@cavuno/board 4.58.0 → 4.59.0

package/dist/filters.d.ts

@@ -1,5 +1,5 @@
-import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-DodvFXH2.js';
-import './_spec-DIzdOWz7.js';
+import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-Cfmfxt86.js';
+import './_spec-bmTwonT1.js';
 
 /**
  * `@cavuno/board/filters` — the canonical listing-filter vocabulary and URL

package/dist/format.d.mts

@@ -1,7 +1,7 @@
-export { C as CurrencyDisplay, F as FormattedSalaryRange, J as JobBreadcrumb, N as NumberNotation, S as SalaryTimeframeInput, a as SalaryTimeframeValue, b as buildJobBreadcrumbs, f as formatSalaryRange, c as formatSalaryStat, d as formatSalaryStatRange, n as normalizeWebsiteUrl } from './breadcrumbs-zYG4xzpC.mjs';
-import { C as CustomFieldDefinition } from './board-D3ByAGAb.mjs';
-import { C as CustomFieldValues } from './jobs-nA2K33Nu.mjs';
-import './_spec-DIzdOWz7.mjs';
+export { C as CurrencyDisplay, F as FormattedSalaryRange, J as JobBreadcrumb, N as NumberNotation, S as SalaryTimeframeInput, a as SalaryTimeframeValue, b as buildJobBreadcrumbs, f as formatSalaryRange, c as formatSalaryStat, d as formatSalaryStatRange, n as normalizeWebsiteUrl } from './breadcrumbs-WferORs2.mjs';
+import { C as CustomFieldDefinition } from './board-BrJfw_S7.mjs';
+import { C as CustomFieldValues } from './jobs-DmrG_cGZ.mjs';
+import './_spec-bmTwonT1.mjs';
 
 /**
  * Date display helpers in the board language (required leading parameter,
@@ -84,6 +84,9 @@ declare function countryOptions(language: string): CountryOption[];
  * with the board locale (`Intl.NumberFormat`, Yes/No chrome). Pre-stringifying
  * numbers would ship `kind: 'text'` and foreclose locale-aware formatting.
  *
+ * Rich text preserves API-sanitized HTML as `kind: 'rich_text'`. Render that
+ * variant as sanitized HTML; continue escaping plain `kind: 'text'` values.
+ *
  * Multi-select stays an array of resolved labels (`kind: 'multi_select'`).
  * Pre-joining with `Intl.ListFormat` would ship `kind: 'text'` and foreclose
  * locale-aware **list** formatting (short style, disjunction, separate chips)
@@ -101,6 +104,11 @@ type CustomFieldDisplayEntry = {
     label: string;
     kind: 'text';
     value: string;
+} | {
+    key: string;
+    label: string;
+    kind: 'rich_text';
+    value: string;
 } | {
     key: string;
     label: string;

package/dist/format.d.ts

@@ -1,7 +1,7 @@
-export { C as CurrencyDisplay, F as FormattedSalaryRange, J as JobBreadcrumb, N as NumberNotation, S as SalaryTimeframeInput, a as SalaryTimeframeValue, b as buildJobBreadcrumbs, f as formatSalaryRange, c as formatSalaryStat, d as formatSalaryStatRange, n as normalizeWebsiteUrl } from './breadcrumbs-aCKRBNWX.js';
-import { C as CustomFieldDefinition } from './board-leXc6_BM.js';
-import { C as CustomFieldValues } from './jobs-DodvFXH2.js';
-import './_spec-DIzdOWz7.js';
+export { C as CurrencyDisplay, F as FormattedSalaryRange, J as JobBreadcrumb, N as NumberNotation, S as SalaryTimeframeInput, a as SalaryTimeframeValue, b as buildJobBreadcrumbs, f as formatSalaryRange, c as formatSalaryStat, d as formatSalaryStatRange, n as normalizeWebsiteUrl } from './breadcrumbs-NG9_miP6.js';
+import { C as CustomFieldDefinition } from './board-Bdc--f9u.js';
+import { C as CustomFieldValues } from './jobs-Cfmfxt86.js';
+import './_spec-bmTwonT1.js';
 
 /**
  * Date display helpers in the board language (required leading parameter,
@@ -84,6 +84,9 @@ declare function countryOptions(language: string): CountryOption[];
  * with the board locale (`Intl.NumberFormat`, Yes/No chrome). Pre-stringifying
  * numbers would ship `kind: 'text'` and foreclose locale-aware formatting.
  *
+ * Rich text preserves API-sanitized HTML as `kind: 'rich_text'`. Render that
+ * variant as sanitized HTML; continue escaping plain `kind: 'text'` values.
+ *
  * Multi-select stays an array of resolved labels (`kind: 'multi_select'`).
  * Pre-joining with `Intl.ListFormat` would ship `kind: 'text'` and foreclose
  * locale-aware **list** formatting (short style, disjunction, separate chips)
@@ -101,6 +104,11 @@ type CustomFieldDisplayEntry = {
     label: string;
     kind: 'text';
     value: string;
+} | {
+    key: string;
+    label: string;
+    kind: 'rich_text';
+    value: string;
 } | {
     key: string;
     label: string;

