@cavuno/board 1.27.0 → 1.28.0

package/dist/index.js

@@ -30,12 +30,15 @@ __export(src_exports, {
   createBoardClient: () => createBoardClient,
   isBoardApiError: () => isBoardApiError,
   isBoardPasswordRequired: () => isBoardPasswordRequired,
+  isColdRule: () => isColdRule,
   isConflict: () => isConflict,
   isForbidden: () => isForbidden,
   isNotFound: () => isNotFound,
+  isOwnMessage: () => isOwnMessage,
   isRateLimited: () => isRateLimited,
   isUnauthorized: () => isUnauthorized,
   isValidationError: () => isValidationError,
+  lastOwnMessageId: () => lastOwnMessageId,
   paginate: () => paginate
 });
 module.exports = __toCommonJS(src_exports);
@@ -176,7 +179,7 @@ var BoardApiError = class extends Error {
   }
 };
 function isBoardApiError(e) {
-  return e instanceof BoardApiError;
+  return e instanceof Error && e.name === "BoardApiError";
 }
 function isNotFound(e) {
   return isBoardApiError(e) && e.status === 404;
@@ -237,14 +240,45 @@ function memoryStorage() {
     }
   };
 }
+function scopeToken(board) {
+  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+function browserStorage(mode, scope) {
+  if (!isBrowser()) {
+    throw new Error(
+      `storage mode '${mode}' is browser-only \u2014 use 'nostore' + per-call headers on the server`
+    );
+  }
+  let backing;
+  try {
+    backing = mode === "local" ? globalThis.localStorage : globalThis.sessionStorage;
+    if (!backing) throw new Error("unavailable");
+  } catch {
+    throw new Error(
+      `storage mode '${mode}' is unavailable in this browsing context (storage access is blocked \u2014 e.g. a sandboxed or third-party iframe). Use 'memory', or 'nostore' + per-call headers.`
+    );
+  }
+  const suffix = scope ? `:${scopeToken(scope)}` : "";
+  return {
+    getItem: (key) => backing.getItem(`${key}${suffix}`),
+    setItem: (key, value) => {
+      backing.setItem(`${key}${suffix}`, value);
+    },
+    removeItem: (key) => {
+      backing.removeItem(`${key}${suffix}`);
+    }
+  };
+}
+var NOSTORE_BRAND = /* @__PURE__ */ Symbol.for("@cavuno/board:nostore");
 var NOSTORE = {
+  [NOSTORE_BRAND]: true,
   getItem: () => null,
   setItem: () => {
   },
   removeItem: () => {
   }
 };
-function resolveStorage(mode) {
+function resolveStorage(mode, scope) {
   const resolved = mode ?? (isBrowser() ? "memory" : "nostore");
   if (typeof resolved === "object") return resolved;
   switch (resolved) {
@@ -252,6 +286,9 @@ function resolveStorage(mode) {
       return memoryStorage();
     case "nostore":
       return NOSTORE;
+    case "local":
+    case "session":
+      return browserStorage(resolved, scope);
     default:
       throw new Error(`Unknown storage mode '${String(resolved)}'`);
   }
@@ -266,7 +303,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.27.0";
+var SDK_VERSION = "1.28.0";
 
 // src/client.ts
 function isRawBody(body) {
@@ -2547,12 +2584,31 @@ function paginate(listFn, query, options) {
   };
 }
 
+// src/messaging-derive.ts
+function isOwnMessage(message, counterpartyId) {
+  return message.authorBoardUserId !== counterpartyId;
+}
+function isColdRule(messages, counterpartyId) {
+  const theyReplied = messages.some(
+    (m) => m.authorBoardUserId === counterpartyId
+  );
+  const iSent = messages.some((m) => m.authorBoardUserId !== counterpartyId);
+  return iSent && !theyReplied;
+}
+function lastOwnMessageId(messages, counterpartyId) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message.authorBoardUserId !== counterpartyId) return message.id;
+  }
+  return null;
+}
+
 // src/index.ts
 function createBoardClient(options) {
   const client = new BoardClient({
     baseUrl: options.baseUrl,
     board: options.board,
-    storage: resolveStorage(options.auth?.storage),
+    storage: resolveStorage(options.auth?.storage, options.board),
     globalHeaders: options.globalHeaders,
     onRequest: options.onRequest,
     onResponse: options.onResponse,

