@cavuno/board 1.28.0 → 1.29.0

package/dist/bin.mjs

@@ -1,11 +1,4 @@
 #!/usr/bin/env node
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
 
 // src/skills.ts
 import { readFileSync } from "fs";
@@ -14,26 +7,335 @@ import { fileURLToPath } from "url";
 function packageRoot() {
   return resolve(dirname(fileURLToPath(import.meta.url)), "..");
 }
-function resolveFromPackageRoot(relativePath) {
-  return resolve(packageRoot(), relativePath);
+function resolveFromPackageRoot(relativePath, baseDir) {
+  return resolve(baseDir ?? packageRoot(), relativePath);
 }
-function loadSkillManifest() {
-  const manifestPath = resolveFromPackageRoot("skills/manifest.json");
+function loadSkillManifest(baseDir) {
+  const manifestPath = resolveFromPackageRoot("skills/manifest.json", baseDir);
   return JSON.parse(readFileSync(manifestPath, "utf8"));
 }
-var init_skills = __esm({
-  "src/skills.ts"() {
-    "use strict";
+function loadSkillCorpus(baseDir) {
+  const manifest = loadSkillManifest(baseDir);
+  return {
+    version: manifest.version,
+    skills: manifest.skills.map((skill) => ({
+      ...skill,
+      content: readFileSync(
+        resolveFromPackageRoot(skill.path, baseDir),
+        "utf8"
+      )
+    }))
+  };
+}
+
+// src/doctor/checks.ts
+function record(id, tier) {
+  return (status, detail) => ({
+    id,
+    tier,
+    status,
+    detail
+  });
+}
+var ENV_API_URL = record("env.api-url", 1);
+var ENV_BOARD_KEY = record("env.board-key", 1);
+var PK_RE = /^pk_[0-9a-f]{32}$/;
+function checkEnv(env) {
+  const results = [];
+  if (!env.apiUrl) {
+    results.push(ENV_API_URL("fail", "PUBLIC_CAVUNO_API_URL is not set"));
+  } else {
+    let origin = null;
+    try {
+      origin = new URL(env.apiUrl).origin;
+    } catch {
+      origin = null;
+    }
+    results.push(
+      origin ? ENV_API_URL("pass", origin) : ENV_API_URL(
+        "fail",
+        `PUBLIC_CAVUNO_API_URL is not a valid URL: ${env.apiUrl}`
+      )
+    );
+  }
+  if (!env.boardKey) {
+    results.push(ENV_BOARD_KEY("fail", "PUBLIC_CAVUNO_BOARD is not set"));
+  } else {
+    results.push(
+      PK_RE.test(env.boardKey) ? ENV_BOARD_KEY("pass", "pk_ key") : ENV_BOARD_KEY(
+        "fail",
+        "PUBLIC_CAVUNO_BOARD must be a publishable key (pk_ + 32 hex chars)"
+      )
+    );
   }
-});
+  return results;
+}
+var JOB_DETAIL_LINK_RE = /href="(\/companies\/[a-z0-9-]+\/jobs\/[a-z0-9-]+)"/i;
+function extractJobDetailLink(html) {
+  return html.match(JOB_DETAIL_LINK_RE)?.[1] ?? null;
+}
+var JSON_LD_RE = /<script[^>]*type="application\/ld\+json"[^>]*>([\s\S]*?)<\/script>/gi;
+function extractJobPostingJsonLd(html) {
+  for (const match of html.matchAll(JSON_LD_RE)) {
+    try {
+      const parsed = JSON.parse(match[1].trim());
+      if (parsed["@type"] === "JobPosting") return parsed;
+    } catch {
+    }
+  }
+  return null;
+}
+var LOC_RE = /<loc>([^<]+)<\/loc>/gi;
+function parseSitemap(xml) {
+  const kind = /<urlset[\s>]/i.test(xml) ? "urlset" : /<sitemapindex[\s>]/i.test(xml) ? "index" : null;
+  if (!kind) return null;
+  return { kind, urls: [...xml.matchAll(LOC_RE)].map((m) => m[1].trim()) };
+}
+function summarize(results) {
+  const passed = results.filter((r) => r.status === "pass").map((r) => r.id);
+  const failed = results.filter((r) => r.status === "fail").map((r) => r.id);
+  const skipped = results.filter((r) => r.status === "skip").map((r) => r.id);
+  return { exitCode: failed.length > 0 ? 1 : 0, passed, failed, skipped };
+}
+
+// src/doctor/run.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join } from "path";
+var FETCH_TIMEOUT_MS = 1e4;
+var READ = {
+  home: record("read.home", 2),
+  jobs: record("read.jobs", 2),
+  jsonld: record("read.jsonld", 2),
+  sitemap: record("read.sitemap", 2),
+  robots: record("read.robots", 2)
+};
+var STATIC_API = record("static.api", 1);
+var STATIC_BOARD = record("static.board", 1);
+var STATIC_SKILLS = record("static.skills", 1);
+async function probe(fetchImpl, url) {
+  try {
+    const response = await fetchImpl(url, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    return {
+      ok: response.ok,
+      status: response.status,
+      body: await response.text()
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      status: 0,
+      body: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkApiReachable(fetchImpl, apiUrl) {
+  let origin;
+  try {
+    origin = new URL(apiUrl).origin;
+  } catch {
+    return null;
+  }
+  const spec = await probe(fetchImpl, `${origin}/api/v1/openapi.json`);
+  const result = spec.ok ? spec : await probe(fetchImpl, `${origin}/v1/openapi.json`);
+  if (!result.ok) {
+    return STATIC_API(
+      "fail",
+      `OpenAPI spec unreachable (HTTP ${result.status})`
+    );
+  }
+  try {
+    const parsed = JSON.parse(result.body);
+    if (typeof parsed.openapi !== "string") throw new Error("not a spec");
+  } catch {
+    return STATIC_API(
+      "fail",
+      "endpoint returned 200 but not an OpenAPI document \u2014 proxy or captive portal in the way?"
+    );
+  }
+  return STATIC_API("pass", "OpenAPI spec reachable");
+}
+async function checkBoardResolves(fetchImpl, env) {
+  const origin = new URL(env.apiUrl).origin;
+  const result = await probe(
+    fetchImpl,
+    `${origin}/v1/boards/${encodeURIComponent(env.boardKey)}`
+  );
+  if (!result.ok) {
+    return STATIC_BOARD(
+      "fail",
+      `board did not resolve for this key (HTTP ${result.status}) \u2014 revoked or wrong key?`
+    );
+  }
+  try {
+    const parsed = JSON.parse(result.body);
+    if (typeof parsed !== "object" || parsed === null) throw new Error("shape");
+  } catch {
+    return STATIC_BOARD(
+      "fail",
+      "board endpoint returned 200 but not JSON \u2014 proxy or captive portal in the way?"