package/dist/format.js

@@ -811,7 +811,12 @@ function resolveCustomFieldDisplay(language, definitions, values) {
     }
     const value = renderTextValue(def, raw);
     if (value !== null) {
-      entries.push({ key: def.key, label: def.label, kind: "text", value });
+      entries.push({
+        key: def.key,
+        label: def.label,
+        kind: def.type === "rich_text" ? "rich_text" : "text",
+        value
+      });
     }
   }
   return entries;

package/dist/format.mjs

@@ -475,7 +475,12 @@ function resolveCustomFieldDisplay(language, definitions, values) {
     }
     const value = renderTextValue(def, raw);
     if (value !== null) {
-      entries.push({ key: def.key, label: def.label, kind: "text", value });
+      entries.push({
+        key: def.key,
+        label: def.label,
+        kind: def.type === "rich_text" ? "rich_text" : "text",
+        value
+      });
     }
   }
   return entries;

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { S as Schemas, c as components } from './_spec-DIzdOWz7.mjs';
-import { F as FetchOptions, S as StorageMode, B as BoardRequest, A as Awaitable, L as Logger, a as BoardClient, b as SearchSuggestQuery } from './search-8kX6OW03.mjs';
-export { c as ACCESS_TOKEN_KEY, d as BOARD_ACCESS_GRANT_KEY, C as CompanySuggestion, e as CustomStorage, M as MarketSuggestion, R as REFRESH_TOKEN_KEY, f as SearchSuggestType, g as SuggestResult, h as SuggestionItem, T as TermSuggestion } from './search-8kX6OW03.mjs';
-import { L as ListEnvelope, R as RemoteOption, E as EmploymentType, S as Seniority, a as JobCapability, b as CustomFieldFilter, O as ObjectReferenceFilter, c as JobCollectionChoiceQuery, d as JobsListQuery, e as JobCardListEnvelope, f as JobRetrieveQuery, g as JobsSearchBody, h as JobCardSearchEnvelope, i as JobsSimilarQuery, j as SearchEnvelope } from './jobs-nA2K33Nu.mjs';
-export { k as CustomFieldValue, C as CustomFieldValues, l as CustomFilterValue, m as EducationRequirement, n as JobCatalogPagination, o as JobCollectionChoiceList, p as JobCollectionFieldDefinition, q as JobCompany, r as JobCustomEmploymentType, J as JobSort, s as OfficeLocation, t as OffsetPagination, P as PublicJob, u as PublicJobCard, v as RelatedSearch, w as RemotePermit, x as RemoteTimezone, y as ResolvedJobCollectionField, z as StorefrontPagination } from './jobs-nA2K33Nu.mjs';
-import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, b as CompanySalary } from './board-D3ByAGAb.mjs';
-export { B as BoardCustomEmploymentType, j as BoardFormBuiltinField, k as BoardFormField, l as BoardFormLayout, m as BoardFormLockReason, n as BoardJobFormField, o as BoardProfileFormField, p as BoardRoleSignIn, q as BoardSignInSsoConnection, a as CompanyCategorySalary, r as CompanyMarket, s as CompanyMarketRef, t as CompanySalarySummary, C as CustomFieldDefinition, u as CustomFieldOption, v as CustomFieldType, L as LocationSalaryDetail, w as LocationSkillsIndex, x as LocationTitlesIndex, P as PublicBoard, y as PublicBoardAds, z as PublicBoardAnalytics, A as PublicBoardFeatures, D as PublicBoardJobForm, E as PublicBoardSignIn, F as PublicCompany, G as PublicCompanyDetail, H as PublicCompanyMembership, I as SalaryCompany, J as SalaryLocation, K as SalarySkill, M as SalaryTitle, N as SkillLocationSalary, O as SkillLocationsIndex, S as SkillSalaryDetail, Q as TitleLocationSalary, R as TitleLocationsIndex, T as TitleSalaryDetail } from './board-D3ByAGAb.mjs';