package/dist/index.mjs

@@ -134,7 +134,7 @@ var BoardApiError = class extends Error {
   }
 };
 function isBoardApiError(e) {
-  return e instanceof BoardApiError;
+  return e instanceof Error && e.name === "BoardApiError";
 }
 function isNotFound(e) {
   return isBoardApiError(e) && e.status === 404;
@@ -195,14 +195,45 @@ function memoryStorage() {
     }
   };
 }
+function scopeToken(board) {
+  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+function browserStorage(mode, scope) {
+  if (!isBrowser()) {
+    throw new Error(
+      `storage mode '${mode}' is browser-only \u2014 use 'nostore' + per-call headers on the server`
+    );
+  }
+  let backing;
+  try {
+    backing = mode === "local" ? globalThis.localStorage : globalThis.sessionStorage;
+    if (!backing) throw new Error("unavailable");
+  } catch {
+    throw new Error(
+      `storage mode '${mode}' is unavailable in this browsing context (storage access is blocked \u2014 e.g. a sandboxed or third-party iframe). Use 'memory', or 'nostore' + per-call headers.`
+    );
+  }
+  const suffix = scope ? `:${scopeToken(scope)}` : "";
+  return {
+    getItem: (key) => backing.getItem(`${key}${suffix}`),
+    setItem: (key, value) => {
+      backing.setItem(`${key}${suffix}`, value);
+    },
+    removeItem: (key) => {
+      backing.removeItem(`${key}${suffix}`);
+    }
+  };
+}
+var NOSTORE_BRAND = /* @__PURE__ */ Symbol.for("@cavuno/board:nostore");
 var NOSTORE = {
+  [NOSTORE_BRAND]: true,
   getItem: () => null,
   setItem: () => {
   },
   removeItem: () => {
   }
 };
-function resolveStorage(mode) {
+function resolveStorage(mode, scope) {
   const resolved = mode ?? (isBrowser() ? "memory" : "nostore");
   if (typeof resolved === "object") return resolved;
   switch (resolved) {
@@ -210,6 +241,9 @@ function resolveStorage(mode) {
       return memoryStorage();
     case "nostore":
       return NOSTORE;
+    case "local":
+    case "session":
+      return browserStorage(resolved, scope);
     default:
       throw new Error(`Unknown storage mode '${String(resolved)}'`);
   }
@@ -224,7 +258,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.27.0";
+var SDK_VERSION = "1.28.0";
 
 // src/client.ts
 function isRawBody(body) {
@@ -2505,12 +2539,31 @@ function paginate(listFn, query, options) {
   };
 }
 
+// src/messaging-derive.ts
+function isOwnMessage(message, counterpartyId) {
+  return message.authorBoardUserId !== counterpartyId;
+}
+function isColdRule(messages, counterpartyId) {
+  const theyReplied = messages.some(
+    (m) => m.authorBoardUserId === counterpartyId
+  );
+  const iSent = messages.some((m) => m.authorBoardUserId !== counterpartyId);
+  return iSent && !theyReplied;
+}
+function lastOwnMessageId(messages, counterpartyId) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message.authorBoardUserId !== counterpartyId) return message.id;
+  }
+  return null;
+}
+
 // src/index.ts
 function createBoardClient(options) {
   const client = new BoardClient({
     baseUrl: options.baseUrl,
     board: options.board,
-    storage: resolveStorage(options.auth?.storage),
+    storage: resolveStorage(options.auth?.storage, options.board),
     globalHeaders: options.globalHeaders,
     onRequest: options.onRequest,
     onResponse: options.onResponse,
@@ -2572,11 +2625,14 @@ export {
   createBoardClient,
   isBoardApiError,
   isBoardPasswordRequired,
+  isColdRule,
   isConflict,
   isForbidden,
   isNotFound,
+  isOwnMessage,
   isRateLimited,
   isUnauthorized,
   isValidationError,
+  lastOwnMessageId,
   paginate
 };

