@cavuno/board 4.31.0 → 4.32.0

package/CHANGELOG.md

@@ -3,6 +3,37 @@
 This changelog records changes that affect Board API compatibility, exported
 types, runtime behavior, or supported integration patterns.
 
+## 4.32.0 — 2026-10-02
+
+- Registration accepts an optional `returnTo`, a same-origin path carried
+  through the verification email link, so someone who signs up partway
+  through a task (for example, applying to a job) lands back where they
+  started after verifying. Resending the verification email accepts the same
+  field: `auth.resendVerification({ body: { returnTo } })`. Unsafe values are
+  ignored.
+
+- Board context includes `features.contactPage`, which matches whether the
+  board's public contact form is live, so a frontend can decide whether to
+  link to the contact page without a separate request.
+
+- Candidate offers include `entitlements` (`listings`, `matches`,
+  `job_alerts`), the candidate permissions each offer grants. Offers without
+  configured permissions grant full access.
+
+## 4.31.1 — 2026-10-01
+
+- `createSessionRefresher` no longer shares an in-flight refresh between
+  requests. On Cloudflare Workers, a refresh started by a request that was
+  then cancelled could stay pending forever, and later requests for that
+  session waited on it. Each call now performs its own refresh; the refresh
+  endpoint returns the same successor refresh token for a token re-presented
+  within a short grace window, so concurrent refreshes converge on one
+  session. To avoid duplicate refresh calls, collapse them within a single
+  incoming request, never across requests.
+
+- The attribution check counts a footer backlink that React streams in a late
+  Suspense segment as visible, matching how browsers and crawlers render it.
+
 ## 4.31.0 — 2026-10-01
 
 - Board SSO supports candidate and employer sign-in through OpenID Connect and

package/dist/{_spec-BD5My4zL.d.mts → _spec-BdqHycDm.d.mts}

@@ -256,6 +256,8 @@ interface components {
             marketingConsent?: boolean;
             /** @description Send the email link to this development origin instead of the board's production origin, for example `http://localhost:5173` while testing a self-hosted frontend. Only accepted with a publishable-key (`pk_...`) identifier (else 400 `board_development_origin_requires_publishable_key`), and only for a localhost development origin: email links can be requested for anyone's address, so a registered https preview returns 400 `board_development_origin_not_allowed_for_email`. It must be one of the board's development origins; otherwise the request fails with 400 `board_development_origin_not_registered`. */
             developmentOrigin?: string;
+            /** @description Optional same-origin path to carry through the email link. */
+            returnTo?: string;
         };
         BoardAuthRequestMagicLinkBody: {
             audienceAttribution?: components["schemas"]["AudienceAttribution"];
@@ -271,6 +273,10 @@ interface components {
             /** @description Send the email link to this development origin instead of the board's production origin, for example `http://localhost:5173` while testing a self-hosted frontend. Only accepted with a publishable-key (`pk_...`) identifier (else 400 `board_development_origin_requires_publishable_key`), and only for a localhost development origin: email links can be requested for anyone's address, so a registered https preview returns 400 `board_development_origin_not_allowed_for_email`. It must be one of the board's development origins; otherwise the request fails with 400 `board_development_origin_not_registered`. */
             developmentOrigin?: string;
         };
+        BoardAuthResendVerificationBody: {
+            /** @description Optional same-origin path to carry through the email link. */
+            returnTo?: string;
+        };
         BoardAuthResetPasswordBody: {
             token: string;
             /** @description Minimum 8 characters. */
@@ -2007,6 +2013,12 @@ interface components {
             intervalUnit: string | null;
             intervalCount: number | null;
             isDefault: boolean;
+            /** @description The effective candidate permissions granted by this offer. Offers without configured candidate permissions grant full access. */
+            entitlements?: {
+                listings: boolean;
+                matches: boolean;
+                job_alerts: boolean;
+            };
         };
         Plan: {
             /** @enum {string} */
@@ -2285,6 +2297,8 @@ interface components {
                 nativeApplications: boolean;
                 /** @description Whether applicant↔employer messaging is enabled on the board. `false` means the `me/conversations` route family rejects with `messaging_disabled` (403). Hide inbox/dock/Message CTAs. */
                 messaging: boolean;
+                /** @description Whether the board's public contact form is live. Matches `enabled` on `GET /v1/boards/{identifier}/contact`, so chrome can decide whether to link to the contact page from this context alone. When `false`, `POST /contact` rejects. */
+                contactPage: boolean;
             };
             /**
              * @description How the operator charges employers for the candidate directory. `paid_messaging` leaves profiles fully visible and spends a credit on a first cold message; `paid_unlocks_and_messaging` also redacts directory cards and gates the opaque `/p/{id}` profile route behind an unlock credit. `null` means the operator has not chosen explicitly, in which case infer it from the published `talent_access` plans: any plan granting profile unlocks means `paid_unlocks_and_messaging`, otherwise `paid_messaging`. The paywall is inert regardless when the board publishes no talent plan. An anonymous viewer has no entitlement read to derive this from, so it ships here rather than only on `me/talent-access`.