-export { B as BoardSeo } from './seo-Bn5gQY8t.mjs';
-import { a as BlogPostsListQuery, b as BlogSimilarQuery, c as BlogSearchBody } from './blog-DgbGOmzW.mjs';
-export { B as BlogAuthorEmbed, d as BlogTagEmbed, e as PublicBlogAdjacentPosts, f as PublicBlogAuthor, g as PublicBlogPost, P as PublicBlogPostSummary, h as PublicBlogTag } from './blog-DgbGOmzW.mjs';
+import { S as Schemas, c as components } from './_spec-bmTwonT1.mjs';
+import { F as FetchOptions, S as StorageMode, B as BoardRequest, A as Awaitable, L as Logger, a as BoardClient, b as SearchSuggestQuery } from './search-CcCXc47H.mjs';
+export { c as ACCESS_TOKEN_KEY, d as BOARD_ACCESS_GRANT_KEY, C as CompanySuggestion, e as CustomStorage, M as MarketSuggestion, R as REFRESH_TOKEN_KEY, f as SearchSuggestType, g as SuggestResult, h as SuggestionItem, T as TermSuggestion } from './search-CcCXc47H.mjs';
+import { L as ListEnvelope, R as RemoteOption, E as EmploymentType, S as Seniority, a as JobCapability, b as CustomFieldFilter, O as ObjectReferenceFilter, c as JobCollectionChoiceQuery, d as JobsListQuery, e as JobCardListEnvelope, f as JobRetrieveQuery, g as JobsSearchBody, h as JobCardSearchEnvelope, i as JobsSimilarQuery, j as SearchEnvelope } from './jobs-DmrG_cGZ.mjs';
+export { k as CustomFieldValue, C as CustomFieldValues, l as CustomFilterValue, m as EducationRequirement, n as JobCatalogPagination, o as JobCollectionChoiceList, p as JobCollectionFieldDefinition, q as JobCompany, r as JobCustomEmploymentType, J as JobSort, s as OfficeLocation, t as OffsetPagination, P as PublicJob, u as PublicJobCard, v as RelatedSearch, w as RemotePermit, x as RemoteTimezone, y as ResolvedJobCollectionField, z as StorefrontPagination } from './jobs-DmrG_cGZ.mjs';
+import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, b as CompanySalary } from './board-BrJfw_S7.mjs';
+export { B as BoardCustomEmploymentType, j as BoardFormBuiltinField, k as BoardFormField, l as BoardFormLayout, m as BoardFormLockReason, n as BoardJobFormField, o as BoardProfileFormField, p as BoardRoleSignIn, q as BoardSignInSsoConnection, a as CompanyCategorySalary, r as CompanyMarket, s as CompanyMarketRef, t as CompanySalarySummary, C as CustomFieldDefinition, u as CustomFieldOption, v as CustomFieldType, L as LocationSalaryDetail, w as LocationSkillsIndex, x as LocationTitlesIndex, P as PublicBoard, y as PublicBoardAds, z as PublicBoardAnalytics, A as PublicBoardFeatures, D as PublicBoardJobForm, E as PublicBoardSignIn, F as PublicCompany, G as PublicCompanyDetail, H as PublicCompanyMembership, I as SalaryCompany, J as SalaryLocation, K as SalarySkill, M as SalaryTitle, N as SkillLocationSalary, O as SkillLocationsIndex, S as SkillSalaryDetail, Q as TitleLocationSalary, R as TitleLocationsIndex, T as TitleSalaryDetail } from './board-BrJfw_S7.mjs';
+export { B as BoardSeo } from './seo-DSRRhklF.mjs';
+import { a as BlogPostsListQuery, b as BlogSimilarQuery, c as BlogSearchBody } from './blog-2rj7bfEp.mjs';
+export { B as BlogAuthorEmbed, d as BlogTagEmbed, e as PublicBlogAdjacentPosts, f as PublicBlogAuthor, g as PublicBlogPost, P as PublicBlogPostSummary, h as PublicBlogTag } from './blog-2rj7bfEp.mjs';
 
