@cavuno/board 4.30.0 → 4.31.1

package/dist/seo.d.ts

@@ -1,9 +1,9 @@
-import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-CvQeoBc8.js';
-import { e as JsonLdObject } from './breadcrumbs-CJ5eu_ye.js';
-export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-CJ5eu_ye.js';
-import './_spec-CuSpfit_.js';
-import './board-t_j16FrX.js';
-import './jobs-CErce8Tw.js';
+import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-CcLmN5Tw.js';
+import { e as JsonLdObject } from './breadcrumbs-Bu1lN6qA.js';
+export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-Bu1lN6qA.js';
+import './_spec-BD5My4zL.js';
+import './board-CF66EdYi.js';
+import './jobs-BbtjrUo2.js';
 
 /**
  * Blog structured data on the `@cavuno/board` wire types, transcribed from

package/dist/server.d.mts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.mjs';
-import './_spec-CuSpfit_.mjs';
-import './search-BefsJD_f.mjs';
-import './board-VrjkKuZ-.mjs';
-import './jobs-h-ewgbXn.mjs';
-import './seo-BFQIA81t.mjs';
-import './blog-21XnewAu.mjs';
+import './_spec-BD5My4zL.mjs';
+import './search-CIjAdPR-.mjs';
+import './board-BRWS1m6D.mjs';
+import './jobs-BPTMfkal.mjs';
+import './seo-BypmVm97.mjs';
+import './blog-Dh-Ru5QZ.mjs';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it
@@ -111,26 +111,31 @@ declare function getCavunoAppCanonicalRedirectUrl(params: {
 }): string | null;
 
 /**
- * Single-flight session refresh — dedupes concurrent refreshes for the same
- * session WITHIN one process/isolate (the rotation race,  ,
- * mitigated at the one layer a client library can reach).
+ * Session refresh for server-rendered apps. Each call rotates the given
+ * session's refresh token with `board.auth.refresh` and maps the result to a
+ * `BoardSession`.
  *
- * Refresh tokens are single-use: two concurrent refreshes for the same
- * session burn the pair — the loser 401s and the user is signed out
- * mid-session. This helper keys an in-flight slot per refreshToken so every
- * concurrent caller awaits the SAME rotation; sequential calls after settle
- * start a fresh one.
+ * No state is held across calls. The refresher is usually module-scoped and
+ * shared by every request, so a promise kept between calls would be shared
+ * across requests too. On edge runtimes such as Cloudflare Workers, I/O
+ * belongs to the request that started it: when that request is cancelled
+ * (for example the client disconnects), its fetch is cancelled and a promise
+ * waiting on it never settles. Any later request awaiting that shared promise
+ * would hang. Each call therefore performs its own refresh.
  *
- * Scope honestly stated: the dedupe is PER PROCESS/ISOLATE (an in-memory
- * map). Two simultaneous requests served by different instances can still
- * race the token; the proactive `isExpiringSoon` window keeps that rare, it
- * does not eliminate it. Pair with `storage: 'nostore'` on the shared
- * server client — `auth.refresh` persists the rotated pair into
- * `client.storage`, and any persistent shared storage would bleed one
- * user's tokens into another's requests.
+ * Concurrent refreshes of the same session are safe without client-side
+ * coordination: the refresh endpoint returns the same successor refresh token
+ * for a token re-presented within a short grace window, so parallel calls
+ * (in one process or across instances) converge on one refresh token. Their
+ * access tokens may differ; each is valid.
+ *
+ * Pair with `storage: 'nostore'` on the shared server client.
+ * `auth.refresh` persists the rotated pair into `client.storage`, and any
+ * persistent shared storage would bleed one user's tokens into another's
+ * requests.
  *
  * Returns the rotated `BoardSession` (persist it back to the cookie), or
- * `null` on a 401 — the token is burned or revoked: clear the cookie and
+ * `null` on a 401: the token is expired or revoked, so clear the cookie and
  * continue signed out, never retry. Other errors (network, 5xx, 429)
  * rethrow untouched.
  *

package/dist/server.d.ts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.js';
-import './_spec-CuSpfit_.js';
-import './search-B2LdM6bj.js';
-import './board-t_j16FrX.js';
-import './jobs-CErce8Tw.js';
-import './seo-BPDNxOiZ.js';
-import './blog-CvQeoBc8.js';
+import './_spec-BD5My4zL.js';
+import './search-CqPIHkv8.js';
+import './board-CF66EdYi.js';
+import './jobs-BbtjrUo2.js';
+import './seo-C-NQ0T9w.js';
+import './blog-CcLmN5Tw.js';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it
@@ -111,26 +111,31 @@ declare function getCavunoAppCanonicalRedirectUrl(params: {
 }): string | null;
 
