@cavuno/board 4.35.0 → 4.36.0

package/dist/doctor.d.mts

@@ -45,4 +45,44 @@ interface DoctorRun {
 }
 declare function runDoctor(options: RunDoctorOptions): Promise<DoctorRun>;
 
-export { type CheckResult, type CheckStatus, type DoctorEnv, type DoctorRun, type DoctorSummary, type RunDoctorOptions, runDoctor };
+/**
+ *cookie-codec conformance.
+ *
+ * Starter / consumer code must not domain-scope cookies on the shared
+ * origin. The SDK server cookie codec (`buildCookie` / `buildClearCookie`
+ * / `serializeSessionCookie` from `@cavuno/board/server`) mints host-only
+ * `__Host-` values; attaching those via `Set-Cookie` is the sanctioned
+ * path and is GREEN. Domain-scoped writes (raw `Set-Cookie` with
+ * `Domain=`, or `document.cookie = … Domain=`) are RED.
+ *
+ * Caveat: the doctor is accountability tooling,
+ * not a security boundary. Tenants remain identifiable paying customers
+ * with an audit trail; this check does not prevent determined abuse.
+ *
+ * Scope: application-authored source only. Generated output under `src/` is
+ * skipped (see GENERATED_DIRS / GENERATED_FILE / hasGeneratedBanner) —
+ * a tenant cannot fix a finding in a file their build regenerates, so
+ * flagging one is pure noise. The motivating case is Paraglide JS: its
+ * compiler writes `src/paraglide/**` (gitignored in the starter) and
+ * `runtime.js` contains a `document.cookie = … cookieDomain` write for
+ * Paraglide's own LOCALE cookie strategy — dead behind a
+ * `TREE_SHAKE_COOKIE_STRATEGY_USED` guard on a board compiled without
+ * the cookie strategy, and unfixable by the consumer either way.
+ *
+ * Why not `.gitignore`? It is the most correct signal, but parsing it
+ * faithfully (nested files, negations, precedence, dir-vs-path anchors)
+ * needs a dependency the SDK will not take, and shelling out to
+ * `git check-ignore` assumes both a git binary and a git working tree —
+ * neither holds for platform-built tenant projects. The pattern list
+ * plus the banner heuristic covers the generators this supported projects actually
+ * runs without either assumption.
+ */
+
+type CookieSourceFile = {
+    path: string;
+    contents: string | Uint8Array;
+};
+/** Scan an immutable source snapshot with the same rules as Doctor's file scan. */
+declare function checkCookieCodecConformanceFiles(files: readonly CookieSourceFile[]): CheckResult[];
+
+export { type CheckResult, type CheckStatus, type DoctorEnv, type DoctorRun, type DoctorSummary, type RunDoctorOptions, checkCookieCodecConformanceFiles, runDoctor };

package/dist/doctor.d.ts

@@ -45,4 +45,44 @@ interface DoctorRun {
 }
 declare function runDoctor(options: RunDoctorOptions): Promise<DoctorRun>;
 
-export { type CheckResult, type CheckStatus, type DoctorEnv, type DoctorRun, type DoctorSummary, type RunDoctorOptions, runDoctor };
+/**
+ *cookie-codec conformance.
+ *
+ * Starter / consumer code must not domain-scope cookies on the shared
+ * origin. The SDK server cookie codec (`buildCookie` / `buildClearCookie`
+ * / `serializeSessionCookie` from `@cavuno/board/server`) mints host-only
+ * `__Host-` values; attaching those via `Set-Cookie` is the sanctioned
+ * path and is GREEN. Domain-scoped writes (raw `Set-Cookie` with
+ * `Domain=`, or `document.cookie = … Domain=`) are RED.
+ *
+ * Caveat: the doctor is accountability tooling,
+ * not a security boundary. Tenants remain identifiable paying customers
+ * with an audit trail; this check does not prevent determined abuse.
+ *
+ * Scope: application-authored source only. Generated output under `src/` is
+ * skipped (see GENERATED_DIRS / GENERATED_FILE / hasGeneratedBanner) —
+ * a tenant cannot fix a finding in a file their build regenerates, so
+ * flagging one is pure noise. The motivating case is Paraglide JS: its
+ * compiler writes `src/paraglide/**` (gitignored in the starter) and
+ * `runtime.js` contains a `document.cookie = … cookieDomain` write for
+ * Paraglide's own LOCALE cookie strategy — dead behind a
+ * `TREE_SHAKE_COOKIE_STRATEGY_USED` guard on a board compiled without
+ * the cookie strategy, and unfixable by the consumer either way.
+ *
+ * Why not `.gitignore`? It is the most correct signal, but parsing it
+ * faithfully (nested files, negations, precedence, dir-vs-path anchors)
+ * needs a dependency the SDK will not take, and shelling out to
+ * `git check-ignore` assumes both a git binary and a git working tree —
+ * neither holds for platform-built tenant projects. The pattern list
+ * plus the banner heuristic covers the generators this supported projects actually
+ * runs without either assumption.
+ */
+
+type CookieSourceFile = {
+    path: string;
+    contents: string | Uint8Array;
+};
+/** Scan an immutable source snapshot with the same rules as Doctor's file scan. */
+declare function checkCookieCodecConformanceFiles(files: readonly CookieSourceFile[]): CheckResult[];
+
+export { type CheckResult, type CheckStatus, type DoctorEnv, type DoctorRun, type DoctorSummary, type RunDoctorOptions, checkCookieCodecConformanceFiles, runDoctor };