package/dist/{_spec-BD5My4zL.d.ts → _spec-BdqHycDm.d.ts}

@@ -256,6 +256,8 @@ interface components {
             marketingConsent?: boolean;
             /** @description Send the email link to this development origin instead of the board's production origin, for example `http://localhost:5173` while testing a self-hosted frontend. Only accepted with a publishable-key (`pk_...`) identifier (else 400 `board_development_origin_requires_publishable_key`), and only for a localhost development origin: email links can be requested for anyone's address, so a registered https preview returns 400 `board_development_origin_not_allowed_for_email`. It must be one of the board's development origins; otherwise the request fails with 400 `board_development_origin_not_registered`. */
             developmentOrigin?: string;
+            /** @description Optional same-origin path to carry through the email link. */
+            returnTo?: string;
         };
         BoardAuthRequestMagicLinkBody: {
             audienceAttribution?: components["schemas"]["AudienceAttribution"];
@@ -271,6 +273,10 @@ interface components {
             /** @description Send the email link to this development origin instead of the board's production origin, for example `http://localhost:5173` while testing a self-hosted frontend. Only accepted with a publishable-key (`pk_...`) identifier (else 400 `board_development_origin_requires_publishable_key`), and only for a localhost development origin: email links can be requested for anyone's address, so a registered https preview returns 400 `board_development_origin_not_allowed_for_email`. It must be one of the board's development origins; otherwise the request fails with 400 `board_development_origin_not_registered`. */
             developmentOrigin?: string;
         };
+        BoardAuthResendVerificationBody: {
+            /** @description Optional same-origin path to carry through the email link. */
+            returnTo?: string;
+        };
         BoardAuthResetPasswordBody: {
             token: string;
             /** @description Minimum 8 characters. */
@@ -2007,6 +2013,12 @@ interface components {
             intervalUnit: string | null;
             intervalCount: number | null;
             isDefault: boolean;
+            /** @description The effective candidate permissions granted by this offer. Offers without configured candidate permissions grant full access. */
+            entitlements?: {
+                listings: boolean;
+                matches: boolean;
+                job_alerts: boolean;
+            };
         };
         Plan: {
             /** @enum {string} */
@@ -2285,6 +2297,8 @@ interface components {
                 nativeApplications: boolean;
                 /** @description Whether applicant↔employer messaging is enabled on the board. `false` means the `me/conversations` route family rejects with `messaging_disabled` (403). Hide inbox/dock/Message CTAs. */
                 messaging: boolean;
+                /** @description Whether the board's public contact form is live. Matches `enabled` on `GET /v1/boards/{identifier}/contact`, so chrome can decide whether to link to the contact page from this context alone. When `false`, `POST /contact` rejects. */
+                contactPage: boolean;
             };
             /**
              * @description How the operator charges employers for the candidate directory. `paid_messaging` leaves profiles fully visible and spends a credit on a first cold message; `paid_unlocks_and_messaging` also redacts directory cards and gates the opaque `/p/{id}` profile route behind an unlock credit. `null` means the operator has not chosen explicitly, in which case infer it from the published `talent_access` plans: any plan granting profile unlocks means `paid_unlocks_and_messaging`, otherwise `paid_messaging`. The paywall is inert regardless when the board publishes no talent plan. An anonymous viewer has no entitlement read to derive this from, so it ships here rather than only on `me/talent-access`.