package/dist/server.d.mts

@@ -0,0 +1,111 @@
+import { BoardSdk } from './index.mjs';
+import './jobs-DK5mPBgq.mjs';
+import './salaries-CrJsaZe6.mjs';
+
+/**
+ * Session cookie codec — pure (no framework imports, no node imports) so it
+ * stays hermetically testable and platform-neutral: helpers speak cookie
+ * STRINGS (`Set-Cookie` values / `Cookie` headers), never framework response
+ * objects. The session is the SDK bearer pair plus the access-token expiry;
+ * it lives in ONE httpOnly cookie owned by the host app (the SDK never sees
+ * storage on the server — ADR-0006).
+ */
+interface BoardSession {
+    accessToken: string;
+    refreshToken: string;
+    /** Access-token expiry, epoch ms (from board_auth_session). */
+    expiresAt: number;
+}
+declare const SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
+/**
+ * The session cookie name, optionally board-scoped. One origin can serve
+ * multiple boards (the hosted platform scopes its grant cookie per account
+ * for this reason) — a multi-board host MUST pass its board identifier so
+ * sessions cannot clobber each other; single-board apps omit it.
+ */
+declare function sessionCookieName(board?: string): string;
+declare function serializeSessionCookie(session: BoardSession, options?: {
+    board?: string;
+}): string;
+declare function clearSessionCookie(options?: {
+    board?: string;
+}): string;
+declare function parseSessionCookie(cookieHeader: string | null, options?: {
+    board?: string;
+}): BoardSession | null;
+declare function isExpiringSoon(session: BoardSession, now: number, windowMs?: number): boolean;
+
+declare const BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
+/**
+ * The grant cookie name, optionally board-scoped — hosted scopes its grant
+ * cookie per account (`board_access_<accountId>`) because one app instance
+ * can gate multiple boards. Multi-board hosts MUST pass their board
+ * identifier; single-board apps omit it.
+ */
+declare function grantCookieName(board?: string): string;
+declare function serializeGrantCookie(token: string, options?: {
+    board?: string;
+}): string;
+declare function clearGrantCookie(options?: {
+    board?: string;
+}): string;
+declare function parseGrantCookie(cookieHeader: string | null, options?: {
+    board?: string;
+}): string | null;
+
+/**
+ * Open-redirect guards — pure URL-safety logic (no cookies involved),
+ * transcribed from the hosted board's `validate-redirect-path.ts` and
+ * golden-tested against it input-for-input.
+ */
+/**
+ * Guard a `?redirect=` / `?next=` param: a same-origin absolute path only
+ * ('/', not '//', no scheme), else `defaultPath` — hosted's
+ * `getSafeRedirectPath(path, defaultPath = '/')` shape (the two-arg form is
+ * live on the employer sign-up page, which falls back to
+ * '/account/connect').
+ */
+declare function safeRedirectPath(path: string | undefined | null, defaultPath?: string): string;
+/**
+ * The current page path (from the request `Referer`) for the /password
+ * redirect-back, guarded by `safeRedirectPath`. Pure — the framework-owned
+ * header read happens in the host app's middleware and the value is passed
+ * in here, so this stays platform-neutral.
+ */
+declare function currentPathFromReferer(referer: string | null): string;
+
+/**
+ * Single-flight session refresh — dedupes concurrent refreshes for the same
+ * session WITHIN one process/isolate (the rotation race, ADR-0057 wart #4,
+ * mitigated at the one layer a client library can reach).
+ *
+ * Refresh tokens are single-use: two concurrent refreshes for the same
+ * session burn the pair — the loser 401s and the user is signed out
+ * mid-session. This helper keys an in-flight slot per refreshToken so every
+ * concurrent caller awaits the SAME rotation; sequential calls after settle
+ * start a fresh one.
+ *
+ * Scope honestly stated: the dedupe is PER PROCESS/ISOLATE (an in-memory
+ * map). Two simultaneous requests served by different instances can still
+ * race the token; the proactive `isExpiringSoon` window keeps that rare, it
+ * does not eliminate it. Pair with `storage: 'nostore'` on the shared
+ * server client — `auth.refresh` persists the rotated pair into
+ * `client.storage`, and any persistent shared storage would bleed one
+ * user's tokens into another's requests.
+ *
+ * Returns the rotated `BoardSession` (persist it back to the cookie), or
+ * `null` on a 401 — the token is burned or revoked: clear the cookie and
+ * continue signed out, never retry. Other errors (network, 5xx, 429)
+ * rethrow untouched.
+ *
+ * @example
+ * const refreshSession = createSessionRefresher(board);
+ * // in the session middleware:
+ * if (isExpiringSoon(session, Date.now())) {
+ *   const next = await refreshSession(session);
+ *   setCookie(next ? serializeSessionCookie(next) : clearSessionCookie());
+ * }
+ */
+declare function createSessionRefresher(board: Pick<BoardSdk, 'auth' | 'client'>): (session: BoardSession) => Promise<BoardSession | null>;
+
+export { BOARD_ACCESS_COOKIE_NAME, type BoardSession, SESSION_COOKIE_NAME, clearGrantCookie, clearSessionCookie, createSessionRefresher, currentPathFromReferer, grantCookieName, isExpiringSoon, parseGrantCookie, parseSessionCookie, safeRedirectPath, serializeGrantCookie, serializeSessionCookie, sessionCookieName };