package/dist/doctor.js

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/doctor/index.ts
 var doctor_exports = {};
 __export(doctor_exports, {
+  checkCookieCodecConformanceFiles: () => checkCookieCodecConformanceFiles,
   runDoctor: () => runDoctor
 });
 module.exports = __toCommonJS(doctor_exports);
@@ -351,9 +352,16 @@ function truncate(line, max = 120) {
   const t = line.trim();
   return t.length > max ? `${t.slice(0, max)}\u2026` : t;
 }
-function checkCookieCodecConformance(projectRoot) {
-  const srcDir = (0, import_node_path3.join)(projectRoot, "src");
-  if (!(0, import_node_fs3.existsSync)(srcDir)) {
+function isAppSourcePath(path) {
+  if (!path.startsWith("src/")) return false;
+  const parts = path.split("/");
+  const name = parts.at(-1);
+  return parts.slice(1, -1).every(
+    (part) => !part.startsWith(".") && part !== "node_modules" && !GENERATED_DIRS.has(part)
+  ) && !name.startsWith(".") && SOURCE_EXT2.test(name) && !GENERATED_FILE.test(name);
+}
+function checkCookieSourceText(files, hasSource, unreadable) {
+  if (!hasSource) {
     return [
       COOKIE(
         "skip",
@@ -361,33 +369,61 @@ function checkCookieCodecConformance(projectRoot) {
       )
     ];
   }
-  const files = [];
-  walkSourceFiles(srcDir, files);
   const findings = [];
-  for (const file of files) {
-    const rel = (0, import_node_path3.relative)(projectRoot, file).split("\\").join("/");
-    let text;
-    try {
-      text = (0, import_node_fs3.readFileSync)(file, "utf8");
-    } catch {
-      continue;
-    }
+  for (const { path, text } of files) {
     if (hasGeneratedBanner(text)) continue;
     const lines = text.split(/\r?\n/);
     for (let i = 0; i < lines.length; i += 1) {
       if (!isOffendingSink(lines, i)) continue;
-      findings.push(`${rel}:${i + 1} \u2014 ${truncate(lines[i])}`);
+      findings.push(`${path}:${i + 1} \u2014 ${truncate(lines[i])}`);
     }
   }
-  if (findings.length === 0) {
-    return [
-      COOKIE(
-        "pass",
-        "no domain-scoped Set-Cookie or document.cookie writes in app-authored src/ (generated output skipped)"
-      )
-    ];
+  if (findings.length > 0) {
+    return [COOKIE("fail", `${findings.join("; ")}; ${REMEDIATION}`)];
+  }
+  if (unreadable) {
+    return [COOKIE("skip", "one or more source files could not be read")];
+  }
+  return [
+    COOKIE(
+      "pass",
+      "no domain-scoped Set-Cookie or document.cookie writes in app-authored src/ (generated output skipped)"
+    )
+  ];
+}
+function checkCookieCodecConformanceFiles(files) {
+  const hasSource = files.some((file) => file.path.startsWith("src/"));
+  const textFiles = [];
+  let unreadable = false;
+  for (const file of files) {
+    if (!isAppSourcePath(file.path)) continue;
+    try {
+      textFiles.push({
+        path: file.path,
+        text: typeof file.contents === "string" ? file.contents : new TextDecoder("utf-8", { fatal: true }).decode(file.contents)
+      });
+    } catch {
+      unreadable = true;
+    }
+  }
+  return checkCookieSourceText(textFiles, hasSource, unreadable);
+}
+function checkCookieCodecConformance(projectRoot) {
+  const srcDir = (0, import_node_path3.join)(projectRoot, "src");
+  if (!(0, import_node_fs3.existsSync)(srcDir)) return checkCookieSourceText([], false, false);
+  const files = [];
+  walkSourceFiles(srcDir, files);
+  const textFiles = [];
+  let unreadable = false;
+  for (const file of files) {
+    const rel = (0, import_node_path3.relative)(projectRoot, file).split("\\").join("/");
+    try {
+      textFiles.push({ path: rel, text: (0, import_node_fs3.readFileSync)(file, "utf8") });
+    } catch {
+      unreadable = true;
+    }
   }
-  return [COOKIE("fail", `${findings.join("; ")}; ${REMEDIATION}`)];
+  return checkCookieSourceText(textFiles, true, unreadable);
 }
 
