@cavuno/board 4.58.0 → 4.59.1

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 This changelog records changes that affect Board API compatibility, exported
 types, runtime behavior, or supported integration patterns.
 
+## 4.59.1 — 2026-11-02
+
+- The board context's `contact` carries `tiktokUrl` and `youtubeUrl` next to
+  the other social links: a normalized profile URL, or `null`.
+- Operator settings take `companyTiktokUrl` and `companyYoutubeUrl`, a handle
+  or profile URL stored as the canonical profile URL.
+- Digital products: `isPublic: true` on a product with no ready file or link
+  is kept as a request. The product reports `digitalProduct.listingPending`
+  and is listed automatically once its first file or link is ready.
+- On a board whose talent directory is for employers only, a profile shown to
+  signed-in members only is returned to approved employers and its owner, not
+  to every signed-in user.
+- `talent.retrieve` returns the experience, education, skills and languages of a
+  members-only profile to viewers allowed to see it.
+
+## 4.59.0 — 2026-11-01
+
+- Security and reliability improvements.
+- `getOAuthAuthorizationUrl` accepts `browserBindingHash` and `exchangeOAuth`
+  accepts `browserBinding` for Google and LinkedIn sign-in. Browsers get this
+  automatically; server callers pass the SHA-256 hex of a secret they keep in
+  an HttpOnly cookie, then the secret itself. Optional today, required later.
+- `resolveCustomFieldDisplay` returns `kind: 'rich_text'` for rich text
+  fields, with sanitized HTML as `value`.
+- New operator operations: `getApplication`, `listJobApplications`,
+  `deleteApplication`, `deleteCustomObjectType` and `deleteInboxTicket`.
+
 ## 4.58.0 — 2026-10-30
 