 /**
- * Single-flight session refresh — dedupes concurrent refreshes for the same
- * session WITHIN one process/isolate (the rotation race,  ,
- * mitigated at the one layer a client library can reach).
+ * Session refresh for server-rendered apps. Each call rotates the given
+ * session's refresh token with `board.auth.refresh` and maps the result to a
+ * `BoardSession`.
  *
- * Refresh tokens are single-use: two concurrent refreshes for the same
- * session burn the pair — the loser 401s and the user is signed out
- * mid-session. This helper keys an in-flight slot per refreshToken so every
- * concurrent caller awaits the SAME rotation; sequential calls after settle
- * start a fresh one.
+ * No state is held across calls. The refresher is usually module-scoped and
+ * shared by every request, so a promise kept between calls would be shared
+ * across requests too. On edge runtimes such as Cloudflare Workers, I/O
+ * belongs to the request that started it: when that request is cancelled
+ * (for example the client disconnects), its fetch is cancelled and a promise
+ * waiting on it never settles. Any later request awaiting that shared promise
+ * would hang. Each call therefore performs its own refresh.
  *
- * Scope honestly stated: the dedupe is PER PROCESS/ISOLATE (an in-memory
- * map). Two simultaneous requests served by different instances can still
- * race the token; the proactive `isExpiringSoon` window keeps that rare, it
- * does not eliminate it. Pair with `storage: 'nostore'` on the shared
- * server client — `auth.refresh` persists the rotated pair into
- * `client.storage`, and any persistent shared storage would bleed one
- * user's tokens into another's requests.
+ * Concurrent refreshes of the same session are safe without client-side
+ * coordination: the refresh endpoint returns the same successor refresh token
+ * for a token re-presented within a short grace window, so parallel calls
+ * (in one process or across instances) converge on one refresh token. Their
+ * access tokens may differ; each is valid.
+ *
+ * Pair with `storage: 'nostore'` on the shared server client.
+ * `auth.refresh` persists the rotated pair into `client.storage`, and any
+ * persistent shared storage would bleed one user's tokens into another's
+ * requests.
  *
  * Returns the rotated `BoardSession` (persist it back to the cookie), or
- * `null` on a 401 — the token is burned or revoked: clear the cookie and
+ * `null` on a 401: the token is expired or revoked, so clear the cookie and
  * continue signed out, never retry. Other errors (network, 5xx, 429)
  * rethrow untouched.
  *

package/dist/server.js

@@ -224,24 +224,19 @@ function createSessionRefresher(board) {
       "createSessionRefresher requires the server client to use storage: 'nostore' \u2014 a shared persistent store would leak rotated tokens across requests. Keep the session in the httpOnly cookie and pass tokens per call."
     );
   }
-  const inflight = /* @__PURE__ */ new Map();
   return async function refresh(session) {
-    const key = session.refreshToken;
-    const existing = inflight.get(key);
-    if (existing) return existing;
-    const attempt = board.auth.refresh({ refreshToken: key }).then(
-      (rotated) => ({
+    try {
+      const rotated = await board.auth.refresh({
+        refreshToken: session.refreshToken
+      });
+      return {
         accessToken: rotated.accessToken,
         refreshToken: rotated.refreshToken,
         expiresAt: rotated.expiresAt
-      })
-    ).catch((error) => {
+      };
+    } catch (error) {
       if (isUnauthorized(error)) return null;
       throw error;
-    }).finally(() => {
-      inflight.delete(key);
-    });
-    inflight.set(key, attempt);
-    return attempt;
+    }
   };
 }

package/dist/server.mjs

@@ -4,7 +4,7 @@ import {
 } from "./chunk-Z4ALWIGS.mjs";
 import {
   isUnauthorized
-} from "./chunk-EHSB2VAJ.mjs";
+} from "./chunk-WSO6JN5C.mjs";
 