 // src/doctor/probe.ts
@@ -8841,5 +8877,6 @@ async function runDoctor(options) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  checkCookieCodecConformanceFiles,
   runDoctor
 });

package/dist/doctor.mjs

@@ -321,9 +321,16 @@ function truncate(line, max = 120) {
   const t = line.trim();
   return t.length > max ? `${t.slice(0, max)}\u2026` : t;
 }
-function checkCookieCodecConformance(projectRoot) {
-  const srcDir = join2(projectRoot, "src");
-  if (!existsSync2(srcDir)) {
+function isAppSourcePath(path) {
+  if (!path.startsWith("src/")) return false;
+  const parts = path.split("/");
+  const name = parts.at(-1);
+  return parts.slice(1, -1).every(
+    (part) => !part.startsWith(".") && part !== "node_modules" && !GENERATED_DIRS.has(part)
+  ) && !name.startsWith(".") && SOURCE_EXT2.test(name) && !GENERATED_FILE.test(name);
+}
+function checkCookieSourceText(files, hasSource, unreadable) {
+  if (!hasSource) {
     return [
       COOKIE(
         "skip",
@@ -331,33 +338,61 @@ function checkCookieCodecConformance(projectRoot) {
       )
     ];
   }
-  const files = [];
-  walkSourceFiles(srcDir, files);
   const findings = [];
-  for (const file of files) {
-    const rel = relative2(projectRoot, file).split("\\").join("/");
-    let text;
-    try {
-      text = readFileSync3(file, "utf8");
-    } catch {
-      continue;
-    }
+  for (const { path, text } of files) {
     if (hasGeneratedBanner(text)) continue;
     const lines = text.split(/\r?\n/);
     for (let i = 0; i < lines.length; i += 1) {
       if (!isOffendingSink(lines, i)) continue;
-      findings.push(`${rel}:${i + 1} \u2014 ${truncate(lines[i])}`);
+      findings.push(`${path}:${i + 1} \u2014 ${truncate(lines[i])}`);
     }
   }
-  if (findings.length === 0) {
-    return [
-      COOKIE(
-        "pass",
-        "no domain-scoped Set-Cookie or document.cookie writes in app-authored src/ (generated output skipped)"
-      )
-    ];
+  if (findings.length > 0) {
+    return [COOKIE("fail", `${findings.join("; ")}; ${REMEDIATION}`)];
+  }
+  if (unreadable) {
+    return [COOKIE("skip", "one or more source files could not be read")];
+  }
+  return [
+    COOKIE(
+      "pass",
+      "no domain-scoped Set-Cookie or document.cookie writes in app-authored src/ (generated output skipped)"
+    )
+  ];
+}
+function checkCookieCodecConformanceFiles(files) {
+  const hasSource = files.some((file) => file.path.startsWith("src/"));
+  const textFiles = [];
+  let unreadable = false;
+  for (const file of files) {
+    if (!isAppSourcePath(file.path)) continue;
+    try {
+      textFiles.push({
+        path: file.path,
+        text: typeof file.contents === "string" ? file.contents : new TextDecoder("utf-8", { fatal: true }).decode(file.contents)
+      });
+    } catch {
+      unreadable = true;
+    }
+  }
+  return checkCookieSourceText(textFiles, hasSource, unreadable);
+}
+function checkCookieCodecConformance(projectRoot) {
+  const srcDir = join2(projectRoot, "src");
+  if (!existsSync2(srcDir)) return checkCookieSourceText([], false, false);
+  const files = [];
+  walkSourceFiles(srcDir, files);
+  const textFiles = [];
+  let unreadable = false;
+  for (const file of files) {
+    const rel = relative2(projectRoot, file).split("\\").join("/");
+    try {
+      textFiles.push({ path: rel, text: readFileSync3(file, "utf8") });
+    } catch {
+      unreadable = true;
+    }
   }
-  return [COOKIE("fail", `${findings.join("; ")}; ${REMEDIATION}`)];
+  return checkCookieSourceText(textFiles, true, unreadable);
 }
 
 // src/doctor/probe.ts
@@ -8810,5 +8845,6 @@ async function runDoctor(options) {
   return { results, summary: summarize(results) };
 }
 export {
+  checkCookieCodecConformanceFiles,
   runDoctor
 };

package/dist/filters.d.mts

@@ -1,5 +1,5 @@
-import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-Cgh8dwXB.mjs';
-import './_spec-DBpKC6Rv.mjs';
+import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-Cg2d2oI4.mjs';
+import './_spec-C4T68Nnr.mjs';
 
 /**
  * `@cavuno/board/filters` — the canonical listing-filter vocabulary and URL

package/dist/filters.d.ts

@@ -1,5 +1,5 @@
-import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-DX_wDSzt.js';
-import './_spec-DBpKC6Rv.js';
+import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-3Md7CCMl.js';
+import './_spec-C4T68Nnr.js';
 