package/dist/bin.mjs

@@ -8249,8 +8249,29 @@ var NON_RENDERED = /* @__PURE__ */ new Set([
 function attribute(node, name) {
   return node.attrs.find((attr) => attr.name === name)?.value;
 }
-function hidden(node) {
-  if (NON_RENDERED.has(node.tagName) || attribute(node, "hidden") !== void 0 || attribute(node, "inert") !== void 0 || attribute(node, "aria-hidden")?.toLowerCase() === "true")
+var STREAMED_REVEAL = /\$R[CR]\(\s*"[^"]+"\s*,\s*"([^"]+)"|\$RS\(\s*"([^"]+)"/g;
+function revealedSegmentIds(root) {
+  const ids = /* @__PURE__ */ new Set();
+  function visit(node) {
+    if ("tagName" in node && node.tagName === "script") {
+      for (const child of node.childNodes) {
+        if (child.nodeName !== "#text") continue;
+        const text = child.value;
+        for (const match of text.matchAll(STREAMED_REVEAL)) {
+          ids.add(match[1] ?? match[2]);
+        }
+      }
+      return;
+    }
+    if ("childNodes" in node) node.childNodes.forEach(visit);
+  }
+  visit(root);
+  return ids;
+}
+function hidden(node, revealed) {
+  const id = attribute(node, "id");
+  const streamedSegment = node.tagName === "div" && id !== void 0 && revealed.has(id);
+  if (NON_RENDERED.has(node.tagName) || attribute(node, "hidden") !== void 0 && !streamedSegment || attribute(node, "inert") !== void 0 || attribute(node, "aria-hidden")?.toLowerCase() === "true")
     return true;
   const style = (attribute(node, "style") ?? "").replace(
     /\/\*[\s\S]*?\*\//g,
@@ -8263,24 +8284,26 @@ function hidden(node) {
     return property === "display" && value === "none" || property === "visibility" && ["hidden", "collapse"].includes(value) || property === "opacity" && value !== "" && Number(value.replace(/%$/, "")) === 0;
   });
 }
-function hasContent(node) {
+function hasContent(node, revealed) {
   if (node.nodeName === "#text")
     return /\S/.test(node.value);
   if ("tagName" in node) {
-    if (hidden(node)) return false;
+    if (hidden(node, revealed)) return false;
     if (node.tagName === "img") return Boolean(attribute(node, "alt")?.trim());
     if (node.tagName === "svg" && attribute(node, "aria-label")?.trim())
       return true;
   }
-  return "childNodes" in node && node.childNodes.some(hasContent);
+  return "childNodes" in node && node.childNodes.some((child) => hasContent(child, revealed));
 }
 function hasCrawlableCavunoBacklink(html) {
+  const root = parse(html);
+  const revealed = revealedSegmentIds(root);
   function visit(node) {
     if ("tagName" in node) {
-      if (hidden(node)) return false;
+      if (hidden(node, revealed)) return false;
       if (node.tagName === "a") {
         const href = attribute(node, "href");
-        if (href !== void 0 && hasContent(node)) {
+        if (href !== void 0 && hasContent(node, revealed)) {
           try {
             const url = new URL(href);
             if (["http:", "https:"].includes(url.protocol) && ["cavuno.com", "www.cavuno.com"].includes(url.hostname))
@@ -8292,7 +8315,7 @@ function hasCrawlableCavunoBacklink(html) {
     }
     return "childNodes" in node && node.childNodes.some(visit);
   }
-  return visit(parse(html));
+  return visit(root);
 }
 
 // src/doctor/read.ts

package/dist/{blog-Dh-Ru5QZ.d.mts → blog-CE0g5csE.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-BD5My4zL.mjs';
+import { S as Schemas } from './_spec-BdqHycDm.mjs';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];

package/dist/{blog-CcLmN5Tw.d.ts → blog-D85cD8W0.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-BD5My4zL.js';
+import { S as Schemas } from './_spec-BdqHycDm.js';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];

package/dist/{board-CF66EdYi.d.ts → board-CEsr8xMh.d.ts}

@@ -1,5 +1,5 @@
-import { S as Schemas } from './_spec-BD5My4zL.js';
-import { L as ListEnvelope, s as RelatedSearch, a as CustomFieldFilter, O as ObjectReferenceFilter } from './jobs-BbtjrUo2.js';
+import { S as Schemas } from './_spec-BdqHycDm.js';
+import { L as ListEnvelope, s as RelatedSearch, a as CustomFieldFilter, O as ObjectReferenceFilter } from './jobs-DbZuagy-.js';
 
 type PublicCompany = Schemas['CompanyPublic'];
 /** A market (sector) a company operates in — name + its source slug. */

package/dist/{board-BRWS1m6D.d.mts → board-CdG7z-Vq.d.mts}

@@ -1,5 +1,5 @@
-import { S as Schemas } from './_spec-BD5My4zL.mjs';
-import { L as ListEnvelope, s as RelatedSearch, a as CustomFieldFilter, O as ObjectReferenceFilter } from './jobs-BPTMfkal.mjs';
+import { S as Schemas } from './_spec-BdqHycDm.mjs';
+import { L as ListEnvelope, s as RelatedSearch, a as CustomFieldFilter, O as ObjectReferenceFilter } from './jobs-COOBWXWV.mjs';
 
 type PublicCompany = Schemas['CompanyPublic'];
 /** A market (sector) a company operates in — name + its source slug. */

package/dist/{breadcrumbs-AEupw3fi.d.mts → breadcrumbs-B3n9k95M.d.mts}

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-BRWS1m6D.mjs';
-import { P as PublicJob } from './jobs-BPTMfkal.mjs';
+import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-CdG7z-Vq.mjs';
+import { P as PublicJob } from './jobs-COOBWXWV.mjs';
 
 /**
  * Wire enum for `salaryTimeframe`. Defined here (not re-exported from any

package/dist/{breadcrumbs-Bu1lN6qA.d.ts → breadcrumbs-DmVbf4_6.d.ts}

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-CF66EdYi.js';
-import { P as PublicJob } from './jobs-BbtjrUo2.js';
+import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-CEsr8xMh.js';
+import { P as PublicJob } from './jobs-DbZuagy-.js';
 
 /**
  * Wire enum for `salaryTimeframe`. Defined here (not re-exported from any