 /**
  * Well-known `<domain>_<snake_reason>` codes the Board API sends, grouped by
@@ -202,7 +202,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "4.58.0";
+declare const SDK_VERSION = "4.59.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {
@@ -853,6 +853,8 @@ type RequestMagicLinkBody = Schemas['BoardAuthRequestMagicLinkBody'];
 type ConsumeMagicLinkBody = Schemas['BoardAuthConsumeMagicLinkBody'];
 type OAuthProvider = 'google' | 'linkedin';
 type OAuthAuthorizationQuery = {
+    /** SHA-256 hex of a random secret retained for the initiating browser. Supplied automatically in browsers. Server callers should pass it and later send the raw secret as `browserBinding` on exchange; it is optional for now and will become required. */
+    browserBindingHash?: string;
     /** JSON-encoded audience evidence captured after analytics consent. */
     audienceAttribution?: string;
     returnTo?: string;

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { S as Schemas, c as components } from './_spec-DIzdOWz7.js';
-import { F as FetchOptions, S as StorageMode, B as BoardRequest, A as Awaitable, L as Logger, a as BoardClient, b as SearchSuggestQuery } from './search-C1XNGSm6.js';
-export { c as ACCESS_TOKEN_KEY, d as BOARD_ACCESS_GRANT_KEY, C as CompanySuggestion, e as CustomStorage, M as MarketSuggestion, R as REFRESH_TOKEN_KEY, f as SearchSuggestType, g as SuggestResult, h as SuggestionItem, T as TermSuggestion } from './search-C1XNGSm6.js';
-import { L as ListEnvelope, R as RemoteOption, E as EmploymentType, S as Seniority, a as JobCapability, b as CustomFieldFilter, O as ObjectReferenceFilter, c as JobCollectionChoiceQuery, d as JobsListQuery, e as JobCardListEnvelope, f as JobRetrieveQuery, g as JobsSearchBody, h as JobCardSearchEnvelope, i as JobsSimilarQuery, j as SearchEnvelope } from './jobs-DodvFXH2.js';
-export { k as CustomFieldValue, C as CustomFieldValues, l as CustomFilterValue, m as EducationRequirement, n as JobCatalogPagination, o as JobCollectionChoiceList, p as JobCollectionFieldDefinition, q as JobCompany, r as JobCustomEmploymentType, J as JobSort, s as OfficeLocation, t as OffsetPagination, P as PublicJob, u as PublicJobCard, v as RelatedSearch, w as RemotePermit, x as RemoteTimezone, y as ResolvedJobCollectionField, z as StorefrontPagination } from './jobs-DodvFXH2.js';
-import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, b as CompanySalary } from './board-leXc6_BM.js';
-export { B as BoardCustomEmploymentType, j as BoardFormBuiltinField, k as BoardFormField, l as BoardFormLayout, m as BoardFormLockReason, n as BoardJobFormField, o as BoardProfileFormField, p as BoardRoleSignIn, q as BoardSignInSsoConnection, a as CompanyCategorySalary, r as CompanyMarket, s as CompanyMarketRef, t as CompanySalarySummary, C as CustomFieldDefinition, u as CustomFieldOption, v as CustomFieldType, L as LocationSalaryDetail, w as LocationSkillsIndex, x as LocationTitlesIndex, P as PublicBoard, y as PublicBoardAds, z as PublicBoardAnalytics, A as PublicBoardFeatures, D as PublicBoardJobForm, E as PublicBoardSignIn, F as PublicCompany, G as PublicCompanyDetail, H as PublicCompanyMembership, I as SalaryCompany, J as SalaryLocation, K as SalarySkill, M as SalaryTitle, N as SkillLocationSalary, O as SkillLocationsIndex, S as SkillSalaryDetail, Q as TitleLocationSalary, R as TitleLocationsIndex, T as TitleSalaryDetail } from './board-leXc6_BM.js';
-export { B as BoardSeo } from './seo-DFAwxGej.js';
-import { a as BlogPostsListQuery, b as BlogSimilarQuery, c as BlogSearchBody } from './blog-CyvB9C6W.js';
-export { B as BlogAuthorEmbed, d as BlogTagEmbed, e as PublicBlogAdjacentPosts, f as PublicBlogAuthor, g as PublicBlogPost, P as PublicBlogPostSummary, h as PublicBlogTag } from './blog-CyvB9C6W.js';
+import { S as Schemas, c as components } from './_spec-bmTwonT1.js';
+import { F as FetchOptions, S as StorageMode, B as BoardRequest, A as Awaitable, L as Logger, a as BoardClient, b as SearchSuggestQuery } from './search-DwJi7GFS.js';
+export { c as ACCESS_TOKEN_KEY, d as BOARD_ACCESS_GRANT_KEY, C as CompanySuggestion, e as CustomStorage, M as MarketSuggestion, R as REFRESH_TOKEN_KEY, f as SearchSuggestType, g as SuggestResult, h as SuggestionItem, T as TermSuggestion } from './search-DwJi7GFS.js';
+import { L as ListEnvelope, R as RemoteOption, E as EmploymentType, S as Seniority, a as JobCapability, b as CustomFieldFilter, O as ObjectReferenceFilter, c as JobCollectionChoiceQuery, d as JobsListQuery, e as JobCardListEnvelope, f as JobRetrieveQuery, g as JobsSearchBody, h as JobCardSearchEnvelope, i as JobsSimilarQuery, j as SearchEnvelope } from './jobs-Cfmfxt86.js';
+export { k as CustomFieldValue, C as CustomFieldValues, l as CustomFilterValue, m as EducationRequirement, n as JobCatalogPagination, o as JobCollectionChoiceList, p as JobCollectionFieldDefinition, q as JobCompany, r as JobCustomEmploymentType, J as JobSort, s as OfficeLocation, t as OffsetPagination, P as PublicJob, u as PublicJobCard, v as RelatedSearch, w as RemotePermit, x as RemoteTimezone, y as ResolvedJobCollectionField, z as StorefrontPagination } from './jobs-Cfmfxt86.js';
+import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, b as CompanySalary } from './board-Bdc--f9u.js';
+export { B as BoardCustomEmploymentType, j as BoardFormBuiltinField, k as BoardFormField, l as BoardFormLayout, m as BoardFormLockReason, n as BoardJobFormField, o as BoardProfileFormField, p as BoardRoleSignIn, q as BoardSignInSsoConnection, a as CompanyCategorySalary, r as CompanyMarket, s as CompanyMarketRef, t as CompanySalarySummary, C as CustomFieldDefinition, u as CustomFieldOption, v as CustomFieldType, L as LocationSalaryDetail, w as LocationSkillsIndex, x as LocationTitlesIndex, P as PublicBoard, y as PublicBoardAds, z as PublicBoardAnalytics, A as PublicBoardFeatures, D as PublicBoardJobForm, E as PublicBoardSignIn, F as PublicCompany, G as PublicCompanyDetail, H as PublicCompanyMembership, I as SalaryCompany, J as SalaryLocation, K as SalarySkill, M as SalaryTitle, N as SkillLocationSalary, O as SkillLocationsIndex, S as SkillSalaryDetail, Q as TitleLocationSalary, R as TitleLocationsIndex, T as TitleSalaryDetail } from './board-Bdc--f9u.js';
+export { B as BoardSeo } from './seo-D4DJWYCY.js';
+import { a as BlogPostsListQuery, b as BlogSimilarQuery, c as BlogSearchBody } from './blog-BEKRpXYK.js';
+export { B as BlogAuthorEmbed, d as BlogTagEmbed, e as PublicBlogAdjacentPosts, f as PublicBlogAuthor, g as PublicBlogPost, P as PublicBlogPostSummary, h as PublicBlogTag } from './blog-BEKRpXYK.js';
 