 /**
  * `@cavuno/board/filters` — the canonical listing-filter vocabulary and URL

package/dist/format.d.mts

@@ -1,7 +1,7 @@
-export { C as CurrencyDisplay, F as FormattedSalaryRange, J as JobBreadcrumb, N as NumberNotation, S as SalaryTimeframeInput, a as SalaryTimeframeValue, b as buildJobBreadcrumbs, f as formatSalaryRange, c as formatSalaryStat, d as formatSalaryStatRange, n as normalizeWebsiteUrl } from './breadcrumbs-BnYHHx40.mjs';
-import { C as CustomFieldDefinition } from './board-D6yRj3IN.mjs';
-import { C as CustomFieldValues } from './jobs-Cgh8dwXB.mjs';
-import './_spec-DBpKC6Rv.mjs';
+export { C as CurrencyDisplay, F as FormattedSalaryRange, J as JobBreadcrumb, N as NumberNotation, S as SalaryTimeframeInput, a as SalaryTimeframeValue, b as buildJobBreadcrumbs, f as formatSalaryRange, c as formatSalaryStat, d as formatSalaryStatRange, n as normalizeWebsiteUrl } from './breadcrumbs-f7KFSWnx.mjs';
+import { C as CustomFieldDefinition } from './board-CRgQjnrn.mjs';
+import { C as CustomFieldValues } from './jobs-Cg2d2oI4.mjs';
+import './_spec-C4T68Nnr.mjs';
 
 /**
  * Date display helpers in the board language (required leading parameter,

package/dist/format.d.ts

@@ -1,7 +1,7 @@
-export { C as CurrencyDisplay, F as FormattedSalaryRange, J as JobBreadcrumb, N as NumberNotation, S as SalaryTimeframeInput, a as SalaryTimeframeValue, b as buildJobBreadcrumbs, f as formatSalaryRange, c as formatSalaryStat, d as formatSalaryStatRange, n as normalizeWebsiteUrl } from './breadcrumbs-B5qrRrgN.js';
-import { C as CustomFieldDefinition } from './board-BpOyLLl_.js';
-import { C as CustomFieldValues } from './jobs-DX_wDSzt.js';
-import './_spec-DBpKC6Rv.js';
+export { C as CurrencyDisplay, F as FormattedSalaryRange, J as JobBreadcrumb, N as NumberNotation, S as SalaryTimeframeInput, a as SalaryTimeframeValue, b as buildJobBreadcrumbs, f as formatSalaryRange, c as formatSalaryStat, d as formatSalaryStatRange, n as normalizeWebsiteUrl } from './breadcrumbs-C_jNh4xd.js';
+import { C as CustomFieldDefinition } from './board-2UfZ7fZk.js';
+import { C as CustomFieldValues } from './jobs-3Md7CCMl.js';
+import './_spec-C4T68Nnr.js';
 