+    );
+  }
+  return STATIC_BOARD("pass", "publishable key resolves the board");
+}
+var SKILL_ROOTS = [".claude/skills", ".agents/skills"];
+function checkSkillsFreshness(projectRoot) {
+  const roots = SKILL_ROOTS.map((root) => join(projectRoot, root)).filter(
+    (root) => existsSync(root)
+  );
+  if (roots.length === 0) {
+    return STATIC_SKILLS(
+      "skip",
+      "no .claude/skills or .agents/skills directory \u2014 run `npx @cavuno/board setup` to install agent skills"
+    );
+  }
+  const corpus = loadSkillCorpus();
+  const stale = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  for (const root of roots) {
+    for (const skill of corpus.skills) {
+      const copied = join(root, skill.name, "SKILL.md");
+      if (!existsSync(copied)) continue;
+      seen.add(skill.name);
+      if (readFileSync2(copied, "utf8") !== skill.content) {
+        stale.add(skill.name);
+      }
+    }
+  }
+  const found = seen.size;
+  if (found === 0) {
+    return STATIC_SKILLS(
+      "skip",
+      "no cavuno-board-* skills installed \u2014 run `npx @cavuno/board setup`"
+    );
+  }
+  return stale.size === 0 ? STATIC_SKILLS(
+    "pass",
+    `${found} installed skills match v${corpus.version}`
+  ) : STATIC_SKILLS(
+    "fail",
+    `stale skills (re-run \`npx @cavuno/board setup\`): ${[...stale].join(", ")}`
+  );
+}
+async function probeJobsAndJsonLd(fetchImpl, base) {
+  const jobs = await probe(fetchImpl, `${base}/jobs`);
+  const jobLink = jobs.ok ? extractJobDetailLink(jobs.body) : null;
+  const jobsResult = jobs.ok && jobLink ? READ.jobs("pass", `listing renders with job detail links (${jobLink})`) : READ.jobs(
+    "fail",
+    jobs.ok ? "listing renders but contains no /companies/{c}/jobs/{s} detail links" : `listing HTTP ${jobs.status}`
+  );
+  if (!jobLink) {
+    return [
+      jobsResult,
+      READ.jsonld(
+        "skip",
+        jobs.ok ? "not probed \u2014 the listing rendered no job detail link (see read.jobs failure)" : "not probed \u2014 the /jobs listing itself failed (see read.jobs failure)"
+      )
+    ];
+  }
+  const detail = await probe(fetchImpl, `${base}${jobLink}`);
+  const posting = detail.ok ? extractJobPostingJsonLd(detail.body) : null;
+  return [
+    jobsResult,
+    posting ? READ.jsonld(
+      "pass",
+      `JobPosting JSON-LD present (${String(posting.title ?? "")})`
+    ) : READ.jsonld(
+      "fail",
+      detail.ok ? "job detail page has no parseable JobPosting JSON-LD" : `job detail HTTP ${detail.status}`
+    )
+  ];
+}
+function onFrontend(base, locUrl) {
+  try {
+    const parsed = new URL(locUrl);
+    return `${base}${parsed.pathname}${parsed.search}`;
+  } catch {
+    return locUrl;
+  }
+}
+async function probeSitemap(fetchImpl, base) {
+  const sitemap = await probe(fetchImpl, `${base}/sitemap.xml`);
+  if (!sitemap.ok) {
+    return READ.sitemap("fail", `sitemap.xml HTTP ${sitemap.status}`);
+  }
+  const doc = parseSitemap(sitemap.body);
+  if (!doc || doc.urls.length === 0) {
+    return READ.sitemap(
+      "fail",
+      doc ? "sitemap.xml has no <loc> entries" : "sitemap.xml is not a sitemap"
+    );
+  }
+  let urls = doc.urls;
+  if (doc.kind === "index") {
+    const child = await probe(fetchImpl, onFrontend(base, urls[0]));
+    const childDoc = child.ok ? parseSitemap(child.body) : null;
+    if (!childDoc || childDoc.urls.length === 0) {
+      return READ.sitemap(
+        "fail",
+        `child sitemap ${urls[0]} ${child.ok ? "has no <loc> entries" : `HTTP ${child.status}`}`
+      );
+    }
+    urls = childDoc.urls;
+  }
+  const sampleUrl = onFrontend(base, urls[0]);
+  const sample = await probe(fetchImpl, sampleUrl);
+  return sample.ok ? READ.sitemap("pass", `${urls.length} entries; sample page resolves`) : READ.sitemap("fail", `sitemap page ${sampleUrl} \u2192 HTTP ${sample.status}`);
+}
+async function runDoctor(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const results = [];
+  const envResults = checkEnv(options.env);
+  results.push(...envResults);
+  const envOk = envResults.every((r) => r.status === "pass");
+  if (options.env.apiUrl) {
+    const api = await checkApiReachable(fetchImpl, options.env.apiUrl);
+    results.push(
+      api ?? STATIC_API("skip", "API URL malformed \u2014 fix env.api-url first")
+    );
+  } else {
+    results.push(STATIC_API("skip", "PUBLIC_CAVUNO_API_URL not set"));
+  }
+  results.push(
+    envOk ? await checkBoardResolves(fetchImpl, options.env) : STATIC_BOARD("skip", "env checks failed \u2014 fix them first")
+  );
+  results.push(checkSkillsFreshness(options.projectRoot ?? process.cwd()));
+  if (!options.frontendUrl) {
+    for (const make of Object.values(READ)) {
+      results.push(make("skip", "no --frontend <url> given"));
+    }
+    return { results, summary: summarize(results) };
+  }
+  const base = options.frontendUrl.replace(/\/$/, "");
+  const [home, jobsAndJsonLd, sitemap, robots] = await Promise.all([
+    probe(fetchImpl, base),
+    probeJobsAndJsonLd(fetchImpl, base),
+    probeSitemap(fetchImpl, base),
+    probe(fetchImpl, `${base}/robots.txt`)
+  ]);
+  results.push(
+    home.ok && /<(html|body|div|main)[\s>]/i.test(home.body) ? READ.home("pass", "home renders") : READ.home(
+      "fail",
+      home.ok ? "home returned 200 but no HTML document \u2014 captive portal or empty shell?" : `home HTTP ${home.status}`
+    ),
+    ...jobsAndJsonLd,
+    sitemap,
+    robots.ok && /user-agent\s*:/i.test(robots.body) ? READ.robots("pass", "present") : READ.robots(
+      "fail",
+      robots.ok ? "robots.txt returned 200 but has no User-agent directive" : `robots.txt HTTP ${robots.status}`
+    )
+  );
+  return { results, summary: summarize(results) };
+}
 