 /**
  * Well-known `<domain>_<snake_reason>` codes the Board API sends, grouped by
@@ -202,7 +202,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "4.58.0";
+declare const SDK_VERSION = "4.59.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {
@@ -853,6 +853,8 @@ type RequestMagicLinkBody = Schemas['BoardAuthRequestMagicLinkBody'];
 type ConsumeMagicLinkBody = Schemas['BoardAuthConsumeMagicLinkBody'];
 type OAuthProvider = 'google' | 'linkedin';
 type OAuthAuthorizationQuery = {
+    /** SHA-256 hex of a random secret retained for the initiating browser. Supplied automatically in browsers. Server callers should pass it and later send the raw secret as `browserBinding` on exchange; it is optional for now and will become required. */
+    browserBindingHash?: string;
     /** JSON-encoded audience evidence captured after analytics consent. */
     audienceAttribution?: string;
     returnTo?: string;

package/dist/index.js

@@ -430,7 +430,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.58.0";
+var SDK_VERSION = "4.59.0";
 
 // src/client.ts
 function isRawBody(body) {
@@ -897,19 +897,54 @@ function authNamespace(client, board = "") {
       return persist(session);
     },
     /**
-     * Build a provider authorization URL. The SDK returns the URL; the
-     * host app owns browser navigation.
+     * Build a provider authorization URL and bind the sign-in to the
+     * initiating browser. With an explicit `browserBindingHash`, the SDK sends
+     * it and the caller keeps the raw secret for `exchangeOAuth`. Otherwise,
+     * in a browser with storage and Web Crypto, the SDK creates and retains
+     * the proof automatically. Server runtimes should pass
+     * `browserBindingHash` (the SHA-256 hex of a random secret they keep
+     * for the visitor) and later supply that secret as `browserBinding` on
+     * exchange; without one the request is sent unbound, which is accepted
+     * for now and will be refused once proof becomes required. The host app
+     * owns navigation.
      *
      * @example
      * const { authorizeUrl } = await board.auth.getOAuthAuthorizationUrl('google');
      * window.location.href = authorizeUrl;
      */
-    getOAuthAuthorizationUrl(provider, query, options) {
-      return client.fetch(`/auth/oauth/${provider}`, {
-        ...options,
-        method: "GET",
-        query
-      });
+    async getOAuthAuthorizationUrl(provider, query, options) {
+      let browserBindingHash = query?.browserBindingHash;
+      let secret;
+      if (!browserBindingHash && globalThis.crypto?.subtle) {
+        try {
+          secret = ssoProof().begin();
+        } catch {
+        }
+      }
+      const automatic = secret !== void 0;
+      try {
+        if (secret !== void 0) {
+          const digest = await globalThis.crypto.subtle.digest(
+            "SHA-256",
+            new TextEncoder().encode(secret)
+          );
+          browserBindingHash = Array.from(
+            new Uint8Array(digest),
+            (byte) => byte.toString(16).padStart(2, "0")
+          ).join("");
+        }
+        return await client.fetch(
+          `/auth/oauth/${provider}`,
+          {
+            ...options,
+            method: "GET",
+            query: browserBindingHash ? { ...query, browserBindingHash } : query
+          }
+        );
+      } catch (error) {
+        if (automatic) ssoProof().clear();
+        throw error;
+      }
     },
     /**
      * Exchange the provider callback one-time token and persist the
@@ -930,7 +965,9 @@ function authNamespace(client, board = "") {
           }
         }
       );
-      return persist(session);
+      const result = await persist(session);
+      ssoProof().clear();
+      return result;
     },
     /**
      * Build the authorization URL for one of the board's SSO connections

package/dist/index.mjs

@@ -46,7 +46,7 @@ function toSearchParams(query) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.58.0";
+var SDK_VERSION = "4.59.0";
 
