@cavuno/board 4.58.0 → 4.59.0

package/dist/suggest.d.ts

@@ -1,5 +1,5 @@
-import { h as SuggestionItem, b as SearchSuggestQuery, F as FetchOptions, g as SuggestResult } from './search-C1XNGSm6.js';
-import './_spec-DIzdOWz7.js';
+import { h as SuggestionItem, b as SearchSuggestQuery, F as FetchOptions, g as SuggestResult } from './search-DwJi7GFS.js';
+import './_spec-bmTwonT1.js';
 
 /**
  * `@cavuno/board/suggest` — framework-agnostic headless search-suggest

package/dist/well-known.mjs

@@ -1,6 +1,6 @@
 import {
   compileManifest
-} from "./chunk-GUXSUQCP.mjs";
+} from "./chunk-LO7D3AIX.mjs";
 import "./chunk-MSY7ERBY.mjs";
 
 // src/well-known/handler.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cavuno/board",
-  "version": "4.58.0",
+  "version": "4.59.0",
   "description": "Build custom job boards and careers pages with Cavuno’s TypeScript SDK.",
   "keywords": [
     "api-client",

package/skills/cavuno-board-auth/SKILL.md

@@ -90,3 +90,10 @@ The signed-in OTP verification, resend, magic-link, and OAuth branches use their
 ## Cavuno SDK reference
 
 For setup and API details beyond this workflow, use the [Cavuno Board SDK documentation](https://cavuno.com/docs/sdk).
+
+
+### OAuth browser proof
+
+SSO sign-ins require proof from the browser that started authorization. Google and LinkedIn sign-ins accept and check the same proof whenever it is supplied, and it will become required for them in a later release. The browser SDK establishes and retains a random secret before `getOAuthAuthorizationUrl` or `getSsoAuthorizationUrl`, sends only its SHA-256 hash to authorization, and supplies the secret when `exchangeOAuth` runs. Keep browser storage available through the provider round trip. Never take a binding secret from a completion URL or copy another browser's completion token.
+
+Server callers (a Worker or other server runtime without browser storage) should generate a random secret, retain it securely in the visitor's session (for example an HttpOnly cookie), pass its lowercase SHA-256 hex as `browserBindingHash` to `getOAuthAuthorizationUrl`, and pass the original secret as `browserBinding` to `exchangeOAuth`. Without a `browserBindingHash`, the SDK sends a Google or LinkedIn request unbound from a server runtime; that is accepted today so existing deployments keep working, and will be refused once proof becomes required. A sign-in started with proof must finish with the matching secret: failed proof leaves the one-time token unconsumed. Automatic OAuth proof is cleared if authorization fails or once exchange succeeds; a rejected exchange keeps the proof available for retry.

package/skills/cavuno-board-format/SKILL.md

@@ -59,7 +59,9 @@ formatSalaryStatRange(language, 90000, 120000, detail.currency);
 formatSalaryStatRange(language, 90000, 120000, detail.currency, 'standard');
 
 // Custom fields — language first. number → kind: 'number' (raw);
-// multi_select → kind: 'multi_select' with values: string[] (labels).
+// multi_select → kind: 'multi_select' with values: string[] (labels);
+// rich_text → kind: 'rich_text' with API-sanitized HTML: render it as HTML.
+// kind: 'text' stays plain text, so keep escaping it.
 // Do not String(n). Do not join multi-select in the SDK — app owns list
 // style (conjunction / short / chips):
 // new Intl.ListFormat(language, { style: 'long', type: 'conjunction' })
@@ -121,6 +123,8 @@ const jobBadges = resolveCustomFieldDisplay(
   switch (entry.kind) {
     case 'text': // a single_select resolves to its option label
       return [entry.value];
+    case 'rich_text': // sanitized HTML: render in a detail section, not a badge
+      return [];
     case 'multi_select':
       return entry.values;
     case 'boolean':

package/skills/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.58.0",
+  "version": "4.59.0",
   "skills": [
     {
       "name": "cavuno-board-account",