;
+}): string;
+declare function parseSessionCookie(cookieHeader: string | null, options?: {
+    board?: string;
+}): BoardSession | null;
+declare function isExpiringSoon(session: BoardSession, now: number, windowMs?: number): boolean;
+
+declare const BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
+/**
+ * The grant cookie name, optionally board-scoped — hosted scopes its grant
+ * cookie per account (`board_access_<accountId>`) because one app instance
+ * can gate multiple boards. Multi-board hosts MUST pass their board
+ * identifier; single-board apps omit it.
+ */
+declare function grantCookieName(board?: string): string;
+declare function serializeGrantCookie(token: string, options?: {
+    board?: string;
+}): string;
+declare function clearGrantCookie(options?: {
+    board?: string;
+}): string;
+declare function parseGrantCookie(cookieHeader: string | null, options?: {
+    board?: string;
+}): string | null;
+
+/**
+ * Open-redirect guards — pure URL-safety logic (no cookies involved),
+ * transcribed from the hosted board's `validate-redirect-path.ts` and
+ * golden-tested against it input-for-input.
+ */
+/**
+ * Guard a `?redirect=` / `?next=` param: a same-origin absolute path only
+ * ('/', not '//', no scheme), else `defaultPath` — hosted's
+ * `getSafeRedirectPath(path, defaultPath = '/')` shape (the two-arg form is
+ * live on the employer sign-up page, which falls back to
+ * '/account/connect').
+ */
+declare function safeRedirectPath(path: string | undefined | null, defaultPath?: string): string;
+/**
+ * The current page path (from the request `Referer`) for the /password
+ * redirect-back, guarded by `safeRedirectPath`. Pure — the framework-owned
+ * header read happens in the host app's middleware and the value is passed
+ * in here, so this stays platform-neutral.
+ */
+declare function currentPathFromReferer(referer: string | null): string;
+
+/**
+ * Single-flight session refresh — dedupes concurrent refreshes for the same
+ * session WITHIN one process/isolate (the rotation race, ADR-0057 wart #4,
+ * mitigated at the one layer a client library can reach).
+ *
+ * Refresh tokens are single-use: two concurrent refreshes for the same
+ * session burn the pair — the loser 401s and the user is signed out
+ * mid-session. This helper keys an in-flight slot per refreshToken so every
+ * concurrent caller awaits the SAME rotation; sequential calls after settle
+ * start a fresh one.
+ *
+ * Scope honestly stated: the dedupe is PER PROCESS/ISOLATE (an in-memory
+ * map). Two simultaneous requests served by different instances can still
+ * race the token; the proactive `isExpiringSoon` window keeps that rare, it
+ * does not eliminate it. Pair with `storage: 'nostore'` on the shared
+ * server client — `auth.refresh` persists the rotated pair into
+ * `client.storage`, and any persistent shared storage would bleed one
+ * user's tokens into another's requests.
+ *
+ * Returns the rotated `BoardSession` (persist it back to the cookie), or
+ * `null` on a 401 — the token is burned or revoked: clear the cookie and
+ * continue signed out, never retry. Other errors (network, 5xx, 429)
+ * rethrow untouched.
+ *
+ * @example
+ * const refreshSession = createSessionRefresher(board);
+ * // in the session middleware:
+ * if (isExpiringSoon(session, Date.now())) {
+ *   const next = await refreshSession(session);
+ *   setCookie(next ? serializeSessionCookie(next) : clearSessionCookie());
+ * }
+ */
+declare function createSessionRefresher(board: Pick<BoardSdk, 'auth' | 'client'>): (session: BoardSession) => Promise<BoardSession | null>;
+
+export { BOARD_ACCESS_COOKIE_NAME, type BoardSession, SESSION_COOKIE_NAME, clearGrantCookie, clearSessionCookie, createSessionRefresher, currentPathFromReferer, grantCookieName, isExpiringSoon, parseGrantCookie, parseSessionCookie, safeRedirectPath, serializeGrantCookie, serializeSessionCookie, sessionCookieName };

package/dist/server.d.ts

@@ -0,0 +1,111 @@
+import { BoardSdk } from './index.js';
+import './jobs-DK5mPBgq.js';
+import './salaries-CXt6Vkrp.js';
+
+/**
+ * Session cookie codec — pure (no framework imports, no node imports) so it
+ * stays hermetically testable and platform-neutral: helpers speak cookie
+ * STRINGS (`Set-Cookie` values / `Cookie` headers), never framework response
+ * objects. The session is the SDK bearer pair plus the access-token expiry;
+ * it lives in ONE httpOnly cookie owned by the host app (the SDK never sees
+ * storage on the server — ADR-0006).