 /**
  * Date display helpers in the board language (required leading parameter,

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { S as Schemas, c as components } from './_spec-DBpKC6Rv.mjs';
-import { F as FetchOptions, S as StorageMode, B as BoardRequest, A as Awaitable, L as Logger, a as BoardClient, b as SearchSuggestQuery } from './search-DsR5-O8E.mjs';
-export { c as ACCESS_TOKEN_KEY, d as BOARD_ACCESS_GRANT_KEY, C as CompanySuggestion, e as CustomStorage, M as MarketSuggestion, R as REFRESH_TOKEN_KEY, f as SearchSuggestType, g as SuggestResult, h as SuggestionItem, T as TermSuggestion } from './search-DsR5-O8E.mjs';
-import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery } from './board-D6yRj3IN.mjs';
-export { B as BoardCustomEmploymentType, j as BoardFormBuiltinField, k as BoardFormField, l as BoardFormLayout, m as BoardFormLockReason, n as BoardJobFormField, o as BoardProfileFormField, p as BoardRoleSignIn, q as BoardSignInSsoConnection, a as CompanyCategorySalary, r as CompanyMarket, s as CompanyMarketRef, b as CompanySalary, t as CompanySalarySummary, C as CustomFieldDefinition, u as CustomFieldOption, v as CustomFieldType, L as LocationSalaryDetail, w as LocationSkillsIndex, x as LocationTitlesIndex, P as PublicBoard, y as PublicBoardAds, z as PublicBoardAnalytics, A as PublicBoardFeatures, D as PublicBoardJobForm, E as PublicBoardSignIn, F as PublicCompany, G as PublicCompanyDetail, H as PublicCompanyMembership, I as SalaryCompany, J as SalaryLocation, K as SalarySkill, M as SalaryTitle, N as SkillLocationSalary, O as SkillLocationsIndex, S as SkillSalaryDetail, Q as TitleLocationSalary, R as TitleLocationsIndex, T as TitleSalaryDetail } from './board-D6yRj3IN.mjs';
-export { B as BoardSeo } from './seo-DbzhNmAY.mjs';
-import { R as RemoteOption, E as EmploymentType, S as Seniority, a as CustomFieldFilter, O as ObjectReferenceFilter, L as ListEnvelope, b as JobCollectionChoiceQuery, c as JobsListQuery, d as JobCardListEnvelope, e as JobsSearchBody, f as JobCardSearchEnvelope, g as JobsSimilarQuery, h as SearchEnvelope } from './jobs-Cgh8dwXB.mjs';
-export { i as CustomFieldValue, C as CustomFieldValues, j as CustomFilterValue, k as EducationRequirement, l as JobCatalogPagination, m as JobCollectionChoiceList, n as JobCollectionFieldDefinition, o as JobCompany, p as JobCustomEmploymentType, J as JobSort, q as OfficeLocation, r as OffsetPagination, P as PublicJob, s as PublicJobCard, t as RelatedSearch, u as RemotePermit, v as RemoteTimezone, w as ResolvedJobCollectionField, x as StorefrontPagination } from './jobs-Cgh8dwXB.mjs';
-import { a as BlogPostsListQuery, b as BlogSimilarQuery, c as BlogSearchBody } from './blog-DXCzYj2q.mjs';
-export { B as BlogAuthorEmbed, d as BlogTagEmbed, e as PublicBlogAdjacentPosts, f as PublicBlogAuthor, g as PublicBlogPost, P as PublicBlogPostSummary, h as PublicBlogTag } from './blog-DXCzYj2q.mjs';
+import { S as Schemas, c as components } from './_spec-C4T68Nnr.mjs';
+import { F as FetchOptions, S as StorageMode, B as BoardRequest, A as Awaitable, L as Logger, a as BoardClient, b as SearchSuggestQuery } from './search-CyDzceiR.mjs';
+export { c as ACCESS_TOKEN_KEY, d as BOARD_ACCESS_GRANT_KEY, C as CompanySuggestion, e as CustomStorage, M as MarketSuggestion, R as REFRESH_TOKEN_KEY, f as SearchSuggestType, g as SuggestResult, h as SuggestionItem, T as TermSuggestion } from './search-CyDzceiR.mjs';
+import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery } from './board-CRgQjnrn.mjs';
+export { B as BoardCustomEmploymentType, j as BoardFormBuiltinField, k as BoardFormField, l as BoardFormLayout, m as BoardFormLockReason, n as BoardJobFormField, o as BoardProfileFormField, p as BoardRoleSignIn, q as BoardSignInSsoConnection, a as CompanyCategorySalary, r as CompanyMarket, s as CompanyMarketRef, b as CompanySalary, t as CompanySalarySummary, C as CustomFieldDefinition, u as CustomFieldOption, v as CustomFieldType, L as LocationSalaryDetail, w as LocationSkillsIndex, x as LocationTitlesIndex, P as PublicBoard, y as PublicBoardAds, z as PublicBoardAnalytics, A as PublicBoardFeatures, D as PublicBoardJobForm, E as PublicBoardSignIn, F as PublicCompany, G as PublicCompanyDetail, H as PublicCompanyMembership, I as SalaryCompany, J as SalaryLocation, K as SalarySkill, M as SalaryTitle, N as SkillLocationSalary, O as SkillLocationsIndex, S as SkillSalaryDetail, Q as TitleLocationSalary, R as TitleLocationsIndex, T as TitleSalaryDetail } from './board-CRgQjnrn.mjs';
+export { B as BoardSeo } from './seo-DuWLAh1M.mjs';
+import { R as RemoteOption, E as EmploymentType, S as Seniority, a as CustomFieldFilter, O as ObjectReferenceFilter, L as ListEnvelope, b as JobCollectionChoiceQuery, c as JobsListQuery, d as JobCardListEnvelope, e as JobsSearchBody, f as JobCardSearchEnvelope, g as JobsSimilarQuery, h as SearchEnvelope } from './jobs-Cg2d2oI4.mjs';
+export { i as CustomFieldValue, C as CustomFieldValues, j as CustomFilterValue, k as EducationRequirement, l as JobCatalogPagination, m as JobCollectionChoiceList, n as JobCollectionFieldDefinition, o as JobCompany, p as JobCustomEmploymentType, J as JobSort, q as OfficeLocation, r as OffsetPagination, P as PublicJob, s as PublicJobCard, t as RelatedSearch, u as RemotePermit, v as RemoteTimezone, w as ResolvedJobCollectionField, x as StorefrontPagination } from './jobs-Cg2d2oI4.mjs';
+import { a as BlogPostsListQuery, b as BlogSimilarQuery, c as BlogSearchBody } from './blog-bQmqKnw2.mjs';
+export { B as BlogAuthorEmbed, d as BlogTagEmbed, e as PublicBlogAdjacentPosts, f as PublicBlogAuthor, g as PublicBlogPost, P as PublicBlogPostSummary, h as PublicBlogTag } from './blog-bQmqKnw2.mjs';
 