 // src/setup/run.ts
-import { cpSync, existsSync, mkdirSync, readFileSync as readFileSync2 } from "fs";
+import { cpSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3 } from "fs";
 import { dirname as dirname2, resolve as resolve2 } from "path";
 function detectFramework(cwd) {
   const pkgPath = resolve2(cwd, "package.json");
-  if (!existsSync(pkgPath)) return null;
-  const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+  if (!existsSync2(pkgPath)) return null;
+  const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   if (deps["@tanstack/react-start"]) return "tanstack-start";
   return null;
@@ -48,7 +350,7 @@ function runSetup(cwd = process.cwd()) {
     resolve2(cwd, ".claude", "skills"),
     resolve2(cwd, ".agents", "skills")
   ];
-  const existing = roots.filter((root) => existsSync(root));
+  const existing = roots.filter((root) => existsSync2(root));
   const targetDirs = existing.length > 0 ? existing : [roots[0]];
   const copied = [];
   for (const targetDir of targetDirs) {
@@ -63,45 +365,72 @@ function runSetup(cwd = process.cwd()) {
   }
   return { version: manifest.version, framework, targetDirs, copied };
 }
-var init_run = __esm({
-  "src/setup/run.ts"() {
-    "use strict";
-    init_skills();
-  }
-});
 