+ */
+interface BoardSession {
+    accessToken: string;
+    refreshToken: string;
+    /** Access-token expiry, epoch ms (from board_auth_session). */
+    expiresAt: number;
+}
+declare const SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
+/**
+ * The session cookie name, optionally board-scoped. One origin can serve
+ * multiple boards (the hosted platform scopes its grant cookie per account
+ * for this reason) — a multi-board host MUST pass its board identifier so
+ * sessions cannot clobber each other; single-board apps omit it.
+ */
+declare function sessionCookieName(board?: string): string;
+declare function serializeSessionCookie(session: BoardSession, options?: {
+    board?: string;
+}): string;
+declare function clearSessionCookie(options?: {
+    board?: string;
+}): string;
+declare function parseSessionCookie(cookieHeader: string | null, options?: {
+    board?: string;
+}): BoardSession | null;
+declare function isExpiringSoon(session: BoardSession, now: number, windowMs?: number): boolean;
+
+declare const BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
+/**
+ * The grant cookie name, optionally board-scoped — hosted scopes its grant
+ * cookie per account (`board_access_<accountId>`) because one app instance
+ * can gate multiple boards. Multi-board hosts MUST pass their board
+ * identifier; single-board apps omit it.
+ */
+declare function grantCookieName(board?: string): string;
+declare function serializeGrantCookie(token: string, options?: {
+    board?: string;
+}): string;
+declare function clearGrantCookie(options?: {
+    board?: string;
+}): string;
+declare function parseGrantCookie(cookieHeader: string | null, options?: {
+    board?: string;
+}): string | null;
+
+/**
+ * Open-redirect guards — pure URL-safety logic (no cookies involved),
+ * transcribed from the hosted board's `validate-redirect-path.ts` and
+ * golden-tested against it input-for-input.
+ */
+/**
+ * Guard a `?redirect=` / `?next=` param: a same-origin absolute path only
+ * ('/', not '//', no scheme), else `defaultPath` — hosted's
+ * `getSafeRedirectPath(path, defaultPath = '/')` shape (the two-arg form is
+ * live on the employer sign-up page, which falls back to
+ * '/account/connect').
+ */
+declare function safeRedirectPath(path: string | undefined | null, defaultPath?: string): string;
+/**
+ * The current page path (from the request `Referer`) for the /password
+ * redirect-back, guarded by `safeRedirectPath`. Pure — the framework-owned
+ * header read happens in the host app's middleware and the value is passed
+ * in here, so this stays platform-neutral.
+ */
+declare function currentPathFromReferer(referer: string | null): string;
+
+/**
+ * Single-flight session refresh — dedupes concurrent refreshes for the same
+ * session WITHIN one process/isolate (the rotation race, ADR-0057 wart #4,
+ * mitigated at the one layer a client library can reach).
+ *
+ * Refresh tokens are single-use: two concurrent refreshes for the same
+ * session burn the pair — the loser 401s and the user is signed out
+ * mid-session. This helper keys an in-flight slot per refreshToken so every
+ * concurrent caller awaits the SAME rotation; sequential calls after settle
+ * start a fresh one.
+ *
+ * Scope honestly stated: the dedupe is PER PROCESS/ISOLATE (an in-memory
+ * map). Two simultaneous requests served by different instances can still
+ * race the token; the proactive `isExpiringSoon` window keeps that rare, it
+ * does not eliminate it. Pair with `storage: 'nostore'` on the shared
+ * server client — `auth.refresh` persists the rotated pair into
+ * `client.storage`, and any persistent shared storage would bleed one
+ * user's tokens into another's requests.
+ *
+ * Returns the rotated `BoardSession` (persist it back to the cookie), or
+ * `null` on a 401 — the token is burned or revoked: clear the cookie and
+ * continue signed out, never retry. Other errors (network, 5xx, 429)
+ * rethrow untouched.