package/dist/server.d.ts

@@ -0,0 +1,111 @@
+import { BoardSdk } from './index.js';
+import './jobs-DK5mPBgq.js';
+import './salaries-CXt6Vkrp.js';
+
+/**
+ * Session cookie codec — pure (no framework imports, no node imports) so it
+ * stays hermetically testable and platform-neutral: helpers speak cookie
+ * STRINGS (`Set-Cookie` values / `Cookie` headers), never framework response
+ * objects. The session is the SDK bearer pair plus the access-token expiry;
+ * it lives in ONE httpOnly cookie owned by the host app (the SDK never sees
+ * storage on the server — ADR-0006).
+ */
+interface BoardSession {
+    accessToken: string;
+    refreshToken: string;
+    /** Access-token expiry, epoch ms (from board_auth_session). */
+    expiresAt: number;
+}
+declare const SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
+/**
+ * The session cookie name, optionally board-scoped. One origin can serve
+ * multiple boards (the hosted platform scopes its grant cookie per account
+ * for this reason) — a multi-board host MUST pass its board identifier so
+ * sessions cannot clobber each other; single-board apps omit it.
+ */
+declare function sessionCookieName(board?: string): string;
+declare function serializeSessionCookie(session: BoardSession, options?: {
+    board?: string;
+}): string;
+declare function clearSessionCookie(options?: {
+    board?: string;
+}): string;
+declare function parseSessionCookie(cookieHeader: string | null, options?: {
+    board?: string;
+}): BoardSession | null;
+declare function isExpiringSoon(session: BoardSession, now: number, windowMs?: number): boolean;
+
+declare const BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
+/**
+ * The grant cookie name, optionally board-scoped — hosted scopes its grant
+ * cookie per account (`board_access_<accountId>`) because one app instance
+ * can gate multiple boards. Multi-board hosts MUST pass their board
+ * identifier; single-board apps omit it.
+ */
+declare function grantCookieName(board?: string): string;
+declare function serializeGrantCookie(token: string, options?: {
+    board?: string;
+}): string;
+declare function clearGrantCookie(options?: {
+    board?: string;
+}): string;
+declare function parseGrantCookie(cookieHeader: string | null, options?: {
+    board?: string;
+}): string | null;
+
+/**
+ * Open-redirect guards — pure URL-safety logic (no cookies involved),
+ * transcribed from the hosted board's `validate-redirect-path.ts` and
+ * golden-tested against it input-for-input.
+ */
+/**
+ * Guard a `?redirect=` / `?next=` param: a same-origin absolute path only
+ * ('/', not '//', no scheme), else `defaultPath` — hosted's
+ * `getSafeRedirectPath(path, defaultPath = '/')` shape (the two-arg form is
+ * live on the employer sign-up page, which falls back to
+ * '/account/connect').
+ */
+declare function safeRedirectPath(path: string | undefined | null, defaultPath?: string): string;
+/**
+ * The current page path (from the request `Referer`) for the /password
+ * redirect-back, guarded by `safeRedirectPath`. Pure — the framework-owned
+ * header read happens in the host app's middleware and the value is passed
+ * in here, so this stays platform-neutral.
+ */
+declare function currentPathFromReferer(referer: string | null): string;
+
+/**
+ * Single-flight session refresh — dedupes concurrent refreshes for the same
+ * session WITHIN one process/isolate (the rotation race, ADR-0057 wart #4,
+ * mitigated at the one layer a client library can reach).
+ *
+ * Refresh tokens are single-use: two concurrent refreshes for the same
+ * session burn the pair — the loser 401s and the user is signed out
+ * mid-session. This helper keys an in-flight slot per refreshToken so every
+ * concurrent caller awaits the SAME rotation; sequential calls after settle
+ * start a fresh one.
+ *
+ * Scope honestly stated: the dedupe is PER PROCESS/ISOLATE (an in-memory
+ * map). Two simultaneous requests served by different instances can still
+ * race the token; the proactive `isExpiringSoon` window keeps that rare, it
+ * does not eliminate it. Pair with `storage: 'nostore'` on the shared
+ * server client — `auth.refresh` persists the rotated pair into
+ * `client.storage`, and any persistent shared storage would bleed one
+ * user's tokens into another's requests.
+ *
+ * Returns the rotated `BoardSession` (persist it back to the cookie), or
+ * `null` on a 401 — the token is burned or revoked: clear the cookie and
+ * continue signed out, never retry. Other errors (network, 5xx, 429)
+ * rethrow untouched.
+ *
+ * @example
+ * const refreshSession = createSessionRefresher(board);
+ * // in the session middleware:
+ * if (isExpiringSoon(session, Date.now())) {
+ *   const next = await refreshSession(session);
+ *   setCookie(next ? serializeSessionCookie(next) : clearSessionCookie());
+ * }
+ */
+declare function createSessionRefresher(board: Pick<BoardSdk, 'auth' | 'client'>): (session: BoardSession) => Promise<BoardSession | null>;
+
+export { BOARD_ACCESS_COOKIE_NAME, type BoardSession, SESSION_COOKIE_NAME, clearGrantCookie, clearSessionCookie, createSessionRefresher, currentPathFromReferer, grantCookieName, isExpiringSoon, parseGrantCookie, parseSessionCookie, safeRedirectPath, serializeGrantCookie, serializeSessionCookie, sessionCookieName };