 // src/server/cookie.ts
 var COOKIE_ATTRIBUTES = "Path=/; HttpOnly; Secure; SameSite=Lax";
@@ -159,25 +159,20 @@ function createSessionRefresher(board) {
       "createSessionRefresher requires the server client to use storage: 'nostore' \u2014 a shared persistent store would leak rotated tokens across requests. Keep the session in the httpOnly cookie and pass tokens per call."
     );
   }
-  const inflight = /* @__PURE__ */ new Map();
   return async function refresh(session) {
-    const key = session.refreshToken;
-    const existing = inflight.get(key);
-    if (existing) return existing;
-    const attempt = board.auth.refresh({ refreshToken: key }).then(
-      (rotated) => ({
+    try {
+      const rotated = await board.auth.refresh({
+        refreshToken: session.refreshToken
+      });
+      return {
         accessToken: rotated.accessToken,
         refreshToken: rotated.refreshToken,
         expiresAt: rotated.expiresAt
-      })
-    ).catch((error) => {
+      };
+    } catch (error) {
       if (isUnauthorized(error)) return null;
       throw error;
-    }).finally(() => {
-      inflight.delete(key);
-    });
-    inflight.set(key, attempt);
-    return attempt;
+    }
   };
 }
 export {

package/dist/sitemap.d.mts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.mjs';
-import './_spec-CuSpfit_.mjs';
-import './search-BefsJD_f.mjs';
-import './board-VrjkKuZ-.mjs';
-import './jobs-h-ewgbXn.mjs';
-import './seo-BFQIA81t.mjs';
-import './blog-21XnewAu.mjs';
+import './_spec-BD5My4zL.mjs';
+import './search-CIjAdPR-.mjs';
+import './board-BRWS1m6D.mjs';
+import './jobs-BPTMfkal.mjs';
+import './seo-BypmVm97.mjs';
+import './blog-Dh-Ru5QZ.mjs';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/sitemap.d.ts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.js';
-import './_spec-CuSpfit_.js';
-import './search-B2LdM6bj.js';
-import './board-t_j16FrX.js';
-import './jobs-CErce8Tw.js';
-import './seo-BPDNxOiZ.js';
-import './blog-CvQeoBc8.js';
+import './_spec-BD5My4zL.js';
+import './search-CqPIHkv8.js';
+import './board-CF66EdYi.js';
+import './jobs-BbtjrUo2.js';
+import './seo-C-NQ0T9w.js';
+import './blog-CcLmN5Tw.js';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/sitemap.mjs

@@ -3,7 +3,7 @@ import {
 } from "./chunk-DLSO6XXY.mjs";
 import {
   isNotFound
-} from "./chunk-EHSB2VAJ.mjs";
+} from "./chunk-WSO6JN5C.mjs";
 import {
   BOARD_PATHS,
   blogAuthorPath,

package/dist/suggest.d.mts

@@ -1,5 +1,5 @@
-import { h as SuggestionItem, b as SearchSuggestQuery, F as FetchOptions, g as SuggestResult } from './search-BefsJD_f.mjs';
-import './_spec-CuSpfit_.mjs';
+import { h as SuggestionItem, b as SearchSuggestQuery, F as FetchOptions, g as SuggestResult } from './search-CIjAdPR-.mjs';
+import './_spec-BD5My4zL.mjs';
 
 /**
  * `@cavuno/board/suggest` — framework-agnostic headless search-suggest

package/dist/suggest.d.ts

@@ -1,5 +1,5 @@
-import { h as SuggestionItem, b as SearchSuggestQuery, F as FetchOptions, g as SuggestResult } from './search-B2LdM6bj.js';
-import './_spec-CuSpfit_.js';
+import { h as SuggestionItem, b as SearchSuggestQuery, F as FetchOptions, g as SuggestResult } from './search-CqPIHkv8.js';
+import './_spec-BD5My4zL.js';
 
 /**
  * `@cavuno/board/suggest` — framework-agnostic headless search-suggest

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cavuno/board",
-  "version": "4.30.0",
+  "version": "4.31.1",
   "description": "Build custom job boards and careers pages with Cavuno’s TypeScript SDK.",
   "keywords": [
     "api-client",