+ *
+ * @example
+ * const refreshSession = createSessionRefresher(board);
+ * // in the session middleware:
+ * if (isExpiringSoon(session, Date.now())) {
+ *   const next = await refreshSession(session);
+ *   setCookie(next ? serializeSessionCookie(next) : clearSessionCookie());
+ * }
+ */
+declare function createSessionRefresher(board: Pick<BoardSdk, 'auth' | 'client'>): (session: BoardSession) => Promise<BoardSession | null>;
+
+export { BOARD_ACCESS_COOKIE_NAME, type BoardSession, SESSION_COOKIE_NAME, clearGrantCookie, clearSessionCookie, createSessionRefresher, currentPathFromReferer, grantCookieName, isExpiringSoon, parseGrantCookie, parseSessionCookie, safeRedirectPath, serializeGrantCookie, serializeSessionCookie, sessionCookieName };

package/dist/server.js

@@ -0,0 +1,199 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server/index.ts
+var server_exports = {};
+__export(server_exports, {
+  BOARD_ACCESS_COOKIE_NAME: () => BOARD_ACCESS_COOKIE_NAME,
+  SESSION_COOKIE_NAME: () => SESSION_COOKIE_NAME,
+  clearGrantCookie: () => clearGrantCookie,
+  clearSessionCookie: () => clearSessionCookie,
+  createSessionRefresher: () => createSessionRefresher,
+  currentPathFromReferer: () => currentPathFromReferer,
+  grantCookieName: () => grantCookieName,
+  isExpiringSoon: () => isExpiringSoon,
+  parseGrantCookie: () => parseGrantCookie,
+  parseSessionCookie: () => parseSessionCookie,
+  safeRedirectPath: () => safeRedirectPath,
+  serializeGrantCookie: () => serializeGrantCookie,
+  serializeSessionCookie: () => serializeSessionCookie,
+  sessionCookieName: () => sessionCookieName
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/server/cookie.ts
+var COOKIE_ATTRIBUTES = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function buildCookie(name, value, maxAgeSeconds) {
+  return `${name}=${value}; Max-Age=${maxAgeSeconds}; ${COOKIE_ATTRIBUTES}`;
+}
+function buildClearCookie(name) {
+  return `${name}=; Max-Age=0; ${COOKIE_ATTRIBUTES}`;
+}
+function readCookie(header, name) {
+  if (!header) return null;
+  const pair = header.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`));
+  if (!pair) return null;
+  const raw = pair.slice(name.length + 1);
+  if (!raw) return null;
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return null;
+  }
+}
+function cookieScope(board) {
+  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+
+// src/server/session.ts
+var SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
+function sessionCookieName(board) {
+  return board ? `${SESSION_COOKIE_NAME}_${cookieScope(board)}` : SESSION_COOKIE_NAME;
+}
+var COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var EXPIRY_WINDOW_MS = 5 * 60 * 1e3;
+function serializeSessionCookie(session, options) {
+  return buildCookie(
+    sessionCookieName(options?.board),
+    encodeURIComponent(JSON.stringify(session)),
+    COOKIE_MAX_AGE_SECONDS
+  );
+}
+function clearSessionCookie(options) {
+  return buildClearCookie(sessionCookieName(options?.board));
+}
+function parseSessionCookie(cookieHeader, options) {
+  const raw = readCookie(cookieHeader, sessionCookieName(options?.board));
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const session = parsed;
+  if (!session || typeof session.accessToken !== "string" || typeof session.refreshToken !== "string" || typeof session.expiresAt !== "number") {
+    return null;
+  }
+  return {
+    accessToken: session.accessToken,
+    refreshToken: session.refreshToken,
+    expiresAt: session.expiresAt
+  };
+}
+function isExpiringSoon(session, now, windowMs = EXPIRY_WINDOW_MS) {
+  return session.expiresAt - now < windowMs;
+}
+
+// src/server/board-access.ts
+var BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
+function grantCookieName(board) {
+  return board ? `${BOARD_ACCESS_COOKIE_NAME}_${cookieScope(board)}` : BOARD_ACCESS_COOKIE_NAME;
+}
+var COOKIE_MAX_AGE_SECONDS2 = 24 * 60 * 60;
+function serializeGrantCookie(token, options) {
+  return buildCookie(
+    grantCookieName(options?.board),
+    encodeURIComponent(token),