 - `features.impressum` on the board context is deprecated. Publish your

package/dist/{_spec-DIzdOWz7.d.mts → _spec-DZV8ME1P.d.mts}

@@ -252,7 +252,7 @@ interface components {
         };
         BoardAuthOAuthExchangeBody: {
             token: string;
-            /** @description For SSO, the random secret established in the initiating browser before requesting authorization. Required for SSO tokens; never read it from a completion URL. */
+            /** @description The random secret established in the initiating browser before requesting authorization. Required for SSO tokens and for Google or LinkedIn tokens started with a browserBindingHash; it will become required for all Google and LinkedIn tokens. Never read it from a completion URL. Browser SDK supplies the retained secret automatically. */
             browserBinding?: string;
         };
         BoardAuthRefreshBody: {
@@ -1418,7 +1418,7 @@ interface components {
             inOfficeFrequency?: number;
             /** @description Physical office locations associated with the job. Prefer `{locationId}` with an `id` from `GET /locations/search` (what a location picker returns); `{query: "City, Country"}` for free-form text and `{city, country, region?, locality?}` are also accepted and geocoded server-side (a country mismatch returns `400 jobs_unresolvable_location`). A location outside the board's job-form `allowedCountries` returns `400 jobs_constraint_violation`. */
             officeLocations?: components["schemas"]["EmployerJobOfficeLocationInput"][];
-            /** @description Collection-reference selections keyed by the configured job collection field key. Values are arrays of record IDs, including for single-select fields. On PATCH omitted keys are preserved; send null or an empty array to clear a field. */
+            /** @description Collection-reference selections keyed by the configured job collection field key. Values are arrays of record IDs, including for single-select fields. On PATCH omitted keys are preserved; send null or an empty array to clear a field. Keys for fields whose collection is archived are ignored, and their stored selections are kept. */
             collectionValues?: {
                 [key: string]: string[] | unknown;
             };
@@ -1594,7 +1594,7 @@ interface components {
             customFieldValues: {
                 [key: string]: string | string[] | boolean | number;
             };
-            /** @description Collection record IDs keyed by configured job collection field. */
+            /** @description Collection record IDs keyed by configured job collection field. Fields whose collection is archived are omitted. */
             collectionValues: {
                 [key: string]: string[];
             };
@@ -1733,7 +1733,7 @@ interface components {
             inOfficeFrequency?: number;
             /** @description Physical office locations associated with the job. Prefer `{locationId}` with an `id` from `GET /locations/search` (what a location picker returns); `{query: "City, Country"}` for free-form text and `{city, country, region?, locality?}` are also accepted and geocoded server-side (a country mismatch returns `400 jobs_unresolvable_location`). A location outside the board's job-form `allowedCountries` returns `400 jobs_constraint_violation`. */
             officeLocations?: components["schemas"]["EmployerJobOfficeLocationInput"][];
-            /** @description Collection-reference selections keyed by the configured job collection field key. Values are arrays of record IDs, including for single-select fields. On PATCH omitted keys are preserved; send null or an empty array to clear a field. */
+            /** @description Collection-reference selections keyed by the configured job collection field key. Values are arrays of record IDs, including for single-select fields. On PATCH omitted keys are preserved; send null or an empty array to clear a field. Keys for fields whose collection is archived are ignored, and their stored selections are kept. */
             collectionValues?: {
                 [key: string]: string[] | unknown;
             };
@@ -2543,6 +2543,7 @@ interface components {
             }[];
         };
         ProfileObjectReferencesResult: {
+            /** @description The reference fields on this profile. Fields whose collection is archived are omitted, along with their selections. */
             definitions: components["schemas"]["ProfileObjectReferenceDefinition"][];
             selections: components["schemas"]["ResolvedProfileObjectReference"][];
         };
@@ -2722,7 +2723,7 @@ interface components {
             customFields: {
                 /** @description This model's custom-field definitions in display order. Empty when the board defines none for the model. */
                 job: components["schemas"]["CustomFieldDefinition"][];
-                /** @description Collection-reference job field definitions in display order. Fetch choices from /boards/{identifier}/job-fields/{fieldKey}/choices. */
+                /** @description Collection-reference job field definitions in display order. Fetch choices from /boards/{identifier}/job-fields/{fieldKey}/choices. Fields whose collection is archived are omitted. */
                 jobCollections: components["schemas"]["JobCollectionFieldDefinition"][];
             };
             /** @description Built-in job-form field configuration from Settings → Job form (custom fields live on `customFields.job`). The platform ENFORCES these constraints when a job is created — a violation is a 400 — so a posting form that ignores them offers options the server will reject and the employer only finds out on submit. */
@@ -2787,6 +2788,10 @@ interface components {
                 linkedinUrl: string | null;
                 /** @description Instagram profile URL. Null when unset or invalid. */
                 instagramUrl: string | null;
+                /** @description TikTok profile URL (`https://www.tiktok.com/@handle`). Null when unset or invalid. */
+                tiktokUrl: string | null;
+                /** @description YouTube channel URL (`https://www.youtube.com/...`). Null when unset or invalid. */
+                youtubeUrl: string | null;
             };
         };
         PublicCompaniesSearchBody: {
@@ -3521,6 +3526,7 @@ interface components {
             orderedStageIds: string[];
         };
         ReplaceProfileObjectReferenceSelectionsBody: {
+            /** @description Replaces the stored selections. Selections for fields whose collection is archived are ignored, and their stored selections are kept. */
             selections: components["schemas"]["ProfileObjectReferenceSelectionWrite"][];
         };
         ReplyBody: {