package/skills/cavuno-board-auth/SKILL.md

@@ -58,7 +58,7 @@ try {
 }
 ```
 
-On SSR, use the module-scoped `createSessionRefresher` pattern in `cavuno-board-server-sessions`; it is the single source of truth for concurrency, cookies, retry limits, and per-call authorization headers.
+On SSR, use the module-scoped `createSessionRefresher` pattern in `cavuno-board-server-sessions`; it is the single source of truth for cookies, retry limits, and per-call authorization headers.
 
 **Complete when:** concurrent expiry paths share one rotation and the original operation is attempted at most once after a successful refresh.
 

package/skills/cavuno-board-server-sessions/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cavuno-board-server-sessions
-description: Wire Cavuno server sessions and board-password access. Use when a server-rendered app needs httpOnly cookies, per-request bearer headers, single-flight refresh, grant cookies, or safe redirect-back handling.
+description: Wire Cavuno server sessions and board-password access. Use when a server-rendered app needs httpOnly cookies, per-request bearer headers, session refresh, grant cookies, or safe redirect-back handling.
 ---
 
 # Wire server sessions
@@ -11,7 +11,7 @@ The server contract has three invariants:
 
 1. One module-scoped board client uses server-default `nostore`.
 2. Each request reads an app-owned httpOnly cookie and passes credentials in that call's headers.
-3. One module-scoped `createSessionRefresher(board)` coordinates refreshes within the process or isolate.
+3. One module-scoped `createSessionRefresher(board)` refreshes expiring sessions. It holds no state between requests.
 
 ## 1. Persist the board-user session
 
@@ -41,7 +41,7 @@ const clearedCookie = clearSessionCookie();
 
 ## 2. Resolve one fresh session per request
 
-Refresh tokens rotate once. Create the refresher beside the shared client so concurrent requests using the same refresh token await one rotation. `isExpiringSoon` selects sessions within the proactive five-minute window.
+Refresh tokens rotate on use. Create the refresher beside the shared client. Each call performs its own refresh; concurrent requests presenting the same refresh token within a short grace window receive the same successor refresh token, so they converge without client-side coordination. `isExpiringSoon` selects sessions within the proactive five-minute window.
 
 ```ts snippet
 import {
@@ -68,9 +68,9 @@ async function resolveSession(cookieHeader: string | null) {
 }
 ```
 
-A rotated session is written back before the response completes. A `null` result represents a 401 from a burned or revoked token: clear the cookie and continue signed out. Network, 5xx, and 429 failures rethrow to the app's error boundary. The helper deduplicates within one process or isolate; separate deployment instances can still race.
+A rotated session is written back before the response completes. A `null` result represents a 401 from a burned or revoked token: clear the cookie and continue signed out. Network, 5xx, and 429 failures rethrow to the app's error boundary. The helper keeps no in-flight promise between requests: on edge runtimes such as Cloudflare Workers, a promise started by a request that is later cancelled never settles, and sharing it would hang every later request for that session.
 
-**Complete when:** two simultaneous resolutions for one expiring session invoke one rotation in the process, both observe the same result, success writes the rotated pair, and `null` produces one clear-cookie response with no refresh retry.
+**Complete when:** two simultaneous resolutions for one expiring session both succeed with the same refresh token, success writes the rotated pair, and `null` produces one clear-cookie response with no refresh retry.
 
 ## 3. Authenticate each SDK call
 

package/skills/cavuno-board-setup/SKILL.md

@@ -48,7 +48,7 @@ Use `cavuno-board-format`, `cavuno-board-filters`, and `cavuno-board-search-sugg
 
 Use `cavuno-board-auth` for board-user registration, login, verification, recovery, and browser storage. In a server-rendered app, use `cavuno-board-server-sessions` as the authority for the httpOnly session cookie, per-call bearer header, and `createSessionRefresher`. Use `cavuno-board-errors` for typed failure branches and board-password grants.
 
-**Complete when:** an authenticated `board.me.retrieve()` succeeds, logout returns the app to a signed-out state, and concurrent server requests share the server skill's single-flight refresher.
+**Complete when:** an authenticated `board.me.retrieve()` succeeds, logout returns the app to a signed-out state, and server requests refresh expiring sessions through the server skill's module-scoped refresher.
 
 ## 5. Add only the enabled surfaces
 

package/skills/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.30.0",
+  "version": "4.31.1",
   "skills": [
     {
       "name": "cavuno-board-account",
@@ -136,7 +136,7 @@
     },
     {
       "name": "cavuno-board-server-sessions",
-      "description": "Wire Cavuno server sessions and board-password access. Use when a server-rendered app needs httpOnly cookies, per-request bearer headers, single-flight refresh, grant cookies, or safe redirect-back handling.",
+      "description": "Wire Cavuno server sessions and board-password access. Use when a server-rendered app needs httpOnly cookies, per-request bearer headers, session refresh, grant cookies, or safe redirect-back handling.",
       "path": "skills/cavuno-board-server-sessions/SKILL.md",
       "framework": null,
       "category": "core"