+    COOKIE_MAX_AGE_SECONDS2
+  );
+}
+function clearGrantCookie(options) {
+  return buildClearCookie(grantCookieName(options?.board));
+}
+function parseGrantCookie(cookieHeader, options) {
+  return readCookie(cookieHeader, grantCookieName(options?.board));
+}
+
+// src/server/redirect-guard.ts
+function safeRedirectPath(path, defaultPath = "/") {
+  if (!path || !path.startsWith("/") || path.startsWith("//")) {
+    return defaultPath;
+  }
+  if (path.includes("://")) return defaultPath;
+  try {
+    const SENTINEL_ORIGIN = "https://redirect.invalid";
+    if (new URL(path, SENTINEL_ORIGIN).origin !== SENTINEL_ORIGIN) {
+      return defaultPath;
+    }
+  } catch {
+    return defaultPath;
+  }
+  return path;
+}
+function currentPathFromReferer(referer) {
+  if (!referer) return "/";
+  try {
+    const url = new URL(referer);
+    return safeRedirectPath(url.pathname + url.search);
+  } catch {
+    return "/";
+  }
+}
+
+// src/errors.ts
+function isBoardApiError(e) {
+  return e instanceof Error && e.name === "BoardApiError";
+}
+function isUnauthorized(e) {
+  return isBoardApiError(e) && e.status === 401;
+}
+
+// src/storage.ts
+var NOSTORE_BRAND = /* @__PURE__ */ Symbol.for("@cavuno/board:nostore");
+function isNoStore(storage) {
+  return storage[NOSTORE_BRAND] === true;
+}
+var NOSTORE = {
+  [NOSTORE_BRAND]: true,
+  getItem: () => null,
+  setItem: () => {
+  },
+  removeItem: () => {
+  }
+};
+
+// src/server/refresher.ts
+function createSessionRefresher(board) {
+  if (typeof globalThis.document === "undefined" && !isNoStore(board.client.storage)) {
+    throw new Error(
+      "createSessionRefresher requires the server client to use storage: 'nostore' \u2014 a shared persistent store would leak rotated tokens across requests. Keep the session in the httpOnly cookie and pass tokens per call."
+    );
+  }
+  const inflight = /* @__PURE__ */ new Map();
+  return async function refresh(session) {
+    const key = session.refreshToken;
+    const existing = inflight.get(key);
+    if (existing) return existing;
+    const attempt = board.auth.refresh({ refreshToken: key }).then(
+      (rotated) => ({
+        accessToken: rotated.accessToken,
+        refreshToken: rotated.refreshToken,
+        expiresAt: rotated.expiresAt
+      })
+    ).catch((error) => {
+      if (isUnauthorized(error)) return null;
+      throw error;
+    }).finally(() => {
+      inflight.delete(key);
+    });
+    inflight.set(key, attempt);
+    return attempt;
+  };
+}

package/dist/server.mjs

@@ -0,0 +1,176 @@
+// src/server/cookie.ts
+var COOKIE_ATTRIBUTES = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function buildCookie(name, value, maxAgeSeconds) {
+  return `${name}=${value}; Max-Age=${maxAgeSeconds}; ${COOKIE_ATTRIBUTES}`;
+}
+function buildClearCookie(name) {
+  return `${name}=; Max-Age=0; ${COOKIE_ATTRIBUTES}`;
+}
+function readCookie(header, name) {
+  if (!header) return null;
+  const pair = header.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`));
+  if (!pair) return null;
+  const raw = pair.slice(name.length + 1);
+  if (!raw) return null;
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return null;
+  }
+}
+function cookieScope(board) {
+  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+
+// src/server/session.ts
+var SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
+function sessionCookieName(board) {
+  return board ? `${SESSION_COOKIE_NAME}_${cookieScope(board)}` : SESSION_COOKIE_NAME;
+}
+var COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var EXPIRY_WINDOW_MS = 5 * 60 * 1e3;
+function serializeSessionCookie(session, options) {
+  return buildCookie(
+    sessionCookieName(options?.board),
+    encodeURIComponent(JSON.stringify(session)),
+    COOKIE_MAX_AGE_SECONDS
+  );
+}
+function clearSessionCookie(options) {
+  return buildClearCookie(sessionCookieName(options?.board));
+}
+function parseSessionCookie(cookieHeader, options) {
+  const raw = readCookie(cookieHeader, sessionCookieName(options?.board));