 /**
  * Well-known `<domain>_<snake_reason>` codes the Board API sends, grouped by
@@ -202,7 +202,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "4.35.0";
+declare const SDK_VERSION = "4.36.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {
@@ -1195,7 +1195,9 @@ declare function createBoardClient(options: CreateBoardClientOptions): {
     client: BoardClient;
     /**
      * Board context — identity, brand (`logoUrl` + favicon `icons`), language,
-     * features, analytics, and AdSense (`ads.enabled`, `ads.clientId`, and `ads.defaultSlotId`).
+     * features, analytics, and AdSense (`ads.enabled`, `ads.clientId`, `ads.defaultSlotId`, and
+     * `ads.googleConsentMessage`, which says whether EEA/UK/CH visitors get Google's consent
+     * message instead of the board's cookie banner).
      * Per-placement slot ids are not on this resource.
      *
      * @example
@@ -1259,6 +1261,7 @@ declare function createBoardClient(options: CreateBoardClientOptions): {
             enabled: boolean;
             clientId: string | null;
             defaultSlotId: string | null;
+            googleConsentMessage: boolean;
         };
         customFields: {
             job: components["schemas"]["CustomFieldDefinition"][];

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { S as Schemas, c as components } from './_spec-DBpKC6Rv.js';
-import { F as FetchOptions, S as StorageMode, B as BoardRequest, A as Awaitable, L as Logger, a as BoardClient, b as SearchSuggestQuery } from './search-DOmwaBud.js';
-export { c as ACCESS_TOKEN_KEY, d as BOARD_ACCESS_GRANT_KEY, C as CompanySuggestion, e as CustomStorage, M as MarketSuggestion, R as REFRESH_TOKEN_KEY, f as SearchSuggestType, g as SuggestResult, h as SuggestionItem, T as TermSuggestion } from './search-DOmwaBud.js';
-import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery } from './board-BpOyLLl_.js';
-export { B as BoardCustomEmploymentType, j as BoardFormBuiltinField, k as BoardFormField, l as BoardFormLayout, m as BoardFormLockReason, n as BoardJobFormField, o as BoardProfileFormField, p as BoardRoleSignIn, q as BoardSignInSsoConnection, a as CompanyCategorySalary, r as CompanyMarket, s as CompanyMarketRef, b as CompanySalary, t as CompanySalarySummary, C as CustomFieldDefinition, u as CustomFieldOption, v as CustomFieldType, L as LocationSalaryDetail, w as LocationSkillsIndex, x as LocationTitlesIndex, P as PublicBoard, y as PublicBoardAds, z as PublicBoardAnalytics, A as PublicBoardFeatures, D as PublicBoardJobForm, E as PublicBoardSignIn, F as PublicCompany, G as PublicCompanyDetail, H as PublicCompanyMembership, I as SalaryCompany, J as SalaryLocation, K as SalarySkill, M as SalaryTitle, N as SkillLocationSalary, O as SkillLocationsIndex, S as SkillSalaryDetail, Q as TitleLocationSalary, R as TitleLocationsIndex, T as TitleSalaryDetail } from './board-BpOyLLl_.js';
-export { B as BoardSeo } from './seo-DtLE8C9q.js';
-import { R as RemoteOption, E as EmploymentType, S as Seniority, a as CustomFieldFilter, O as ObjectReferenceFilter, L as ListEnvelope, b as JobCollectionChoiceQuery, c as JobsListQuery, d as JobCardListEnvelope, e as JobsSearchBody, f as JobCardSearchEnvelope, g as JobsSimilarQuery, h as SearchEnvelope } from './jobs-DX_wDSzt.js';
-export { i as CustomFieldValue, C as CustomFieldValues, j as CustomFilterValue, k as EducationRequirement, l as JobCatalogPagination, m as JobCollectionChoiceList, n as JobCollectionFieldDefinition, o as JobCompany, p as JobCustomEmploymentType, J as JobSort, q as OfficeLocation, r as OffsetPagination, P as PublicJob, s as PublicJobCard, t as RelatedSearch, u as RemotePermit, v as RemoteTimezone, w as ResolvedJobCollectionField, x as StorefrontPagination } from './jobs-DX_wDSzt.js';
-import { a as BlogPostsListQuery, b as BlogSimilarQuery, c as BlogSearchBody } from './blog-Bk6oHqIR.js';
-export { B as BlogAuthorEmbed, d as BlogTagEmbed, e as PublicBlogAdjacentPosts, f as PublicBlogAuthor, g as PublicBlogPost, P as PublicBlogPostSummary, h as PublicBlogTag } from './blog-Bk6oHqIR.js';
+import { S as Schemas, c as components } from './_spec-C4T68Nnr.js';
+import { F as FetchOptions, S as StorageMode, B as BoardRequest, A as Awaitable, L as Logger, a as BoardClient, b as SearchSuggestQuery } from './search-15gcqPyt.js';
+export { c as ACCESS_TOKEN_KEY, d as BOARD_ACCESS_GRANT_KEY, C as CompanySuggestion, e as CustomStorage, M as MarketSuggestion, R as REFRESH_TOKEN_KEY, f as SearchSuggestType, g as SuggestResult, h as SuggestionItem, T as TermSuggestion } from './search-15gcqPyt.js';
+import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery } from './board-2UfZ7fZk.js';
+export { B as BoardCustomEmploymentType, j as BoardFormBuiltinField, k as BoardFormField, l as BoardFormLayout, m as BoardFormLockReason, n as BoardJobFormField, o as BoardProfileFormField, p as BoardRoleSignIn, q as BoardSignInSsoConnection, a as CompanyCategorySalary, r as CompanyMarket, s as CompanyMarketRef, b as CompanySalary, t as CompanySalarySummary, C as CustomFieldDefinition, u as CustomFieldOption, v as CustomFieldType, L as LocationSalaryDetail, w as LocationSkillsIndex, x as LocationTitlesIndex, P as PublicBoard, y as PublicBoardAds, z as PublicBoardAnalytics, A as PublicBoardFeatures, D as PublicBoardJobForm, E as PublicBoardSignIn, F as PublicCompany, G as PublicCompanyDetail, H as PublicCompanyMembership, I as SalaryCompany, J as SalaryLocation, K as SalarySkill, M as SalaryTitle, N as SkillLocationSalary, O as SkillLocationsIndex, S as SkillSalaryDetail, Q as TitleLocationSalary, R as TitleLocationsIndex, T as TitleSalaryDetail } from './board-2UfZ7fZk.js';
+export { B as BoardSeo } from './seo-CON8CLIF.js';
+import { R as RemoteOption, E as EmploymentType, S as Seniority, a as CustomFieldFilter, O as ObjectReferenceFilter, L as ListEnvelope, b as JobCollectionChoiceQuery, c as JobsListQuery, d as JobCardListEnvelope, e as JobsSearchBody, f as JobCardSearchEnvelope, g as JobsSimilarQuery, h as SearchEnvelope } from './jobs-3Md7CCMl.js';
+export { i as CustomFieldValue, C as CustomFieldValues, j as CustomFilterValue, k as EducationRequirement, l as JobCatalogPagination, m as JobCollectionChoiceList, n as JobCollectionFieldDefinition, o as JobCompany, p as JobCustomEmploymentType, J as JobSort, q as OfficeLocation, r as OffsetPagination, P as PublicJob, s as PublicJobCard, t as RelatedSearch, u as RemotePermit, v as RemoteTimezone, w as ResolvedJobCollectionField, x as StorefrontPagination } from './jobs-3Md7CCMl.js';
+import { a as BlogPostsListQuery, b as BlogSimilarQuery, c as BlogSearchBody } from './blog-_LtV-JaY.js';
+export { B as BlogAuthorEmbed, d as BlogTagEmbed, e as PublicBlogAdjacentPosts, f as PublicBlogAuthor, g as PublicBlogPost, P as PublicBlogPostSummary, h as PublicBlogTag } from './blog-_LtV-JaY.js';
 
