@cavuno/board 4.68.0 → 4.70.0

package/CHANGELOG.md

@@ -3,6 +3,79 @@
 This changelog records changes that affect Board API compatibility, exported
 types, runtime behavior, or supported integration patterns.
 
+## 4.71.0 — 2026-11-12
+
+- `board.jobAlerts.confirm({ token })` can resolve two more statuses,
+  which the API already returned: `waitlisted` (the alert is confirmed and
+  starts once the board can send to more people) and `unsubscribed` (the
+  link was sent before the person's alerts were turned off, so it does not
+  turn them back on; they resume them from a manage link with
+  `board.jobAlerts.resubscribe`). `JobAlertConfirmation['status']` lists
+  both, so an exhaustive `switch` over it needs the two new cases.
+- `JobAlertConfirmation['subscription']` is also present when a link is
+  refused (`expired`, `not_found` or `unsubscribed`): `marketing` for a
+  link from `board.subscribe`, `job_alerts` for a job alert link. Word the
+  refusal by it. It is still absent for an unknown token.
+- `board.subscribe(...)` records the visitor's IP address and user agent
+  as consent evidence only when the request comes through a board built
+  with Cavuno's AI Builder. A frontend that calls the API from the browser
+  or its own server records neither, since the address and user agent the
+  API sees are not the visitor's.
+
+## 4.70.0 — 2026-11-12
+
+- Company members can add gallery images and files to their company's
+  custom fields. `board.me.companies.uploadCustomFieldFile(slug, fieldKey,
+  file)` uploads one file (up to 10 MB; galleries take JPEG, PNG, WebP or
+  GIF) and returns a `ProfileFieldMedia` draft. Save its `id` with
+  `board.me.companies.updateCustomFields` to attach it. The caller must be
+  an approved member of the company. A key that is not an upload field is
+  refused with `company_custom_field_not_found`, and a field company
+  members cannot edit with `company_custom_field_not_editable`.
+- `board.me.companies.retrieveCustomFields(slug)` and `updateCustomFields`
+  are typed `MyCompanyProfileFieldValues`, which adds `customFieldMedia`:
+  the saved files of upload fields, keyed by field, with links that also
+  load drafts for the company's members. `MyCompanyProfileFieldValues` is
+  exported.
+- `board.subscribe({ email, consent, consentText, source })` signs an
+  address up for the board's email from a newsletter form. The person gets
+  a confirmation email and nothing is granted until they click it. It
+  always resolves `{ status: 'submitted', sendingPaused }`.
+  `BoardSubscribeInput` and `SubscriptionRequest` are exported.
+- `board.auth.register(...)` and `board.auth.resendVerification()` answer
+  422 `board_auth_email_undeliverable` when the address cannot receive
+  email, such as a temporary or disposable inbox. On register nothing is
+  created, so ask for a different address.
+
+## 4.69.0 — 2026-11-12
+
+- Members-only boards: on a board whose context has
+  `posting.requiresMembership`, `board.plans.list()` leaves out job-posting
+  plans, except those priced by quote, because visitors cannot buy them.
+  `board.jobPosting.plans()` still returns them for members. An anonymous
+  `board.jobPosting.create(...)` on such a board is refused with
+  `membership_required`, whatever company website it names.
+- `board.jobPosting.plans()` returns each feature's `name`, `dataType` and
+  `displayOrder`, as `board.plans.list()` does, so a posting form can label a
+  plan's custom attributes from that one read.
+- `board.me.companies.billingOptions.list(slug)` is typed as
+  `EmployerBillingOptionsList`, which includes the `capabilities` the
+  endpoint returns: `canPost`, the `reason` when posting is refused, and the
+  membership allowance. `EmployerPostingCapabilities` is exported. Read
+  `canPost` to show a membership offer before the employer writes a job.
+- `board.me.companies.startMembershipCheckout(slug, body)` takes an optional
+  `redirectOnCompletion`: `'always'` (the default, unchanged) or
+  `'if_required'`, which keeps a card payment on the embedding page and fires
+  Stripe.js `onComplete`. Payment methods that need a redirect still return
+  to `returnPath`.
+- The board context carries `features.tipJar` (the board has an active tip
+  jar) and `features.products` (it lists at least one product), so a frontend
+  can show those links without probing `/tip-jar` and `/products`.
+- `auth.refresh()` and `auth.logout()` are rate limited per refresh token (10
+  a minute) instead of per client IP, with a ceiling of 1,000 a minute per IP.
+  A server-rendered frontend refreshing many visitors' sessions from one IP no
+  longer gets `rate_limited`.
+
 ## 4.68.0 — 2026-11-11
 