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const session = parsed;
+  if (!session || typeof session.accessToken !== "string" || typeof session.refreshToken !== "string" || typeof session.expiresAt !== "number") {
+    return null;
+  }
+  return {
+    accessToken: session.accessToken,
+    refreshToken: session.refreshToken,
+    expiresAt: session.expiresAt
+  };
+}
+function isExpiringSoon(session, now, windowMs = EXPIRY_WINDOW_MS) {
+  return session.expiresAt - now < windowMs;
+}
+
+// src/server/board-access.ts
+var BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
+function grantCookieName(board) {
+  return board ? `${BOARD_ACCESS_COOKIE_NAME}_${cookieScope(board)}` : BOARD_ACCESS_COOKIE_NAME;
+}
+var COOKIE_MAX_AGE_SECONDS2 = 24 * 60 * 60;
+function serializeGrantCookie(token, options) {
+  return buildCookie(
+    grantCookieName(options?.board),
+    encodeURIComponent(token),
+    COOKIE_MAX_AGE_SECONDS2
+  );
+}
+function clearGrantCookie(options) {
+  return buildClearCookie(grantCookieName(options?.board));
+}
+function parseGrantCookie(cookieHeader, options) {
+  return readCookie(cookieHeader, grantCookieName(options?.board));
+}
+
+// src/server/redirect-guard.ts
+function safeRedirectPath(path, defaultPath = "/") {
+  if (!path || !path.startsWith("/") || path.startsWith("//")) {
+    return defaultPath;
+  }
+  if (path.includes("://")) return defaultPath;
+  try {
+    const SENTINEL_ORIGIN = "https://redirect.invalid";
+    if (new URL(path, SENTINEL_ORIGIN).origin !== SENTINEL_ORIGIN) {
+      return defaultPath;
+    }
+  } catch {
+    return defaultPath;
+  }
+  return path;
+}
+function currentPathFromReferer(referer) {
+  if (!referer) return "/";
+  try {
+    const url = new URL(referer);
+    return safeRedirectPath(url.pathname + url.search);
+  } catch {
+    return "/";
+  }
+}
+
+// src/errors.ts
+function isBoardApiError(e) {
+  return e instanceof Error && e.name === "BoardApiError";
+}
+function isUnauthorized(e) {
+  return isBoardApiError(e) && e.status === 401;
+}
+
+// src/storage.ts
+var NOSTORE_BRAND = /* @__PURE__ */ Symbol.for("@cavuno/board:nostore");
+function isNoStore(storage) {
+  return storage[NOSTORE_BRAND] === true;
+}
+var NOSTORE = {
+  [NOSTORE_BRAND]: true,
+  getItem: () => null,
+  setItem: () => {
+  },
+  removeItem: () => {
+  }
+};
+
+// src/server/refresher.ts
+function createSessionRefresher(board) {
+  if (typeof globalThis.document === "undefined" && !isNoStore(board.client.storage)) {
+    throw new Error(
+      "createSessionRefresher requires the server client to use storage: 'nostore' \u2014 a shared persistent store would leak rotated tokens across requests. Keep the session in the httpOnly cookie and pass tokens per call."
+    );
+  }
+  const inflight = /* @__PURE__ */ new Map();
+  return async function refresh(session) {
+    const key = session.refreshToken;
+    const existing = inflight.get(key);
+    if (existing) return existing;
+    const attempt = board.auth.refresh({ refreshToken: key }).then(
+      (rotated) => ({
+        accessToken: rotated.accessToken,
+        refreshToken: rotated.refreshToken,
+        expiresAt: rotated.expiresAt
+      })
+    ).catch((error) => {
+      if (isUnauthorized(error)) return null;
+      throw error;
+    }).finally(() => {
+      inflight.delete(key);
+    });
+    inflight.set(key, attempt);
+    return attempt;
+  };
+}
+export {
+  BOARD_ACCESS_COOKIE_NAME,
+  SESSION_COOKIE_NAME,
+  clearGrantCookie,
+  clearSessionCookie,
+  createSessionRefresher,
+  currentPathFromReferer,
+  grantCookieName,
+  isExpiringSoon,
+  parseGrantCookie,
+  parseSessionCookie,
+  safeRedirectPath,
+  serializeGrantCookie,
+  serializeSessionCookie,
+  sessionCookieName
+};

package/dist/sitemap.d.mts

@@ -0,0 +1,63 @@
+import { BoardSdk } from './index.mjs';
+import './jobs-DK5mPBgq.mjs';
+import './salaries-CrJsaZe6.mjs';
+
+/**
+ * Sitemap primitives — the pure XML + bucket-filename logic behind a board
+ * frontend's `/sitemap.xml` index and `/sitemap/:file` bucket routes.