 // src/bin.ts
-var require_bin = __commonJS({
-  "src/bin.ts"() {
-    init_run();
-    function main() {
-      if (process.argv[2] !== "setup") {
-        console.error("Usage: cavuno-board setup");
-        process.exit(1);
-      }
-      const result = runSetup();
-      console.log(`
-@cavuno/board setup \u2014 v${result.version}`);
-      console.log(
-        `Detected framework: ${result.framework ?? "none (core skills only)"}`
-      );
-      console.log(
-        `Copied ${result.copied.length} skills \u2192 ${result.targetDirs.join(", ")}`
-      );
-      for (const name of result.copied) console.log(`  - ${name}`);
-      console.log("\nNext steps:");
-      console.log("  1. Set your environment variables:");
-      console.log("       PUBLIC_CAVUNO_API_URL=https://api.cavuno.com");
-      console.log(
-        "       PUBLIC_CAVUNO_BOARD=pk_...   # your board publishable key"
-      );
-      console.log('  2. Ask your coding agent: "set up my Cavuno board".');
-      console.log("     It reads the cavuno-board-setup skill first.");
-      console.log(
-        "\n  Re-run `npx @cavuno/board setup` after upgrading to refresh skills."
-      );
-    }
-    main();
+async function doctor(argv) {
+  const frontendFlag = argv.indexOf("--frontend");
+  const frontendUrl = frontendFlag >= 0 ? argv[frontendFlag + 1] : void 0;
+  const { results, summary } = await runDoctor({
+    env: {
+      apiUrl: process.env.PUBLIC_CAVUNO_API_URL,
+      boardKey: process.env.PUBLIC_CAVUNO_BOARD
+    },
+    frontendUrl
+  });
+  console.log("\n@cavuno/board doctor");
+  for (const result of results) {
+    const mark = result.status === "pass" ? "\u2713" : result.status === "fail" ? "\u2717" : "\u2212";
+    console.log(
+      `  ${mark} [tier ${result.tier}] ${result.id} \u2014 ${result.detail}`
+    );
+  }
+  console.log(
+    `
+${summary.passed.length} passed, ${summary.failed.length} failed, ${summary.skipped.length} skipped`
+  );
+  if (summary.skipped.length > 0) {
+    console.log(`  Skipped (NOT verified): ${summary.skipped.join(", ")}`);
+  }
+  if (!frontendUrl) {
+    console.log(
+      "  Pass --frontend <url> to run the read probes against your board frontend."
+    );
   }
-});
-export default require_bin();
+  process.exit(summary.exitCode);
+}
+function main() {
+  const verb = process.argv[2];
+  if (verb === "doctor") {
+    doctor(process.argv.slice(3)).catch((error) => {
+      console.error("doctor crashed:", error);
+      process.exit(1);
+    });
+    return;
+  }
+  if (verb !== "setup") {
+    console.error("Usage: cavuno-board <setup|doctor>");
+    process.exit(1);
+  }
+  const result = runSetup();
+  console.log(`
+@cavuno/board setup \u2014 v${result.version}`);
+  console.log(
+    `Detected framework: ${result.framework ?? "none (core skills only)"}`
+  );
+  console.log(
+    `Copied ${result.copied.length} skills \u2192 ${result.targetDirs.join(", ")}`
+  );
+  for (const name of result.copied) console.log(`  - ${name}`);
+  console.log("\nNext steps:");
+  console.log("  1. Set your environment variables:");
+  console.log("       PUBLIC_CAVUNO_API_URL=https://api.cavuno.com");
+  console.log(
+    "       PUBLIC_CAVUNO_BOARD=pk_...   # your board publishable key"
+  );
+  console.log('  2. Ask your coding agent: "set up my Cavuno board".');
+  console.log("     It reads the cavuno-board-setup skill first.");
+  console.log(
+    "\n  Re-run `npx @cavuno/board setup` after upgrading to refresh skills."
+  );
+}
+main();