 // src/client.ts
 function isRawBody(body) {
@@ -513,19 +513,54 @@ function authNamespace(client, board = "") {
       return persist(session);
     },
     /**
-     * Build a provider authorization URL. The SDK returns the URL; the
-     * host app owns browser navigation.
+     * Build a provider authorization URL and bind the sign-in to the
+     * initiating browser. With an explicit `browserBindingHash`, the SDK sends
+     * it and the caller keeps the raw secret for `exchangeOAuth`. Otherwise,
+     * in a browser with storage and Web Crypto, the SDK creates and retains
+     * the proof automatically. Server runtimes should pass
+     * `browserBindingHash` (the SHA-256 hex of a random secret they keep
+     * for the visitor) and later supply that secret as `browserBinding` on
+     * exchange; without one the request is sent unbound, which is accepted
+     * for now and will be refused once proof becomes required. The host app
+     * owns navigation.
      *
      * @example
      * const { authorizeUrl } = await board.auth.getOAuthAuthorizationUrl('google');
      * window.location.href = authorizeUrl;
      */
-    getOAuthAuthorizationUrl(provider, query, options) {
-      return client.fetch(`/auth/oauth/${provider}`, {
-        ...options,
-        method: "GET",
-        query
-      });
+    async getOAuthAuthorizationUrl(provider, query, options) {
+      let browserBindingHash = query?.browserBindingHash;
+      let secret;
+      if (!browserBindingHash && globalThis.crypto?.subtle) {
+        try {
+          secret = ssoProof().begin();
+        } catch {
+        }
+      }
+      const automatic = secret !== void 0;
+      try {
+        if (secret !== void 0) {
+          const digest = await globalThis.crypto.subtle.digest(
+            "SHA-256",
+            new TextEncoder().encode(secret)
+          );
+          browserBindingHash = Array.from(
+            new Uint8Array(digest),
+            (byte) => byte.toString(16).padStart(2, "0")
+          ).join("");
+        }
+        return await client.fetch(
+          `/auth/oauth/${provider}`,
+          {
+            ...options,
+            method: "GET",
+            query: browserBindingHash ? { ...query, browserBindingHash } : query
+          }
+        );
+      } catch (error) {
+        if (automatic) ssoProof().clear();
+        throw error;
+      }
     },
     /**
      * Exchange the provider callback one-time token and persist the
@@ -546,7 +581,9 @@ function authNamespace(client, board = "") {
           }
         }
       );
-      return persist(session);
+      const result = await persist(session);
+      ssoProof().clear();
+      return result;
     },
     /**
      * Build the authorization URL for one of the board's SSO connections

package/dist/{jobs-DodvFXH2.d.ts → jobs-Cfmfxt86.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DIzdOWz7.js';
+import { S as Schemas } from './_spec-bmTwonT1.js';
 
 /**
  * Optional pagination metadata returned by Board API list operations.

package/dist/{jobs-nA2K33Nu.d.mts → jobs-DmrG_cGZ.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DIzdOWz7.mjs';
+import { S as Schemas } from './_spec-bmTwonT1.mjs';
 
 /**
  * Optional pagination metadata returned by Board API list operations.

package/dist/route-contract.d.mts

@@ -97,10 +97,9 @@ declare function createBoardLinkResolver(layers: readonly ManifestLayer[]): {
  *.
  *
  * Segment-wise matcher (no RegExp construction from templates). Templates
- * are validated at write time but stay defensive here: a segment starting
- * with ':' is a whole-segment param, a segment with fixed text before a
- * `:name` (`@:handle`) captures what follows that text, and anything else
- * is a literal.
+ * are validated at write time but stay defensive here: identifier params
+ * capture between optional fixed text (`@:handle`, `:postSlug.html`),
+ * and segments without params are literal.
  */
 
 /**

package/dist/route-contract.d.ts

@@ -97,10 +97,9 @@ declare function createBoardLinkResolver(layers: readonly ManifestLayer[]): {
  *.
  *
  * Segment-wise matcher (no RegExp construction from templates). Templates
- * are validated at write time but stay defensive here: a segment starting
- * with ':' is a whole-segment param, a segment with fixed text before a
- * `:name` (`@:handle`) captures what follows that text, and anything else
- * is a literal.
+ * are validated at write time but stay defensive here: identifier params
+ * capture between optional fixed text (`@:handle`, `:postSlug.html`),
+ * and segments without params are literal.
  */
 