+ * Mirrors the hosted board's 8-bucket model (`board-sitemap.loader.ts`): a
+ * sitemap index points at one file per content bucket, each an ordinary
+ * `<urlset>`.
+ *
+ * The XML byte layout transcribes the hosted serializers
+ * (`sitemap-xml.utils.ts` — `serializeBoardSitemap` /
+ * `serializeBoardSitemapIndex`) and is golden-tested byte-equal against
+ * them in-monorepo. `changefreq`/`priority` are deliberately not supported:
+ * the hosted builders never emit them.
+ *
+ * Network enumeration lives in `walker.ts`; this module is pure so the
+ * chunking + filename round-trip is unit-tested without a board.
+ */
+declare const SITEMAP_BUCKETS: readonly ["marketing", "jobs-categories", "jobs-skills", "jobs-locations", "jobs-details", "companies", "salaries", "blog"];
+type SitemapBucket = (typeof SITEMAP_BUCKETS)[number];
+/** Matches the hosted chunk size so the two corpora line up bucket-for-bucket. */
+declare const SITEMAP_CHUNK_SIZE = 45000;
+declare function xmlEscape(value: string): string;
+/**
+ * Chunk 0 (or no chunk) → the bare bucket filename; chunks 1+ append `-2`,
+ * `-3`, … so the common single-chunk case has the cleanest URL. The scheme
+ * is the filename component of the hosted `getBoardSitemapBucketPath`.
+ */
+declare function bucketFilename(bucket: SitemapBucket, chunkIndex?: number): string;
+/** Inverse of `bucketFilename`; returns null for unknown buckets / non-xml. */
+declare function parseBucketFilename(filename: string): {
+    bucket: SitemapBucket;
+    chunkIndex: number;
+} | null;
+declare function chunk<T>(items: readonly T[], size: number): T[][];
+/**
+ * One `<url>` entry. A bare string is shorthand for `{ url }` — the walker
+ * emits plain URL strings; hosted-shaped entries carry `lastModified` (and
+ * `images` on job-detail entries: the company logo).
+ */
+interface SitemapUrlEntry {
+    url: string;
+    /** A `Date` serializes to ISO 8601; a string passes through as-is. */
+    lastModified?: Date | string;
+    /** Google image-sitemap extension URLs (adds the `xmlns:image` namespace). */
+    images?: readonly string[];
+}
+interface SitemapIndexEntry {
+    url: string;
+    lastModified?: Date | string;
+}
+declare function renderUrlset(entries: readonly (string | SitemapUrlEntry)[]): string;
+declare function renderSitemapIndex(entries: readonly (string | SitemapIndexEntry)[]): string;
+
+/** Matches the hosted thin-content floor: a listing page needs ≥5 jobs to index. */
+declare const MIN_JOBS_PER_INDEXED_PAGE = 5;
+/** Which buckets the index lists. Blog is gated by its feature; the rest emit an empty urlset when a board lacks that content (valid, just zero URLs). */
+declare function listedBuckets(board: BoardSdk): Promise<SitemapBucket[]>;
+declare function buildBucketUrls(board: BoardSdk, origin: string, bucket: SitemapBucket): Promise<string[]>;
+
+export { MIN_JOBS_PER_INDEXED_PAGE, SITEMAP_BUCKETS, SITEMAP_CHUNK_SIZE, type SitemapBucket, type SitemapIndexEntry, type SitemapUrlEntry, bucketFilename, buildBucketUrls, chunk, listedBuckets, parseBucketFilename, renderSitemapIndex, renderUrlset, xmlEscape };