package/dist/index.d.mts

@@ -203,7 +203,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "1.28.0";
+declare const SDK_VERSION = "1.29.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {

package/dist/index.d.ts

@@ -203,7 +203,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "1.28.0";
+declare const SDK_VERSION = "1.29.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {

package/dist/index.js

@@ -179,7 +179,7 @@ var BoardApiError = class extends Error {
   }
 };
 function isBoardApiError(e) {
-  return e instanceof Error && e.name === "BoardApiError";
+  return e instanceof Error && e.name === "BoardApiError" && typeof e.status === "number" && typeof e.code === "string";
 }
 function isNotFound(e) {
   return isBoardApiError(e) && e.status === 404;
@@ -221,6 +221,16 @@ function toSearchParams(query) {
   return params;
 }
 
+// src/scope.ts
+function scopeToken(board) {
+  let hash = 5381;
+  for (let i = 0; i < board.length; i++) {
+    hash = (hash << 5) + hash + board.charCodeAt(i) >>> 0;
+  }
+  const sanitized = board.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return `${sanitized}-${hash.toString(36)}`;
+}
+
 // src/storage.ts
 var ACCESS_TOKEN_KEY = "cavuno_board_access_token";
 var REFRESH_TOKEN_KEY = "cavuno_board_refresh_token";
@@ -240,9 +250,6 @@ function memoryStorage() {
     }
   };
 }
-function scopeToken(board) {
-  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
-}
 function browserStorage(mode, scope) {
   if (!isBrowser()) {
     throw new Error(
@@ -303,7 +310,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.28.0";
+var SDK_VERSION = "1.29.0";
 
 // src/client.ts
 function isRawBody(body) {

package/dist/index.mjs

@@ -134,7 +134,7 @@ var BoardApiError = class extends Error {
   }
 };
 function isBoardApiError(e) {
-  return e instanceof Error && e.name === "BoardApiError";
+  return e instanceof Error && e.name === "BoardApiError" && typeof e.status === "number" && typeof e.code === "string";
 }
 function isNotFound(e) {
   return isBoardApiError(e) && e.status === 404;
@@ -176,6 +176,16 @@ function toSearchParams(query) {
   return params;
 }
 
+// src/scope.ts
+function scopeToken(board) {
+  let hash = 5381;
+  for (let i = 0; i < board.length; i++) {
+    hash = (hash << 5) + hash + board.charCodeAt(i) >>> 0;
+  }
+  const sanitized = board.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return `${sanitized}-${hash.toString(36)}`;
+}
+
 // src/storage.ts
 var ACCESS_TOKEN_KEY = "cavuno_board_access_token";
 var REFRESH_TOKEN_KEY = "cavuno_board_refresh_token";
@@ -195,9 +205,6 @@ function memoryStorage() {
     }
   };
 }
-function scopeToken(board) {
-  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
-}
 function browserStorage(mode, scope) {
   if (!isBrowser()) {
     throw new Error(
@@ -258,7 +265,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.28.0";
+var SDK_VERSION = "1.29.0";
 
 // src/client.ts
 function isRawBody(body) {

package/dist/server.js

@@ -37,6 +37,16 @@ __export(server_exports, {
 });
 module.exports = __toCommonJS(server_exports);
 
+// src/scope.ts
+function scopeToken(board) {
+  let hash = 5381;
+  for (let i = 0; i < board.length; i++) {
+    hash = (hash << 5) + hash + board.charCodeAt(i) >>> 0;
+  }
+  const sanitized = board.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return `${sanitized}-${hash.toString(36)}`;
+}
+
 // src/server/cookie.ts
 var COOKIE_ATTRIBUTES = "Path=/; HttpOnly; Secure; SameSite=Lax";
 function buildCookie(name, value, maxAgeSeconds) {
@@ -57,14 +67,11 @@ function readCookie(header, name) {
     return null;
   }
 }
-function cookieScope(board) {
-  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
-}
 
 // src/server/session.ts
 var SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
 function sessionCookieName(board) {
-  return board ? `${SESSION_COOKIE_NAME}_${cookieScope(board)}` : SESSION_COOKIE_NAME;
+  return board ? `${SESSION_COOKIE_NAME}_${scopeToken(board)}` : SESSION_COOKIE_NAME;
 }
 var COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
 var EXPIRY_WINDOW_MS = 5 * 60 * 1e3;
@@ -104,7 +111,7 @@ function isExpiringSoon(session, now, windowMs = EXPIRY_WINDOW_MS) {
 // src/server/board-access.ts
 var BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
 function grantCookieName(board) {
-  return board ? `${BOARD_ACCESS_COOKIE_NAME}_${cookieScope(board)}` : BOARD_ACCESS_COOKIE_NAME;
+  return board ? `${BOARD_ACCESS_COOKIE_NAME}_${scopeToken(board)}` : BOARD_ACCESS_COOKIE_NAME;
 }
 var COOKIE_MAX_AGE_SECONDS2 = 24 * 60 * 60;
 function serializeGrantCookie(token, options) {
@@ -149,7 +156,7 @@ function currentPathFromReferer(referer) {
 