package/dist/{_spec-DIzdOWz7.d.ts → _spec-DZV8ME1P.d.ts}

@@ -252,7 +252,7 @@ interface components {
         };
         BoardAuthOAuthExchangeBody: {
             token: string;
-            /** @description For SSO, the random secret established in the initiating browser before requesting authorization. Required for SSO tokens; never read it from a completion URL. */
+            /** @description The random secret established in the initiating browser before requesting authorization. Required for SSO tokens and for Google or LinkedIn tokens started with a browserBindingHash; it will become required for all Google and LinkedIn tokens. Never read it from a completion URL. Browser SDK supplies the retained secret automatically. */
             browserBinding?: string;
         };
         BoardAuthRefreshBody: {
@@ -1418,7 +1418,7 @@ interface components {
             inOfficeFrequency?: number;
             /** @description Physical office locations associated with the job. Prefer `{locationId}` with an `id` from `GET /locations/search` (what a location picker returns); `{query: "City, Country"}` for free-form text and `{city, country, region?, locality?}` are also accepted and geocoded server-side (a country mismatch returns `400 jobs_unresolvable_location`). A location outside the board's job-form `allowedCountries` returns `400 jobs_constraint_violation`. */
             officeLocations?: components["schemas"]["EmployerJobOfficeLocationInput"][];
-            /** @description Collection-reference selections keyed by the configured job collection field key. Values are arrays of record IDs, including for single-select fields. On PATCH omitted keys are preserved; send null or an empty array to clear a field. */
+            /** @description Collection-reference selections keyed by the configured job collection field key. Values are arrays of record IDs, including for single-select fields. On PATCH omitted keys are preserved; send null or an empty array to clear a field. Keys for fields whose collection is archived are ignored, and their stored selections are kept. */
             collectionValues?: {
                 [key: string]: string[] | unknown;
             };
@@ -1594,7 +1594,7 @@ interface components {
             customFieldValues: {
                 [key: string]: string | string[] | boolean | number;
             };
-            /** @description Collection record IDs keyed by configured job collection field. */
+            /** @description Collection record IDs keyed by configured job collection field. Fields whose collection is archived are omitted. */
             collectionValues: {
                 [key: string]: string[];
             };
@@ -1733,7 +1733,7 @@ interface components {
             inOfficeFrequency?: number;
             /** @description Physical office locations associated with the job. Prefer `{locationId}` with an `id` from `GET /locations/search` (what a location picker returns); `{query: "City, Country"}` for free-form text and `{city, country, region?, locality?}` are also accepted and geocoded server-side (a country mismatch returns `400 jobs_unresolvable_location`). A location outside the board's job-form `allowedCountries` returns `400 jobs_constraint_violation`. */
             officeLocations?: components["schemas"]["EmployerJobOfficeLocationInput"][];
-            /** @description Collection-reference selections keyed by the configured job collection field key. Values are arrays of record IDs, including for single-select fields. On PATCH omitted keys are preserved; send null or an empty array to clear a field. */
+            /** @description Collection-reference selections keyed by the configured job collection field key. Values are arrays of record IDs, including for single-select fields. On PATCH omitted keys are preserved; send null or an empty array to clear a field. Keys for fields whose collection is archived are ignored, and their stored selections are kept. */
             collectionValues?: {
                 [key: string]: string[] | unknown;
             };
@@ -2543,6 +2543,7 @@ interface components {
             }[];
         };
         ProfileObjectReferencesResult: {
+            /** @description The reference fields on this profile. Fields whose collection is archived are omitted, along with their selections. */
             definitions: components["schemas"]["ProfileObjectReferenceDefinition"][];
             selections: components["schemas"]["ResolvedProfileObjectReference"][];
         };
@@ -2722,7 +2723,7 @@ interface components {
             customFields: {
                 /** @description This model's custom-field definitions in display order. Empty when the board defines none for the model. */
                 job: components["schemas"]["CustomFieldDefinition"][];
-                /** @description Collection-reference job field definitions in display order. Fetch choices from /boards/{identifier}/job-fields/{fieldKey}/choices. */
+                /** @description Collection-reference job field definitions in display order. Fetch choices from /boards/{identifier}/job-fields/{fieldKey}/choices. Fields whose collection is archived are omitted. */
                 jobCollections: components["schemas"]["JobCollectionFieldDefinition"][];
             };
             /** @description Built-in job-form field configuration from Settings → Job form (custom fields live on `customFields.job`). The platform ENFORCES these constraints when a job is created — a violation is a 400 — so a posting form that ignores them offers options the server will reject and the employer only finds out on submit. */
@@ -2787,6 +2788,10 @@ interface components {
                 linkedinUrl: string | null;
                 /** @description Instagram profile URL. Null when unset or invalid. */
                 instagramUrl: string | null;
+                /** @description TikTok profile URL (`https://www.tiktok.com/@handle`). Null when unset or invalid. */
+                tiktokUrl: string | null;
+                /** @description YouTube channel URL (`https://www.youtube.com/...`). Null when unset or invalid. */
+                youtubeUrl: string | null;
             };
         };
         PublicCompaniesSearchBody: {
@@ -3521,6 +3526,7 @@ interface components {
             orderedStageIds: string[];
         };
         ReplaceProfileObjectReferenceSelectionsBody: {
+            /** @description Replaces the stored selections. Selections for fields whose collection is archived are ignored, and their stored selections are kept. */
             selections: components["schemas"]["ProfileObjectReferenceSelectionWrite"][];
         };
         ReplyBody: {