package/dist/server.js

@@ -0,0 +1,199 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server/index.ts
+var server_exports = {};
+__export(server_exports, {
+  BOARD_ACCESS_COOKIE_NAME: () => BOARD_ACCESS_COOKIE_NAME,
+  SESSION_COOKIE_NAME: () => SESSION_COOKIE_NAME,
+  clearGrantCookie: () => clearGrantCookie,
+  clearSessionCookie: () => clearSessionCookie,
+  createSessionRefresher: () => createSessionRefresher,
+  currentPathFromReferer: () => currentPathFromReferer,
+  grantCookieName: () => grantCookieName,
+  isExpiringSoon: () => isExpiringSoon,
+  parseGrantCookie: () => parseGrantCookie,
+  parseSessionCookie: () => parseSessionCookie,
+  safeRedirectPath: () => safeRedirectPath,
+  serializeGrantCookie: () => serializeGrantCookie,
+  serializeSessionCookie: () => serializeSessionCookie,
+  sessionCookieName: () => sessionCookieName
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/server/cookie.ts
+var COOKIE_ATTRIBUTES = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function buildCookie(name, value, maxAgeSeconds) {
+  return `${name}=${value}; Max-Age=${maxAgeSeconds}; ${COOKIE_ATTRIBUTES}`;
+}
+function buildClearCookie(name) {
+  return `${name}=; Max-Age=0; ${COOKIE_ATTRIBUTES}`;
+}
+function readCookie(header, name) {
+  if (!header) return null;
+  const pair = header.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`));
+  if (!pair) return null;
+  const raw = pair.slice(name.length + 1);
+  if (!raw) return null;
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return null;
+  }
+}
+function cookieScope(board) {
+  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+
+// src/server/session.ts
+var SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
+function sessionCookieName(board) {
+  return board ? `${SESSION_COOKIE_NAME}_${cookieScope(board)}` : SESSION_COOKIE_NAME;
+}
+var COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var EXPIRY_WINDOW_MS = 5 * 60 * 1e3;
+function serializeSessionCookie(session, options) {
+  return buildCookie(
+    sessionCookieName(options?.board),
+    encodeURIComponent(JSON.stringify(session)),
+    COOKIE_MAX_AGE_SECONDS
+  );
+}
+function clearSessionCookie(options) {
+  return buildClearCookie(sessionCookieName(options?.board));
+}
+function parseSessionCookie(cookieHeader, options) {
+  const raw = readCookie(cookieHeader, sessionCookieName(options?.board));
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const session = parsed;
+  if (!session || typeof session.accessToken !== "string" || typeof session.refreshToken !== "string" || typeof session.expiresAt !== "number") {
+    return null;
+  }
+  return {
+    accessToken: session.accessToken,
+    refreshToken: session.refreshToken,
+    expiresAt: session.expiresAt
+  };
+}
+function isExpiringSoon(session, now, windowMs = EXPIRY_WINDOW_MS) {
+  return session.expiresAt - now < windowMs;
+}
+