 // src/errors.ts
 function isBoardApiError(e) {
-  return e instanceof Error && e.name === "BoardApiError";
+  return e instanceof Error && e.name === "BoardApiError" && typeof e.status === "number" && typeof e.code === "string";
 }
 function isUnauthorized(e) {
   return isBoardApiError(e) && e.status === 401;

package/dist/server.mjs

@@ -1,3 +1,13 @@
+// src/scope.ts
+function scopeToken(board) {
+  let hash = 5381;
+  for (let i = 0; i < board.length; i++) {
+    hash = (hash << 5) + hash + board.charCodeAt(i) >>> 0;
+  }
+  const sanitized = board.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return `${sanitized}-${hash.toString(36)}`;
+}
+
 // src/server/cookie.ts
 var COOKIE_ATTRIBUTES = "Path=/; HttpOnly; Secure; SameSite=Lax";
 function buildCookie(name, value, maxAgeSeconds) {
@@ -18,14 +28,11 @@ function readCookie(header, name) {
     return null;
   }
 }
-function cookieScope(board) {
-  return board.replace(/[^a-zA-Z0-9_-]/g, "_");
-}
 
 // src/server/session.ts
 var SESSION_COOKIE_NAME = "__Host-cavuno_board_session";
 function sessionCookieName(board) {
-  return board ? `${SESSION_COOKIE_NAME}_${cookieScope(board)}` : SESSION_COOKIE_NAME;
+  return board ? `${SESSION_COOKIE_NAME}_${scopeToken(board)}` : SESSION_COOKIE_NAME;
 }
 var COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
 var EXPIRY_WINDOW_MS = 5 * 60 * 1e3;
@@ -65,7 +72,7 @@ function isExpiringSoon(session, now, windowMs = EXPIRY_WINDOW_MS) {
 // src/server/board-access.ts
 var BOARD_ACCESS_COOKIE_NAME = "__Host-cavuno_board_access";
 function grantCookieName(board) {
-  return board ? `${BOARD_ACCESS_COOKIE_NAME}_${cookieScope(board)}` : BOARD_ACCESS_COOKIE_NAME;
+  return board ? `${BOARD_ACCESS_COOKIE_NAME}_${scopeToken(board)}` : BOARD_ACCESS_COOKIE_NAME;
 }
 var COOKIE_MAX_AGE_SECONDS2 = 24 * 60 * 60;
 function serializeGrantCookie(token, options) {
@@ -110,7 +117,7 @@ function currentPathFromReferer(referer) {
 
 // src/errors.ts
 function isBoardApiError(e) {
-  return e instanceof Error && e.name === "BoardApiError";
+  return e instanceof Error && e.name === "BoardApiError" && typeof e.status === "number" && typeof e.code === "string";
 }
 function isUnauthorized(e) {
   return isBoardApiError(e) && e.status === 401;

package/dist/skills-types.d.mts

@@ -0,0 +1,20 @@
+/**
+ * Skill-manifest types, split from `skills.ts` so non-Node consumers (the
+ * remote-mcp worker types its `/dev` toolset against the wire shape) can
+ * import them without dragging the Node fs loader into their program.
+ */
+interface SkillManifestEntry {
+    name: string;
+    description: string;
+    /** Path to the SKILL.md, relative to the package root. */
+    path: string;
+    /** Framework slug for flavor skills; `null` for framework-agnostic core skills. */
+    framework: string | null;
+    category: 'core' | 'flavor';
+}
+interface SkillManifest {
+    version: string;
+    skills: SkillManifestEntry[];
+}
+
+export type { SkillManifest, SkillManifestEntry };

package/dist/skills-types.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Skill-manifest types, split from `skills.ts` so non-Node consumers (the
+ * remote-mcp worker types its `/dev` toolset against the wire shape) can
+ * import them without dragging the Node fs loader into their program.
+ */
+interface SkillManifestEntry {
+    name: string;
+    description: string;
+    /** Path to the SKILL.md, relative to the package root. */
+    path: string;
+    /** Framework slug for flavor skills; `null` for framework-agnostic core skills. */
+    framework: string | null;
+    category: 'core' | 'flavor';
+}
+interface SkillManifest {
+    version: string;
+    skills: SkillManifestEntry[];
+}
+
+export type { SkillManifest, SkillManifestEntry };

package/dist/skills-types.js

@@ -0,0 +1,18 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/skills/types.ts
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/skills.d.mts