package/dist/analytics.js

@@ -69,6 +69,40 @@ function withCors(response) {
 function corsPreflight() {
   return withCors(new Response(null, { status: 204 }));
 }
+var COLLECT_BODY_MAX_BYTES = 64 * 1024;
+async function readCollectBody(request) {
+  if (Number(request.headers.get("Content-Length")) > COLLECT_BODY_MAX_BYTES) {
+    await request.body?.cancel().catch(() => {
+    });
+    return null;
+  }
+  if (!request.body) return new Uint8Array();
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > COLLECT_BODY_MAX_BYTES) {
+        await reader.cancel().catch(() => {
+        });
+        return null;
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
 async function proxyCollect(request, targetUrl) {
   if (request.method === "OPTIONS") {
     return corsPreflight();
@@ -85,7 +119,10 @@ async function proxyCollect(request, targetUrl) {
   if (accept) headers.set("Accept", accept);
   const target = new URL(targetUrl);
   target.search = new URL(request.url).search;
-  const body = await request.arrayBuffer();
+  const body = await readCollectBody(request);
+  if (body === null) {
+    return withCors(new Response(null, { status: 413 }));
+  }
   const upstream = await fetch(target.toString(), {
     method: "POST",
     headers,

package/dist/analytics.mjs

@@ -32,6 +32,40 @@ function withCors(response) {
 function corsPreflight() {
   return withCors(new Response(null, { status: 204 }));
 }
+var COLLECT_BODY_MAX_BYTES = 64 * 1024;
+async function readCollectBody(request) {
+  if (Number(request.headers.get("Content-Length")) > COLLECT_BODY_MAX_BYTES) {
+    await request.body?.cancel().catch(() => {
+    });
+    return null;
+  }
+  if (!request.body) return new Uint8Array();
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > COLLECT_BODY_MAX_BYTES) {
+        await reader.cancel().catch(() => {
+        });
+        return null;
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
 async function proxyCollect(request, targetUrl) {
   if (request.method === "OPTIONS") {
     return corsPreflight();
@@ -48,7 +82,10 @@ async function proxyCollect(request, targetUrl) {
   if (accept) headers.set("Accept", accept);
   const target = new URL(targetUrl);
   target.search = new URL(request.url).search;
-  const body = await request.arrayBuffer();
+  const body = await readCollectBody(request);
+  if (body === null) {
+    return withCors(new Response(null, { status: 413 }));
+  }
   const upstream = await fetch(target.toString(), {
     method: "POST",
     headers,

package/dist/bin.mjs

@@ -259,7 +259,7 @@ function splitSegments(path) {
   if (withoutTrailing === "") return [];
   return withoutTrailing.split("/");
 }
-var PREFIXED_PARAM_RE = /^([^:]+):([A-Za-z_][A-Za-z0-9_]*)(.*)$/;
+var PARAM_SEGMENT_RE = /^([^:]*):([A-Za-z_][A-Za-z0-9_]*)([A-Za-z0-9_.@-]*)$/;
 function matchPathToTemplate(template, pathname) {
   const templateSegs = splitSegments(template);
   const pathSegs = splitSegments(pathname);
@@ -272,16 +272,14 @@ function matchPathToTemplate(template, pathname) {
     const pSeg = pathSegs[i];
     let name = null;
     let value = pSeg;
-    if (tSeg.startsWith(":") && tSeg.length > 1) {
+    const parameter = PARAM_SEGMENT_RE.exec(tSeg);
+    if (parameter) {
+      const [, prefix = "", param = "", suffix = ""] = parameter;
+      if (!pSeg.startsWith(prefix) || !pSeg.endsWith(suffix)) return null;
+      name = param;
+      value = pSeg.slice(prefix.length, pSeg.length - suffix.length);
+    } else if (tSeg.startsWith(":") && tSeg.length > 1) {
       name = tSeg.slice(1);
-    } else {
-      const prefixed = PREFIXED_PARAM_RE.exec(tSeg);
-      if (prefixed) {
-        const [, prefix = "", param = "", suffix = ""] = prefixed;
-        if (!pSeg.startsWith(prefix) || !pSeg.endsWith(suffix)) return null;
-        name = param;
-        value = pSeg.slice(prefix.length, pSeg.length - suffix.length);
-      }
     }
     if (name !== null) {
       if (value.length === 0) return null;
@@ -8761,7 +8759,8 @@ var LOCALIZED_URLS = record("read.localizedUrls", 2);
 var REDIRECT_OK = /* @__PURE__ */ new Set([
   "employers",
   "alertsManage",
-  "alertsConfirm"
+  "alertsConfirm",
+  "mePurchases"
 ]);
 var MAY_BE_UNPUBLISHED = /* @__PURE__ */ new Set([
   "blog",
@@ -9018,10 +9017,18 @@ function scoreBoardIdentity(board, robotsBody, env) {
 }
 function onFrontend(base, locUrl) {
   try {
-    const parsed = new URL(locUrl);
-    return `${base}${parsed.pathname}${parsed.search}`;
+    const frontend = new URL(base);
+    const parsed = new URL(locUrl, frontend.origin + "/");
+    if (frontend.protocol !== "http:" && frontend.protocol !== "https:" || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return null;
+    }
+    const rebased = new URL(frontend);
+    rebased.pathname = frontend.pathname.replace(/\/$/, "") + parsed.pathname;
+    rebased.search = parsed.search;
+    rebased.hash = "";
+    return rebased.origin === frontend.origin ? rebased.href : null;
   } catch {
-    return locUrl;
+    return null;
   }
 }
 async function probeSitemap(fetchImpl, base) {
@@ -9039,6 +9046,9 @@ async function probeSitemap(fetchImpl, base) {
   let urls = doc.urls;
   if (doc.kind === "index") {
     const childUrl = onFrontend(base, urls[0]);
+    if (childUrl === null) {
+      return READ.sitemap("fail", "child sitemap has an invalid HTTP(S) URL");
+    }
     let child = await probe(fetchImpl, childUrl);
     if (!child.ok && (child.status === 503 || child.status === 0)) {
       child = await probe(fetchImpl, childUrl);
@@ -9053,6 +9063,9 @@ async function probeSitemap(fetchImpl, base) {
     urls = childDoc.urls;
   }
   const sampleUrl = onFrontend(base, urls[0]);
+  if (sampleUrl === null) {
+    return READ.sitemap("fail", "sitemap page has an invalid HTTP(S) URL");
+  }
   const sample = await probe(fetchImpl, sampleUrl);
   return sample.ok ? READ.sitemap("pass", `${urls.length} entries; sample page resolves`) : READ.sitemap("fail", `sitemap page ${sampleUrl} \u2192 HTTP ${sample.status}`);
 }