 /**

package/dist/route-contract.js

@@ -1163,7 +1163,7 @@ function splitSegments(path) {
   if (withoutTrailing === "") return [];
   return withoutTrailing.split("/");
 }
-var PREFIXED_PARAM_RE = /^([^:]+):([A-Za-z_][A-Za-z0-9_]*)(.*)$/;
+var PARAM_SEGMENT_RE = /^([^:]*):([A-Za-z_][A-Za-z0-9_]*)([A-Za-z0-9_.@-]*)$/;
 function matchPathToTemplate(template, pathname) {
   const templateSegs = splitSegments(template);
   const pathSegs = splitSegments(pathname);
@@ -1176,16 +1176,14 @@ function matchPathToTemplate(template, pathname) {
     const pSeg = pathSegs[i];
     let name = null;
     let value = pSeg;
-    if (tSeg.startsWith(":") && tSeg.length > 1) {
+    const parameter = PARAM_SEGMENT_RE.exec(tSeg);
+    if (parameter) {
+      const [, prefix = "", param = "", suffix = ""] = parameter;
+      if (!pSeg.startsWith(prefix) || !pSeg.endsWith(suffix)) return null;
+      name = param;
+      value = pSeg.slice(prefix.length, pSeg.length - suffix.length);
+    } else if (tSeg.startsWith(":") && tSeg.length > 1) {
       name = tSeg.slice(1);
-    } else {
-      const prefixed = PREFIXED_PARAM_RE.exec(tSeg);
-      if (prefixed) {
-        const [, prefix = "", param = "", suffix = ""] = prefixed;
-        if (!pSeg.startsWith(prefix) || !pSeg.endsWith(suffix)) return null;
-        name = param;
-        value = pSeg.slice(prefix.length, pSeg.length - suffix.length);
-      }
     }
     if (name !== null) {
       if (value.length === 0) return null;

package/dist/route-contract.mjs

@@ -26,7 +26,7 @@ import {
   parseTanStackRoutes,
   sameParamSet,
   validateManifest
-} from "./chunk-GUXSUQCP.mjs";
+} from "./chunk-LO7D3AIX.mjs";
 import "./chunk-MSY7ERBY.mjs";
 export {
   ALL_ROLES,

package/dist/{search-8kX6OW03.d.mts → search-CcCXc47H.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DIzdOWz7.mjs';
+import { S as Schemas } from './_spec-bmTwonT1.mjs';
 
 type Awaitable<T> = T | Promise<T>;
 /**

package/dist/{search-C1XNGSm6.d.ts → search-DwJi7GFS.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DIzdOWz7.js';
+import { S as Schemas } from './_spec-bmTwonT1.js';
 
 type Awaitable<T> = T | Promise<T>;
 /**

package/dist/{seo-DFAwxGej.d.ts → seo-D4DJWYCY.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DIzdOWz7.js';
+import { S as Schemas } from './_spec-bmTwonT1.js';
 
 /**
  * The public SEO-infra payload (`board.seo()`) — platform infrastructure a

package/dist/{seo-Bn5gQY8t.d.mts → seo-DSRRhklF.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DIzdOWz7.mjs';
+import { S as Schemas } from './_spec-bmTwonT1.mjs';
 
 /**
  * The public SEO-infra payload (`board.seo()`) — platform infrastructure a

package/dist/seo-files.d.mts

@@ -1,5 +1,5 @@
-import { B as BoardSeo } from './seo-Bn5gQY8t.mjs';
-import './_spec-DIzdOWz7.mjs';
+import { B as BoardSeo } from './seo-DSRRhklF.mjs';
+import './_spec-bmTwonT1.mjs';
 
 /**
  * `@cavuno/board/seo-files` — platform-owned crawler/identity file bodies

package/dist/seo-files.d.ts

@@ -1,5 +1,5 @@
-import { B as BoardSeo } from './seo-DFAwxGej.js';
-import './_spec-DIzdOWz7.js';
+import { B as BoardSeo } from './seo-D4DJWYCY.js';
+import './_spec-bmTwonT1.js';
 
 /**
  * `@cavuno/board/seo-files` — platform-owned crawler/identity file bodies

package/dist/seo.d.mts

@@ -1,9 +1,9 @@
-import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-DgbGOmzW.mjs';
-import { e as JsonLdObject } from './breadcrumbs-zYG4xzpC.mjs';
-export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-zYG4xzpC.mjs';
-import './_spec-DIzdOWz7.mjs';
-import './board-D3ByAGAb.mjs';
-import './jobs-nA2K33Nu.mjs';
+import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-2rj7bfEp.mjs';
+import { e as JsonLdObject } from './breadcrumbs-WferORs2.mjs';
+export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-WferORs2.mjs';
+import './_spec-bmTwonT1.mjs';
+import './board-BrJfw_S7.mjs';
+import './jobs-DmrG_cGZ.mjs';
 