 - Company market resolutions return `companyCount`: the number of companies

package/dist/{_spec-t2B6ioRS.d.mts → _spec-Dk7QyuoJ.d.mts}

@@ -428,6 +428,17 @@ interface components {
             definition: components["schemas"]["CustomFieldDefinition"];
         };
         BoardJobFormField: components["schemas"]["BoardFormBuiltinField"] | components["schemas"]["BoardJobFormCustomField"] | components["schemas"]["BoardJobFormCollectionField"];
+        BoardMarketingTopic: {
+            /**
+             * @description String representing the object's type. Objects of the same type share the same value.
+             * @enum {string}
+             */
+            object: "marketing_topic";
+            /** @description The topic’s key, which a sign-up sends in `topics` when the person ticks it. */
+            key: string;
+            /** @description The topic’s name, to label its checkbox. */
+            name: string;
+        };
         /** @description An MCP Server Card (SEP-2127): what an assistant needs to find and connect to the server before it connects. It lists no tools; `tools/list` on the server does. */
         BoardMcpServerCard: {
             /** @description The Server Card JSON Schema this document follows: `https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json`. */
@@ -550,6 +561,29 @@ interface components {
             /** @description ISO 8601 timestamp of the newest content in the bucket, when the board tracks one. */
             lastModified?: string;
         };
+        BoardSubscribeBody: {
+            /**
+             * Format: email
+             * @description The address to sign up. It gets a confirmation email.
+             */
+            email: string;
+            /**
+             * @description Must be `true`: the person ticked an unticked checkbox agreeing to `consentText`.
+             * @enum {boolean}
+             */
+            consent: true;
+            /** @description The checkbox wording the person agreed to, exactly as shown, such as "Send me news and offers from Acme Jobs." It must contain the board's name (any letter case), or the request is refused with 400. Kept with the consent once the person confirms. */
+            consentText: string;
+            /** @description A label for the form, such as `blog-footer`: lowercase letters, digits and hyphens, up to 64 characters. It shows as the contact's Source. */
+            source: string;
+            /**
+             * Format: uri
+             * @description The page the form was on. Defaults to the request's `Referer`.
+             */
+            pageUrl?: string;
+            /** @description Honeypot. Render it as a hidden field that people leave empty; when it is filled in, the request answers `submitted` and does nothing. */
+            website?: string;
+        };
         BoardUser: {
             /** @description Board user ID. */
             id: string;
@@ -2099,6 +2133,12 @@ interface components {
             features: {
                 key: string | null;
                 value: string | null;
+                /** @description The feature's display name, including an operator-defined custom attribute's name. */
+                name: string;
+                /** @description How to read `value`, such as `integer`, `boolean` or `string`. */
+                dataType: string;
+                /** @description The operator-set order among the plan features; null when unset. */
+                displayOrder: number | null;
             }[];
         };
         JobPostingResult: {
@@ -2322,6 +2362,11 @@ interface components {
             returnPath: string;
             /** @enum {string} */
             colorMode: "light" | "dark";
+            /**
+             * @description When the buyer leaves for `returnPath`. `always` (default): every completed checkout redirects there. `if_required`: a card payment completes in place and the embedding page reacts to Stripe.js `onComplete` (then reads `GET …/membership/checkout/{sessionId}`); only a payment method that needs a redirect returns to `returnPath`.