package/dist/{blog-DgbGOmzW.d.mts → blog-BfVuJQvO.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DIzdOWz7.mjs';
+import { S as Schemas } from './_spec-DZV8ME1P.mjs';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];

package/dist/{blog-CyvB9C6W.d.ts → blog-CLVfmknV.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DIzdOWz7.js';
+import { S as Schemas } from './_spec-DZV8ME1P.js';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];

package/dist/{board-leXc6_BM.d.ts → board-Cl6cfS-a.d.ts}

@@ -1,5 +1,5 @@
-import { S as Schemas } from './_spec-DIzdOWz7.js';
-import { L as ListEnvelope, v as RelatedSearch, b as CustomFieldFilter, O as ObjectReferenceFilter, a as JobCapability } from './jobs-DodvFXH2.js';
+import { S as Schemas } from './_spec-DZV8ME1P.js';
+import { L as ListEnvelope, v as RelatedSearch, b as CustomFieldFilter, O as ObjectReferenceFilter, a as JobCapability } from './jobs-Di0L5sM1.js';
 
 type PublicCompany = Schemas['CompanyPublic'];
 /**

package/dist/{board-D3ByAGAb.d.mts → board-gmV8MoLW.d.mts}

@@ -1,5 +1,5 @@
-import { S as Schemas } from './_spec-DIzdOWz7.mjs';
-import { L as ListEnvelope, v as RelatedSearch, b as CustomFieldFilter, O as ObjectReferenceFilter, a as JobCapability } from './jobs-nA2K33Nu.mjs';
+import { S as Schemas } from './_spec-DZV8ME1P.mjs';
+import { L as ListEnvelope, v as RelatedSearch, b as CustomFieldFilter, O as ObjectReferenceFilter, a as JobCapability } from './jobs-DfMyFAYs.mjs';
 
 type PublicCompany = Schemas['CompanyPublic'];
 /**

package/dist/{breadcrumbs-zYG4xzpC.d.mts → breadcrumbs-BOM71gXT.d.mts}

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-D3ByAGAb.mjs';
-import { P as PublicJob } from './jobs-nA2K33Nu.mjs';
+import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-gmV8MoLW.mjs';
+import { P as PublicJob } from './jobs-DfMyFAYs.mjs';
 
 /**
  * Wire enum for `salaryTimeframe`. Defined here (not re-exported from any

package/dist/{breadcrumbs-aCKRBNWX.d.ts → breadcrumbs-dTn6GsKo.d.ts}

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-leXc6_BM.js';
-import { P as PublicJob } from './jobs-DodvFXH2.js';
+import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-Cl6cfS-a.js';
+import { P as PublicJob } from './jobs-Di0L5sM1.js';
 
 /**
  * Wire enum for `salaryTimeframe`. Defined here (not re-exported from any