 /**
  * Blog structured data on the `@cavuno/board` wire types, transcribed from

package/dist/seo.d.ts

@@ -1,9 +1,9 @@
-import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-CyvB9C6W.js';
-import { e as JsonLdObject } from './breadcrumbs-aCKRBNWX.js';
-export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-aCKRBNWX.js';
-import './_spec-DIzdOWz7.js';
-import './board-leXc6_BM.js';
-import './jobs-DodvFXH2.js';
+import { P as PublicBlogPostSummary, B as BlogAuthorEmbed } from './blog-BEKRpXYK.js';
+import { e as JsonLdObject } from './breadcrumbs-NG9_miP6.js';
+export { A as ALL_COUNTRY_CODES, B as BreadcrumbItemInput, g as FaqItem, J as JobBreadcrumb, h as JsonLdBoard, N as NumberNotation, i as SENIORITY_ORDER, j as SalaryFaqEntry, k as SalaryJsonLdOptions, l as SalaryOccupationListOptions, b as buildJobBreadcrumbs, m as buildSalaryFaq, o as companyCategorySalaryJsonLd, p as companySalaryJsonLd, q as createBreadcrumbJsonLd, r as createJobPostingJsonLd, s as crossAxisSalaryJsonLd, t as faqJsonLd, c as formatSalaryStat, d as formatSalaryStatRange, u as itemListJsonLd, v as locationSalaryJsonLd, n as normalizeWebsiteUrl, w as skillSalaryJsonLd, x as sortBySeniority, y as titleSalaryJsonLd } from './breadcrumbs-NG9_miP6.js';
+import './_spec-bmTwonT1.js';
+import './board-Bdc--f9u.js';
+import './jobs-Cfmfxt86.js';
 
 /**
  * Blog structured data on the `@cavuno/board` wire types, transcribed from

package/dist/server.d.mts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.mjs';
-import './_spec-DIzdOWz7.mjs';
-import './search-8kX6OW03.mjs';
-import './jobs-nA2K33Nu.mjs';
-import './board-D3ByAGAb.mjs';
-import './seo-Bn5gQY8t.mjs';
-import './blog-DgbGOmzW.mjs';
+import './_spec-bmTwonT1.mjs';
+import './search-CcCXc47H.mjs';
+import './jobs-DmrG_cGZ.mjs';
+import './board-BrJfw_S7.mjs';
+import './seo-DSRRhklF.mjs';
+import './blog-2rj7bfEp.mjs';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it

package/dist/server.d.ts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.js';
-import './_spec-DIzdOWz7.js';
-import './search-C1XNGSm6.js';
-import './jobs-DodvFXH2.js';
-import './board-leXc6_BM.js';
-import './seo-DFAwxGej.js';
-import './blog-CyvB9C6W.js';
+import './_spec-bmTwonT1.js';
+import './search-DwJi7GFS.js';
+import './jobs-Cfmfxt86.js';
+import './board-Bdc--f9u.js';
+import './seo-D4DJWYCY.js';
+import './blog-BEKRpXYK.js';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it

package/dist/sitemap.d.mts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.mjs';
-import './_spec-DIzdOWz7.mjs';
-import './search-8kX6OW03.mjs';
-import './jobs-nA2K33Nu.mjs';
-import './board-D3ByAGAb.mjs';
-import './seo-Bn5gQY8t.mjs';
-import './blog-DgbGOmzW.mjs';
+import './_spec-bmTwonT1.mjs';
+import './search-CcCXc47H.mjs';
+import './jobs-DmrG_cGZ.mjs';
+import './board-BrJfw_S7.mjs';
+import './seo-DSRRhklF.mjs';
+import './blog-2rj7bfEp.mjs';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/sitemap.d.ts

@@ -1,10 +1,10 @@
 import { BoardSdk } from './index.js';
-import './_spec-DIzdOWz7.js';
-import './search-C1XNGSm6.js';
-import './jobs-DodvFXH2.js';
-import './board-leXc6_BM.js';
-import './seo-DFAwxGej.js';
-import './blog-CyvB9C6W.js';
+import './_spec-bmTwonT1.js';
+import './search-DwJi7GFS.js';
+import './jobs-Cfmfxt86.js';
+import './board-Bdc--f9u.js';
+import './seo-D4DJWYCY.js';
+import './blog-BEKRpXYK.js';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/suggest.d.mts

@@ -1,5 +1,5 @@
-import { h as SuggestionItem, b as SearchSuggestQuery, F as FetchOptions, g as SuggestResult } from './search-8kX6OW03.mjs';
-import './_spec-DIzdOWz7.mjs';
+import { h as SuggestionItem, b as SearchSuggestQuery, F as FetchOptions, g as SuggestResult } from './search-CcCXc47H.mjs';
+import './_spec-bmTwonT1.mjs';
 
 /**
  * `@cavuno/board/suggest` — framework-agnostic headless search-suggest