+             * @enum {string}
+             */
+            redirectOnCompletion?: "always" | "if_required";
         };
         Message: {
             id: string;
@@ -2362,6 +2407,12 @@ interface components {
                 [key: string]: components["schemas"]["ProfileFieldMedia"][];
             };
         };
+        MyCompanyProfileFieldValuesResponse: components["schemas"]["ProfileFieldValuesResponse"] & {
+            /** @description Resolved files for the company’s saved `image_gallery` and `file` values, keyed by field key like `values`, in the stored order, including private fields. Each file `id` matches a value in `values`. `url` is a signed link for the company’s members that expires after at least 24 hours, so read it from the response rather than storing it. Unsaved uploads are not listed. Fields with no files are omitted. */
+            customFieldMedia: {
+                [key: string]: components["schemas"]["ProfileFieldMedia"][];
+            };
+        };
         MyItemVerification: components["schemas"]["ItemVerification"] & {
             /** @description The verification's id. For an item with no verification yet (`unverified`), its `itemKey`. */
             id?: string;
@@ -3337,10 +3388,15 @@ interface components {
             /** @enum {string} */
             object: "job_alert_confirmation";
             /**
-             * @description Outcome of the confirmation. Always returned with HTTP 200 so the consumer renders by status (the token may be valid, stale, or unknown).
+             * @description Outcome of the confirmation. Always returned with HTTP 200 so the consumer renders by status (the token may be valid, stale, or unknown). `waitlisted`: the job alert is confirmed, but the board can't send to more people yet, so it starts once a spot opens. `unsubscribed`: a job-alert link sent before the alerts were turned off, which doesn't turn them back on. The subscription form sends an address that unsubscribed no confirmation email; resume alerts with the manage token (`POST /boards/{identifier}/job-alerts/resubscribe`) or a signed-in alert create.
              * @enum {string}
              */
-            status: "confirmed" | "already_confirmed" | "expired" | "not_found";
+            status: "confirmed" | "already_confirmed" | "expired" | "not_found" | "waitlisted" | "unsubscribed";
+            /**
+             * @description What the link confirms: `marketing` for a link from a newsletter sign-up (`POST /boards/{identifier}/subscribe`), which signs the person up for the board's email and never turns job alerts on, or `job_alerts`. Word the outcome by it. Present on a refused link too (`expired`, `not_found` or `unsubscribed`). Absent when the token is unknown or isn't a confirmation link.
+             * @enum {string}
+             */
+            subscription?: "job_alerts" | "marketing";
         };
         PublicJobAlertManageResult: {
             /** @enum {string} */
@@ -3624,6 +3680,17 @@ interface components {
              */
             offset?: number;
         };
+        PublicSubscriptionRequest: {
+            /** @enum {string} */
+            object: "subscription_request";
+            /**
+             * @description Always `submitted`, whether the address is new, waiting to confirm or already subscribed, so the response can't be used to find out who is subscribed. Unless the person already gets the board's email, a confirmation email has been sent; nothing is sent to them until they click it.
+             * @enum {string}
+             */
+            status: "submitted";
+            /** @description The board's marketing email is paused (too many bounces or spam reports). Sign-ups are still recorded; tell the person emails may be delayed. */
+            sendingPaused: boolean;
+        };
         PublicTalentPlace: {
             /** @enum {string} */
             object: "talent_place";