@@ -1,9 +1,7 @@
 /**
- * Skill-corpus loader. Node-only (reads the shipped `skills/` directory from
- * the installed package) — kept out of the isomorphic core and exposed via the
- * `@cavuno/board/skills` subpath export. Both `npx @cavuno/board setup` and the
- * in-admin sidekick (ADR-0033) read the corpus through here, so the two doors
- * stay fed from one source.
+ * Skill-manifest types, split from `skills.ts` so non-Node consumers (the
+ * remote-mcp worker types its `/dev` toolset against the wire shape) can
+ * import them without dragging the Node fs loader into their program.
  */
 interface SkillManifestEntry {
     name: string;
@@ -18,6 +16,15 @@ interface SkillManifest {
     version: string;
     skills: SkillManifestEntry[];
 }
+
+/**
+ * Skill-corpus loader. Node-only (reads the shipped `skills/` directory from
+ * the installed package) — kept out of the isomorphic core and exposed via the
+ * `@cavuno/board/skills` subpath export. Both `npx @cavuno/board setup` and the
+ * in-admin sidekick (ADR-0033) read the corpus through here, so the two doors
+ * stay fed from one source.
+ */
+
 interface LoadedSkill extends SkillManifestEntry {
     content: string;
 }
@@ -26,13 +33,13 @@ interface SkillCorpus {
     skills: LoadedSkill[];
 }
 /** Resolve a package-root-relative path (e.g. a manifest `path`) to an absolute path. */
-declare function resolveFromPackageRoot(relativePath: string): string;
-declare function loadSkillManifest(): SkillManifest;
+declare function resolveFromPackageRoot(relativePath: string, baseDir?: string): string;
+declare function loadSkillManifest(baseDir?: string): SkillManifest;
 /**
  * Load the full skill corpus — manifest metadata plus each skill's markdown
  * `content`. The sidekick injects `content` into its agent context; an external
  * Claude Code instead receives the files copied by the setup command.
  */
-declare function loadSkillCorpus(): SkillCorpus;
+declare function loadSkillCorpus(baseDir?: string): SkillCorpus;
 
 export { type LoadedSkill, type SkillCorpus, type SkillManifest, type SkillManifestEntry, loadSkillCorpus, loadSkillManifest, resolveFromPackageRoot };

package/dist/skills.d.ts

@@ -1,9 +1,7 @@
 /**
- * Skill-corpus loader. Node-only (reads the shipped `skills/` directory from
- * the installed package) — kept out of the isomorphic core and exposed via the
- * `@cavuno/board/skills` subpath export. Both `npx @cavuno/board setup` and the
- * in-admin sidekick (ADR-0033) read the corpus through here, so the two doors
- * stay fed from one source.
+ * Skill-manifest types, split from `skills.ts` so non-Node consumers (the
+ * remote-mcp worker types its `/dev` toolset against the wire shape) can
+ * import them without dragging the Node fs loader into their program.
  */
 interface SkillManifestEntry {
     name: string;
@@ -18,6 +16,15 @@ interface SkillManifest {
     version: string;
     skills: SkillManifestEntry[];
 }
+
+/**
+ * Skill-corpus loader. Node-only (reads the shipped `skills/` directory from
+ * the installed package) — kept out of the isomorphic core and exposed via the
+ * `@cavuno/board/skills` subpath export. Both `npx @cavuno/board setup` and the
+ * in-admin sidekick (ADR-0033) read the corpus through here, so the two doors
+ * stay fed from one source.
+ */
+
 interface LoadedSkill extends SkillManifestEntry {
     content: string;
 }
@@ -26,13 +33,13 @@ interface SkillCorpus {
     skills: LoadedSkill[];
 }
 /** Resolve a package-root-relative path (e.g. a manifest `path`) to an absolute path. */
-declare function resolveFromPackageRoot(relativePath: string): string;
-declare function loadSkillManifest(): SkillManifest;
+declare function resolveFromPackageRoot(relativePath: string, baseDir?: string): string;
+declare function loadSkillManifest(baseDir?: string): SkillManifest;
 /**
  * Load the full skill corpus — manifest metadata plus each skill's markdown
  * `content`. The sidekick injects `content` into its agent context; an external
  * Claude Code instead receives the files copied by the setup command.
  */
-declare function loadSkillCorpus(): SkillCorpus;
+declare function loadSkillCorpus(baseDir?: string): SkillCorpus;
 
 export { type LoadedSkill, type SkillCorpus, type SkillManifest, type SkillManifestEntry, loadSkillCorpus, loadSkillManifest, resolveFromPackageRoot };