+// src/server/board-access.ts
+var BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
+function grantCookieName(board) {
+  return board ? `${BOARD_ACCESS_COOKIE_NAME}_${cookieScope(board)}` : BOARD_ACCESS_COOKIE_NAME;
+}
+var COOKIE_MAX_AGE_SECONDS2 = 24 * 60 * 60;
+function serializeGrantCookie(token, options) {
+  return buildCookie(
+    grantCookieName(options?.board),
+    encodeURIComponent(token),
+    COOKIE_MAX_AGE_SECONDS2
+  );
+}
+function clearGrantCookie(options) {
+  return buildClearCookie(grantCookieName(options?.board));
+}
+function parseGrantCookie(cookieHeader, options) {
+  return readCookie(cookieHeader, grantCookieName(options?.board));
+}
+
+// src/server/redirect-guard.ts
+function safeRedirectPath(path, defaultPath = "/") {
+  if (!path || !path.startsWith("/") || path.startsWith("//")) {
+    return defaultPath;
+  }
+  if (path.includes("://")) return defaultPath;
+  try {
+    const SENTINEL_ORIGIN = "https://redirect.invalid";
+    if (new URL(path, SENTINEL_ORIGIN).origin !== SENTINEL_ORIGIN) {
+      return defaultPath;
+    }
+  } catch {
+    return defaultPath;
+  }
+  return path;
+}
+function currentPathFromReferer(referer) {
+  if (!referer) return "/";
+  try {
+    const url = new URL(referer);
+    return safeRedirectPath(url.pathname + url.search);
+  } catch {
+    return "/";
+  }
+}
+
+// src/errors.ts
+function isBoardApiError(e) {
+  return e instanceof Error && e.name === "BoardApiError";
+}
+function isUnauthorized(e) {
+  return isBoardApiError(e) && e.status === 401;
+}
+
+// src/storage.ts
+var NOSTORE_BRAND = /* @__PURE__ */ Symbol.for("@cavuno/board:nostore");
+function isNoStore(storage) {
+  return storage[NOSTORE_BRAND] === true;
+}
+var NOSTORE = {
+  [NOSTORE_BRAND]: true,
+  getItem: () => null,
+  setItem: () => {
+  },
+  removeItem: () => {
+  }
+};
+
+// src/server/refresher.ts
+function createSessionRefresher(board) {
+  if (typeof globalThis.document === "undefined" && !isNoStore(board.client.storage)) {
+    throw new Error(
+      "createSessionRefresher requires the server client to use storage: 'nostore' \u2014 a shared persistent store would leak rotated tokens across requests. Keep the session in the httpOnly cookie and pass tokens per call."
+    );
+  }
+  const inflight = /* @__PURE__ */ new Map();
+  return async function refresh(session) {
+    const key = session.refreshToken;
+    const existing = inflight.get(key);
+    if (existing) return existing;
+    const attempt = board.auth.refresh({ refreshToken: key }).then(
+      (rotated) => ({
+        accessToken: rotated.accessToken,
+        refreshToken: rotated.refreshToken,
+        expiresAt: rotated.expiresAt
+      })
+    ).catch((error) => {
+      if (isUnauthorized(error)) return null;
+      throw error;
+    }).finally(() => {
+      inflight.delete(key);
+    });
+    inflight.set(key, attempt);
+    return attempt;
+  };
+}