package/dist/{_spec-t2B6ioRS.d.ts → _spec-Dk7QyuoJ.d.ts}

@@ -428,6 +428,17 @@ interface components {
             definition: components["schemas"]["CustomFieldDefinition"];
         };
         BoardJobFormField: components["schemas"]["BoardFormBuiltinField"] | components["schemas"]["BoardJobFormCustomField"] | components["schemas"]["BoardJobFormCollectionField"];
+        BoardMarketingTopic: {
+            /**
+             * @description String representing the object's type. Objects of the same type share the same value.
+             * @enum {string}
+             */
+            object: "marketing_topic";
+            /** @description The topic’s key, which a sign-up sends in `topics` when the person ticks it. */
+            key: string;
+            /** @description The topic’s name, to label its checkbox. */
+            name: string;
+        };
         /** @description An MCP Server Card (SEP-2127): what an assistant needs to find and connect to the server before it connects. It lists no tools; `tools/list` on the server does. */
         BoardMcpServerCard: {
             /** @description The Server Card JSON Schema this document follows: `https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json`. */
@@ -550,6 +561,29 @@ interface components {
             /** @description ISO 8601 timestamp of the newest content in the bucket, when the board tracks one. */
             lastModified?: string;
         };
+        BoardSubscribeBody: {
+            /**
+             * Format: email
+             * @description The address to sign up. It gets a confirmation email.
+             */
+            email: string;
+            /**
+             * @description Must be `true`: the person ticked an unticked checkbox agreeing to `consentText`.
+             * @enum {boolean}
+             */
+            consent: true;
+            /** @description The checkbox wording the person agreed to, exactly as shown, such as "Send me news and offers from Acme Jobs." It must contain the board's name (any letter case), or the request is refused with 400. Kept with the consent once the person confirms. */
+            consentText: string;
+            /** @description A label for the form, such as `blog-footer`: lowercase letters, digits and hyphens, up to 64 characters. It shows as the contact's Source. */
+            source: string;
+            /**
+             * Format: uri
+             * @description The page the form was on. Defaults to the request's `Referer`.
+             */
+            pageUrl?: string;
+            /** @description Honeypot. Render it as a hidden field that people leave empty; when it is filled in, the request answers `submitted` and does nothing. */
+            website?: string;
+        };
         BoardUser: {
             /** @description Board user ID. */
             id: string;
@@ -2099,6 +2133,12 @@ interface components {
             features: {
                 key: string | null;
                 value: string | null;
+                /** @description The feature's display name, including an operator-defined custom attribute's name. */
+                name: string;
+                /** @description How to read `value`, such as `integer`, `boolean` or `string`. */
+                dataType: string;
+                /** @description The operator-set order among the plan features; null when unset. */
+                displayOrder: number | null;
             }[];
         };
         JobPostingResult: {
@@ -2322,6 +2362,11 @@ interface components {
             returnPath: string;
             /** @enum {string} */
             colorMode: "light" | "dark";
+            /**
+             * @description When the buyer leaves for `returnPath`. `always` (default): every completed checkout redirects there. `if_required`: a card payment completes in place and the embedding page reacts to Stripe.js `onComplete` (then reads `GET …/membership/checkout/{sessionId}`); only a payment method that needs a redirect returns to `returnPath`.
+             * @enum {string}
+             */
+            redirectOnCompletion?: "always" | "if_required";
         };
         Message: {
             id: string;
@@ -2362,6 +2407,12 @@ interface components {
                 [key: string]: components["schemas"]["ProfileFieldMedia"][];
             };
         };
+        MyCompanyProfileFieldValuesResponse: components["schemas"]["ProfileFieldValuesResponse"] & {
+            /** @description Resolved files for the company’s saved `image_gallery` and `file` values, keyed by field key like `values`, in the stored order, including private fields. Each file `id` matches a value in `values`. `url` is a signed link for the company’s members that expires after at least 24 hours, so read it from the response rather than storing it. Unsaved uploads are not listed. Fields with no files are omitted. */
+            customFieldMedia: {
+                [key: string]: components["schemas"]["ProfileFieldMedia"][];
+            };
+        };
         MyItemVerification: components["schemas"]["ItemVerification"] & {
             /** @description The verification's id. For an item with no verification yet (`unverified`), its `itemKey`. */
             id?: string;
@@ -3337,10 +3388,15 @@ interface components {
             /** @enum {string} */
             object: "job_alert_confirmation";
             /**
-             * @description Outcome of the confirmation. Always returned with HTTP 200 so the consumer renders by status (the token may be valid, stale, or unknown).
+             * @description Outcome of the confirmation. Always returned with HTTP 200 so the consumer renders by status (the token may be valid, stale, or unknown). `waitlisted`: the job alert is confirmed, but the board can't send to more people yet, so it starts once a spot opens. `unsubscribed`: a job-alert link sent before the alerts were turned off, which doesn't turn them back on. The subscription form sends an address that unsubscribed no confirmation email; resume alerts with the manage token (`POST /boards/{identifier}/job-alerts/resubscribe`) or a signed-in alert create.
              * @enum {string}
              */
-            status: "confirmed" | "already_confirmed" | "expired" | "not_found";
+            status: "confirmed" | "already_confirmed" | "expired" | "not_found" | "waitlisted" | "unsubscribed";
+            /**
+             * @description What the link confirms: `marketing` for a link from a newsletter sign-up (`POST /boards/{identifier}/subscribe`), which signs the person up for the board's email and never turns job alerts on, or `job_alerts`. Word the outcome by it. Present on a refused link too (`expired`, `not_found` or `unsubscribed`). Absent when the token is unknown or isn't a confirmation link.
+             * @enum {string}
+             */
+            subscription?: "job_alerts" | "marketing";
         };
         PublicJobAlertManageResult: {
             /** @enum {string} */
@@ -3624,6 +3680,17 @@ interface components {
              */
             offset?: number;
         };
+        PublicSubscriptionRequest: {
+            /** @enum {string} */
+            object: "subscription_request";
+            /**
+             * @description Always `submitted`, whether the address is new, waiting to confirm or already subscribed, so the response can't be used to find out who is subscribed. Unless the person already gets the board's email, a confirmation email has been sent; nothing is sent to them until they click it.
+             * @enum {string}
+             */
+            status: "submitted";
+            /** @description The board's marketing email is paused (too many bounces or spam reports). Sign-ups are still recorded; tell the person emails may be delayed. */
+            sendingPaused: boolean;
+        };
         PublicTalentPlace: {
             /** @enum {string} */
             object: "talent_place";