 /**
  * Well-known `<domain>_<snake_reason>` codes the Board API sends, grouped by
@@ -202,7 +202,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "4.35.0";
+declare const SDK_VERSION = "4.36.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {
@@ -1195,7 +1195,9 @@ declare function createBoardClient(options: CreateBoardClientOptions): {
     client: BoardClient;
     /**
      * Board context — identity, brand (`logoUrl` + favicon `icons`), language,
-     * features, analytics, and AdSense (`ads.enabled`, `ads.clientId`, and `ads.defaultSlotId`).
+     * features, analytics, and AdSense (`ads.enabled`, `ads.clientId`, `ads.defaultSlotId`, and
+     * `ads.googleConsentMessage`, which says whether EEA/UK/CH visitors get Google's consent
+     * message instead of the board's cookie banner).
      * Per-placement slot ids are not on this resource.
      *
      * @example
@@ -1259,6 +1261,7 @@ declare function createBoardClient(options: CreateBoardClientOptions): {
             enabled: boolean;
             clientId: string | null;
             defaultSlotId: string | null;
+            googleConsentMessage: boolean;
         };
         customFields: {
             job: components["schemas"]["CustomFieldDefinition"][];

package/dist/index.js

@@ -403,7 +403,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.35.0";
+var SDK_VERSION = "4.36.0";
 
 // src/client.ts
 function isRawBody(body) {
@@ -3924,7 +3924,9 @@ function createBoardClient(options) {
     client,
     /**
      * Board context — identity, brand (`logoUrl` + favicon `icons`), language,
-     * features, analytics, and AdSense (`ads.enabled`, `ads.clientId`, and `ads.defaultSlotId`).
+     * features, analytics, and AdSense (`ads.enabled`, `ads.clientId`, `ads.defaultSlotId`, and
+     * `ads.googleConsentMessage`, which says whether EEA/UK/CH visitors get Google's consent
+     * message instead of the board's cookie banner).
      * Per-placement slot ids are not on this resource.
      *
      * @example

package/dist/index.mjs

@@ -46,7 +46,7 @@ function toSearchParams(query) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.35.0";
+var SDK_VERSION = "4.36.0";
 
