@cavuno/board 1.31.0-preview.0 → 1.31.0

package/dist/index.d.mts

@@ -204,7 +204,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "1.31.0-preview.0";
+declare const SDK_VERSION = "1.31.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {

package/dist/index.d.ts

@@ -204,7 +204,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "1.31.0-preview.0";
+declare const SDK_VERSION = "1.31.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {

package/dist/index.js

@@ -312,7 +312,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.31.0-preview.0";
+var SDK_VERSION = "1.31.0";
 
 // src/client.ts
 function isRawBody(body) {

package/dist/index.mjs

@@ -265,7 +265,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.31.0-preview.0";
+var SDK_VERSION = "1.31.0";
 
 // src/client.ts
 function isRawBody(body) {

package/dist/theme.d.mts

@@ -33,6 +33,13 @@ interface ThemeInput {
         dark?: Record<string, unknown>;
     };
 }
+/**
+ * True when `value` is safe to emit inside a `<style>` CSS declaration — i.e.
+ * carries none of the breakout characters above. Shared by the SDK render sink
+ * (`boardThemeToCss`) and the hosted public-API serializer, so the denylist
+ * lives in exactly one place.
+ */
+declare function isSafeThemeColorValue(value: string): boolean;
 /**
  * Render the board theme as `:root` (+ `.dark`) CSS-variable overrides.
  * Inject once at the app shell, after the static theme stylesheet.
@@ -60,4 +67,4 @@ declare function themeFontFamily(fontKey: string): string;
 /** One Google Fonts request covering the sans + heading families. */
 declare function googleFontsUrl(theme: ThemeInput | null): string | null;
 
-export { BOARD_COLOR_KEYS, type BoardColorKey, THEME_FONT_GOOGLE_FAMILIES, type ThemeInput, boardThemeToCss, googleFontsUrl, themeFontFamily, themeMode };
+export { BOARD_COLOR_KEYS, type BoardColorKey, THEME_FONT_GOOGLE_FAMILIES, type ThemeInput, boardThemeToCss, googleFontsUrl, isSafeThemeColorValue, themeFontFamily, themeMode };

package/dist/theme.d.ts

@@ -33,6 +33,13 @@ interface ThemeInput {
         dark?: Record<string, unknown>;
     };
 }
+/**
+ * True when `value` is safe to emit inside a `<style>` CSS declaration — i.e.
+ * carries none of the breakout characters above. Shared by the SDK render sink
+ * (`boardThemeToCss`) and the hosted public-API serializer, so the denylist
+ * lives in exactly one place.
+ */
+declare function isSafeThemeColorValue(value: string): boolean;
 /**
  * Render the board theme as `:root` (+ `.dark`) CSS-variable overrides.
  * Inject once at the app shell, after the static theme stylesheet.
@@ -60,4 +67,4 @@ declare function themeFontFamily(fontKey: string): string;
 /** One Google Fonts request covering the sans + heading families. */
 declare function googleFontsUrl(theme: ThemeInput | null): string | null;
 
-export { BOARD_COLOR_KEYS, type BoardColorKey, THEME_FONT_GOOGLE_FAMILIES, type ThemeInput, boardThemeToCss, googleFontsUrl, themeFontFamily, themeMode };
+export { BOARD_COLOR_KEYS, type BoardColorKey, THEME_FONT_GOOGLE_FAMILIES, type ThemeInput, boardThemeToCss, googleFontsUrl, isSafeThemeColorValue, themeFontFamily, themeMode };

package/dist/theme.js

@@ -24,6 +24,7 @@ __export(theme_exports, {
   THEME_FONT_GOOGLE_FAMILIES: () => THEME_FONT_GOOGLE_FAMILIES,
   boardThemeToCss: () => boardThemeToCss,
   googleFontsUrl: () => googleFontsUrl,
+  isSafeThemeColorValue: () => isSafeThemeColorValue,
   themeFontFamily: () => themeFontFamily,
   themeMode: () => themeMode
 });
@@ -46,9 +47,14 @@ var BOARD_COLOR_KEYS = [
   "contrastBackground",
   "contrastText"
 ];
+var CSS_INJECTION_CHARS = /[<>{};]|[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+function isSafeThemeColorValue(value) {
+  return !CSS_INJECTION_CHARS.test(value);
+}
 function color(colors, key) {
   const value = colors[key];
-  return typeof value === "string" && value ? value : void 0;
+  if (typeof value !== "string" || !value) return void 0;
+  return isSafeThemeColorValue(value) ? value : void 0;
 }
 function tokenLines(colors) {
   const lines = [];

package/dist/theme.mjs

@@ -17,9 +17,14 @@ var BOARD_COLOR_KEYS = [
   "contrastBackground",
   "contrastText"
 ];
+var CSS_INJECTION_CHARS = /[<>{};]|[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+function isSafeThemeColorValue(value) {
+  return !CSS_INJECTION_CHARS.test(value);
+}
 function color(colors, key) {
   const value = colors[key];
-  return typeof value === "string" && value ? value : void 0;
+  if (typeof value !== "string" || !value) return void 0;
+  return isSafeThemeColorValue(value) ? value : void 0;
 }
 function tokenLines(colors) {
   const lines = [];
@@ -123,6 +128,7 @@ export {
   THEME_FONT_GOOGLE_FAMILIES,
   boardThemeToCss,
   googleFontsUrl,
+  isSafeThemeColorValue,
   themeFontFamily,
   themeMode
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cavuno/board",
-  "version": "1.31.0-preview.0",
+  "version": "1.31.0",
   "description": "Typed isomorphic client for the Cavuno Board API",
   "license": "MIT",
   "type": "commonjs",

package/skills/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.31.0-preview.0",
+  "version": "1.31.0",
   "skills": [
     {
       "name": "cavuno-board-account",