package/dist/{blog-W1cBNXyS.d.ts → blog-DfUNkngR.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-t2B6ioRS.js';
+import { S as Schemas } from './_spec-Dk7QyuoJ.js';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];

package/dist/{blog-B8UJJza1.d.mts → blog-Oo6YHXSE.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-t2B6ioRS.mjs';
+import { S as Schemas } from './_spec-Dk7QyuoJ.mjs';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];

package/dist/{board-On_r_ixp.d.ts → board-CfmGT0yV.d.ts}

@@ -1,5 +1,5 @@
-import { S as Schemas } from './_spec-t2B6ioRS.js';
-import { L as ListEnvelope, v as RelatedSearch, b as CustomFieldFilter, O as ObjectReferenceFilter, a as JobCapability } from './jobs-D_LjWgIk.js';
+import { S as Schemas } from './_spec-Dk7QyuoJ.js';
+import { L as ListEnvelope, v as RelatedSearch, b as CustomFieldFilter, O as ObjectReferenceFilter, a as JobCapability } from './jobs-BlAsTCQl.js';
 
 type PublicCompany = Schemas['CompanyPublic'];
 /**

package/dist/{board-8RMVpFBw.d.mts → board-DzBYIwKz.d.mts}

@@ -1,5 +1,5 @@
-import { S as Schemas } from './_spec-t2B6ioRS.mjs';
-import { L as ListEnvelope, v as RelatedSearch, b as CustomFieldFilter, O as ObjectReferenceFilter, a as JobCapability } from './jobs-CrGBikhJ.mjs';
+import { S as Schemas } from './_spec-Dk7QyuoJ.mjs';
+import { L as ListEnvelope, v as RelatedSearch, b as CustomFieldFilter, O as ObjectReferenceFilter, a as JobCapability } from './jobs-BMRvZlNx.mjs';
 
 type PublicCompany = Schemas['CompanyPublic'];
 /**

package/dist/{breadcrumbs-eV2OQqf6.d.ts → breadcrumbs-CS0nlknq.d.ts}

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-On_r_ixp.js';
-import { P as PublicJob } from './jobs-D_LjWgIk.js';
+import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-CfmGT0yV.js';
+import { P as PublicJob } from './jobs-BlAsTCQl.js';
 
 /**
  * Wire enum for `salaryTimeframe`. Defined here (not re-exported from any

package/dist/{breadcrumbs-BgBj_AiZ.d.mts → breadcrumbs-DeIA0RQp.d.mts}

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-8RMVpFBw.mjs';
-import { P as PublicJob } from './jobs-CrGBikhJ.mjs';
+import { P as PublicBoard, a as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './board-DzBYIwKz.mjs';
+import { P as PublicJob } from './jobs-BMRvZlNx.mjs';
 
 /**
  * Wire enum for `salaryTimeframe`. Defined here (not re-exported from any