package/dist/skills.js

@@ -37,20 +37,23 @@ var import_node_url = require("url");
 function packageRoot() {
   return (0, import_node_path.resolve)((0, import_node_path.dirname)((0, import_node_url.fileURLToPath)(importMetaUrl)), "..");
 }
-function resolveFromPackageRoot(relativePath) {
-  return (0, import_node_path.resolve)(packageRoot(), relativePath);
+function resolveFromPackageRoot(relativePath, baseDir) {
+  return (0, import_node_path.resolve)(baseDir ?? packageRoot(), relativePath);
 }
-function loadSkillManifest() {
-  const manifestPath = resolveFromPackageRoot("skills/manifest.json");
+function loadSkillManifest(baseDir) {
+  const manifestPath = resolveFromPackageRoot("skills/manifest.json", baseDir);
   return JSON.parse((0, import_node_fs.readFileSync)(manifestPath, "utf8"));
 }
-function loadSkillCorpus() {
-  const manifest = loadSkillManifest();
+function loadSkillCorpus(baseDir) {
+  const manifest = loadSkillManifest(baseDir);
   return {
     version: manifest.version,
     skills: manifest.skills.map((skill) => ({
       ...skill,
-      content: (0, import_node_fs.readFileSync)(resolveFromPackageRoot(skill.path), "utf8")
+      content: (0, import_node_fs.readFileSync)(
+        resolveFromPackageRoot(skill.path, baseDir),
+        "utf8"
+      )
     }))
   };
 }

package/dist/skills.mjs

@@ -5,20 +5,23 @@ import { fileURLToPath } from "url";
 function packageRoot() {
   return resolve(dirname(fileURLToPath(import.meta.url)), "..");
 }
-function resolveFromPackageRoot(relativePath) {
-  return resolve(packageRoot(), relativePath);
+function resolveFromPackageRoot(relativePath, baseDir) {
+  return resolve(baseDir ?? packageRoot(), relativePath);
 }
-function loadSkillManifest() {
-  const manifestPath = resolveFromPackageRoot("skills/manifest.json");
+function loadSkillManifest(baseDir) {
+  const manifestPath = resolveFromPackageRoot("skills/manifest.json", baseDir);
   return JSON.parse(readFileSync(manifestPath, "utf8"));
 }
-function loadSkillCorpus() {
-  const manifest = loadSkillManifest();
+function loadSkillCorpus(baseDir) {
+  const manifest = loadSkillManifest(baseDir);
   return {
     version: manifest.version,
     skills: manifest.skills.map((skill) => ({
       ...skill,
-      content: readFileSync(resolveFromPackageRoot(skill.path), "utf8")
+      content: readFileSync(
+        resolveFromPackageRoot(skill.path, baseDir),
+        "utf8"
+      )
     }))
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cavuno/board",
-  "version": "1.28.0",
+  "version": "1.29.0",
   "description": "Typed isomorphic client for the Cavuno Board API",
   "license": "MIT",
   "type": "commonjs",
@@ -100,6 +100,16 @@
         "default": "./dist/skills.js"
       }
     },
+    "./skills/types": {
+      "import": {
+        "types": "./dist/skills-types.d.mts",
+        "default": "./dist/skills-types.mjs"
+      },
+      "require": {
+        "types": "./dist/skills-types.d.ts",
+        "default": "./dist/skills-types.js"
+      }
+    },
     "./skills/*": "./skills/*"
   },
   "files": [

package/skills/cavuno-board-smoke-test/SKILL.md

@@ -15,6 +15,20 @@ auth, and SEO surfaces behave. Verify at runtime, in this order.
 - After upgrading `@cavuno/board` or rotating the `pk_…` key.
 - When any surface renders empty and you don't know which layer is wrong.
 
+## 0 — Run `doctor` first (deterministic pass)
+
+```bash
+PUBLIC_CAVUNO_API_URL=... PUBLIC_CAVUNO_BOARD=pk_... \
+  npx @cavuno/board doctor --frontend http://localhost:3000
+```
+
+Doctor codifies the static checks (env shape, API reachability) and the
+read probes (home/jobs render, JobPosting JSON-LD, sitemap, robots) as
+pass/fail/skip with a non-zero exit on failure — anything it SKIPS is
+named in its summary and still needs the manual checks below. Use the
+rest of this skill for the behavioral checks doctor does not automate
+(auth flows, gating semantics, production build).
+
 ## 1 — Probe the API directly (before blaming app code)
 
 Use the real env values the app reads (`PUBLIC_CAVUNO_API_URL`,

package/skills/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.28.0",
+  "version": "1.29.0",
   "skills": [
     {
       "name": "cavuno-board-account",