 // src/client.ts
 function isRawBody(body) {
@@ -3537,7 +3537,9 @@ function createBoardClient(options) {
     client,
     /**
      * Board context — identity, brand (`logoUrl` + favicon `icons`), language,
-     * features, analytics, and AdSense (`ads.enabled`, `ads.clientId`, and `ads.defaultSlotId`).
+     * features, analytics, and AdSense (`ads.enabled`, `ads.clientId`, `ads.defaultSlotId`, and
+     * `ads.googleConsentMessage`, which says whether EEA/UK/CH visitors get Google's consent
+     * message instead of the board's cookie banner).
      * Per-placement slot ids are not on this resource.
      *
      * @example

package/dist/{jobs-DX_wDSzt.d.ts → jobs-3Md7CCMl.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DBpKC6Rv.js';
+import { S as Schemas } from './_spec-C4T68Nnr.js';
 
 /**
  * Optional pagination metadata returned by Board API list operations.

package/dist/{jobs-Cgh8dwXB.d.mts → jobs-Cg2d2oI4.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DBpKC6Rv.mjs';
+import { S as Schemas } from './_spec-C4T68Nnr.mjs';
 
 /**
  * Optional pagination metadata returned by Board API list operations.

package/dist/{search-DOmwaBud.d.ts → search-15gcqPyt.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DBpKC6Rv.js';
+import { S as Schemas } from './_spec-C4T68Nnr.js';
 
 type Awaitable<T> = T | Promise<T>;
 /**

package/dist/{search-DsR5-O8E.d.mts → search-CyDzceiR.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DBpKC6Rv.mjs';
+import { S as Schemas } from './_spec-C4T68Nnr.mjs';
 
 type Awaitable<T> = T | Promise<T>;
 /**

package/dist/{seo-DtLE8C9q.d.ts → seo-CON8CLIF.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DBpKC6Rv.js';
+import { S as Schemas } from './_spec-C4T68Nnr.js';
 
 /**
  * The public SEO-infra payload (`board.seo()`) — platform infrastructure a

package/dist/{seo-DbzhNmAY.d.mts → seo-DuWLAh1M.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DBpKC6Rv.mjs';
+import { S as Schemas } from './_spec-C4T68Nnr.mjs';
 
 /**
  * The public SEO-infra payload (`board.seo()`) — platform infrastructure a

package/dist/seo-files.d.mts

@@ -1,5 +1,5 @@
-import { B as BoardSeo } from './seo-DbzhNmAY.mjs';
-import './_spec-DBpKC6Rv.mjs';
+import { B as BoardSeo } from './seo-DuWLAh1M.mjs';
+import './_spec-C4T68Nnr.mjs';
 
 /**
  * `@cavuno/board/seo-files` — platform-owned crawler/identity file bodies

package/dist/seo-files.d.ts

@@ -1,5 +1,5 @@
-import { B as BoardSeo } from './seo-DtLE8C9q.js';
-import './_spec-DBpKC6Rv.js';
+import { B as BoardSeo } from './seo-CON8CLIF.js';
+import './_spec-C4T68Nnr.js';
 
 /**
  * `@cavuno/board/seo-files` — platform-owned crawler/identity file bodies

package/dist/seo.d.mts

@@ -1,9 +1,9 @@
-import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-DXCzYj2q.mjs';
-import { e as JsonLdObject } from './breadcrumbs-BnYHHx40.mjs';
-export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-BnYHHx40.mjs';
-import './_spec-DBpKC6Rv.mjs';
-import './board-D6yRj3IN.mjs';
-import './jobs-Cgh8dwXB.mjs';
+import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-bQmqKnw2.mjs';
+import { e as JsonLdObject } from './breadcrumbs-f7KFSWnx.mjs';
+export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-f7KFSWnx.mjs';
+import './_spec-C4T68Nnr.mjs';
+import './board-CRgQjnrn.mjs';
+import './jobs-Cg2d2oI4.mjs';
 
 /**
  * Blog structured data on the `@cavuno/board` wire types, transcribed from

package/dist/seo.d.ts

@@ -1,9 +1,9 @@
-import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-Bk6oHqIR.js';
-import { e as JsonLdObject } from './breadcrumbs-B5qrRrgN.js';
-export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-B5qrRrgN.js';
-import './_spec-DBpKC6Rv.js';
-import './board-BpOyLLl_.js';
-import './jobs-DX_wDSzt.js';
+import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-_LtV-JaY.js';
+import { e as JsonLdObject } from './breadcrumbs-C_jNh4xd.js';
+export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-C_jNh4xd.js';
+import './_spec-C4T68Nnr.js';
+import './board-2UfZ7fZk.js';
+import './jobs-3Md7CCMl.js';
 
 /**
  * Blog structured data on the `@cavuno/board` wire types, transcribed from

package/dist/server.d.mts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.mjs';
-import './_spec-DBpKC6Rv.mjs';
-import './search-DsR5-O8E.mjs';
-import './board-D6yRj3IN.mjs';
-import './jobs-Cgh8dwXB.mjs';
-import './seo-DbzhNmAY.mjs';
-import './blog-DXCzYj2q.mjs';
+import './_spec-C4T68Nnr.mjs';
+import './search-CyDzceiR.mjs';
+import './board-CRgQjnrn.mjs';
+import './jobs-Cg2d2oI4.mjs';
+import './seo-DuWLAh1M.mjs';
+import './blog-bQmqKnw2.mjs';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it